- org/owasp/dependencycheck/data/lucene/package-info.java
+ org/owasp/dependencycheck/data/update/StandardUpdate.java
0
@@ -71,34 +71,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/update/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/update/StandardUpdate.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -113,20 +85,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/update/exception/InvalidDataException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -144,21 +102,7 @@ under the License.
- org/owasp/dependencycheck/analyzer/JarAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Plugin.java
+ org/owasp/dependencycheck/exception/ScanAgentException.java
0
@@ -183,6 +127,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -197,48 +155,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/FileUtils.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -253,20 +169,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -295,20 +197,6 @@ under the License.
0
-
-
-
- dependency-check-ant/src/main/resources/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -326,7 +214,7 @@ under the License.
- org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
+ dependency-check-ant/target/generated-classes/cobertura/task.properties
0
@@ -354,49 +242,7 @@ under the License.
- org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-core/src/test/resources/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/utils/Settings.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
+ org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java
0
@@ -449,20 +295,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -477,48 +309,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Parent.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Model.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -536,7 +326,7 @@ under the License.
- org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
+ org/owasp/dependencycheck/jaxb/pom/generated/Parent.java
0
@@ -550,7 +340,7 @@ under the License.
- dependency-check-core/target/test-classes/dependencycheck.properties
+ dependency-check-ant/target/classes/task.properties
0
@@ -564,7 +354,7 @@ under the License.
- org/owasp/dependencycheck/utils/NonClosingStream.java
+ dependency-check-maven/target/generated-classes/cobertura/log.properties
0
@@ -589,6 +379,20 @@ under the License.
0
+
+
+
+ org/owasp/dependencycheck/utils/NonClosingStream.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -617,6 +421,20 @@ under the License.
0
+
+
+
+ org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -634,7 +452,1449 @@ under the License.
- org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java
+ org/owasp/dependencycheck/jaxb/pom/generated/Build.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/DBUtils.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/taskdefs.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Developer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/VulnerableSoftware.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/DependencySimilarity.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/suppression/PropertyType.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/cpe/Fields.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/suppression/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-cli/target/maven-archiver/pom.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/VulnerabilityComparator.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/exception/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/Identifier.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/src/main/resources/dependencycheck.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-ant/target/classes/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-cli/target/generated-classes/cobertura/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/Checksum.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/src/test/resources/dependencycheck.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/Confidence.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 3
+
+
+
+
+ org/owasp/dependencycheck/utils/InvalidSettingException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/Downloader.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/Evidence.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/target/test-classes/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/Reference.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-cli/src/main/resources/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/LogFilter.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nvdcve/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/exception/UpdateException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/cwe/CweHandler.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/LuceneUtils.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/Filter.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/cwe/CweDB.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nvdcve/CveDB.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Profile.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/URLConnectionFailureException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-cli/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nuget/NuspecParseException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/cpe/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/suppression/SuppressionParseException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/target/generated-classes/cobertura/dependencycheck.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/exception/NoDataException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/task/ProcessTask.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nvdcve/DriverShim.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/dependency/Vulnerability.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/ExtractionException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/src/main/resources/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 2
+
+
+
+
+ org/owasp/dependencycheck/data/update/xml/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nuget/NugetPackage.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/target/classes/dependencycheck.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/NvdCveUpdater.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/classes/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/mojo.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/exception/InvalidDataException.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/JarAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Plugin.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/agent/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/FileUtils.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-ant/src/main/resources/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/maven-archiver/pom.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/src/test/resources/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/Settings.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/maven-plugin-help.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/jaxb/pom/generated/Model.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/utils/package-info.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-core/target/test-classes/dependencycheck.properties
0
@@ -687,20 +1947,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Build.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -729,76 +1975,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/DBUtils.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Developer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/dependency/VulnerableSoftware.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -813,20 +1989,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -855,34 +2017,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/suppression/PropertyType.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/lucene/DependencySimilarity.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -914,7 +2048,7 @@ under the License.
- org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.java
+ dependency-check-ant/target/maven-archiver/pom.properties
0
@@ -928,7 +2062,7 @@ under the License.
- org/owasp/dependencycheck/data/cpe/Fields.java
+ org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.java
0
@@ -967,34 +2101,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/suppression/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-cli/target/maven-archiver/pom.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1009,20 +2115,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1040,21 +2132,7 @@ under the License.
- org/owasp/dependencycheck/dependency/VulnerabilityComparator.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java
+ org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.java
0
@@ -1079,20 +2157,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/update/exception/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1107,20 +2171,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/dependency/Identifier.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1135,20 +2185,6 @@ under the License.
0
-
-
-
- dependency-check-core/src/main/resources/dependencycheck.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1177,20 +2213,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1205,90 +2227,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-cli/target/generated-classes/cobertura/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/utils/Checksum.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-core/src/test/resources/dependencycheck.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1303,34 +2241,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/dependency/Confidence.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1348,7 +2258,7 @@ under the License.
- org/owasp/dependencycheck/jaxb/pom/generated/Scm.java
+ dependency-check-ant/target/classes/taskdefs.properties
0
@@ -1362,7 +2272,7 @@ under the License.
- org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
+ org/owasp/dependencycheck/jaxb/pom/generated/Scm.java
0
@@ -1401,34 +2311,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/InvalidSettingException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/utils/Downloader.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1457,76 +2339,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/dependency/Evidence.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-core/target/test-classes/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/analyzer/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-cli/src/main/resources/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1541,34 +2353,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/dependency/Reference.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/utils/LogFilter.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1583,62 +2367,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/nvdcve/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/update/exception/UpdateException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1695,34 +2423,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/lucene/LuceneUtils.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/cwe/CweHandler.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1765,20 +2465,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/Filter.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1793,20 +2479,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/cwe/CweDB.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1821,20 +2493,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1866,7 +2524,7 @@ under the License.
- org/owasp/dependencycheck/jaxb/pom/generated/Extension.java
+ org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java
0
@@ -1880,7 +2538,7 @@ under the License.
- org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java
+ org/owasp/dependencycheck/jaxb/pom/generated/Extension.java
0
@@ -1919,20 +2577,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/nvdcve/CveDB.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1947,20 +2591,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Profile.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1975,76 +2605,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/utils/URLConnectionFailureException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-cli/target/generated-classes/cobertura/cobertura.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2059,62 +2619,6 @@ under the License.
0
-
-
-
- dependency-check-core/target/generated-classes/cobertura/dependencycheck.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/suppression/SuppressionParseException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/nuget/NuspecParseException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/cpe/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2129,20 +2633,6 @@ under the License.
0
-
-
-
- dependency-check-cli/target/classes/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2160,35 +2650,7 @@ under the License.
- org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.java
+ dependency-check-cli/target/classes/log.properties
0
@@ -2213,20 +2675,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2244,7 +2692,7 @@ under the License.
- org/owasp/dependencycheck/exception/NoDataException.java
+ org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java
0
@@ -2253,7 +2701,7 @@ under the License.
0
- 0
+ 1
@@ -2283,20 +2731,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/update/task/ProcessTask.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2314,21 +2748,7 @@ under the License.
- org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/nvdcve/DriverShim.java
+ dependency-check-maven/target/classes/mojo.properties
0
@@ -2353,20 +2773,6 @@ under the License.
0
-
-
-
- dependency-check-core/target/test-classes/test.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2384,35 +2790,7 @@ under the License.
- org/owasp/dependencycheck/dependency/Vulnerability.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java
+ dependency-check-core/target/test-classes/test.properties
0
@@ -2437,34 +2815,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/ExtractionException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-maven/src/main/resources/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2479,62 +2829,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java
-
-
- 0
-
-
- 0
-
-
- 2
-
-
-
-
- org/owasp/dependencycheck/data/nuget/NugetPackage.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/data/update/xml/package-info.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- dependency-check-core/target/classes/dependencycheck.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2549,20 +2843,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/update/NvdCveUpdater.java
-
-
- 0
-
-
- 0
-
-
- 0
-
diff --git a/dependency-check-core/cobertura/frame-packages.html b/dependency-check-core/cobertura/frame-packages.html
index bbcf0bda1..c00b6bb79 100644
--- a/dependency-check-core/cobertura/frame-packages.html
+++ b/dependency-check-core/cobertura/frame-packages.html
@@ -16,6 +16,9 @@
org.owasp.dependencycheck
+org.owasp.dependencycheck.agent
+
org.owasp.dependencycheck.analyzer
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.agent.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.agent.html
new file mode 100644
index 000000000..f700cc7bb
--- /dev/null
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.agent.html
@@ -0,0 +1,23 @@
+
+
+
+Coverage Report Classes
+
+org.owasp.dependencycheck.agent
+
+
+Classes
+
+
+
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html
index f300a3cc5..499551c2e 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html
@@ -15,61 +15,67 @@ org.owasp.dependencycheck.analyzer
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html
index c6d96b96d..61c9854cf 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html
@@ -15,13 +15,13 @@ org.owasp.dependencycheck.data.cpe
-CpeMemoryIndex (73%) CpeMemoryIndex (0%)
Fields (N/A)
-IndexEntry (58%) IndexEntry (0%)
IndexException (N/A)
-CweDB (52%) CweDB (0%)
CweHandler (0%) UpdateService (0%)
-UpdateableNvdCve (93%) UpdateableNvdCve (0%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.xml.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.xml.html
index 2847f58b9..49fd999f9 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.xml.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.xml.html
@@ -15,10 +15,10 @@ org.owasp.dependencycheck.data.update.xml
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html
index 8e4b8e2bb..1d6831f15 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html
@@ -15,31 +15,31 @@ org.owasp.dependencycheck.dependency
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.exception.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.exception.html
index 12d75deb0..bcd7ae741 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.exception.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.exception.html
@@ -17,6 +17,9 @@ org.owasp.dependencycheck.exception
NoDataException (N/A)
+
+ScanAgentException (N/A)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html
index 3d8a50aad..a99d369f0 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html
@@ -15,7 +15,7 @@ org.owasp.dependencycheck
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.generated.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.generated.html
index a8d5afaca..472817a1c 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.generated.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.generated.html
@@ -69,7 +69,7 @@ org.owasp.dependencycheck.jaxb.pom.generated
MailingList (0%)
-Model (6%) Model (0%)
Notifier (0%)
-AbstractAnalyzer (100%) AbstractAnalyzer (0%)
-AbstractSuppressionAnalyzer (51%) AbstractFileTypeAnalyzer (0%)
-AbstractTokenizingFilter (100%) AbstractSuppressionAnalyzer (0%)
+
+AbstractTokenizingFilter (0%)
Activation (N/A) ActivationProperty (N/A)
-AlphaNumericTokenizer (100%) AlphaNumericTokenizer (0%)
AnalysisException (N/A)
-AnalysisPhase (100%) AnalysisPhase (0%)
Analyzer (N/A)
-AnalyzerService (100%) AnalyzerService (0%)
-ArchiveAnalyzer (65%) ArchiveAnalyzer (0%)
ArchiveExtractionException (N/A)
-AssemblyAnalyzer (69%) AssemblyAnalyzer (0%)
Build (0%) BuildBase (0%)
-CPEAnalyzer (84%) CPEAnalyzer (0%)
CachedWebDataSource (N/A) CallableDownloadTask (0%)
-Checksum (87%) Checksum (0%)
CiManagement (0%)
-Confidence (100%) Confidence (0%)
-ConnectionFactory (51%) ConnectionFactory (0%)
Contributor (0%) CorruptDatabaseException (N/A)
-CpeMemoryIndex (73%) CpeMemoryIndex (0%)
-CpeSuppressionAnalyzer (88%) CpeSuppressionAnalyzer (0%)
-CweDB (52%) CweDB (0%)
CweHandler (0%)
-DBUtils (36%) DBUtils (0%)
DatabaseException (N/A)
-DatabaseProperties (83%) DatabaseProperties (0%)
-Dependency (56%) Dependency (0%)
Dependency (0%)
-DependencyBundlingAnalyzer (48%) DependencyBundlingAnalyzer (0%)
+
+DependencyCheckScanAgent (0%)
DependencyManagement (0%) DependencySimilarity (0%)
-DependencyVersion (90%) DependencyVersion (0%)
-DependencyVersionUtil (100%) DependencyVersionUtil (0%)
DeploymentRepository (N/A) DownloadFailedException (N/A)
-Downloader (18%) Downloader (0%)
DriverLoadException (N/A)
-DriverLoader (58%) DriverLoader (0%)
-DriverShim (6%) DriverShim (0%)
-Engine (59%) Engine (0%)
-Evidence (51%) Evidence (0%)
-EvidenceCollection (72%) EvidenceCollection (0%)
Exclusion (N/A) ExtractionException (N/A)
-FalsePositiveAnalyzer (69%) FalsePositiveAnalyzer (0%)
-FieldAnalyzer (100%) FieldAnalyzer (0%)
Fields (N/A)
-FileNameAnalyzer (95%) FileNameAnalyzer (0%)
-FileUtils (23%) FileTypeAnalyzer (N/A)
-Filter (91%) FileUtils (0%)
-HintAnalyzer (93%) Filter (0%)
-Identifier (31%) HintAnalyzer (0%)
-IndexEntry (58%) Identifier (0%)
+
+IndexEntry (0%)
IndexException (N/A) IssueManagement (N/A)
-JarAnalyzer (61%) JarAnalyzer (0%)
-JavaScriptAnalyzer (25%) JavaScriptAnalyzer (0%)
License (N/A) LogFilter (0%)
-LogUtils (8%) LogUtils (0%)
-LuceneUtils (100%) LuceneUtils (0%)
MailingList (0%)
-MavenArtifact (50%) MavenArtifact (0%)
MavenNamespaceFilter (0%)
-Model (6%) Model (0%)
-NexusAnalyzer (33%) NexusAnalyzer (0%)
-NexusSearch (75%) NexusSearch (0%)
NoDataException (N/A)
-NonClosingStream (100%) NonClosingStream (0%)
Notifier (0%) NugetPackage (0%)
-NuspecAnalyzer (26%) NuspecAnalyzer (0%)
NuspecParseException (N/A) NuspecParser (N/A)
-NvdCve12Handler (94%) NvdCve12Handler (0%)
-NvdCve20Handler (85%) NvdCve20Handler (0%)
-NvdCveAnalyzer (73%) NvdCveAnalyzer (0%)
NvdCveInfo (N/A) Organization (N/A)
-Pair (28%) Pair (0%)
Parent (N/A) Profile (0%)
-PropertyType (57%) PropertyType (0%)
-Reference (28%) Reference (0%)
Relocation (N/A)
-ReportGenerator (52%) ReportGenerator (0%)
ReportPlugin (0%) Resource (0%)
+ScanAgentException (N/A)
+
Scm (N/A)
-SearchFieldAnalyzer (100%) SearchFieldAnalyzer (0%)
SearchVersionAnalyzer (0%)
-Settings (49%) Settings (0%)
Site (N/A) SuppressionErrorHandler (0%)
-SuppressionHandler (97%) SuppressionHandler (0%)
SuppressionParseException (N/A)
-SuppressionParser (57%) SuppressionParser (0%)
-SuppressionRule (96%) SuppressionRule (0%)
-TokenPairConcatenatingFilter (100%) TokenPairConcatenatingFilter (0%)
-URLConnectionFactory (18%) URLConnectionFactory (0%)
URLConnectionFailureException (N/A) UpdateService (0%)
-UpdateableNvdCve (93%) UpdateableNvdCve (0%)
-UrlStringUtils (90%) UrlStringUtils (0%)
-UrlTokenizingFilter (77%) UrlTokenizingFilter (0%)
-VelocityLoggerRedirect (53%) VelocityLoggerRedirect (0%)
VersionAnalyzer (0%) VersionTokenizingFilter (0%)
-Vulnerability (69%) Vulnerability (0%)
-VulnerabilityComparator (100%) VulnerabilityComparator (0%)
-VulnerabilitySuppressionAnalyzer (88%) VulnerabilitySuppressionAnalyzer (0%)
-VulnerableSoftware (81%) VulnerableSoftware (0%)
-XPathNuspecParser (94%) XPathNuspecParser (0%)
package-info (N/A) Coverage Report
+Coverage Report - org.owasp.dependencycheck.agent
+
+
+
+
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html
index 57f84484b..f4f4722ed 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html
@@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html
index 29c9adf25..c46d74fc8 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html
@@ -16,7 +16,7 @@
@@ -29,46 +29,50 @@ packageTable.sort(0);
@@ -77,6 +81,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html
index 2d387176d..be1c34876 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html
index 2e9bce520..950e92089 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html
index b8e1961a5..7c08ec8a4 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html
index e4576d109..f2902f3cc 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html
index 354f1fa3c..8819c2b21 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html
index da0fb5a54..38767050f 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html
index 139194c7a..ab7389d9b 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html
@@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html
index 221b61a01..c1210475f 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html
@@ -16,10 +16,10 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html
index 7d0225891..3ced2e7b6 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html
@@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html
index 1c767d225..7c9c156f5 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html
index c75f50a63..be68cf191 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html
index 909e45203..474d0f3ca 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html
index 43d728119..adc01cb28 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html
@@ -16,26 +16,27 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html
index 3f38dc96d..aeef3e13a 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html
index a35cf330c..9f3b2c7e8 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html
@@ -17,7 +17,7 @@
Package # Classes Line Coverage Branch Coverage Complexity
org.owasp.dependencycheck.jaxb.pom 1 1.25; 1.25org.owasp.dependencycheck.jaxb.pom.generated 87 1.0907407407407408; 1.091org.owasp.dependencycheck.jaxb.pom.generated 87 1.0907407407407408; 1.091
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html
index 78fc98c94..7bc35945d 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html
index ec99d0ce6..40cc46b7e 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html
index 35068fd2f..7fd501762 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary.html b/dependency-check-core/cobertura/frame-summary.html
index fc745c530..8b8e0ae28 100644
--- a/dependency-check-core/cobertura/frame-summary.html
+++ b/dependency-check-core/cobertura/frame-summary.html
@@ -16,27 +16,28 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html
index 6ccf58804..b4b2248f7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html
@@ -12,7 +12,7 @@
@@ -80,666 +80,727 @@
31
import org.owasp.dependencycheck.analyzer.AnalyzerService;
32
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer; 33
- import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException; 34
- import org.owasp.dependencycheck.data.cpe.IndexException;
+ import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; 35
- import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory;
+ import org.owasp.dependencycheck.data.cpe.IndexException; 36
- import org.owasp.dependencycheck.data.nvdcve.CveDB;
+ import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory; 37
- import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+ import org.owasp.dependencycheck.data.nvdcve.CveDB; 38
- import org.owasp.dependencycheck.data.update.CachedWebDataSource;
+ import org.owasp.dependencycheck.data.nvdcve.DatabaseException; 39
- import org.owasp.dependencycheck.data.update.UpdateService;
+ import org.owasp.dependencycheck.data.update.CachedWebDataSource; 40
- import org.owasp.dependencycheck.data.update.exception.UpdateException;
+ import org.owasp.dependencycheck.data.update.UpdateService; 41
- import org.owasp.dependencycheck.dependency.Dependency;
+ import org.owasp.dependencycheck.data.update.exception.UpdateException; 42
- import org.owasp.dependencycheck.exception.NoDataException;
+ import org.owasp.dependencycheck.dependency.Dependency; 43
- import org.owasp.dependencycheck.utils.FileUtils;
+ import org.owasp.dependencycheck.exception.NoDataException; 44
- import org.owasp.dependencycheck.utils.InvalidSettingException;
+ import org.owasp.dependencycheck.utils.FileUtils; 45
- import org.owasp.dependencycheck.utils.Settings;
+ import org.owasp.dependencycheck.utils.InvalidSettingException; 46
-
+ import org.owasp.dependencycheck.utils.Settings; 47
-
+ 48
-
+ 49
-
+ 50
-
+ 51
-
+ 52
-
+ 53
-
+ 54
- public class Engine {
+ 55
-
+ public class Engine { 56
-
- 57
-
- 58
-
- 59
- private final List<Dependency> dependencies;
- 60
-
- 61
-
- 62
-
- 63
- private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
- 64
-
- 65
-
- 66
-
- 67
- private final Set<String> extensions;
- 68
- 69
+ 57
- 70
-
- 71
-
- 72
-
- 73
+ 58
+
+ 59
- 74 6 public Engine() throws DatabaseException {
- 75 6 this .extensions = new HashSet<String>();
- 76 6 this .dependencies = new ArrayList<Dependency>();
- 77 6 this .analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
- 78 6 ConnectionFactory.initialize();
+ 60
+ private List<Dependency> dependencies;
+ 61
+
+ 62
+
+ 63
+
+ 64
+ private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
+ 65
+
+ 66
+
+ 67
+
+ 68
+ private final Set<FileTypeAnalyzer> fileTypeAnalyzers;
+ 69
+
+ 70
+
+ 71
+
+ 72
+
+ 73
+
+ 74
+
+ 75 0 public Engine() throws DatabaseException {
+ 76 0 this .dependencies = new ArrayList<Dependency>();
+ 77 0 this .analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
+ 78 0 this .fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
79
- 80 6 boolean autoUpdate = true ;
+ 80 0 ConnectionFactory.initialize();
81
- try {
- 82 6 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
- 83 0 } catch (InvalidSettingException ex) {
- 84 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "Invalid setting for auto-update; using true." );
- 85 6 }
- 86 6 if (autoUpdate) {
- 87 0 doUpdates();
- 88
- }
- 89 6 loadAnalyzers();
- 90 6 }
- 91
- 92
-
+ 82 0 boolean autoUpdate = true ;
+ 83
+ try {
+ 84 0 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+ 85 0 } catch (InvalidSettingException ex) {
+ 86 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "Invalid setting for auto-update; using true." );
+ 87 0 }
+ 88 0 if (autoUpdate) {
+ 89 0 doUpdates();
+ 90
+ }
+ 91 0 loadAnalyzers();
+ 92 0 }
93
-
+ 94
-
+ 95
+
+ 96
+
+ 97
public void cleanup() {
- 96 6 ConnectionFactory.cleanup();
- 97 6 }
- 98
-
- 99
-
+ 98 0 ConnectionFactory.cleanup();
+ 99 0 }
100
-
+ 101
-
+ 102
- private void loadAnalyzers() {
+ 103
+
+ 104
+ private void loadAnalyzers() {
+ 105
- 104 60 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 105 54 analyzers.put(phase, new ArrayList<Analyzer>());
- 106
+ 106 0 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 107 0 analyzers.put(phase, new ArrayList<Analyzer>());
+ 108
}
- 107
+ 109
- 108 6 final AnalyzerService service = AnalyzerService.getInstance();
- 109 6 final Iterator<Analyzer> iterator = service.getAnalyzers();
- 110 84 while (iterator.hasNext()) {
- 111 78 final Analyzer a = iterator.next();
- 112 78 analyzers.get(a.getAnalysisPhase()).add(a);
- 113 78 if (a.getSupportedExtensions() != null ) {
- 114 30 extensions.addAll(a.getSupportedExtensions());
- 115
+ 110 0 final AnalyzerService service = AnalyzerService.getInstance();
+ 111 0 final Iterator<Analyzer> iterator = service.getAnalyzers();
+ 112 0 while (iterator.hasNext()) {
+ 113 0 final Analyzer a = iterator.next();
+ 114 0 analyzers.get(a.getAnalysisPhase()).add(a);
+ 115 0 if (a instanceof FileTypeAnalyzer) {
+ 116 0 this .fileTypeAnalyzers.add((FileTypeAnalyzer) a);
+ 117
}
- 116 78 }
- 117 6 }
- 118
-
- 119
-
+ 118 0 }
+ 119 0 }
120
-
+ 121
-
+ 122
-
+ 123
-
+ 124
-
+ 125
- public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
- 126 0 return analyzers.get(phase);
+ 126
+
127
- }
- 128
-
+ public List<Analyzer> getAnalyzers(AnalysisPhase phase) { 128 0 return analyzers.get(phase);
129
-
+ } 130
-
+ 131
-
+ 132
-
+ 133
-
+ 134
- public List<Dependency> getDependencies() {
+ 135
- return dependencies;
+ 136
- }
+ public List<Dependency> getDependencies() { 137
-
+ return dependencies; 138
-
+ } 139
-
+ 140
-
+ public void setDependencies(List<Dependency> dependencies) { 141
-
+ this .dependencies = dependencies; 142
-
+ 143
-
+ 144
-
+ 145
-
+ } 146
- public void scan(String[] paths) {
- 147 0 for (String path : paths) {
- 148 0 final File file = new File(path);
- 149 0 scan(file);
- 150
- }
- 151 0 }
- 152
- 153
+ 147
- 154
-
- 155
-
- 156
-
- 157
-
- 158
-
- 159
- public void scan(String path) {
- 160 0 final File file = new File(path);
- 161 0 scan(file);
- 162 0 }
- 163
-
- 164
-
- 165
+ 148
- 166
+ 149
- 167
+ 150
- 168
+ 151
- 169
+ 152
- 170
-
- 171
+ 153
+
+ 154
- 172
- public void scan(File[] files) {
- 173 0 for (File file : files) {
- 174 0 scan(file);
- 175
+ 155
+ public void scan(String[] paths) {
+ 156 0 for (String path : paths) {
+ 157 0 final File file = new File(path);
+ 158 0 scan(file);
+ 159
}
- 176 0 }
- 177
+ 160 0 }
+ 161
- 178
+ 162
- 179
-
- 180
-
- 181
-
- 182
-
- 183
-
- 184
-
- 185
-
- 186
- public void scan(Set<File> files) {
- 187 0 for (File file : files) {
- 188 0 scan(file);
- 189 0 }
- 190 0 }
- 191
-
- 192
-
- 193
-
- 194
-
- 195
-
- 196
-
- 197
-
- 198
-
- 199
-
- 200
- public void scan(List<File> files) {
- 201 0 for (File file : files) {
- 202 0 scan(file);
- 203 0 }
- 204 0 }
- 205
-
- 206
-
- 207
+ 163
- 208
+ 164
- 209
+ 165
- 210
-
- 211
+ 166
+
+ 167
+
+ 168
+ public void scan(String path) {
+ 169 0 if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$" )) {
+ 170 0 final String[] parts = path.split("\\*\\." );
+ 171 0 final String[] ext = new String[]{parts[parts.length - 1]};
+ 172 0 final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2));
+ 173 0 if (dir.isDirectory()) {
+ 174 0 final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true );
+ 175 0 scan(files);
+ 176 0 } else {
+ 177 0 final String msg = String.format("Invalid file path provided to scan '%s'" , path);
+ 178 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+ 179
+ }
+ 180 0 } else {
+ 181 0 final File file = new File(path);
+ 182 0 scan(file);
+ 183
+ }
+ 184 0 }
+ 185
+
+ 186
+
+ 187
+
+ 188
+
+ 189
- 212
-
+ 190
+
+ 191
+
+ 192
+
+ 193
+
+ 194
+ public void scan(File[] files) {
+ 195 0 for (File file : files) {
+ 196 0 scan(file);
+ 197
+ }
+ 198 0 }
+ 199
+
+ 200
+
+ 201
+
+ 202
+
+ 203
+
+ 204
+
+ 205
+
+ 206
+
+ 207
+
+ 208
+ public void scan(Set<File> files) {
+ 209 0 for (File file : files) {
+ 210 0 scan(file);
+ 211 0 }
+ 212 0 }
213
-
+ 214
- public void scan(File file) {
- 215 13 if (file.exists()) {
- 216 13 if (file.isDirectory()) {
- 217 8 scanDirectory(file);
+ 215
+
+ 216
+
+ 217
+
218
- } else {
- 219 5 scanFile(file);
+ 219
+
220
- }
+ 221
- }
- 222 13 }
- 223
-
- 224
-
- 225
-
- 226
-
+ 222
+ public void scan(List<File> files) {
+ 223 0 for (File file : files) {
+ 224 0 scan(file);
+ 225 0 }
+ 226 0 }
227
-
+ 228
-
+ 229
- protected void scanDirectory(File dir) {
- 230 35 final File[] files = dir.listFiles();
- 231 35 if (files != null ) {
- 232 81 for (File f : files) {
- 233 46 if (f.isDirectory()) {
- 234 27 scanDirectory(f);
+ 230
+
+ 231
+
+ 232
+
+ 233
+
+ 234
+
235
- } else {
- 236 19 scanFile(f);
- 237
- }
- 238
- }
- 239
- }
- 240 35 }
- 241
-
+ 236
+ public void scan(File file) {
+ 237 0 if (file.exists()) {
+ 238 0 if (file.isDirectory()) {
+ 239 0 scanDirectory(file);
+ 240
+ } else {
+ 241 0 scanFile(file);
242
-
+ } 243
-
- 244
-
+ } 244 0 }
245
-
+ 246
-
+ 247
- protected void scanFile(File file) {
- 248 24 if (!file.isFile()) {
- 249 0 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file." , file.toString());
- 250 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
- 251 0 return ;
- 252
- }
- 253 24 final String fileName = file.getName();
- 254 24 final String extension = FileUtils.getFileExtension(fileName);
- 255 24 if (extension != null ) {
- 256 24 if (extensions.contains(extension)) {
- 257 24 final Dependency dependency = new Dependency(file);
- 258 24 dependencies.add(dependency);
- 259 24 }
- 260
- } else {
- 261 0 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed." ,
- 262
- file.toString());
- 263 0 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, msg);
- 264
- }
- 265 24 }
- 266
-
- 267
-
- 268
-
- 269
-
- 270
- public void analyzeDependencies() {
- 271
-
- 272
- try {
- 273 3 ensureDataExists();
- 274 0 } catch (NoDataException ex) {
- 275 0 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
- 276 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
- 277 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
- 278 0 return ;
- 279 0 } catch (DatabaseException ex) {
- 280 0 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
- 281 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
- 282 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
- 283 0 return ;
- 284
-
- 285 3 }
- 286
-
- 287 3 final String logHeader = String.format("%n"
- 288
- + "----------------------------------------------------%n"
- 289
- + "BEGIN ANALYSIS%n"
- 290
- + "----------------------------------------------------" );
- 291 3 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logHeader);
- 292 3 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Starting" );
- 293
-
- 294
-
- 295 30 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 296 27 final List<Analyzer> analyzerList = analyzers.get(phase);
- 297 27 for (Analyzer a : analyzerList) {
- 298
- try {
- 299 39 final String msg = String.format("Initializing %s" , a.getName());
- 300 39 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
- 301 39 a.initialize();
- 302 0 } catch (Throwable ex) {
- 303 0 final String msg = String.format("Exception occurred initializing %s." , a.getName());
- 304 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
- 305 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
- 306
- try {
- 307 0 a.close();
- 308 0 } catch (Throwable ex1) {
- 309 0 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex1);
- 310 0 }
- 311 39 }
- 312 39 }
- 313
- }
- 314
-
- 315
-
- 316 30 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 317 27 final List<Analyzer> analyzerList = analyzers.get(phase);
- 318
-
- 319 27 for (Analyzer a : analyzerList) {
- 320
-
- 321
-
- 322
-
- 323
-
- 324 39 final String msg = String.format("Begin Analyzer '%s'" , a.getName());
- 325 39 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
- 326 39 final Set<Dependency> dependencySet = new HashSet<Dependency>();
- 327 39 dependencySet.addAll(dependencies);
- 328 39 for (Dependency d : dependencySet) {
- 329 113 if (a.supportsExtension(d.getFileExtension())) {
- 330 84 final String msgFile = String.format("Begin Analysis of '%s'" , d.getActualFilePath());
- 331 84 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msgFile);
- 332
- try {
- 333 84 a.analyze(d, this );
- 334 0 } catch (AnalysisException ex) {
- 335 0 final String exMsg = String.format("An error occured while analyzing '%s'." , d.getActualFilePath());
- 336 0 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, exMsg);
- 337 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
- 338 0 } catch (Throwable ex) {
- 339 0 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'" , d.getActualFilePath());
- 340
-
- 341 0 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, axMsg);
- 342 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
- 343 84 }
- 344
- }
- 345 113 }
- 346 39 }
- 347
- }
- 348
-
- 349
-
- 350 30 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 351 27 final List<Analyzer> analyzerList = analyzers.get(phase);
- 352 27 for (Analyzer a : analyzerList) {
- 353 39 final String msg = String.format("Closing Analyzer '%s'" , a.getName());
- 354 39 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
- 355
- try {
- 356 39 a.close();
- 357 0 } catch (Throwable ex) {
- 358 0 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex);
- 359 39 }
- 360 39 }
- 361
- }
- 362
-
- 363 3 final String logFooter = String.format("%n"
- 364
- + "----------------------------------------------------%n"
- 365
- + "END ANALYSIS%n"
- 366
- + "----------------------------------------------------" );
- 367 3 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logFooter);
- 368 3 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Complete" );
- 369 3 }
- 370
-
- 371
-
- 372
-
- 373
-
- 374
- private void doUpdates() {
- 375 0 final UpdateService service = UpdateService.getInstance();
- 376 0 final Iterator<CachedWebDataSource> iterator = service.getDataSources();
- 377 0 while (iterator.hasNext()) {
- 378 0 final CachedWebDataSource source = iterator.next();
- 379
- try {
- 380 0 source.update();
- 381 0 } catch (UpdateException ex) {
- 382 0 Logger.getLogger(Engine.class .getName()).log(Level.WARNING,
- 383
- "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities." );
- 384 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE,
- 385
- String.format("Unable to update details for %s" , source.getClass().getName()), ex);
- 386 0 }
- 387 0 }
- 388 0 }
- 389
-
- 390
-
- 391
-
- 392
+
+ 248
- 393
-
- 394
+ 249
+
+ 250
- 395
- public List<Analyzer> getAnalyzers() {
- 396 1 final List<Analyzer> ret = new ArrayList<Analyzer>();
- 397 10 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 398 9 final List<Analyzer> analyzerList = analyzers.get(phase);
- 399 9 ret.addAll(analyzerList);
- 400
- }
- 401 1 return ret;
- 402
- }
- 403
-
- 404
-
- 405
-
- 406
-
- 407
-
- 408
-
- 409
-
- 410
- public boolean supportsExtension(String ext) {
- 411 152 if (ext == null ) {
- 412 8 return false ;
- 413
- }
- 414 1285 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 415 1160 final List<Analyzer> analyzerList = analyzers.get(phase);
- 416 1160 for (Analyzer a : analyzerList) {
- 417 1676 if (a.getSupportedExtensions() != null && a.supportsExtension(ext)) {
- 418 19 return true ;
- 419
+ 251
+ protected void scanDirectory(File dir) {
+ 252 0 final File[] files = dir.listFiles();
+ 253 0 if (files != null ) {
+ 254 0 for (File f : files) {
+ 255 0 if (f.isDirectory()) {
+ 256 0 scanDirectory(f);
+ 257
+ } else {
+ 258 0 scanFile(f);
+ 259
}
- 420 1657 }
- 421
+ 260
+ }
+ 261
}
- 422 125 return false ;
- 423
- }
- 424
+ 262 0 }
+ 263
- 425
+ 264
- 426
-
- 427
+ 265
+
+ 266
- 428
-
- 429
-
- 430
+ 267
+
+ 268
- 431
- private void ensureDataExists() throws NoDataException, DatabaseException {
- 432 3 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
- 433 3 final CveDB cve = new CveDB();
- 434
-
- 435
- try {
- 436 3 cve.open();
- 437 3 cpe.open(cve);
- 438 0 } catch (IndexException ex) {
- 439 0 throw new NoDataException(ex.getMessage(), ex);
- 440 0 } catch (DatabaseException ex) {
- 441 0 throw new NoDataException(ex.getMessage(), ex);
- 442
- } finally {
- 443 3 cve.close();
- 444 3 }
- 445 3 if (cpe.numDocs() <= 0) {
- 446 0 cpe.close();
- 447 0 throw new NoDataException("No documents exist" );
- 448
+ 269
+ protected void scanFile(File file) {
+ 270 0 if (!file.isFile()) {
+ 271 0 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file." , file.toString());
+ 272 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+ 273 0 return ;
+ 274
}
- 449 3 }
- 450
+ 275 0 final String fileName = file.getName();
+ 276 0 final String extension = FileUtils.getFileExtension(fileName);
+ 277 0 if (extension != null ) {
+ 278 0 if (supportsExtension(extension)) {
+ 279 0 final Dependency dependency = new Dependency(file);
+ 280 0 dependencies.add(dependency);
+ 281 0 }
+ 282
+ } else {
+ 283 0 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed." ,
+ 284
+ file.toString());
+ 285 0 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, msg);
+ 286
+ }
+ 287 0 }
+ 288
+
+ 289
+
+ 290
+
+ 291
+
+ 292
+ public void analyzeDependencies() {
+ 293
+
+ 294
+ try {
+ 295 0 ensureDataExists();
+ 296 0 } catch (NoDataException ex) {
+ 297 0 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
+ 298 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+ 299 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
+ 300 0 return ;
+ 301 0 } catch (DatabaseException ex) {
+ 302 0 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
+ 303 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+ 304 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
+ 305 0 return ;
+ 306
+
+ 307 0 }
+ 308
+
+ 309 0 final String logHeader = String.format("%n"
+ 310
+ + "----------------------------------------------------%n"
+ 311
+ + "BEGIN ANALYSIS%n"
+ 312
+ + "----------------------------------------------------" );
+ 313 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logHeader);
+ 314 0 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Starting" );
+ 315
+
+ 316
+
+ 317 0 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 318 0 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 319
+
+ 320 0 for (Analyzer a : analyzerList) {
+ 321 0 initializeAnalyzer(a);
+ 322
+
+ 323
+
+ 324
+
+ 325
+
+ 326
+
+ 327 0 final String msg = String.format("Begin Analyzer '%s'" , a.getName());
+ 328 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+ 329 0 final Set<Dependency> dependencySet = new HashSet<Dependency>();
+ 330 0 dependencySet.addAll(dependencies);
+ 331 0 for (Dependency d : dependencySet) {
+ 332 0 boolean shouldAnalyze = true ;
+ 333 0 if (a instanceof FileTypeAnalyzer) {
+ 334 0 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
+ 335 0 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension());
+ 336
+ }
+ 337 0 if (shouldAnalyze) {
+ 338 0 final String msgFile = String.format("Begin Analysis of '%s'" , d.getActualFilePath());
+ 339 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msgFile);
+ 340
+ try {
+ 341 0 a.analyze(d, this );
+ 342 0 } catch (AnalysisException ex) {
+ 343 0 final String exMsg = String.format("An error occured while analyzing '%s'." , d.getActualFilePath());
+ 344 0 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, exMsg);
+ 345 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
+ 346 0 } catch (Throwable ex) {
+ 347 0 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'" , d.getActualFilePath());
+ 348
+
+ 349 0 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, axMsg);
+ 350 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
+ 351 0 }
+ 352
+ }
+ 353 0 }
+ 354 0 }
+ 355
+ }
+ 356 0 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 357 0 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 358
+
+ 359 0 for (Analyzer a : analyzerList) {
+ 360 0 closeAnalyzer(a);
+ 361 0 }
+ 362
+ }
+ 363
+
+ 364 0 final String logFooter = String.format("%n"
+ 365
+ + "----------------------------------------------------%n"
+ 366
+ + "END ANALYSIS%n"
+ 367
+ + "----------------------------------------------------" );
+ 368 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logFooter);
+ 369 0 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Complete" );
+ 370 0 }
+ 371
+
+ 372
+
+ 373
+
+ 374
+
+ 375
+
+ 376
+
+ 377
+ private void initializeAnalyzer(Analyzer analyzer) {
+ 378
+ try {
+ 379 0 final String msg = String.format("Initializing %s" , analyzer.getName());
+ 380 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+ 381 0 analyzer.initialize();
+ 382 0 } catch (Throwable ex) {
+ 383 0 final String msg = String.format("Exception occurred initializing %s." , analyzer.getName());
+ 384 0 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+ 385 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
+ 386
+ try {
+ 387 0 analyzer.close();
+ 388 0 } catch (Throwable ex1) {
+ 389 0 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex1);
+ 390 0 }
+ 391 0 }
+ 392 0 }
+ 393
+
+ 394
+
+ 395
+
+ 396
+
+ 397
+
+ 398
+
+ 399
+ private void closeAnalyzer(Analyzer analyzer) {
+ 400 0 final String msg = String.format("Closing Analyzer '%s'" , analyzer.getName());
+ 401 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+ 402
+ try {
+ 403 0 analyzer.close();
+ 404 0 } catch (Throwable ex) {
+ 405 0 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex);
+ 406 0 }
+ 407 0 }
+ 408
+
+ 409
+
+ 410
+
+ 411
+
+ 412
+ private void doUpdates() {
+ 413 0 final UpdateService service = UpdateService.getInstance();
+ 414 0 final Iterator<CachedWebDataSource> iterator = service.getDataSources();
+ 415 0 while (iterator.hasNext()) {
+ 416 0 final CachedWebDataSource source = iterator.next();
+ 417
+ try {
+ 418 0 source.update();
+ 419 0 } catch (UpdateException ex) {
+ 420 0 Logger.getLogger(Engine.class .getName()).log(Level.WARNING,
+ 421
+ "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities." );
+ 422 0 Logger.getLogger(Engine.class .getName()).log(Level.FINE,
+ 423
+ String.format("Unable to update details for %s" , source.getClass().getName()), ex);
+ 424 0 }
+ 425 0 }
+ 426 0 }
+ 427
+
+ 428
+
+ 429
+
+ 430
+
+ 431
+
+ 432
+
+ 433
+ public List<Analyzer> getAnalyzers() {
+ 434 0 final List<Analyzer> ret = new ArrayList<Analyzer>();
+ 435 0 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 436 0 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 437 0 ret.addAll(analyzerList);
+ 438
+ }
+ 439 0 return ret;
+ 440
+ }
+ 441
+
+ 442
+
+ 443
+
+ 444
+
+ 445
+
+ 446
+
+ 447
+
+ 448
+ public boolean supportsExtension(String ext) {
+ 449 0 if (ext == null ) {
+ 450 0 return false ;
+ 451
+ }
+ 452 0 boolean scan = false ;
+ 453 0 for (FileTypeAnalyzer a : this .fileTypeAnalyzers) {
+ 454
+
+ 455
+
+ 456 0 scan |= a.supportsExtension(ext);
+ 457 0 }
+ 458 0 return scan;
+ 459
+ }
+ 460
+
+ 461
+
+ 462
+
+ 463
+
+ 464
+
+ 465
+
+ 466
+
+ 467
+ private void ensureDataExists() throws NoDataException, DatabaseException {
+ 468 0 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
+ 469 0 final CveDB cve = new CveDB();
+ 470
+
+ 471
+ try {
+ 472 0 cve.open();
+ 473 0 cpe.open(cve);
+ 474 0 } catch (IndexException ex) {
+ 475 0 throw new NoDataException(ex.getMessage(), ex);
+ 476 0 } catch (DatabaseException ex) {
+ 477 0 throw new NoDataException(ex.getMessage(), ex);
+ 478
+ } finally {
+ 479 0 cve.close();
+ 480 0 }
+ 481 0 if (cpe.numDocs() <= 0) {
+ 482 0 cpe.close();
+ 483 0 throw new NoDataException("No documents exist" );
+ 484
+ }
+ 485 0 }
+ 486
+
+ 487
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
new file mode 100644
index 000000000..0bc723a8c
--- /dev/null
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
@@ -0,0 +1,1831 @@
+
+
+
+Coverage Report
+Coverage Report - org.owasp.dependencycheck.agent.DependencyCheckScanAgent
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.agent;
+ 19
+
+ 20
+ import java.io.File;
+ 21
+ import java.io.IOException;
+ 22
+ import java.util.List;
+ 23
+ import java.util.logging.Level;
+ 24
+ import java.util.logging.Logger;
+ 25
+ import org.owasp.dependencycheck.Engine;
+ 26
+ import org.owasp.dependencycheck.data.nvdcve.CveDB;
+ 27
+ import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+ 28
+ import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+ 29
+ import org.owasp.dependencycheck.dependency.Dependency;
+ 30
+ import org.owasp.dependencycheck.dependency.Identifier;
+ 31
+ import org.owasp.dependencycheck.dependency.Vulnerability;
+ 32
+ import org.owasp.dependencycheck.exception.ScanAgentException;
+ 33
+ import org.owasp.dependencycheck.reporting.ReportGenerator;
+ 34
+ import org.owasp.dependencycheck.utils.Settings;
+ 35
+
+ 36
+
+ 37
+
+ 38
+
+ 39
+
+ 40
+
+ 41
+
+ 42
+
+ 43
+
+ 44
+
+ 45
+
+ 46
+
+ 47
+
+ 48
+
+ 49
+
+ 50
+
+ 51
+
+ 52
+
+ 53
+
+ 54
+
+ 55
+
+ 56
+
+ 57
+
+ 58
+
+ 59
+
+ 60
+ @SuppressWarnings("unused" )
+ 61 0 public class DependencyCheckScanAgent {
+ 62
+
+ 63
+
+ 64
+
+ 65
+
+ 66 0 private static final String NEW_LINE = System.getProperty("line.separator" , "\n" ).intern();
+ 67
+
+ 68
+
+ 69
+
+ 70
+
+ 71 0 private String applicationName = "Dependency-Check" ;
+ 72
+
+ 73
+
+ 74
+
+ 75
+
+ 76
+
+ 77
+
+ 78
+ public String getApplicationName() {
+ 79
+ return applicationName;
+ 80
+ }
+ 81
+
+ 82
+
+ 83
+
+ 84
+
+ 85
+
+ 86
+
+ 87
+ public void setApplicationName(String applicationName) {
+ 88
+ this .applicationName = applicationName;
+ 89
+ }
+ 90
+
+ 91
+
+ 92
+
+ 93
+
+ 94
+ private List<Dependency> dependencies;
+ 95
+
+ 96
+
+ 97
+
+ 98
+
+ 99
+
+ 100
+
+ 101
+ public List<Dependency> getDependencies() {
+ 102
+ return dependencies;
+ 103
+ }
+ 104
+
+ 105
+
+ 106
+
+ 107
+
+ 108
+
+ 109
+
+ 110
+ public void setDependencies(List<Dependency> dependencies) {
+ 111
+ this .dependencies = dependencies;
+ 112
+ }
+ 113
+
+ 114
+
+ 115
+
+ 116
+
+ 117 0 private String dataDirectory = null ;
+ 118
+
+ 119
+
+ 120
+
+ 121
+
+ 122
+
+ 123
+
+ 124
+ public String getDataDirectory() {
+ 125
+ return dataDirectory;
+ 126
+ }
+ 127
+
+ 128
+
+ 129
+
+ 130
+
+ 131
+
+ 132
+
+ 133
+ public void setDataDirectory(String dataDirectory) {
+ 134
+ this .dataDirectory = dataDirectory;
+ 135
+ }
+ 136
+
+ 137
+
+ 138
+
+ 139
+
+ 140
+ private String reportOutputDirectory;
+ 141
+
+ 142
+
+ 143
+
+ 144
+
+ 145
+
+ 146
+
+ 147
+ public String getReportOutputDirectory() {
+ 148
+ return reportOutputDirectory;
+ 149
+ }
+ 150
+
+ 151
+
+ 152
+
+ 153
+
+ 154
+
+ 155
+
+ 156
+ public void setReportOutputDirectory(String reportOutputDirectory) {
+ 157
+ this .reportOutputDirectory = reportOutputDirectory;
+ 158
+ }
+ 159
+
+ 160
+
+ 161
+
+ 162
+
+ 163
+
+ 164
+
+ 165 0 private float failBuildOnCVSS = 11;
+ 166
+
+ 167
+
+ 168
+
+ 169
+
+ 170
+
+ 171
+
+ 172
+ public float getFailBuildOnCVSS() {
+ 173
+ return failBuildOnCVSS;
+ 174
+ }
+ 175
+
+ 176
+
+ 177
+
+ 178
+
+ 179
+
+ 180
+
+ 181
+ public void setFailBuildOnCVSS(float failBuildOnCVSS) {
+ 182
+ this .failBuildOnCVSS = failBuildOnCVSS;
+ 183
+ }
+ 184
+
+ 185
+
+ 186
+
+ 187
+
+ 188
+
+ 189 0 private boolean autoUpdate = true ;
+ 190
+
+ 191
+
+ 192
+
+ 193
+
+ 194
+
+ 195
+
+ 196
+ public boolean isAutoUpdate() {
+ 197
+ return autoUpdate;
+ 198
+ }
+ 199
+
+ 200
+
+ 201
+
+ 202
+
+ 203
+
+ 204
+
+ 205
+ public void setAutoUpdate(boolean autoUpdate) {
+ 206
+ this .autoUpdate = autoUpdate;
+ 207
+ }
+ 208
+
+ 209
+
+ 210
+
+ 211
+
+ 212
+
+ 213 0 private ReportGenerator.Format reportFormat = ReportGenerator.Format.HTML;
+ 214
+
+ 215
+
+ 216
+
+ 217
+
+ 218
+
+ 219
+
+ 220
+ public ReportGenerator.Format getReportFormat() {
+ 221
+ return reportFormat;
+ 222
+ }
+ 223
+
+ 224
+
+ 225
+
+ 226
+
+ 227
+
+ 228
+
+ 229
+ public void setReportFormat(ReportGenerator.Format reportFormat) {
+ 230
+ this .reportFormat = reportFormat;
+ 231
+ }
+ 232
+
+ 233
+
+ 234
+
+ 235
+
+ 236
+ private String proxyUrl;
+ 237
+
+ 238
+
+ 239
+
+ 240
+
+ 241
+
+ 242
+
+ 243
+ public String getProxyUrl() {
+ 244
+ return proxyUrl;
+ 245
+ }
+ 246
+
+ 247
+
+ 248
+
+ 249
+
+ 250
+
+ 251
+
+ 252
+ public void setProxyUrl(String proxyUrl) {
+ 253
+ this .proxyUrl = proxyUrl;
+ 254
+ }
+ 255
+
+ 256
+
+ 257
+
+ 258
+
+ 259
+ private String proxyPort;
+ 260
+
+ 261
+
+ 262
+
+ 263
+
+ 264
+
+ 265
+
+ 266
+ public String getProxyPort() {
+ 267
+ return proxyPort;
+ 268
+ }
+ 269
+
+ 270
+
+ 271
+
+ 272
+
+ 273
+
+ 274
+
+ 275
+ public void setProxyPort(String proxyPort) {
+ 276
+ this .proxyPort = proxyPort;
+ 277
+ }
+ 278
+
+ 279
+
+ 280
+
+ 281
+
+ 282
+ private String proxyUsername;
+ 283
+
+ 284
+
+ 285
+
+ 286
+
+ 287
+
+ 288
+
+ 289
+ public String getProxyUsername() {
+ 290
+ return proxyUsername;
+ 291
+ }
+ 292
+
+ 293
+
+ 294
+
+ 295
+
+ 296
+
+ 297
+
+ 298
+ public void setProxyUsername(String proxyUsername) {
+ 299
+ this .proxyUsername = proxyUsername;
+ 300
+ }
+ 301
+
+ 302
+
+ 303
+
+ 304
+
+ 305
+ private String proxyPassword;
+ 306
+
+ 307
+
+ 308
+
+ 309
+
+ 310
+
+ 311
+
+ 312
+ public String getProxyPassword() {
+ 313
+ return proxyPassword;
+ 314
+ }
+ 315
+
+ 316
+
+ 317
+
+ 318
+
+ 319
+
+ 320
+
+ 321
+ public void setProxyPassword(String proxyPassword) {
+ 322
+ this .proxyPassword = proxyPassword;
+ 323
+ }
+ 324
+
+ 325
+
+ 326
+
+ 327
+
+ 328
+ private String connectionTimeout;
+ 329
+
+ 330
+
+ 331
+
+ 332
+
+ 333
+
+ 334
+
+ 335
+ public String getConnectionTimeout() {
+ 336
+ return connectionTimeout;
+ 337
+ }
+ 338
+
+ 339
+
+ 340
+
+ 341
+
+ 342
+
+ 343
+
+ 344
+ public void setConnectionTimeout(String connectionTimeout) {
+ 345
+ this .connectionTimeout = connectionTimeout;
+ 346
+ }
+ 347
+
+ 348
+
+ 349
+
+ 350
+
+ 351 0 private String logFile = null ;
+ 352
+
+ 353
+
+ 354
+
+ 355
+
+ 356
+
+ 357
+
+ 358
+ public String getLogFile() {
+ 359
+ return logFile;
+ 360
+ }
+ 361
+
+ 362
+
+ 363
+
+ 364
+
+ 365
+
+ 366
+
+ 367
+ public void setLogFile(String logFile) {
+ 368
+ this .logFile = logFile;
+ 369
+ }
+ 370
+
+ 371
+
+ 372
+
+ 373
+
+ 374
+ private String suppressionFile;
+ 375
+
+ 376
+
+ 377
+
+ 378
+
+ 379
+
+ 380
+
+ 381
+ public String getSuppressionFile() {
+ 382
+ return suppressionFile;
+ 383
+ }
+ 384
+
+ 385
+
+ 386
+
+ 387
+
+ 388
+
+ 389
+
+ 390
+ public void setSuppressionFile(String suppressionFile) {
+ 391
+ this .suppressionFile = suppressionFile;
+ 392
+ }
+ 393
+
+ 394
+
+ 395
+
+ 396
+
+ 397 0 private boolean showSummary = true ;
+ 398
+
+ 399
+
+ 400
+
+ 401
+
+ 402
+
+ 403
+
+ 404
+ public boolean isShowSummary() {
+ 405
+ return showSummary;
+ 406
+ }
+ 407
+
+ 408
+
+ 409
+
+ 410
+
+ 411
+
+ 412
+
+ 413
+ public void setShowSummary(boolean showSummary) {
+ 414
+ this .showSummary = showSummary;
+ 415
+ }
+ 416
+
+ 417
+
+ 418
+
+ 419
+
+ 420 0 private boolean nexusAnalyzerEnabled = true ;
+ 421
+
+ 422
+
+ 423
+
+ 424
+
+ 425
+
+ 426
+
+ 427
+ public boolean isNexusAnalyzerEnabled() {
+ 428
+ return nexusAnalyzerEnabled;
+ 429
+ }
+ 430
+
+ 431
+
+ 432
+
+ 433
+
+ 434
+
+ 435
+
+ 436
+ public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
+ 437
+ this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
+ 438
+ }
+ 439
+
+ 440
+
+ 441
+
+ 442
+
+ 443
+ private String nexusUrl;
+ 444
+
+ 445
+
+ 446
+
+ 447
+
+ 448
+
+ 449
+
+ 450
+ public String getNexusUrl() {
+ 451
+ return nexusUrl;
+ 452
+ }
+ 453
+
+ 454
+
+ 455
+
+ 456
+
+ 457
+
+ 458
+
+ 459
+ public void setNexusUrl(String nexusUrl) {
+ 460
+ this .nexusUrl = nexusUrl;
+ 461
+ }
+ 462
+
+ 463
+
+ 464
+
+ 465
+
+ 466 0 private boolean nexusUsesProxy = true ;
+ 467
+
+ 468
+
+ 469
+
+ 470
+
+ 471
+
+ 472
+
+ 473
+ public boolean isNexusUsesProxy() {
+ 474
+ return nexusUsesProxy;
+ 475
+ }
+ 476
+
+ 477
+
+ 478
+
+ 479
+
+ 480
+
+ 481
+
+ 482
+ public void setNexusUsesProxy(boolean nexusUsesProxy) {
+ 483
+ this .nexusUsesProxy = nexusUsesProxy;
+ 484
+ }
+ 485
+
+ 486
+
+ 487
+
+ 488
+
+ 489
+ private String databaseDriverName;
+ 490
+
+ 491
+
+ 492
+
+ 493
+
+ 494
+
+ 495
+
+ 496
+ public String getDatabaseDriverName() {
+ 497
+ return databaseDriverName;
+ 498
+ }
+ 499
+
+ 500
+
+ 501
+
+ 502
+
+ 503
+
+ 504
+
+ 505
+ public void setDatabaseDriverName(String databaseDriverName) {
+ 506
+ this .databaseDriverName = databaseDriverName;
+ 507
+ }
+ 508
+
+ 509
+
+ 510
+
+ 511
+
+ 512
+ private String databaseDriverPath;
+ 513
+
+ 514
+
+ 515
+
+ 516
+
+ 517
+
+ 518
+
+ 519
+ public String getDatabaseDriverPath() {
+ 520
+ return databaseDriverPath;
+ 521
+ }
+ 522
+
+ 523
+
+ 524
+
+ 525
+
+ 526
+
+ 527
+
+ 528
+ public void setDatabaseDriverPath(String databaseDriverPath) {
+ 529
+ this .databaseDriverPath = databaseDriverPath;
+ 530
+ }
+ 531
+
+ 532
+
+ 533
+
+ 534
+
+ 535
+ private String connectionString;
+ 536
+
+ 537
+
+ 538
+
+ 539
+
+ 540
+
+ 541
+
+ 542
+ public String getConnectionString() {
+ 543
+ return connectionString;
+ 544
+ }
+ 545
+
+ 546
+
+ 547
+
+ 548
+
+ 549
+
+ 550
+
+ 551
+ public void setConnectionString(String connectionString) {
+ 552
+ this .connectionString = connectionString;
+ 553
+ }
+ 554
+
+ 555
+
+ 556
+
+ 557
+
+ 558
+ private String databaseUser;
+ 559
+
+ 560
+
+ 561
+
+ 562
+
+ 563
+
+ 564
+
+ 565
+ public String getDatabaseUser() {
+ 566
+ return databaseUser;
+ 567
+ }
+ 568
+
+ 569
+
+ 570
+
+ 571
+
+ 572
+
+ 573
+
+ 574
+ public void setDatabaseUser(String databaseUser) {
+ 575
+ this .databaseUser = databaseUser;
+ 576
+ }
+ 577
+
+ 578
+
+ 579
+
+ 580
+
+ 581
+ private String databasePassword;
+ 582
+
+ 583
+
+ 584
+
+ 585
+
+ 586
+
+ 587
+
+ 588
+ public String getDatabasePassword() {
+ 589
+ return databasePassword;
+ 590
+ }
+ 591
+
+ 592
+
+ 593
+
+ 594
+
+ 595
+
+ 596
+
+ 597
+ public void setDatabasePassword(String databasePassword) {
+ 598
+ this .databasePassword = databasePassword;
+ 599
+ }
+ 600
+
+ 601
+
+ 602
+
+ 603
+
+ 604
+
+ 605
+ private String zipExtensions;
+ 606
+
+ 607
+
+ 608
+
+ 609
+
+ 610
+
+ 611
+
+ 612
+ public String getZipExtensions() {
+ 613
+ return zipExtensions;
+ 614
+ }
+ 615
+
+ 616
+
+ 617
+
+ 618
+
+ 619
+
+ 620
+
+ 621
+ public void setZipExtensions(String zipExtensions) {
+ 622
+ this .zipExtensions = zipExtensions;
+ 623
+ }
+ 624
+
+ 625
+
+ 626
+
+ 627
+
+ 628
+ private String cveUrl12Modified;
+ 629
+
+ 630
+
+ 631
+
+ 632
+
+ 633
+
+ 634
+
+ 635
+ public String getCveUrl12Modified() {
+ 636
+ return cveUrl12Modified;
+ 637
+ }
+ 638
+
+ 639
+
+ 640
+
+ 641
+
+ 642
+
+ 643
+
+ 644
+ public void setCveUrl12Modified(String cveUrl12Modified) {
+ 645
+ this .cveUrl12Modified = cveUrl12Modified;
+ 646
+ }
+ 647
+
+ 648
+
+ 649
+
+ 650
+
+ 651
+ private String cveUrl20Modified;
+ 652
+
+ 653
+
+ 654
+
+ 655
+
+ 656
+
+ 657
+
+ 658
+ public String getCveUrl20Modified() {
+ 659
+ return cveUrl20Modified;
+ 660
+ }
+ 661
+
+ 662
+
+ 663
+
+ 664
+
+ 665
+
+ 666
+
+ 667
+ public void setCveUrl20Modified(String cveUrl20Modified) {
+ 668
+ this .cveUrl20Modified = cveUrl20Modified;
+ 669
+ }
+ 670
+
+ 671
+
+ 672
+
+ 673
+
+ 674
+ private String cveUrl12Base;
+ 675
+
+ 676
+
+ 677
+
+ 678
+
+ 679
+
+ 680
+
+ 681
+ public String getCveUrl12Base() {
+ 682
+ return cveUrl12Base;
+ 683
+ }
+ 684
+
+ 685
+
+ 686
+
+ 687
+
+ 688
+
+ 689
+
+ 690
+ public void setCveUrl12Base(String cveUrl12Base) {
+ 691
+ this .cveUrl12Base = cveUrl12Base;
+ 692
+ }
+ 693
+
+ 694
+
+ 695
+
+ 696
+
+ 697
+ private String cveUrl20Base;
+ 698
+
+ 699
+
+ 700
+
+ 701
+
+ 702
+
+ 703
+
+ 704
+ public String getCveUrl20Base() {
+ 705
+ return cveUrl20Base;
+ 706
+ }
+ 707
+
+ 708
+
+ 709
+
+ 710
+
+ 711
+
+ 712
+
+ 713
+ public void setCveUrl20Base(String cveUrl20Base) {
+ 714
+ this .cveUrl20Base = cveUrl20Base;
+ 715
+ }
+ 716
+
+ 717
+
+ 718
+
+ 719
+
+ 720
+ private String pathToMono;
+ 721
+
+ 722
+
+ 723
+
+ 724
+
+ 725
+
+ 726
+
+ 727
+ public String getPathToMono() {
+ 728
+ return pathToMono;
+ 729
+ }
+ 730
+
+ 731
+
+ 732
+
+ 733
+
+ 734
+
+ 735
+
+ 736
+ public void setPathToMono(String pathToMono) {
+ 737
+ this .pathToMono = pathToMono;
+ 738
+ }
+ 739
+
+ 740
+
+ 741
+
+ 742
+
+ 743
+
+ 744
+
+ 745
+
+ 746
+
+ 747
+ private Engine executeDependencyCheck() throws DatabaseException {
+ 748 0 populateSettings();
+ 749 0 Engine engine = null ;
+ 750
+ try {
+ 751 0 engine = new Engine();
+ 752 0 engine.setDependencies(this .dependencies);
+ 753 0 engine.analyzeDependencies();
+ 754
+
+ 755
+ } finally {
+ 756 0 if (engine != null ) {
+ 757 0 engine.cleanup();
+ 758
+ }
+ 759
+ }
+ 760 0 return engine;
+ 761
+ }
+ 762
+
+ 763
+
+ 764
+
+ 765
+
+ 766
+
+ 767
+
+ 768
+
+ 769
+ private void generateExternalReports(Engine engine, File outDirectory) {
+ 770 0 DatabaseProperties prop = null ;
+ 771 0 CveDB cve = null ;
+ 772
+ try {
+ 773 0 cve = new CveDB();
+ 774 0 cve.open();
+ 775 0 prop = cve.getDatabaseProperties();
+ 776 0 } catch (DatabaseException ex) {
+ 777 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+ 778
+ } finally {
+ 779 0 if (cve != null ) {
+ 780 0 cve.close();
+ 781
+ }
+ 782
+ }
+ 783 0 final ReportGenerator r = new ReportGenerator(this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
+ 784
+ try {
+ 785 0 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
+ 786 0 } catch (IOException ex) {
+ 787 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.SEVERE,
+ 788
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 789 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, null , ex);
+ 790 0 } catch (Throwable ex) {
+ 791 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.SEVERE,
+ 792
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 793 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, null , ex);
+ 794 0 }
+ 795 0 }
+ 796
+
+ 797
+
+ 798
+
+ 799
+
+ 800
+
+ 801
+ private void populateSettings() {
+ 802 0 if (dataDirectory != null ) {
+ 803 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ 804
+ } else {
+ 805 0 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
+ 806 0 final File base = jarPath.getParentFile();
+ 807 0 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+ 808 0 final File dataDir = new File(base, sub);
+ 809 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ 810
+ }
+ 811
+
+ 812 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 813
+
+ 814 0 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+ 815 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+ 816
+ }
+ 817 0 if (proxyPort != null && !proxyPort.isEmpty()) {
+ 818 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+ 819
+ }
+ 820 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+ 821 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+ 822
+ }
+ 823 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+ 824 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+ 825
+ }
+ 826 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+ 827 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+ 828
+ }
+ 829 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+ 830 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+ 831
+ }
+ 832 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+ 833 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+ 834 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 835
+ }
+ 836 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+ 837 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+ 838 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 839
+ }
+ 840 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+ 841 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 842
+ }
+ 843 0 if (connectionString != null && !connectionString.isEmpty()) {
+ 844 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 845
+ }
+ 846 0 if (databaseUser != null && !databaseUser.isEmpty()) {
+ 847 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+ 848
+ }
+ 849 0 if (databasePassword != null && !databasePassword.isEmpty()) {
+ 850 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+ 851
+ }
+ 852 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+ 853 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+ 854
+ }
+ 855 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+ 856 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+ 857
+ }
+ 858 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+ 859 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+ 860
+ }
+ 861 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+ 862 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+ 863
+ }
+ 864 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+ 865 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+ 866
+ }
+ 867 0 if (pathToMono != null && !pathToMono.isEmpty()) {
+ 868 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+ 869
+ }
+ 870 0 }
+ 871
+
+ 872
+
+ 873
+
+ 874
+
+ 875
+
+ 876
+
+ 877
+
+ 878
+ public void execute() throws ScanAgentException {
+ 879 0 Engine engine = null ;
+ 880
+ try {
+ 881 0 engine = executeDependencyCheck();
+ 882 0 generateExternalReports(engine, new File(this .reportOutputDirectory));
+ 883 0 if (this .showSummary) {
+ 884 0 showSummary(engine.getDependencies());
+ 885
+ }
+ 886 0 if (this .failBuildOnCVSS <= 10) {
+ 887 0 checkForFailure(engine.getDependencies());
+ 888
+ }
+ 889 0 } catch (DatabaseException ex) {
+ 890 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.SEVERE,
+ 891
+ "Unable to connect to the dependency-check database; analysis has stopped" );
+ 892 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, "" , ex);
+ 893
+ } finally {
+ 894 0 if (engine != null ) {
+ 895 0 engine.cleanup();
+ 896
+ }
+ 897
+ }
+ 898 0 }
+ 899
+
+ 900
+
+ 901
+
+ 902
+
+ 903
+
+ 904
+
+ 905
+
+ 906
+
+ 907
+
+ 908
+ private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
+ 909 0 final StringBuilder ids = new StringBuilder();
+ 910 0 for (Dependency d : dependencies) {
+ 911 0 boolean addName = true ;
+ 912 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 913 0 if (v.getCvssScore() >= failBuildOnCVSS) {
+ 914 0 if (addName) {
+ 915 0 addName = false ;
+ 916 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+ 917 0 ids.append(v.getName());
+ 918
+ } else {
+ 919 0 ids.append(", " ).append(v.getName());
+ 920
+ }
+ 921
+ }
+ 922 0 }
+ 923 0 }
+ 924 0 if (ids.length() > 0) {
+ 925 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 926
+ + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+ 927
+ + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+ 928
+
+ 929 0 throw new ScanAgentException(msg);
+ 930
+ }
+ 931 0 }
+ 932
+
+ 933
+
+ 934
+
+ 935
+
+ 936
+
+ 937
+
+ 938
+ private void showSummary(List<Dependency> dependencies) {
+ 939 0 final StringBuilder summary = new StringBuilder();
+ 940 0 for (Dependency d : dependencies) {
+ 941 0 boolean firstEntry = true ;
+ 942 0 final StringBuilder ids = new StringBuilder();
+ 943 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 944 0 if (firstEntry) {
+ 945 0 firstEntry = false ;
+ 946
+ } else {
+ 947 0 ids.append(", " );
+ 948
+ }
+ 949 0 ids.append(v.getName());
+ 950 0 }
+ 951 0 if (ids.length() > 0) {
+ 952 0 summary.append(d.getFileName()).append(" (" );
+ 953 0 firstEntry = true ;
+ 954 0 for (Identifier id : d.getIdentifiers()) {
+ 955 0 if (firstEntry) {
+ 956 0 firstEntry = false ;
+ 957
+ } else {
+ 958 0 summary.append(", " );
+ 959
+ }
+ 960 0 summary.append(id.getValue());
+ 961 0 }
+ 962 0 summary.append(") : " ).append(ids).append(NEW_LINE);
+ 963
+ }
+ 964 0 }
+ 965 0 if (summary.length() > 0) {
+ 966 0 final String msg = String.format("%n%n"
+ 967
+ + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+ 968
+ + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+ 969 0 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.WARNING, msg);
+ 970
+ }
+ 971 0 }
+ 972
+
+ 973
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
index b20e473ee..bcb2cf808 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,96 +56,57 @@
19
20
- import java.util.Collections;
- 21
- import java.util.HashSet;
- 22
- import java.util.Set;
- 23
-
- 24
- 25
+ 21
- 26
+ 22
- 27
+ 23
- 28
+ 24
public abstract class AbstractAnalyzer implements Analyzer {
- 29
+ 25
- 30
+ 26
- 31
-
- 32
-
- 33
-
- 34
-
- 35
-
- 36
-
- 37
-
- 38
-
- 39
-
- 40
- protected static Set<String> newHashSet(String... strings) {
- 41 10 final Set<String> set = new HashSet<String>();
- 42
-
- 43 10 Collections.addAll(set, strings);
- 44 10 return set;
- 45
- }
- 46
-
- 47
-
- 48
+ 27
- 49
+ 28
- 50
+ 29
- 51
+ 30
- 52
+ 31
@Override
- 53
+ 32
public void initialize() throws Exception {
- 54
+ 33
- 55 29 }
- 56
+ 34 0 }
+ 35
- 57
+ 36
- 58
+ 37
- 59
+ 38
- 60
+ 39
- 61
+ 40
- 62
+ 41
@Override
- 63
+ 42
public void close() throws Exception {
- 64
+ 43
- 65 33 }
- 66
+ 44 0 }
+ 45
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
new file mode 100644
index 000000000..3cb332227
--- /dev/null
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
@@ -0,0 +1,447 @@
+
+
+
+Coverage Report
+Coverage Report - org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.analyzer;
+ 19
+
+ 20
+ import java.util.Collections;
+ 21
+ import java.util.HashSet;
+ 22
+ import java.util.Set;
+ 23
+ import java.util.logging.Level;
+ 24
+ import java.util.logging.Logger;
+ 25
+ import org.owasp.dependencycheck.Engine;
+ 26
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ 27
+ import org.owasp.dependencycheck.dependency.Dependency;
+ 28
+ import org.owasp.dependencycheck.utils.InvalidSettingException;
+ 29
+ import org.owasp.dependencycheck.utils.Settings;
+ 30
+
+ 31
+
+ 32
+
+ 33
+
+ 34
+
+ 35
+
+ 36
+ public abstract class AbstractFileTypeAnalyzer extends AbstractAnalyzer implements FileTypeAnalyzer {
+ 37
+
+ 38
+
+ 39
+
+ 40
+
+ 41
+
+ 42
+
+ 43 0 public AbstractFileTypeAnalyzer() {
+ 44 0 final String key = getAnalyzerEnabledSettingKey();
+ 45
+ try {
+ 46 0 enabled = Settings.getBoolean(key, true );
+ 47 0 } catch (InvalidSettingException ex) {
+ 48 0 String msg = String.format("Invalid settting for property '%s'" , key);
+ 49 0 LOGGER.log(Level.WARNING, msg);
+ 50 0 LOGGER.log(Level.FINE, "" , ex);
+ 51 0 msg = String.format("%s has been disabled" , getName());
+ 52 0 LOGGER.log(Level.WARNING, msg);
+ 53 0 }
+ 54 0 }
+ 55
+
+ 56
+
+ 57
+
+ 58
+
+ 59
+
+ 60
+
+ 61 0 private static final Logger LOGGER = Logger.getLogger(AbstractFileTypeAnalyzer.class .getName());
+ 62
+
+ 63
+
+ 64
+
+ 65 0 private boolean filesMatched = false ;
+ 66
+
+ 67
+
+ 68
+
+ 69
+
+ 70
+
+ 71
+
+ 72
+ protected boolean isFilesMatched() {
+ 73
+ return filesMatched;
+ 74
+ }
+ 75
+
+ 76
+
+ 77
+
+ 78
+
+ 79
+
+ 80
+
+ 81
+ protected void setFilesMatched(boolean filesMatched) {
+ 82
+ this .filesMatched = filesMatched;
+ 83
+ }
+ 84
+
+ 85
+
+ 86
+
+ 87
+
+ 88 0 private boolean enabled = true ;
+ 89
+
+ 90
+
+ 91
+
+ 92
+
+ 93
+
+ 94
+
+ 95
+ public boolean isEnabled() {
+ 96
+ return enabled;
+ 97
+ }
+ 98
+
+ 99
+
+ 100
+
+ 101
+
+ 102
+
+ 103
+
+ 104
+ public void setEnabled(boolean enabled) {
+ 105
+ this .enabled = enabled;
+ 106
+ }
+ 107
+
+ 108
+
+ 109
+
+ 110
+
+ 111
+
+ 112
+
+ 113
+
+ 114
+
+ 115
+
+ 116
+
+ 117
+
+ 118
+
+ 119
+
+ 120
+
+ 121
+
+ 122
+
+ 123
+
+ 124
+ protected abstract Set<String> getSupportedExtensions();
+ 125
+
+ 126
+
+ 127
+
+ 128
+
+ 129
+
+ 130
+
+ 131
+ protected abstract void initializeFileTypeAnalyzer() throws Exception;
+ 132
+
+ 133
+
+ 134
+
+ 135
+
+ 136
+
+ 137
+
+ 138
+
+ 139
+
+ 140
+
+ 141
+ protected abstract void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException;
+ 142
+
+ 143
+
+ 144
+
+ 145
+
+ 146
+
+ 147
+
+ 148
+
+ 149
+ protected abstract String getAnalyzerEnabledSettingKey();
+ 150
+
+ 151
+
+ 152
+
+ 153
+
+ 154
+
+ 155
+
+ 156
+
+ 157
+
+ 158
+ @Override
+ 159
+ public final void initialize() throws Exception {
+ 160 0 if (filesMatched) {
+ 161 0 initializeFileTypeAnalyzer();
+ 162
+ } else {
+ 163 0 enabled = false ;
+ 164
+ }
+ 165 0 }
+ 166
+
+ 167
+
+ 168
+
+ 169
+
+ 170
+
+ 171
+
+ 172
+
+ 173
+
+ 174
+
+ 175
+ @Override
+ 176
+ public final void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+ 177 0 if (enabled) {
+ 178 0 analyzeFileType(dependency, engine);
+ 179
+ }
+ 180 0 }
+ 181
+
+ 182
+
+ 183
+
+ 184
+
+ 185
+
+ 186
+
+ 187
+
+ 188
+ @Override
+ 189
+ public final boolean supportsExtension(String extension) {
+ 190 0 if (!enabled) {
+ 191 0 return false ;
+ 192
+ }
+ 193 0 final Set<String> ext = getSupportedExtensions();
+ 194 0 if (ext == null ) {
+ 195 0 final String msg = String.format("The '%s' analyzer is misconfigured and does not have any file extensions;"
+ 196
+ + " it will be disabled" , getName());
+ 197 0 Logger.getLogger(AbstractFileTypeAnalyzer.class .getName()).log(Level.SEVERE, msg);
+ 198 0 return false ;
+ 199
+ } else {
+ 200 0 final boolean match = ext.contains(extension);
+ 201 0 if (match) {
+ 202 0 filesMatched = match;
+ 203
+ }
+ 204 0 return match;
+ 205
+ }
+ 206
+ }
+ 207
+
+ 208
+
+ 209
+
+ 210
+
+ 211
+
+ 212
+
+ 213
+
+ 214
+
+ 215
+
+ 216
+
+ 217
+
+ 218
+
+ 219
+
+ 220
+
+ 221
+
+ 222
+ protected static Set<String> newHashSet(String... strings) {
+ 223 0 final Set<String> set = new HashSet<String>();
+ 224
+
+ 225 0 Collections.addAll(set, strings);
+ 226 0 return set;
+ 227
+ }
+ 228
+
+ 229
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
index 75be9bc4e..26988d67e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
@@ -12,7 +12,7 @@
@@ -124,172 +124,154 @@
53
54
-
+ 55
-
+ 56
-
+ 57
-
+ 58
-
+ 59
60
@Override
61
- public boolean supportsExtension(String extension) {
- 62 19 return true ;
- 63
- }
- 64
-
- 65
-
- 66
-
- 67
-
- 68
-
- 69
-
- 70
-
- 71
- @Override
- 72
public void initialize() throws Exception {
- 73 8 super .initialize();
- 74 8 loadSuppressionData();
- 75 8 }
- 76
+ 62 0 super .initialize();
+ 63 0 loadSuppressionData();
+ 64 0 }
+ 65
- 77
+ 66
- 78
+ 67
- 79
+ 68
private List<SuppressionRule> rules;
- 80
+ 69
- 81
+ 70
- 82
+ 71
- 83
+ 72
- 84
+ 73
- 85
+ 74
- 86
+ 75
public List<SuppressionRule> getRules() {
- 87
+ 76
return rules;
- 88
+ 77
}
- 89
+ 78
- 90
+ 79
- 91
+ 80
- 92
+ 81
- 93
+ 82
- 94
+ 83
- 95
+ 84
public void setRules(List<SuppressionRule> rules) {
- 96
+ 85
this .rules = rules;
- 97
+ 86
}
- 98
+ 87
- 99
+ 88
- 100
+ 89
- 101
+ 90
- 102
+ 91
- 103
+ 92
- 104
+ 93
private void loadSuppressionData() throws SuppressionParseException {
- 105 8 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
- 106 8 if (suppressionFilePath == null ) {
- 107 0 return ;
- 108
+ 94 0 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
+ 95 0 if (suppressionFilePath == null ) {
+ 96 0 return ;
+ 97
}
- 109 8 File file = null ;
- 110 8 boolean deleteTempFile = false ;
- 111
+ 98 0 File file = null ;
+ 99 0 boolean deleteTempFile = false ;
+ 100
try {
- 112 8 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
- 113 8 if (uriRx.matcher(suppressionFilePath).matches()) {
- 114 8 deleteTempFile = true ;
- 115 8 file = FileUtils.getTempFile("suppression" , "xml" );
- 116 8 final URL url = new URL(suppressionFilePath);
+ 101 0 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
+ 102 0 if (uriRx.matcher(suppressionFilePath).matches()) {
+ 103 0 deleteTempFile = true ;
+ 104 0 file = FileUtils.getTempFile("suppression" , "xml" );
+ 105 0 final URL url = new URL(suppressionFilePath);
+ 106
+ try {
+ 107 0 Downloader.fetchFile(url, file, false );
+ 108 0 } catch (DownloadFailedException ex) {
+ 109 0 Downloader.fetchFile(url, file, true );
+ 110 0 }
+ 111 0 } else {
+ 112 0 file = new File(suppressionFilePath);
+ 113
+ }
+ 114
+
+ 115 0 if (file != null ) {
+ 116 0 final SuppressionParser parser = new SuppressionParser();
117
try {
- 118 8 Downloader.fetchFile(url, file, false );
- 119 0 } catch (DownloadFailedException ex) {
- 120 0 Downloader.fetchFile(url, file, true );
- 121 8 }
- 122
+ 118 0 rules = parser.parseSuppressionRules(file);
+ 119 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, rules.size() + " suppression rules were loaded." );
+ 120 0 } catch (SuppressionParseException ex) {
+ 121 0 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
+ 122 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, msg);
+ 123 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, ex.getMessage());
+ 124 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+ 125 0 throw ex;
+ 126 0 }
+ 127
}
- 123
-
- 124 8 if (file != null ) {
- 125 8 final SuppressionParser parser = new SuppressionParser();
- 126
- try {
- 127 8 rules = parser.parseSuppressionRules(file);
- 128 0 } catch (SuppressionParseException ex) {
- 129 0 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
- 130 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, msg);
- 131 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, ex.getMessage());
- 132 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 133 0 throw ex;
- 134 8 }
- 135
- }
- 136 0 } catch (DownloadFailedException ex) {
- 137 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
- 138
+ 128 0 } catch (DownloadFailedException ex) {
+ 129 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
+ 130
"Unable to fetch the configured suppression file" );
- 139 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
- 140 0 throw new SuppressionParseException("Unable to fetch the configured suppression file" , ex);
- 141 0 } catch (MalformedURLException ex) {
- 142 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
- 143
+ 131 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+ 132 0 throw new SuppressionParseException("Unable to fetch the configured suppression file" , ex);
+ 133 0 } catch (MalformedURLException ex) {
+ 134 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
+ 135
"Configured suppression file has an invalid URL" );
- 144 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
- 145 0 throw new SuppressionParseException("Configured suppression file has an invalid URL" , ex);
- 146 0 } catch (IOException ex) {
- 147 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
- 148
+ 136 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+ 137 0 throw new SuppressionParseException("Configured suppression file has an invalid URL" , ex);
+ 138 0 } catch (IOException ex) {
+ 139 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
+ 140
"Unable to create temp file for suppressions" );
- 149 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
- 150 0 throw new SuppressionParseException("Unable to create temp file for suppressions" , ex);
- 151
+ 141 0 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+ 142 0 throw new SuppressionParseException("Unable to create temp file for suppressions" , ex);
+ 143
} finally {
- 152 8 if (deleteTempFile && file != null ) {
- 153 8 FileUtils.delete(file);
- 154
+ 144 0 if (deleteTempFile && file != null ) {
+ 145 0 FileUtils.delete(file);
+ 146
}
- 155
+ 147
}
- 156 8 }
- 157
+ 148 0 }
+ 149
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
index 366422db1..fcc51cc2e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
@@ -12,7 +12,7 @@
@@ -65,7 +65,7 @@
24
- 25 162 public enum AnalysisPhase {
+ 25 0 public enum AnalysisPhase {
26
27
@@ -74,67 +74,67 @@
29
- 30 1 INITIAL,
+ 30 0 INITIAL,
31
32
33
- 34 1 INFORMATION_COLLECTION,
+ 34 0 INFORMATION_COLLECTION,
35
36
37
- 38 1 PRE_IDENTIFIER_ANALYSIS,
+ 38 0 PRE_IDENTIFIER_ANALYSIS,
39
40
41
- 42 1 IDENTIFIER_ANALYSIS,
+ 42 0 IDENTIFIER_ANALYSIS,
43
44
45
- 46 1 POST_IDENTIFIER_ANALYSIS,
+ 46 0 POST_IDENTIFIER_ANALYSIS,
47
48
49
- 50 1 PRE_FINDING_ANALYSIS,
+ 50 0 PRE_FINDING_ANALYSIS,
51
52
53
- 54 1 FINDING_ANALYSIS,
+ 54 0 FINDING_ANALYSIS,
55
56
57
- 58 1 POST_FINDING_ANALYSIS,
+ 58 0 POST_FINDING_ANALYSIS,
59
60
61
- 62 1 FINAL
+ 62 0 FINAL
63
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
index bd6e7edc5..53c70ace1 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
@@ -56,161 +56,111 @@
19
20
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
- 21
- import java.util.Set;
- 22
import org.owasp.dependencycheck.Engine;
- 23
+ 21
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ 22
import org.owasp.dependencycheck.dependency.Dependency;
+ 23
+
24
-
- 25
- 26
+ 25
- 27
+ 26
- 28
+ 27
- 29
+ 28
- 30
+ 29
- 31
+ 30
public interface Analyzer {
+ 31
+
32
-
+ 33
-
- 34
- 35
+ 34
- 36
+ 35
+ 36
+
37
-
- 38
- 39
+ 38
- 40
+ 39
- 41
+ 40
+ 41
+
42
-
- 43
void analyze(Dependency dependency, Engine engine) throws AnalysisException;
+ 43
+
44
-
+ 45
-
- 46
-
- 47
-
- 48
-
- 49
-
- 50
-
- 51
-
- 52
-
- 53
-
- 54
-
- 55
-
- 56
-
- 57
-
- 58
-
- 59
- Set<String> getSupportedExtensions();
- 60
-
- 61
-
- 62
- 63
+ 46
- 64
+ 47
- 65
+ 48
- 66
+ 49
String getName();
- 67
+ 50
- 68
+ 51
- 69
-
- 70
-
- 71
-
- 72
-
- 73
-
- 74
- boolean supportsExtension(String extension);
- 75
-
- 76
-
- 77
+ 52
- 78
+ 53
- 79
+ 54
- 80
+ 55
- 81
+ 56
AnalysisPhase getAnalysisPhase();
- 82
+ 57
- 83
+ 58
- 84
+ 59
- 85
+ 60
- 86
+ 61
- 87
+ 62
- 88
+ 63
void initialize() throws Exception;
- 89
+ 64
- 90
+ 65
- 91
+ 66
- 92
+ 67
- 93
+ 68
- 94
+ 69
- 95
+ 70
void close() throws Exception;
- 96
+ 71
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html
index e65b99fd8..75febe131 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html
@@ -12,7 +12,7 @@
@@ -97,9 +97,9 @@
40
- 41 1 private AnalyzerService() {
- 42 1 loader = ServiceLoader.load(Analyzer.class );
- 43 1 }
+ 41 0 private AnalyzerService() {
+ 42 0 loader = ServiceLoader.load(Analyzer.class );
+ 43 0 }
44
45
@@ -114,11 +114,11 @@
50
public static synchronized AnalyzerService getInstance() {
- 51 7 if (service == null ) {
- 52 1 service = new AnalyzerService();
+ 51 0 if (service == null ) {
+ 52 0 service = new AnalyzerService();
53
}
- 54 7 return service;
+ 54 0 return service;
55
}
56
@@ -135,13 +135,13 @@
62
public Iterator<Analyzer> getAnalyzers() {
- 63 7 return loader.iterator();
+ 63 0 return loader.iterator();
64
}
65
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
index 4b05de714..a4193476b 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
@@ -12,7 +12,7 @@
@@ -128,567 +128,580 @@
55
56
- public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
+ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer { 57
58
59
-
+ 60
- 61
- private static final int BUFFER_SIZE = 4096;
+ 61 0 private static final Logger LOGGER = Logger.getLogger(ArchiveAnalyzer.class .getName());
62
63
-
+ 64
- 65 1 private static int dirCount = 0;
+ 65
+ private static final int BUFFER_SIZE = 4096;
66
67
-
+ 68
- 69
- private File tempFileLocation = null ;
+ 69 0 private static int dirCount = 0;
70
71
-
+ 72
- 73 1 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth" , 3);
+ 73
+ private File tempFileLocation = null ;
74
75
-
+ 76
- 77
- private int scanDepth = 0;
+ 77 0 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth" , 3);
78
-
+ 79
-
+ 80
-
+ 81
-
+ private int scanDepth = 0; 82
- private static final String ANALYZER_NAME = "Archive Analyzer" ;
+ 83
-
+ 84
-
+ 85
+
+ 86
- 86 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
87
-
+ private static final String ANALYZER_NAME = "Archive Analyzer" ; 88
-
- 89
-
- 90 1 private static final Set<String> ZIPPABLES = newHashSet("zip" , "ear" , "war" , "nupkg" );
- 91
+ 89
+
+ 90
+
+ 91 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
92
-
+ 93
-
+ 94
- 95 1 private static final Set<String> EXTENSIONS = newHashSet("tar" , "gz" , "tgz" );
+ 95 0 private static final Set<String> ZIPPABLES = newHashSet("zip" , "ear" , "war" , "nupkg" );
96
-
+ 97
- static {
- 98 1 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
- 99 1 if (additionalZipExt != null ) {
- 100 0 final HashSet ext = new HashSet<String>(Arrays.asList(additionalZipExt));
- 101 0 ZIPPABLES.addAll(ext);
+ 98
+
+ 99
+
+ 100 0 private static final Set<String> EXTENSIONS = newHashSet("tar" , "gz" , "tgz" );
+ 101
+
102
- }
- 103 1 EXTENSIONS.addAll(ZIPPABLES);
- 104 1 }
- 105
-
- 106
-
+ static { 103 0 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
+ 104 0 if (additionalZipExt != null ) {
+ 105 0 final HashSet ext = new HashSet<String>(Arrays.asList(additionalZipExt));
+ 106 0 ZIPPABLES.addAll(ext);
107
-
- 108
-
- 109
-
+ } 108 0 EXTENSIONS.addAll(ZIPPABLES);
+ 109 0 }
110
-
+ 111
- public Set<String> getSupportedExtensions() {
- 112 158 return EXTENSIONS;
+ 112
+
113
- }
+ 114
-
+ 115
-
+ 116
-
+ @Override 117
-
- 118
-
+ public Set<String> getSupportedExtensions() { 118 0 return EXTENSIONS;
119
-
+ } 120
- public String getName() {
- 121 10 return ANALYZER_NAME;
+ 121
+
122
- }
+ 123
-
+ 124
-
+ 125
-
+ 126
-
+ @Override 127
-
- 128
-
+ public String getName() { 128 0 return ANALYZER_NAME;
129
-
+ } 130
- public boolean supportsExtension(String extension) {
- 131 173 return EXTENSIONS.contains(extension);
+ 131
+
132
- }
- 133
-
- 134
-
- 135
- 136
+ 133
- 137
+ 134
- 138
+ 135
- 139
+ 136
+ @Override
+ 137
public AnalysisPhase getAnalysisPhase() {
- 140 7 return ANALYSIS_PHASE;
- 141
+ 138 0 return ANALYSIS_PHASE;
+ 139
}
- 142
+ 140
+ 141
+
+ 142
+
143
-
+ 144
-
+ 145
-
+ 146
-
+ 147
-
+ @Override 148
-
- 149
- @Override
+ protected String getAnalyzerEnabledSettingKey() { 149 0 return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
150
- public void initialize() throws Exception {
- 151 9 final File baseDir = Settings.getTempDirectory();
- 152 9 if (!baseDir.exists()) {
- 153 0 if (!baseDir.mkdirs()) {
- 154 0 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
- 155 0 throw new AnalysisException(msg);
- 156
- }
- 157
- }
- 158 9 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
- 159 9 if (!tempFileLocation.delete()) {
- 160 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
- 161 0 throw new AnalysisException(msg);
- 162
- }
- 163 9 if (!tempFileLocation.mkdirs()) {
- 164 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
- 165 0 throw new AnalysisException(msg);
- 166
- }
- 167 9 }
- 168
-
- 169
-
- 170
-
- 171
-
- 172
-
- 173
-
- 174
- @Override
- 175
- public void close() throws Exception {
- 176 9 if (tempFileLocation != null && tempFileLocation.exists()) {
- 177 9 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, "Attempting to delete temporary files" );
- 178 9 final boolean success = FileUtils.delete(tempFileLocation);
- 179 9 if (!success) {
- 180 2 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.WARNING,
- 181
- "Failed to delete some temporary files, see the log for more details" );
- 182
- }
- 183
- }
- 184 9 }
- 185
-
- 186
-
- 187
-
- 188
-
- 189
-
- 190
-
- 191
-
- 192
-
- 193
-
- 194
- @Override
- 195
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 196 8 final File f = new File(dependency.getActualFilePath());
- 197 8 final File tmpDir = getNextTempDirectory();
- 198 8 extractFiles(f, tmpDir, engine);
- 199
-
- 200
-
- 201 8 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
- 202 8 engine.scan(tmpDir);
- 203 8 final List<Dependency> newDependencies = engine.getDependencies();
- 204 8 if (dependencies.size() != newDependencies.size()) {
- 205
-
- 206 6 final Set<Dependency> dependencySet = new HashSet<Dependency>();
- 207 6 dependencySet.addAll(newDependencies);
- 208 6 dependencySet.removeAll(dependencies);
- 209
-
- 210 6 for (Dependency d : dependencySet) {
- 211
-
- 212 19 final String displayPath = String.format("%s%s" ,
- 213
- dependency.getFilePath(),
- 214
- d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
- 215 19 final String displayName = String.format("%s%s%s" ,
- 216
- dependency.getFileName(),
- 217
- File.separator,
- 218
- d.getFileName());
- 219 19 d.setFilePath(displayPath);
- 220 19 d.setFileName(displayName);
- 221
-
- 222
-
- 223
-
- 224 19 if (this .supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) {
- 225 3 scanDepth += 1;
- 226 3 analyze(d, engine);
- 227 3 scanDepth -= 1;
- 228
- }
- 229 19 }
- 230
- }
- 231 8 Collections.sort(engine.getDependencies());
- 232 8 }
- 233
-
- 234
-
- 235
-
- 236
-
- 237
-
- 238
-
- 239
-
- 240
- private File getNextTempDirectory() throws AnalysisException {
- 241 8 dirCount += 1;
- 242 8 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
- 243
-
- 244 8 if (directory.exists()) {
- 245 0 return getNextTempDirectory();
- 246
- }
- 247 8 if (!directory.mkdirs()) {
- 248 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
- 249 0 throw new AnalysisException(msg);
- 250
- }
- 251 8 return directory;
- 252
}
- 253
+ 151
- 254
+ 152
- 255
-
- 256
+ 153
+
+ 154
- 257
-
- 258
-
- 259
-
- 260
-
- 261
+ 155
+
+ 156
- 262
- private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
- 263 8 if (archive == null || destination == null ) {
- 264 0 return ;
- 265
+ 157
+ @Override
+ 158
+ public void initializeFileTypeAnalyzer() throws Exception {
+ 159 0 final File baseDir = Settings.getTempDirectory();
+ 160 0 if (!baseDir.exists()) {
+ 161 0 if (!baseDir.mkdirs()) {
+ 162 0 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
+ 163 0 throw new AnalysisException(msg);
+ 164
+ }
+ 165
}
- 266
+ 166 0 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+ 167 0 if (!tempFileLocation.delete()) {
+ 168 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
+ 169 0 throw new AnalysisException(msg);
+ 170
+ }
+ 171 0 if (!tempFileLocation.mkdirs()) {
+ 172 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
+ 173 0 throw new AnalysisException(msg);
+ 174
+ }
+ 175 0 }
+ 176
- 267 8 FileInputStream fis = null ;
+ 177
+
+ 178
+
+ 179
+
+ 180
+
+ 181
+
+ 182
+ @Override
+ 183
+ public void close() throws Exception {
+ 184 0 if (tempFileLocation != null && tempFileLocation.exists()) {
+ 185 0 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+ 186 0 final boolean success = FileUtils.delete(tempFileLocation);
+ 187 0 if (!success) {
+ 188 0 LOGGER.log(Level.WARNING, "Failed to delete some temporary files, see the log for more details" );
+ 189
+ }
+ 190
+ }
+ 191 0 }
+ 192
+
+ 193
+
+ 194
+
+ 195
+
+ 196
+
+ 197
+
+ 198
+
+ 199
+
+ 200
+
+ 201
+ @Override
+ 202
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ 203 0 final File f = new File(dependency.getActualFilePath());
+ 204 0 final File tmpDir = getNextTempDirectory();
+ 205 0 extractFiles(f, tmpDir, engine);
+ 206
+
+ 207
+
+ 208 0 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
+ 209 0 engine.scan(tmpDir);
+ 210 0 final List<Dependency> newDependencies = engine.getDependencies();
+ 211 0 if (dependencies.size() != newDependencies.size()) {
+ 212
+
+ 213 0 final Set<Dependency> dependencySet = new HashSet<Dependency>();
+ 214 0 dependencySet.addAll(newDependencies);
+ 215 0 dependencySet.removeAll(dependencies);
+ 216
+
+ 217 0 for (Dependency d : dependencySet) {
+ 218
+
+ 219 0 final String displayPath = String.format("%s%s" ,
+ 220
+ dependency.getFilePath(),
+ 221
+ d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
+ 222 0 final String displayName = String.format("%s%s%s" ,
+ 223
+ dependency.getFileName(),
+ 224
+ File.separator,
+ 225
+ d.getFileName());
+ 226 0 d.setFilePath(displayPath);
+ 227 0 d.setFileName(displayName);
+ 228
+
+ 229
+
+ 230
+
+ 231 0 if (this .supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) {
+ 232 0 scanDepth += 1;
+ 233 0 analyze(d, engine);
+ 234 0 scanDepth -= 1;
+ 235
+ }
+ 236 0 }
+ 237
+ }
+ 238 0 Collections.sort(engine.getDependencies());
+ 239 0 }
+ 240
+
+ 241
+
+ 242
+
+ 243
+
+ 244
+
+ 245
+
+ 246
+
+ 247
+ private File getNextTempDirectory() throws AnalysisException {
+ 248 0 dirCount += 1;
+ 249 0 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+ 250
+
+ 251 0 if (directory.exists()) {
+ 252 0 return getNextTempDirectory();
+ 253
+ }
+ 254 0 if (!directory.mkdirs()) {
+ 255 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+ 256 0 throw new AnalysisException(msg);
+ 257
+ }
+ 258 0 return directory;
+ 259
+ }
+ 260
+
+ 261
+
+ 262
+
+ 263
+
+ 264
+
+ 265
+
+ 266
+
+ 267
+
268
- try {
- 269 8 fis = new FileInputStream(archive);
- 270 0 } catch (FileNotFoundException ex) {
- 271 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 272 0 throw new AnalysisException("Archive file was not found." , ex);
- 273 8 }
- 274 8 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
+ 269
+ private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
+ 270 0 if (archive == null || destination == null ) {
+ 271 0 return ;
+ 272
+ }
+ 273
+
+ 274 0 FileInputStream fis = null ;
275
try {
- 276 8 if (ZIPPABLES.contains(archiveExt)) {
- 277 3 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
- 278 5 } else if ("tar" .equals(archiveExt)) {
- 279 3 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
- 280 2 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
- 281 2 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
- 282 2 final String uncompressedExt = FileUtils.getFileExtension(uncompressedName).toLowerCase();
- 283 2 if (engine.supportsExtension(uncompressedExt)) {
- 284 2 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName));
- 285
- }
- 286
- }
- 287 0 } catch (ArchiveExtractionException ex) {
- 288 0 final String msg = String.format("Exception extracting archive '%s'." , archive.getName());
- 289 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.WARNING, msg);
- 290 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 291 0 } catch (IOException ex) {
- 292 0 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
- 293 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.WARNING, msg);
- 294 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 295
- } finally {
- 296 0 try {
- 297 8 fis.close();
- 298 0 } catch (IOException ex) {
- 299 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 300 8 }
- 301 0 }
- 302 8 }
- 303
-
- 304
-
- 305
-
- 306
-
- 307
-
- 308
-
- 309
-
- 310
-
- 311
-
- 312
- private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
- 313
- ArchiveEntry entry;
- 314
+ 276 0 fis = new FileInputStream(archive);
+ 277 0 } catch (FileNotFoundException ex) {
+ 278 0 LOGGER.log(Level.FINE, null , ex);
+ 279 0 throw new AnalysisException("Archive file was not found." , ex);
+ 280 0 }
+ 281 0 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
+ 282
try {
- 315 181 while ((entry = input.getNextEntry()) != null ) {
- 316 175 if (entry.isDirectory()) {
- 317 25 final File d = new File(destination, entry.getName());
- 318 25 if (!d.exists()) {
- 319 25 if (!d.mkdirs()) {
- 320 0 final String msg = String.format("Unable to create directory '%s'." , d.getAbsolutePath());
- 321 0 throw new AnalysisException(msg);
- 322
- }
- 323
- }
- 324 25 } else {
- 325 150 final File file = new File(destination, entry.getName());
- 326 150 final String ext = FileUtils.getFileExtension(file.getName());
- 327 150 if (engine.supportsExtension(ext)) {
- 328 17 BufferedOutputStream bos = null ;
+ 283 0 if (ZIPPABLES.contains(archiveExt)) {
+ 284 0 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+ 285 0 } else if ("tar" .equals(archiveExt)) {
+ 286 0 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+ 287 0 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
+ 288 0 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
+ 289 0 final String uncompressedExt = FileUtils.getFileExtension(uncompressedName).toLowerCase();
+ 290 0 if (engine.supportsExtension(uncompressedExt)) {
+ 291 0 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName));
+ 292
+ }
+ 293
+ }
+ 294 0 } catch (ArchiveExtractionException ex) {
+ 295 0 final String msg = String.format("Exception extracting archive '%s'." , archive.getName());
+ 296 0 LOGGER.log(Level.WARNING, msg);
+ 297 0 LOGGER.log(Level.FINE, null , ex);
+ 298 0 } catch (IOException ex) {
+ 299 0 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
+ 300 0 LOGGER.log(Level.WARNING, msg);
+ 301 0 LOGGER.log(Level.FINE, null , ex);
+ 302
+ } finally {
+ 303 0 try {
+ 304 0 fis.close();
+ 305 0 } catch (IOException ex) {
+ 306 0 LOGGER.log(Level.FINEST, null , ex);
+ 307 0 }
+ 308 0 }
+ 309 0 }
+ 310
+
+ 311
+
+ 312
+
+ 313
+
+ 314
+
+ 315
+
+ 316
+
+ 317
+
+ 318
+
+ 319
+ private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
+ 320
+ ArchiveEntry entry;
+ 321
+ try {
+ 322 0 while ((entry = input.getNextEntry()) != null ) {
+ 323 0 if (entry.isDirectory()) {
+ 324 0 final File d = new File(destination, entry.getName());
+ 325 0 if (!d.exists()) {
+ 326 0 if (!d.mkdirs()) {
+ 327 0 final String msg = String.format("Unable to create directory '%s'." , d.getAbsolutePath());
+ 328 0 throw new AnalysisException(msg);
329
- FileOutputStream fos;
+ } 330
- try {
- 331 17 final File parent = file.getParentFile();
- 332 17 if (!parent.isDirectory()) {
- 333 1 if (!parent.mkdirs()) {
- 334 0 final String msg = String.format("Unable to build directory '%s'." , parent.getAbsolutePath());
- 335 0 throw new AnalysisException(msg);
+ } 331 0 } else {
+ 332 0 final File file = new File(destination, entry.getName());
+ 333 0 final String ext = FileUtils.getFileExtension(file.getName());
+ 334 0 if (engine.supportsExtension(ext)) {
+ 335 0 BufferedOutputStream bos = null ;
336
- }
+ FileOutputStream fos; 337
- }
- 338 17 fos = new FileOutputStream(file);
- 339 17 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
- 340
- int count;
- 341 17 final byte data[] = new byte [BUFFER_SIZE];
- 342 3367 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
- 343 3350 bos.write(data, 0, count);
+ try { 338 0 final File parent = file.getParentFile();
+ 339 0 if (!parent.isDirectory()) {
+ 340 0 if (!parent.mkdirs()) {
+ 341 0 final String msg = String.format("Unable to build directory '%s'." , parent.getAbsolutePath());
+ 342 0 throw new AnalysisException(msg);
+ 343
+ }
344
}
- 345 17 bos.flush();
- 346 0 } catch (FileNotFoundException ex) {
- 347 0 Logger.getLogger(ArchiveAnalyzer.class
- 348
- .getName()).log(Level.FINE, null , ex);
- 349 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
- 350 0 throw new AnalysisException(msg, ex);
- 351 0 } catch (IOException ex) {
- 352 0 Logger.getLogger(ArchiveAnalyzer.class
- 353
- .getName()).log(Level.FINE, null , ex);
- 354 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
- 355 0 throw new AnalysisException(msg, ex);
- 356
- } finally {
- 357 17 if (bos != null ) {
- 358
- try {
- 359 17 bos.close();
- 360 0 } catch (IOException ex) {
- 361 0 Logger.getLogger(ArchiveAnalyzer.class
- 362
- .getName()).log(Level.FINEST, null , ex);
- 363 17 }
- 364
+ 345 0 fos = new FileOutputStream(file);
+ 346 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+ 347
+ int count;
+ 348 0 final byte data[] = new byte [BUFFER_SIZE];
+ 349 0 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
+ 350 0 bos.write(data, 0, count);
+ 351
}
+ 352 0 bos.flush();
+ 353 0 } catch (FileNotFoundException ex) {
+ 354 0 Logger.getLogger(ArchiveAnalyzer.class
+ 355
+ .getName()).log(Level.FINE, null , ex);
+ 356 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
+ 357 0 throw new AnalysisException(msg, ex);
+ 358 0 } catch (IOException ex) {
+ 359 0 Logger.getLogger(ArchiveAnalyzer.class
+ 360
+ .getName()).log(Level.FINE, null , ex);
+ 361 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+ 362 0 throw new AnalysisException(msg, ex);
+ 363
+ } finally {
+ 364 0 if (bos != null ) {
365
+ try {
+ 366 0 bos.close();
+ 367 0 } catch (IOException ex) {
+ 368 0 Logger.getLogger(ArchiveAnalyzer.class
+ 369
+ .getName()).log(Level.FINEST, null , ex);
+ 370 0 }
+ 371
+ }
+ 372
}
- 366
- }
- 367 150 }
- 368
- }
- 369 0 } catch (IOException ex) {
- 370 0 throw new ArchiveExtractionException(ex);
- 371 0 } catch (Throwable ex) {
- 372 0 throw new ArchiveExtractionException(ex);
373
- } finally {
- 374 6 if (input != null ) {
+ } 374 0 }
375
- try {
- 376 6 input.close();
- 377 0 } catch (IOException ex) {
- 378 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 379 6 }
+ } 376 0 } catch (IOException ex) {
+ 377 0 throw new ArchiveExtractionException(ex);
+ 378 0 } catch (Throwable ex) {
+ 379 0 throw new ArchiveExtractionException(ex);
380
- }
- 381
- }
- 382 6 }
- 383
-
- 384
-
- 385
-
- 386
-
- 387
-
- 388
-
- 389
-
- 390
-
- 391
- private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
- 392 2 FileOutputStream out = null ;
- 393
- try {
- 394 2 out = new FileOutputStream(outputFile);
- 395 2 final byte [] buffer = new byte [BUFFER_SIZE];
- 396 2 int n = 0;
- 397 272 while (-1 != (n = inputStream.read(buffer))) {
- 398 270 out.write(buffer, 0, n);
- 399
- }
- 400 0 } catch (FileNotFoundException ex) {
- 401 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 402 0 throw new ArchiveExtractionException(ex);
- 403 0 } catch (IOException ex) {
- 404 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 405 0 throw new ArchiveExtractionException(ex);
- 406
} finally {
- 407 2 if (out != null ) {
- 408
+ 381 0 if (input != null ) {
+ 382
try {
- 409 2 out.close();
- 410 0 } catch (IOException ex) {
- 411 0 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 412 2 }
- 413
+ 383 0 input.close();
+ 384 0 } catch (IOException ex) {
+ 385 0 LOGGER.log(Level.FINEST, null , ex);
+ 386 0 }
+ 387
}
- 414
+ 388
}
- 415 2 }
- 416
+ 389 0 }
+ 390
+
+ 391
+
+ 392
+
+ 393
+
+ 394
+
+ 395
+
+ 396
+
+ 397
+
+ 398
+ private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
+ 399 0 FileOutputStream out = null ;
+ 400
+ try {
+ 401 0 out = new FileOutputStream(outputFile);
+ 402 0 final byte [] buffer = new byte [BUFFER_SIZE];
+ 403 0 int n = 0;
+ 404 0 while (-1 != (n = inputStream.read(buffer))) {
+ 405 0 out.write(buffer, 0, n);
+ 406
+ }
+ 407 0 } catch (FileNotFoundException ex) {
+ 408 0 LOGGER.log(Level.FINE, null , ex);
+ 409 0 throw new ArchiveExtractionException(ex);
+ 410 0 } catch (IOException ex) {
+ 411 0 LOGGER.log(Level.FINE, null , ex);
+ 412 0 throw new ArchiveExtractionException(ex);
+ 413
+ } finally {
+ 414 0 if (out != null ) {
+ 415
+ try {
+ 416 0 out.close();
+ 417 0 } catch (IOException ex) {
+ 418 0 LOGGER.log(Level.FINEST, null , ex);
+ 419 0 }
+ 420
+ }
+ 421
+ }
+ 422 0 }
+ 423
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
index 29a034e89..16a6e1105 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,415 +56,482 @@
19
20
- import java.io.File;
+ import java.io.BufferedReader; 21
- import java.io.FileOutputStream;
+ import java.io.File; 22
- import java.io.IOException;
+ import java.io.FileOutputStream; 23
- import java.io.InputStream;
+ import java.io.IOException; 24
- import java.util.ArrayList;
+ import java.io.InputStream; 25
- import java.util.List;
+ import java.io.InputStreamReader; 26
- import java.util.Set;
+ import java.util.ArrayList; 27
- import java.util.logging.Level;
+ import java.util.List; 28
- import java.util.logging.Logger;
+ import java.util.Set; 29
- import javax.xml.parsers.DocumentBuilder;
+ import java.util.logging.Level; 30
- import javax.xml.parsers.DocumentBuilderFactory;
+ import java.util.logging.Logger; 31
- import javax.xml.xpath.XPath;
+ import javax.xml.parsers.DocumentBuilder; 32
- import javax.xml.xpath.XPathExpressionException;
+ import javax.xml.parsers.DocumentBuilderFactory; 33
- import javax.xml.xpath.XPathFactory;
+ import javax.xml.xpath.XPath; 34
- import org.owasp.dependencycheck.Engine;
+ import javax.xml.xpath.XPathExpressionException; 35
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ import javax.xml.xpath.XPathFactory; 36
- import org.owasp.dependencycheck.dependency.Confidence;
+ import org.owasp.dependencycheck.Engine; 37
- import org.owasp.dependencycheck.dependency.Dependency;
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException; 38
- import org.owasp.dependencycheck.dependency.Evidence;
+ import org.owasp.dependencycheck.dependency.Confidence; 39
- import org.owasp.dependencycheck.utils.Settings;
+ import org.owasp.dependencycheck.dependency.Dependency; 40
- import org.w3c.dom.Document;
+ import org.owasp.dependencycheck.dependency.Evidence; 41
- import org.xml.sax.SAXException;
+ import org.owasp.dependencycheck.utils.Settings; 42
-
+ import org.w3c.dom.Document; 43
-
+ import org.xml.sax.SAXException; 44
-
+ 45
-
+ 46
-
+ 47
48
-
+ 49
- public class AssemblyAnalyzer extends AbstractAnalyzer {
+ 50
-
+ 51
-
+ public class AssemblyAnalyzer extends AbstractFileTypeAnalyzer { 52
-
+ 53
-
+ 54
- private static final String ANALYZER_NAME = "Assembly Analyzer" ;
+ 55
-
+ 56
-
+ private static final String ANALYZER_NAME = "Assembly Analyzer" ; 57
-
- 58 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 58
+
59
-
- 60
-
+ 60 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
61
-
- 62 1 private static final Set<String> SUPORTED_EXTENSIONS = newHashSet("dll" , "exe" );
+ 62
+
63
-
- 64
-
+ 64 0 private static final Set<String> SUPORTED_EXTENSIONS = newHashSet("dll" , "exe" );
65
-
+ 66
- private File grokAssemblyExe;
+ 67
-
+ 68
-
+ private File grokAssemblyExe = null ; 69
-
+ 70
- private DocumentBuilder builder;
+ 71
-
+ 72
-
+ private DocumentBuilder builder; 73
-
- 74 1 private static final Logger LOG = Logger.getLogger(AbstractAnalyzer.class .getName());
+ 74
+
75
-
- 76
-
+ 76 0 private static final Logger LOG = Logger.getLogger(AssemblyAnalyzer.class .getName());
77
-
+ 78
-
- 79
-
- 80
-
- 81
- private List<String> buildArgumentList() {
- 82
-
- 83 11 final List<String> args = new ArrayList<String>();
- 84 11 if (!"\\" .equals(System.getProperty("file.separator" ))) {
- 85 0 if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null ) {
- 86 0 args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
- 87
- } else {
- 88 0 args.add("mono" );
- 89
- }
- 90
- }
- 91 11 args.add(grokAssemblyExe.getPath());
- 92
-
- 93 11 return args;
- 94
- }
- 95
-
- 96
- 97
-
- 98
+ 79
+
+ 80
- 99
-
- 100
-
- 101
-
- 102
+ 81
+
+ 82
- 103
- @Override
- 104
- public void analyze(Dependency dependency, Engine engine)
- 105
- throws AnalysisException {
- 106 3 if (grokAssemblyExe == null ) {
- 107 0 LOG.warning("GrokAssembly didn't get deployed" );
- 108 0 return ;
- 109
+ 83
+ private List<String> buildArgumentList() {
+ 84
+
+ 85 0 final List<String> args = new ArrayList<String>();
+ 86 0 if (!"\\" .equals(System.getProperty("file.separator" ))) {
+ 87 0 if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null ) {
+ 88 0 args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
+ 89
+ } else {
+ 90 0 args.add("mono" );
+ 91
+ }
+ 92
}
- 110
+ 93 0 args.add(grokAssemblyExe.getPath());
+ 94
- 111 3 final List<String> args = buildArgumentList();
- 112 3 args.add(dependency.getActualFilePath());
- 113 3 final ProcessBuilder pb = new ProcessBuilder(args);
- 114
+ 95 0 return args;
+ 96
+ }
+ 97
+
+ 98
+
+ 99
+
+ 100
+
+ 101
+
+ 102
+
+ 103
+
+ 104
+
+ 105
+ @Override
+ 106
+ public void analyzeFileType(Dependency dependency, Engine engine)
+ 107
+ throws AnalysisException {
+ 108 0 if (grokAssemblyExe == null ) {
+ 109 0 LOG.warning("GrokAssembly didn't get deployed" );
+ 110 0 return ;
+ 111
+ }
+ 112
+
+ 113 0 final List<String> args = buildArgumentList();
+ 114 0 args.add(dependency.getActualFilePath());
+ 115 0 final ProcessBuilder pb = new ProcessBuilder(args);
+ 116 0 BufferedReader rdr = null ;
+ 117
try {
- 115 3 final Process proc = pb.start();
- 116 3 final Document doc = builder.parse(proc.getInputStream());
- 117 3 final XPath xpath = XPathFactory.newInstance().newXPath();
- 118
-
+ 118 0 final Process proc = pb.start();
119
-
- 120 3 final String error = xpath.evaluate("/assembly/error" , doc);
- 121 3 if (error != null && !"" .equals(error)) {
- 122 1 throw new AnalysisException(error);
- 123
- }
+ 120 0 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream()));
+ 121 0 String line = null ;
+ 122 0 while (rdr.ready() && (line = rdr.readLine()) != null ) {
+ 123 0 LOG.log(Level.WARNING, "Error from GrokAssembly: {0}" , line);
124
-
- 125 2 final String version = xpath.evaluate("/assembly/version" , doc);
- 126 2 if (version != null ) {
- 127 2 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
+ } 125 0 int rc = 0;
+ 126 0 final Document doc = builder.parse(proc.getInputStream());
+ 127 0 final XPath xpath = XPathFactory.newInstance().newXPath();
128
- version, Confidence.HIGHEST));
+ 129
+
+ 130 0 final String error = xpath.evaluate("/assembly/error" , doc);
+ 131 0 if (error != null && !"" .equals(error)) {
+ 132 0 throw new AnalysisException(error);
+ 133
}
- 130
-
- 131 2 final String vendor = xpath.evaluate("/assembly/company" , doc);
- 132 2 if (vendor != null ) {
- 133 2 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
134
- vendor, Confidence.HIGH));
- 135
- }
- 136
- 137 2 final String product = xpath.evaluate("/assembly/product" , doc);
- 138 2 if (product != null ) {
- 139 2 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
+ 135 0 final String version = xpath.evaluate("/assembly/version" , doc);
+ 136 0 if (version != null ) {
+ 137 0 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
+ 138
+ version, Confidence.HIGHEST));
+ 139
+ }
140
- product, Confidence.HIGH));
- 141
- }
- 142
- 143 0 } catch (IOException ioe) {
- 144 0 throw new AnalysisException(ioe);
- 145 0 } catch (SAXException saxe) {
- 146 0 throw new AnalysisException("Couldn't parse GrokAssembly result" , saxe);
- 147 0 } catch (XPathExpressionException xpe) {
- 148
-
- 149 0 throw new AnalysisException(xpe);
- 150 2 }
- 151 2 }
+ 141 0 final String vendor = xpath.evaluate("/assembly/company" , doc);
+ 142 0 if (vendor != null ) {
+ 143 0 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
+ 144
+ vendor, Confidence.HIGH));
+ 145
+ }
+ 146
+
+ 147 0 final String product = xpath.evaluate("/assembly/product" , doc);
+ 148 0 if (product != null ) {
+ 149 0 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
+ 150
+ product, Confidence.HIGH));
+ 151
+ }
152
153
-
- 154
-
- 155
-
+ try { 154 0 rc = proc.waitFor();
+ 155 0 } catch (InterruptedException ie) {
156
-
- 157
-
- 158
- @Override
- 159
- public void initialize() throws Exception {
- 160 8 super .initialize();
- 161 8 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
- 162 8 FileOutputStream fos = null ;
- 163 8 InputStream is = null ;
+ return ; 157 0 }
+ 158 0 if (rc == 3) {
+ 159 0 LOG.log(Level.INFO, "{0} is not a valid assembly" , dependency.getActualFilePath());
+ 160
+ return ;
+ 161 0 } else if (rc != 0) {
+ 162 0 LOG.log(Level.WARNING, "Return code {0} from GrokAssembly" , rc);
+ 163
+ }
164
- try {
- 165 8 fos = new FileOutputStream(tempFile);
- 166 8 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
- 167 8 final byte [] buff = new byte [4096];
- 168 8 int bread = -1;
- 169 24 while ((bread = is.read(buff)) >= 0) {
- 170 16 fos.write(buff, 0, bread);
- 171
- }
- 172 8 grokAssemblyExe = tempFile;
- 173
-
- 174 8 grokAssemblyExe.deleteOnExit();
- 175 8 LOG.log(Level.FINE, "Extracted GrokAssembly.exe to {0}" , grokAssemblyExe.getPath());
- 176 0 } catch (IOException ioe) {
- 177 0 LOG.log(Level.WARNING, "Could not extract GrokAssembly.exe: {0}" , ioe.getMessage());
- 178 0 throw new AnalysisException("Could not extract GrokAssembly.exe" , ioe);
- 179
+
+ 165 0 } catch (IOException ioe) {
+ 166 0 throw new AnalysisException(ioe);
+ 167 0 } catch (SAXException saxe) {
+ 168 0 throw new AnalysisException("Couldn't parse GrokAssembly result" , saxe);
+ 169 0 } catch (XPathExpressionException xpe) {
+ 170
+
+ 171 0 throw new AnalysisException(xpe);
+ 172
} finally {
- 180 8 if (fos != null ) {
- 181
+ 173 0 if (rdr != null ) {
+ 174
try {
- 182 8 fos.close();
- 183 0 } catch (Throwable e) {
- 184 0 LOG.fine("Error closing output stream" );
- 185 8 }
- 186
+ 175 0 rdr.close();
+ 176 0 } catch (IOException ex) {
+ 177 0 Logger.getLogger(AssemblyAnalyzer.class .getName()).log(Level.FINEST, "ignore" , ex);
+ 178 0 }
+ 179
}
- 187 8 if (is != null ) {
- 188
- try {
- 189 8 is.close();
- 190 0 } catch (Throwable e) {
- 191 0 LOG.fine("Error closing input stream" );
- 192 8 }
- 193
- }
- 194
+ 180
}
- 195
+ 181 0 }
+ 182
- 196
-
- 197 8 final List<String> args = buildArgumentList();
- 198
+ 183
+
+ 184
+
+ 185
+
+ 186
+
+ 187
+
+ 188
+ @Override
+ 189
+ public void initializeFileTypeAnalyzer() throws Exception {
+ 190 0 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
+ 191 0 FileOutputStream fos = null ;
+ 192 0 InputStream is = null ;
+ 193
try {
- 199 8 final Process p = new ProcessBuilder(args).start();
- 200 8 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
- 201 8 final XPath xpath = XPathFactory.newInstance().newXPath();
- 202 8 final String error = xpath.evaluate("/assembly/error" , doc);
- 203 8 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
- 204 0 LOG.warning("An error occured with the .NET AssemblyAnalyzer, please see the log for more details." );
- 205 0 LOG.fine("GrokAssembly.exe is not working properly" );
- 206 0 grokAssemblyExe = null ;
- 207 0 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer" );
- 208
+ 194 0 fos = new FileOutputStream(tempFile);
+ 195 0 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
+ 196 0 final byte [] buff = new byte [4096];
+ 197 0 int bread = -1;
+ 198 0 while ((bread = is.read(buff)) >= 0) {
+ 199 0 fos.write(buff, 0, bread);
+ 200
}
- 209 0 } catch (Throwable e) {
- 210 0 LOG.warning("An error occured with the .NET AssemblyAnalyzer; "
- 211
- + "this can be ignored unless you are scanning .NET dlls. Please see the log for more details." );
- 212 0 LOG.log(Level.FINE, "Could not execute GrokAssembly {0}" , e.getMessage());
- 213 0 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer" , e);
- 214 8 }
+ 201 0 grokAssemblyExe = tempFile;
+ 202
+
+ 203 0 grokAssemblyExe.deleteOnExit();
+ 204 0 LOG.log(Level.FINE, "Extracted GrokAssembly.exe to {0}" , grokAssemblyExe.getPath());
+ 205 0 } catch (IOException ioe) {
+ 206 0 LOG.log(Level.WARNING, "Could not extract GrokAssembly.exe: {0}" , ioe.getMessage());
+ 207 0 throw new AnalysisException("Could not extract GrokAssembly.exe" , ioe);
+ 208
+ } finally {
+ 209 0 if (fos != null ) {
+ 210
+ try {
+ 211 0 fos.close();
+ 212 0 } catch (Throwable e) {
+ 213 0 LOG.fine("Error closing output stream" );
+ 214 0 }
215
-
- 216 8 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
- 217 8 }
- 218
-
- 219
- @Override
- 220
- public void close() throws Exception {
- 221 8 super .close();
+ } 216 0 if (is != null ) {
+ 217
+ try {
+ 218 0 is.close();
+ 219 0 } catch (Throwable e) {
+ 220 0 LOG.fine("Error closing input stream" );
+ 221 0 }
222
- try {
- 223 8 grokAssemblyExe.delete();
- 224 0 } catch (SecurityException se) {
- 225 0 LOG.fine("Can't delete temporary GrokAssembly.exe" );
- 226 8 }
- 227 8 }
+ } 223
+ }
+ 224
+
+ 225
+
+ 226 0 final List<String> args = buildArgumentList();
+ 227 0 BufferedReader rdr = null ;
228
-
- 229
-
- 230
-
+ try { 229 0 final ProcessBuilder pb = new ProcessBuilder(args);
+ 230 0 final Process p = pb.start();
231
-
- 232
-
+ 232 0 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream()));
233
-
- 234
- @Override
+ String line; 234 0 while (rdr.ready() && (line = rdr.readLine()) != null ) {
235
- public Set<String> getSupportedExtensions() {
- 236 138 return SUPORTED_EXTENSIONS;
- 237
- }
- 238
-
- 239
-
- 240
-
- 241
-
- 242
-
- 243
-
- 244
- @Override
+ 236
+ }
+ 237 0 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
+ 238 0 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 239 0 final String error = xpath.evaluate("/assembly/error" , doc);
+ 240 0 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
+ 241 0 LOG.warning("An error occured with the .NET AssemblyAnalyzer, please see the log for more details." );
+ 242 0 LOG.fine("GrokAssembly.exe is not working properly" );
+ 243 0 grokAssemblyExe = null ;
+ 244 0 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer" );
245
- public String getName() {
- 246 10 return ANALYZER_NAME;
- 247
- }
+ } 246 0 } catch (Throwable e) {
+ 247 0 LOG.warning("An error occured with the .NET AssemblyAnalyzer; "
248
-
- 249
-
- 250
-
+ + "this can be ignored unless you are scanning .NET dlls. Please see the log for more details." ); 249 0 LOG.log(Level.FINE, "Could not execute GrokAssembly {0}" , e.getMessage());
+ 250 0 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer" , e);
251
-
- 252
-
+ } finally { 252 0 if (rdr != null ) {
253
-
- 254
-
- 255
- @Override
- 256
- public boolean supportsExtension(String extension) {
- 257 134 return SUPORTED_EXTENSIONS.contains(extension);
+ try { 254 0 rdr.close();
+ 255 0 } catch (IOException ex) {
+ 256 0 Logger.getLogger(AssemblyAnalyzer.class .getName()).log(Level.FINEST, "ignore" , ex);
+ 257 0 }
258
- }
+ } 259
-
+ } 260
-
- 261
-
- 262
-
+ 261 0 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ 262 0 }
263
-
+ 264
-
- 265
@Override
- 266
- public AnalysisPhase getAnalysisPhase() {
- 267 6 return ANALYSIS_PHASE;
- 268
+ 265
+ public void close() throws Exception {
+ 266 0 super .close();
+ 267
+ try {
+ 268 0 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
+ 269 0 grokAssemblyExe.deleteOnExit();
+ 270
+ }
+ 271 0 } catch (SecurityException se) {
+ 272 0 LOG.fine("Can't delete temporary GrokAssembly.exe" );
+ 273 0 }
+ 274 0 }
+ 275
+
+ 276
+
+ 277
+
+ 278
+
+ 279
+
+ 280
+
+ 281
+ @Override
+ 282
+ public Set<String> getSupportedExtensions() {
+ 283 0 return SUPORTED_EXTENSIONS;
+ 284
}
- 269
+ 285
+
+ 286
+
+ 287
+
+ 288
+
+ 289
+
+ 290
+
+ 291
+ @Override
+ 292
+ public String getName() {
+ 293 0 return ANALYZER_NAME;
+ 294
+ }
+ 295
+
+ 296
+
+ 297
+
+ 298
+
+ 299
+
+ 300
+
+ 301
+ @Override
+ 302
+ public AnalysisPhase getAnalysisPhase() {
+ 303 0 return ANALYSIS_PHASE;
+ 304
+ }
+ 305
+
+ 306
+
+ 307
+
+ 308
+
+ 309
+
+ 310
+
+ 311
+ @Override
+ 312
+ protected String getAnalyzerEnabledSettingKey() {
+ 313 0 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
+ 314
+ }
+ 315
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
index 17e10ad7f..0e027591c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
@@ -12,9 +12,9 @@
@@ -200,625 +200,630 @@
90
91
-
+ 92
93
-
+ 94
-
+ 95
-
- 96
-
- 97
- public void open() throws IOException, DatabaseException {
- 98 11 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Opening the CVE Database" );
- 99 11 cve = new CveDB();
- 100 11 cve.open();
- 101 11 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Creating the Lucene CPE Index" );
- 102 11 cpe = CpeMemoryIndex.getInstance();
- 103
- try {
- 104 11 cpe.open(cve);
- 105 0 } catch (IndexException ex) {
- 106 0 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "IndexException" , ex);
- 107 0 throw new DatabaseException(ex);
- 108 11 }
- 109 11 }
- 110
-
- 111
-
- 112
-
- 113
-
- 114
@Override
+ 96
+ public String getName() {
+ 97 0 return "CPE Analyzer" ;
+ 98
+ }
+ 99
+
+ 100
+
+ 101
+
+ 102
+
+ 103
+
+ 104
+
+ 105
+ @Override
+ 106
+ public AnalysisPhase getAnalysisPhase() {
+ 107 0 return AnalysisPhase.IDENTIFIER_ANALYSIS;
+ 108
+ }
+ 109
+
+ 110
+
+ 111
+
+ 112
+
+ 113
+
+ 114
+
115
- public void close() {
- 116 11 if (cpe != null ) {
- 117 11 cpe.close();
- 118
- }
- 119 11 if (cve != null ) {
- 120 11 cve.close();
+ @Override 116
+ public void initialize() throws Exception {
+ 117 0 this .open();
+ 118 0 }
+ 119
+
+ 120
+
121
- }
- 122 11 }
+ 122
+
123
-
+ 124
-
+ 125
-
+ 126
-
+ 127
-
- 128
-
- 129
-
- 130
-
- 131
-
- 132
-
+ public void open() throws IOException, DatabaseException { 128 0 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Opening the CVE Database" );
+ 129 0 cve = new CveDB();
+ 130 0 cve.open();
+ 131 0 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Creating the Lucene CPE Index" );
+ 132 0 cpe = CpeMemoryIndex.getInstance();
133
- protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
- 134 19 Confidence confidence = Confidence.HIGHEST;
- 135
+ try {
+ 134 0 cpe.open(cve);
+ 135 0 } catch (IndexException ex) {
+ 136 0 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "IndexException" , ex);
+ 137 0 throw new DatabaseException(ex);
+ 138 0 }
+ 139 0 }
+ 140
- 136 19 String vendors = addEvidenceWithoutDuplicateTerms("" , dependency.getVendorEvidence(), confidence);
- 137 19 String products = addEvidenceWithoutDuplicateTerms("" , dependency.getProductEvidence(), confidence);
- 138
-
- 139
-
- 140 19 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
141
-
- 142 19 int ctr = 0;
- 143
- do {
- 144 76 if (!vendors.isEmpty() && !products.isEmpty()) {
- 145 72 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
- 146
- dependency.getVendorEvidence().getWeighting());
- 147
-
- 148 72 for (IndexEntry e : entries) {
- 149 729 if (verifyEntry(e, dependency)) {
- 150 71 final String vendor = e.getVendor();
- 151 71 final String product = e.getProduct();
- 152 71 determineIdentifiers(dependency, vendor, product);
- 153
- }
- 154 729 }
- 155
- }
- 156 76 confidence = reduceConfidence(confidence);
- 157 76 if (dependency.getVendorEvidence().contains(confidence)) {
- 158 61 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
- 159
- }
- 160 76 if (dependency.getProductEvidence().contains(confidence)) {
- 161 64 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
- 162
- }
- 163
-
- 164
-
- 165 76 if (dependency.getVersionEvidence().contains(confidence)) {
- 166 37 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
- 167
- }
- 168 76 } while ((++ctr) < 4);
- 169 19 }
- 170
-
- 171
- 172
-
- 173
-
- 174
-
- 175
-
- 176
-
- 177
-
- 178
-
- 179
-
- 180
+ 142
+
+ 143
- 181
- private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
- 182 219 final String txt = (text == null ) ? "" : text;
- 183 219 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
- 184 219 sb.append(' ' ).append(txt).append(' ' );
- 185 219 for (Evidence e : ec.iterator(confidenceFilter)) {
- 186 409 String value = e.getValue();
- 187
+ 144
+ @Override
+ 145
+ public void close() {
+ 146 0 if (cpe != null ) {
+ 147 0 cpe.close();
+ 148
+ }
+ 149 0 if (cve != null ) {
+ 150 0 cve.close();
+ 151
+ }
+ 152 0 }
+ 153
- 188
-
+ 154
+
+ 155
+
+ 156
+
+ 157
+
+ 158
+
+ 159
+
+ 160
+
+ 161
+
+ 162
+
+ 163
+ protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
+ 164 0 Confidence confidence = Confidence.HIGHEST;
+ 165
+
+ 166 0 String vendors = addEvidenceWithoutDuplicateTerms("" , dependency.getVendorEvidence(), confidence);
+ 167 0 String products = addEvidenceWithoutDuplicateTerms("" , dependency.getProductEvidence(), confidence);
+ 168
+
+ 169
+
+ 170 0 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
+ 171
+
+ 172 0 int ctr = 0;
+ 173
+ do {
+ 174 0 if (!vendors.isEmpty() && !products.isEmpty()) {
+ 175 0 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
+ 176
+ dependency.getVendorEvidence().getWeighting());
+ 177
+
+ 178 0 for (IndexEntry e : entries) {
+ 179 0 if (verifyEntry(e, dependency)) {
+ 180 0 final String vendor = e.getVendor();
+ 181 0 final String product = e.getProduct();
+ 182 0 determineIdentifiers(dependency, vendor, product);
+ 183
+ }
+ 184 0 }
+ 185
+ }
+ 186 0 confidence = reduceConfidence(confidence);
+ 187 0 if (dependency.getVendorEvidence().contains(confidence)) {
+ 188 0 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
189
-
- 190 409 if (value.startsWith("http://" )) {
- 191 32 value = value.substring(7).replaceAll("\\." , " " );
+ } 190 0 if (dependency.getProductEvidence().contains(confidence)) {
+ 191 0 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
192
}
- 193 409 if (value.startsWith("https://" )) {
- 194 0 value = value.substring(8).replaceAll("\\." , " " );
- 195
+ 193
+
+ 194
+
+ 195 0 if (dependency.getVersionEvidence().contains(confidence)) {
+ 196 0 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
+ 197
}
- 196 409 if (sb.indexOf(" " + value + " " ) < 0) {
- 197 270 sb.append(value).append(' ' );
- 198
- }
- 199 409 }
- 200 219 return sb.toString().trim();
- 201
- }
- 202
+ 198 0 } while ((++ctr) < 4);
+ 199 0 }
+ 200
- 203
+ 201
+ 202
+
+ 203
+
204
-
+ 205
206
-
+ 207
-
+ 208
-
+ 209
- private Confidence reduceConfidence(final Confidence c) {
- 210 76 if (c == Confidence.HIGHEST) {
- 211 19 return Confidence.HIGH;
- 212 57 } else if (c == Confidence.HIGH) {
- 213 19 return Confidence.MEDIUM;
- 214
- } else {
- 215 38 return Confidence.LOW;
- 216
- }
+ 210
+
+ 211
+ private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
+ 212 0 final String txt = (text == null ) ? "" : text;
+ 213 0 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
+ 214 0 sb.append(' ' ).append(txt).append(' ' );
+ 215 0 for (Evidence e : ec.iterator(confidenceFilter)) {
+ 216 0 String value = e.getValue();
217
- }
+ 218
-
+ 219
-
- 220
-
- 221
-
+ 220 0 if (value.startsWith("http://" )) {
+ 221 0 value = value.substring(7).replaceAll("\\." , " " );
222
-
- 223
-
- 224
-
- 225
-
- 226
-
- 227
-
- 228
-
- 229
-
- 230
-
- 231
-
- 232
-
- 233
-
- 234
-
- 235
-
- 236
-
- 237
- protected List<IndexEntry> searchCPE(String vendor, String product,
- 238
- Set<String> vendorWeightings, Set<String> productWeightings)
- 239
- throws CorruptIndexException, IOException, ParseException {
- 240 73 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
- 241
-
- 242 73 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
- 243 73 if (searchString == null ) {
- 244 0 return ret;
- 245
- }
- 246
-
- 247 73 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
- 248 1222 for (ScoreDoc d : docs.scoreDocs) {
- 249 1149 if (d.score >= 0.08) {
- 250 750 final Document doc = cpe.getDocument(d.doc);
- 251 750 final IndexEntry entry = new IndexEntry();
- 252 750 entry.setVendor(doc.get(Fields.VENDOR));
- 253 750 entry.setProduct(doc.get(Fields.PRODUCT));
- 254
-
- 255
-
- 256
-
- 257
-
- 258
-
- 259
-
- 260
-
- 261 750 entry.setSearchScore(d.score);
- 262 750 if (!ret.contains(entry)) {
- 263 750 ret.add(entry);
- 264
- }
- 265
}
+ 223 0 if (value.startsWith("https://" )) {
+ 224 0 value = value.substring(8).replaceAll("\\." , " " );
+ 225
+ }
+ 226 0 if (sb.indexOf(" " + value + " " ) < 0) {
+ 227 0 sb.append(value).append(' ' );
+ 228
+ }
+ 229 0 }
+ 230 0 return sb.toString().trim();
+ 231
+ }
+ 232
+
+ 233
+
+ 234
+
+ 235
+
+ 236
+
+ 237
+
+ 238
+
+ 239
+ private Confidence reduceConfidence(final Confidence c) {
+ 240 0 if (c == Confidence.HIGHEST) {
+ 241 0 return Confidence.HIGH;
+ 242 0 } else if (c == Confidence.HIGH) {
+ 243 0 return Confidence.MEDIUM;
+ 244
+ } else {
+ 245 0 return Confidence.LOW;
+ 246
+ }
+ 247
+ }
+ 248
+
+ 249
+
+ 250
+
+ 251
+
+ 252
+
+ 253
+
+ 254
+
+ 255
+
+ 256
+
+ 257
+
+ 258
+
+ 259
+
+ 260
+
+ 261
+
+ 262
+
+ 263
+
+ 264
+
+ 265
+
266
- }
- 267 73 return ret;
+ 267
+ protected List<IndexEntry> searchCPE(String vendor, String product,
268
- }
+ Set<String> vendorWeightings, Set<String> productWeightings) 269
-
- 270
-
+ throws CorruptIndexException, IOException, ParseException { 270 0 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
271
-
- 272
-
- 273
-
- 274
-
+ 272 0 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
+ 273 0 if (searchString == null ) {
+ 274 0 return ret;
275
-
+ } 276
-
- 277
-
- 278
-
- 279
-
- 280
-
- 281
-
- 282
-
- 283
-
+ 277 0 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
+ 278 0 for (ScoreDoc d : docs.scoreDocs) {
+ 279 0 if (d.score >= 0.08) {
+ 280 0 final Document doc = cpe.getDocument(d.doc);
+ 281 0 final IndexEntry entry = new IndexEntry();
+ 282 0 entry.setVendor(doc.get(Fields.VENDOR));
+ 283 0 entry.setProduct(doc.get(Fields.PRODUCT));
284
- protected String buildSearch(String vendor, String product,
+ 285
- Set<String> vendorWeighting, Set<String> productWeightings) {
- 286 77 final String v = vendor;
- 287 77 final String p = product;
- 288 77 final StringBuilder sb = new StringBuilder(v.length() + p.length()
+ 286
+
+ 287
+
+ 288
+
289
- + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
+ 290
-
- 291 77 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
- 292 0 return null ;
- 293
+
+ 291 0 entry.setSearchScore(d.score);
+ 292 0 if (!ret.contains(entry)) {
+ 293 0 ret.add(entry);
+ 294
+ }
+ 295
+ }
+ 296
}
- 294 77 sb.append(" AND " );
- 295 77 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
- 296 0 return null ;
- 297
- }
- 298 77 return sb.toString();
- 299
+ 297 0 return ret;
+ 298
}
+ 299
+
300
-
- 301
+ 301
+
302
-
+ 303
-
- 304
-
- 305
+ 304
+
+ 305
+
306
-
+ 307
-
+ 308
-
+ 309
-
+ 310
-
+ 311
-
+ 312
- private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
- 313 154 sb.append(" " ).append(field).append(":( " );
+ 313
+
314
-
- 315 154 final String cleanText = cleanseText(searchText);
- 316
-
- 317 154 if ("" .equals(cleanText)) {
- 318 0 return false ;
+ protected String buildSearch(String vendor, String product, 315
+ Set<String> vendorWeighting, Set<String> productWeightings) {
+ 316 0 final String v = vendor;
+ 317 0 final String p = product;
+ 318 0 final StringBuilder sb = new StringBuilder(v.length() + p.length()
319
- }
+ + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); 320
- 321 154 if (weightedText == null || weightedText.isEmpty()) {
- 322 40 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
+ 321 0 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
+ 322 0 return null ;
323
- } else {
- 324 114 final StringTokenizer tokens = new StringTokenizer(cleanText);
- 325 1211 while (tokens.hasMoreElements()) {
- 326 1097 final String word = tokens.nextToken();
- 327 1097 String temp = null ;
- 328 1097 for (String weighted : weightedText) {
- 329 2202 final String weightedStr = cleanseText(weighted);
- 330 2202 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
- 331 251 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
- 332 251 if (!word.equalsIgnoreCase(weightedStr)) {
- 333 18 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
- 334
- }
- 335
- }
- 336 2202 }
- 337 1097 if (temp == null ) {
- 338 846 temp = LuceneUtils.escapeLuceneQuery(word);
- 339
- }
- 340 1097 sb.append(" " ).append(temp);
- 341 1097 }
- 342
}
- 343 154 sb.append(" ) " );
- 344 154 return true ;
- 345
+ 324 0 sb.append(" AND " );
+ 325 0 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
+ 326 0 return null ;
+ 327
+ }
+ 328 0 return sb.toString();
+ 329
}
+ 330
+
+ 331
+
+ 332
+
+ 333
+
+ 334
+
+ 335
+
+ 336
+
+ 337
+
+ 338
+
+ 339
+
+ 340
+
+ 341
+
+ 342
+ private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
+ 343 0 sb.append(" " ).append(field).append(":( " );
+ 344
+
+ 345 0 final String cleanText = cleanseText(searchText);
346
- 347
-
- 348
-
+ 347 0 if ("" .equals(cleanText)) {
+ 348 0 return false ;
349
-
+ } 350
-
- 351
-
- 352
-
+ 351 0 if (weightedText == null || weightedText.isEmpty()) {
+ 352 0 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
353
- private String cleanseText(String text) {
- 354 2356 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
- 355
- }
- 356
-
- 357
-
- 358
-
- 359
-
- 360
-
- 361
-
- 362
-
- 363
-
+ } else { 354 0 final StringTokenizer tokens = new StringTokenizer(cleanText);
+ 355 0 while (tokens.hasMoreElements()) {
+ 356 0 final String word = tokens.nextToken();
+ 357 0 String temp = null ;
+ 358 0 for (String weighted : weightedText) {
+ 359 0 final String weightedStr = cleanseText(weighted);
+ 360 0 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
+ 361 0 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
+ 362 0 if (!word.equalsIgnoreCase(weightedStr)) {
+ 363 0 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
364
- private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
- 365 2202 if (l == null || r == null ) {
- 366 0 return false ;
- 367
- }
- 368
-
- 369 2202 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
- 370 2202 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
- 371 2202 return left.equalsIgnoreCase(right);
+ } 365
+ }
+ 366 0 }
+ 367 0 if (temp == null ) {
+ 368 0 temp = LuceneUtils.escapeLuceneQuery(word);
+ 369
+ }
+ 370 0 sb.append(" " ).append(temp);
+ 371 0 }
372
- }
- 373
-
- 374
-
+ } 373 0 sb.append(" ) " );
+ 374 0 return true ;
375
-
+ } 376
-
+ 377
-
+ 378
-
+ 379
-
+ 380
-
+ 381
-
+ 382
- private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
- 383 729 boolean isValid = false ;
- 384
-
- 385 729 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
+ 383
+ private String cleanseText(String text) {
+ 384 0 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
+ 385
+ }
386
- && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
+ 387
-
- 388 71 isValid = true ;
+ 388
+
389
- }
- 390 729 return isValid;
+ 390
+
391
- }
+ 392
-
+ 393
-
+ 394
-
- 395
-
- 396
-
+ private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) { 395 0 if (l == null || r == null ) {
+ 396 0 return false ;
397
-
+ } 398
-
- 399
-
- 400
- private boolean collectionContainsString(EvidenceCollection ec, String text) {
- 401
+ 399 0 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
+ 400 0 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
+ 401 0 return left.equalsIgnoreCase(right);
402
-
- 403
-
- 404
-
- 405
-
- 406
-
- 407
-
- 408
-
- 409
-
- 410
-
- 411
-
- 412
-
- 413 806 if (text == null ) {
- 414 0 return false ;
- 415
- }
- 416 806 final String[] words = text.split("[\\s_-]" );
- 417 806 final List<String> list = new ArrayList<String>();
- 418 806 String tempWord = null ;
- 419 2272 for (String word : words) {
- 420
-
- 421
-
- 422
-
- 423
-
- 424 1466 if (tempWord != null ) {
- 425 17 list.add(tempWord + word);
- 426 17 tempWord = null ;
- 427 1449 } else if (word.length() <= 2) {
- 428 42 tempWord = word;
- 429
- } else {
- 430 1407 list.add(word);
- 431
- }
- 432
- }
- 433 806 if (tempWord != null && !list.isEmpty()) {
- 434 21 final String tmp = list.get(list.size() - 1) + tempWord;
- 435 21 list.add(tmp);
- 436
- }
- 437 806 boolean contains = true ;
- 438 806 for (String word : list) {
- 439 1445 contains &= ec.containsUsedString(word);
- 440 1445 }
- 441 806 return contains;
- 442
}
- 443
+ 403
- 444
+ 404
+ 405
+
+ 406
+
+ 407
+
+ 408
+
+ 409
+
+ 410
+
+ 411
+
+ 412
+ private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
+ 413 0 boolean isValid = false ;
+ 414
+
+ 415 0 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
+ 416
+ && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
+ 417
+
+ 418 0 isValid = true ;
+ 419
+ }
+ 420 0 return isValid;
+ 421
+ }
+ 422
+
+ 423
+
+ 424
+
+ 425
+
+ 426
+
+ 427
+
+ 428
+
+ 429
+
+ 430
+ private boolean collectionContainsString(EvidenceCollection ec, String text) {
+ 431
+
+ 432
+
+ 433
+
+ 434
+
+ 435
+
+ 436
+
+ 437
+
+ 438
+
+ 439
+
+ 440
+
+ 441
+
+ 442
+
+ 443 0 if (text == null ) {
+ 444 0 return false ;
445
-
- 446
-
- 447
-
- 448
-
- 449
-
+ } 446 0 final String[] words = text.split("[\\s_-]" );
+ 447 0 final List<String> list = new ArrayList<String>();
+ 448 0 String tempWord = null ;
+ 449 0 for (String word : words) {
450
-
+ 451
- @Override
+ 452
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+ 453
- try {
- 454 15 determineCPE(dependency);
- 455 0 } catch (CorruptIndexException ex) {
- 456 0 throw new AnalysisException("CPE Index is corrupt." , ex);
- 457 0 } catch (IOException ex) {
- 458 0 throw new AnalysisException("Failure opening the CPE Index." , ex);
- 459 0 } catch (ParseException ex) {
- 460 0 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency." , ex);
- 461 15 }
- 462 15 }
- 463
-
- 464
-
- 465
-
+ 454 0 if (tempWord != null ) {
+ 455 0 list.add(tempWord + word);
+ 456 0 tempWord = null ;
+ 457 0 } else if (word.length() <= 2) {
+ 458 0 tempWord = word;
+ 459
+ } else {
+ 460 0 list.add(word);
+ 461
+ }
+ 462
+ }
+ 463 0 if (tempWord != null && !list.isEmpty()) {
+ 464 0 final String tmp = list.get(list.size() - 1) + tempWord;
+ 465 0 list.add(tmp);
466
-
- 467
-
- 468
-
- 469
- @Override
- 470
- public Set<String> getSupportedExtensions() {
- 471
- return null ;
+ } 467 0 boolean contains = true ;
+ 468 0 for (String word : list) {
+ 469 0 contains &= ec.containsUsedString(word);
+ 470 0 }
+ 471 0 return contains;
472
}
473
@@ -826,514 +831,468 @@
474
475
-
+ 476
477
-
+ 478
-
+ 479
- @Override
+ 480
- public String getName() {
- 481 9 return "CPE Analyzer" ;
+ 481
+ @Override
482
- }
+ public void analyze(Dependency dependency, Engine engine) throws AnalysisException { 483
-
- 484
-
- 485
-
- 486
-
- 487
-
- 488
-
- 489
-
- 490
- @Override
- 491
- public boolean supportsExtension(String extension) {
- 492 9 return true ;
+ try { 484 0 determineCPE(dependency);
+ 485 0 } catch (CorruptIndexException ex) {
+ 486 0 throw new AnalysisException("CPE Index is corrupt." , ex);
+ 487 0 } catch (IOException ex) {
+ 488 0 throw new AnalysisException("Failure opening the CPE Index." , ex);
+ 489 0 } catch (ParseException ex) {
+ 490 0 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency." , ex);
+ 491 0 }
+ 492 0 }
493
- }
+ 494
-
+ 495
-
- 496
-
- 497
-
- 498
-
- 499
-
- 500
- @Override
- 501
- public AnalysisPhase getAnalysisPhase() {
- 502 6 return AnalysisPhase.IDENTIFIER_ANALYSIS;
- 503
- }
- 504
-
- 505
-
- 506
-
- 507
-
- 508
-
- 509
-
- 510
- @Override
- 511
- public void initialize() throws Exception {
- 512 3 this .open();
- 513 3 }
- 514
-
- 515
-
- 516
- 517
+ 496
- 518
+ 497
- 519
+ 498
- 520
+ 499
- 521
+ 500
- 522
+ 501
- 523
+ 502
- 524
+ 503
- 525
+ 504
private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException {
- 526 71 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
- 527 71 DependencyVersion bestGuess = new DependencyVersion("-" );
- 528 71 Confidence bestGuessConf = null ;
- 529 71 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
- 530 355 for (Confidence conf : Confidence.values()) {
- 531 284 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
- 532 160 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
- 533 160 if (evVer == null ) {
- 534 0 continue ;
- 535
+ 505 0 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
+ 506 0 DependencyVersion bestGuess = new DependencyVersion("-" );
+ 507 0 Confidence bestGuessConf = null ;
+ 508 0 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
+ 509 0 for (Confidence conf : Confidence.values()) {
+ 510 0 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
+ 511 0 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
+ 512 0 if (evVer == null ) {
+ 513 0 continue ;
+ 514
}
- 536 160 for (VulnerableSoftware vs : cpes) {
- 537
+ 515 0 for (VulnerableSoftware vs : cpes) {
+ 516
DependencyVersion dbVer;
- 538 9104 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
- 539 2855 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
- 540
+ 517 0 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
+ 518 0 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
+ 519
} else {
- 541 6249 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
- 542
+ 520 0 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
+ 521
}
- 543 9104 if (dbVer == null
- 544
+ 522 0 if (dbVer == null
+ 523
|| evVer.equals(dbVer)) {
- 545 169 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(vs.getName(), "UTF-8" ));
- 546 169 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
- 547 169 collected.add(match);
- 548 169 } else {
- 549
+ 524 0 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(vs.getName(), "UTF-8" ));
+ 525 0 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
+ 526 0 collected.add(match);
+ 527 0 } else {
+ 528
- 550 8935 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
- 551
+ 529 0 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
+ 530
&& evVer.matchesAtLeastThreeLevels(dbVer)) {
- 552 412 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
- 553 10 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
- 554 10 bestGuess = dbVer;
- 555 10 bestGuessConf = conf;
- 556
+ 531 0 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+ 532 0 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
+ 533 0 bestGuess = dbVer;
+ 534 0 bestGuessConf = conf;
+ 535
}
- 557
+ 536
}
- 558
+ 537
}
- 559
+ 538
}
- 560 9104 }
- 561 160 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
- 562 49 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
- 563 49 bestGuess = evVer;
- 564 49 bestGuessConf = conf;
- 565
+ 539 0 }
+ 540 0 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+ 541 0 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
+ 542 0 bestGuess = evVer;
+ 543 0 bestGuessConf = conf;
+ 544
}
- 566
+ 545
}
- 567 160 }
- 568
+ 546 0 }
+ 547
}
- 569 71 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
- 570 71 final String url = null ;
- 571 71 if (bestGuessConf == null ) {
- 572 12 bestGuessConf = Confidence.LOW;
- 573
+ 548 0 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
+ 549 0 final String url = null ;
+ 550 0 if (bestGuessConf == null ) {
+ 551 0 bestGuessConf = Confidence.LOW;
+ 552
}
- 574 71 final IdentifierMatch match = new IdentifierMatch("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
- 575 71 collected.add(match);
- 576
+ 553 0 final IdentifierMatch match = new IdentifierMatch("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
+ 554 0 collected.add(match);
+ 555
- 577 71 Collections.sort(collected);
- 578 71 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
- 579 71 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
- 580 71 for (IdentifierMatch m : collected) {
- 581 240 if (bestIdentifierQuality.equals(m.getConfidence())
- 582
+ 556 0 Collections.sort(collected);
+ 557 0 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
+ 558 0 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
+ 559 0 for (IdentifierMatch m : collected) {
+ 560 0 if (bestIdentifierQuality.equals(m.getConfidence())
+ 561
&& bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
- 583 88 final Identifier i = m.getIdentifier();
- 584 88 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
- 585 23 i.setConfidence(Confidence.LOW);
- 586
+ 562 0 final Identifier i = m.getIdentifier();
+ 563 0 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
+ 564 0 i.setConfidence(Confidence.LOW);
+ 565
} else {
- 587 65 i.setConfidence(bestEvidenceQuality);
- 588
+ 566 0 i.setConfidence(bestEvidenceQuality);
+ 567
}
- 589 88 dependency.addIdentifier(i);
- 590
+ 568 0 dependency.addIdentifier(i);
+ 569
}
- 591 240 }
- 592 71 }
- 593
+ 570 0 }
+ 571 0 }
+ 572
- 594
+ 573
- 595
+ 574
- 596
+ 575
- 597 1 private enum IdentifierConfidence {
- 598
+ 576 0 private enum IdentifierConfidence {
+ 577
- 599
+ 578
- 600
+ 579
+ 580
+
+ 581 0 EXACT_MATCH,
+ 582
+
+ 583
+
+ 584
+
+ 585 0 BEST_GUESS
+ 586
+ }
+ 587
+
+ 588
+
+ 589
+
+ 590
+
+ 591 0 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
+ 592
+
+ 593
+
+ 594
+
+ 595
+
+ 596
+
+ 597
+
+ 598
+
+ 599
+
+ 600
+
601
- 602 1 EXACT_MATCH,
- 603
-
- 604
-
- 605
-
- 606 1 BEST_GUESS
+ 602 0 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
+ 603 0 this .identifier = new Identifier(type, value, url);
+ 604 0 this .confidence = identifierConfidence;
+ 605 0 this .evidenceConfidence = evidenceConfidence;
+ 606 0 }
607
- }
- 608
-
- 609
-
- 610
-
- 611
-
- 612 265 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
- 613
-
- 614
-
- 615
-
- 616
-
- 617
-
- 618
-
- 619
-
- 620
-
- 621
-
- 622
-
- 623 240 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
- 624 240 this .identifier = new Identifier(type, value, url);
- 625 240 this .confidence = identifierConfidence;
- 626 240 this .evidenceConfidence = evidenceConfidence;
- 627 240 }
- 628
- 629
+ 608
- 630
+ 609
- 631
+ 610
- 632
+ 611
private Confidence evidenceConfidence;
- 633
+ 612
- 634
+ 613
- 635
+ 614
- 636
+ 615
- 637
+ 616
- 638
+ 617
- 639
+ 618
public Confidence getEvidenceConfidence() {
- 640
+ 619
return evidenceConfidence;
- 641
+ 620
}
- 642
+ 621
- 643
+ 622
- 644
+ 623
- 645
+ 624
- 646
+ 625
- 647
+ 626
- 648
+ 627
public void setEvidenceConfidence(Confidence evidenceConfidence) {
- 649
+ 628
this .evidenceConfidence = evidenceConfidence;
- 650
+ 629
}
- 651
+ 630
- 652
+ 631
- 653
+ 632
- 654
+ 633
private IdentifierConfidence confidence;
- 655
+ 634
- 656
+ 635
- 657
+ 636
- 658
+ 637
- 659
+ 638
- 660
+ 639
- 661
+ 640
public IdentifierConfidence getConfidence() {
- 662
+ 641
return confidence;
- 663
+ 642
}
- 664
+ 643
- 665
+ 644
- 666
+ 645
- 667
+ 646
- 668
+ 647
- 669
+ 648
- 670
+ 649
public void setConfidence(IdentifierConfidence confidence) {
- 671
+ 650
this .confidence = confidence;
- 672
+ 651
}
- 673
+ 652
- 674
+ 653
- 675
+ 654
- 676
+ 655
private Identifier identifier;
- 677
+ 656
- 678
+ 657
- 679
+ 658
- 680
+ 659
- 681
+ 660
- 682
+ 661
- 683
+ 662
public Identifier getIdentifier() {
- 684
+ 663
return identifier;
- 685
+ 664
}
- 686
+ 665
- 687
+ 666
- 688
+ 667
- 689
+ 668
- 690
+ 669
- 691
+ 670
- 692
+ 671
public void setIdentifier(Identifier identifier) {
- 693
+ 672
this .identifier = identifier;
- 694
+ 673
}
- 695
+ 674
- 696
+ 675
- 697
+ 676
- 698
+ 677
- 699
+ 678
- 700
+ 679
- 701
+ 680
- 702
+ 681
- 703
+ 682
@Override
- 704
+ 683
public String toString() {
- 705 0 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
- 706
+ 684 0 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
+ 685
+ ", confidence=" + confidence + ", identifier=" + identifier + '}' ;
- 707
+ 686
}
- 708
+ 687
- 709
+ 688
- 710
+ 689
- 711
+ 690
- 712
+ 691
- 713
+ 692
- 714
+ 693
@Override
- 715
+ 694
public int hashCode() {
- 716 0 int hash = 5;
- 717 0 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
- 718 0 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
- 719 0 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
- 720 0 return hash;
- 721
+ 695 0 int hash = 5;
+ 696 0 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
+ 697 0 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
+ 698 0 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
+ 699 0 return hash;
+ 700
}
- 722
+ 701
- 723
+ 702
- 724
+ 703
- 725
+ 704
- 726
+ 705
- 727
+ 706
- 728
+ 707
- 729
+ 708
@Override
- 730
+ 709
public boolean equals(Object obj) {
- 731 0 if (obj == null ) {
- 732 0 return false ;
- 733
+ 710 0 if (obj == null ) {
+ 711 0 return false ;
+ 712
}
- 734 0 if (getClass() != obj.getClass()) {
- 735 0 return false ;
- 736
+ 713 0 if (getClass() != obj.getClass()) {
+ 714 0 return false ;
+ 715
}
- 737 0 final IdentifierMatch other = (IdentifierMatch) obj;
- 738 0 if (this .evidenceConfidence != other.evidenceConfidence) {
- 739 0 return false ;
- 740
+ 716 0 final IdentifierMatch other = (IdentifierMatch) obj;
+ 717 0 if (this .evidenceConfidence != other.evidenceConfidence) {
+ 718 0 return false ;
+ 719
}
- 741 0 if (this .confidence != other.confidence) {
- 742 0 return false ;
- 743
+ 720 0 if (this .confidence != other.confidence) {
+ 721 0 return false ;
+ 722
}
- 744 0 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
- 745 0 return false ;
- 746
+ 723 0 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
+ 724 0 return false ;
+ 725
}
- 747 0 return true ;
- 748
+ 726 0 return true ;
+ 727
}
- 749
+ 728
- 750
+ 729
- 751
+ 730
- 752
+ 731
- 753
+ 732
- 754
+ 733
- 755
+ 734
- 756
+ 735
- 757
+ 736
- 758
+ 737
@Override
- 759
+ 738
public int compareTo(IdentifierMatch o) {
- 760 265 int conf = this .confidence.compareTo(o.confidence);
- 761 265 if (conf == 0) {
- 762 193 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
- 763 193 if (conf == 0) {
- 764 83 conf = identifier.compareTo(o.identifier);
- 765
+ 739 0 int conf = this .confidence.compareTo(o.confidence);
+ 740 0 if (conf == 0) {
+ 741 0 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
+ 742 0 if (conf == 0) {
+ 743 0 conf = identifier.compareTo(o.identifier);
+ 744
}
- 766
+ 745
}
- 767 265 return conf;
- 768
+ 746 0 return conf;
+ 747
}
- 769
+ 748
}
- 770
+ 749
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
index 5148f22f6..925a9fffa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
@@ -12,7 +12,7 @@
@@ -97,7 +97,7 @@
40
- 41 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+ 41 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
42
43
@@ -114,7 +114,7 @@
@Override
49
public String getName() {
- 50 9 return ANALYZER_NAME;
+ 50 0 return ANALYZER_NAME;
51
}
52
@@ -133,7 +133,7 @@
@Override
59
public AnalysisPhase getAnalysisPhase() {
- 60 6 return ANALYSIS_PHASE;
+ 60 0 return ANALYSIS_PHASE;
61
}
62
@@ -146,20 +146,20 @@
public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
66
- 67 9 if (getRules() == null || getRules().size() <= 0) {
+ 67 0 if (getRules() == null || getRules().size() <= 0) {
68 0 return ;
69
}
70
- 71 9 for (final SuppressionRule rule : getRules()) {
- 72 45 rule.process(dependency);
- 73 45 }
- 74 9 }
+ 71 0 for (final SuppressionRule rule : getRules()) {
+ 72 0 rule.process(dependency);
+ 73 0 }
+ 74 0 }
75
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
index 3ad25def6..621375cf9 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,27 +56,27 @@
19
20
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
- 21
import java.io.File;
- 22
+ 21
import java.util.HashSet;
- 23
+ 22
import java.util.Iterator;
- 24
+ 23
import java.util.ListIterator;
- 25
+ 24
import java.util.Set;
- 26
+ 25
import java.util.logging.Level;
- 27
+ 26
import java.util.logging.Logger;
- 28
+ 27
import java.util.regex.Matcher;
- 29
+ 28
import java.util.regex.Pattern;
- 30
+ 29
import org.owasp.dependencycheck.Engine;
+ 30
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
31
import org.owasp.dependencycheck.dependency.Dependency;
32
@@ -121,7 +121,7 @@
52
- 53 1 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*" );
+ 53 0 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*" );
54
55
@@ -137,567 +137,524 @@
60
61
-
+ 62
- 63 1 private static final Set<String> EXTENSIONS = null ;
+ 63
+ private static final String ANALYZER_NAME = "Dependency Bundling Analyzer" ;
64
65
-
+ 66
- 67
- private static final String ANALYZER_NAME = "Dependency Bundling Analyzer" ;
+ 67 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
68
-
+ 69
-
+ 70
-
- 71 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
- 72
-
- 73
-
- 74
-
- 75
-
- 76
-
- 77
-
- 78
- public Set<String> getSupportedExtensions() {
- 79 133 return EXTENSIONS;
- 80
- }
- 81
-
- 82
-
- 83
- 84
+ 71
- 85
+ 72
- 86
+ 73
- 87
+ 74
public String getName() {
- 88 10 return ANALYZER_NAME;
- 89
+ 75 0 return ANALYZER_NAME;
+ 76
}
- 90
+ 77
- 91
+ 78
- 92
-
- 93
-
- 94
-
- 95
-
- 96
-
- 97
- public boolean supportsExtension(String extension) {
- 98 10 return true ;
- 99
- }
- 100
-
- 101
-
- 102
+ 79
- 103
+ 80
- 104
+ 81
- 105
+ 82
- 106
+ 83
public AnalysisPhase getAnalysisPhase() {
- 107 7 return ANALYSIS_PHASE;
- 108
+ 84 0 return ANALYSIS_PHASE;
+ 85
}
- 109
+ 86
- 110
+ 87
- 111
+ 88
- 112
+ 89
- 113
+ 90
- 114
+ 91
- 115
+ 92
- 116
+ 93
- 117
+ 94
- 118
+ 95
- 119
+ 96
@Override
- 120
+ 97
public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
- 121 9 if (!analyzed) {
- 122 1 analyzed = true ;
- 123 1 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
- 124 1 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
- 125
+ 98 0 if (!analyzed) {
+ 99 0 analyzed = true ;
+ 100 0 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
+ 101 0 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
+ 102
- 126 4 while (mainIterator.hasNext()) {
- 127 3 final Dependency dependency = mainIterator.next();
- 128 3 if (mainIterator.hasNext()) {
- 129 2 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
- 130 5 while (subIterator.hasNext()) {
- 131 3 final Dependency nextDependency = subIterator.next();
- 132 3 if (isShadedJar(dependency, nextDependency)) {
- 133 0 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )) {
- 134 0 dependenciesToRemove.add(dependency);
- 135
+ 103 0 while (mainIterator.hasNext()) {
+ 104 0 final Dependency dependency = mainIterator.next();
+ 105 0 if (mainIterator.hasNext()) {
+ 106 0 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
+ 107 0 while (subIterator.hasNext()) {
+ 108 0 final Dependency nextDependency = subIterator.next();
+ 109 0 if (isShadedJar(dependency, nextDependency)) {
+ 110 0 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )) {
+ 111 0 dependenciesToRemove.add(dependency);
+ 112
} else {
- 136 0 dependenciesToRemove.add(nextDependency);
- 137
+ 113 0 dependenciesToRemove.add(nextDependency);
+ 114
}
- 138 3 } else if (hashesMatch(dependency, nextDependency)) {
- 139 0 if (isCore(dependency, nextDependency)) {
- 140 0 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
- 141
+ 115 0 } else if (hashesMatch(dependency, nextDependency)) {
+ 116 0 if (isCore(dependency, nextDependency)) {
+ 117 0 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
+ 118
} else {
- 142 0 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
- 143
+ 119 0 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+ 120
}
- 144 3 } else if (cpeIdentifiersMatch(dependency, nextDependency)
- 145
+ 121 0 } else if (cpeIdentifiersMatch(dependency, nextDependency)
+ 122
&& hasSameBasePath(dependency, nextDependency)
- 146
+ 123
&& fileNameMatch(dependency, nextDependency)) {
- 147
+ 124
- 148 0 if (isCore(dependency, nextDependency)) {
- 149 0 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
- 150
+ 125 0 if (isCore(dependency, nextDependency)) {
+ 126 0 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
+ 127
} else {
- 151 0 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
- 152
+ 128 0 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+ 129
}
- 153
+ 130
}
- 154 3 }
- 155
+ 131 0 }
+ 132
}
- 156 3 }
- 157
+ 133 0 }
+ 134
- 158
+ 135
- 159 1 for (Dependency d : dependenciesToRemove) {
- 160 0 engine.getDependencies().remove(d);
- 161 0 }
- 162
+ 136 0 for (Dependency d : dependenciesToRemove) {
+ 137 0 engine.getDependencies().remove(d);
+ 138 0 }
+ 139
}
- 163 9 }
- 164
+ 140 0 }
+ 141
- 165
+ 142
- 166
+ 143
- 167
+ 144
- 168
+ 145
- 169
+ 146
- 170
+ 147
- 171
+ 148
- 172
+ 149
- 173
+ 150
- 174
+ 151
private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
- 175 0 dependency.addRelatedDependency(relatedDependency);
- 176 0 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
- 177 0 while (i.hasNext()) {
- 178 0 dependency.addRelatedDependency(i.next());
- 179 0 i.remove();
- 180
+ 152 0 dependency.addRelatedDependency(relatedDependency);
+ 153 0 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
+ 154 0 while (i.hasNext()) {
+ 155 0 dependency.addRelatedDependency(i.next());
+ 156 0 i.remove();
+ 157
}
- 181 0 dependenciesToRemove.add(relatedDependency);
- 182 0 }
- 183
+ 158 0 dependenciesToRemove.add(relatedDependency);
+ 159 0 }
+ 160
- 184
+ 161
- 185
+ 162
- 186
+ 163
- 187
+ 164
- 188
+ 165
- 189
+ 166
- 190
+ 167
- 191
+ 168
private String getBaseRepoPath(final String path) {
- 192 0 int pos = path.indexOf("repository" + File.separator) + 11;
- 193 0 if (pos < 0) {
- 194 0 return path;
- 195
+ 169 0 int pos = path.indexOf("repository" + File.separator) + 11;
+ 170 0 if (pos < 0) {
+ 171 0 return path;
+ 172
}
- 196 0 int tmp = path.indexOf(File.separator, pos);
- 197 0 if (tmp <= 0) {
- 198 0 return path;
- 199
+ 173 0 int tmp = path.indexOf(File.separator, pos);
+ 174 0 if (tmp <= 0) {
+ 175 0 return path;
+ 176
}
- 200 0 if (tmp > 0) {
- 201 0 pos = tmp + 1;
- 202
+ 177 0 if (tmp > 0) {
+ 178 0 pos = tmp + 1;
+ 179
}
- 203 0 tmp = path.indexOf(File.separator, pos);
- 204 0 if (tmp > 0) {
- 205 0 pos = tmp + 1;
- 206
+ 180 0 tmp = path.indexOf(File.separator, pos);
+ 181 0 if (tmp > 0) {
+ 182 0 pos = tmp + 1;
+ 183
}
- 207 0 return path.substring(0, pos);
- 208
+ 184 0 return path.substring(0, pos);
+ 185
}
- 209
+ 186
- 210
+ 187
- 211
+ 188
- 212
+ 189
- 213
+ 190
- 214
+ 191
- 215
+ 192
- 216
+ 193
- 217
+ 194
private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
- 218 0 if (dependency1 == null || dependency1.getFileName() == null
- 219
+ 195 0 if (dependency1 == null || dependency1.getFileName() == null
+ 196
|| dependency2 == null || dependency2.getFileName() == null ) {
- 220 0 return false ;
- 221
+ 197 0 return false ;
+ 198
}
- 222 0 String fileName1 = dependency1.getFileName();
- 223 0 String fileName2 = dependency2.getFileName();
- 224
+ 199 0 String fileName1 = dependency1.getFileName();
+ 200 0 String fileName2 = dependency2.getFileName();
+ 201
- 225
+ 202
- 226
+ 203
- 227 0 final File one = new File(fileName1);
- 228 0 final File two = new File(fileName2);
- 229 0 final String oneParent = one.getParent();
- 230 0 final String twoParent = two.getParent();
- 231 0 if (oneParent != null ) {
- 232 0 if (oneParent.equals(twoParent)) {
- 233 0 fileName1 = one.getName();
- 234 0 fileName2 = two.getName();
- 235
+ 204 0 final File one = new File(fileName1);
+ 205 0 final File two = new File(fileName2);
+ 206 0 final String oneParent = one.getParent();
+ 207 0 final String twoParent = two.getParent();
+ 208 0 if (oneParent != null ) {
+ 209 0 if (oneParent.equals(twoParent)) {
+ 210 0 fileName1 = one.getName();
+ 211 0 fileName2 = two.getName();
+ 212
} else {
- 236 0 return false ;
- 237
+ 213 0 return false ;
+ 214
}
- 238 0 } else if (twoParent != null ) {
- 239 0 return false ;
- 240
+ 215 0 } else if (twoParent != null ) {
+ 216 0 return false ;
+ 217
}
- 241
+ 218
- 242
+ 219
- 243 0 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
- 244 0 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
- 245 0 if (version1 != null && version2 != null ) {
- 246 0 if (!version1.equals(version2)) {
- 247 0 return false ;
- 248
+ 220 0 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
+ 221 0 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
+ 222 0 if (version1 != null && version2 != null ) {
+ 223 0 if (!version1.equals(version2)) {
+ 224 0 return false ;
+ 225
}
+ 226
+ }
+ 227
+
+ 228
+
+ 229 0 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
+ 230 0 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
+ 231 0 if (match1.find() && match2.find()) {
+ 232 0 return match1.group().equals(match2.group());
+ 233
+ }
+ 234
+
+ 235 0 return false ;
+ 236
+ }
+ 237
+
+ 238
+
+ 239
+
+ 240
+
+ 241
+
+ 242
+
+ 243
+
+ 244
+
+ 245
+ private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
+ 246 0 if (dependency1 == null || dependency1.getIdentifiers() == null
+ 247
+ || dependency2 == null || dependency2.getIdentifiers() == null ) {
+ 248 0 return false ;
249
}
- 250
-
- 251
-
- 252 0 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
- 253 0 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
- 254 0 if (match1.find() && match2.find()) {
- 255 0 return match1.group().equals(match2.group());
+ 250 0 boolean matches = false ;
+ 251 0 int cpeCount1 = 0;
+ 252 0 int cpeCount2 = 0;
+ 253 0 for (Identifier i : dependency1.getIdentifiers()) {
+ 254 0 if ("cpe" .equals(i.getType())) {
+ 255 0 cpeCount1 += 1;
256
- }
- 257
-
- 258 0 return false ;
- 259
- }
- 260
-
+ } 257 0 }
+ 258 0 for (Identifier i : dependency2.getIdentifiers()) {
+ 259 0 if ("cpe" .equals(i.getType())) {
+ 260 0 cpeCount2 += 1;
261
-
- 262
-
- 263
-
- 264
-
- 265
-
- 266
-
- 267
-
+ } 262 0 }
+ 263 0 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
+ 264 0 for (Identifier i : dependency1.getIdentifiers()) {
+ 265 0 matches |= dependency2.getIdentifiers().contains(i);
+ 266 0 if (!matches) {
+ 267 0 break ;
268
- private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
- 269 3 if (dependency1 == null || dependency1.getIdentifiers() == null
- 270
- || dependency2 == null || dependency2.getIdentifiers() == null ) {
- 271 0 return false ;
- 272
- }
- 273 3 boolean matches = false ;
- 274 3 int cpeCount1 = 0;
- 275 3 int cpeCount2 = 0;
- 276 3 for (Identifier i : dependency1.getIdentifiers()) {
- 277 3 if ("cpe" .equals(i.getType())) {
- 278 3 cpeCount1 += 1;
- 279
- }
- 280 3 }
- 281 3 for (Identifier i : dependency2.getIdentifiers()) {
- 282 3 if ("cpe" .equals(i.getType())) {
- 283 3 cpeCount2 += 1;
- 284
- }
- 285 3 }
- 286 3 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
- 287 3 for (Identifier i : dependency1.getIdentifiers()) {
- 288 3 matches |= dependency2.getIdentifiers().contains(i);
- 289 3 if (!matches) {
- 290 2 break ;
- 291
}
- 292 1 }
- 293
+ 269 0 }
+ 270
}
- 294 3 if (LogUtils.isVerboseLoggingEnabled()) {
- 295 0 final String msg = String.format("IdentifiersMatch=%s (%s, %s)" , matches, dependency1.getFileName(), dependency2.getFileName());
- 296 0 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
- 297
+ 271 0 if (LogUtils.isVerboseLoggingEnabled()) {
+ 272 0 final String msg = String.format("IdentifiersMatch=%s (%s, %s)" , matches, dependency1.getFileName(), dependency2.getFileName());
+ 273 0 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
+ 274
}
- 298 3 return matches;
- 299
+ 275 0 return matches;
+ 276
}
- 300
+ 277
- 301
+ 278
- 302
+ 279
- 303
+ 280
- 304
+ 281
- 305
+ 282
- 306
+ 283
- 307
+ 284
- 308
+ 285
private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
- 309 1 if (dependency1 == null || dependency2 == null ) {
- 310 0 return false ;
- 311
+ 286 0 if (dependency1 == null || dependency2 == null ) {
+ 287 0 return false ;
+ 288
}
- 312 1 final File lFile = new File(dependency1.getFilePath());
- 313 1 String left = lFile.getParent();
- 314 1 final File rFile = new File(dependency2.getFilePath());
- 315 1 String right = rFile.getParent();
- 316 1 if (left == null ) {
- 317 0 return right == null ;
- 318
+ 289 0 final File lFile = new File(dependency1.getFilePath());
+ 290 0 String left = lFile.getParent();
+ 291 0 final File rFile = new File(dependency2.getFilePath());
+ 292 0 String right = rFile.getParent();
+ 293 0 if (left == null ) {
+ 294 0 return right == null ;
+ 295
}
- 319 1 if (left.equalsIgnoreCase(right)) {
- 320 0 return true ;
- 321
+ 296 0 if (left.equalsIgnoreCase(right)) {
+ 297 0 return true ;
+ 298
}
- 322 1 if (left.matches(".*[/\\\\]repository[/\\\\].*" ) && right.matches(".*[/\\\\]repository[/\\\\].*" )) {
- 323 0 left = getBaseRepoPath(left);
- 324 0 right = getBaseRepoPath(right);
- 325
+ 299 0 if (left.matches(".*[/\\\\]repository[/\\\\].*" ) && right.matches(".*[/\\\\]repository[/\\\\].*" )) {
+ 300 0 left = getBaseRepoPath(left);
+ 301 0 right = getBaseRepoPath(right);
+ 302
}
- 326 1 if (left.equalsIgnoreCase(right)) {
- 327 0 return true ;
- 328
+ 303 0 if (left.equalsIgnoreCase(right)) {
+ 304 0 return true ;
+ 305
}
- 329
+ 306
- 330 1 for (Dependency child : dependency2.getRelatedDependencies()) {
- 331 0 if (hasSameBasePath(dependency1, child)) {
- 332 0 return true ;
- 333
+ 307 0 for (Dependency child : dependency2.getRelatedDependencies()) {
+ 308 0 if (hasSameBasePath(dependency1, child)) {
+ 309 0 return true ;
+ 310
}
- 334 0 }
- 335 1 return false ;
- 336
+ 311 0 }
+ 312 0 return false ;
+ 313
}
- 337
+ 314
- 338
+ 315
- 339
+ 316
- 340
+ 317
- 341
+ 318
- 342
+ 319
- 343
+ 320
- 344
+ 321
- 345
+ 322
- 346
+ 323
boolean isCore(Dependency left, Dependency right) {
- 347 2 final String leftName = left.getFileName().toLowerCase();
- 348 2 final String rightName = right.getFileName().toLowerCase();
- 349
+ 324 0 final String leftName = left.getFileName().toLowerCase();
+ 325 0 final String rightName = right.getFileName().toLowerCase();
+ 326
- 350
+ 327
final boolean returnVal;
- 351 2 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
- 352
+ 328 0 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+ 329
|| rightName.contains("core" ) && !leftName.contains("core" )
- 353
+ 330
|| rightName.contains("kernel" ) && !leftName.contains("kernel" )) {
- 354 0 returnVal = false ;
- 355 2 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
- 356
+ 331 0 returnVal = false ;
+ 332 0 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+ 333
|| !rightName.contains("core" ) && leftName.contains("core" )
- 357
+ 334
|| !rightName.contains("kernel" ) && leftName.contains("kernel" )) {
- 358 2 returnVal = true ;
- 359
+ 335 0 returnVal = true ;
+ 336
} else {
- 360
+ 337
- 361
+ 338
- 362
+ 339
- 363
+ 340
- 364
+ 341
- 365
+ 342
- 366
+ 343
- 367
+ 344
- 368
+ 345
- 369 0 returnVal = leftName.length() <= rightName.length();
- 370
+ 346 0 returnVal = leftName.length() <= rightName.length();
+ 347
}
- 371 2 if (LogUtils.isVerboseLoggingEnabled()) {
- 372 0 final String msg = String.format("IsCore=%s (%s, %s)" , returnVal, left.getFileName(), right.getFileName());
- 373 0 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
- 374
+ 348 0 if (LogUtils.isVerboseLoggingEnabled()) {
+ 349 0 final String msg = String.format("IsCore=%s (%s, %s)" , returnVal, left.getFileName(), right.getFileName());
+ 350 0 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
+ 351
}
- 375 2 return returnVal;
- 376
+ 352 0 return returnVal;
+ 353
}
- 377
+ 354
- 378
+ 355
- 379
+ 356
- 380
+ 357
- 381
+ 358
- 382
+ 359
- 383
+ 360
- 384
+ 361
- 385
+ 362
private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
- 386 3 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
- 387 0 return false ;
- 388
+ 363 0 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
+ 364 0 return false ;
+ 365
}
- 389 3 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
- 390
+ 366 0 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
+ 367
}
- 391
+ 368
- 392
+ 369
- 393
+ 370
- 394
+ 371
- 395
+ 372
- 396
+ 373
- 397
+ 374
- 398
+ 375
- 399
+ 376
- 400
+ 377
- 401
+ 378
private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
- 402 3 final String mainName = dependency.getFileName().toLowerCase();
- 403 3 final String nextName = nextDependency.getFileName().toLowerCase();
- 404 3 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
- 405 0 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
- 406 3 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
- 407 0 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
- 408
+ 379 0 final String mainName = dependency.getFileName().toLowerCase();
+ 380 0 final String nextName = nextDependency.getFileName().toLowerCase();
+ 381 0 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
+ 382 0 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
+ 383 0 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
+ 384 0 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
+ 385
}
- 409 3 return false ;
- 410
+ 386 0 return false ;
+ 387
}
- 411
+ 388
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
index 9fe21acd5..7c78e7965 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
@@ -12,7 +12,7 @@
@@ -110,535 +110,492 @@
46
47
-
+ 48
- 49 1 private static final Set<String> EXTENSIONS = null ;
+ 49
+ private static final String ANALYZER_NAME = "False Positive Analyzer" ;
50
51
-
+ 52
- 53
- private static final String ANALYZER_NAME = "False Positive Analyzer" ;
+ 53 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
54
-
+ 55
-
+ 56
-
- 57 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
- 58
-
- 59
-
- 60
-
- 61
-
- 62
-
- 63
-
- 64
- public Set<String> getSupportedExtensions() {
- 65 133 return EXTENSIONS;
- 66
- }
- 67
-
- 68
-
- 69
- 70
+ 57
- 71
+ 58
- 72
+ 59
- 73
+ 60
public String getName() {
- 74 10 return ANALYZER_NAME;
- 75
+ 61 0 return ANALYZER_NAME;
+ 62
}
- 76
+ 63
- 77
+ 64
- 78
-
- 79
-
- 80
-
- 81
-
- 82
-
- 83
- public boolean supportsExtension(String extension) {
- 84 10 return true ;
- 85
- }
- 86
-
- 87
-
- 88
+ 65
- 89
+ 66
- 90
+ 67
- 91
+ 68
- 92
+ 69
public AnalysisPhase getAnalysisPhase() {
- 93 7 return ANALYSIS_PHASE;
- 94
+ 70 0 return ANALYSIS_PHASE;
+ 71
}
- 95
+ 72
- 96
+ 73
- 97
+ 74
- 98
+ 75
- 99
+ 76
- 100
+ 77
- 101
+ 78
- 102
+ 79
- 103
+ 80
- 104
+ 81
@Override
- 105
+ 82
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 106 16 removeJreEntries(dependency);
- 107 16 removeBadMatches(dependency);
- 108 16 removeWrongVersionMatches(dependency);
- 109 16 removeSpuriousCPE(dependency);
- 110 16 addFalseNegativeCPEs(dependency);
- 111 16 }
- 112
+ 83 0 removeJreEntries(dependency);
+ 84 0 removeBadMatches(dependency);
+ 85 0 removeWrongVersionMatches(dependency);
+ 86 0 removeSpuriousCPE(dependency);
+ 87 0 addFalseNegativeCPEs(dependency);
+ 88 0 }
+ 89
- 113
+ 90
- 114
+ 91
- 115
+ 92
- 116
+ 93
- 117
+ 94
- 118
+ 95
- 119
+ 96
- 120
+ 97
- 121
+ 98
- 122
+ 99
- 123
+ 100
- 124
+ 101
- 125
+ 102
- 126
+ 103
- 127
+ 104
- 128
+ 105
- 129
+ 106
- 130
+ 107
- 131
+ 108
@SuppressWarnings("null" )
- 132
+ 109
private void removeSpuriousCPE(Dependency dependency) {
- 133 16 final List<Identifier> ids = new ArrayList<Identifier>();
- 134 16 ids.addAll(dependency.getIdentifiers());
- 135 16 Collections.sort(ids);
- 136 16 final ListIterator<Identifier> mainItr = ids.listIterator();
- 137 37 while (mainItr.hasNext()) {
- 138 21 final Identifier currentId = mainItr.next();
- 139 21 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
- 140 21 if (currentCpe == null ) {
- 141 0 continue ;
- 142
+ 110 0 final List<Identifier> ids = new ArrayList<Identifier>();
+ 111 0 ids.addAll(dependency.getIdentifiers());
+ 112 0 Collections.sort(ids);
+ 113 0 final ListIterator<Identifier> mainItr = ids.listIterator();
+ 114 0 while (mainItr.hasNext()) {
+ 115 0 final Identifier currentId = mainItr.next();
+ 116 0 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
+ 117 0 if (currentCpe == null ) {
+ 118 0 continue ;
+ 119
}
- 143 21 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
- 144 32 while (subItr.hasNext()) {
- 145 11 final Identifier nextId = subItr.next();
- 146 11 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
- 147 11 if (nextCpe == null ) {
- 148 0 continue ;
- 149
+ 120 0 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
+ 121 0 while (subItr.hasNext()) {
+ 122 0 final Identifier nextId = subItr.next();
+ 123 0 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
+ 124 0 if (nextCpe == null ) {
+ 125 0 continue ;
+ 126
}
- 150
+ 127
- 151 11 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
- 152 3 if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
- 153
+ 128 0 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
+ 129 0 if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
+ 130
- 154 3 final String currentVersion = currentCpe.getVersion();
- 155 3 final String nextVersion = nextCpe.getVersion();
- 156 3 if (currentVersion == null && nextVersion == null ) {
- 157
+ 131 0 final String currentVersion = currentCpe.getVersion();
+ 132 0 final String nextVersion = nextCpe.getVersion();
+ 133 0 if (currentVersion == null && nextVersion == null ) {
+ 134
- 158 0 Logger.getLogger(FalsePositiveAnalyzer.class
- 159
+ 135 0 Logger.getLogger(FalsePositiveAnalyzer.class
+ 136
.getName()).log(Level.FINE, "currentVersion and nextVersion are both null?" );
- 160 3 } else if (currentVersion == null && nextVersion != null ) {
- 161 3 dependency.getIdentifiers().remove(currentId);
- 162 0 } else if (nextVersion == null && currentVersion != null ) {
- 163 0 dependency.getIdentifiers().remove(nextId);
- 164 0 } else if (currentVersion.length() < nextVersion.length()) {
- 165 0 if (nextVersion.startsWith(currentVersion) || "-" .equals(currentVersion)) {
- 166 0 dependency.getIdentifiers().remove(currentId);
- 167
+ 137 0 } else if (currentVersion == null && nextVersion != null ) {
+ 138 0 dependency.getIdentifiers().remove(currentId);
+ 139 0 } else if (nextVersion == null && currentVersion != null ) {
+ 140 0 dependency.getIdentifiers().remove(nextId);
+ 141 0 } else if (currentVersion.length() < nextVersion.length()) {
+ 142 0 if (nextVersion.startsWith(currentVersion) || "-" .equals(currentVersion)) {
+ 143 0 dependency.getIdentifiers().remove(currentId);
+ 144
}
- 168
+ 145
} else {
- 169 0 if (currentVersion.startsWith(nextVersion) || "-" .equals(nextVersion)) {
- 170 0 dependency.getIdentifiers().remove(nextId);
- 171
+ 146 0 if (currentVersion.startsWith(nextVersion) || "-" .equals(nextVersion)) {
+ 147 0 dependency.getIdentifiers().remove(nextId);
+ 148
}
- 172
+ 149
}
- 173
+ 150
}
- 174
+ 151
}
- 175 11 }
- 176 21 }
- 177 16 }
- 178
+ 152 0 }
+ 153 0 }
+ 154 0 }
+ 155
- 179
+ 156
- 180
+ 157
- 181 1 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
- 182
+ 158 0 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
+ 159
+ "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
- 183
+ 160
+ "jdk|jre|jsf|jsse)($|:.*)" );
- 184
+ 161
- 185
+ 162
- 186
+ 163
- 187 1 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
- 188
+ 164 0 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
+ 165
- 189
+ 166
- 190
+ 167
- 191
+ 168
- 192
+ 169
- 193
+ 170
- 194
+ 171
private void removeJreEntries(Dependency dependency) {
- 195 16 final Set<Identifier> identifiers = dependency.getIdentifiers();
- 196 16 final Iterator<Identifier> itr = identifiers.iterator();
- 197 39 while (itr.hasNext()) {
- 198 23 final Identifier i = itr.next();
- 199 23 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
- 200 23 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
- 201 23 if (coreCPE.matches() && !coreFiles.matches()) {
- 202 0 itr.remove();
- 203
+ 172 0 final Set<Identifier> identifiers = dependency.getIdentifiers();
+ 173 0 final Iterator<Identifier> itr = identifiers.iterator();
+ 174 0 while (itr.hasNext()) {
+ 175 0 final Identifier i = itr.next();
+ 176 0 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
+ 177 0 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
+ 178 0 if (coreCPE.matches() && !coreFiles.matches()) {
+ 179 0 itr.remove();
+ 180
}
+ 181
+
+ 182
+
+ 183
+
+ 184
+
+ 185
+
+ 186
+
+ 187
+
+ 188
+
+ 189
+
+ 190
+
+ 191
+
+ 192
+
+ 193
+
+ 194
+
+ 195
+
+ 196
+
+ 197
+
+ 198
+
+ 199
+
+ 200
+
+ 201
+
+ 202 0 }
+ 203 0 }
204
205
-
+ 206
-
- 207
-
- 208
-
- 209
-
- 210
-
- 211
-
- 212
-
- 213
-
- 214
-
- 215
-
- 216
-
- 217
-
- 218
-
- 219
-
- 220
-
- 221
-
- 222
-
- 223
-
- 224
-
- 225 23 }
- 226 16 }
- 227
-
- 228
-
- 229
- 230
+ 207
- 231
+ 208
- 232
+ 209
- 233
+ 210
- 234
+ 211
- 235
+ 212
private VulnerableSoftware parseCpe(String type, String value) {
- 236 32 if (!"cpe" .equals(type)) {
- 237 0 return null ;
- 238
+ 213 0 if (!"cpe" .equals(type)) {
+ 214 0 return null ;
+ 215
}
- 239 32 final VulnerableSoftware cpe = new VulnerableSoftware();
- 240
+ 216 0 final VulnerableSoftware cpe = new VulnerableSoftware();
+ 217
try {
- 241 32 cpe.parseName(value);
- 242 0 } catch (UnsupportedEncodingException ex) {
- 243 0 Logger.getLogger(FalsePositiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 244 0 return null ;
- 245 32 }
- 246 32 return cpe;
- 247
+ 218 0 cpe.parseName(value);
+ 219 0 } catch (UnsupportedEncodingException ex) {
+ 220 0 Logger.getLogger(FalsePositiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
+ 221 0 return null ;
+ 222 0 }
+ 223 0 return cpe;
+ 224
}
- 248
+ 225
- 249
+ 226
- 250
+ 227
- 251
+ 228
- 252
+ 229
- 253
+ 230
- 254
+ 231
- 255
+ 232
private void removeBadMatches(Dependency dependency) {
- 256 16 final Set<Identifier> identifiers = dependency.getIdentifiers();
- 257 16 final Iterator<Identifier> itr = identifiers.iterator();
- 258
+ 233 0 final Set<Identifier> identifiers = dependency.getIdentifiers();
+ 234 0 final Iterator<Identifier> itr = identifiers.iterator();
+ 235
- 259
+ 236
- 260
+ 237
- 261
+ 238
- 262
+ 239
- 263
+ 240
- 264
+ 241
- 265
+ 242
- 266 39 while (itr.hasNext()) {
- 267 23 final Identifier i = itr.next();
- 268
+ 243 0 while (itr.hasNext()) {
+ 244 0 final Identifier i = itr.next();
+ 245
- 269 23 if ("cpe" .equals(i.getType())) {
- 270 23 if ((i.getValue().matches(".*c\\+\\+.*" )
- 271
+ 246 0 if ("cpe" .equals(i.getType())) {
+ 247 0 if ((i.getValue().matches(".*c\\+\\+.*" )
+ 248
|| i.getValue().startsWith("cpe:/a:jquery:jquery" )
- 272
+ 249
|| i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
- 273
+ 250
|| i.getValue().startsWith("cpe:/a:yahoo:yui" )
- 274
+ 251
|| i.getValue().startsWith("cpe:/a:file:file" )
- 275
+ 252
|| i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
- 276
+ 253
|| i.getValue().startsWith("cpe:/a:cvs:cvs" )
- 277
+ 254
|| i.getValue().startsWith("cpe:/a:ftp:ftp" )
- 278
+ 255
|| i.getValue().startsWith("cpe:/a:ssh:ssh" ))
- 279
+ 256
&& (dependency.getFileName().toLowerCase().endsWith(".jar" )
- 280
+ 257
|| dependency.getFileName().toLowerCase().endsWith("pom.xml" ))) {
- 281 1 itr.remove();
- 282 22 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
- 283
+ 258 0 itr.remove();
+ 259 0 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
+ 260
&& !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
- 284 0 itr.remove();
- 285 22 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
- 286
+ 261 0 itr.remove();
+ 262 0 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
+ 263
&& !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
- 287 0 itr.remove();
- 288 22 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
- 289
+ 264 0 itr.remove();
+ 265 0 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
+ 266
&& !dependency.getFileName().toLowerCase().matches("jboss-[\\d\\.]+(GA)?\\.jar" )) {
- 290 0 itr.remove();
+ 267 0 itr.remove();
+ 268
+ }
+ 269
+ }
+ 270 0 }
+ 271 0 }
+ 272
+
+ 273
+
+ 274
+
+ 275
+
+ 276
+
+ 277
+
+ 278
+ private void removeWrongVersionMatches(Dependency dependency) {
+ 279 0 final Set<Identifier> identifiers = dependency.getIdentifiers();
+ 280 0 final Iterator<Identifier> itr = identifiers.iterator();
+ 281
+
+ 282 0 final String fileName = dependency.getFileName();
+ 283 0 if (fileName != null && fileName.contains("axis2" )) {
+ 284 0 while (itr.hasNext()) {
+ 285 0 final Identifier i = itr.next();
+ 286 0 if ("cpe" .equals(i.getType())) {
+ 287 0 final String cpe = i.getValue();
+ 288 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
+ 289 0 itr.remove();
+ 290
+ }
291
}
- 292
- }
- 293 23 }
- 294 16 }
- 295
-
- 296
-
- 297
-
- 298
-
- 299
-
+ 292 0 }
+ 293 0 } else if (fileName != null && fileName.contains("axis" )) {
+ 294 0 while (itr.hasNext()) {
+ 295 0 final Identifier i = itr.next();
+ 296 0 if ("cpe" .equals(i.getType())) {
+ 297 0 final String cpe = i.getValue();
+ 298 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
+ 299 0 itr.remove();
300
-
+ } 301
- private void removeWrongVersionMatches(Dependency dependency) {
- 302 16 final Set<Identifier> identifiers = dependency.getIdentifiers();
- 303 16 final Iterator<Identifier> itr = identifiers.iterator();
- 304
-
- 305 16 final String fileName = dependency.getFileName();
- 306 16 if (fileName != null && fileName.contains("axis2" )) {
- 307 3 while (itr.hasNext()) {
- 308 2 final Identifier i = itr.next();
- 309 2 if ("cpe" .equals(i.getType())) {
- 310 2 final String cpe = i.getValue();
- 311 2 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
- 312 1 itr.remove();
- 313
- }
- 314
}
- 315 2 }
- 316 15 } else if (fileName != null && fileName.contains("axis" )) {
- 317 0 while (itr.hasNext()) {
- 318 0 final Identifier i = itr.next();
- 319 0 if ("cpe" .equals(i.getType())) {
- 320 0 final String cpe = i.getValue();
- 321 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
- 322 0 itr.remove();
- 323
- }
- 324
- }
- 325 0 }
- 326
+ 302 0 }
+ 303
}
- 327 16 }
- 328
+ 304 0 }
+ 305
- 329
+ 306
- 330
+ 307
- 331
+ 308
- 332
+ 309
- 333
+ 310
- 334
+ 311
- 335
+ 312
- 336
+ 313
private void addFalseNegativeCPEs(Dependency dependency) {
- 337 16 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
- 338 34 while (itr.hasNext()) {
- 339 18 final Identifier i = itr.next();
- 340 18 if ("cpe" .equals(i.getType()) && i.getValue() != null
- 341
+ 314 0 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+ 315 0 while (itr.hasNext()) {
+ 316 0 final Identifier i = itr.next();
+ 317 0 if ("cpe" .equals(i.getType()) && i.getValue() != null
+ 318
&& (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
- 342
+ 319
|| i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
- 343
+ 320
|| i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
- 344
+ 321
|| i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
- 345 0 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
- 346 0 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
- 347 0 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
- 348 0 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
- 349
+ 322 0 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
+ 323 0 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
+ 324 0 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
+ 325 0 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
+ 326
try {
- 350 0 dependency.addIdentifier("cpe" ,
- 351
+ 327 0 dependency.addIdentifier("cpe" ,
+ 328
newCpe,
- 352
+ 329
String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe, "UTF-8" )));
- 353 0 dependency.addIdentifier("cpe" ,
- 354
+ 330 0 dependency.addIdentifier("cpe" ,
+ 331
newCpe2,
- 355
+ 332
String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe2, "UTF-8" )));
- 356 0 dependency.addIdentifier("cpe" ,
- 357
+ 333 0 dependency.addIdentifier("cpe" ,
+ 334
newCpe3,
- 358
+ 335
String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe3, "UTF-8" )));
- 359 0 dependency.addIdentifier("cpe" ,
- 360
+ 336 0 dependency.addIdentifier("cpe" ,
+ 337
newCpe4,
- 361
+ 338
String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe4, "UTF-8" )));
- 362 0 } catch (UnsupportedEncodingException ex) {
- 363 0 Logger.getLogger(FalsePositiveAnalyzer.class
- 364
+ 339 0 } catch (UnsupportedEncodingException ex) {
+ 340 0 Logger.getLogger(FalsePositiveAnalyzer.class
+ 341
.getName()).log(Level.FINE, null , ex);
- 365 0 }
- 366
+ 342 0 }
+ 343
}
- 367 18 }
- 368 16 }
- 369
+ 344 0 }
+ 345 0 }
+ 346
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
index 565feed58..1e15aba88 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,224 +56,179 @@
19
20
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
- 21
import java.io.File;
- 22
- import java.util.Set;
- 23
+ 21
import org.owasp.dependencycheck.Engine;
- 24
+ 22
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ 23
import org.owasp.dependencycheck.dependency.Confidence;
- 25
+ 24
import org.owasp.dependencycheck.dependency.Dependency;
- 26
+ 25
import org.owasp.dependencycheck.utils.DependencyVersion;
- 27
+ 26
import org.owasp.dependencycheck.utils.DependencyVersionUtil;
+ 27
+
28
-
- 29
+ 29
+
30
-
- 31
- 32
+ 31
- 33
+ 32
- 34
+ 33
- 35
+ 34
public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
- 36
+ 35
- 37
+ 36
+ 37
+
38
-
- 39
+ 39
+
40
-
- 41
private static final String ANALYZER_NAME = "File Name Analyzer" ;
- 42
+ 41
- 43
+ 42
- 44
+ 43
- 45 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 44 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 45
+
46
47
-
- 48
-
- 49 1 private static final Set<String> EXTENSIONS = null ;
- 50
-
- 51
-
- 52
-
- 53
-
- 54
-
- 55
-
- 56
- public Set<String> getSupportedExtensions() {
- 57 149 return EXTENSIONS;
- 58
- }
- 59
-
- 60
-
- 61
- 62
+ 48
- 63
+ 49
- 64
+ 50
- 65
+ 51
public String getName() {
- 66 10 return ANALYZER_NAME;
- 67
+ 52 0 return ANALYZER_NAME;
+ 53
}
- 68
+ 54
- 69
+ 55
- 70
-
- 71
+ 56
+
+ 57
- 72
-
- 73
-
- 74
+ 58
+
+ 59
- 75
- public boolean supportsExtension(String extension) {
- 76 10 return true ;
- 77
+ 60
+ public AnalysisPhase getAnalysisPhase() {
+ 61 0 return ANALYSIS_PHASE;
+ 62
}
+ 63
+
+ 64
+
+ 65
+
+ 66
+
+ 67
+
+ 68
+
+ 69
+
+ 70
+
+ 71
+
+ 72
+ @Override
+ 73
+ public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+ 74
+
+ 75
+
+ 76 0 final File f = new File(dependency.getFileName());
+ 77 0 String fileName = f.getName();
78
79
-
- 80
-
- 81
-
- 82
-
- 83
-
- 84
- public AnalysisPhase getAnalysisPhase() {
- 85 7 return ANALYSIS_PHASE;
- 86
- }
- 87
-
- 88
-
- 89
-
- 90
-
- 91
-
- 92
-
- 93
-
- 94
-
- 95
-
- 96
- @Override
- 97
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 98
-
- 99
-
- 100 18 final File f = new File(dependency.getFileName());
- 101 18 String fileName = f.getName();
- 102
-
- 103
- 104 18 final int pos = fileName.lastIndexOf("." );
- 105 18 if (pos > 0) {
- 106 18 fileName = fileName.substring(0, pos);
- 107
+ 80 0 final int pos = fileName.lastIndexOf("." );
+ 81 0 if (pos > 0) {
+ 82 0 fileName = fileName.substring(0, pos);
+ 83
}
- 108
+ 84
- 109
+ 85
- 110 18 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
- 111 18 if (version != null ) {
- 112
+ 86 0 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
+ 87 0 if (version != null ) {
+ 88
- 113
+ 89
- 114
+ 90
- 115 10 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
- 116 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
- 117
+ 91 0 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
+ 92 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+ 93
version.toString(), Confidence.MEDIUM);
- 118
+ 94
} else {
- 119 10 dependency.getVersionEvidence().addEvidence("file" , "name" ,
- 120
+ 95 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+ 96
version.toString(), Confidence.HIGHEST);
- 121
+ 97
}
- 122 10 dependency.getVersionEvidence().addEvidence("file" , "name" ,
- 123
+ 98 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+ 99
fileName, Confidence.MEDIUM);
- 124
+ 100
}
- 125
+ 101
- 126
+ 102
- 127 18 if (fileName.contains("-" )) {
- 128 10 dependency.getProductEvidence().addEvidence("file" , "name" ,
- 129
+ 103 0 if (fileName.contains("-" )) {
+ 104 0 dependency.getProductEvidence().addEvidence("file" , "name" ,
+ 105
fileName, Confidence.HIGHEST);
- 130 10 dependency.getVendorEvidence().addEvidence("file" , "name" ,
- 131
+ 106 0 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+ 107
fileName, Confidence.HIGHEST);
- 132
+ 108
} else {
- 133 8 dependency.getProductEvidence().addEvidence("file" , "name" ,
- 134
+ 109 0 dependency.getProductEvidence().addEvidence("file" , "name" ,
+ 110
fileName, Confidence.HIGH);
- 135 8 dependency.getVendorEvidence().addEvidence("file" , "name" ,
- 136
+ 111 0 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+ 112
fileName, Confidence.HIGH);
- 137
+ 113
}
- 138 18 }
- 139
+ 114 0 }
+ 115
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
new file mode 100644
index 000000000..e20f51fb7
--- /dev/null
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
@@ -0,0 +1,92 @@
+
+
+
+Coverage Report
+Coverage Report - org.owasp.dependencycheck.analyzer.FileTypeAnalyzer
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.analyzer;
+ 19
+
+ 20
+
+ 21
+
+ 22
+
+ 23
+
+ 24
+
+ 25
+ public interface FileTypeAnalyzer extends Analyzer {
+ 26
+
+ 27
+
+ 28
+
+ 29
+
+ 30
+
+ 31
+
+ 32
+
+ 33
+ boolean supportsExtension(String extension);
+ 34
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html
index 0a95c614f..01a322b07 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,15 +56,15 @@
19
20
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
- 21
import java.util.ArrayList;
- 22
+ 21
import java.util.Iterator;
- 23
+ 22
import java.util.Set;
- 24
+ 23
import org.owasp.dependencycheck.Engine;
+ 24
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
25
import org.owasp.dependencycheck.dependency.Confidence;
26
@@ -101,173 +101,134 @@
42
- 43 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
+ 43 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
44
-
+ 45
-
+ 46
-
- 47 1 private static final Set<String> EXTENSIONS = null ;
- 48
-
- 49
-
- 50
-
- 51
-
- 52
-
- 53
-
- 54
- public Set<String> getSupportedExtensions() {
- 55 132 return EXTENSIONS;
- 56
- }
- 57
-
- 58
-
- 59
- 60
+ 47
- 61
+ 48
- 62
+ 49
- 63
+ 50
+ @Override
+ 51
public String getName() {
- 64 9 return ANALYZER_NAME;
- 65
+ 52 0 return ANALYZER_NAME;
+ 53
}
- 66
+ 54
- 67
+ 55
+ 56
+
+ 57
+
+ 58
+
+ 59
+
+ 60
+ @Override
+ 61
+ public AnalysisPhase getAnalysisPhase() {
+ 62 0 return ANALYSIS_PHASE;
+ 63
+ }
+ 64
+
+ 65
+
+ 66
+
+ 67
+
68
-
+ 69
70
-
- 71
-
- 72
-
- 73
- public boolean supportsExtension(String extension) {
- 74 9 return true ;
- 75
- }
- 76
-
- 77
-
- 78
-
- 79
-
- 80
-
- 81
-
- 82
- public AnalysisPhase getAnalysisPhase() {
- 83 6 return ANALYSIS_PHASE;
- 84
- }
- 85
-
- 86
-
- 87
-
- 88
-
- 89
-
- 90
-
- 91
- 92
+ 71
- 93
+ 72
- 94
+ 73
- 95
+ 74
@Override
- 96
+ 75
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 97 15 final Evidence springTest1 = new Evidence("Manifest" ,
- 98
+ 76 0 final Evidence springTest1 = new Evidence("Manifest" ,
+ 77
"Implementation-Title" ,
- 99
+ 78
"Spring Framework" ,
- 100
+ 79
Confidence.HIGH);
- 101
+ 80
- 102 15 final Evidence springTest2 = new Evidence("Manifest" ,
- 103
+ 81 0 final Evidence springTest2 = new Evidence("Manifest" ,
+ 82
"Implementation-Title" ,
- 104
+ 83
"org.springframework.core" ,
- 105
+ 84
Confidence.HIGH);
- 106
+ 85
- 107 15 final Evidence springTest3 = new Evidence("Manifest" ,
- 108
+ 86 0 final Evidence springTest3 = new Evidence("Manifest" ,
+ 87
"Bundle-Vendor" ,
- 109
+ 88
"SpringSource" ,
- 110
+ 89
Confidence.HIGH);
- 111
+ 90
- 112 15 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
- 113 15 if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
- 114 2 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
- 115 2 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "SpringSource" , Confidence.HIGH);
- 116 2 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
- 117
+ 91 0 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
+ 92 0 if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
+ 93 0 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
+ 94 0 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "SpringSource" , Confidence.HIGH);
+ 95 0 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+ 96
}
+ 97
+
+ 98 0 evidence = dependency.getVendorEvidence().getEvidence();
+ 99 0 if (evidence.contains(springTest3)) {
+ 100 0 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
+ 101 0 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+ 102
+ }
+ 103 0 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
+ 104 0 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
+ 105 0 while (itr.hasNext()) {
+ 106 0 final Evidence e = itr.next();
+ 107 0 if ("sun" .equalsIgnoreCase(e.getValue(false ))) {
+ 108 0 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)" , e.getName(), "oracle" , e.getConfidence());
+ 109 0 newEntries.add(newEvidence);
+ 110 0 } else if ("oracle" .equalsIgnoreCase(e.getValue(false ))) {
+ 111 0 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)" , e.getName(), "sun" , e.getConfidence());
+ 112 0 newEntries.add(newEvidence);
+ 113
+ }
+ 114 0 }
+ 115 0 for (Evidence e : newEntries) {
+ 116 0 dependency.getVendorEvidence().addEvidence(e);
+ 117 0 }
118
- 119 15 evidence = dependency.getVendorEvidence().getEvidence();
- 120 15 if (evidence.contains(springTest3)) {
- 121 2 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
- 122 2 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
- 123
- }
- 124 15 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
- 125 15 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
- 126 121 while (itr.hasNext()) {
- 127 106 final Evidence e = itr.next();
- 128 106 if ("sun" .equalsIgnoreCase(e.getValue(false ))) {
- 129 2 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)" , e.getName(), "oracle" , e.getConfidence());
- 130 2 newEntries.add(newEvidence);
- 131 2 } else if ("oracle" .equalsIgnoreCase(e.getValue(false ))) {
- 132 0 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)" , e.getName(), "sun" , e.getConfidence());
- 133 0 newEntries.add(newEvidence);
- 134
- }
- 135 106 }
- 136 15 for (Evidence e : newEntries) {
- 137 2 dependency.getVendorEvidence().addEvidence(e);
- 138 2 }
- 139
-
- 140 15 }
- 141
+ 119 0 }
+ 120
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
index bae3abcce..b465acffe 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
@@ -12,8 +12,8 @@
@@ -181,7 +181,7 @@
81
82
- public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
+ public class JarAnalyzer extends AbstractFileTypeAnalyzer { 83
84
@@ -189,1976 +189,2006 @@
85
86
-
+ 87
- 88
- private static final int BUFFER_SIZE = 4096;
+ 88 0 private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class .getName());
89
90
-
+ 91
- 92 1 private static int dirCount = 0;
+ 92
+ private static final int BUFFER_SIZE = 4096;
93
94
-
+ 95
- 96 1 private static final String NEWLINE = System.getProperty("line.separator" );
+ 96 0 private static int dirCount = 0;
97
98
-
+ 99
- 100 1 private static final Set<String> IGNORE_VALUES = newHashSet(
+ 100 0 private static final String NEWLINE = System.getProperty("line.separator" );
101
- "Sun Java System Application Server" );
+ 102
-
+ 103
-
- 104
- 105 1 private static final Set<String> IGNORE_KEYS = newHashSet(
+ 104 0 private static final Set<String> IGNORE_VALUES = newHashSet(
+ 105
+ "Sun Java System Application Server" );
106
- "built-by" ,
+ 107
- "created-by" ,
+ 108
- "builtby" ,
- 109
- "createdby" ,
+ 109 0 private static final Set<String> IGNORE_KEYS = newHashSet(
110
- "build-jdk" ,
+ "built-by" , 111
- "buildjdk" ,
+ "created-by" , 112
- "ant-version" ,
+ "builtby" , 113
- "antversion" ,
+ "createdby" , 114
- "import-package" ,
+ "build-jdk" , 115
- "export-package" ,
+ "buildjdk" , 116
- "importpackage" ,
+ "ant-version" , 117
- "exportpackage" ,
+ "antversion" , 118
- "sealed" ,
+ "dynamicimportpackage" , 119
- "manifest-version" ,
+ "dynamicimport-package" , 120
- "archiver-version" ,
+ "dynamic-importpackage" , 121
- "manifestversion" ,
+ "dynamic-import-package" , 122
- "archiverversion" ,
+ "import-package" , 123
- "classpath" ,
+ "ignore-package" , 124
- "class-path" ,
+ "export-package" , 125
- "tool" ,
+ "importpackage" , 126
- "bundle-manifestversion" ,
+ "ignorepackage" , 127
- "bundlemanifestversion" ,
+ "exportpackage" , 128
- "include-resource" );
+ "sealed" , 129
-
+ "manifest-version" , 130
-
+ "archiver-version" , 131
-
+ "manifestversion" , 132
- private static final String BUNDLE_VERSION = "Bundle-Version" ;
+ "archiverversion" , 133
-
+ "classpath" , 134
-
+ "class-path" , 135
-
+ "tool" , 136
- private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
+ "bundle-manifestversion" , 137
-
+ "bundlemanifestversion" , 138
-
+ "include-resource" , 139
-
+ "embed-dependency" , 140
- private static final String BUNDLE_NAME = "Bundle-Name" ;
+ "ipojo-components" , 141
-
+ "ipojo-extension" ); 142
-
+ 143
-
+ 144
- private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
+ 145
-
+ private static final String BUNDLE_VERSION = "Bundle-Version" ; 146
-
+ 147
+
+ 148
- 148 1 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
149
-
+ private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ; 150
-
- 151
-
- 152
- private Unmarshaller pomUnmarshaller;
- 153
-
- 154
-
- 155
- 156
-
- 157
+ 151
+
+ 152
- 158 13 public JarAnalyzer() {
+ 153
+ private static final String BUNDLE_NAME = "Bundle-Name" ;
+ 154
+
+ 155
+
+ 156
+
+ 157
+ private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
+ 158
+
159
- try {
- 160 13 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
- 161 13 pomUnmarshaller = jaxbContext.createUnmarshaller();
- 162 0 } catch (JAXBException ex) {
- 163 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details." );
- 164 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 165 13 }
- 166 13 }
+ 160
+
+ 161 0 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
+ 162
+
+ 163
+
+ 164
+
+ 165
+ private Unmarshaller pomUnmarshaller;
+ 166
+
167
-
+ 168
169
-
+ 170
- 171
- private static final String ANALYZER_NAME = "Jar Analyzer" ;
+ 171 0 public JarAnalyzer() {
172
-
- 173
-
- 174
-
- 175 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
- 176
-
- 177
-
- 178
-
- 179 1 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
+ try { 173 0 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
+ 174 0 pomUnmarshaller = jaxbContext.createUnmarshaller();
+ 175 0 } catch (JAXBException ex) {
+ 176 0 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details." );
+ 177 0 LOGGER.log(Level.FINE, null , ex);
+ 178 0 }
+ 179 0 }
180
181
-
+ 182
-
+ 183
-
+ 184
-
- 185
+ 185
+ private static final String ANALYZER_NAME = "Jar Analyzer" ;
186
- public Set<String> getSupportedExtensions() {
- 187 155 return EXTENSIONS;
+ 187
+
188
- }
- 189
-
+ 189 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
190
191
-
+ 192
-
- 193
-
+ 193 0 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
194
-
+ 195
- public String getName() {
- 196 10 return ANALYZER_NAME;
+ 196
+
197
- }
+ 198
-
+ 199
-
+ 200
-
- 201
-
- 202
-
- 203
-
- 204
-
- 205
- public boolean supportsExtension(String extension) {
- 206 151 return EXTENSIONS.contains(extension);
- 207
- }
- 208
-
- 209
-
- 210
-
- 211
-
- 212
-
- 213
-
- 214
- public AnalysisPhase getAnalysisPhase() {
- 215 6 return ANALYSIS_PHASE;
- 216
- }
- 217
-
- 218
-
- 219
-
- 220
-
- 221
-
- 222
-
- 223
-
- 224
-
- 225
-
- 226
-
- 227
@Override
+ 201
+ public Set<String> getSupportedExtensions() {
+ 202 0 return EXTENSIONS;
+ 203
+ }
+ 204
+
+ 205
+
+ 206
+
+ 207
+
+ 208
+
+ 209
+
+ 210
+ @Override
+ 211
+ public String getName() {
+ 212 0 return ANALYZER_NAME;
+ 213
+ }
+ 214
+
+ 215
+
+ 216
+
+ 217
+
+ 218
+
+ 219
+
+ 220
+ public AnalysisPhase getAnalysisPhase() {
+ 221 0 return ANALYSIS_PHASE;
+ 222
+ }
+ 223
+
+ 224
+
+ 225
+
+ 226
+
+ 227
+
228
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+ 229
- try {
- 230 18 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
- 231 18 final String fileName = dependency.getFileName().toLowerCase();
- 232 18 if (classNames.isEmpty()
+ 230
+ @Override
+ 231
+ protected String getAnalyzerEnabledSettingKey() {
+ 232 0 return Settings.KEYS.ANALYZER_JAR_ENABLED;
233
- && (fileName.endsWith("-sources.jar" )
+ } 234
- || fileName.endsWith("-javadoc.jar" )
+ 235
- || fileName.endsWith("-src.jar" )
+ 236
- || fileName.endsWith("-doc.jar" ))) {
- 237 0 engine.getDependencies().remove(dependency);
+ 237
+
238
- }
- 239 18 final boolean hasManifest = parseManifest(dependency, classNames);
- 240 18 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
- 241 18 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
- 242 18 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
- 243 0 } catch (IOException ex) {
- 244 0 throw new AnalysisException("Exception occurred reading the JAR file." , ex);
- 245 18 }
- 246 18 }
- 247
-
- 248
-
+ 239
+
+ 240
+
+ 241
+
+ 242
+
+ 243
+ @Override
+ 244
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ 245
+ try {
+ 246 0 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
+ 247 0 final String fileName = dependency.getFileName().toLowerCase();
+ 248 0 if (classNames.isEmpty()
249
-
+ && (fileName.endsWith("-sources.jar" ) 250
-
+ || fileName.endsWith("-javadoc.jar" ) 251
-
+ || fileName.endsWith("-src.jar" ) 252
-
- 253
-
+ || fileName.endsWith("-doc.jar" ))) { 253 0 engine.getDependencies().remove(dependency);
254
-
- 255
-
- 256
-
- 257
-
- 258
- protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
- 259 18 boolean foundSomething = false ;
- 260
- final JarFile jar;
- 261
- try {
- 262 18 jar = new JarFile(dependency.getActualFilePath());
- 263 0 } catch (IOException ex) {
- 264 0 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
+ } 255 0 final boolean hasManifest = parseManifest(dependency, classNames);
+ 256 0 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
+ 257 0 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
+ 258 0 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
+ 259 0 } catch (IOException ex) {
+ 260 0 throw new AnalysisException("Exception occurred reading the JAR file." , ex);
+ 261 0 }
+ 262 0 }
+ 263
+
+ 264
+
265
-
- 266 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 267 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 268 0 return false ;
- 269 18 }
- 270
- List<String> pomEntries;
- 271
- try {
- 272 18 pomEntries = retrievePomListing(jar);
- 273 0 } catch (IOException ex) {
- 274 0 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
- 275
-
- 276 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 277 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, msg, ex);
- 278 0 return false ;
- 279 18 }
- 280 18 if (pomEntries.isEmpty()) {
- 281 11 return false ;
- 282
- }
- 283 7 for (String path : pomEntries) {
- 284 7 Properties pomProperties = null ;
- 285
- try {
- 286 7 pomProperties = retrievePomProperties(path, jar);
- 287 0 } catch (IOException ex) {
- 288 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
- 289 7 }
- 290 7 Model pom = null ;
- 291
- try {
- 292 7 if (pomEntries.size() > 1) {
- 293
-
- 294 0 final Dependency newDependency = new Dependency();
- 295 0 pom = extractPom(path, jar, newDependency);
- 296
-
- 297 0 final String displayPath = String.format("%s%s%s" ,
- 298
- dependency.getFilePath(),
- 299
- File.separator,
- 300
- path);
- 301 0 final String displayName = String.format("%s%s%s" ,
- 302
- dependency.getFileName(),
- 303
- File.separator,
- 304
- path);
- 305
-
- 306 0 newDependency.setFileName(displayName);
- 307 0 newDependency.setFilePath(displayPath);
- 308 0 addPomEvidence(newDependency, pom, pomProperties);
- 309 0 engine.getDependencies().add(newDependency);
- 310 0 Collections.sort(engine.getDependencies());
- 311 0 } else {
- 312 7 pom = retrievePom(path, jar);
- 313 7 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
- 314
- }
- 315 0 } catch (AnalysisException ex) {
- 316 0 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
- 317 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 318 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, "" , ex);
- 319 7 }
- 320 7 }
- 321 7 return foundSomething;
- 322
- }
- 323
-
- 324
-
- 325
-
- 326
+
+ 266
+
+ 267
- 327
-
- 328
-
- 329
-
- 330
-
- 331
-
- 332
- @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
- 333
- justification = "The reader is closed by closing the zipEntry" )
- 334
- private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
- 335 7 Properties pomProperties = null ;
- 336 7 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
- 337 7 final ZipEntry propEntry = jar.getEntry(propPath);
- 338 7 if (propEntry != null ) {
- 339 0 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
- 340 0 pomProperties = new Properties();
- 341 0 pomProperties.load(reader);
- 342
- }
- 343 7 return pomProperties;
- 344
- }
- 345
-
- 346
-
- 347
-
- 348
-
- 349
-
- 350
-
- 351
-
- 352
-
- 353
- private List<String> retrievePomListing(final JarFile jar) throws IOException {
- 354 18 final List<String> pomEntries = new ArrayList<String>();
- 355 18 final Enumeration<JarEntry> entries = jar.entries();
- 356 7564 while (entries.hasMoreElements()) {
- 357 7546 final JarEntry entry = entries.nextElement();
- 358 7546 final String entryName = (new File(entry.getName())).getName().toLowerCase();
- 359 7546 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
- 360 7 pomEntries.add(entry.getName());
- 361
- }
- 362 7546 }
- 363 18 return pomEntries;
- 364
- }
- 365
-
- 366
-
- 367
-
- 368
-
- 369
-
- 370
-
- 371
+ 268
- 372
-
- 373
-
- 374
-
- 375
+ 269
+
+ 270
+
+ 271
+
+ 272
+
+ 273
- 376
- private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
- 377 0 InputStream input = null ;
- 378 0 FileOutputStream fos = null ;
- 379 0 BufferedOutputStream bos = null ;
- 380 0 final File tmpDir = getNextTempDirectory();
- 381 0 final File file = new File(tmpDir, "pom.xml" );
+ 274
+ protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
+ 275 0 boolean foundSomething = false ;
+ 276
+ final JarFile jar;
+ 277
+ try {
+ 278 0 jar = new JarFile(dependency.getActualFilePath());
+ 279 0 } catch (IOException ex) {
+ 280 0 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
+ 281
+
+ 282 0 LOGGER.log(Level.WARNING, msg);
+ 283 0 LOGGER.log(Level.FINE, "" , ex);
+ 284 0 return false ;
+ 285 0 }
+ 286
+ List<String> pomEntries;
+ 287
+ try {
+ 288 0 pomEntries = retrievePomListing(jar);
+ 289 0 } catch (IOException ex) {
+ 290 0 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
+ 291
+
+ 292 0 LOGGER.log(Level.WARNING, msg);
+ 293 0 LOGGER.log(Level.FINE, msg, ex);
+ 294 0 return false ;
+ 295 0 }
+ 296 0 if (pomEntries.isEmpty()) {
+ 297 0 return false ;
+ 298
+ }
+ 299 0 for (String path : pomEntries) {
+ 300 0 Properties pomProperties = null ;
+ 301
+ try {
+ 302 0 pomProperties = retrievePomProperties(path, jar);
+ 303 0 } catch (IOException ex) {
+ 304 0 LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
+ 305 0 }
+ 306 0 Model pom = null ;
+ 307
+ try {
+ 308 0 if (pomEntries.size() > 1) {
+ 309
+
+ 310 0 final Dependency newDependency = new Dependency();
+ 311 0 pom = extractPom(path, jar, newDependency);
+ 312
+
+ 313 0 final String displayPath = String.format("%s%s%s" ,
+ 314
+ dependency.getFilePath(),
+ 315
+ File.separator,
+ 316
+ path);
+ 317 0 final String displayName = String.format("%s%s%s" ,
+ 318
+ dependency.getFileName(),
+ 319
+ File.separator,
+ 320
+ path);
+ 321
+
+ 322 0 newDependency.setFileName(displayName);
+ 323 0 newDependency.setFilePath(displayPath);
+ 324 0 addPomEvidence(newDependency, pom, pomProperties);
+ 325 0 engine.getDependencies().add(newDependency);
+ 326 0 Collections.sort(engine.getDependencies());
+ 327 0 } else {
+ 328 0 pom = retrievePom(path, jar);
+ 329 0 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
+ 330
+ }
+ 331 0 } catch (AnalysisException ex) {
+ 332 0 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
+ 333 0 LOGGER.log(Level.WARNING, msg);
+ 334 0 LOGGER.log(Level.FINE, "" , ex);
+ 335 0 }
+ 336 0 }
+ 337 0 return foundSomething;
+ 338
+ }
+ 339
+
+ 340
+
+ 341
+
+ 342
+
+ 343
+
+ 344
+
+ 345
+
+ 346
+
+ 347
+
+ 348
+ @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
+ 349
+ justification = "The reader is closed by closing the zipEntry" )
+ 350
+ private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
+ 351 0 Properties pomProperties = null ;
+ 352 0 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
+ 353 0 final ZipEntry propEntry = jar.getEntry(propPath);
+ 354 0 if (propEntry != null ) {
+ 355 0 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
+ 356 0 pomProperties = new Properties();
+ 357 0 pomProperties.load(reader);
+ 358
+ }
+ 359 0 return pomProperties;
+ 360
+ }
+ 361
+
+ 362
+
+ 363
+
+ 364
+
+ 365
+
+ 366
+
+ 367
+
+ 368
+
+ 369
+ private List<String> retrievePomListing(final JarFile jar) throws IOException {
+ 370 0 final List<String> pomEntries = new ArrayList<String>();
+ 371 0 final Enumeration<JarEntry> entries = jar.entries();
+ 372 0 while (entries.hasMoreElements()) {
+ 373 0 final JarEntry entry = entries.nextElement();
+ 374 0 final String entryName = (new File(entry.getName())).getName().toLowerCase();
+ 375 0 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
+ 376 0 pomEntries.add(entry.getName());
+ 377
+ }
+ 378 0 }
+ 379 0 return pomEntries;
+ 380
+ }
+ 381
+
382
- try {
- 383 0 final ZipEntry entry = jar.getEntry(path);
- 384 0 input = jar.getInputStream(entry);
- 385 0 fos = new FileOutputStream(file);
- 386 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
- 387
- int count;
- 388 0 final byte data[] = new byte [BUFFER_SIZE];
- 389 0 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
- 390 0 bos.write(data, 0, count);
- 391
- }
- 392 0 bos.flush();
- 393 0 dependency.setActualFilePath(file.getAbsolutePath());
- 394 0 } catch (IOException ex) {
- 395 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.SEVERE, null , ex);
- 396
- } finally {
- 397 0 closeStream(bos);
- 398 0 closeStream(fos);
- 399 0 closeStream(input);
- 400 0 }
- 401 0 Model model = null ;
- 402 0 FileInputStream fis = null ;
- 403
- try {
- 404 0 fis = new FileInputStream(file);
- 405 0 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
- 406 0 final InputSource xml = new InputSource(reader);
- 407 0 final SAXSource source = new SAXSource(xml);
- 408 0 model = readPom(source);
- 409 0 } catch (FileNotFoundException ex) {
- 410 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
- 411 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 412 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 413 0 throw new AnalysisException(ex);
- 414 0 } catch (UnsupportedEncodingException ex) {
- 415 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
- 416 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 417 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 418 0 throw new AnalysisException(ex);
- 419 0 } catch (AnalysisException ex) {
- 420 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
- 421 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 422 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 423 0 throw ex;
- 424
- } finally {
- 425 0 closeStream(fis);
- 426 0 }
- 427 0 return model;
- 428
- }
- 429
-
- 430
- 431
-
- 432
-
- 433
-
- 434
-
- 435
- private void closeStream(InputStream stream) {
- 436 0 if (stream != null ) {
- 437
- try {
- 438 0 stream.close();
- 439 0 } catch (IOException ex) {
- 440 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 441 0 }
- 442
- }
- 443 0 }
- 444
-
- 445
-
- 446
-
- 447
-
- 448
-
- 449
-
- 450
- private void closeStream(OutputStream stream) {
- 451 0 if (stream != null ) {
- 452
- try {
- 453 0 stream.close();
- 454 0 } catch (IOException ex) {
- 455 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 456 0 }
- 457
- }
- 458 0 }
- 459
-
- 460
-
- 461
+ 383
- 462
+ 384
- 463
+ 385
- 464
+ 386
- 465
-
- 466
-
- 467
-
- 468
-
- 469
- private Model retrievePom(String path, JarFile jar) throws AnalysisException {
- 470 7 final ZipEntry entry = jar.getEntry(path);
- 471 7 Model model = null ;
- 472 7 if (entry != null ) {
- 473
- try {
- 474 7 final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
- 475 7 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
- 476 7 final InputSource xml = new InputSource(reader);
- 477 7 final SAXSource source = new SAXSource(xml);
- 478 7 model = readPom(source);
- 479 0 } catch (SecurityException ex) {
- 480 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
- 481 0 Logger
- 482
- .getLogger(JarAnalyzer.class
- 483
- .getName()).log(Level.WARNING, msg);
- 484 0 Logger.getLogger(JarAnalyzer.class
- 485
- .getName()).log(Level.FINE, null , ex);
- 486 0 throw new AnalysisException(ex);
- 487 0 } catch (IOException ex) {
- 488 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
- 489 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 490 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 491 0 throw new AnalysisException(ex);
- 492 0 } catch (Throwable ex) {
- 493 0 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
- 494 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
- 495 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
- 496 0 throw new AnalysisException(ex);
- 497 7 }
- 498
- }
- 499 7 return model;
- 500
- }
- 501
-
- 502
-
- 503
-
- 504
-
- 505
-
- 506
+ 387
+
+ 388
- 507
+ 389
- 508
+ 390
- 509
+ 391
- 510
- private Model readPom(SAXSource source) throws AnalysisException {
- 511 7 Model model = null ;
- 512
+ 392
+ private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
+ 393 0 InputStream input = null ;
+ 394 0 FileOutputStream fos = null ;
+ 395 0 BufferedOutputStream bos = null ;
+ 396 0 final File tmpDir = getNextTempDirectory();
+ 397 0 final File file = new File(tmpDir, "pom.xml" );
+ 398
try {
- 513 7 final XMLFilter filter = new MavenNamespaceFilter();
- 514 7 final SAXParserFactory spf = SAXParserFactory.newInstance();
- 515 7 final SAXParser sp = spf.newSAXParser();
- 516 7 final XMLReader xr = sp.getXMLReader();
- 517 7 filter.setParent(xr);
- 518 7 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
- 519 7 model = el.getValue();
- 520 0 } catch (SecurityException ex) {
- 521 0 throw new AnalysisException(ex);
- 522 0 } catch (ParserConfigurationException ex) {
- 523 0 throw new AnalysisException(ex);
- 524 0 } catch (SAXException ex) {
- 525 0 throw new AnalysisException(ex);
- 526 0 } catch (JAXBException ex) {
- 527 0 throw new AnalysisException(ex);
- 528 0 } catch (Throwable ex) {
- 529 0 throw new AnalysisException(ex);
- 530 7 }
- 531 7 return model;
- 532
+ 399 0 final ZipEntry entry = jar.getEntry(path);
+ 400 0 input = jar.getInputStream(entry);
+ 401 0 fos = new FileOutputStream(file);
+ 402 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+ 403
+ int count;
+ 404 0 final byte data[] = new byte [BUFFER_SIZE];
+ 405 0 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
+ 406 0 bos.write(data, 0, count);
+ 407
+ }
+ 408 0 bos.flush();
+ 409 0 dependency.setActualFilePath(file.getAbsolutePath());
+ 410 0 } catch (IOException ex) {
+ 411 0 final String msg = String.format("An error occured reading '%s' from '%s'." , path, dependency.getFilePath());
+ 412 0 LOGGER.warning(msg);
+ 413 0 LOGGER.log(Level.SEVERE, "" , ex);
+ 414
+ } finally {
+ 415 0 closeStream(bos);
+ 416 0 closeStream(fos);
+ 417 0 closeStream(input);
+ 418 0 }
+ 419 0 Model model = null ;
+ 420 0 FileInputStream fis = null ;
+ 421
+ try {
+ 422 0 fis = new FileInputStream(file);
+ 423 0 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
+ 424 0 final InputSource xml = new InputSource(reader);
+ 425 0 final SAXSource source = new SAXSource(xml);
+ 426 0 model = readPom(source);
+ 427 0 } catch (FileNotFoundException ex) {
+ 428 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
+ 429 0 LOGGER.log(Level.WARNING, msg);
+ 430 0 LOGGER.log(Level.FINE, "" , ex);
+ 431 0 throw new AnalysisException(ex);
+ 432 0 } catch (UnsupportedEncodingException ex) {
+ 433 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+ 434 0 LOGGER.log(Level.WARNING, msg);
+ 435 0 LOGGER.log(Level.FINE, "" , ex);
+ 436 0 throw new AnalysisException(ex);
+ 437 0 } catch (AnalysisException ex) {
+ 438 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
+ 439 0 LOGGER.log(Level.WARNING, msg);
+ 440 0 LOGGER.log(Level.FINE, "" , ex);
+ 441 0 throw ex;
+ 442
+ } finally {
+ 443 0 closeStream(fis);
+ 444 0 }
+ 445 0 return model;
+ 446
}
- 533
+ 447
- 534
+ 448
- 535
-
- 536
+ 449
+
+ 450
- 537
-
- 538
-
- 539
-
- 540
-
- 541
-
- 542
-
- 543
+ 451
+
+ 452
- 544
- private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
- 545 7 boolean foundSomething = false ;
- 546 7 if (pom == null ) {
- 547 0 return foundSomething;
- 548
+ 453
+ private void closeStream(InputStream stream) {
+ 454 0 if (stream != null ) {
+ 455
+ try {
+ 456 0 stream.close();
+ 457 0 } catch (IOException ex) {
+ 458 0 LOGGER.log(Level.FINEST, null , ex);
+ 459 0 }
+ 460
}
- 549 7 String groupid = interpolateString(pom.getGroupId(), pomProperties);
- 550 7 if (groupid != null && !groupid.isEmpty()) {
- 551 4 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
- 552 3 groupid = groupid.substring(4);
+ 461 0 }
+ 462
+
+ 463
+
+ 464
+
+ 465
+
+ 466
+
+ 467
+
+ 468
+ private void closeStream(OutputStream stream) {
+ 469 0 if (stream != null ) {
+ 470
+ try {
+ 471 0 stream.close();
+ 472 0 } catch (IOException ex) {
+ 473 0 LOGGER.log(Level.FINEST, null , ex);
+ 474 0 }
+ 475
+ }
+ 476 0 }
+ 477
+
+ 478
+
+ 479
+
+ 480
+
+ 481
+
+ 482
+
+ 483
+
+ 484
+
+ 485
+
+ 486
+
+ 487
+ private Model retrievePom(String path, JarFile jar) throws AnalysisException {
+ 488 0 final ZipEntry entry = jar.getEntry(path);
+ 489 0 Model model = null ;
+ 490 0 if (entry != null ) {
+ 491
+ try {
+ 492 0 final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
+ 493 0 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
+ 494 0 final InputSource xml = new InputSource(reader);
+ 495 0 final SAXSource source = new SAXSource(xml);
+ 496 0 model = readPom(source);
+ 497 0 } catch (SecurityException ex) {
+ 498 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
+ 499 0 Logger
+ 500
+ .getLogger(JarAnalyzer.class
+ 501
+ .getName()).log(Level.WARNING, msg);
+ 502 0 Logger.getLogger(JarAnalyzer.class
+ 503
+ .getName()).log(Level.FINE, null , ex);
+ 504 0 throw new AnalysisException(ex);
+ 505 0 } catch (IOException ex) {
+ 506 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+ 507 0 LOGGER.log(Level.WARNING, msg);
+ 508 0 LOGGER.log(Level.FINE, "" , ex);
+ 509 0 throw new AnalysisException(ex);
+ 510 0 } catch (Throwable ex) {
+ 511 0 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
+ 512 0 LOGGER.log(Level.WARNING, msg);
+ 513 0 LOGGER.log(Level.FINE, "" , ex);
+ 514 0 throw new AnalysisException(ex);
+ 515 0 }
+ 516
+ }
+ 517 0 return model;
+ 518
+ }
+ 519
+
+ 520
+
+ 521
+
+ 522
+
+ 523
+
+ 524
+
+ 525
+
+ 526
+
+ 527
+
+ 528
+ private Model readPom(SAXSource source) throws AnalysisException {
+ 529 0 Model model = null ;
+ 530
+ try {
+ 531 0 final XMLFilter filter = new MavenNamespaceFilter();
+ 532 0 final SAXParserFactory spf = SAXParserFactory.newInstance();
+ 533 0 final SAXParser sp = spf.newSAXParser();
+ 534 0 final XMLReader xr = sp.getXMLReader();
+ 535 0 filter.setParent(xr);
+ 536 0 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
+ 537 0 model = el.getValue();
+ 538 0 } catch (SecurityException ex) {
+ 539 0 throw new AnalysisException(ex);
+ 540 0 } catch (ParserConfigurationException ex) {
+ 541 0 throw new AnalysisException(ex);
+ 542 0 } catch (SAXException ex) {
+ 543 0 throw new AnalysisException(ex);
+ 544 0 } catch (JAXBException ex) {
+ 545 0 throw new AnalysisException(ex);
+ 546 0 } catch (Throwable ex) {
+ 547 0 throw new AnalysisException(ex);
+ 548 0 }
+ 549 0 return model;
+ 550
+ }
+ 551
+
+ 552
+
553
- }
- 554 4 foundSomething = true ;
- 555 4 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
- 556 4 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
- 557 4 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
- 558 4 addMatchingValues(classes, groupid, dependency.getProductEvidence());
- 559
- }
- 560 7 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
- 561 7 if (artifactid != null && !artifactid.isEmpty()) {
- 562 7 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
- 563 0 artifactid = artifactid.substring(4);
- 564
- }
- 565 7 foundSomething = true ;
- 566 7 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
- 567 7 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
- 568 7 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
- 569 7 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
- 570
- }
- 571
-
- 572 7 final String version = interpolateString(pom.getVersion(), pomProperties);
- 573 7 if (version != null && !version.isEmpty()) {
- 574 2 foundSomething = true ;
- 575 2 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
- 576
- }
- 577
-
- 578 7 final Organization org = pom.getOrganization();
- 579 7 if (org != null && org.getName() != null ) {
- 580 0 foundSomething = true ;
- 581 0 final String orgName = interpolateString(org.getName(), pomProperties);
- 582 0 if (orgName != null && !orgName.isEmpty()) {
- 583 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
- 584 0 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
- 585
- }
- 586
- }
- 587
-
- 588 7 final String pomName = interpolateString(pom.getName(), pomProperties);
- 589 7 if (pomName != null && !pomName.isEmpty()) {
- 590 7 foundSomething = true ;
- 591 7 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 592 7 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 593 7 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
- 594 7 addMatchingValues(classes, pomName, dependency.getProductEvidence());
- 595
- }
- 596
-
- 597
-
- 598 7 if (pom.getDescription() != null ) {
- 599 3 foundSomething = true ;
- 600 3 final String description = interpolateString(pom.getDescription(), pomProperties);
- 601 3 if (description != null && !description.isEmpty()) {
- 602 3 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
- 603 3 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
- 604 3 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
- 605
- }
- 606
- }
- 607 7 extractLicense(pom, pomProperties, dependency);
- 608 7 return foundSomething;
- 609
- }
- 610
-
- 611
-
- 612
-
- 613
-
- 614
+
+ 554
- 615
-
- 616
-
- 617
-
- 618
+ 555
+
+ 556
+
+ 557
+
+ 558
+
+ 559
+
+ 560
+
+ 561
- 619
- protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
- 620
- Dependency dependency, boolean addPackagesAsEvidence) {
- 621 18 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
- 622 18 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
- 623 18 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
- 624
+ 562
+ private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
+ 563 0 boolean foundSomething = false ;
+ 564 0 if (pom == null ) {
+ 565 0 return foundSomething;
+ 566
+ }
+ 567 0 String groupid = interpolateString(pom.getGroupId(), pomProperties);
+ 568 0 if (groupid != null && !groupid.isEmpty()) {
+ 569 0 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
+ 570 0 groupid = groupid.substring(4);
+ 571
+ }
+ 572 0 foundSomething = true ;
+ 573 0 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
+ 574 0 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+ 575 0 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
+ 576 0 addMatchingValues(classes, groupid, dependency.getProductEvidence());
+ 577
+ }
+ 578 0 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+ 579 0 if (artifactid != null && !artifactid.isEmpty()) {
+ 580 0 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
+ 581 0 artifactid = artifactid.substring(4);
+ 582
+ }
+ 583 0 foundSomething = true ;
+ 584 0 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
+ 585 0 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+ 586 0 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
+ 587 0 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
+ 588
+ }
+ 589
+
+ 590 0 final String version = interpolateString(pom.getVersion(), pomProperties);
+ 591 0 if (version != null && !version.isEmpty()) {
+ 592 0 foundSomething = true ;
+ 593 0 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+ 594
+ }
+ 595
+
+ 596 0 final Organization org = pom.getOrganization();
+ 597 0 if (org != null && org.getName() != null ) {
+ 598 0 foundSomething = true ;
+ 599 0 final String orgName = interpolateString(org.getName(), pomProperties);
+ 600 0 if (orgName != null && !orgName.isEmpty()) {
+ 601 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+ 602 0 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
+ 603
+ }
+ 604
+ }
+ 605
+
+ 606 0 final String pomName = interpolateString(pom.getName(), pomProperties);
+ 607 0 if (pomName != null && !pomName.isEmpty()) {
+ 608 0 foundSomething = true ;
+ 609 0 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+ 610 0 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+ 611 0 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
+ 612 0 addMatchingValues(classes, pomName, dependency.getProductEvidence());
+ 613
+ }
+ 614
- 625 18 final int classCount = classNames.size();
- 626 18 final EvidenceCollection vendor = dependency.getVendorEvidence();
- 627 18 final EvidenceCollection product = dependency.getProductEvidence();
+ 615
+
+ 616 0 if (pom.getDescription() != null ) {
+ 617 0 foundSomething = true ;
+ 618 0 final String description = interpolateString(pom.getDescription(), pomProperties);
+ 619 0 if (description != null && !description.isEmpty()) {
+ 620 0 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
+ 621 0 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
+ 622 0 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
+ 623
+ }
+ 624
+ }
+ 625 0 extractLicense(pom, pomProperties, dependency);
+ 626 0 return foundSomething;
+ 627
+ }
628
- 629 18 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
- 630 182 final float ratio = entry.getValue() / (float ) classCount;
- 631 182 if (ratio > 0.5) {
+ 629
+
+ 630
+
+ 631
+
632
-
- 633 36 vendor.addWeighting(entry.getKey());
- 634 36 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
- 635 22 vendor.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
+ 633
+
+ 634
+
+ 635
+
636
- }
+ 637
- }
- 638 182 }
- 639 18 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
- 640 3772 final float ratio = entry.getValue() / (float ) classCount;
- 641 3772 if (ratio > 0.5) {
- 642 21 product.addWeighting(entry.getKey());
- 643 21 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
- 644 11 product.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
- 645
- }
+ protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames, 638
+ Dependency dependency, boolean addPackagesAsEvidence) {
+ 639 0 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
+ 640 0 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
+ 641 0 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
+ 642
+
+ 643 0 final int classCount = classNames.size();
+ 644 0 final EvidenceCollection vendor = dependency.getVendorEvidence();
+ 645 0 final EvidenceCollection product = dependency.getProductEvidence();
646
- }
- 647 3772 }
- 648 18 }
- 649
+ 647 0 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
+ 648 0 final float ratio = entry.getValue() / (float ) classCount;
+ 649 0 if (ratio > 0.5) {
650
-
- 651
-
- 652
-
- 653
-
+ 651 0 vendor.addWeighting(entry.getKey());
+ 652 0 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+ 653 0 vendor.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
654
-
+ } 655
-
- 656
-
- 657
-
- 658
-
- 659
-
- 660
-
- 661
-
- 662
-
+ } 656 0 }
+ 657 0 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
+ 658 0 final float ratio = entry.getValue() / (float ) classCount;
+ 659 0 if (ratio > 0.5) {
+ 660 0 product.addWeighting(entry.getKey());
+ 661 0 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+ 662 0 product.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
663
-
+ } 664
- protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
- 665 18 boolean foundSomething = false ;
- 666 18 JarFile jar = null ;
+ } 665 0 }
+ 666 0 }
667
- try {
- 668 18 jar = new JarFile(dependency.getActualFilePath());
+ 668
+
669
-
- 670 18 final Manifest manifest = jar.getManifest();
+ 670
+
671
-
- 672 18 if (manifest == null ) {
+ 672
+
673
-
- 674 0 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
+ 674
+
675
- && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
+ 676
- && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
+ 677
- && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
- 678 0 Logger.getLogger(JarAnalyzer.class
+ 678
+
679
- .getName()).log(Level.INFO,
+ 680
- String.format("Jar file '%s' does not contain a manifest." ,
+ 681
- dependency.getFileName()));
+ 682
- }
- 683 0 return false ;
- 684
- }
- 685 18 final Attributes atts = manifest.getMainAttributes();
- 686
+ protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
+ 683 0 boolean foundSomething = false ;
+ 684 0 JarFile jar = null ;
+ 685
+ try {
+ 686 0 jar = new JarFile(dependency.getActualFilePath());
+ 687
- 687 18 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
- 688 18 final EvidenceCollection productEvidence = dependency.getProductEvidence();
- 689 18 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
- 690
+ 688 0 final Manifest manifest = jar.getManifest();
+ 689
- 691 18 final String source = "Manifest" ;
- 692
-
- 693 18 for (Entry<Object, Object> entry : atts.entrySet()) {
- 694 260 String key = entry.getKey().toString();
- 695 260 String value = atts.getValue(key);
- 696 260 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
- 697 0 value = Jsoup.parse(value).text();
+ 690 0 if (manifest == null ) {
+ 691
+
+ 692 0 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
+ 693
+ && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
+ 694
+ && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
+ 695
+ && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
+ 696 0 Logger.getLogger(JarAnalyzer.class
+ 697
+ .getName()).log(Level.INFO,
698
+ String.format("Jar file '%s' does not contain a manifest." ,
+ 699
+ dependency.getFileName()));
+ 700
}
- 699 260 if (IGNORE_VALUES.contains(value)) {
- 700 0 continue ;
- 701 260 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
- 702 9 foundSomething = true ;
- 703 9 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 704 9 addMatchingValues(classInformation, value, productEvidence);
- 705 251 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
- 706 12 foundSomething = true ;
- 707 12 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 708 239 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
- 709 8 foundSomething = true ;
- 710 8 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 711 8 addMatchingValues(classInformation, value, vendorEvidence);
- 712 231 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
- 713 5 foundSomething = true ;
- 714 5 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 715 5 addMatchingValues(classInformation, value, vendorEvidence);
- 716 226 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
- 717 7 foundSomething = true ;
- 718 7 addDescription(dependency, value, "manifest" , key);
- 719
-
- 720 7 addMatchingValues(classInformation, value, productEvidence);
- 721 219 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
- 722 10 foundSomething = true ;
- 723 10 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 724 10 addMatchingValues(classInformation, value, productEvidence);
- 725 209 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
- 726 8 foundSomething = true ;
- 727 8 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 728 8 addMatchingValues(classInformation, value, vendorEvidence);
- 729 201 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
- 730 10 foundSomething = true ;
- 731 10 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 732 191 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
- 733 5 continue ;
- 734
-
- 735
-
- 736
-
+ 701 0 return false ;
+ 702
+ }
+ 703 0 final Attributes atts = manifest.getMainAttributes();
+ 704
+
+ 705 0 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
+ 706 0 final EvidenceCollection productEvidence = dependency.getProductEvidence();
+ 707 0 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
+ 708
+
+ 709 0 final String source = "Manifest" ;
+ 710
+
+ 711 0 for (Entry<Object, Object> entry : atts.entrySet()) {
+ 712 0 String key = entry.getKey().toString();
+ 713 0 String value = atts.getValue(key);
+ 714 0 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
+ 715 0 value = Jsoup.parse(value).text();
+ 716
+ }
+ 717 0 if (IGNORE_VALUES.contains(value)) {
+ 718 0 continue ;
+ 719 0 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
+ 720 0 foundSomething = true ;
+ 721 0 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 722 0 addMatchingValues(classInformation, value, productEvidence);
+ 723 0 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
+ 724 0 foundSomething = true ;
+ 725 0 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 726 0 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
+ 727 0 foundSomething = true ;
+ 728 0 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 729 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 730 0 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
+ 731 0 foundSomething = true ;
+ 732 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 733 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 734 0 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
+ 735 0 foundSomething = true ;
+ 736 0 addDescription(dependency, value, "manifest" , key);
737
-
- 738
-
- 739
-
- 740
-
- 741
-
- 742
- } else {
- 743 186 key = key.toLowerCase();
- 744
-
- 745 186 if (!IGNORE_KEYS.contains(key)
- 746
- && !key.endsWith("jdk" )
- 747
- && !key.contains("lastmodified" )
- 748
- && !key.endsWith("package" )
- 749
- && !key.endsWith("classpath" )
- 750
- && !key.endsWith("class-path" )
- 751
- && !key.endsWith("-scm" )
+ 738 0 addMatchingValues(classInformation, value, productEvidence);
+ 739 0 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
+ 740 0 foundSomething = true ;
+ 741 0 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 742 0 addMatchingValues(classInformation, value, productEvidence);
+ 743 0 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
+ 744 0 foundSomething = true ;
+ 745 0 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 746 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 747 0 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
+ 748 0 foundSomething = true ;
+ 749 0 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 750 0 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
+ 751 0 continue ;
752
- && !key.startsWith("scm-" )
+ 753
- && !isImportPackage(key, value)
+ 754
- && !isPackage(key, value)) {
+ 755
-
- 756 59 foundSomething = true ;
- 757 59 if (key.contains("version" )) {
- 758 10 if (key.contains("specification" )) {
- 759 8 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 756
+
+ 757
+
+ 758
+
+ 759
+
760
- } else {
- 761 2 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ } else { 761 0 key = key.toLowerCase();
762
- }
- 763 49 } else if ("build-id" .equals(key)) {
- 764 0 int pos = value.indexOf('(' );
- 765 0 if (pos >= 0) {
- 766 0 value = value.substring(0, pos - 1);
+ 763 0 if (!IGNORE_KEYS.contains(key)
+ 764
+ && !key.endsWith("jdk" )
+ 765
+ && !key.contains("lastmodified" )
+ 766
+ && !key.endsWith("package" )
767
- }
- 768 0 pos = value.indexOf('[' );
- 769 0 if (pos >= 0) {
- 770 0 value = value.substring(0, pos - 1);
+ && !key.endsWith("classpath" ) 768
+ && !key.endsWith("class-path" )
+ 769
+ && !key.endsWith("-scm" )
+ 770
+ && !key.startsWith("scm-" )
771
- }
- 772 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 773 0 } else if (key.contains("title" )) {
- 774 8 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 775 8 addMatchingValues(classInformation, value, productEvidence);
- 776 41 } else if (key.contains("vendor" )) {
- 777 5 if (key.contains("specification" )) {
- 778 5 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
- 779
+ && !isImportPackage(key, value)
+ 772
+ && !isPackage(key, value)) {
+ 773
+
+ 774 0 foundSomething = true ;
+ 775 0 if (key.contains("version" )) {
+ 776 0 if (key.contains("specification" )) {
+ 777 0 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 778
} else {
- 780 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 781 0 addMatchingValues(classInformation, value, vendorEvidence);
- 782
+ 779 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 780
}
- 783 36 } else if (key.contains("name" )) {
- 784 13 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 785 13 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 786 13 addMatchingValues(classInformation, value, vendorEvidence);
- 787 13 addMatchingValues(classInformation, value, productEvidence);
- 788 23 } else if (key.contains("license" )) {
- 789 6 addLicense(dependency, value);
- 790
- } else {
- 791 17 if (key.contains("description" )) {
- 792 0 addDescription(dependency, value, "manifest" , key);
- 793
+ 781 0 } else if ("build-id" .equals(key)) {
+ 782 0 int pos = value.indexOf('(' );
+ 783 0 if (pos >= 0) {
+ 784 0 value = value.substring(0, pos - 1);
+ 785
+ }
+ 786 0 pos = value.indexOf('[' );
+ 787 0 if (pos >= 0) {
+ 788 0 value = value.substring(0, pos - 1);
+ 789
+ }
+ 790 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 791 0 } else if (key.contains("title" )) {
+ 792 0 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 793 0 addMatchingValues(classInformation, value, productEvidence);
+ 794 0 } else if (key.contains("vendor" )) {
+ 795 0 if (key.contains("specification" )) {
+ 796 0 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 797
} else {
- 794 17 productEvidence.addEvidence(source, key, value, Confidence.LOW);
- 795 17 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
- 796 17 addMatchingValues(classInformation, value, vendorEvidence);
- 797 17 addMatchingValues(classInformation, value, productEvidence);
- 798 17 if (value.matches(".*\\d.*" )) {
- 799 6 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
- 800 30 while (tokenizer.hasMoreElements()) {
- 801 24 final String s = tokenizer.nextToken();
- 802 24 if (s.matches("^[0-9.]+$" )) {
- 803 0 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
- 804
- }
- 805 24 }
- 806
- }
- 807
+ 798 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 799 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 800
}
+ 801 0 } else if (key.contains("name" )) {
+ 802 0 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 803 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 804 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 805 0 addMatchingValues(classInformation, value, productEvidence);
+ 806 0 } else if (key.contains("license" )) {
+ 807 0 addLicense(dependency, value);
808
- }
- 809
- }
- 810
- }
- 811 255 }
- 812
- } finally {
- 813 18 if (jar != null ) {
- 814 18 jar.close();
- 815
- }
- 816
- }
- 817 18 return foundSomething;
- 818
- }
- 819
-
- 820
-
- 821
-
+ } else { 809 0 if (key.contains("description" )) {
+ 810 0 addDescription(dependency, value, "manifest" , key);
+ 811
+ } else {
+ 812 0 productEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 813 0 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 814 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 815 0 addMatchingValues(classInformation, value, productEvidence);
+ 816 0 if (value.matches(".*\\d.*" )) {
+ 817 0 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
+ 818 0 while (tokenizer.hasMoreElements()) {
+ 819 0 final String s = tokenizer.nextToken();
+ 820 0 if (s.matches("^[0-9.]+$" )) {
+ 821 0 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
822
-
- 823
-
+ } 823 0 }
824
-
+ } 825
-
+ } 826
-
+ } 827
-
+ } 828
-
- 829
-
+ } 829 0 }
830
-
- 831
-
- 832
- private String addDescription(Dependency dependency, String description, String source, String key) {
- 833 10 if (dependency.getDescription() == null ) {
- 834 9 dependency.setDescription(description);
- 835
+ } finally {
+ 831 0 if (jar != null ) {
+ 832 0 jar.close();
+ 833
+ }
+ 834
}
+ 835 0 return foundSomething;
836
- String desc;
- 837 10 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
- 838 0 desc = Jsoup.parse(description).text();
- 839
- } else {
- 840 10 desc = description;
- 841
- }
- 842 10 dependency.setDescription(desc);
- 843 10 if (desc.length() > 100) {
- 844 2 desc = desc.replaceAll("\\s\\s+" , " " );
- 845 2 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
- 846 2 final int posLike = desc.toLowerCase().indexOf("like " , 100);
- 847 2 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
- 848 2 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
- 849 2 int pos = -1;
- 850 2 pos = Math.max(pos, posSuchAs);
- 851 2 if (pos >= 0 && posLike >= 0) {
- 852 0 pos = Math.min(pos, posLike);
- 853
- } else {
- 854 2 pos = Math.max(pos, posLike);
- 855
- }
- 856 2 if (pos >= 0 && posWillUse >= 0) {
- 857 0 pos = Math.min(pos, posWillUse);
- 858
- } else {
- 859 2 pos = Math.max(pos, posWillUse);
- 860
- }
- 861 2 if (pos >= 0 && posUses >= 0) {
- 862 0 pos = Math.min(pos, posUses);
- 863
- } else {
- 864 2 pos = Math.max(pos, posUses);
- 865
- }
- 866
-
- 867 2 if (pos > 0) {
- 868 2 final StringBuilder sb = new StringBuilder(pos + 3);
- 869 2 sb.append(desc.substring(0, pos));
- 870 2 sb.append("..." );
- 871 2 desc = sb.toString();
- 872
- }
- 873 2 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
- 874 2 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
- 875 2 } else {
- 876 8 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
- 877 8 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
- 878
- }
- 879 10 return desc;
- 880
}
- 881
+ 837
- 882
+ 838
- 883
-
- 884
+ 839
+
+ 840
+
+ 841
+
+ 842
- 885
-
- 886
-
- 887
+ 843
+
+ 844
+
+ 845
+
+ 846
+
+ 847
+
+ 848
+
+ 849
- 888
- private void addLicense(Dependency d, String license) {
- 889 6 if (d.getLicense() == null ) {
- 890 6 d.setLicense(license);
- 891 0 } else if (!d.getLicense().contains(license)) {
- 892 0 d.setLicense(d.getLicense() + NEWLINE + license);
- 893
+ 850
+ private String addDescription(Dependency dependency, String description, String source, String key) {
+ 851 0 if (dependency.getDescription() == null ) {
+ 852 0 dependency.setDescription(description);
+ 853
}
- 894 6 }
- 895
+ 854
+ String desc;
+ 855 0 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
+ 856 0 desc = Jsoup.parse(description).text();
+ 857
+ } else {
+ 858 0 desc = description;
+ 859
+ }
+ 860 0 dependency.setDescription(desc);
+ 861 0 if (desc.length() > 100) {
+ 862 0 desc = desc.replaceAll("\\s\\s+" , " " );
+ 863 0 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
+ 864 0 final int posLike = desc.toLowerCase().indexOf("like " , 100);
+ 865 0 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
+ 866 0 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
+ 867 0 int pos = -1;
+ 868 0 pos = Math.max(pos, posSuchAs);
+ 869 0 if (pos >= 0 && posLike >= 0) {
+ 870 0 pos = Math.min(pos, posLike);
+ 871
+ } else {
+ 872 0 pos = Math.max(pos, posLike);
+ 873
+ }
+ 874 0 if (pos >= 0 && posWillUse >= 0) {
+ 875 0 pos = Math.min(pos, posWillUse);
+ 876
+ } else {
+ 877 0 pos = Math.max(pos, posWillUse);
+ 878
+ }
+ 879 0 if (pos >= 0 && posUses >= 0) {
+ 880 0 pos = Math.min(pos, posUses);
+ 881
+ } else {
+ 882 0 pos = Math.max(pos, posUses);
+ 883
+ }
+ 884
+ 885 0 if (pos > 0) {
+ 886 0 final StringBuilder sb = new StringBuilder(pos + 3);
+ 887 0 sb.append(desc.substring(0, pos));
+ 888 0 sb.append("..." );
+ 889 0 desc = sb.toString();
+ 890
+ }
+ 891 0 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
+ 892 0 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
+ 893 0 } else {
+ 894 0 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
+ 895 0 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
896
-
- 897
-
+ } 897 0 return desc;
898
-
- 899 13 private File tempFileLocation = null ;
- 900
+ }
+ 899
- 901
+ 900
+ 901
+
902
-
- 903
+ 903
+
904
-
+ 905
906
- @Override
- 907
- public void initialize() throws Exception {
- 908 3 final File baseDir = Settings.getTempDirectory();
- 909 3 if (!baseDir.exists()) {
- 910 0 if (!baseDir.mkdirs()) {
- 911 0 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
- 912 0 throw new AnalysisException(msg);
+ private void addLicense(Dependency d, String license) { 907 0 if (d.getLicense() == null ) {
+ 908 0 d.setLicense(license);
+ 909 0 } else if (!d.getLicense().contains(license)) {
+ 910 0 d.setLicense(d.getLicense() + NEWLINE + license);
+ 911
+ }
+ 912 0 }
913
- }
+ 914
- }
- 915 3 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
- 916 3 if (!tempFileLocation.delete()) {
- 917 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
- 918 0 throw new AnalysisException(msg);
+ 915
+
+ 916
+
+ 917 0 private File tempFileLocation = null ;
+ 918
+
919
- }
- 920 3 if (!tempFileLocation.mkdirs()) {
- 921 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
- 922 0 throw new AnalysisException(msg);
- 923
- }
- 924 3 }
- 925
-
- 926
- 927
-
- 928
-
- 929
- @Override
- 930
- public void close() {
- 931 3 if (tempFileLocation != null && tempFileLocation.exists()) {
- 932 3 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, "Attempting to delete temporary files" );
- 933 3 final boolean success = FileUtils.delete(tempFileLocation);
- 934 3 if (!success) {
- 935 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING,
- 936
- "Failed to delete some temporary files, see the log for more details" );
- 937
- }
- 938
- }
- 939 3 }
- 940
-
- 941
-
- 942
-
- 943
-
- 944
-
- 945
-
- 946
-
- 947
-
- 948
-
- 949
-
- 950
-
- 951
-
- 952
-
- 953
-
- 954
-
- 955
-
- 956
-
- 957
-
- 958
-
- 959
-
- 960
-
- 961
-
- 962
-
- 963
+ 920
+
+ 921
- 964
-
- 965
-
- 966
-
- 967
+ 922
+
+ 923
+ 924
+ @Override
+ 925
+ public void initializeFileTypeAnalyzer() throws Exception {
+ 926 0 final File baseDir = Settings.getTempDirectory();
+ 927 0 if (!baseDir.exists()) {
+ 928 0 if (!baseDir.mkdirs()) {
+ 929 0 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
+ 930 0 throw new AnalysisException(msg);
+ 931
+ }
+ 932
+ }
+ 933 0 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+ 934 0 if (!tempFileLocation.delete()) {
+ 935 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
+ 936 0 throw new AnalysisException(msg);
+ 937
+ }
+ 938 0 if (!tempFileLocation.mkdirs()) {
+ 939 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
+ 940 0 throw new AnalysisException(msg);
+ 941
+ }
+ 942 0 }
+ 943
+
+ 944
+
+ 945
+
+ 946
+
+ 947
+ @Override
+ 948
+ public void close() {
+ 949 0 if (tempFileLocation != null && tempFileLocation.exists()) {
+ 950 0 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+ 951 0 final boolean success = FileUtils.delete(tempFileLocation);
+ 952 0 if (!success) {
+ 953 0 LOGGER.log(Level.WARNING,
+ 954
+ "Failed to delete some temporary files, see the log for more details" );
+ 955
+ }
+ 956
+ }
+ 957 0 }
+ 958
+
+ 959
+
+ 960
+
+ 961
+
+ 962
+
+ 963
+
+ 964
+
+ 965
+
+ 966
+
+ 967
+
968
- protected String interpolateString(String text, Properties properties) {
- 969 40 Properties props = properties;
- 970 40 if (text == null ) {
- 971 8 return text;
+ 969
+
+ 970
+
+ 971
+
972
- }
- 973 32 if (props == null ) {
- 974 25 props = new Properties();
+ 973
+
+ 974
+
975
- }
+ 976
-
- 977 32 final int pos = text.indexOf("${" );
- 978 32 if (pos < 0) {
- 979 29 return text;
+ 977
+
+ 978
+
+ 979
+
980
- }
- 981 3 final int end = text.indexOf("}" );
- 982 3 if (end < pos) {
- 983 0 return text;
+ 981
+
+ 982
+
+ 983
+
984
- }
+ 985
-
- 986 3 final String propName = text.substring(pos + 2, end);
- 987 3 String propValue = interpolateString(props.getProperty(propName), props);
- 988 3 if (propValue == null ) {
- 989 0 propValue = "" ;
+ 986
+ protected String interpolateString(String text, Properties properties) {
+ 987 0 Properties props = properties;
+ 988 0 if (text == null ) {
+ 989 0 return text;
990
}
- 991 3 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
- 992 3 sb.append(text.subSequence(0, pos));
- 993 3 sb.append(propValue);
- 994 3 sb.append(text.substring(end + 1));
- 995 3 return interpolateString(sb.toString(), props);
- 996
- }
- 997
+ 991 0 if (props == null ) {
+ 992 0 props = new Properties();
+ 993
+ }
+ 994
+ 995 0 final int pos = text.indexOf("${" );
+ 996 0 if (pos < 0) {
+ 997 0 return text;
998
-
- 999
-
- 1000
-
- 1001
-
+ } 999 0 final int end = text.indexOf("}" );
+ 1000 0 if (end < pos) {
+ 1001 0 return text;
1002
-
+ } 1003
-
- 1004
-
- 1005
- private boolean isImportPackage(String key, String value) {
- 1006 61 final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$" );
- 1007 61 if (packageRx.matcher(value).matches()) {
- 1008 0 return (key.contains("import" ) || key.contains("include" ));
- 1009
- }
- 1010 61 return false ;
- 1011
- }
- 1012
- 1013
-
+ 1004 0 final String propName = text.substring(pos + 2, end);
+ 1005 0 String propValue = interpolateString(props.getProperty(propName), props);
+ 1006 0 if (propValue == null ) {
+ 1007 0 propValue = "" ;
+ 1008
+ }
+ 1009 0 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
+ 1010 0 sb.append(text.subSequence(0, pos));
+ 1011 0 sb.append(propValue);
+ 1012 0 sb.append(text.substring(end + 1));
+ 1013 0 return interpolateString(sb.toString(), props);
1014
-
- 1015
-
- 1016
-
- 1017
-
- 1018
-
- 1019
-
- 1020
- private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
- 1021 18 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
- 1022 18 JarFile jar = null ;
- 1023
- try {
- 1024 18 jar = new JarFile(dependency.getActualFilePath());
- 1025 18 final Enumeration entries = jar.entries();
- 1026 7564 while (entries.hasMoreElements()) {
- 1027 7546 final JarEntry entry = (JarEntry) entries.nextElement();
- 1028 7546 final String name = entry.getName().toLowerCase();
- 1029
-
- 1030 7546 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
- 1031 6375 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
- 1032 6375 classNames.add(className);
- 1033
- }
- 1034 7546 }
- 1035 0 } catch (IOException ex) {
- 1036 0 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
- 1037 0 Logger
- 1038
- .getLogger(JarAnalyzer.class
- 1039
- .getName()).log(Level.WARNING, msg);
- 1040 0 Logger.getLogger(JarAnalyzer.class
- 1041
- .getName()).log(Level.FINE, null , ex);
- 1042
- } finally {
- 1043 18 if (jar != null ) {
- 1044
- try {
- 1045 18 jar.close();
- 1046 0 } catch (IOException ex) {
- 1047 0 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 1048 18 }
- 1049
- }
- 1050
- }
- 1051 18 return classNames;
- 1052
}
- 1053
+ 1015
+ 1016
+
+ 1017
+
+ 1018
+
+ 1019
+
+ 1020
+
+ 1021
+
+ 1022
+
+ 1023
+ private boolean isImportPackage(String key, String value) {
+ 1024 0 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$" );
+ 1025 0 final boolean matches = packageRx.matcher(value).matches();
+ 1026 0 return matches && (key.contains("import" ) || key.contains("include" ) || value.length() > 10);
+ 1027
+ }
+ 1028
+
+ 1029
+
+ 1030
+
+ 1031
+
+ 1032
+
+ 1033
+
+ 1034
+
+ 1035
+
+ 1036
+ private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
+ 1037 0 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
+ 1038 0 JarFile jar = null ;
+ 1039
+ try {
+ 1040 0 jar = new JarFile(dependency.getActualFilePath());
+ 1041 0 final Enumeration entries = jar.entries();
+ 1042 0 while (entries.hasMoreElements()) {
+ 1043 0 final JarEntry entry = (JarEntry) entries.nextElement();
+ 1044 0 final String name = entry.getName().toLowerCase();
+ 1045
+
+ 1046 0 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
+ 1047 0 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
+ 1048 0 classNames.add(className);
+ 1049
+ }
+ 1050 0 }
+ 1051 0 } catch (IOException ex) {
+ 1052 0 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
+ 1053 0 Logger
1054
-
+ .getLogger(JarAnalyzer.class 1055
-
- 1056
-
+ .getName()).log(Level.WARNING, msg); 1056 0 Logger.getLogger(JarAnalyzer.class
1057
-
+ .getName()).log(Level.FINE, null , ex); 1058
-
- 1059
-
+ } finally { 1059 0 if (jar != null ) {
1060
-
- 1061
-
- 1062
- private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
- 1063
- HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
- 1064 18 for (ClassNameInformation entry : classNames) {
- 1065 6375 final ArrayList<String> list = entry.getPackageStructure();
- 1066 6375 addEntry(vendor, list.get(0));
- 1067
-
- 1068 6375 if (list.size() == 2) {
- 1069 0 addEntry(product, list.get(1));
- 1070
+ try {
+ 1061 0 jar.close();
+ 1062 0 } catch (IOException ex) {
+ 1063 0 LOGGER.log(Level.FINEST, null , ex);
+ 1064 0 }
+ 1065
}
- 1071 6375 if (list.size() == 3) {
- 1072 1991 addEntry(vendor, list.get(1));
- 1073 1991 addEntry(product, list.get(1));
- 1074 1991 addEntry(product, list.get(2));
- 1075
- }
- 1076 6375 if (list.size() >= 4) {
- 1077 4384 addEntry(vendor, list.get(1));
- 1078 4384 addEntry(vendor, list.get(2));
- 1079 4384 addEntry(product, list.get(1));
- 1080 4384 addEntry(product, list.get(2));
- 1081 4384 addEntry(product, list.get(3));
- 1082
- }
- 1083 6375 }
- 1084 18 }
- 1085
-
- 1086
-
- 1087
-
- 1088
-
- 1089
-
- 1090
-
- 1091
-
- 1092
-
- 1093
- private void addEntry(HashMap<String, Integer> collection, String key) {
- 1094 34268 if (collection.containsKey(key)) {
- 1095 30314 collection.put(key, collection.get(key) + 1);
- 1096
- } else {
- 1097 3954 collection.put(key, 1);
- 1098
+ 1066
}
- 1099 34268 }
- 1100
+ 1067 0 return classNames;
+ 1068
+ }
+ 1069
- 1101
+ 1070
+ 1071
+
+ 1072
+
+ 1073
+
+ 1074
+
+ 1075
+
+ 1076
+
+ 1077
+
+ 1078
+ private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
+ 1079
+ HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
+ 1080 0 for (ClassNameInformation entry : classNames) {
+ 1081 0 final ArrayList<String> list = entry.getPackageStructure();
+ 1082 0 addEntry(vendor, list.get(0));
+ 1083
+
+ 1084 0 if (list.size() == 2) {
+ 1085 0 addEntry(product, list.get(1));
+ 1086
+ }
+ 1087 0 if (list.size() == 3) {
+ 1088 0 addEntry(vendor, list.get(1));
+ 1089 0 addEntry(product, list.get(1));
+ 1090 0 addEntry(product, list.get(2));
+ 1091
+ }
+ 1092 0 if (list.size() >= 4) {
+ 1093 0 addEntry(vendor, list.get(1));
+ 1094 0 addEntry(vendor, list.get(2));
+ 1095 0 addEntry(product, list.get(1));
+ 1096 0 addEntry(product, list.get(2));
+ 1097 0 addEntry(product, list.get(3));
+ 1098
+ }
+ 1099 0 }
+ 1100 0 }
+ 1101
+
1102
-
+ 1103
-
+ 1104
-
+ 1105
1106
-
+ 1107
-
+ 1108
-
+ 1109
-
- 1110
- private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
- 1111 157 if (value == null || value.isEmpty()) {
- 1112 0 return ;
- 1113
+ private void addEntry(HashMap<String, Integer> collection, String key) {
+ 1110 0 if (collection.containsKey(key)) {
+ 1111 0 collection.put(key, collection.get(key) + 1);
+ 1112
+ } else {
+ 1113 0 collection.put(key, 1);
+ 1114
}
- 1114 157 final String text = value.toLowerCase();
- 1115 157 for (ClassNameInformation cni : classes) {
- 1116 63174 for (String key : cni.getPackageStructure()) {
- 1117 231862 if (text.contains(key)) {
- 1118 70531 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
+ 1115 0 }
+ 1116
+
+ 1117
+
+ 1118
+
1119
- }
- 1120 231862 }
- 1121 63174 }
- 1122 157 }
+ 1120
+
+ 1121
+
+ 1122
+
1123
-
+ 1124
-
+ 1125
-
+ 1126
-
- 1127
-
- 1128
-
+ private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) { 1127 0 if (value == null || value.isEmpty()) {
+ 1128 0 return ;
1129
-
- 1130
-
- 1131
- private boolean isPackage(String key, String value) {
- 1132
-
- 1133 61 return !key.matches(".*(version|title|vendor|name|license|description).*" )
- 1134
- && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
+ } 1130 0 final String text = value.toLowerCase();
+ 1131 0 for (ClassNameInformation cni : classes) {
+ 1132 0 for (String key : cni.getPackageStructure()) {
+ 1133 0 if (text.contains(key)) {
+ 1134 0 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
1135
-
- 1136
- }
- 1137
-
- 1138
-
+ } 1136 0 }
+ 1137 0 }
+ 1138 0 }
1139
-
+ 1140
-
+ 1141
-
+ 1142
-
+ 1143
-
+ 1144
-
+ 1145
-
+ 1146
- private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) {
- 1147 0 if (pom == null ) {
- 1148 0 return ;
- 1149
- }
- 1150 0 String groupid = interpolateString(pom.getGroupId(), pomProperties);
- 1151 0 if (groupid != null && !groupid.isEmpty()) {
- 1152 0 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
- 1153 0 groupid = groupid.substring(4);
+ 1147
+ private boolean isPackage(String key, String value) {
+ 1148
+
+ 1149 0 return !key.matches(".*(version|title|vendor|name|license|description).*" )
+ 1150
+ && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
+ 1151
+
+ 1152
+ }
+ 1153
+
1154
- }
- 1155 0 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
- 1156 0 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+ 1155
+
+ 1156
+
1157
- }
- 1158 0 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
- 1159 0 if (artifactid != null && !artifactid.isEmpty()) {
- 1160 0 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
- 1161 0 artifactid = artifactid.substring(4);
+ 1158
+
+ 1159
+
+ 1160
+
+ 1161
+
1162
- }
- 1163 0 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
- 1164 0 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+ private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) { 1163 0 if (pom == null ) {
+ 1164 0 return ;
1165
}
- 1166 0 final String version = interpolateString(pom.getVersion(), pomProperties);
- 1167 0 if (version != null && !version.isEmpty()) {
- 1168 0 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
- 1169
- }
+ 1166 0 String groupid = interpolateString(pom.getGroupId(), pomProperties);
+ 1167 0 if (groupid != null && !groupid.isEmpty()) {
+ 1168 0 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
+ 1169 0 groupid = groupid.substring(4);
1170
-
- 1171 0 final Parent parent = pom.getParent();
- 1172 0 if (parent != null ) {
- 1173 0 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
- 1174 0 if (parentGroupId != null && !parentGroupId.isEmpty()) {
- 1175 0 if (groupid == null || groupid.isEmpty()) {
- 1176 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.HIGH);
- 1177
- } else {
- 1178 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.MEDIUM);
- 1179
- }
- 1180 0 dependency.getProductEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.LOW);
- 1181
}
- 1182 0 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
- 1183 0 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
- 1184 0 if (artifactid == null || artifactid.isEmpty()) {
- 1185 0 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.HIGH);
- 1186
- } else {
- 1187 0 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.MEDIUM);
- 1188
- }
- 1189 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.LOW);
- 1190
- }
- 1191 0 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
- 1192 0 if (parentVersion != null && !parentVersion.isEmpty()) {
- 1193 0 if (version == null || version.isEmpty()) {
- 1194 0 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.HIGH);
- 1195
- } else {
- 1196 0 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.LOW);
- 1197
- }
- 1198
- }
- 1199
+ 1171 0 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
+ 1172 0 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+ 1173
}
- 1200
-
- 1201 0 final Organization org = pom.getOrganization();
- 1202 0 if (org != null && org.getName() != null ) {
- 1203 0 final String orgName = interpolateString(org.getName(), pomProperties);
- 1204 0 if (orgName != null && !orgName.isEmpty()) {
- 1205 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+ 1174 0 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+ 1175 0 if (artifactid != null && !artifactid.isEmpty()) {
+ 1176 0 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
+ 1177 0 artifactid = artifactid.substring(4);
+ 1178
+ }
+ 1179 0 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
+ 1180 0 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+ 1181
+ }
+ 1182 0 final String version = interpolateString(pom.getVersion(), pomProperties);
+ 1183 0 if (version != null && !version.isEmpty()) {
+ 1184 0 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+ 1185
+ }
+ 1186
+
+ 1187 0 final Parent parent = pom.getParent();
+ 1188 0 if (parent != null ) {
+ 1189 0 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
+ 1190 0 if (parentGroupId != null && !parentGroupId.isEmpty()) {
+ 1191 0 if (groupid == null || groupid.isEmpty()) {
+ 1192 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.HIGH);
+ 1193
+ } else {
+ 1194 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.MEDIUM);
+ 1195
+ }
+ 1196 0 dependency.getProductEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.LOW);
+ 1197
+ }
+ 1198 0 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
+ 1199 0 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
+ 1200 0 if (artifactid == null || artifactid.isEmpty()) {
+ 1201 0 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.HIGH);
+ 1202
+ } else {
+ 1203 0 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.MEDIUM);
+ 1204
+ }
+ 1205 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.LOW);
1206
}
- 1207
- }
- 1208
-
- 1209 0 final String pomName = interpolateString(pom.getName(), pomProperties);
- 1210 0 if (pomName != null && !pomName.isEmpty()) {
- 1211 0 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 1212 0 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 1213
- }
- 1214
-
- 1215
-
- 1216 0 if (pom.getDescription() != null ) {
- 1217 0 final String description = interpolateString(pom.getDescription(), pomProperties);
- 1218 0 if (description != null && !description.isEmpty()) {
- 1219 0 addDescription(dependency, description, "pom" , "description" );
- 1220
- }
- 1221
- }
- 1222 0 extractLicense(pom, pomProperties, dependency);
- 1223 0 }
- 1224
-
- 1225
-
- 1226
-
- 1227
-
- 1228
-
- 1229
-
- 1230
-
- 1231
-
- 1232
- private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
- 1233
-
- 1234 7 if (pom.getLicenses() != null ) {
- 1235 1 String license = null ;
- 1236 1 for (License lic : pom.getLicenses().getLicense()) {
- 1237 1 String tmp = null ;
- 1238 1 if (lic.getName() != null ) {
- 1239 1 tmp = interpolateString(lic.getName(), pomProperties);
- 1240
- }
- 1241 1 if (lic.getUrl() != null ) {
- 1242 1 if (tmp == null ) {
- 1243 0 tmp = interpolateString(lic.getUrl(), pomProperties);
- 1244
- } else {
- 1245 1 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
- 1246
- }
- 1247
- }
- 1248 1 if (tmp == null ) {
- 1249 0 continue ;
- 1250
- }
- 1251 1 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
- 1252 0 tmp = Jsoup.parse(tmp).text();
- 1253
- }
- 1254 1 if (license == null ) {
- 1255 1 license = tmp;
- 1256
+ 1207 0 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
+ 1208 0 if (parentVersion != null && !parentVersion.isEmpty()) {
+ 1209 0 if (version == null || version.isEmpty()) {
+ 1210 0 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.HIGH);
+ 1211
} else {
- 1257 0 license += "\n" + tmp;
- 1258
+ 1212 0 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.LOW);
+ 1213
}
- 1259 1 }
- 1260 1 if (license != null ) {
- 1261 1 dependency.setLicense(license);
- 1262
+ 1214
}
- 1263
+ 1215
}
- 1264 7 }
- 1265
+ 1216
+
+ 1217 0 final Organization org = pom.getOrganization();
+ 1218 0 if (org != null && org.getName() != null ) {
+ 1219 0 final String orgName = interpolateString(org.getName(), pomProperties);
+ 1220 0 if (orgName != null && !orgName.isEmpty()) {
+ 1221 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+ 1222
+ }
+ 1223
+ }
+ 1224
+
+ 1225 0 final String pomName = interpolateString(pom.getName(), pomProperties);
+ 1226 0 if (pomName != null && !pomName.isEmpty()) {
+ 1227 0 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+ 1228 0 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+ 1229
+ }
+ 1230
- 1266
+ 1231
+
+ 1232 0 if (pom.getDescription() != null ) {
+ 1233 0 final String description = interpolateString(pom.getDescription(), pomProperties);
+ 1234 0 if (description != null && !description.isEmpty()) {
+ 1235 0 addDescription(dependency, description, "pom" , "description" );
+ 1236
+ }
+ 1237
+ }
+ 1238 0 extractLicense(pom, pomProperties, dependency);
+ 1239 0 }
+ 1240
+
+ 1241
- 1267
-
- 1268
+ 1242
+
+ 1243
+
+ 1244
+
+ 1245
+
+ 1246
+
+ 1247
+ 1248
+ private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
+ 1249
+
+ 1250 0 if (pom.getLicenses() != null ) {
+ 1251 0 String license = null ;
+ 1252 0 for (License lic : pom.getLicenses().getLicense()) {
+ 1253 0 String tmp = null ;
+ 1254 0 if (lic.getName() != null ) {
+ 1255 0 tmp = interpolateString(lic.getName(), pomProperties);
+ 1256
+ }
+ 1257 0 if (lic.getUrl() != null ) {
+ 1258 0 if (tmp == null ) {
+ 1259 0 tmp = interpolateString(lic.getUrl(), pomProperties);
+ 1260
+ } else {
+ 1261 0 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
+ 1262
+ }
+ 1263
+ }
+ 1264 0 if (tmp == null ) {
+ 1265 0 continue ;
+ 1266
+ }
+ 1267 0 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
+ 1268 0 tmp = Jsoup.parse(tmp).text();
1269
- protected static class ClassNameInformation {
- 1270
-
- 1271
-
+ } 1270 0 if (license == null ) {
+ 1271 0 license = tmp;
1272
-
- 1273
-
+ } else { 1273 0 license += "\n" + tmp;
1274
-
- 1275
-
- 1276
-
- 1277
-
+ } 1275 0 }
+ 1276 0 if (license != null ) {
+ 1277 0 dependency.setLicense(license);
1278
-
- 1279
-
- 1280
-
- 1281
-
- 1282
-
- 1283
-
- 1284
-
- 1285
-
- 1286
-
- 1287
-
- 1288
-
- 1289
-
- 1290
-
- 1291 6375 ClassNameInformation(String className) {
- 1292 6375 name = className;
- 1293 6375 if (name.contains("/" )) {
- 1294 6375 final String[] tmp = className.toLowerCase().split("/" );
- 1295 6375 int start = 0;
- 1296 6375 int end = 3;
- 1297 6375 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
- 1298 5948 start = 1;
- 1299 5948 end = 4;
- 1300
- }
- 1301 6375 if (tmp.length <= end) {
- 1302 1991 end = tmp.length - 1;
- 1303
- }
- 1304 29884 for (int i = start; i <= end; i++) {
- 1305 23509 packageStructure.add(tmp[i]);
- 1306
- }
- 1307 6375 } else {
- 1308 0 packageStructure.add(name);
- 1309
}
- 1310 6375 }
- 1311
-
- 1312
-
- 1313
-
- 1314
- private String name;
- 1315
-
- 1316
-
- 1317
-
- 1318
-
- 1319
-
- 1320
-
- 1321
- public String getName() {
- 1322
- return name;
- 1323
+ 1279
}
- 1324
+ 1280 0 }
+ 1281
- 1325
+ 1282
+
+ 1283
+
+ 1284
+
+ 1285
+ protected static class ClassNameInformation {
+ 1286
+
+ 1287
- 1326
-
- 1327
+ 1288
+
+ 1289
+
+ 1290
+
+ 1291
+
+ 1292
+
+ 1293
+
+ 1294
+
+ 1295
+
+ 1296
+
+ 1297
+
+ 1298
+
+ 1299
+
+ 1300
+
+ 1301
+
+ 1302
+
+ 1303
+
+ 1304
+ 1305
+
+ 1306
+
+ 1307 0 ClassNameInformation(String className) {
+ 1308 0 name = className;
+ 1309 0 if (name.contains("/" )) {
+ 1310 0 final String[] tmp = className.toLowerCase().split("/" );
+ 1311 0 int start = 0;
+ 1312 0 int end = 3;
+ 1313 0 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
+ 1314 0 start = 1;
+ 1315 0 end = 4;
+ 1316
+ }
+ 1317 0 if (tmp.length <= end) {
+ 1318 0 end = tmp.length - 1;
+ 1319
+ }
+ 1320 0 for (int i = start; i <= end; i++) {
+ 1321 0 packageStructure.add(tmp[i]);
+ 1322
+ }
+ 1323 0 } else {
+ 1324 0 packageStructure.add(name);
+ 1325
+ }
+ 1326 0 }
+ 1327
+
1328
-
+ 1329
1330
- public void setName(String name) {
+ private String name; 1331
- this .name = name;
+ 1332
- }
+ 1333
-
+ 1334
-
- 1335
-
- 1336 6375 private final ArrayList<String> packageStructure = new ArrayList<String>();
- 1337
-
- 1338
-
- 1339
-
- 1340
- 1341
-
- 1342
+ 1335
+
+ 1336
- 1343
- public ArrayList<String> getPackageStructure() {
- 1344
- return packageStructure;
- 1345
+ 1337
+ public String getName() {
+ 1338
+ return name;
+ 1339
}
- 1346
- }
- 1347
+ 1340
+ 1341
+
+ 1342
+
+ 1343
+
+ 1344
+
+ 1345
+
+ 1346
+ public void setName(String name) {
+ 1347
+ this .name = name;
1348
-
+ } 1349
-
+ 1350
-
+ 1351
-
- 1352
-
+ 1352 0 private final ArrayList<String> packageStructure = new ArrayList<String>();
1353
-
+ 1354
- private File getNextTempDirectory() throws AnalysisException {
- 1355 0 dirCount += 1;
- 1356 0 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+ 1355
+
+ 1356
+
1357
-
- 1358 0 if (directory.exists()) {
- 1359 0 return getNextTempDirectory();
+ 1358
+
+ 1359
+ public ArrayList<String> getPackageStructure() {
1360
+ return packageStructure;
+ 1361
}
- 1361 0 if (!directory.mkdirs()) {
- 1362 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
- 1363 0 throw new AnalysisException(msg);
- 1364
- }
- 1365 0 return directory;
- 1366
+ 1362
}
+ 1363
+
+ 1364
+
+ 1365
+
+ 1366
+
1367
+
+ 1368
+
+ 1369
+
+ 1370
+ private File getNextTempDirectory() throws AnalysisException {
+ 1371 0 dirCount += 1;
+ 1372 0 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+ 1373
+
+ 1374 0 if (directory.exists()) {
+ 1375 0 return getNextTempDirectory();
+ 1376
+ }
+ 1377 0 if (!directory.mkdirs()) {
+ 1378 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+ 1379 0 throw new AnalysisException(msg);
+ 1380
+ }
+ 1381 0 return directory;
+ 1382
+ }
+ 1383
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html
index da940f636..1edd35ebd 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html
@@ -12,7 +12,7 @@
@@ -80,185 +80,201 @@
31
import org.owasp.dependencycheck.dependency.Dependency;
32
-
+ import org.owasp.dependencycheck.utils.Settings; 33
-
- 34
-
- 35
-
- 36
-
- 37
-
- 38
-
- 39
- public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
- 40
+ 34
+
+ 35
+
+ 36
+
+ 37
+
+ 38
+
+ 39
+
+ 40
+ public class JavaScriptAnalyzer extends AbstractFileTypeAnalyzer {
41
-
+ 42
43
-
+ 44
- 45
- private static final String ANALYZER_NAME = "JavaScript Analyzer" ;
+ 45 0 private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class .getName());
46
-
+ 47
-
+ 48
-
- 49 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 49
+
50
-
+ 51
-
+ private static final String ANALYZER_NAME = "JavaScript Analyzer" ; 52
-
- 53 1 private static final Set<String> EXTENSIONS = newHashSet("js" );
+ 53
+
54
-
- 55
-
+ 55 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
56
-
+ 57
-
+ 58
-
- 59
+ 59 0 private static final Set<String> EXTENSIONS = newHashSet("js" );
60
- @Override
+ 61
- public Set<String> getSupportedExtensions() {
- 62 1 return EXTENSIONS;
+ 62
+
63
- }
+ 64
-
+ 65
-
+ 66
-
+ @Override 67
-
- 68
-
+ public Set<String> getSupportedExtensions() { 68 0 return EXTENSIONS;
69
-
+ } 70
- @Override
+ 71
- public String getName() {
- 72 1 return ANALYZER_NAME;
+ 72
+
73
- }
+ 74
-
+ 75
-
+ 76
-
+ @Override 77
-
- 78
-
+ public String getName() { 78 0 return ANALYZER_NAME;
79
-
+ } 80
-
+ 81
- @Override
+ 82
- public boolean supportsExtension(String extension) {
- 83 1 return EXTENSIONS.contains(extension);
- 84
- }
- 85
-
- 86
-
- 87
- 88
+ 83
- 89
+ 84
- 90
+ 85
- 91
+ 86
@Override
- 92
+ 87
public AnalysisPhase getAnalysisPhase() {
- 93 1 return ANALYSIS_PHASE;
- 94
+ 88 0 return ANALYSIS_PHASE;
+ 89
}
- 95
+ 90
- 96
-
- 97
+ 91
- 98
-
- 99
+ 92
+
+ 93
- 100
-
- 101
-
- 102
-
- 103
+ 94
+
+ 95
- 104
+ 96
@Override
+ 97
+ protected String getAnalyzerEnabledSettingKey() {
+ 98 0 return Settings.KEYS.ANALYZER_JAVASCRIPT_ENABLED;
+ 99
+ }
+ 100
+
+ 101
+
+ 102
+
+ 103
+
+ 104
+
105
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 106 0 BufferedReader fin = null ;;
+ 106
+
107
- try {
+ 108
+ @Override
+ 109
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ 110 0 BufferedReader fin = null ;;
+ 111
+ try {
+ 112
- 109 0 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)" , Pattern.MULTILINE);
- 110 0 File file = dependency.getActualFile();
- 111 0 fin = new BufferedReader(new FileReader(file));
- 112 0 StringBuilder sb = new StringBuilder(2000);
- 113
+ 113 0 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)" , Pattern.MULTILINE);
+ 114 0 File file = dependency.getActualFile();
+ 115 0 fin = new BufferedReader(new FileReader(file));
+ 116 0 StringBuilder sb = new StringBuilder(2000);
+ 117
String text;
- 114 0 while ((text = fin.readLine()) != null ) {
- 115 0 sb.append(text);
- 116
+ 118 0 while ((text = fin.readLine()) != null ) {
+ 119 0 sb.append(text);
+ 120
}
- 117 0 } catch (FileNotFoundException ex) {
- 118 0 final String msg = String.format("Dependency file not found: '%s'" , dependency.getActualFilePath());
- 119 0 throw new AnalysisException(msg, ex);
- 120 0 } catch (IOException ex) {
- 121 0 Logger.getLogger(JavaScriptAnalyzer.class .getName()).log(Level.SEVERE, null , ex);
- 122
+ 121 0 } catch (FileNotFoundException ex) {
+ 122 0 final String msg = String.format("Dependency file not found: '%s'" , dependency.getActualFilePath());
+ 123 0 throw new AnalysisException(msg, ex);
+ 124 0 } catch (IOException ex) {
+ 125 0 LOGGER.log(Level.SEVERE, null , ex);
+ 126
} finally {
- 123 0 if (fin != null ) {
- 124
+ 127 0 if (fin != null ) {
+ 128
try {
- 125 0 fin.close();
- 126 0 } catch (IOException ex) {
- 127 0 Logger.getLogger(JavaScriptAnalyzer.class .getName()).log(Level.FINEST, null , ex);
- 128 0 }
- 129
+ 129 0 fin.close();
+ 130 0 } catch (IOException ex) {
+ 131 0 LOGGER.log(Level.FINEST, null , ex);
+ 132 0 }
+ 133
}
- 130
+ 134
}
- 131 0 }
- 132
+ 135 0 }
+ 136
+
+ 137
+ @Override
+ 138
+ protected void initializeFileTypeAnalyzer() throws Exception {
+ 139
+
+ 140 0 }
+ 141
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
index 070762a6f..e4d6a49c9 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
@@ -12,7 +12,7 @@
@@ -114,22 +114,22 @@
48
49
- public class NexusAnalyzer extends AbstractAnalyzer {
+ public class NexusAnalyzer extends AbstractFileTypeAnalyzer { 50
51
52
-
+ 53
- 54 1 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
+ 54 0 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
55
56
57
-
+ 58
59
@@ -139,10 +139,10 @@
61
62
-
+ 63
- 64 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 64 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
65
66
@@ -151,216 +151,191 @@
68
- 69 1 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
+ 69 0 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
70
71
72
-
+ 73
74
- private boolean enabled = false ;
+ private NexusSearch searcher; 75
76
77
-
- 78
-
- 79
- private NexusSearch searcher;
- 80
-
- 81
-
- 82
- 83
+ 78
- 84
+ 79
- 85
+ 80
- 86
+ 81
@Override
- 87
- public void initialize() throws Exception {
- 88 3 enabled = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED);
- 89 3 LOGGER.fine("Initializing Nexus Analyzer" );
- 90 3 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , enabled));
- 91 3 if (enabled) {
- 92 0 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
- 93 0 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
- 94
+ 82
+ public void initializeFileTypeAnalyzer() throws Exception {
+ 83 0 LOGGER.fine("Initializing Nexus Analyzer" );
+ 84 0 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , isEnabled()));
+ 85 0 if (isEnabled()) {
+ 86 0 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+ 87 0 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
+ 88
try {
- 95 0 searcher = new NexusSearch(new URL(searchUrl));
- 96 0 if (!searcher.preflightRequest()) {
- 97 0 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
- 98 0 enabled = false ;
- 99
+ 89 0 searcher = new NexusSearch(new URL(searchUrl));
+ 90 0 if (!searcher.preflightRequest()) {
+ 91 0 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
+ 92 0 setEnabled(false );
+ 93
}
- 100 0 } catch (MalformedURLException mue) {
- 101
+ 94 0 } catch (MalformedURLException mue) {
+ 95
- 102
+ 96
- 103 0 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
- 104 0 enabled = false ;
- 105 0 }
- 106
+ 97 0 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
+ 98 0 setEnabled(false );
+ 99 0 }
+ 100
}
- 107 3 }
- 108
+ 101 0 }
+ 102
- 109
+ 103
- 110
+ 104
- 111
+ 105
- 112
+ 106
- 113
+ 107
- 114
+ 108
@Override
- 115
+ 109
public String getName() {
- 116 9 return ANALYZER_NAME;
+ 110 0 return ANALYZER_NAME;
+ 111
+ }
+ 112
+
+ 113
+
+ 114
+
+ 115
+
+ 116
+
117
- }
+ 118
-
+ @Override 119
-
- 120
-
+ protected String getAnalyzerEnabledSettingKey() { 120 0 return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
121
-
+ } 122
-
+ 123
-
+ 124
- @Override
+ 125
- public AnalysisPhase getAnalysisPhase() {
- 126 6 return ANALYSIS_PHASE;
+ 126
+
127
- }
+ 128
-
+ @Override 129
-
- 130
-
+ public AnalysisPhase getAnalysisPhase() { 130 0 return ANALYSIS_PHASE;
131
-
+ } 132
-
+ 133
-
+ 134
- @Override
+ 135
- public Set<String> getSupportedExtensions() {
- 136 138 return SUPPORTED_EXTENSIONS;
+ 136
+
137
- }
+ 138
-
+ @Override 139
-
- 140
-
+ public Set<String> getSupportedExtensions() { 140 0 return SUPPORTED_EXTENSIONS;
141
-
- 142
-
- 143
-
- 144
-
- 145
- @Override
- 146
- public boolean supportsExtension(String extension) {
- 147 134 return SUPPORTED_EXTENSIONS.contains(extension);
- 148
}
- 149
+ 142
- 150
+ 143
- 151
+ 144
- 152
+ 145
- 153
+ 146
- 154
+ 147
- 155
+ 148
- 156
+ 149
- 157
+ 150
@Override
- 158
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 159
-
- 160 5 if (!enabled) {
- 161 5 return ;
- 162
- }
- 163
-
- 164
+ 151
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ 152
try {
- 165 0 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
- 166 0 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
- 167 0 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
- 168
+ 153 0 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
+ 154 0 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
+ 155 0 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
+ 156
}
- 169 0 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
- 170 0 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
- 171
+ 157 0 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
+ 158 0 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
+ 159
}
- 172 0 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
- 173 0 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
- 174
+ 160 0 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
+ 161 0 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
+ 162
}
- 175 0 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
- 176 0 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
- 177
+ 163 0 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
+ 164 0 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
+ 165
}
- 178 0 } catch (IllegalArgumentException iae) {
- 179
+ 166 0 } catch (IllegalArgumentException iae) {
+ 167
- 180 0 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
- 181 0 } catch (FileNotFoundException fnfe) {
- 182
+ 168 0 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
+ 169 0 } catch (FileNotFoundException fnfe) {
+ 170
- 183 0 LOGGER.fine(String.format("Artificat not found in repository '%s'" , dependency.getFileName()));
- 184 0 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
- 185 0 } catch (IOException ioe) {
- 186
+ 171 0 LOGGER.fine(String.format("Artificat not found in repository '%s'" , dependency.getFileName()));
+ 172 0 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
+ 173 0 } catch (IOException ioe) {
+ 174
- 187 0 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
- 188 0 }
- 189 0 }
- 190
+ 175 0 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
+ 176 0 }
+ 177 0 }
+ 178
}
- 191
-
- 192
-
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
index 5617c1626..d99a93961 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
@@ -12,7 +12,7 @@
@@ -58,239 +58,245 @@
20
import java.io.FileInputStream;
21
- import java.util.Set;
+ import java.io.FileNotFoundException; 22
- import java.util.logging.Level;
+ import java.io.IOException; 23
- import java.util.logging.Logger;
+ import java.util.Set; 24
- import org.owasp.dependencycheck.Engine;
+ import java.util.logging.Level; 25
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ import java.util.logging.Logger; 26
- import org.owasp.dependencycheck.data.nuget.NugetPackage;
+ import org.owasp.dependencycheck.Engine; 27
- import org.owasp.dependencycheck.data.nuget.NuspecParser;
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException; 28
- import org.owasp.dependencycheck.data.nuget.XPathNuspecParser;
+ import org.owasp.dependencycheck.data.nuget.NugetPackage; 29
- import org.owasp.dependencycheck.dependency.Confidence;
+ import org.owasp.dependencycheck.data.nuget.NuspecParseException; 30
- import org.owasp.dependencycheck.dependency.Dependency;
+ import org.owasp.dependencycheck.data.nuget.NuspecParser; 31
-
+ import org.owasp.dependencycheck.data.nuget.XPathNuspecParser; 32
-
+ import org.owasp.dependencycheck.dependency.Confidence; 33
-
+ import org.owasp.dependencycheck.dependency.Dependency; 34
-
+ import org.owasp.dependencycheck.utils.Settings; 35
-
+ 36
-
+ 37
- public class NuspecAnalyzer extends AbstractAnalyzer {
+ 38
-
+ 39
-
+ 40
-
+ 41
-
- 42 1 private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class .getName());
+ public class NuspecAnalyzer extends AbstractFileTypeAnalyzer { 42
+
43
-
+ 44
-
+ 45
-
- 46
+ 46 0 private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class .getName());
47
- private static final String ANALYZER_NAME = "Nuspec Analyzer" ;
+ 48
-
+ 49
-
+ 50
-
+ 51
-
- 52 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ private static final String ANALYZER_NAME = "Nuspec Analyzer" ; 52
+
53
-
+ 54
-
+ 55
-
- 56
- 57 1 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec" );
+ 56 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 57
+
58
-
+ 59
-
+ 60
-
- 61
-
+ 61 0 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec" );
62
-
+ 63
-
+ 64
- @Override
+ 65
- public void initialize() throws Exception {
- 66 3 }
+ 66
+
67
-
+ 68
-
+ @Override 69
-
- 70
-
+ public void initializeFileTypeAnalyzer() throws Exception { 70 0 }
71
-
+ 72
-
+ 73
- @Override
+ 74
- public String getName() {
- 75 10 return ANALYZER_NAME;
+ 75
+
76
- }
+ 77
-
+ @Override 78
-
- 79
-
+ public String getName() { 79 0 return ANALYZER_NAME;
80
-
+ } 81
-
+ 82
-
+ 83
- @Override
+ 84
- public AnalysisPhase getAnalysisPhase() {
- 85 7 return ANALYSIS_PHASE;
+ 85
+
86
- }
+ 87
-
+ @Override 88
-
- 89
-
+ protected String getAnalyzerEnabledSettingKey() { 89 0 return Settings.KEYS.ANALYZER_NUSPEC_ENABLED;
90
-
+ } 91
-
+ 92
-
+ 93
- @Override
+ 94
- public Set<String> getSupportedExtensions() {
- 95 140 return SUPPORTED_EXTENSIONS;
+ 95
+
96
- }
+ 97
-
+ @Override 98
-
- 99
-
+ public AnalysisPhase getAnalysisPhase() { 99 0 return ANALYSIS_PHASE;
100
-
- 101
-
- 102
-
- 103
-
- 104
- @Override
- 105
- public boolean supportsExtension(String extension) {
- 106 136 return SUPPORTED_EXTENSIONS.contains(extension);
- 107
}
- 108
+ 101
- 109
+ 102
- 110
-
- 111
+ 103
+
+ 104
- 112
-
- 113
-
- 114
-
- 115
+ 105
+
+ 106
- 116
+ 107
@Override
+ 108
+ public Set<String> getSupportedExtensions() {
+ 109 0 return SUPPORTED_EXTENSIONS;
+ 110
+ }
+ 111
+
+ 112
+
+ 113
+
+ 114
+
+ 115
+
+ 116
+
117
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 118 0 LOGGER.log(Level.INFO, "Checking Nuspec file {0}" , dependency.toString());
+ 118
+
119
+ @Override
+ 120
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ 121 0 LOGGER.log(Level.FINE, "Checking Nuspec file {0}" , dependency.toString());
+ 122
try {
- 120 0 final NuspecParser parser = new XPathNuspecParser();
- 121 0 NugetPackage np = null ;
- 122 0 FileInputStream fis = null ;
- 123
- try {
- 124 0 fis = new FileInputStream(dependency.getActualFilePath());
- 125 0 np = parser.parse(fis);
+ 123 0 final NuspecParser parser = new XPathNuspecParser();
+ 124 0 NugetPackage np = null ;
+ 125 0 FileInputStream fis = null ;
126
- } finally {
- 127 0 if (fis != null ) {
- 128
- try {
- 129 0 fis.close();
- 130 0 } catch (Throwable e) {
- 131 0 LOGGER.fine("Error closing input stream" );
- 132 0 }
+ try { 127 0 fis = new FileInputStream(dependency.getActualFilePath());
+ 128 0 np = parser.parse(fis);
+ 129 0 } catch (NuspecParseException ex) {
+ 130 0 throw new AnalysisException(ex);
+ 131 0 } catch (FileNotFoundException ex) {
+ 132 0 throw new AnalysisException(ex);
133
- }
- 134
- }
+ } finally { 134 0 if (fis != null ) {
135
-
- 136 0 if (np.getOwners() != null ) {
- 137 0 dependency.getVendorEvidence().addEvidence("nuspec" , "owners" , np.getOwners(), Confidence.HIGHEST);
- 138
+ try {
+ 136 0 fis.close();
+ 137 0 } catch (IOException e) {
+ 138 0 LOGGER.fine("Error closing input stream" );
+ 139 0 }
+ 140
+ }
+ 141
}
- 139 0 dependency.getVendorEvidence().addEvidence("nuspec" , "authors" , np.getAuthors(), Confidence.HIGH);
- 140 0 dependency.getVersionEvidence().addEvidence("nuspec" , "version" , np.getVersion(), Confidence.HIGHEST);
- 141 0 dependency.getProductEvidence().addEvidence("nuspec" , "id" , np.getId(), Confidence.HIGHEST);
- 142 0 if (np.getTitle() != null ) {
- 143 0 dependency.getProductEvidence().addEvidence("nuspec" , "title" , np.getTitle(), Confidence.MEDIUM);
- 144
- }
- 145 0 } catch (Throwable e) {
- 146 0 throw new AnalysisException(e);
- 147 0 }
- 148 0 }
- 149
- }
- 150
+ 142
+ 143 0 if (np.getOwners() != null ) {
+ 144 0 dependency.getVendorEvidence().addEvidence("nuspec" , "owners" , np.getOwners(), Confidence.HIGHEST);
+ 145
+ }
+ 146 0 dependency.getVendorEvidence().addEvidence("nuspec" , "authors" , np.getAuthors(), Confidence.HIGH);
+ 147 0 dependency.getVersionEvidence().addEvidence("nuspec" , "version" , np.getVersion(), Confidence.HIGHEST);
+ 148 0 dependency.getProductEvidence().addEvidence("nuspec" , "id" , np.getId(), Confidence.HIGHEST);
+ 149 0 if (np.getTitle() != null ) {
+ 150 0 dependency.getProductEvidence().addEvidence("nuspec" , "title" , np.getTitle(), Confidence.MEDIUM);
151
-
+ } 152 0 } catch (Throwable e) {
+ 153 0 throw new AnalysisException(e);
+ 154 0 }
+ 155 0 }
+ 156
+ }
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
index 7c05cc291..d603489da 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,97 +56,97 @@
19
20
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
- 21
import java.io.IOException;
- 22
+ 21
import java.sql.SQLException;
- 23
+ 22
import java.util.List;
- 24
- import java.util.Set;
- 25
+ 23
import org.owasp.dependencycheck.Engine;
- 26
+ 24
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ 25
import org.owasp.dependencycheck.data.nvdcve.CveDB;
- 27
+ 26
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
- 28
+ 27
import org.owasp.dependencycheck.dependency.Dependency;
- 29
+ 28
import org.owasp.dependencycheck.dependency.Identifier;
- 30
+ 29
import org.owasp.dependencycheck.dependency.Vulnerability;
+ 30
+
31
-
- 32
- 33
+ 32
- 34
+ 33
- 35
+ 34
- 36
+ 35
- 37
+ 36
- 38
+ 37
public class NvdCveAnalyzer implements Analyzer {
+ 38
+
39
-
+ 40
-
- 41
+ 41
+
42
-
- 43
static final int MAX_QUERY_RESULTS = 100;
+ 43
+
44
-
- 45
+ 45
+
46
-
- 47
private CveDB cveDB;
+ 47
+
48
-
+ 49
-
- 50
- 51
+ 50
- 52
+ 51
- 53
+ 52
- 54
+ 53
- 55
+ 54
+ 55
+
56
-
- 57
public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException {
- 58 3 cveDB = new CveDB();
- 59 3 cveDB.open();
- 60 3 }
- 61
+ 57 0 cveDB = new CveDB();
+ 58 0 cveDB.open();
+ 59 0 }
+ 60
- 62
+ 61
- 63
+ 62
- 64
+ 63
+ 64
+ @Override
65
public void close() {
- 66 3 cveDB.close();
- 67 3 cveDB = null ;
- 68 3 }
+ 66 0 cveDB.close();
+ 67 0 cveDB = null ;
+ 68 0 }
69
70
@@ -203,112 +203,83 @@
98
99
+ @Override
+ 100
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 100 9 for (Identifier id : dependency.getIdentifiers()) {
- 101 11 if ("cpe" .equals(id.getType())) {
- 102
+ 101 0 for (Identifier id : dependency.getIdentifiers()) {
+ 102 0 if ("cpe" .equals(id.getType())) {
+ 103
try {
- 103 11 final String value = id.getValue();
- 104 11 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
- 105 11 dependency.getVulnerabilities().addAll(vulns);
- 106 0 } catch (DatabaseException ex) {
- 107 0 throw new AnalysisException(ex);
- 108 11 }
- 109
+ 104 0 final String value = id.getValue();
+ 105 0 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
+ 106 0 dependency.getVulnerabilities().addAll(vulns);
+ 107 0 } catch (DatabaseException ex) {
+ 108 0 throw new AnalysisException(ex);
+ 109 0 }
+ 110
}
- 110 11 }
- 111 9 }
- 112
-
+ 111 0 }
+ 112 0 }
113
-
+ 114
-
+ 115
-
- 116
-
- 117
-
- 118
- public Set<String> getSupportedExtensions() {
- 119
- return null ;
- 120
- }
- 121
-
- 122
-
- 123
- 124
+ 116
- 125
+ 117
- 126
+ 118
- 127
+ 119
+ @Override
+ 120
public String getName() {
- 128 9 return "NVD CVE Analyzer" ;
- 129
+ 121 0 return "NVD CVE Analyzer" ;
+ 122
}
- 130
+ 123
- 131
+ 124
- 132
-
- 133
-
- 134
-
- 135
-
- 136
-
- 137
- public boolean supportsExtension(String extension) {
- 138 9 return true ;
- 139
- }
- 140
-
- 141
-
- 142
+ 125
- 143
+ 126
- 144
+ 127
- 145
+ 128
- 146
+ 129
+ @Override
+ 130
public AnalysisPhase getAnalysisPhase() {
- 147 6 return AnalysisPhase.FINDING_ANALYSIS;
- 148
+ 131 0 return AnalysisPhase.FINDING_ANALYSIS;
+ 132
}
- 149
+ 133
- 150
+ 134
- 151
-
- 152
+ 135
+
+ 136
- 153
+ 137
- 154
+ 138
- 155
+ 139
+ @Override
+ 140
public void initialize() throws Exception {
- 156 3 this .open();
- 157 3 }
- 158
+ 141 0 this .open();
+ 142 0 }
+ 143
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
index d67df2f69..50bb1b6e8 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
@@ -12,7 +12,7 @@
@@ -97,7 +97,7 @@
40
- 41 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
+ 41 0 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
42
43
@@ -114,7 +114,7 @@
@Override
49
public String getName() {
- 50 9 return ANALYZER_NAME;
+ 50 0 return ANALYZER_NAME;
51
}
52
@@ -133,7 +133,7 @@
@Override
59
public AnalysisPhase getAnalysisPhase() {
- 60 6 return ANALYSIS_PHASE;
+ 60 0 return ANALYSIS_PHASE;
61
}
62
@@ -146,20 +146,20 @@
public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
66
- 67 9 if (getRules() == null || getRules().size() <= 0) {
+ 67 0 if (getRules() == null || getRules().size() <= 0) {
68 0 return ;
69
}
70
- 71 9 for (final SuppressionRule rule : getRules()) {
- 72 45 rule.process(dependency);
- 73 45 }
- 74 9 }
+ 71 0 for (final SuppressionRule rule : getRules()) {
+ 72 0 rule.process(dependency);
+ 73 0 }
+ 74 0 }
75
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
index 48c77aee4..f8f753d57 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
@@ -151,6 +151,6 @@
} }
@@ -137,7 +137,7 @@
60
- 61 1 private static CpeMemoryIndex instance = new CpeMemoryIndex();
+ 61 0 private static CpeMemoryIndex instance = new CpeMemoryIndex();
62
63
@@ -164,7 +164,7 @@
74
public static CpeMemoryIndex getInstance() {
- 75 14 return instance;
+ 75 0 return instance;
76
}
77
@@ -239,22 +239,22 @@
112
public void open(CveDB cve) throws IndexException {
- 113 14 if (!openState) {
- 114 11 index = new RAMDirectory();
- 115 11 buildIndex(cve);
+ 113 0 if (!openState) {
+ 114 0 index = new RAMDirectory();
+ 115 0 buildIndex(cve);
116
try {
- 117 11 indexReader = DirectoryReader.open(index);
+ 117 0 indexReader = DirectoryReader.open(index);
118 0 } catch (IOException ex) {
119 0 throw new IndexException(ex);
- 120 11 }
- 121 11 indexSearcher = new IndexSearcher(indexReader);
- 122 11 searchingAnalyzer = createSearchingAnalyzer();
- 123 11 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
- 124 11 openState = true ;
+ 120 0 }
+ 121 0 indexSearcher = new IndexSearcher(indexReader);
+ 122 0 searchingAnalyzer = createSearchingAnalyzer();
+ 123 0 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
+ 124 0 openState = true ;
125
}
- 126 14 }
+ 126 0 }
127
128
@@ -297,9 +297,9 @@
@SuppressWarnings("unchecked" )
147
private Analyzer createIndexingAnalyzer() {
- 148 11 final Map fieldAnalyzers = new HashMap();
- 149 11 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
- 150 11 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
+ 148 0 final Map fieldAnalyzers = new HashMap();
+ 149 0 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
+ 150 0 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
151
}
152
@@ -318,15 +318,15 @@
@SuppressWarnings("unchecked" )
159
private Analyzer createSearchingAnalyzer() {
- 160 11 final Map fieldAnalyzers = new HashMap();
- 161 11 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
- 162 11 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
- 163 11 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
- 164 11 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
- 165 11 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
+ 160 0 final Map fieldAnalyzers = new HashMap();
+ 161 0 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
+ 162 0 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
+ 163 0 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
+ 164 0 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
+ 165 0 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
166
- 167 11 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
+ 167 0 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
168
}
169
@@ -351,13 +351,13 @@
179
public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException {
- 180 236434 final Document doc = new Document();
- 181 236434 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
- 182 236434 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
- 183 236434 doc.add(v);
- 184 236434 doc.add(p);
- 185 236434 indexWriter.addDocument(doc);
- 186 236434 }
+ 180 0 final Document doc = new Document();
+ 181 0 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
+ 182 0 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
+ 183 0 doc.add(v);
+ 184 0 doc.add(p);
+ 185 0 indexWriter.addDocument(doc);
+ 186 0 }
187
188
@@ -368,30 +368,30 @@
191
public void close() {
- 192 11 if (searchingAnalyzer != null ) {
- 193 11 searchingAnalyzer.close();
- 194 11 searchingAnalyzer = null ;
+ 192 0 if (searchingAnalyzer != null ) {
+ 193 0 searchingAnalyzer.close();
+ 194 0 searchingAnalyzer = null ;
195
}
- 196 11 if (indexReader != null ) {
+ 196 0 if (indexReader != null ) {
197
try {
- 198 11 indexReader.close();
+ 198 0 indexReader.close();
199 0 } catch (IOException ex) {
200 0 Logger.getLogger(CpeMemoryIndex.class .getName()).log(Level.FINEST, null , ex);
- 201 11 }
- 202 11 indexReader = null ;
+ 201 0 }
+ 202 0 indexReader = null ;
203
}
- 204 11 queryParser = null ;
- 205 11 indexSearcher = null ;
- 206 11 if (index != null ) {
- 207 11 index.close();
- 208 11 index = null ;
+ 204 0 queryParser = null ;
+ 205 0 indexSearcher = null ;
+ 206 0 if (index != null ) {
+ 207 0 index.close();
+ 208 0 index = null ;
209
}
- 210 11 openState = false ;
- 211 11 }
+ 210 0 openState = false ;
+ 211 0 }
212
213
@@ -408,53 +408,53 @@
219
private void buildIndex(CveDB cve) throws IndexException {
- 220 11 Analyzer analyzer = null ;
- 221 11 IndexWriter indexWriter = null ;
+ 220 0 Analyzer analyzer = null ;
+ 221 0 IndexWriter indexWriter = null ;
222
try {
- 223 11 analyzer = createIndexingAnalyzer();
- 224 11 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
- 225 11 indexWriter = new IndexWriter(index, conf);
+ 223 0 analyzer = createIndexingAnalyzer();
+ 224 0 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
+ 225 0 indexWriter = new IndexWriter(index, conf);
226
try {
- 227 11 final Set<Pair<String, String>> data = cve.getVendorProductList();
- 228 11 for (Pair<String, String> pair : data) {
- 229 236434 saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
- 230 236434 }
+ 227 0 final Set<Pair<String, String>> data = cve.getVendorProductList();
+ 228 0 for (Pair<String, String> pair : data) {
+ 229 0 saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
+ 230 0 }
231 0 } catch (DatabaseException ex) {
232 0 Logger.getLogger(CpeMemoryIndex.class .getName()).log(Level.FINE, null , ex);
233 0 throw new IndexException("Error reading CPE data" , ex);
- 234 11 }
+ 234 0 }
235 0 } catch (CorruptIndexException ex) {
236 0 throw new IndexException("Unable to close an in-memory index" , ex);
237 0 } catch (IOException ex) {
238 0 throw new IndexException("Unable to close an in-memory index" , ex);
239
} finally {
- 240 11 if (indexWriter != null ) {
+ 240 0 if (indexWriter != null ) {
241
try {
242
try {
- 243 11 indexWriter.commit();
+ 243 0 indexWriter.commit();
244
} finally {
- 245 11 indexWriter.close(true );
- 246 11 }
+ 245 0 indexWriter.close(true );
+ 246 0 }
247 0 } catch (CorruptIndexException ex) {
248 0 throw new IndexException("Unable to close an in-memory index" , ex);
249 0 } catch (IOException ex) {
250 0 throw new IndexException("Unable to close an in-memory index" , ex);
- 251 11 }
- 252 11 if (analyzer != null ) {
- 253 11 analyzer.close();
+ 251 0 }
+ 252 0 if (analyzer != null ) {
+ 253 0 analyzer.close();
254
}
255
}
256
}
- 257 11 }
+ 257 0 }
258
259
@@ -496,12 +496,12 @@
280
public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException {
- 281 73 if (searchString == null || searchString.trim().isEmpty()) {
+ 281 0 if (searchString == null || searchString.trim().isEmpty()) {
282 0 throw new ParseException("Query is null or empty" );
283
}
- 284 73 final Query query = queryParser.parse(searchString);
- 285 73 return indexSearcher.search(query, maxQueryResults);
+ 284 0 final Query query = queryParser.parse(searchString);
+ 285 0 return indexSearcher.search(query, maxQueryResults);
286
}
287
@@ -548,7 +548,7 @@
309
public Document getDocument(int documentId) throws IOException {
- 310 750 return indexSearcher.doc(documentId);
+ 310 0 return indexSearcher.doc(documentId);
311
}
312
@@ -565,17 +565,17 @@
318
public int numDocs() {
- 319 3 if (indexReader == null ) {
+ 319 0 if (indexReader == null ) {
320 0 return -1;
321
}
- 322 3 return indexReader.numDocs();
+ 322 0 return indexReader.numDocs();
323
}
324
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
index 80e2464ae..834e56adf 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
@@ -103,6 +103,6 @@
}
@@ -302,19 +302,19 @@
144
public void parseName(String cpeName) throws UnsupportedEncodingException {
- 145 1 if (cpeName != null && cpeName.length() > 7) {
- 146 1 final String[] data = cpeName.substring(7).split(":" );
- 147 1 if (data.length >= 1) {
- 148 1 vendor = URLDecoder.decode(data[0].replace("+" , "%2B" ), "UTF-8" );
- 149 1 if (data.length >= 2) {
- 150 1 product = URLDecoder.decode(data[1].replace("+" , "%2B" ), "UTF-8" );
+ 145 0 if (cpeName != null && cpeName.length() > 7) {
+ 146 0 final String[] data = cpeName.substring(7).split(":" );
+ 147 0 if (data.length >= 1) {
+ 148 0 vendor = URLDecoder.decode(data[0].replace("+" , "%2B" ), "UTF-8" );
+ 149 0 if (data.length >= 2) {
+ 150 0 product = URLDecoder.decode(data[1].replace("+" , "%2B" ), "UTF-8" );
151
}
152
}
153
}
- 154 1 }
+ 154 0 }
155
156
@@ -332,21 +332,21 @@
@Override
164
public boolean equals(Object obj) {
- 165 6397 if (obj == null ) {
+ 165 0 if (obj == null ) {
166 0 return false ;
167
}
- 168 6397 if (getClass() != obj.getClass()) {
+ 168 0 if (getClass() != obj.getClass()) {
169 0 return false ;
170
}
- 171 6397 final IndexEntry other = (IndexEntry) obj;
- 172 6397 if ((this .vendor == null ) ? (other.vendor != null ) : !this .vendor.equals(other.vendor)) {
- 173 5182 return false ;
+ 171 0 final IndexEntry other = (IndexEntry) obj;
+ 172 0 if ((this .vendor == null ) ? (other.vendor != null ) : !this .vendor.equals(other.vendor)) {
+ 173 0 return false ;
174
}
- 175 1215 if ((this .product == null ) ? (other.product != null ) : !this .product.equals(other.product)) {
- 176 1215 return false ;
+ 175 0 if ((this .product == null ) ? (other.product != null ) : !this .product.equals(other.product)) {
+ 176 0 return false ;
177
}
178 0 return true ;
@@ -375,6 +375,6 @@
} }
@@ -99,7 +99,7 @@
41
- 42 1 private static final HashMap<String, String> CWE = loadData();
+ 42 0 private static final HashMap<String, String> CWE = loadData();
43
44
@@ -114,13 +114,13 @@
49
private static HashMap<String, String> loadData() {
- 50 1 ObjectInputStream oin = null ;
+ 50 0 ObjectInputStream oin = null ;
51
try {
- 52 1 final String filePath = "data/cwe.hashmap.serialized" ;
- 53 1 final InputStream input = CweDB.class .getClassLoader().getResourceAsStream(filePath);
- 54 1 oin = new ObjectInputStream(input);
- 55 1 return (HashMap<String, String>) oin.readObject();
+ 52 0 final String filePath = "data/cwe.hashmap.serialized" ;
+ 53 0 final InputStream input = CweDB.class .getClassLoader().getResourceAsStream(filePath);
+ 54 0 oin = new ObjectInputStream(input);
+ 55 0 return (HashMap<String, String>) oin.readObject();
56 0 } catch (ClassNotFoundException ex) {
57 0 Logger.getLogger(CweDB.class .getName()).log(Level.WARNING, "Unable to load CWE data. This should not be an issue." );
58 0 Logger.getLogger(CweDB.class .getName()).log(Level.FINE, null , ex);
@@ -129,13 +129,13 @@
61 0 Logger.getLogger(CweDB.class .getName()).log(Level.FINE, null , ex);
62
} finally {
- 63 1 if (oin != null ) {
+ 63 0 if (oin != null ) {
64
try {
- 65 1 oin.close();
+ 65 0 oin.close();
66 0 } catch (IOException ex) {
67 0 Logger.getLogger(CweDB.class .getName()).log(Level.FINEST, null , ex);
- 68 2 }
+ 68 0 }
69
}
70
@@ -161,8 +161,8 @@
81
public static String getCweName(String cweId) {
- 82 51 if (cweId != null ) {
- 83 51 return CWE.get(cweId);
+ 82 0 if (cweId != null ) {
+ 83 0 return CWE.get(cweId);
84
}
85 0 return null ;
@@ -172,6 +172,6 @@
} }
@@ -85,7 +85,7 @@
34
- 35 31 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
+ 35 0 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
36
37
@@ -144,9 +144,9 @@
64
public AbstractTokenizingFilter(TokenStream stream) {
- 65 31 super (stream);
- 66 31 tokens = new LinkedList<String>();
- 67 31 }
+ 65 0 super (stream);
+ 66 0 tokens = new LinkedList<String>();
+ 67 0 }
68
69
@@ -161,20 +161,20 @@
74
protected boolean addTerm() {
- 75 38507 final boolean termAdded = tokens.size() > 0;
- 76 38509 if (termAdded) {
- 77 23082 final String term = tokens.pop();
- 78 23082 clearAttributes();
- 79 23075 termAtt.append(term);
+ 75 0 final boolean termAdded = tokens.size() > 0;
+ 76 0 if (termAdded) {
+ 77 0 final String term = tokens.pop();
+ 78 0 clearAttributes();
+ 79 0 termAtt.append(term);
80
}
- 81 38492 return termAdded;
+ 81 0 return termAdded;
82
}
83
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
index 5143f2c64..f1420ec9e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
@@ -12,7 +12,7 @@
@@ -135,13 +135,13 @@
@Override 59
protected boolean isTokenChar(int c) {
- 60 5508126 return Character.isLetter(c) || Character.isDigit(c);
+ 60 0 return Character.isLetter(c) || Character.isDigit(c);
61
}
62
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
index 766b3826d..cc3fa360d 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
@@ -112,6 +112,6 @@
}
@@ -139,13 +139,13 @@
@Override 61
protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
- 62 23 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
+ 62 0 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
63
- 64 23 TokenStream stream = source;
+ 64 0 TokenStream stream = source;
65
- 66 23 stream = new WordDelimiterFilter(stream,
+ 66 0 stream = new WordDelimiterFilter(stream,
67
WordDelimiterFilter.CATENATE_WORDS
68
@@ -162,17 +162,17 @@
| WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null );
74
- 75 23 stream = new LowerCaseFilter(version, stream);
- 76 23 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
+ 75 0 stream = new LowerCaseFilter(version, stream);
+ 76 0 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
77
- 78 23 return new TokenStreamComponents(source, stream);
+ 78 0 return new TokenStreamComponents(source, stream);
79
}
80
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
index 069a003b3..bb1f92987 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
@@ -12,7 +12,7 @@
@@ -83,7 +83,7 @@
33
- 34 1 public static final Version CURRENT_VERSION = Version.LUCENE_45;
+ 34 0 public static final Version CURRENT_VERSION = Version.LUCENE_45;
35
36
@@ -124,15 +124,15 @@
final CharSequence text) {
54
- 55 1158 if (text == null || buf == null ) {
- 56 1 return ;
+ 55 0 if (text == null || buf == null ) {
+ 56 0 return ;
57
}
58
- 59 11488 for (int i = 0; i < text.length(); i++) {
- 60 10331 final char c = text.charAt(i);
- 61 10331 switch (c) {
+ 59 0 for (int i = 0; i < text.length(); i++) {
+ 60 0 final char c = text.charAt(i);
+ 61 0 switch (c) {
62
case '+' :
63
@@ -169,17 +169,17 @@
case ':' :
79
case '\\' :
- 80 226 buf.append('\\' );
+ 80 0 buf.append('\\' );
81
default :
- 82 10331 buf.append(c);
+ 82 0 buf.append(c);
83
break ;
84
}
85
}
- 86 1157 }
+ 86 0 }
87
88
@@ -198,27 +198,27 @@
public static String escapeLuceneQuery(final CharSequence text) {
95
- 96 1117 if (text == null ) {
- 97 1 return null ;
+ 96 0 if (text == null ) {
+ 97 0 return null ;
98
}
99
- 100 1116 int size = text.length();
- 101 1116 size = size >> 1;
- 102 1116 final StringBuilder buf = new StringBuilder(size);
+ 100 0 int size = text.length();
+ 101 0 size = size >> 1;
+ 102 0 final StringBuilder buf = new StringBuilder(size);
103
- 104 1116 appendEscapedLuceneQuery(buf, text);
+ 104 0 appendEscapedLuceneQuery(buf, text);
105
- 106 1116 return buf.toString();
+ 106 0 return buf.toString();
107
}
108
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
index 7f141362b..96987705a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
@@ -12,7 +12,7 @@
@@ -145,13 +145,13 @@
@Override 64
protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
- 65 24 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
+ 65 0 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
66
- 67 24 TokenStream stream = source;
+ 67 0 TokenStream stream = source;
68
- 69 24 stream = new WordDelimiterFilter(stream,
+ 69 0 stream = new WordDelimiterFilter(stream,
70
WordDelimiterFilter.GENERATE_WORD_PARTS
71
@@ -166,14 +166,14 @@
| WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null );
76
- 77 24 stream = new LowerCaseFilter(version, stream);
- 78 24 stream = new UrlTokenizingFilter(stream);
- 79 24 concatenatingFilter = new TokenPairConcatenatingFilter(stream);
- 80 24 stream = concatenatingFilter;
- 81 24 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
+ 77 0 stream = new LowerCaseFilter(version, stream);
+ 78 0 stream = new UrlTokenizingFilter(stream);
+ 79 0 concatenatingFilter = new TokenPairConcatenatingFilter(stream);
+ 80 0 stream = concatenatingFilter;
+ 81 0 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
82
- 83 24 return new TokenStreamComponents(source, stream);
+ 83 0 return new TokenStreamComponents(source, stream);
84
}
85
@@ -194,15 +194,15 @@
93
public void clear() {
- 94 2 if (concatenatingFilter != null ) {
- 95 2 concatenatingFilter.clear();
+ 94 0 if (concatenatingFilter != null ) {
+ 95 0 concatenatingFilter.clear();
96
}
- 97 2 }
+ 97 0 }
98
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html
index 21923d9dc..a1da0ba89 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html
@@ -158,6 +158,6 @@
}
@@ -93,7 +93,7 @@
38
- 39 26 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
+ 39 0 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
40
41
@@ -160,9 +160,9 @@
72
public TokenPairConcatenatingFilter(TokenStream stream) {
- 73 26 super (stream);
- 74 26 words = new LinkedList<String>();
- 75 26 }
+ 73 0 super (stream);
+ 74 0 words = new LinkedList<String>();
+ 75 0 }
76
77
@@ -187,35 +187,35 @@
87
- 88 7578 while (input.incrementToken()) {
- 89 2130 final String word = new String(termAtt.buffer(), 0, termAtt.length());
- 90 2130 words.add(word);
- 91 2130 }
+ 88 0 while (input.incrementToken()) {
+ 89 0 final String word = new String(termAtt.buffer(), 0, termAtt.length());
+ 90 0 words.add(word);
+ 91 0 }
92
93
94
- 95 5448 if (previousWord != null && words.size() > 0) {
- 96 2102 final String word = words.getFirst();
- 97 2102 clearAttributes();
- 98 2102 termAtt.append(previousWord).append(word);
- 99 2102 previousWord = null ;
- 100 2102 return true ;
+ 95 0 if (previousWord != null && words.size() > 0) {
+ 96 0 final String word = words.getFirst();
+ 97 0 clearAttributes();
+ 98 0 termAtt.append(previousWord).append(word);
+ 99 0 previousWord = null ;
+ 100 0 return true ;
101
}
102
- 103 3346 if (words.size() > 0) {
- 104 2130 final String word = words.removeFirst();
- 105 2130 clearAttributes();
- 106 2130 termAtt.append(word);
- 107 2130 previousWord = word;
- 108 2130 return true ;
+ 103 0 if (words.size() > 0) {
+ 104 0 final String word = words.removeFirst();
+ 105 0 clearAttributes();
+ 106 0 termAtt.append(word);
+ 107 0 previousWord = word;
+ 108 0 return true ;
109
}
- 110 1216 return false ;
+ 110 0 return false ;
111
}
112
@@ -236,13 +236,13 @@
120
public void clear() {
- 121 3 previousWord = null ;
- 122 3 words.clear();
- 123 3 }
+ 121 0 previousWord = null ;
+ 122 0 words.clear();
+ 123 0 }
124
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
index ef765d353..1eb29b246 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
@@ -12,7 +12,7 @@
@@ -131,22 +131,22 @@
@Override 57
public boolean incrementToken() throws IOException {
- 58 38602 final LinkedList<String> tokens = getTokens();
- 59 38611 final CharTermAttribute termAtt = getTermAtt();
- 60 38614 if (tokens.size() == 0 && input.incrementToken()) {
- 61 23075 final String text = new String(termAtt.buffer(), 0, termAtt.length());
- 62 23074 if (UrlStringUtils.containsUrl(text)) {
- 63 2 final String[] parts = text.split("\\s" );
- 64 4 for (String part : parts) {
- 65 2 if (UrlStringUtils.isUrl(part)) {
+ 58 0 final LinkedList<String> tokens = getTokens();
+ 59 0 final CharTermAttribute termAtt = getTermAtt();
+ 60 0 if (tokens.size() == 0 && input.incrementToken()) {
+ 61 0 final String text = new String(termAtt.buffer(), 0, termAtt.length());
+ 62 0 if (UrlStringUtils.containsUrl(text)) {
+ 63 0 final String[] parts = text.split("\\s" );
+ 64 0 for (String part : parts) {
+ 65 0 if (UrlStringUtils.isUrl(part)) {
66
try {
- 67 2 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
- 68 2 tokens.addAll(data);
+ 67 0 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
+ 68 0 tokens.addAll(data);
69 0 } catch (MalformedURLException ex) {
70 0 Logger.getLogger(UrlTokenizingFilter.class .getName()).log(Level.FINE, "error parsing " + part, ex);
71 0 tokens.add(part);
- 72 2 }
+ 72 0 }
73
} else {
74 0 tokens.add(part);
@@ -154,19 +154,19 @@
} 76
}
- 77 2 } else {
- 78 23067 tokens.add(text);
+ 77 0 } else {
+ 78 0 tokens.add(text);
79
}
80
}
- 81 38497 return addTerm();
+ 81 0 return addTerm();
82
}
83
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html
index ff939c18f..8e23c0137 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html
@@ -157,6 +157,6 @@
} }
@@ -158,12 +158,12 @@
73
- 74 1 public MavenArtifact(String groupId, String artifactId, String version, String url) {
- 75 1 setGroupId(groupId);
- 76 1 setArtifactId(artifactId);
- 77 1 setVersion(version);
- 78 1 setArtifactUrl(url);
- 79 1 }
+ 74 0 public MavenArtifact(String groupId, String artifactId, String version, String url) {
+ 75 0 setGroupId(groupId);
+ 76 0 setArtifactId(artifactId);
+ 77 0 setVersion(version);
+ 78 0 setArtifactUrl(url);
+ 79 0 }
80
81
@@ -335,6 +335,6 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
index f349110e3..90d27a848 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
@@ -12,7 +12,7 @@
@@ -127,7 +127,7 @@
55
- 56 1 private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
+ 56 0 private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
57
.getName());
58
@@ -144,25 +144,25 @@
64
- 65 4 public NexusSearch(URL rootURL) {
- 66 4 this .rootURL = rootURL;
+ 65 0 public NexusSearch(URL rootURL) {
+ 66 0 this .rootURL = rootURL;
67
try {
- 68 4 if (null != Settings.getString(Settings.KEYS.PROXY_URL)
+ 68 0 if (null != Settings.getString(Settings.KEYS.PROXY_URL)
69
&& Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) {
70 0 useProxy = true ;
71 0 LOGGER.fine("Using proxy" );
72
} else {
- 73 4 useProxy = false ;
- 74 4 LOGGER.fine("Not using proxy" );
+ 73 0 useProxy = false ;
+ 74 0 LOGGER.fine("Not using proxy" );
75
}
76 0 } catch (InvalidSettingException ise) {
77 0 useProxy = false ;
- 78 4 }
- 79 4 }
+ 78 0 }
+ 79 0 }
80
81
@@ -185,18 +185,18 @@
90
public MavenArtifact searchSha1(String sha1) throws IOException {
- 91 4 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$" )) {
- 92 2 throw new IllegalArgumentException("Invalid SHA1 format" );
+ 91 0 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$" )) {
+ 92 0 throw new IllegalArgumentException("Invalid SHA1 format" );
93
}
94
- 95 2 final URL url = new URL(rootURL, String.format("identify/sha1/%s" ,
+ 95 0 final URL url = new URL(rootURL, String.format("identify/sha1/%s" ,
96
sha1.toLowerCase()));
97
- 98 2 LOGGER.fine(String.format("Searching Nexus url %s" , url.toString()));
+ 98 0 LOGGER.fine(String.format("Searching Nexus url %s" , url.toString()));
99
100
@@ -209,63 +209,63 @@
104
- 105 2 URLConnection conn = null ;
- 106 2 conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
+ 105 0 URLConnection conn = null ;
+ 106 0 conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
107
- 108 2 conn.setDoOutput(true );
+ 108 0 conn.setDoOutput(true );
109
110
111
- 112 2 conn.addRequestProperty("Accept" , "application/xml" );
- 113 2 conn.connect();
+ 112 0 conn.addRequestProperty("Accept" , "application/xml" );
+ 113 0 conn.connect();
114
115
try {
- 116 2 final DocumentBuilder builder = DocumentBuilderFactory
+ 116 0 final DocumentBuilder builder = DocumentBuilderFactory
117
.newInstance().newDocumentBuilder();
- 118 2 final Document doc = builder.parse(conn.getInputStream());
- 119 1 final XPath xpath = XPathFactory.newInstance().newXPath();
- 120 1 final String groupId = xpath
+ 118 0 final Document doc = builder.parse(conn.getInputStream());
+ 119 0 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 120 0 final String groupId = xpath
121
.evaluate(
122
"/org.sonatype.nexus.rest.model.NexusArtifact/groupId" ,
123
doc);
- 124 1 final String artifactId = xpath.evaluate(
+ 124 0 final String artifactId = xpath.evaluate(
125
"/org.sonatype.nexus.rest.model.NexusArtifact/artifactId" ,
126
doc);
- 127 1 final String version = xpath
+ 127 0 final String version = xpath
128
.evaluate(
129
"/org.sonatype.nexus.rest.model.NexusArtifact/version" ,
130
doc);
- 131 1 final String link = xpath
+ 131 0 final String link = xpath
132
.evaluate(
133
"/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink" ,
134
doc);
- 135 1 return new MavenArtifact(groupId, artifactId, version, link);
- 136 1 } catch (FileNotFoundException fnfe) {
+ 135 0 return new MavenArtifact(groupId, artifactId, version, link);
+ 136 0 } catch (FileNotFoundException fnfe) {
137
138
139
- 140 1 throw fnfe;
+ 140 0 throw fnfe;
141 0 } catch (Throwable e) {
142
@@ -292,27 +292,27 @@
public boolean preflightRequest() { 154
try {
- 155 4 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status" ), useProxy);
- 156 4 conn.addRequestProperty("Accept" , "application/xml" );
- 157 4 conn.connect();
- 158 4 if (conn.getResponseCode() != 200) {
+ 155 0 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status" ), useProxy);
+ 156 0 conn.addRequestProperty("Accept" , "application/xml" );
+ 157 0 conn.connect();
+ 158 0 if (conn.getResponseCode() != 200) {
159 0 LOGGER.log(Level.WARNING, "Expected 200 result from Nexus, got {0}" , conn.getResponseCode());
160 0 return false ;
161
}
- 162 4 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
- 163 4 final Document doc = builder.parse(conn.getInputStream());
- 164 4 if (!"status" .equals(doc.getDocumentElement().getNodeName())) {
+ 162 0 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ 163 0 final Document doc = builder.parse(conn.getInputStream());
+ 164 0 if (!"status" .equals(doc.getDocumentElement().getNodeName())) {
165 0 LOGGER.log(Level.WARNING, "Expected root node name of status, got {0}" , doc.getDocumentElement().getNodeName());
166 0 return false ;
167
}
168 0 } catch (Throwable e) {
169 0 return false ;
- 170 4 }
+ 170 0 }
171
- 172 4 return true ;
+ 172 0 return true ;
173
}
174
@@ -323,6 +323,6 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
index d4593b8f1..adff45eb2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
@@ -377,6 +377,6 @@
} } }
@@ -99,8 +99,8 @@
41
private String getOrNull(Node n) {
- 42 3 if (n != null ) {
- 43 3 return n.getTextContent();
+ 42 0 if (n != null ) {
+ 43 0 return n.getTextContent();
44
} else {
45 0 return null ;
@@ -130,32 +130,32 @@
public NugetPackage parse(InputStream stream) throws NuspecParseException { 58
try {
- 59 3 final Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream);
- 60 2 final XPath xpath = XPathFactory.newInstance().newXPath();
- 61 2 final NugetPackage nuspec = new NugetPackage();
+ 59 0 final Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream);
+ 60 0 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 61 0 final NugetPackage nuspec = new NugetPackage();
62
- 63 2 if (xpath.evaluate("/package/metadata/id" , d, XPathConstants.NODE) == null
+ 63 0 if (xpath.evaluate("/package/metadata/id" , d, XPathConstants.NODE) == null
64
|| xpath.evaluate("/package/metadata/version" , d, XPathConstants.NODE) == null
65
|| xpath.evaluate("/package/metadata/authors" , d, XPathConstants.NODE) == null
66
|| xpath.evaluate("/package/metadata/description" , d, XPathConstants.NODE) == null ) {
- 67 1 throw new NuspecParseException("Invalid Nuspec format" );
+ 67 0 throw new NuspecParseException("Invalid Nuspec format" );
68
}
69
- 70 1 nuspec.setId(xpath.evaluate("/package/metadata/id" , d));
- 71 1 nuspec.setVersion(xpath.evaluate("/package/metadata/version" , d));
- 72 1 nuspec.setAuthors(xpath.evaluate("/package/metadata/authors" , d));
- 73 1 nuspec.setOwners(getOrNull((Node) xpath.evaluate("/package/metadata/owners" , d, XPathConstants.NODE)));
- 74 1 nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl" , d, XPathConstants.NODE)));
- 75 1 nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title" , d, XPathConstants.NODE)));
- 76 1 return nuspec;
- 77 2 } catch (Throwable e) {
- 78 2 throw new NuspecParseException("Unable to parse nuspec" , e);
+ 70 0 nuspec.setId(xpath.evaluate("/package/metadata/id" , d));
+ 71 0 nuspec.setVersion(xpath.evaluate("/package/metadata/version" , d));
+ 72 0 nuspec.setAuthors(xpath.evaluate("/package/metadata/authors" , d));
+ 73 0 nuspec.setOwners(getOrNull((Node) xpath.evaluate("/package/metadata/owners" , d, XPathConstants.NODE)));
+ 74 0 nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl" , d, XPathConstants.NODE)));
+ 75 0 nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title" , d, XPathConstants.NODE)));
+ 76 0 return nuspec;
+ 77 0 } catch (Throwable e) {
+ 78 0 throw new NuspecParseException("Unable to parse nuspec" , e);
79
}
80
@@ -164,6 +164,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
index 179505297..183c31933 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
@@ -12,7 +12,7 @@
@@ -129,28 +129,28 @@
56
- 57 1 private static Driver driver = null ;
+ 57 0 private static Driver driver = null ;
58
59
60
- 61 1 private static String connectionString = null ;
+ 61 0 private static String connectionString = null ;
62
63
64
- 65 1 private static String userName = null ;
+ 65 0 private static String userName = null ;
66
67
68
- 69 1 private static String password = null ;
+ 69 0 private static String password = null ;
70
71
@@ -181,68 +181,68 @@
public static synchronized void initialize() throws DatabaseException {
84
- 85 60 if (connectionString != null ) {
- 86 54 return ;
+ 85 0 if (connectionString != null ) {
+ 86 0 return ;
87
}
- 88 6 Connection conn = null ;
+ 88 0 Connection conn = null ;
89
try {
90
- 91 6 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "" );
- 92 6 if (!driverName.isEmpty()) {
- 93 6 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Loading driver: {0}" , driverName);
- 94 6 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "" );
+ 91 0 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "" );
+ 92 0 if (!driverName.isEmpty()) {
+ 93 0 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Loading driver: {0}" , driverName);
+ 94 0 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "" );
95
try {
- 96 6 if (!driverPath.isEmpty()) {
+ 96 0 if (!driverPath.isEmpty()) {
97 0 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Loading driver from: {0}" , driverPath);
98 0 driver = DriverLoader.load(driverName, driverPath);
99
} else {
- 100 6 driver = DriverLoader.load(driverName);
+ 100 0 driver = DriverLoader.load(driverName);
101
}
102 0 } catch (DriverLoadException ex) {
103 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, "Unable to load database driver" , ex);
104 0 throw new DatabaseException("Unable to load database driver" );
- 105 6 }
+ 105 0 }
106
}
- 107 6 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser" );
+ 107 0 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser" );
108
- 109 6 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!" );
+ 109 0 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!" );
110
try {
- 111 6 connectionString = getConnectionString();
+ 111 0 connectionString = getConnectionString();
112 0 } catch (IOException ex) {
113 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE,
114
"Unable to retrieve the database connection string" , ex);
115 0 throw new DatabaseException("Unable to retrieve the database connection string" );
- 116 6 }
- 117 6 boolean shouldCreateSchema = false ;
+ 116 0 }
+ 117 0 boolean shouldCreateSchema = false ;
118
try {
- 119 6 if (connectionString.startsWith("jdbc:h2:file:" )) {
- 120 6 shouldCreateSchema = !dbSchemaExists();
- 121 6 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Need to create DB Structure: {0}" , shouldCreateSchema);
+ 119 0 if (connectionString.startsWith("jdbc:h2:file:" )) {
+ 120 0 shouldCreateSchema = !dbSchemaExists();
+ 121 0 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Need to create DB Structure: {0}" , shouldCreateSchema);
122
}
123 0 } catch (IOException ioex) {
124 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, "Unable to verify database exists" , ioex);
125 0 throw new DatabaseException("Unable to verify database exists" );
- 126 6 }
- 127 6 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Loading database connection" );
- 128 6 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Connection String: {0}" , connectionString);
- 129 6 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Database User: {0}" , userName);
+ 126 0 }
+ 127 0 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Loading database connection" );
+ 128 0 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Connection String: {0}" , connectionString);
+ 129 0 Logger.getLogger(CveDB.class .getName()).log(Level.FINE, "Database User: {0}" , userName);
130
131
try {
- 132 6 conn = DriverManager.getConnection(connectionString, userName, password);
+ 132 0 conn = DriverManager.getConnection(connectionString, userName, password);
133 0 } catch (SQLException ex) {
134 0 if (ex.getMessage().contains("java.net.UnknownHostException" ) && connectionString.contains("AUTO_SERVER=TRUE;" )) {
135 0 connectionString = connectionString.replace("AUTO_SERVER=TRUE;" , "" );
@@ -263,10 +263,10 @@
147 0 throw new DatabaseException("Unable to connect to the database" );
148
}
- 149 6 }
+ 149 0 }
150
- 151 6 if (shouldCreateSchema) {
+ 151 0 if (shouldCreateSchema) {
152
try {
153 0 createTables(conn);
@@ -278,27 +278,27 @@
} else { 159
try {
- 160 6 ensureSchemaVersion(conn);
+ 160 0 ensureSchemaVersion(conn);
161 0 } catch (DatabaseException dex) {
162 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, null , dex);
163 0 throw new DatabaseException("Database schema does not match this version of dependency-check" );
- 164 6 }
+ 164 0 }
165
}
166
} finally {
- 167 6 if (conn != null ) {
+ 167 0 if (conn != null ) {
168
try {
- 169 6 conn.close();
+ 169 0 conn.close();
170 0 } catch (SQLException ex) {
171 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, "An error occured closing the connection" , ex);
- 172 6 }
+ 172 0 }
173
}
174
}
- 175 6 }
+ 175 0 }
176
177
@@ -313,20 +313,20 @@
182
public static synchronized void cleanup() {
- 183 6 if (driver != null ) {
+ 183 0 if (driver != null ) {
184
try {
- 185 6 DriverManager.deregisterDriver(driver);
+ 185 0 DriverManager.deregisterDriver(driver);
186 0 } catch (SQLException ex) {
187 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, "An error occured unloading the databse driver" , ex);
- 188 6 }
- 189 6 driver = null ;
+ 188 0 }
+ 189 0 driver = null ;
190
}
- 191 6 connectionString = null ;
- 192 6 userName = null ;
- 193 6 password = null ;
- 194 6 }
+ 191 0 connectionString = null ;
+ 192 0 userName = null ;
+ 193 0 password = null ;
+ 194 0 }
195
196
@@ -343,16 +343,16 @@
202
public static Connection getConnection() throws DatabaseException {
- 203 54 initialize();
- 204 54 Connection conn = null ;
+ 203 0 initialize();
+ 204 0 Connection conn = null ;
205
try {
- 206 54 conn = DriverManager.getConnection(connectionString, userName, password);
+ 206 0 conn = DriverManager.getConnection(connectionString, userName, password);
207 0 } catch (SQLException ex) {
208 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, null , ex);
209 0 throw new DatabaseException("Unable to connect to the database" );
- 210 54 }
- 211 54 return conn;
+ 210 0 }
+ 211 0 return conn;
212
}
213
@@ -373,12 +373,12 @@
221
private static String getConnectionString() throws IOException {
- 222 6 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE" );
- 223 6 if (connStr.contains("%s" )) {
- 224 6 final String directory = getDataDirectory().getCanonicalPath();
- 225 6 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION);
- 226 6 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, String.format("File path for H2 file: '%s'" , dataFile.toString()));
- 227 6 return String.format(connStr, dataFile.getAbsolutePath());
+ 222 0 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE" );
+ 223 0 if (connStr.contains("%s" )) {
+ 224 0 final String directory = getDataDirectory().getCanonicalPath();
+ 225 0 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION);
+ 226 0 Logger.getLogger(ConnectionFactory.class .getName()).log(Level.FINE, String.format("File path for H2 file: '%s'" , dataFile.toString()));
+ 227 0 return String.format(connStr, dataFile.getAbsolutePath());
228
}
229 0 return connStr;
@@ -402,15 +402,15 @@
239
public static File getDataDirectory() throws IOException {
- 240 12 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
- 241 12 if (!path.exists()) {
+ 240 0 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
+ 241 0 if (!path.exists()) {
242 0 if (!path.mkdirs()) {
243 0 throw new IOException("Unable to create NVD CVE Data directory" );
244
}
245
}
- 246 12 return path;
+ 246 0 return path;
247
}
248
@@ -429,10 +429,10 @@
255
private static boolean dbSchemaExists() throws IOException {
- 256 6 final File dir = getDataDirectory();
- 257 6 final String name = String.format("cve.%s.h2.db" , DB_SCHEMA_VERSION);
- 258 6 final File file = new File(dir, name);
- 259 6 return file.exists();
+ 256 0 final File dir = getDataDirectory();
+ 257 0 final String name = String.format("cve.%s.h2.db" , DB_SCHEMA_VERSION);
+ 258 0 final File file = new File(dir, name);
+ 259 0 return file.exists();
260
}
261
@@ -513,19 +513,19 @@
311
private static void ensureSchemaVersion(Connection conn) throws DatabaseException {
- 312 6 ResultSet rs = null ;
- 313 6 CallableStatement cs = null ;
+ 312 0 ResultSet rs = null ;
+ 313 0 CallableStatement cs = null ;
314
try {
- 315 6 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'" );
- 316 6 rs = cs.executeQuery();
- 317 6 if (rs.next()) {
- 318 6 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
- 319 6 if (isWrongSchema) {
+ 315 0 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'" );
+ 316 0 rs = cs.executeQuery();
+ 317 0 if (rs.next()) {
+ 318 0 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
+ 319 0 if (isWrongSchema) {
320 0 throw new DatabaseException("Incorrect database schema; unable to continue" );
321
}
- 322 6 } else {
+ 322 0 } else {
323 0 throw new DatabaseException("Database schema is missing" );
324
}
@@ -534,14 +534,14 @@
327 0 throw new DatabaseException("Unable to check the database schema version" );
328
} finally {
- 329 6 DBUtils.closeResultSet(rs);
- 330 6 DBUtils.closeStatement(cs);
- 331 6 }
- 332 6 }
+ 329 0 DBUtils.closeResultSet(rs);
+ 330 0 DBUtils.closeStatement(cs);
+ 331 0 }
+ 332 0 }
333
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
index 8cf533aeb..866b0a7cf 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
@@ -121,6 +121,6 @@
} }
@@ -151,10 +151,10 @@
67
- 68 27 DatabaseProperties(CveDB cveDB) {
- 69 27 this .cveDB = cveDB;
- 70 27 loadProperties();
- 71 27 }
+ 68 0 DatabaseProperties(CveDB cveDB) {
+ 69 0 this .cveDB = cveDB;
+ 70 0 loadProperties();
+ 71 0 }
72
73
@@ -165,8 +165,8 @@
76
private void loadProperties() {
- 77 27 this .properties = cveDB.getProperties();
- 78 27 }
+ 77 0 this .properties = cveDB.getProperties();
+ 78 0 }
79
80
@@ -181,7 +181,7 @@
85
public boolean isEmpty() {
- 86 1 return properties == null || properties.isEmpty();
+ 86 0 return properties == null || properties.isEmpty();
87
}
88
@@ -200,13 +200,13 @@
95
public void save(NvdCveInfo updatedValue) throws UpdateException {
- 96 1 if (updatedValue == null ) {
+ 96 0 if (updatedValue == null ) {
97 0 return ;
98
}
- 99 1 properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
- 100 1 cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
- 101 1 }
+ 99 0 properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+ 100 0 cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+ 101 0 }
102
103
@@ -225,7 +225,7 @@
110
public String getProperty(String key) {
- 111 2 return properties.getProperty(key);
+ 111 0 return properties.getProperty(key);
112
}
113
@@ -248,7 +248,7 @@
122
public String getProperty(String key, String defaultValue) {
- 123 1 return properties.getProperty(key, defaultValue);
+ 123 0 return properties.getProperty(key, defaultValue);
124
}
125
@@ -285,22 +285,22 @@
141
public Map getMetaData() {
- 142 1 final TreeMap map = new TreeMap();
- 143 1 for (Entry<Object, Object> entry : properties.entrySet()) {
- 144 16 final String key = (String) entry.getKey();
- 145 16 if (!"version" .equals(key)) {
- 146 15 if (key.startsWith("NVD CVE " )) {
+ 142 0 final TreeMap map = new TreeMap();
+ 143 0 for (Entry<Object, Object> entry : properties.entrySet()) {
+ 144 0 final String key = (String) entry.getKey();
+ 145 0 if (!"version" .equals(key)) {
+ 146 0 if (key.startsWith("NVD CVE " )) {
147
try {
- 148 15 final long epoch = Long.parseLong((String) entry.getValue());
- 149 15 final Date date = new Date(epoch);
- 150 15 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss" );
- 151 15 final String formatted = format.format(date);
- 152 15 map.put(key, formatted);
+ 148 0 final long epoch = Long.parseLong((String) entry.getValue());
+ 149 0 final Date date = new Date(epoch);
+ 150 0 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss" );
+ 151 0 final String formatted = format.format(date);
+ 152 0 map.put(key, formatted);
153 0 } catch (Throwable ex) {
154 0 Logger.getLogger(DatabaseProperties.class .getName()).log(Level.FINE, "Unable to parse timestamp from DB" , ex);
155 0 map.put(key, entry.getValue());
- 156 15 }
+ 156 0 }
157
} else {
158 0 map.put(key, entry.getValue());
@@ -308,14 +308,14 @@
} 160
}
- 161 16 }
- 162 1 return map;
+ 161 0 }
+ 162 0 return map;
163
}
164
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
index 22ff55d10..cd9b7af9d 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
@@ -137,6 +137,6 @@
}
@@ -124,8 +124,8 @@
53
public static Driver load(String className) throws DriverLoadException {
- 54 8 final ClassLoader loader = DriverLoader.class .getClassLoader();
- 55 8 return load(className, loader);
+ 54 0 final ClassLoader loader = DriverLoader.class .getClassLoader();
+ 55 0 return load(className, loader);
56
}
57
@@ -158,56 +158,56 @@
71
public static Driver load(String className, String pathToDriver) throws DriverLoadException {
- 72 4 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
- 73 4 final ArrayList<URL> urls = new ArrayList<URL>();
- 74 4 final String[] paths = pathToDriver.split(File.pathSeparator);
- 75 9 for (String path : paths) {
- 76 5 final File file = new File(path);
- 77 5 if (file.isDirectory()) {
- 78 2 final File[] files = file.listFiles();
+ 72 0 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
+ 73 0 final ArrayList<URL> urls = new ArrayList<URL>();
+ 74 0 final String[] paths = pathToDriver.split(File.pathSeparator);
+ 75 0 for (String path : paths) {
+ 76 0 final File file = new File(path);
+ 77 0 if (file.isDirectory()) {
+ 78 0 final File[] files = file.listFiles();
79
- 80 27 for (File f : files) {
+ 80 0 for (File f : files) {
81
try {
- 82 25 urls.add(f.toURI().toURL());
+ 82 0 urls.add(f.toURI().toURL());
83 0 } catch (MalformedURLException ex) {
84 0 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'" ,
85
className, f.getAbsoluteFile());
86 0 Logger.getLogger(DriverLoader.class .getName()).log(Level.FINE, msg, ex);
87 0 throw new DriverLoadException(msg, ex);
- 88 25 }
+ 88 0 }
89
}
- 90 2 } else if (file.exists()) {
+ 90 0 } else if (file.exists()) {
91
try {
- 92 2 urls.add(file.toURI().toURL());
+ 92 0 urls.add(file.toURI().toURL());
93 0 } catch (MalformedURLException ex) {
94 0 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'" ,
95
className, file.getAbsoluteFile());
96 0 Logger.getLogger(DriverLoader.class .getName()).log(Level.FINE, msg, ex);
97 0 throw new DriverLoadException(msg, ex);
- 98 2 }
+ 98 0 }
99
}
100
}
- 101 4 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
+ 101 0 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
102
@Override
103
public URLClassLoader run() {
- 104 4 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
+ 104 0 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
105
}
106
});
107
- 108 4 return load(className, loader);
+ 108 0 return load(className, loader);
109
}
110
@@ -232,19 +232,19 @@
private static Driver load(String className, ClassLoader loader) throws DriverLoadException {
120
try {
- 121 12 final Class c = Class.forName(className, true , loader);
+ 121 0 final Class c = Class.forName(className, true , loader);
122
- 123 9 final Driver driver = (Driver) c.newInstance();
- 124 9 final Driver shim = new DriverShim(driver);
+ 123 0 final Driver driver = (Driver) c.newInstance();
+ 124 0 final Driver shim = new DriverShim(driver);
125
- 126 9 DriverManager.registerDriver(shim);
- 127 9 return shim;
- 128 3 } catch (ClassNotFoundException ex) {
- 129 3 final String msg = String.format("Unable to load database driver '%s'" , className);
- 130 3 Logger.getLogger(DriverLoader.class .getName()).log(Level.FINE, msg, ex);
- 131 3 throw new DriverLoadException(msg, ex);
+ 126 0 DriverManager.registerDriver(shim);
+ 127 0 return shim;
+ 128 0 } catch (ClassNotFoundException ex) {
+ 129 0 final String msg = String.format("Unable to load database driver '%s'" , className);
+ 130 0 Logger.getLogger(DriverLoader.class .getName()).log(Level.FINE, msg, ex);
+ 131 0 throw new DriverLoadException(msg, ex);
132 0 } catch (InstantiationException ex) {
133 0 final String msg = String.format("Unable to load database driver '%s'" , className);
134 0 Logger.getLogger(DriverLoader.class .getName()).log(Level.FINE, msg, ex);
@@ -265,6 +265,6 @@
}
@@ -149,7 +149,7 @@
@Override 66
public boolean acceptsURL(String url) throws SQLException {
- 67 2 return this .driver.acceptsURL(url);
+ 67 0 return this .driver.acceptsURL(url);
68
}
69
@@ -381,13 +381,13 @@
@Override
197
public String toString() {
- 198 18 return "DriverShim{" + "driver=" + driver + '}' ;
+ 198 0 return "DriverShim{" + "driver=" + driver + '}' ;
199
}
200
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
index f7cb21a7b..98ff7d4cd 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
@@ -93,6 +93,6 @@
} } } } }
@@ -85,7 +85,7 @@
34
- 35 12 public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
+ 35 0 public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
36
37
@@ -94,7 +94,7 @@
39
- 40 5 private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
+ 40 0 private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
41
42
@@ -127,13 +127,13 @@
56
public boolean isUpdateNeeded() {
- 57 3 for (NvdCveInfo item : this ) {
- 58 4 if (item.getNeedsUpdate()) {
- 59 1 return true ;
+ 57 0 for (NvdCveInfo item : this ) {
+ 58 0 if (item.getNeedsUpdate()) {
+ 59 0 return true ;
60
}
- 61 3 }
- 62 2 return false ;
+ 61 0 }
+ 62 0 return false ;
63
}
64
@@ -160,8 +160,8 @@
75
public void add(String id, String url, String oldUrl) throws MalformedURLException, DownloadFailedException {
- 76 1 add(id, url, oldUrl, false );
- 77 1 }
+ 76 0 add(id, url, oldUrl, false );
+ 77 0 }
78
79
@@ -188,14 +188,14 @@
90
public void add(String id, String url, String oldUrl, boolean needsUpdate) throws MalformedURLException, DownloadFailedException {
- 91 9 final NvdCveInfo item = new NvdCveInfo();
- 92 9 item.setNeedsUpdate(needsUpdate);
- 93 9 item.setId(id);
- 94 9 item.setUrl(url);
- 95 9 item.setOldSchemaVersionUrl(oldUrl);
- 96 9 item.setTimestamp(Downloader.getLastModified(new URL(url)));
- 97 9 collection.put(id, item);
- 98 9 }
+ 91 0 final NvdCveInfo item = new NvdCveInfo();
+ 92 0 item.setNeedsUpdate(needsUpdate);
+ 93 0 item.setId(id);
+ 94 0 item.setUrl(url);
+ 95 0 item.setOldSchemaVersionUrl(oldUrl);
+ 96 0 item.setTimestamp(Downloader.getLastModified(new URL(url)));
+ 97 0 collection.put(id, item);
+ 98 0 }
99
100
@@ -206,8 +206,8 @@
103
public void clear() {
- 104 1 collection.clear();
- 105 1 }
+ 104 0 collection.clear();
+ 105 0 }
106
107
@@ -233,7 +233,7 @@
118
- 119 5 private Iterator<Entry<String, NvdCveInfo>> iterableContent = null ;
+ 119 0 private Iterator<Entry<String, NvdCveInfo>> iterableContent = null ;
120
121
@@ -256,8 +256,8 @@
@Override
130
public Iterator<NvdCveInfo> iterator() {
- 131 4 iterableContent = collection.entrySet().iterator();
- 132 4 return this ;
+ 131 0 iterableContent = collection.entrySet().iterator();
+ 132 0 return this ;
133
}
134
@@ -282,7 +282,7 @@
@Override
144
public boolean hasNext() {
- 145 10 return iterableContent.hasNext();
+ 145 0 return iterableContent.hasNext();
146
}
147
@@ -307,7 +307,7 @@
@Override
157
public NvdCveInfo next() {
- 158 7 return iterableContent.next().getValue();
+ 158 0 return iterableContent.next().getValue();
159
}
160
@@ -328,8 +328,8 @@
@Override
168
public void remove() {
- 169 1 iterableContent.remove();
- 170 1 }
+ 169 0 iterableContent.remove();
+ 170 0 }
171
172
@@ -346,7 +346,7 @@
178
NvdCveInfo get(String key) {
- 179 2 return collection.get(key);
+ 179 0 return collection.get(key);
180
}
181
@@ -362,6 +362,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
index 549e91a5d..296bbccab 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
@@ -119,6 +119,6 @@
} } } }
@@ -90,7 +90,7 @@
36
- 37 1 public class NvdCve12Handler extends DefaultHandler {
+ 37 0 public class NvdCve12Handler extends DefaultHandler {
38
39
@@ -139,21 +139,21 @@
61
- 62 1 private boolean skip = false ;
+ 62 0 private boolean skip = false ;
63
64
65
- 66 1 private boolean hasPreviousVersion = false ;
+ 66 0 private boolean hasPreviousVersion = false ;
67
68
69
- 70 1 private final Element current = new Element();
+ 70 0 private final Element current = new Element();
71
72
@@ -186,33 +186,33 @@
@Override
86
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
- 87 1222 current.setNode(qName);
- 88 1222 if (current.isEntryNode()) {
- 89 27 vendor = null ;
- 90 27 product = null ;
- 91 27 hasPreviousVersion = false ;
- 92 27 final String reject = attributes.getValue("reject" );
- 93 27 skip = "1" .equals(reject);
- 94 27 if (!skip) {
- 95 26 vulnerability = attributes.getValue("name" );
- 96 26 software = new ArrayList<VulnerableSoftware>();
+ 87 0 current.setNode(qName);
+ 88 0 if (current.isEntryNode()) {
+ 89 0 vendor = null ;
+ 90 0 product = null ;
+ 91 0 hasPreviousVersion = false ;
+ 92 0 final String reject = attributes.getValue("reject" );
+ 93 0 skip = "1" .equals(reject);
+ 94 0 if (!skip) {
+ 95 0 vulnerability = attributes.getValue("name" );
+ 96 0 software = new ArrayList<VulnerableSoftware>();
97
} else {
- 98 1 vulnerability = null ;
- 99 1 software = null ;
+ 98 0 vulnerability = null ;
+ 99 0 software = null ;
100
}
- 101 27 } else if (!skip && current.isProdNode()) {
+ 101 0 } else if (!skip && current.isProdNode()) {
102
- 103 52 vendor = attributes.getValue("vendor" );
- 104 52 product = attributes.getValue("name" );
- 105 1143 } else if (!skip && current.isVersNode()) {
- 106 761 final String prev = attributes.getValue("prev" );
- 107 761 if (prev != null && "1" .equals(prev)) {
- 108 1 hasPreviousVersion = true ;
- 109 1 final String edition = attributes.getValue("edition" );
- 110 1 final String num = attributes.getValue("num" );
+ 103 0 vendor = attributes.getValue("vendor" );
+ 104 0 product = attributes.getValue("name" );
+ 105 0 } else if (!skip && current.isVersNode()) {
+ 106 0 final String prev = attributes.getValue("prev" );
+ 107 0 if (prev != null && "1" .equals(prev)) {
+ 108 0 hasPreviousVersion = true ;
+ 109 0 final String edition = attributes.getValue("edition" );
+ 110 0 final String num = attributes.getValue("num" );
111
112
@@ -221,48 +221,48 @@
114
- 115 1 String cpe = "cpe:/a:" + vendor + ":" + product;
- 116 1 if (num != null ) {
- 117 1 cpe += ":" + num;
+ 115 0 String cpe = "cpe:/a:" + vendor + ":" + product;
+ 116 0 if (num != null ) {
+ 117 0 cpe += ":" + num;
118
}
- 119 1 if (edition != null ) {
+ 119 0 if (edition != null ) {
120 0 cpe += ":" + edition;
121
}
- 122 1 final VulnerableSoftware vs = new VulnerableSoftware();
- 123 1 vs.setCpe(cpe);
- 124 1 vs.setPreviousVersion(prev);
- 125 1 software.add(vs);
+ 122 0 final VulnerableSoftware vs = new VulnerableSoftware();
+ 123 0 vs.setCpe(cpe);
+ 124 0 vs.setPreviousVersion(prev);
+ 125 0 software.add(vs);
126
}
- 127 761 } else if (current.isNVDNode()) {
- 128 1 final String nvdVer = attributes.getValue("nvd_xml_version" );
- 129 1 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
+ 127 0 } else if (current.isNVDNode()) {
+ 128 0 final String nvdVer = attributes.getValue("nvd_xml_version" );
+ 129 0 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
130 0 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported" );
131
}
- 132 1 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
+ 132 0 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
133
}
- 134 1222 }
+ 134 0 }
135
136
@Override
137
public void endElement(String uri, String localName, String qName) throws SAXException {
- 138 1222 current.setNode(qName);
- 139 1222 if (current.isEntryNode()) {
- 140 27 if (!skip && hasPreviousVersion) {
- 141 1 vulnerabilities.put(vulnerability, software);
+ 138 0 current.setNode(qName);
+ 139 0 if (current.isEntryNode()) {
+ 140 0 if (!skip && hasPreviousVersion) {
+ 141 0 vulnerabilities.put(vulnerability, software);
142
}
- 143 27 vulnerability = null ;
- 144 27 software = null ;
+ 143 0 vulnerability = null ;
+ 144 0 software = null ;
145
}
- 146 1222 }
+ 146 0 }
147
148
@@ -273,7 +273,7 @@
151
- 152 1 protected static class Element {
+ 152 0 protected static class Element {
153
154
@@ -374,7 +374,7 @@
202
public boolean isNVDNode() {
- 203 382 return NVD.equals(node);
+ 203 0 return NVD.equals(node);
204
}
205
@@ -391,7 +391,7 @@
211
public boolean isEntryNode() {
- 212 2444 return ENTRY.equals(node);
+ 212 0 return ENTRY.equals(node);
213
}
214
@@ -425,7 +425,7 @@
229
public boolean isProdNode() {
- 230 1192 return PROD.equals(node);
+ 230 0 return PROD.equals(node);
231
}
232
@@ -442,7 +442,7 @@
238
public boolean isVersNode() {
- 239 1140 return VERS.equals(node);
+ 239 0 return VERS.equals(node);
240
}
241
@@ -453,6 +453,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html
index 0449ea322..12181df9c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html
@@ -12,8 +12,8 @@
@@ -98,7 +98,7 @@
40
- 41 1 public class NvdCve20Handler extends DefaultHandler {
+ 41 0 public class NvdCve20Handler extends DefaultHandler {
42
43
@@ -115,7 +115,7 @@
49
- 50 1 private final Element current = new Element();
+ 50 0 private final Element current = new Element();
51
52
@@ -146,7 +146,7 @@
65
- 66 1 private boolean hasApplicationCpe = false ;
+ 66 0 private boolean hasApplicationCpe = false ;
67
68
@@ -205,144 +205,144 @@
@Override
95
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
- 96 2412 current.setNode(qName);
- 97 2412 if (current.isEntryNode()) {
- 98 27 hasApplicationCpe = false ;
- 99 27 vulnerability = new Vulnerability();
- 100 27 vulnerability.setName(attributes.getValue("id" ));
- 101 2385 } else if (current.isVulnProductNode()) {
- 102 727 nodeText = new StringBuilder(100);
- 103 1658 } else if (current.isVulnReferencesNode()) {
- 104 90 final String lang = attributes.getValue("xml:lang" );
- 105 90 if ("en" .equals(lang)) {
- 106 90 reference = new Reference();
+ 96 0 current.setNode(qName);
+ 97 0 if (current.isEntryNode()) {
+ 98 0 hasApplicationCpe = false ;
+ 99 0 vulnerability = new Vulnerability();
+ 100 0 vulnerability.setName(attributes.getValue("id" ));
+ 101 0 } else if (current.isVulnProductNode()) {
+ 102 0 nodeText = new StringBuilder(100);
+ 103 0 } else if (current.isVulnReferencesNode()) {
+ 104 0 final String lang = attributes.getValue("xml:lang" );
+ 105 0 if ("en" .equals(lang)) {
+ 106 0 reference = new Reference();
107
} else {
108 0 reference = null ;
109
}
- 110 90 } else if (reference != null && current.isVulnReferenceNode()) {
- 111 90 reference.setUrl(attributes.getValue("href" ));
- 112 90 nodeText = new StringBuilder(130);
- 113 1478 } else if (reference != null && current.isVulnSourceNode()) {
- 114 90 nodeText = new StringBuilder(30);
- 115 1388 } else if (current.isVulnSummaryNode()) {
- 116 27 nodeText = new StringBuilder(500);
- 117 1361 } else if (current.isNVDNode()) {
- 118 1 final String nvdVer = attributes.getValue("nvd_xml_version" );
- 119 1 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
+ 110 0 } else if (reference != null && current.isVulnReferenceNode()) {
+ 111 0 reference.setUrl(attributes.getValue("href" ));
+ 112 0 nodeText = new StringBuilder(130);
+ 113 0 } else if (reference != null && current.isVulnSourceNode()) {
+ 114 0 nodeText = new StringBuilder(30);
+ 115 0 } else if (current.isVulnSummaryNode()) {
+ 116 0 nodeText = new StringBuilder(500);
+ 117 0 } else if (current.isNVDNode()) {
+ 118 0 final String nvdVer = attributes.getValue("nvd_xml_version" );
+ 119 0 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
120 0 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported" );
121
}
- 122 1 } else if (current.isVulnCWENode()) {
- 123 19 vulnerability.setCwe(attributes.getValue("id" ));
- 124 1341 } else if (current.isCVSSScoreNode()) {
- 125 26 nodeText = new StringBuilder(5);
- 126 1315 } else if (current.isCVSSAccessVectorNode()) {
- 127 26 nodeText = new StringBuilder(20);
- 128 1289 } else if (current.isCVSSAccessComplexityNode()) {
- 129 26 nodeText = new StringBuilder(20);
- 130 1263 } else if (current.isCVSSAuthenticationNode()) {
- 131 26 nodeText = new StringBuilder(20);
- 132 1237 } else if (current.isCVSSAvailabilityImpactNode()) {
- 133 26 nodeText = new StringBuilder(20);
- 134 1211 } else if (current.isCVSSConfidentialityImpactNode()) {
- 135 26 nodeText = new StringBuilder(20);
- 136 1185 } else if (current.isCVSSIntegrityImpactNode()) {
- 137 26 nodeText = new StringBuilder(20);
+ 122 0 } else if (current.isVulnCWENode()) {
+ 123 0 vulnerability.setCwe(attributes.getValue("id" ));
+ 124 0 } else if (current.isCVSSScoreNode()) {
+ 125 0 nodeText = new StringBuilder(5);
+ 126 0 } else if (current.isCVSSAccessVectorNode()) {
+ 127 0 nodeText = new StringBuilder(20);
+ 128 0 } else if (current.isCVSSAccessComplexityNode()) {
+ 129 0 nodeText = new StringBuilder(20);
+ 130 0 } else if (current.isCVSSAuthenticationNode()) {
+ 131 0 nodeText = new StringBuilder(20);
+ 132 0 } else if (current.isCVSSAvailabilityImpactNode()) {
+ 133 0 nodeText = new StringBuilder(20);
+ 134 0 } else if (current.isCVSSConfidentialityImpactNode()) {
+ 135 0 nodeText = new StringBuilder(20);
+ 136 0 } else if (current.isCVSSIntegrityImpactNode()) {
+ 137 0 nodeText = new StringBuilder(20);
138
}
- 139 2412 }
+ 139 0 }
140
141
@Override
142
public void characters(char [] ch, int start, int length) throws SAXException {
- 143 3987 if (nodeText != null ) {
- 144 1142 nodeText.append(ch, start, length);
+ 143 0 if (nodeText != null ) {
+ 144 0 nodeText.append(ch, start, length);
145
}
- 146 3987 }
+ 146 0 }
147
148
@Override
149
public void endElement(String uri, String localName, String qName) throws SAXException {
- 150 2412 current.setNode(qName);
- 151 2412 if (current.isEntryNode()) {
- 152 27 totalNumberOfEntries += 1;
- 153 27 if (hasApplicationCpe) {
- 154 19 totalNumberOfApplicationEntries += 1;
+ 150 0 current.setNode(qName);
+ 151 0 if (current.isEntryNode()) {
+ 152 0 totalNumberOfEntries += 1;
+ 153 0 if (hasApplicationCpe) {
+ 154 0 totalNumberOfApplicationEntries += 1;
155
try {
- 156 19 saveEntry(vulnerability);
+ 156 0 saveEntry(vulnerability);
157 0 } catch (DatabaseException ex) {
158 0 throw new SAXException(ex);
159 0 } catch (CorruptIndexException ex) {
160 0 throw new SAXException(ex);
161 0 } catch (IOException ex) {
162 0 throw new SAXException(ex);
- 163 19 }
+ 163 0 }
164
}
- 165 27 vulnerability = null ;
- 166 2385 } else if (current.isCVSSScoreNode()) {
+ 165 0 vulnerability = null ;
+ 166 0 } else if (current.isCVSSScoreNode()) {
167
try {
- 168 26 final float score = Float.parseFloat(nodeText.toString());
- 169 26 vulnerability.setCvssScore(score);
+ 168 0 final float score = Float.parseFloat(nodeText.toString());
+ 169 0 vulnerability.setCvssScore(score);
170 0 } catch (NumberFormatException ex) {
171 0 Logger.getLogger(NvdCve20Handler.class .getName()).log(Level.SEVERE, "Error parsing CVSS Score." );
172 0 Logger.getLogger(NvdCve20Handler.class .getName()).log(Level.FINE, null , ex);
- 173 26 }
- 174 26 nodeText = null ;
- 175 2359 } else if (current.isCVSSAccessVectorNode()) {
- 176 26 vulnerability.setCvssAccessVector(nodeText.toString());
- 177 26 nodeText = null ;
- 178 2333 } else if (current.isCVSSAccessComplexityNode()) {
- 179 26 vulnerability.setCvssAccessComplexity(nodeText.toString());
- 180 26 nodeText = null ;
- 181 2307 } else if (current.isCVSSAuthenticationNode()) {
- 182 26 vulnerability.setCvssAuthentication(nodeText.toString());
- 183 26 nodeText = null ;
- 184 2281 } else if (current.isCVSSAvailabilityImpactNode()) {
- 185 26 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
- 186 26 nodeText = null ;
- 187 2255 } else if (current.isCVSSConfidentialityImpactNode()) {
- 188 26 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
- 189 26 nodeText = null ;
- 190 2229 } else if (current.isCVSSIntegrityImpactNode()) {
- 191 26 vulnerability.setCvssIntegrityImpact(nodeText.toString());
- 192 26 nodeText = null ;
- 193 2203 } else if (current.isVulnProductNode()) {
- 194 727 final String cpe = nodeText.toString();
- 195 727 if (cpe.startsWith("cpe:/a:" )) {
- 196 614 hasApplicationCpe = true ;
- 197 614 vulnerability.addVulnerableSoftware(cpe);
+ 173 0 }
+ 174 0 nodeText = null ;
+ 175 0 } else if (current.isCVSSAccessVectorNode()) {
+ 176 0 vulnerability.setCvssAccessVector(nodeText.toString());
+ 177 0 nodeText = null ;
+ 178 0 } else if (current.isCVSSAccessComplexityNode()) {
+ 179 0 vulnerability.setCvssAccessComplexity(nodeText.toString());
+ 180 0 nodeText = null ;
+ 181 0 } else if (current.isCVSSAuthenticationNode()) {
+ 182 0 vulnerability.setCvssAuthentication(nodeText.toString());
+ 183 0 nodeText = null ;
+ 184 0 } else if (current.isCVSSAvailabilityImpactNode()) {
+ 185 0 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
+ 186 0 nodeText = null ;
+ 187 0 } else if (current.isCVSSConfidentialityImpactNode()) {
+ 188 0 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
+ 189 0 nodeText = null ;
+ 190 0 } else if (current.isCVSSIntegrityImpactNode()) {
+ 191 0 vulnerability.setCvssIntegrityImpact(nodeText.toString());
+ 192 0 nodeText = null ;
+ 193 0 } else if (current.isVulnProductNode()) {
+ 194 0 final String cpe = nodeText.toString();
+ 195 0 if (cpe.startsWith("cpe:/a:" )) {
+ 196 0 hasApplicationCpe = true ;
+ 197 0 vulnerability.addVulnerableSoftware(cpe);
198
}
- 199 727 nodeText = null ;
- 200 727 } else if (reference != null && current.isVulnReferencesNode()) {
- 201 90 vulnerability.addReference(reference);
- 202 90 reference = null ;
- 203 1386 } else if (reference != null && current.isVulnReferenceNode()) {
- 204 90 reference.setName(nodeText.toString());
- 205 90 nodeText = null ;
- 206 1296 } else if (reference != null && current.isVulnSourceNode()) {
- 207 90 reference.setSource(nodeText.toString());
- 208 90 nodeText = null ;
- 209 1206 } else if (current.isVulnSummaryNode()) {
- 210 27 vulnerability.setDescription(nodeText.toString());
- 211 27 if (nodeText.indexOf("** REJECT **" ) >= 0) {
- 212 1 hasApplicationCpe = true ;
+ 199 0 nodeText = null ;
+ 200 0 } else if (reference != null && current.isVulnReferencesNode()) {
+ 201 0 vulnerability.addReference(reference);
+ 202 0 reference = null ;
+ 203 0 } else if (reference != null && current.isVulnReferenceNode()) {
+ 204 0 reference.setName(nodeText.toString());
+ 205 0 nodeText = null ;
+ 206 0 } else if (reference != null && current.isVulnSourceNode()) {
+ 207 0 reference.setSource(nodeText.toString());
+ 208 0 nodeText = null ;
+ 209 0 } else if (current.isVulnSummaryNode()) {
+ 210 0 vulnerability.setDescription(nodeText.toString());
+ 211 0 if (nodeText.indexOf("** REJECT **" ) >= 0) {
+ 212 0 hasApplicationCpe = true ;
213
}
- 214 27 nodeText = null ;
+ 214 0 nodeText = null ;
215
}
- 216 2412 }
+ 216 0 }
217
218
@@ -415,8 +415,8 @@
252
private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException {
- 253 19 if (cveDB == null ) {
- 254 19 return ;
+ 253 0 if (cveDB == null ) {
+ 254 0 return ;
255
}
256 0 final String cveName = vuln.getName();
@@ -439,7 +439,7 @@
269
- 270 1 protected static class Element {
+ 270 0 protected static class Element {
271
272
@@ -620,7 +620,7 @@
360
public boolean isNVDNode() {
- 361 1361 return NVD.equals(node);
+ 361 0 return NVD.equals(node);
362
}
363
@@ -637,7 +637,7 @@
369
public boolean isEntryNode() {
- 370 4824 return ENTRY.equals(node);
+ 370 0 return ENTRY.equals(node);
371
}
372
@@ -654,7 +654,7 @@
378
public boolean isVulnProductNode() {
- 379 4588 return VULN_PRODUCT.equals(node);
+ 379 0 return VULN_PRODUCT.equals(node);
380
}
381
@@ -671,7 +671,7 @@
387
public boolean isVulnReferencesNode() {
- 388 1928 return VULN_REFERENCES.equals(node);
+ 388 0 return VULN_REFERENCES.equals(node);
389
}
390
@@ -688,7 +688,7 @@
396
public boolean isVulnReferenceNode() {
- 397 360 return VULN_REFERENCE.equals(node);
+ 397 0 return VULN_REFERENCE.equals(node);
398
}
399
@@ -705,7 +705,7 @@
405
public boolean isVulnSourceNode() {
- 406 180 return VULN_SOURCE.equals(node);
+ 406 0 return VULN_SOURCE.equals(node);
407
}
408
@@ -722,7 +722,7 @@
414
public boolean isVulnSummaryNode() {
- 415 2594 return VULN_SUMMARY.equals(node);
+ 415 0 return VULN_SUMMARY.equals(node);
416
}
417
@@ -739,7 +739,7 @@
423
public boolean isVulnCWENode() {
- 424 1360 return VULN_CWE.equals(node);
+ 424 0 return VULN_CWE.equals(node);
425
}
426
@@ -756,7 +756,7 @@
432
public boolean isCVSSScoreNode() {
- 433 3726 return CVSS_SCORE.equals(node);
+ 433 0 return CVSS_SCORE.equals(node);
434
}
435
@@ -773,7 +773,7 @@
441
public boolean isCVSSAccessVectorNode() {
- 442 3674 return CVSS_ACCESS_VECTOR.equals(node);
+ 442 0 return CVSS_ACCESS_VECTOR.equals(node);
443
}
444
@@ -790,7 +790,7 @@
450
public boolean isCVSSAccessComplexityNode() {
- 451 3622 return CVSS_ACCESS_COMPLEXITY.equals(node);
+ 451 0 return CVSS_ACCESS_COMPLEXITY.equals(node);
452
}
453
@@ -807,7 +807,7 @@
459
public boolean isCVSSAuthenticationNode() {
- 460 3570 return CVSS_AUTHENTICATION.equals(node);
+ 460 0 return CVSS_AUTHENTICATION.equals(node);
461
}
462
@@ -824,7 +824,7 @@
468
public boolean isCVSSConfidentialityImpactNode() {
- 469 3466 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
+ 469 0 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
470
}
471
@@ -841,7 +841,7 @@
477
public boolean isCVSSIntegrityImpactNode() {
- 478 3414 return CVSS_INTEGRITY_IMPACT.equals(node);
+ 478 0 return CVSS_INTEGRITY_IMPACT.equals(node);
479
}
480
@@ -858,7 +858,7 @@
486
public boolean isCVSSAvailabilityImpactNode() {
- 487 3518 return CVSS_AVAILABILITY_IMPACT.equals(node);
+ 487 0 return CVSS_AVAILABILITY_IMPACT.equals(node);
488
}
489
@@ -869,6 +869,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html
index 72a0d63a0..eb41b5de0 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html
@@ -12,7 +12,7 @@
@@ -65,7 +65,7 @@
24
- 25 72 public enum Confidence {
+ 25 0 public enum Confidence {
26
27
@@ -74,32 +74,32 @@
29
- 30 1 HIGHEST,
+ 30 0 HIGHEST,
31
32
33
- 34 1 HIGH,
+ 34 0 HIGH,
35
36
37
- 38 1 MEDIUM,
+ 38 0 MEDIUM,
39
40
41
- 42 1 LOW
+ 42 0 LOW
43
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html
index d535e3778..87694aa73 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html
@@ -12,7 +12,7 @@
@@ -91,7 +91,7 @@
37
- 38 25 public class Dependency implements Comparable<Dependency> {
+ 38 0 public class Dependency implements Comparable<Dependency> {
39
40
@@ -182,13 +182,13 @@
83
- 84 72 public Dependency() {
- 85 72 vendorEvidence = new EvidenceCollection();
- 86 72 productEvidence = new EvidenceCollection();
- 87 72 versionEvidence = new EvidenceCollection();
- 88 72 identifiers = new TreeSet<Identifier>();
- 89 72 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
- 90 72 }
+ 84 0 public Dependency() {
+ 85 0 vendorEvidence = new EvidenceCollection();
+ 86 0 productEvidence = new EvidenceCollection();
+ 87 0 versionEvidence = new EvidenceCollection();
+ 88 0 identifiers = new TreeSet<Identifier>();
+ 89 0 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
+ 90 0 }
91
92
@@ -203,13 +203,13 @@
97
public Dependency(File file) {
- 98 51 this ();
- 99 51 this .actualFilePath = file.getPath();
- 100 51 this .filePath = this .actualFilePath;
- 101 51 this .fileName = file.getName();
- 102 51 this .fileExtension = FileUtils.getFileExtension(fileName);
- 103 51 determineHashes(file);
- 104 51 }
+ 98 0 this ();
+ 99 0 this .actualFilePath = file.getPath();
+ 100 0 this .filePath = this .actualFilePath;
+ 101 0 this .fileName = file.getName();
+ 102 0 this .fileExtension = FileUtils.getFileExtension(fileName);
+ 103 0 determineHashes(file);
+ 104 0 }
105
106
@@ -219,7 +219,7 @@
108
109
-
+ 110
111
@@ -233,815 +233,834 @@
115
116
-
+ 117
-
+ 118
-
+ 119
-
+ 120
- public void setFileName(String fileName) {
+ 121
- this .fileName = fileName;
- 122
- }
+ public String getFileNameForJavaScript() { 122 0 return this .fileName.replace("\\" , "\\\\" );
123
-
+ } 124
-
+ 125
-
+ 126
-
- 127
-
- 128
-
- 129
- public void setActualFilePath(String actualFilePath) {
- 130 2 this .actualFilePath = actualFilePath;
- 131 2 if (this .sha1sum == null ) {
- 132 2 final File file = new File(this .actualFilePath);
- 133 2 determineHashes(file);
- 134
- }
- 135 2 }
- 136
-
- 137
-
- 138
-
- 139
-
- 140
-
- 141
-
- 142
- public String getActualFilePath() {
- 143
- return this .actualFilePath;
- 144
- }
- 145
-
- 146
-
- 147
-
- 148
-
- 149
-
- 150
-
- 151
- public File getActualFile() {
- 152 0 return new File(this .actualFilePath);
- 153
- }
- 154
-
- 155
-
- 156
-
- 157
-
- 158
-
- 159
-
- 160
- public void setFilePath(String filePath) {
- 161
- this .filePath = filePath;
- 162
- }
- 163
-
- 164
-
- 165
-
- 166
-
- 167
-
- 168
-
- 169
-
- 170
-
- 171
-
- 172
-
- 173
- public String getFilePath() {
- 174
- return this .filePath;
- 175
- }
- 176
-
- 177
-
- 178
+ 127
+
+ 128
+
+ 129
+
+ 130
+ public void setFileName(String fileName) {
+ 131
+ this .fileName = fileName;
+ 132
+ }
+ 133
+
+ 134
+
+ 135
+
+ 136
+
+ 137
+
+ 138
+
+ 139
+ public void setActualFilePath(String actualFilePath) {
+ 140 0 this .actualFilePath = actualFilePath;
+ 141 0 if (this .sha1sum == null ) {
+ 142 0 final File file = new File(this .actualFilePath);
+ 143 0 determineHashes(file);
+ 144
+ }
+ 145 0 }
+ 146
+
+ 147
+
+ 148
+
+ 149
+
+ 150
+
+ 151
+
+ 152
+ public String getActualFilePath() {
+ 153
+ return this .actualFilePath;
+ 154
+ }
+ 155
+
+ 156
+
+ 157
+
+ 158
+
+ 159
+
+ 160
+
+ 161
+ public File getActualFile() {
+ 162 0 return new File(this .actualFilePath);
+ 163
+ }
+ 164
+
+ 165
+
+ 166
+
+ 167
+
+ 168
+
+ 169
+
+ 170
+ public void setFilePath(String filePath) {
+ 171
+ this .filePath = filePath;
+ 172
+ }
+ 173
+
+ 174
+
+ 175
+
+ 176
+
+ 177
+
+ 178
+
179
-
+ 180
-
+ 181
-
+ 182
- public void setFileExtension(String fileExtension) {
+ 183
- this .fileExtension = fileExtension;
+ public String getFilePath() { 184
- }
+ return this .filePath; 185
-
+ } 186
-
+ 187
-
+ 188
-
+ 189
-
+ 190
-
+ 191
- public String getFileExtension() {
+ 192
- return this .fileExtension;
+ public void setFileExtension(String fileExtension) { 193
- }
+ this .fileExtension = fileExtension; 194
-
+ } 195
-
+ 196
-
+ 197
-
+ 198
-
+ 199
-
+ 200
- public String getMd5sum() {
+ 201
- return this .md5sum;
+ public String getFileExtension() { 202
- }
+ return this .fileExtension; 203
-
+ } 204
-
+ 205
-
+ 206
-
+ 207
-
+ 208
-
+ 209
- public void setMd5sum(String md5sum) {
+ 210
- this .md5sum = md5sum;
+ public String getMd5sum() { 211
- }
+ return this .md5sum; 212
-
+ } 213
-
+ 214
-
+ 215
-
+ 216
-
+ 217
-
+ 218
- public String getSha1sum() {
+ 219
- return this .sha1sum;
+ public void setMd5sum(String md5sum) { 220
- }
+ this .md5sum = md5sum; 221
-
+ } 222
-
+ 223
-
+ 224
-
+ 225
-
+ 226
-
+ 227
- public void setSha1sum(String sha1sum) {
+ 228
- this .sha1sum = sha1sum;
+ public String getSha1sum() { 229
- }
+ return this .sha1sum; 230
-
+ } 231
-
+ 232
-
+ 233
-
+ 234
-
+ 235
-
+ 236
- public Set<Identifier> getIdentifiers() {
+ 237
- return this .identifiers;
+ public void setSha1sum(String sha1sum) { 238
- }
+ this .sha1sum = sha1sum; 239
-
+ } 240
-
+ 241
-
+ 242
-
+ 243
-
+ 244
-
+ 245
- public void setIdentifiers(Set<Identifier> identifiers) {
+ 246
- this .identifiers = identifiers;
+ public Set<Identifier> getIdentifiers() { 247
- }
+ return this .identifiers; 248
-
+ } 249
-
+ 250
-
+ 251
-
+ 252
-
+ 253
-
+ 254
-
+ 255
-
+ public void setIdentifiers(Set<Identifier> identifiers) { 256
- public void addIdentifier(String type, String value, String url) {
- 257 6 final Identifier i = new Identifier(type, value, url);
- 258 6 this .identifiers.add(i);
- 259 6 }
+ this .identifiers = identifiers; 257
+ }
+ 258
+
+ 259
+
260
-
+ 261
-
+ 262
-
- 263
-
- 264
- 265
+ 263
- 266
+ 264
- 267
-
- 268
+ 265
- 269
- public void addIdentifier(String type, String value, String url, Confidence confidence) {
- 270 0 final Identifier i = new Identifier(type, value, url);
- 271 0 i.setConfidence(confidence);
- 272 0 this .identifiers.add(i);
- 273 0 }
- 274
+ 266
+ public void addIdentifier(String type, String value, String url) {
+ 267 0 final Identifier i = new Identifier(type, value, url);
+ 268 0 this .identifiers.add(i);
+ 269 0 }
+ 270
- 275
+ 271
- 276
+ 272
+ 273
+
+ 274
+
+ 275
+
+ 276
+
277
-
+ 278
-
+ 279
-
- 280
- public void addIdentifier(Identifier identifier) {
- 281 88 this .identifiers.add(identifier);
- 282 88 }
- 283
-
+ public void addIdentifier(String type, String value, String url, Confidence confidence) { 280 0 final Identifier i = new Identifier(type, value, url);
+ 281 0 i.setConfidence(confidence);
+ 282 0 this .identifiers.add(i);
+ 283 0 }
284
-
+ 285
-
+ 286
-
+ 287
-
+ 288
-
+ 289
- public EvidenceCollection getEvidence() {
- 290 1 return EvidenceCollection.merge(this .productEvidence, this .vendorEvidence, this .versionEvidence);
- 291
- }
- 292
-
+ 290
+ public void addIdentifier(Identifier identifier) {
+ 291 0 this .identifiers.add(identifier);
+ 292 0 }
293
-
+ 294
-
+ 295
-
+ 296
-
+ 297
-
+ 298
- public EvidenceCollection getEvidenceUsed() {
- 299 4 return EvidenceCollection.mergeUsed(this .productEvidence, this .vendorEvidence, this .versionEvidence);
- 300
- }
+ 299
+ public EvidenceCollection getEvidence() {
+ 300 0 return EvidenceCollection.merge(this .productEvidence, this .vendorEvidence, this .versionEvidence);
301
-
+ } 302
-
+ 303
-
+ 304
-
+ 305
-
+ 306
-
+ 307
- public EvidenceCollection getVendorEvidence() {
+ 308
- return this .vendorEvidence;
- 309
- }
+ public EvidenceCollection getEvidenceUsed() { 309 0 return EvidenceCollection.mergeUsed(this .productEvidence, this .vendorEvidence, this .versionEvidence);
310
-
+ } 311
-
+ 312
-
+ 313
-
+ 314
-
+ 315
-
- 316
- public EvidenceCollection getProductEvidence() {
- 317
- return this .productEvidence;
- 318
- }
- 319
-
- 320
-
- 321
-
- 322
-
- 323
+ 316
+
+ 317
+ public EvidenceCollection getVendorEvidence() {
+ 318
+ return this .vendorEvidence;
+ 319
+ }
+ 320
+
+ 321
+
+ 322
+
+ 323
+
324
-
+ 325
- public EvidenceCollection getVersionEvidence() {
+ 326
- return this .versionEvidence;
+ public EvidenceCollection getProductEvidence() { 327
- }
+ return this .productEvidence; 328
-
+ } 329
-
+ 330
-
+ 331
- private String description;
+ 332
-
+ 333
-
+ 334
-
+ 335
-
+ public EvidenceCollection getVersionEvidence() { 336
-
+ return this .versionEvidence; 337
-
+ } 338
- public String getDescription() {
+ 339
- return description;
+ 340
- }
+ 341
-
+ private String description; 342
-
+ 343
-
+ 344
-
+ 345
-
+ 346
-
+ 347
- public void setDescription(String description) {
+ 348
- this .description = description;
+ public String getDescription() { 349
- }
+ return description; 350
-
+ } 351
-
+ 352
-
+ 353
- private String license;
+ 354
-
+ 355
-
+ 356
-
+ 357
-
+ public void setDescription(String description) { 358
-
+ this .description = description; 359
-
+ } 360
- public String getLicense() {
+ 361
- return license;
+ 362
- }
+ 363
-
+ private String license; 364
-
+ 365
-
+ 366
-
+ 367
-
+ 368
-
+ 369
- public void setLicense(String license) {
+ 370
- this .license = license;
+ public String getLicense() { 371
- }
+ return license; 372
-
+ } 373
-
+ 374
-
+ 375
- private SortedSet<Vulnerability> vulnerabilities;
+ 376
-
+ 377
-
+ 378
-
+ 379
-
+ public void setLicense(String license) { 380
-
+ this .license = license; 381
-
+ } 382
- public SortedSet<Vulnerability> getVulnerabilities() {
+ 383
- return vulnerabilities;
+ 384
- }
+ 385
-
+ private SortedSet<Vulnerability> vulnerabilities; 386
-
+ 387
-
+ 388
-
+ 389
-
+ 390
-
+ 391
- public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
+ 392
- this .vulnerabilities = vulnerabilities;
+ public SortedSet<Vulnerability> getVulnerabilities() { 393
- }
+ return vulnerabilities; 394
-
+ } 395
-
+ 396
-
+ 397
-
+ 398
-
+ 399
-
+ 400
- private void determineHashes(File file) {
- 401 53 String md5 = null ;
- 402 53 String sha1 = null ;
+ 401
+ public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
+ 402
+ this .vulnerabilities = vulnerabilities;
403
+ }
+ 404
+
+ 405
+
+ 406
+
+ 407
+
+ 408
+
+ 409
+
+ 410
+ private void determineHashes(File file) {
+ 411 0 String md5 = null ;
+ 412 0 String sha1 = null ;
+ 413
try {
- 404 53 md5 = Checksum.getMD5Checksum(file);
- 405 50 sha1 = Checksum.getSHA1Checksum(file);
- 406 3 } catch (IOException ex) {
- 407 3 final String msg = String.format("Unable to read '%s' to determine hashes." , file.getName());
- 408 3 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
- 409 3 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
- 410 0 } catch (NoSuchAlgorithmException ex) {
- 411 0 final String msg = "Unable to use MD5 of SHA1 checksums." ;
- 412 0 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
- 413 0 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
- 414 53 }
- 415 53 this .setMd5sum(md5);
- 416 53 this .setSha1sum(sha1);
- 417 53 }
- 418
-
- 419
-
- 420
-
- 421
-
- 422
-
- 423
-
- 424
- public void addVulnerability(Vulnerability vulnerability) {
- 425 3 this .vulnerabilities.add(vulnerability);
- 426 3 }
- 427
-
+ 414 0 md5 = Checksum.getMD5Checksum(file);
+ 415 0 sha1 = Checksum.getSHA1Checksum(file);
+ 416 0 } catch (IOException ex) {
+ 417 0 final String msg = String.format("Unable to read '%s' to determine hashes." , file.getName());
+ 418 0 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
+ 419 0 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
+ 420 0 } catch (NoSuchAlgorithmException ex) {
+ 421 0 final String msg = "Unable to use MD5 of SHA1 checksums." ;
+ 422 0 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
+ 423 0 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
+ 424 0 }
+ 425 0 this .setMd5sum(md5);
+ 426 0 this .setSha1sum(sha1);
+ 427 0 }
428
-
+ 429
-
- 430 72 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
+ 430
+
431
-
+ 432
-
+ 433
-
+ 434
-
- 435
-
- 436
-
+ public void addVulnerability(Vulnerability vulnerability) { 435 0 this .vulnerabilities.add(vulnerability);
+ 436 0 }
437
- public Set<Dependency> getRelatedDependencies() {
+ 438
- return relatedDependencies;
+ 439
- }
- 440
-
+ 440 0 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
441
-
+ 442
-
+ 443
-
+ 444
-
+ 445
-
+ 446
- public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
- 447
- this .relatedDependencies = relatedDependencies;
- 448
- }
- 449
-
- 450
-
- 451
-
- 452
-
- 453
-
- 454
- 455
- public void addRelatedDependency(Dependency dependency) {
- 456 0 relatedDependencies.add(dependency);
- 457 0 }
- 458
+ 447
+ public Set<Dependency> getRelatedDependencies() {
+ 448
+ return relatedDependencies;
+ 449
+ }
+ 450
- 459
+ 451
- 460
-
- 461
+ 452
+
+ 453
+ 454
+
+ 455
+
+ 456
+ public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
+ 457
+ this .relatedDependencies = relatedDependencies;
+ 458
+ }
+ 459
+
+ 460
+
+ 461
+
462
-
+ 463
-
+ 464
465
- public int compareTo(Dependency o) {
- 466 25 return this .getFileName().compareToIgnoreCase(o.getFileName());
- 467
- }
+ public void addRelatedDependency(Dependency dependency) { 466 0 relatedDependencies.add(dependency);
+ 467 0 }
468
469
470
-
+ 471
472
-
+ 473
-
+ 474
475
- @Override
- 476
- public boolean equals(Object obj) {
- 477 0 if (obj == null ) {
- 478 0 return false ;
+ public int compareTo(Dependency o) { 476 0 return this .getFileName().compareToIgnoreCase(o.getFileName());
+ 477
+ }
+ 478
+
479
- }
- 480 0 if (getClass() != obj.getClass()) {
- 481 0 return false ;
+ 480
+
+ 481
+
482
- }
- 483 0 final Dependency other = (Dependency) obj;
- 484 0 if ((this .actualFilePath == null ) ? (other.actualFilePath != null ) : !this .actualFilePath.equals(other.actualFilePath)) {
- 485 0 return false ;
+ 483
+
+ 484
+
+ 485
+ @Override
486
- }
- 487 0 if ((this .filePath == null ) ? (other.filePath != null ) : !this .filePath.equals(other.filePath)) {
+ public boolean equals(Object obj) { 487 0 if (obj == null ) {
488 0 return false ;
489
}
- 490 0 if ((this .fileName == null ) ? (other.fileName != null ) : !this .fileName.equals(other.fileName)) {
+ 490 0 if (getClass() != obj.getClass()) {
491 0 return false ;
492
}
- 493 0 if ((this .fileExtension == null ) ? (other.fileExtension != null ) : !this .fileExtension.equals(other.fileExtension)) {
- 494 0 return false ;
- 495
+ 493 0 final Dependency other = (Dependency) obj;
+ 494 0 if ((this .actualFilePath == null ) ? (other.actualFilePath != null ) : !this .actualFilePath.equals(other.actualFilePath)) {
+ 495 0 return false ;
+ 496
}
- 496 0 if ((this .md5sum == null ) ? (other.md5sum != null ) : !this .md5sum.equals(other.md5sum)) {
- 497 0 return false ;
- 498
+ 497 0 if ((this .filePath == null ) ? (other.filePath != null ) : !this .filePath.equals(other.filePath)) {
+ 498 0 return false ;
+ 499
}
- 499 0 if ((this .sha1sum == null ) ? (other.sha1sum != null ) : !this .sha1sum.equals(other.sha1sum)) {
- 500 0 return false ;
- 501
+ 500 0 if ((this .fileName == null ) ? (other.fileName != null ) : !this .fileName.equals(other.fileName)) {
+ 501 0 return false ;
+ 502
}
- 502 0 if (this .identifiers != other.identifiers && (this .identifiers == null || !this .identifiers.equals(other.identifiers))) {
- 503 0 return false ;
- 504
+ 503 0 if ((this .fileExtension == null ) ? (other.fileExtension != null ) : !this .fileExtension.equals(other.fileExtension)) {
+ 504 0 return false ;
+ 505
}
- 505 0 if (this .vendorEvidence != other.vendorEvidence && (this .vendorEvidence == null || !this .vendorEvidence.equals(other.vendorEvidence))) {
- 506 0 return false ;
- 507
+ 506 0 if ((this .md5sum == null ) ? (other.md5sum != null ) : !this .md5sum.equals(other.md5sum)) {
+ 507 0 return false ;
+ 508
}
- 508 0 if (this .productEvidence != other.productEvidence && (this .productEvidence == null || !this .productEvidence.equals(other.productEvidence))) {
- 509 0 return false ;
- 510
+ 509 0 if ((this .sha1sum == null ) ? (other.sha1sum != null ) : !this .sha1sum.equals(other.sha1sum)) {
+ 510 0 return false ;
+ 511
}
- 511 0 if (this .versionEvidence != other.versionEvidence && (this .versionEvidence == null || !this .versionEvidence.equals(other.versionEvidence))) {
- 512 0 return false ;
- 513
+ 512 0 if (this .identifiers != other.identifiers && (this .identifiers == null || !this .identifiers.equals(other.identifiers))) {
+ 513 0 return false ;
+ 514
}
- 514 0 if ((this .description == null ) ? (other.description != null ) : !this .description.equals(other.description)) {
- 515 0 return false ;
- 516
+ 515 0 if (this .vendorEvidence != other.vendorEvidence && (this .vendorEvidence == null || !this .vendorEvidence.equals(other.vendorEvidence))) {
+ 516 0 return false ;
+ 517
}
- 517 0 if ((this .license == null ) ? (other.license != null ) : !this .license.equals(other.license)) {
- 518 0 return false ;
- 519
+ 518 0 if (this .productEvidence != other.productEvidence && (this .productEvidence == null || !this .productEvidence.equals(other.productEvidence))) {
+ 519 0 return false ;
+ 520
}
- 520 0 if (this .vulnerabilities != other.vulnerabilities && (this .vulnerabilities == null || !this .vulnerabilities.equals(other.vulnerabilities))) {
- 521 0 return false ;
- 522
+ 521 0 if (this .versionEvidence != other.versionEvidence && (this .versionEvidence == null || !this .versionEvidence.equals(other.versionEvidence))) {
+ 522 0 return false ;
+ 523
}
- 523 0 if (this .relatedDependencies != other.relatedDependencies
- 524
- && (this .relatedDependencies == null || !this .relatedDependencies.equals(other.relatedDependencies))) {
+ 524 0 if ((this .description == null ) ? (other.description != null ) : !this .description.equals(other.description)) {
525 0 return false ;
526
}
- 527 0 return true ;
- 528
- }
+ 527 0 if ((this .license == null ) ? (other.license != null ) : !this .license.equals(other.license)) {
+ 528 0 return false ;
529
-
- 530
-
- 531
-
+ } 530 0 if (this .vulnerabilities != other.vulnerabilities && (this .vulnerabilities == null || !this .vulnerabilities.equals(other.vulnerabilities))) {
+ 531 0 return false ;
532
-
- 533
-
+ } 533 0 if (this .relatedDependencies != other.relatedDependencies
534
-
- 535
- @Override
+ && (this .relatedDependencies == null || !this .relatedDependencies.equals(other.relatedDependencies))) { 535 0 return false ;
536
- public int hashCode() {
- 537 144 int hash = 3;
- 538 144 hash = 47 * hash + (this .actualFilePath != null ? this .actualFilePath.hashCode() : 0);
- 539 144 hash = 47 * hash + (this .filePath != null ? this .filePath.hashCode() : 0);
- 540 144 hash = 47 * hash + (this .fileName != null ? this .fileName.hashCode() : 0);
- 541 144 hash = 47 * hash + (this .fileExtension != null ? this .fileExtension.hashCode() : 0);
- 542 144 hash = 47 * hash + (this .md5sum != null ? this .md5sum.hashCode() : 0);
- 543 144 hash = 47 * hash + (this .sha1sum != null ? this .sha1sum.hashCode() : 0);
- 544 144 hash = 47 * hash + (this .identifiers != null ? this .identifiers.hashCode() : 0);
- 545 144 hash = 47 * hash + (this .vendorEvidence != null ? this .vendorEvidence.hashCode() : 0);
- 546 144 hash = 47 * hash + (this .productEvidence != null ? this .productEvidence.hashCode() : 0);
- 547 144 hash = 47 * hash + (this .versionEvidence != null ? this .versionEvidence.hashCode() : 0);
- 548 144 hash = 47 * hash + (this .description != null ? this .description.hashCode() : 0);
- 549 144 hash = 47 * hash + (this .license != null ? this .license.hashCode() : 0);
- 550 144 hash = 47 * hash + (this .vulnerabilities != null ? this .vulnerabilities.hashCode() : 0);
- 551 144 hash = 47 * hash + (this .relatedDependencies != null ? this .relatedDependencies.hashCode() : 0);
- 552 144 return hash;
- 553
+ }
+ 537 0 return true ;
+ 538
}
- 554
+ 539
- 555
+ 540
- 556
-
- 557
+ 541
+
+ 542
- 558
-
- 559
+ 543
+
+ 544
- 560
+ 545
@Override
- 561
- public String toString() {
- 562 0 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}" ;
+ 546
+ public int hashCode() {
+ 547 0 int hash = 3;
+ 548 0 hash = 47 * hash + (this .actualFilePath != null ? this .actualFilePath.hashCode() : 0);
+ 549 0 hash = 47 * hash + (this .filePath != null ? this .filePath.hashCode() : 0);
+ 550 0 hash = 47 * hash + (this .fileName != null ? this .fileName.hashCode() : 0);
+ 551 0 hash = 47 * hash + (this .fileExtension != null ? this .fileExtension.hashCode() : 0);
+ 552 0 hash = 47 * hash + (this .md5sum != null ? this .md5sum.hashCode() : 0);
+ 553 0 hash = 47 * hash + (this .sha1sum != null ? this .sha1sum.hashCode() : 0);
+ 554 0 hash = 47 * hash + (this .identifiers != null ? this .identifiers.hashCode() : 0);
+ 555 0 hash = 47 * hash + (this .vendorEvidence != null ? this .vendorEvidence.hashCode() : 0);
+ 556 0 hash = 47 * hash + (this .productEvidence != null ? this .productEvidence.hashCode() : 0);
+ 557 0 hash = 47 * hash + (this .versionEvidence != null ? this .versionEvidence.hashCode() : 0);
+ 558 0 hash = 47 * hash + (this .description != null ? this .description.hashCode() : 0);
+ 559 0 hash = 47 * hash + (this .license != null ? this .license.hashCode() : 0);
+ 560 0 hash = 47 * hash + (this .vulnerabilities != null ? this .vulnerabilities.hashCode() : 0);
+ 561 0 hash = 47 * hash + (this .relatedDependencies != null ? this .relatedDependencies.hashCode() : 0);
+ 562 0 return hash;
563
}
564
+
+ 565
+
+ 566
+
+ 567
+
+ 568
+
+ 569
+
+ 570
+ @Override
+ 571
+ public String toString() {
+ 572 0 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}" ;
+ 573
+ }
+ 574
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html
index 029c4de11..1fb19bc33 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html
@@ -12,7 +12,7 @@
@@ -65,7 +65,7 @@
24
- 25 121459 public class Evidence implements Comparable<Evidence> {
+ 25 0 public class Evidence implements Comparable<Evidence> {
26
27
@@ -218,8 +218,8 @@
101
public String getValue() {
- 102 6816 used = true ;
- 103 6816 return value;
+ 102 0 used = true ;
+ 103 0 return value;
104
}
105
@@ -238,8 +238,8 @@
112
public String getValue(Boolean setUsed) {
- 113 210 used = used || setUsed;
- 114 210 return value;
+ 113 0 used = used || setUsed;
+ 114 0 return value;
115
}
116
@@ -443,29 +443,29 @@
222
public int compareTo(Evidence o) {
- 223 121459 if (source.equals(o.source)) {
- 224 99766 if (name.equals(o.name)) {
- 225 99463 if (value.equals(o.value)) {
- 226 70558 if (confidence.equals(o.confidence)) {
- 227 70553 return 0;
+ 223 0 if (source.equals(o.source)) {
+ 224 0 if (name.equals(o.name)) {
+ 225 0 if (value.equals(o.value)) {
+ 226 0 if (confidence.equals(o.confidence)) {
+ 227 0 return 0;
228
} else {
- 229 5 return confidence.compareTo(o.confidence);
+ 229 0 return confidence.compareTo(o.confidence);
230
}
231
} else {
- 232 28905 return value.compareToIgnoreCase(o.value);
+ 232 0 return value.compareToIgnoreCase(o.value);
233
}
234
} else {
- 235 303 return name.compareToIgnoreCase(o.name);
+ 235 0 return name.compareToIgnoreCase(o.name);
236
}
237
} else {
- 238 21693 return source.compareToIgnoreCase(o.source);
+ 238 0 return source.compareToIgnoreCase(o.source);
239
}
240
@@ -474,6 +474,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html
index bad5908d0..83159456f 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html
@@ -12,12 +12,12 @@
@@ -108,10 +108,10 @@
43
- 44 488 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
+ 44 0 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
45
public boolean passes(Evidence evidence) {
- 46 488 return evidence.getConfidence() == Confidence.HIGHEST;
+ 46 0 return evidence.getConfidence() == Confidence.HIGHEST;
47
}
48
@@ -122,10 +122,10 @@
51
- 52 482 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
+ 52 0 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
53
public boolean passes(Evidence evidence) {
- 54 482 return evidence.getConfidence() == Confidence.HIGH;
+ 54 0 return evidence.getConfidence() == Confidence.HIGH;
55
}
56
@@ -136,10 +136,10 @@
59
- 60 1 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
+ 60 0 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
61
public boolean passes(Evidence evidence) {
- 62 452 return evidence.getConfidence() == Confidence.MEDIUM;
+ 62 0 return evidence.getConfidence() == Confidence.MEDIUM;
63
}
64
@@ -150,10 +150,10 @@
67
- 68 1 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
+ 68 0 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
69
public boolean passes(Evidence evidence) {
- 70 748 return evidence.getConfidence() == Confidence.LOW;
+ 70 0 return evidence.getConfidence() == Confidence.LOW;
71
}
72
@@ -164,10 +164,10 @@
75
- 76 1 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
+ 76 0 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
77
public boolean passes(Evidence evidence) {
- 78 9272 return evidence.isUsed();
+ 78 0 return evidence.isUsed();
79
}
80
@@ -188,15 +188,15 @@
88
public final Iterable<Evidence> iterator(Confidence confidence) {
- 89 504 if (confidence == Confidence.HIGHEST) {
- 90 128 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this .list);
- 91 376 } else if (confidence == Confidence.HIGH) {
- 92 123 return EvidenceCollection.HIGH_CONFIDENCE.filter(this .list);
- 93 253 } else if (confidence == Confidence.MEDIUM) {
- 94 108 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this .list);
+ 89 0 if (confidence == Confidence.HIGHEST) {
+ 90 0 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this .list);
+ 91 0 } else if (confidence == Confidence.HIGH) {
+ 92 0 return EvidenceCollection.HIGH_CONFIDENCE.filter(this .list);
+ 93 0 } else if (confidence == Confidence.MEDIUM) {
+ 94 0 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this .list);
95
} else {
- 96 145 return EvidenceCollection.LOW_CONFIDENCE.filter(this .list);
+ 96 0 return EvidenceCollection.LOW_CONFIDENCE.filter(this .list);
97
}
98
@@ -225,10 +225,10 @@
110
- 111 221 public EvidenceCollection() {
- 112 221 list = new TreeSet<Evidence>();
- 113 221 weightedStrings = new HashSet<String>();
- 114 221 }
+ 111 0 public EvidenceCollection() {
+ 112 0 list = new TreeSet<Evidence>();
+ 113 0 weightedStrings = new HashSet<String>();
+ 114 0 }
115
116
@@ -243,8 +243,8 @@
121
public void addEvidence(Evidence e) {
- 122 70901 list.add(e);
- 123 70901 }
+ 122 0 list.add(e);
+ 123 0 }
124
125
@@ -265,9 +265,9 @@
133
public void addEvidence(String source, String name, String value, Confidence confidence) {
- 134 70835 final Evidence e = new Evidence(source, name, value, confidence);
- 135 70835 addEvidence(e);
- 136 70835 }
+ 134 0 final Evidence e = new Evidence(source, name, value, confidence);
+ 135 0 addEvidence(e);
+ 136 0 }
137
138
@@ -294,8 +294,8 @@
149
public void addWeighting(String str) {
- 150 57 weightedStrings.add(str);
- 151 57 }
+ 150 0 weightedStrings.add(str);
+ 151 0 }
152
153
@@ -410,7 +410,7 @@
216
public Iterator<Evidence> iterator() {
- 217 1467 return list.iterator();
+ 217 0 return list.iterator();
218
}
219
@@ -429,23 +429,23 @@
226
public boolean containsUsedString(String text) {
- 227 1446 if (text == null ) {
+ 227 0 if (text == null ) {
228 0 return false ;
229
}
- 230 1446 final String textToTest = text.toLowerCase();
+ 230 0 final String textToTest = text.toLowerCase();
231
- 232 1446 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this )) {
+ 232 0 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this )) {
233
- 234 6193 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]" , "" );
- 235 6193 if (value.contains(textToTest)) {
- 236 510 return true ;
+ 234 0 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]" , "" );
+ 235 0 if (value.contains(textToTest)) {
+ 236 0 return true ;
237
}
- 238 5683 }
- 239 936 return false ;
+ 238 0 }
+ 239 0 return false ;
240
}
241
@@ -496,13 +496,13 @@
268
public boolean contains(Confidence confidence) {
- 269 228 for (Evidence e : list) {
- 270 701 if (e.getConfidence().equals(confidence)) {
- 271 162 return true ;
+ 269 0 for (Evidence e : list) {
+ 270 0 if (e.getConfidence().equals(confidence)) {
+ 271 0 return true ;
272
}
- 273 539 }
- 274 66 return false ;
+ 273 0 }
+ 274 0 return false ;
275
}
276
@@ -521,17 +521,17 @@
283
public static EvidenceCollection mergeUsed(EvidenceCollection... ec) {
- 284 4 final EvidenceCollection ret = new EvidenceCollection();
- 285 16 for (EvidenceCollection col : ec) {
- 286 12 for (Evidence e : col.list) {
- 287 59 if (e.isUsed()) {
- 288 58 ret.addEvidence(e);
+ 284 0 final EvidenceCollection ret = new EvidenceCollection();
+ 285 0 for (EvidenceCollection col : ec) {
+ 286 0 for (Evidence e : col.list) {
+ 287 0 if (e.isUsed()) {
+ 288 0 ret.addEvidence(e);
289
}
- 290 59 }
+ 290 0 }
291
}
- 292 4 return ret;
+ 292 0 return ret;
293
}
294
@@ -550,13 +550,13 @@
301
public static EvidenceCollection merge(EvidenceCollection... ec) {
- 302 1 final EvidenceCollection ret = new EvidenceCollection();
- 303 4 for (EvidenceCollection col : ec) {
- 304 3 ret.list.addAll(col.list);
- 305 3 ret.weightedStrings.addAll(col.weightedStrings);
+ 302 0 final EvidenceCollection ret = new EvidenceCollection();
+ 303 0 for (EvidenceCollection col : ec) {
+ 304 0 ret.list.addAll(col.list);
+ 305 0 ret.weightedStrings.addAll(col.weightedStrings);
306
}
- 307 1 return ret;
+ 307 0 return ret;
308
}
309
@@ -575,11 +575,11 @@
@Override
316
public String toString() {
- 317 3 final StringBuilder sb = new StringBuilder();
- 318 3 for (Evidence e : this .list) {
- 319 11 sb.append(e.getValue()).append(' ' );
- 320 11 }
- 321 3 return sb.toString();
+ 317 0 final StringBuilder sb = new StringBuilder();
+ 318 0 for (Evidence e : this .list) {
+ 319 0 sb.append(e.getValue()).append(' ' );
+ 320 0 }
+ 321 0 return sb.toString();
322
}
323
@@ -596,7 +596,7 @@
329
public int size() {
- 330 221 return list.size();
+ 330 0 return list.size();
331
}
332
@@ -639,22 +639,22 @@
351
private String urlCorrection(String value) {
- 352 6193 if (value == null || !UrlStringUtils.containsUrl(value)) {
- 353 6061 return value;
+ 352 0 if (value == null || !UrlStringUtils.containsUrl(value)) {
+ 353 0 return value;
354
}
- 355 132 final StringBuilder sb = new StringBuilder(value.length());
- 356 132 final String[] parts = value.split("\\s" );
- 357 264 for (String part : parts) {
- 358 132 if (UrlStringUtils.isUrl(part)) {
+ 355 0 final StringBuilder sb = new StringBuilder(value.length());
+ 356 0 final String[] parts = value.split("\\s" );
+ 357 0 for (String part : parts) {
+ 358 0 if (UrlStringUtils.isUrl(part)) {
359
try {
- 360 132 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
- 361 132 sb.append(' ' ).append(StringUtils.join(data, ' ' ));
+ 360 0 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
+ 361 0 sb.append(' ' ).append(StringUtils.join(data, ' ' ));
362 0 } catch (MalformedURLException ex) {
363 0 Logger.getLogger(EvidenceCollection.class .getName()).log(Level.FINE, "error parsing " + part, ex);
364 0 sb.append(' ' ).append(part);
- 365 132 }
+ 365 0 }
366
} else {
367 0 sb.append(' ' ).append(part);
@@ -662,13 +662,13 @@
} 369
}
- 370 132 return sb.toString().trim();
+ 370 0 return sb.toString().trim();
371
}
372
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html
index 8f2c76f58..e417ac949 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html
@@ -12,7 +12,7 @@
@@ -63,7 +63,7 @@
23
- 24 149 public class Identifier implements Comparable<Identifier> {
+ 24 0 public class Identifier implements Comparable<Identifier> {
25
26
@@ -373,10 +373,10 @@
@Override
185
public int hashCode() {
- 186 59 int hash = 5;
- 187 59 hash = 53 * hash + (this .value != null ? this .value.hashCode() : 0);
- 188 59 hash = 53 * hash + (this .type != null ? this .type.hashCode() : 0);
- 189 59 return hash;
+ 186 0 int hash = 5;
+ 187 0 hash = 53 * hash + (this .value != null ? this .value.hashCode() : 0);
+ 188 0 hash = 53 * hash + (this .type != null ? this .type.hashCode() : 0);
+ 189 0 return hash;
190
}
191
@@ -414,17 +414,17 @@
208
public int compareTo(Identifier o) {
- 209 232 if (o == null ) {
+ 209 0 if (o == null ) {
210 0 return -1;
211
}
- 212 232 return this .value.compareTo(o.value);
+ 212 0 return this .value.compareTo(o.value);
213
}
214
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html
index 494265cb0..8666bbef1 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html
@@ -12,7 +12,7 @@
@@ -69,7 +69,7 @@
26
- 27 1223 public class Reference implements Serializable, Comparable<Reference> {
+ 27 0 public class Reference implements Serializable, Comparable<Reference> {
28
29
@@ -271,10 +271,10 @@
136
public int compareTo(Reference o) {
- 137 1223 if (source.equals(o.source)) {
- 138 265 if (name.equals(o.name)) {
- 139 87 if (url.equals(o.url)) {
- 140 87 return 0;
+ 137 0 if (source.equals(o.source)) {
+ 138 0 if (name.equals(o.name)) {
+ 139 0 if (url.equals(o.url)) {
+ 140 0 return 0;
141
} else {
142 0 return url.compareTo(o.url);
@@ -282,12 +282,12 @@
} 144
} else {
- 145 178 return name.compareTo(o.name);
+ 145 0 return name.compareTo(o.name);
146
}
147
} else {
- 148 958 return source.compareTo(o.source);
+ 148 0 return source.compareTo(o.source);
149
}
150
@@ -296,6 +296,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html
index bcd8bda86..4d7dfe202 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html
@@ -12,7 +12,7 @@
@@ -75,7 +75,7 @@
29
- 30 89 public class Vulnerability implements Serializable, Comparable<Vulnerability> {
+ 30 0 public class Vulnerability implements Serializable, Comparable<Vulnerability> {
31
32
@@ -180,7 +180,7 @@
82
- 83 89 private SortedSet<Reference> references = new TreeSet<Reference>();
+ 83 0 private SortedSet<Reference> references = new TreeSet<Reference>();
84
85
@@ -231,8 +231,8 @@
108
public void addReference(Reference ref) {
- 109 90 this .references.add(ref);
- 110 90 }
+ 109 0 this .references.add(ref);
+ 110 0 }
111
112
@@ -251,19 +251,19 @@
119
public void addReference(String referenceSource, String referenceName, String referenceUrl) {
- 120 430 final Reference ref = new Reference();
- 121 430 ref.setSource(referenceSource);
- 122 430 ref.setName(referenceName);
- 123 430 ref.setUrl(referenceUrl);
- 124 430 this .references.add(ref);
- 125 430 }
+ 120 0 final Reference ref = new Reference();
+ 121 0 ref.setSource(referenceSource);
+ 122 0 ref.setName(referenceName);
+ 123 0 ref.setUrl(referenceUrl);
+ 124 0 this .references.add(ref);
+ 125 0 }
126
127
128
- 129 89 private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
+ 129 0 private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
130
131
@@ -316,7 +316,7 @@
155
public boolean addVulnerableSoftware(String cpe) {
- 156 3276 return addVulnerableSoftware(cpe, null );
+ 156 0 return addVulnerableSoftware(cpe, null );
157
}
158
@@ -337,13 +337,13 @@
166
public boolean addVulnerableSoftware(String cpe, String previousVersion) {
- 167 3318 final VulnerableSoftware vs = new VulnerableSoftware();
- 168 3318 vs.setCpe(cpe);
- 169 3318 if (previousVersion != null ) {
- 170 42 vs.setPreviousVersion(previousVersion);
+ 167 0 final VulnerableSoftware vs = new VulnerableSoftware();
+ 168 0 vs.setCpe(cpe);
+ 169 0 if (previousVersion != null ) {
+ 170 0 vs.setPreviousVersion(previousVersion);
171
}
- 172 3318 return updateVulnerableSoftware(vs);
+ 172 0 return updateVulnerableSoftware(vs);
173
}
174
@@ -362,11 +362,11 @@
181
public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) {
- 182 3318 if (vulnerableSoftware.contains(vulnSoftware)) {
+ 182 0 if (vulnerableSoftware.contains(vulnSoftware)) {
183 0 vulnerableSoftware.remove(vulnSoftware);
184
}
- 185 3318 return vulnerableSoftware.add(vulnSoftware);
+ 185 0 return vulnerableSoftware.add(vulnSoftware);
186
}
187
@@ -749,9 +749,9 @@
@Override
380
public int hashCode() {
- 381 41 int hash = 5;
- 382 41 hash = 41 * hash + (this .name != null ? this .name.hashCode() : 0);
- 383 41 return hash;
+ 381 0 int hash = 5;
+ 382 0 hash = 41 * hash + (this .name != null ? this .name.hashCode() : 0);
+ 383 0 return hash;
384
}
385
@@ -811,9 +811,9 @@
413
public void setMatchedCPE(String cpeId, String previous) {
- 414 61 matchedCPE = cpeId;
- 415 61 matchedAllPreviousCPE = previous;
- 416 61 }
+ 414 0 matchedCPE = cpeId;
+ 415 0 matchedAllPreviousCPE = previous;
+ 416 0 }
417
418
@@ -871,6 +871,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html
index 0a5928a9a..9ad0f90f6 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html
@@ -12,7 +12,7 @@
@@ -71,7 +71,7 @@
27
- 28 114 public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
+ 28 0 public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
29
30
@@ -100,13 +100,13 @@
42
public int compare(Vulnerability o1, Vulnerability o2) {
- 43 114 return o2.getName().compareTo(o1.getName());
+ 43 0 return o2.getName().compareTo(o1.getName());
44
}
45
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html
index 2912b4290..075419c93 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html
@@ -12,7 +12,7 @@
@@ -79,7 +79,7 @@
31
- 32 51021 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
+ 32 0 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
33
34
@@ -106,14 +106,14 @@
public void setCpe(String cpe) {
45
try {
- 46 7716 parseName(cpe);
+ 46 0 parseName(cpe);
47 0 } catch (UnsupportedEncodingException ex) {
48 0 final String msg = String.format("Character encoding is unsupported for CPE '%s'." , cpe);
49 0 Logger.getLogger(VulnerableSoftware.class .getName()).log(Level.WARNING, msg);
50 0 Logger.getLogger(VulnerableSoftware.class .getName()).log(Level.FINE, null , ex);
51 0 setName(cpe);
- 52 7716 }
- 53 7716 }
+ 52 0 }
+ 53 0 }
54
55
@@ -150,32 +150,32 @@
@Override
71
public void parseName(String cpeName) throws UnsupportedEncodingException {
- 72 11292 this .name = cpeName;
- 73 11292 if (cpeName != null && cpeName.length() > 7) {
- 74 11292 final String[] data = cpeName.substring(7).split(":" );
- 75 11292 if (data.length >= 1) {
- 76 11292 this .setVendor(URLDecoder.decode(data[0].replace("+" , "%2B" ), "UTF-8" ));
+ 72 0 this .name = cpeName;
+ 73 0 if (cpeName != null && cpeName.length() > 7) {
+ 74 0 final String[] data = cpeName.substring(7).split(":" );
+ 75 0 if (data.length >= 1) {
+ 76 0 this .setVendor(URLDecoder.decode(data[0].replace("+" , "%2B" ), "UTF-8" ));
77
}
- 78 11292 if (data.length >= 2) {
- 79 11292 this .setProduct(URLDecoder.decode(data[1].replace("+" , "%2B" ), "UTF-8" ));
+ 78 0 if (data.length >= 2) {
+ 79 0 this .setProduct(URLDecoder.decode(data[1].replace("+" , "%2B" ), "UTF-8" ));
80
}
- 81 11292 if (data.length >= 3) {
- 82 11264 version = URLDecoder.decode(data[2].replace("+" , "%2B" ), "UTF-8" );
+ 81 0 if (data.length >= 3) {
+ 82 0 version = URLDecoder.decode(data[2].replace("+" , "%2B" ), "UTF-8" );
83
}
- 84 11292 if (data.length >= 4) {
- 85 2318 revision = URLDecoder.decode(data[3].replace("+" , "%2B" ), "UTF-8" );
+ 84 0 if (data.length >= 4) {
+ 85 0 revision = URLDecoder.decode(data[3].replace("+" , "%2B" ), "UTF-8" );
86
}
- 87 11292 if (data.length >= 5) {
- 88 1 edition = URLDecoder.decode(data[4].replace("+" , "%2B" ), "UTF-8" );
+ 87 0 if (data.length >= 5) {
+ 88 0 edition = URLDecoder.decode(data[4].replace("+" , "%2B" ), "UTF-8" );
89
}
90
}
- 91 11292 }
+ 91 0 }
92
93
@@ -198,7 +198,7 @@
102
public boolean hasPreviousVersion() {
- 103 392 return previousVersion != null ;
+ 103 0 return previousVersion != null ;
104
}
105
@@ -255,17 +255,17 @@
@Override
131
public boolean equals(Object obj) {
- 132 1 if (obj == null ) {
+ 132 0 if (obj == null ) {
133 0 return false ;
134
}
- 135 1 if (getClass() != obj.getClass()) {
+ 135 0 if (getClass() != obj.getClass()) {
136 0 return false ;
137
}
- 138 1 final VulnerableSoftware other = (VulnerableSoftware) obj;
- 139 1 if ((this .getName() == null ) ? (other.getName() != null ) : !this .getName().equals(other.getName())) {
- 140 1 return false ;
+ 138 0 final VulnerableSoftware other = (VulnerableSoftware) obj;
+ 139 0 if ((this .getName() == null ) ? (other.getName() != null ) : !this .getName().equals(other.getName())) {
+ 140 0 return false ;
141
}
142 0 return true ;
@@ -287,9 +287,9 @@
@Override 151
public int hashCode() {
- 152 4516 int hash = 7;
- 153 4516 hash = 83 * hash + (this .getName() != null ? this .getName().hashCode() : 0);
- 154 4516 return hash;
+ 152 0 int hash = 7;
+ 153 0 hash = 83 * hash + (this .getName() != null ? this .getName().hashCode() : 0);
+ 154 0 return hash;
155
}
156
@@ -329,21 +329,21 @@
@Override
174
public int compareTo(VulnerableSoftware vs) {
- 175 51023 int result = 0;
- 176 51023 final String[] left = this .getName().split(":" );
- 177 51023 final String[] right = vs.getName().split(":" );
- 178 51023 final int max = (left.length <= right.length) ? left.length : right.length;
- 179 51023 if (max > 0) {
- 180 308355 for (int i = 0; result == 0 && i < max; i++) {
- 181 257332 final String[] subLeft = left[i].split("\\." );
- 182 257332 final String[] subRight = right[i].split("\\." );
- 183 257332 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
- 184 257332 if (subMax > 0) {
- 185 578427 for (int x = 0; result == 0 && x < subMax; x++) {
- 186 321095 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
+ 175 0 int result = 0;
+ 176 0 final String[] left = this .getName().split(":" );
+ 177 0 final String[] right = vs.getName().split(":" );
+ 178 0 final int max = (left.length <= right.length) ? left.length : right.length;
+ 179 0 if (max > 0) {
+ 180 0 for (int i = 0; result == 0 && i < max; i++) {
+ 181 0 final String[] subLeft = left[i].split("\\." );
+ 182 0 final String[] subRight = right[i].split("\\." );
+ 183 0 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
+ 184 0 if (subMax > 0) {
+ 185 0 for (int x = 0; result == 0 && x < subMax; x++) {
+ 186 0 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
187
try {
- 188 111835 result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x]));
+ 188 0 result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x]));
189
190
@@ -369,21 +369,21 @@
201 0 result = subLeft[x].compareToIgnoreCase(subRight[x]);
202
}
- 203 111835 }
+ 203 0 }
204
} else {
- 205 209260 result = subLeft[x].compareToIgnoreCase(subRight[x]);
+ 205 0 result = subLeft[x].compareToIgnoreCase(subRight[x]);
206
}
207
}
- 208 257332 if (result == 0) {
- 209 208461 if (subLeft.length > subRight.length) {
- 210 1478 result = 2;
+ 208 0 if (result == 0) {
+ 209 0 if (subLeft.length > subRight.length) {
+ 210 0 result = 2;
211
}
- 212 208461 if (subRight.length > subLeft.length) {
- 213 7 result = -2;
+ 212 0 if (subRight.length > subLeft.length) {
+ 213 0 result = -2;
214
}
215
@@ -395,13 +395,13 @@
}
219
}
- 220 51023 if (result == 0) {
- 221 667 if (left.length > right.length) {
- 222 578 result = 2;
+ 220 0 if (result == 0) {
+ 221 0 if (left.length > right.length) {
+ 222 0 result = 2;
223
}
- 224 667 if (right.length > left.length) {
- 225 10 result = -2;
+ 224 0 if (right.length > left.length) {
+ 225 0 result = -2;
226
}
227
@@ -411,7 +411,7 @@
229 0 result = this .getName().compareToIgnoreCase(vs.getName());
230
}
- 231 51023 return result;
+ 231 0 return result;
232
}
233
@@ -430,19 +430,19 @@
240
private static boolean isPositiveInteger(final String str) {
- 241 433024 if (str == null || str.isEmpty()) {
- 242 14 return false ;
+ 241 0 if (str == null || str.isEmpty()) {
+ 242 0 return false ;
243
}
- 244 674390 for (int i = 0; i < str.length(); i++) {
- 245 450626 final char c = str.charAt(i);
- 246 450626 if (c < '0' || c > '9' ) {
- 247 209246 return false ;
+ 244 0 for (int i = 0; i < str.length(); i++) {
+ 245 0 final char c = str.charAt(i);
+ 246 0 if (c < '0' || c > '9' ) {
+ 247 0 return false ;
248
}
249
}
- 250 223764 return true ;
+ 250 0 return true ;
251
}
252
@@ -625,6 +625,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html
index 03070db4a..8ff897d21 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html
@@ -155,6 +155,6 @@
} Coverage Report
+Coverage Report - org.owasp.dependencycheck.exception.ScanAgentException
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.exception;
+ 19
+
+ 20
+ import java.io.IOException;
+ 21
+
+ 22
+
+ 23
+
+ 24
+
+ 25
+
+ 26
+
+ 27
+ public class ScanAgentException extends IOException {
+ 28
+
+ 29
+
+ 30
+
+ 31
+
+ 32
+ private static final long serialVersionUID = 1L;
+ 33
+
+ 34
+
+ 35
+
+ 36
+
+ 37
+ public ScanAgentException() {
+ 38
+ super ();
+ 39
+ }
+ 40
+
+ 41
+
+ 42
+
+ 43
+
+ 44
+
+ 45
+
+ 46
+ public ScanAgentException(String msg) {
+ 47
+ super (msg);
+ 48
+ }
+ 49
+
+ 50
+
+ 51
+
+ 52
+
+ 53
+
+ 54
+
+ 55
+ public ScanAgentException(Throwable ex) {
+ 56
+ super (ex);
+ 57
+ }
+ 58
+
+ 59
+
+ 60
+
+ 61
+
+ 62
+
+ 63
+
+ 64
+
+ 65
+ public ScanAgentException(String msg, Throwable ex) {
+ 66
+ super (msg, ex);
+ 67
+ }
+ 68
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html
index 851b353d5..88a7c8cdf 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html
@@ -198,6 +198,6 @@
} } } } } } } } } } } } } } } } } } } Model$Contributors 1.1549295774647887; 1.155Model$Dependencies 1.1549295774647887; 1.155Model$Developers 1.1549295774647887; 1.155Model$Licenses 1.1549295774647887; 1.155Model$Licenses 1.1549295774647887; 1.155Model$MailingLists 1.1549295774647887; 1.155Model$Modules 1.1549295774647887; 1.155Model$PluginRepositories 1.1549295774647887; 1.155 @Generated(value = "com.sun.tools.internal.xjc.Driver" , date = "2012-11-09T12:33:57-05:00" , comments = "JAXB RI vJAXB 2.1.10 in JDK 6" ) 1273
public List<License> getLicense() {
- 1274 1 if (license == null ) {
+ 1274 0 if (license == null ) {
1275 0 license = new ArrayList<License>();
1276
}
- 1277 1 return this .license;
+ 1277 0 return this .license;
1278
}
1279
@@ -3433,6 +3433,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html
index 5425b6c79..a25697860 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html
@@ -683,6 +683,6 @@
} } } } } } } } } } } } } } } } } } package org.owasp.dependencycheck.jaxb.pom.generated;
@@ -191,20 +191,20 @@
89
- 90 1 public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) {
- 91 1 engine = createVelocityEngine();
- 92 1 context = createContext();
+ 90 0 public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) {
+ 91 0 engine = createVelocityEngine();
+ 92 0 context = createContext();
93
- 94 1 engine.init();
+ 94 0 engine.init();
95
- 96 1 context.put("applicationName" , applicationName);
- 97 1 context.put("dependencies" , dependencies);
- 98 1 context.put("analyzers" , analyzers);
- 99 1 context.put("properties" , properties);
- 100 1 context.put("version" , Settings.getString("application.version" , "Unknown" ));
- 101 1 }
+ 96 0 context.put("applicationName" , applicationName);
+ 97 0 context.put("dependencies" , dependencies);
+ 98 0 context.put("analyzers" , analyzers);
+ 99 0 context.put("properties" , properties);
+ 100 0 context.put("version" , Settings.getString("application.version" , "Unknown" ));
+ 101 0 }
102
103
@@ -219,11 +219,11 @@
108
private VelocityEngine createVelocityEngine() {
- 109 1 final VelocityEngine ve = new VelocityEngine();
- 110 1 ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class .getName());
- 111 1 ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath" );
- 112 1 ve.setProperty("classpath.resource.loader.class" , ClasspathResourceLoader.class .getName());
- 113 1 return ve;
+ 109 0 final VelocityEngine ve = new VelocityEngine();
+ 110 0 ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class .getName());
+ 111 0 ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath" );
+ 112 0 ve.setProperty("classpath.resource.loader.class" , ClasspathResourceLoader.class .getName());
+ 113 0 return ve;
114
}
115
@@ -244,13 +244,13 @@
justification = "No plan to fix this style issue" )
123
private Context createContext() {
- 124 1 final ToolManager manager = new ToolManager();
- 125 1 final Context c = manager.createContext();
- 126 1 final EasyFactoryConfiguration config = new EasyFactoryConfiguration();
- 127 1 config.addDefaultTools();
- 128 1 config.toolbox("application" ).tool("esc" , "org.apache.velocity.tools.generic.EscapeTool" ).tool("org.apache.velocity.tools.generic.DateTool" );
- 129 1 manager.configure(config);
- 130 1 return c;
+ 124 0 final ToolManager manager = new ToolManager();
+ 125 0 final Context c = manager.createContext();
+ 126 0 final EasyFactoryConfiguration config = new EasyFactoryConfiguration();
+ 127 0 config.addDefaultTools();
+ 128 0 config.toolbox("application" ).tool("esc" , "org.apache.velocity.tools.generic.EscapeTool" ).tool("org.apache.velocity.tools.generic.DateTool" );
+ 129 0 manager.configure(config);
+ 130 0 return c;
131
}
132
@@ -274,15 +274,15 @@
141
public void generateReports(String outputDir, Format format) throws IOException, Exception {
142 0 if (format == Format.XML || format == Format.ALL) {
- 143 0 generateReport("XmlReport" , outputDir + File.separator + "DependencyCheck-Report.xml" );
+ 143 0 generateReport("XmlReport" , outputDir + File.separator + "dependency-check-report.xml" );
144
}
145 0 if (format == Format.HTML || format == Format.ALL) {
- 146 0 generateReport("HtmlReport" , outputDir + File.separator + "DependencyCheck-Report.html" );
+ 146 0 generateReport("HtmlReport" , outputDir + File.separator + "dependency-check-report.html" );
147
}
148 0 if (format == Format.VULN || format == Format.ALL) {
- 149 0 generateReport("VulnerabilityReport" , outputDir + File.separator + "DependencyCheck-Vulnerability.html" );
+ 149 0 generateReport("VulnerabilityReport" , outputDir + File.separator + "dependency-check-vulnerability.html" );
150
}
151 0 }
@@ -351,10 +351,10 @@
189
protected void generateReport(String templateName, String outFileName) throws IOException, Exception {
- 190 1 InputStream input = null ;
- 191 1 String templatePath = null ;
- 192 1 final File f = new File(templateName);
- 193 1 if (f.exists() && f.isFile()) {
+ 190 0 InputStream input = null ;
+ 191 0 String templatePath = null ;
+ 192 0 final File f = new File(templateName);
+ 193 0 if (f.exists() && f.isFile()) {
194
try {
195 0 templatePath = templateName;
@@ -366,25 +366,25 @@
201 0 }
202
} else {
- 203 1 templatePath = "templates/" + templateName + ".vsl" ;
- 204 1 input = this .getClass().getClassLoader().getResourceAsStream(templatePath);
+ 203 0 templatePath = "templates/" + templateName + ".vsl" ;
+ 204 0 input = this .getClass().getClassLoader().getResourceAsStream(templatePath);
205
}
- 206 1 if (input == null ) {
+ 206 0 if (input == null ) {
207 0 throw new IOException("Template file doesn't exist" );
208
}
209
- 210 1 final InputStreamReader reader = new InputStreamReader(input, "UTF-8" );
- 211 1 OutputStreamWriter writer = null ;
- 212 1 OutputStream outputStream = null ;
+ 210 0 final InputStreamReader reader = new InputStreamReader(input, "UTF-8" );
+ 211 0 OutputStreamWriter writer = null ;
+ 212 0 OutputStream outputStream = null ;
213
214
try {
- 215 1 final File outDir = new File(outFileName).getParentFile();
- 216 1 if (!outDir.exists()) {
+ 215 0 final File outDir = new File(outFileName).getParentFile();
+ 216 0 if (!outDir.exists()) {
217 0 final boolean created = outDir.mkdirs();
218 0 if (!created) {
219 0 throw new Exception("Unable to create directory '" + outDir.getAbsolutePath() + "'." );
@@ -394,47 +394,47 @@
} 222
- 223 1 outputStream = new FileOutputStream(outFileName);
- 224 1 writer = new OutputStreamWriter(outputStream, "UTF-8" );
+ 223 0 outputStream = new FileOutputStream(outFileName);
+ 224 0 writer = new OutputStreamWriter(outputStream, "UTF-8" );
225
- 226 1 if (!engine.evaluate(context, writer, templatePath, reader)) {
+ 226 0 if (!engine.evaluate(context, writer, templatePath, reader)) {
227 0 throw new Exception("Failed to convert the template into html." );
228
}
- 229 1 writer.flush();
+ 229 0 writer.flush();
230
} finally {
- 231 1 if (writer != null ) {
+ 231 0 if (writer != null ) {
232
try {
- 233 1 writer.close();
+ 233 0 writer.close();
234 0 } catch (IOException ex) {
235 0 Logger.getLogger(ReportGenerator.class .getName()).log(Level.FINEST, null , ex);
- 236 1 }
+ 236 0 }
237
}
- 238 1 if (outputStream != null ) {
+ 238 0 if (outputStream != null ) {
239
try {
- 240 1 outputStream.close();
+ 240 0 outputStream.close();
241 0 } catch (IOException ex) {
242 0 Logger.getLogger(ReportGenerator.class .getName()).log(Level.FINEST, null , ex);
- 243 1 }
+ 243 0 }
244
}
245
try {
- 246 1 reader.close();
+ 246 0 reader.close();
247 0 } catch (IOException ex) {
248 0 Logger.getLogger(ReportGenerator.class .getName()).log(Level.FINEST, null , ex);
- 249 1 }
+ 249 0 }
250 0 }
- 251 1 }
+ 251 0 }
252
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html
index 87a900f31..630b3bb97 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html
@@ -12,7 +12,7 @@
@@ -109,7 +109,7 @@
public void init(RuntimeServices rsvc) { 46
- 47 1 }
+ 47 0 }
48
49
@@ -128,8 +128,8 @@
56
public void log(int level, String message) {
- 57 32 Logger.getLogger(Velocity.class .getName()).log(getLevel(level), message);
- 58 32 }
+ 57 0 Logger.getLogger(Velocity.class .getName()).log(getLevel(level), message);
+ 58 0 }
59
60
@@ -168,7 +168,7 @@
78
public boolean isLevelEnabled(int level) {
- 79 12 return true ;
+ 79 0 return true ;
80
}
81
@@ -187,13 +187,13 @@
88
private Level getLevel(int velocityLevel) {
- 89 32 switch (velocityLevel) {
+ 89 0 switch (velocityLevel) {
90
case TRACE_ID:
- 91 8 return Level.ALL;
+ 91 0 return Level.ALL;
92
case DEBUG_ID:
- 93 24 return Level.FINE;
+ 93 0 return Level.FINE;
94
case INFO_ID:
95 0 return Level.INFO;
@@ -214,6 +214,6 @@
}
@@ -237,28 +237,28 @@
110
public boolean matches(String text) {
- 111 76 if (text == null ) {
+ 111 0 if (text == null ) {
112 0 return false ;
113
}
- 114 76 if (this .regex) {
+ 114 0 if (this .regex) {
115
Pattern rx;
- 116 43 if (this .caseSensitive) {
- 117 2 rx = Pattern.compile(this .value);
+ 116 0 if (this .caseSensitive) {
+ 117 0 rx = Pattern.compile(this .value);
118
} else {
- 119 41 rx = Pattern.compile(this .value, Pattern.CASE_INSENSITIVE);
+ 119 0 rx = Pattern.compile(this .value, Pattern.CASE_INSENSITIVE);
120
}
- 121 43 return rx.matcher(text).matches();
+ 121 0 return rx.matcher(text).matches();
122
} else {
- 123 33 if (this .caseSensitive) {
- 124 2 return value.equals(text);
+ 123 0 if (this .caseSensitive) {
+ 124 0 return value.equals(text);
125
} else {
- 126 31 return value.equalsIgnoreCase(text);
+ 126 0 return value.equalsIgnoreCase(text);
127
}
128
@@ -308,28 +308,28 @@
@Override
153
public boolean equals(Object obj) {
- 154 1 if (obj == null ) {
+ 154 0 if (obj == null ) {
155 0 return false ;
156
}
- 157 1 if (getClass() != obj.getClass()) {
+ 157 0 if (getClass() != obj.getClass()) {
158 0 return false ;
159
}
- 160 1 final PropertyType other = (PropertyType) obj;
- 161 1 if ((this .value == null ) ? (other.value != null ) : !this .value.equals(other.value)) {
+ 160 0 final PropertyType other = (PropertyType) obj;
+ 161 0 if ((this .value == null ) ? (other.value != null ) : !this .value.equals(other.value)) {
162 0 return false ;
163
}
- 164 1 if (this .regex != other.regex) {
+ 164 0 if (this .regex != other.regex) {
165 0 return false ;
166
}
- 167 1 if (this .caseSensitive != other.caseSensitive) {
+ 167 0 if (this .caseSensitive != other.caseSensitive) {
168 0 return false ;
169
}
- 170 1 return true ;
+ 170 0 return true ;
171
}
172
@@ -357,6 +357,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html
index 59e5ec4ae..6fecf18ec 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html
@@ -188,6 +188,6 @@
}
@@ -77,7 +77,7 @@
30
- 31 10 public class SuppressionHandler extends DefaultHandler {
+ 31 0 public class SuppressionHandler extends DefaultHandler {
32
33
@@ -142,7 +142,7 @@
63
- 64 10 private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
+ 64 0 private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
65
66
@@ -209,17 +209,17 @@
@Override
97
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
- 98 200 currentAttributes = null ;
- 99 200 currentText = new StringBuffer();
+ 98 0 currentAttributes = null ;
+ 99 0 currentText = new StringBuffer();
100
- 101 200 if (SUPPRESS.equals(qName)) {
- 102 50 rule = new SuppressionRule();
- 103 150 } else if (FILE_PATH.equals(qName)) {
- 104 30 currentAttributes = attributes;
+ 101 0 if (SUPPRESS.equals(qName)) {
+ 102 0 rule = new SuppressionRule();
+ 103 0 } else if (FILE_PATH.equals(qName)) {
+ 104 0 currentAttributes = attributes;
105
}
- 106 200 }
+ 106 0 }
107
108
@@ -242,27 +242,27 @@
@Override
117
public void endElement(String uri, String localName, String qName) throws SAXException {
- 118 200 if (SUPPRESS.equals(qName)) {
- 119 50 suppressionRules.add(rule);
- 120 50 rule = null ;
- 121 150 } else if (FILE_PATH.equals(qName)) {
- 122 30 final PropertyType pt = processPropertyType();
- 123 30 rule.setFilePath(pt);
- 124 30 } else if (SHA1.equals(qName)) {
- 125 10 rule.setSha1(currentText.toString());
- 126 110 } else if (CPE.equals(qName)) {
- 127 20 final PropertyType pt = processPropertyType();
- 128 20 rule.addCpe(pt);
- 129 20 } else if (CWE.equals(qName)) {
+ 118 0 if (SUPPRESS.equals(qName)) {
+ 119 0 suppressionRules.add(rule);
+ 120 0 rule = null ;
+ 121 0 } else if (FILE_PATH.equals(qName)) {
+ 122 0 final PropertyType pt = processPropertyType();
+ 123 0 rule.setFilePath(pt);
+ 124 0 } else if (SHA1.equals(qName)) {
+ 125 0 rule.setSha1(currentText.toString());
+ 126 0 } else if (CPE.equals(qName)) {
+ 127 0 final PropertyType pt = processPropertyType();
+ 128 0 rule.addCpe(pt);
+ 129 0 } else if (CWE.equals(qName)) {
130 0 rule.addCwe(currentText.toString());
- 131 90 } else if (CVE.equals(qName)) {
- 132 20 rule.addCve(currentText.toString());
- 133 70 } else if (CVSS_BELOW.equals(qName)) {
- 134 10 final float cvss = Float.parseFloat(currentText.toString());
- 135 10 rule.addCvssBelow(cvss);
+ 131 0 } else if (CVE.equals(qName)) {
+ 132 0 rule.addCve(currentText.toString());
+ 133 0 } else if (CVSS_BELOW.equals(qName)) {
+ 134 0 final float cvss = Float.parseFloat(currentText.toString());
+ 135 0 rule.addCvssBelow(cvss);
136
}
- 137 200 }
+ 137 0 }
138
139
@@ -285,8 +285,8 @@
@Override
148
public void characters(char [] ch, int start, int length) throws SAXException {
- 149 440 currentText.append(ch, start, length);
- 150 440 }
+ 149 0 currentText.append(ch, start, length);
+ 150 0 }
151
152
@@ -303,28 +303,28 @@
158
private PropertyType processPropertyType() {
- 159 50 final PropertyType pt = new PropertyType();
- 160 50 pt.setValue(currentText.toString());
- 161 50 if (currentAttributes != null && currentAttributes.getLength() > 0) {
- 162 30 final String regex = currentAttributes.getValue("regex" );
- 163 30 if (regex != null ) {
- 164 30 pt.setRegex(Boolean.parseBoolean(regex));
+ 159 0 final PropertyType pt = new PropertyType();
+ 160 0 pt.setValue(currentText.toString());
+ 161 0 if (currentAttributes != null && currentAttributes.getLength() > 0) {
+ 162 0 final String regex = currentAttributes.getValue("regex" );
+ 163 0 if (regex != null ) {
+ 164 0 pt.setRegex(Boolean.parseBoolean(regex));
165
}
- 166 30 final String caseSensitive = currentAttributes.getValue("caseSensitive" );
- 167 30 if (regex != null ) {
- 168 30 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
+ 166 0 final String caseSensitive = currentAttributes.getValue("caseSensitive" );
+ 167 0 if (regex != null ) {
+ 168 0 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
169
}
170
}
- 171 50 return pt;
+ 171 0 return pt;
172
}
173
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html
index d1e22096d..cf71e72b8 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html
@@ -155,6 +155,6 @@
}
@@ -147,32 +147,32 @@
public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException { 65
try {
- 66 9 final InputStream schemaStream = this .getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd" );
- 67 9 final SuppressionHandler handler = new SuppressionHandler();
+ 66 0 final InputStream schemaStream = this .getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd" );
+ 67 0 final SuppressionHandler handler = new SuppressionHandler();
68
- 69 9 final SAXParserFactory factory = SAXParserFactory.newInstance();
- 70 9 factory.setNamespaceAware(true );
- 71 9 factory.setValidating(true );
- 72 9 final SAXParser saxParser = factory.newSAXParser();
- 73 9 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
- 74 9 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
- 75 9 final XMLReader xmlReader = saxParser.getXMLReader();
- 76 9 xmlReader.setErrorHandler(new SuppressionErrorHandler());
- 77 9 xmlReader.setContentHandler(handler);
+ 69 0 final SAXParserFactory factory = SAXParserFactory.newInstance();
+ 70 0 factory.setNamespaceAware(true );
+ 71 0 factory.setValidating(true );
+ 72 0 final SAXParser saxParser = factory.newSAXParser();
+ 73 0 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
+ 74 0 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
+ 75 0 final XMLReader xmlReader = saxParser.getXMLReader();
+ 76 0 xmlReader.setErrorHandler(new SuppressionErrorHandler());
+ 77 0 xmlReader.setContentHandler(handler);
78
- 79 9 final InputStream inputStream = new FileInputStream(file);
- 80 9 final Reader reader = new InputStreamReader(inputStream, "UTF-8" );
- 81 9 final InputSource in = new InputSource(reader);
+ 79 0 final InputStream inputStream = new FileInputStream(file);
+ 80 0 final Reader reader = new InputStreamReader(inputStream, "UTF-8" );
+ 81 0 final InputSource in = new InputSource(reader);
82
83
- 84 9 xmlReader.parse(in);
+ 84 0 xmlReader.parse(in);
85
- 86 9 return handler.getSuppressionRules();
+ 86 0 return handler.getSuppressionRules();
87 0 } catch (ParserConfigurationException ex) {
88 0 Logger.getLogger(SuppressionParser.class .getName()).log(Level.FINE, null , ex);
89 0 throw new SuppressionParseException(ex);
@@ -193,6 +193,6 @@
}
@@ -77,7 +77,7 @@
30
- 31 63 public class SuppressionRule {
+ 31 0 public class SuppressionRule {
32
33
@@ -174,7 +174,7 @@
79
- 80 63 private List<PropertyType> cpe = new ArrayList<PropertyType>();
+ 80 0 private List<PropertyType> cpe = new ArrayList<PropertyType>();
81
82
@@ -225,8 +225,8 @@
105
public void addCpe(PropertyType cpe) {
- 106 24 this .cpe.add(cpe);
- 107 24 }
+ 106 0 this .cpe.add(cpe);
+ 107 0 }
108
109
@@ -241,7 +241,7 @@
114
public boolean hasCpe() {
- 115 28 return cpe.size() > 0;
+ 115 0 return cpe.size() > 0;
116
}
117
@@ -250,7 +250,7 @@
119
- 120 63 private List<Float> cvssBelow = new ArrayList<Float>();
+ 120 0 private List<Float> cvssBelow = new ArrayList<Float>();
121
122
@@ -301,8 +301,8 @@
145
public void addCvssBelow(Float cvss) {
- 146 13 this .cvssBelow.add(cvss);
- 147 13 }
+ 146 0 this .cvssBelow.add(cvss);
+ 147 0 }
148
149
@@ -317,7 +317,7 @@
154
public boolean hasCvssBelow() {
- 155 25 return cvssBelow.size() > 0;
+ 155 0 return cvssBelow.size() > 0;
156
}
157
@@ -326,7 +326,7 @@
159
- 160 63 private List<String> cwe = new ArrayList<String>();
+ 160 0 private List<String> cwe = new ArrayList<String>();
161
162
@@ -377,8 +377,8 @@
185
public void addCwe(String cwe) {
- 186 2 this .cwe.add(cwe);
- 187 2 }
+ 186 0 this .cwe.add(cwe);
+ 187 0 }
188
189
@@ -393,7 +393,7 @@
194
public boolean hasCwe() {
- 195 26 return cwe.size() > 0;
+ 195 0 return cwe.size() > 0;
196
}
197
@@ -402,7 +402,7 @@
199
- 200 63 private List<String> cve = new ArrayList<String>();
+ 200 0 private List<String> cve = new ArrayList<String>();
201
202
@@ -453,8 +453,8 @@
225
public void addCve(String cve) {
- 226 23 this .cve.add(cve);
- 227 23 }
+ 226 0 this .cve.add(cve);
+ 227 0 }
228
229
@@ -469,7 +469,7 @@
234
public boolean hasCve() {
- 235 28 return cve.size() > 0;
+ 235 0 return cve.size() > 0;
236
}
237
@@ -488,48 +488,48 @@
244
public void process(Dependency dependency) {
- 245 99 if (filePath != null && !filePath.matches(dependency.getFilePath())) {
- 246 54 return ;
+ 245 0 if (filePath != null && !filePath.matches(dependency.getFilePath())) {
+ 246 0 return ;
247
}
- 248 45 if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
- 249 19 return ;
+ 248 0 if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
+ 249 0 return ;
250
}
- 251 26 if (this .hasCpe()) {
- 252 3 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
- 253 8 while (itr.hasNext()) {
- 254 5 final Identifier i = itr.next();
- 255 5 for (PropertyType c : this .cpe) {
- 256 9 if (cpeMatches(c, i)) {
- 257 4 itr.remove();
- 258 4 break ;
+ 251 0 if (this .hasCpe()) {
+ 252 0 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+ 253 0 while (itr.hasNext()) {
+ 254 0 final Identifier i = itr.next();
+ 255 0 for (PropertyType c : this .cpe) {
+ 256 0 if (cpeMatches(c, i)) {
+ 257 0 itr.remove();
+ 258 0 break ;
259
}
- 260 5 }
- 261 5 }
+ 260 0 }
+ 261 0 }
262
}
- 263 26 if (hasCve() || hasCwe() || hasCvssBelow()) {
- 264 23 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
- 265 69 while (itr.hasNext()) {
- 266 46 boolean remove = false ;
- 267 46 final Vulnerability v = itr.next();
- 268 46 for (String entry : this .cve) {
- 269 3 if (entry.equalsIgnoreCase(v.getName())) {
- 270 1 remove = true ;
- 271 1 break ;
+ 263 0 if (hasCve() || hasCwe() || hasCvssBelow()) {
+ 264 0 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
+ 265 0 while (itr.hasNext()) {
+ 266 0 boolean remove = false ;
+ 267 0 final Vulnerability v = itr.next();
+ 268 0 for (String entry : this .cve) {
+ 269 0 if (entry.equalsIgnoreCase(v.getName())) {
+ 270 0 remove = true ;
+ 271 0 break ;
272
}
- 273 2 }
- 274 46 if (!remove) {
- 275 45 for (String entry : this .cwe) {
- 276 1 if (v.getCwe() != null ) {
- 277 1 final String toMatch = String.format("CWE-%s " , entry);
- 278 1 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
- 279 1 if (toTest.equals(toMatch)) {
- 280 1 remove = true ;
- 281 1 break ;
+ 273 0 }
+ 274 0 if (!remove) {
+ 275 0 for (String entry : this .cwe) {
+ 276 0 if (v.getCwe() != null ) {
+ 277 0 final String toMatch = String.format("CWE-%s " , entry);
+ 278 0 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
+ 279 0 if (toTest.equals(toMatch)) {
+ 280 0 remove = true ;
+ 281 0 break ;
282
}
283
@@ -537,24 +537,24 @@
284 0 }
285
}
- 286 46 if (!remove) {
- 287 44 for (float cvss : this .cvssBelow) {
- 288 44 if (v.getCvssScore() < cvss) {
- 289 25 remove = true ;
- 290 25 break ;
+ 286 0 if (!remove) {
+ 287 0 for (float cvss : this .cvssBelow) {
+ 288 0 if (v.getCvssScore() < cvss) {
+ 289 0 remove = true ;
+ 290 0 break ;
291
}
- 292 19 }
+ 292 0 }
293
}
- 294 46 if (remove) {
- 295 27 itr.remove();
+ 294 0 if (remove) {
+ 295 0 itr.remove();
296
}
- 297 46 }
+ 297 0 }
298
}
- 299 26 }
+ 299 0 }
300
301
@@ -571,15 +571,15 @@
307
boolean cpeHasNoVersion(PropertyType c) {
- 308 14 if (c.isRegex()) {
- 309 2 return false ;
+ 308 0 if (c.isRegex()) {
+ 309 0 return false ;
310
}
- 311 12 if (countCharacter(c.getValue(), ':' ) == 3) {
- 312 3 return true ;
+ 311 0 if (countCharacter(c.getValue(), ':' ) == 3) {
+ 312 0 return true ;
313
}
- 314 9 return false ;
+ 314 0 return false ;
315
}
316
@@ -600,14 +600,14 @@
324
int countCharacter(String str, char c) {
- 325 15 int count = 0;
- 326 15 int pos = str.indexOf(c) + 1;
- 327 66 while (pos > 0) {
- 328 51 count += 1;
- 329 51 pos = str.indexOf(c, pos) + 1;
+ 325 0 int count = 0;
+ 326 0 int pos = str.indexOf(c) + 1;
+ 327 0 while (pos > 0) {
+ 328 0 count += 1;
+ 329 0 pos = str.indexOf(c, pos) + 1;
330
}
- 331 15 return count;
+ 331 0 return count;
332
}
333
@@ -628,33 +628,33 @@
341
boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) {
- 342 16 if (cpeEntry.matches(identifier.getValue())) {
- 343 5 return true ;
- 344 11 } else if (cpeHasNoVersion(cpeEntry)) {
- 345 2 if (cpeEntry.isCaseSensitive()) {
+ 342 0 if (cpeEntry.matches(identifier.getValue())) {
+ 343 0 return true ;
+ 344 0 } else if (cpeHasNoVersion(cpeEntry)) {
+ 345 0 if (cpeEntry.isCaseSensitive()) {
346 0 if (identifier.getValue().startsWith(cpeEntry.getValue())) {
347 0 return true ;
348
}
349
} else {
- 350 2 final String id = identifier.getValue().toLowerCase();
- 351 2 final String check = cpeEntry.getValue().toLowerCase();
- 352 2 if (id.startsWith(check)) {
- 353 2 return true ;
+ 350 0 final String id = identifier.getValue().toLowerCase();
+ 351 0 final String check = cpeEntry.getValue().toLowerCase();
+ 352 0 if (id.startsWith(check)) {
+ 353 0 return true ;
354
}
355
}
356
}
- 357 9 return false ;
+ 357 0 return false ;
358
}
359
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html
index 98812848e..4903c8256 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html
@@ -12,7 +12,7 @@
@@ -101,36 +101,36 @@
42
public static byte [] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException {
- 43 108 InputStream fis = null ;
- 44 108 byte [] buffer = new byte [1024];
- 45 108 MessageDigest complete = MessageDigest.getInstance(algorithm);
+ 43 0 InputStream fis = null ;
+ 44 0 byte [] buffer = new byte [1024];
+ 45 0 MessageDigest complete = MessageDigest.getInstance(algorithm);
46
int numRead;
47
try {
- 48 107 fis = new FileInputStream(file);
+ 48 0 fis = new FileInputStream(file);
49
do {
- 50 68600 numRead = fis.read(buffer);
- 51 68600 if (numRead > 0) {
- 52 68497 complete.update(buffer, 0, numRead);
+ 50 0 numRead = fis.read(buffer);
+ 51 0 if (numRead > 0) {
+ 52 0 complete.update(buffer, 0, numRead);
53
}
- 54 68600 } while (numRead != -1);
+ 54 0 } while (numRead != -1);
55
} finally {
- 56 107 if (fis != null ) {
+ 56 0 if (fis != null ) {
57
try {
- 58 103 fis.close();
+ 58 0 fis.close();
59 0 } catch (IOException ex) {
60 0 Logger.getLogger(Checksum.class .getName()).log(Level.FINEST, "Error closing file '" + file.getName() + "'." , ex);
- 61 107 }
+ 61 0 }
62
}
63
}
- 64 103 return complete.digest();
+ 64 0 return complete.digest();
65
}
66
@@ -153,8 +153,8 @@
75
public static String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException {
- 76 54 byte [] b = getChecksum("MD5" , file);
- 77 51 return getHex(b);
+ 76 0 byte [] b = getChecksum("MD5" , file);
+ 77 0 return getHex(b);
78
}
79
@@ -177,8 +177,8 @@
88
public static String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException {
- 89 51 byte [] b = getChecksum("SHA1" , file);
- 90 51 return getHex(b);
+ 89 0 byte [] b = getChecksum("SHA1" , file);
+ 90 0 return getHex(b);
91
}
92
@@ -205,22 +205,22 @@
103
public static String getHex(byte [] raw) {
- 104 103 if (raw == null ) {
+ 104 0 if (raw == null ) {
105 0 return null ;
106
}
- 107 103 final StringBuilder hex = new StringBuilder(2 * raw.length);
- 108 1956 for (final byte b : raw) {
- 109 1853 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
+ 107 0 final StringBuilder hex = new StringBuilder(2 * raw.length);
+ 108 0 for (final byte b : raw) {
+ 109 0 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
110
}
- 111 103 return hex.toString();
+ 111 0 return hex.toString();
112
}
113
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html
index 5abe27d4d..3a1d5d1f1 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html
@@ -12,7 +12,7 @@
@@ -143,18 +143,18 @@
68
public static void closeStatement(Statement statement) {
- 69 313 if (statement != null ) {
+ 69 0 if (statement != null ) {
70
try {
- 71 313 statement.close();
+ 71 0 statement.close();
72 0 } catch (SQLException ex) {
73 0 Logger.getLogger(CveDB.class
74
.getName()).log(Level.FINEST, statement.toString(), ex);
- 75 313 }
+ 75 0 }
76
}
- 77 313 }
+ 77 0 }
78
79
@@ -169,22 +169,22 @@
84
public static void closeResultSet(ResultSet rs) {
- 85 323 if (rs != null ) {
+ 85 0 if (rs != null ) {
86
try {
- 87 323 rs.close();
+ 87 0 rs.close();
88 0 } catch (SQLException ex) {
89 0 Logger.getLogger(CveDB.class
90
.getName()).log(Level.FINEST, rs.toString(), ex);
- 91 323 }
+ 91 0 }
92
}
- 93 323 }
+ 93 0 }
94
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html
index 3f4f7983b..84df40056 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html
@@ -12,7 +12,7 @@
@@ -95,7 +95,7 @@
39
- 40 14 public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
+ 40 0 public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
41
42
@@ -124,9 +124,9 @@
54
- 55 12873 public DependencyVersion(String version) {
- 56 12873 parseVersion(version);
- 57 12873 }
+ 55 0 public DependencyVersion(String version) {
+ 56 0 parseVersion(version);
+ 57 0 }
58
59
@@ -143,21 +143,21 @@
65
public final void parseVersion(String version) {
- 66 12875 versionParts = new ArrayList<String>();
- 67 12875 if (version != null ) {
- 68 12875 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)" );
- 69 12875 final Matcher matcher = rx.matcher(version.toLowerCase());
- 70 53017 while (matcher.find()) {
- 71 40142 versionParts.add(matcher.group());
+ 66 0 versionParts = new ArrayList<String>();
+ 67 0 if (version != null ) {
+ 68 0 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)" );
+ 69 0 final Matcher matcher = rx.matcher(version.toLowerCase());
+ 70 0 while (matcher.find()) {
+ 71 0 versionParts.add(matcher.group());
72
}
- 73 12875 if (versionParts.isEmpty()) {
- 74 77 versionParts.add(version);
+ 73 0 if (versionParts.isEmpty()) {
+ 74 0 versionParts.add(version);
75
}
76
}
- 77 12875 }
+ 77 0 }
78
79
@@ -216,7 +216,7 @@
106
public Iterator iterator() {
- 107 1 return versionParts.iterator();
+ 107 0 return versionParts.iterator();
108
}
109
@@ -235,7 +235,7 @@
@Override
116
public String toString() {
- 117 3722 return StringUtils.join(versionParts.toArray(), "." );
+ 117 0 return StringUtils.join(versionParts.toArray(), "." );
118
}
119
@@ -256,33 +256,33 @@
@Override
127
public boolean equals(Object obj) {
- 128 12509 if (obj == null ) {
+ 128 0 if (obj == null ) {
129 0 return false ;
130
}
- 131 12509 if (getClass() != obj.getClass()) {
+ 131 0 if (getClass() != obj.getClass()) {
132 0 return false ;
133
}
- 134 12509 final DependencyVersion other = (DependencyVersion) obj;
- 135 12509 final int max = (this .versionParts.size() < other.versionParts.size())
+ 134 0 final DependencyVersion other = (DependencyVersion) obj;
+ 135 0 final int max = (this .versionParts.size() < other.versionParts.size())
136
? this .versionParts.size() : other.versionParts.size();
137
- 138 19001 for (int i = 0; i < max; i++) {
- 139 18310 final String thisPart = this .versionParts.get(i);
- 140 18310 final String otherPart = other.versionParts.get(i);
- 141 18310 if (!thisPart.equals(otherPart)) {
- 142 11818 return false ;
+ 138 0 for (int i = 0; i < max; i++) {
+ 139 0 final String thisPart = this .versionParts.get(i);
+ 140 0 final String otherPart = other.versionParts.get(i);
+ 141 0 if (!thisPart.equals(otherPart)) {
+ 142 0 return false ;
143
}
144
}
- 145 691 if (this .versionParts.size() > max) {
- 146 86 for (int i = max; i < this .versionParts.size(); i++) {
- 147 86 if (!"0" .equals(this .versionParts.get(i))) {
- 148 86 return false ;
+ 145 0 if (this .versionParts.size() > max) {
+ 146 0 for (int i = max; i < this .versionParts.size(); i++) {
+ 147 0 if (!"0" .equals(this .versionParts.get(i))) {
+ 148 0 return false ;
149
}
150
@@ -291,10 +291,10 @@
}
152
- 153 605 if (other.versionParts.size() > max) {
- 154 463 for (int i = max; i < other.versionParts.size(); i++) {
- 155 447 if (!"0" .equals(other.versionParts.get(i))) {
- 156 415 return false ;
+ 153 0 if (other.versionParts.size() > max) {
+ 154 0 for (int i = max; i < other.versionParts.size(); i++) {
+ 155 0 if (!"0" .equals(other.versionParts.get(i))) {
+ 156 0 return false ;
157
}
158
@@ -313,7 +313,7 @@
165
- 166 190 return true ;
+ 166 0 return true ;
167
}
168
@@ -332,9 +332,9 @@
@Override
175
public int hashCode() {
- 176 1 int hash = 5;
- 177 1 hash = 71 * hash + (this .versionParts != null ? this .versionParts.hashCode() : 0);
- 178 1 return hash;
+ 176 0 int hash = 5;
+ 177 0 hash = 71 * hash + (this .versionParts != null ? this .versionParts.hashCode() : 0);
+ 178 0 return hash;
179
}
180
@@ -355,35 +355,35 @@
188
public boolean matchesAtLeastThreeLevels(DependencyVersion version) {
- 189 8359 if (version == null ) {
+ 189 0 if (version == null ) {
190 0 return false ;
191
}
192
- 193 8359 boolean ret = true ;
- 194 8359 int max = (this .versionParts.size() < version.versionParts.size())
+ 193 0 boolean ret = true ;
+ 194 0 int max = (this .versionParts.size() < version.versionParts.size())
195
? this .versionParts.size() : version.versionParts.size();
196
- 197 8359 if (max > 3) {
- 198 2 max = 3;
+ 197 0 if (max > 3) {
+ 198 0 max = 3;
199
}
200
- 201 12674 for (int i = 0; i < max; i++) {
- 202 12260 if (this .versionParts.get(i) == null || !this .versionParts.get(i).equals(version.versionParts.get(i))) {
- 203 7945 ret = false ;
- 204 7945 break ;
+ 201 0 for (int i = 0; i < max; i++) {
+ 202 0 if (this .versionParts.get(i) == null || !this .versionParts.get(i).equals(version.versionParts.get(i))) {
+ 203 0 ret = false ;
+ 204 0 break ;
205
}
206
}
207
- 208 8359 return ret;
+ 208 0 return ret;
209
}
210
@@ -392,36 +392,36 @@
@Override
212
public int compareTo(DependencyVersion version) {
- 213 55 if (version == null ) {
+ 213 0 if (version == null ) {
214 0 return 1;
215
}
- 216 55 final List<String> left = this .getVersionParts();
- 217 55 final List<String> right = version.getVersionParts();
- 218 55 final int max = left.size() < right.size() ? left.size() : right.size();
+ 216 0 final List<String> left = this .getVersionParts();
+ 217 0 final List<String> right = version.getVersionParts();
+ 218 0 final int max = left.size() < right.size() ? left.size() : right.size();
219
- 220 92 for (int i = 0; i < max; i++) {
- 221 85 final String lStr = left.get(i);
- 222 85 final String rStr = right.get(i);
- 223 85 if (lStr.equals(rStr)) {
- 224 37 continue ;
+ 220 0 for (int i = 0; i < max; i++) {
+ 221 0 final String lStr = left.get(i);
+ 222 0 final String rStr = right.get(i);
+ 223 0 if (lStr.equals(rStr)) {
+ 224 0 continue ;
225
}
226
try {
- 227 48 final int l = Integer.parseInt(lStr);
- 228 43 final int r = Integer.parseInt(rStr);
- 229 43 if (l < r) {
- 230 35 return -1;
- 231 8 } else if (l > r) {
- 232 8 return 1;
+ 227 0 final int l = Integer.parseInt(lStr);
+ 228 0 final int r = Integer.parseInt(rStr);
+ 229 0 if (l < r) {
+ 230 0 return -1;
+ 231 0 } else if (l > r) {
+ 232 0 return 1;
233
}
- 234 5 } catch (NumberFormatException ex) {
- 235 5 final int comp = left.get(i).compareTo(right.get(i));
- 236 5 if (comp < 0) {
- 237 5 return -1;
+ 234 0 } catch (NumberFormatException ex) {
+ 235 0 final int comp = left.get(i).compareTo(right.get(i));
+ 236 0 if (comp < 0) {
+ 237 0 return -1;
238 0 } else if (comp > 0) {
239 0 return 1;
240
@@ -429,13 +429,13 @@
241 0 }
242
}
- 243 7 if (left.size() < right.size()) {
- 244 3 return -1;
- 245 4 } else if (left.size() > right.size()) {
- 246 3 return 1;
+ 243 0 if (left.size() < right.size()) {
+ 244 0 return -1;
+ 245 0 } else if (left.size() > right.size()) {
+ 246 0 return 1;
247
} else {
- 248 1 return 0;
+ 248 0 return 0;
249
}
250
@@ -444,6 +444,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html
index 166aad238..f7fc0472b 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html
@@ -12,7 +12,7 @@
@@ -85,7 +85,7 @@
34
- 35 1 private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
+ 35 0 private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
36
37
@@ -94,7 +94,7 @@
39
- 40 1 private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
+ 40 0 private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
41
42
@@ -131,56 +131,56 @@
58
public static DependencyVersion parseVersion(String text) {
- 59 12839 if (text == null ) {
- 60 40 return null ;
+ 59 0 if (text == null ) {
+ 60 0 return null ;
61
}
62
- 63 12799 if ("-" .equals(text)) {
- 64 19 final DependencyVersion dv = new DependencyVersion();
- 65 19 final ArrayList<String> list = new ArrayList<String>();
- 66 19 list.add(text);
- 67 19 dv.setVersionParts(list);
- 68 19 return dv;
+ 63 0 if ("-" .equals(text)) {
+ 64 0 final DependencyVersion dv = new DependencyVersion();
+ 65 0 final ArrayList<String> list = new ArrayList<String>();
+ 66 0 list.add(text);
+ 67 0 dv.setVersionParts(list);
+ 68 0 return dv;
69
}
- 70 12780 String version = null ;
- 71 12780 Matcher matcher = RX_VERSION.matcher(text);
- 72 12780 if (matcher.find()) {
- 73 12664 version = matcher.group();
+ 70 0 String version = null ;
+ 71 0 Matcher matcher = RX_VERSION.matcher(text);
+ 72 0 if (matcher.find()) {
+ 73 0 version = matcher.group();
74
}
75
- 76 12780 if (matcher.find()) {
- 77 2 return null ;
+ 76 0 if (matcher.find()) {
+ 77 0 return null ;
78
}
- 79 12778 if (version == null ) {
- 80 116 matcher = RX_SINGLE_VERSION.matcher(text);
- 81 116 if (matcher.find()) {
- 82 106 version = matcher.group();
+ 79 0 if (version == null ) {
+ 80 0 matcher = RX_SINGLE_VERSION.matcher(text);
+ 81 0 if (matcher.find()) {
+ 82 0 version = matcher.group();
83
} else {
- 84 10 return null ;
+ 84 0 return null ;
85
}
86
- 87 106 if (matcher.find()) {
- 88 1 return null ;
+ 87 0 if (matcher.find()) {
+ 88 0 return null ;
89
}
90
}
- 91 12767 return new DependencyVersion(version);
+ 91 0 return new DependencyVersion(version);
92
}
93
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html
index 57bbd278d..50238f8ce 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html
@@ -155,6 +155,6 @@
}
@@ -145,31 +145,31 @@
65
public static void fetchFile(URL url, File outputPath, boolean useProxy) throws DownloadFailedException {
- 66 8 if ("file" .equalsIgnoreCase(url.getProtocol())) {
+ 66 0 if ("file" .equalsIgnoreCase(url.getProtocol())) {
67
File file;
68
try {
- 69 8 file = new File(url.toURI());
+ 69 0 file = new File(url.toURI());
70 0 } catch (URISyntaxException ex) {
71 0 final String msg = String.format("Download failed, unable to locate '%s'" , url.toString());
72 0 throw new DownloadFailedException(msg);
- 73 8 }
- 74 8 if (file.exists()) {
+ 73 0 }
+ 74 0 if (file.exists()) {
75
try {
- 76 8 org.apache.commons.io.FileUtils.copyFile(file, outputPath);
+ 76 0 org.apache.commons.io.FileUtils.copyFile(file, outputPath);
77 0 } catch (IOException ex) {
78 0 final String msg = String.format("Download failed, unable to copy '%s'" , url.toString());
79 0 throw new DownloadFailedException(msg);
- 80 8 }
+ 80 0 }
81
} else {
82 0 final String msg = String.format("Download failed, file does not exist '%s'" , url.toString());
83 0 throw new DownloadFailedException(msg);
84
}
- 85 8 } else {
+ 85 0 } else {
86 0 HttpURLConnection conn = null ;
87
try {
@@ -251,7 +251,7 @@
144 0 }
145
}
- 146 8 }
+ 146 0 }
147
148
@@ -272,21 +272,21 @@
156
public static long getLastModified(URL url) throws DownloadFailedException {
- 157 10 long timestamp = 0;
+ 157 0 long timestamp = 0;
158
- 159 10 if ("file" .equalsIgnoreCase(url.getProtocol())) {
+ 159 0 if ("file" .equalsIgnoreCase(url.getProtocol())) {
160
File lastModifiedFile;
161
try {
- 162 10 lastModifiedFile = new File(url.toURI());
+ 162 0 lastModifiedFile = new File(url.toURI());
163 0 } catch (URISyntaxException ex) {
164 0 final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?" , url.toString());
165 0 throw new DownloadFailedException(msg);
- 166 10 }
- 167 10 timestamp = lastModifiedFile.lastModified();
- 168 10 } else {
+ 166 0 }
+ 167 0 timestamp = lastModifiedFile.lastModified();
+ 168 0 } else {
169 0 HttpURLConnection conn = null ;
170
try {
@@ -314,13 +314,13 @@
} 188
}
- 189 10 return timestamp;
+ 189 0 return timestamp;
190
}
191
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html
index b7e43a996..6fb0770ca 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html
@@ -155,6 +155,6 @@
}
@@ -104,320 +104,362 @@
43
44
-
+ 45
46
- private static final int BUFFER_SIZE = 4096;
+ private static final String BIT_BUCKET_UNIX = "/dev/null" ; 47
48
49
-
+ 50
51
- private FileUtils() {
+ private static final String BIT_BUCKET_WIN = "NUL" ; 52
- }
+ 53
-
+ 54
-
+ 55
-
+ 56
-
+ private static final int BUFFER_SIZE = 4096; 57
-
+ 58
-
+ 59
-
+ 60
- public static String getFileExtension(String fileName) {
- 61 237 String ret = null ;
- 62 237 final int pos = fileName.lastIndexOf("." );
- 63 237 if (pos >= 0) {
- 64 229 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
+ 61
+ private FileUtils() {
+ 62
+ }
+ 63
+
+ 64
+
65
- }
- 66 237 return ret;
+ 66
+
67
- }
+ 68
-
+ 69
-
+ 70
-
- 71
-
- 72
-
- 73
-
- 74
-
+ public static String getFileExtension(String fileName) { 71 0 String ret = null ;
+ 72 0 final int pos = fileName.lastIndexOf("." );
+ 73 0 if (pos >= 0) {
+ 74 0 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
75
- public static boolean delete(File file) {
- 76 75 boolean success = true ;
- 77 75 if (file.isDirectory()) {
- 78 101 for (File f : file.listFiles()) {
- 79 54 success &= delete(f);
+ } 76 0 return ret;
+ 77
+ }
+ 78
+
+ 79
+
80
- }
+ 81
- }
- 82 75 if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
- 83 6 success = false ;
- 84 6 final String msg = String.format("Failed to delete file: %s" , file.getPath());
- 85 6 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg);
- 86
- }
- 87 75 return success;
- 88
- }
- 89
-
- 90
-
- 91
-
+ 82
+
+ 83
+
+ 84
+
+ 85
+ public static boolean delete(File file) {
+ 86 0 boolean success = true ;
+ 87 0 if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
+ 88 0 success = false ;
+ 89 0 final String msg = String.format("Failed to delete file: %s; attempting to delete on exit." , file.getPath());
+ 90 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg);
+ 91 0 file.deleteOnExit();
92
-
- 93
-
+ } 93 0 return success;
94
-
+ } 95
-
+ 96
-
+ 97
- public static File getTempFile(String prefix, String extension) {
- 98 8 final File dir = Settings.getTempDirectory();
- 99 8 if (!dir.exists()) {
- 100 0 dir.mkdirs();
+ 98
+
+ 99
+
+ 100
+
101
- }
- 102 8 final String tempFileName = String.format("%s%s.%s" , prefix, UUID.randomUUID().toString(), extension);
- 103 8 final File tempFile = new File(dir, tempFileName);
- 104 8 if (tempFile.exists()) {
- 105 0 return getTempFile(prefix, extension);
- 106
- }
- 107 8 return tempFile;
- 108
- }
+ 102
+
+ 103
+
+ 104
+ public static File getTempFile(String prefix, String extension) throws IOException {
+ 105 0 final File dir = Settings.getTempDirectory();
+ 106 0 if (!dir.exists()) {
+ 107 0 if (!dir.mkdirs()) {
+ 108 0 throw new IOException("Unable to create temporary folder" );
109
-
- 110
-
- 111
-
- 112
-
- 113
-
- 114
-
- 115
-
- 116
-
- 117
-
- 118
-
- 119
-
- 120
-
- 121
-
- 122
- @java.lang.Deprecated
- 123
- public static File getDataDirectory(String configuredFilePath, Class clazz) throws IOException {
- 124 0 final File file = new File(configuredFilePath);
- 125 0 if (file.isDirectory() && file.canWrite()) {
- 126 0 return new File(file.getCanonicalPath());
- 127
- } else {
- 128 0 final File exePath = getPathToJar(clazz);
- 129 0 return new File(exePath, configuredFilePath);
- 130
- }
- 131
- }
- 132
-
- 133
-
- 134
-
- 135
-
- 136
-
- 137
-
- 138
-
- 139
-
- 140
-
- 141
-
- 142
- @java.lang.Deprecated
- 143
- public static File getPathToJar(Class clazz) throws UnsupportedEncodingException {
- 144 0 final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath();
- 145 0 final String decodedPath = URLDecoder.decode(filePath, "UTF-8" );
- 146 0 final File jarPath = new File(decodedPath);
- 147 0 return jarPath.getParentFile();
- 148
- }
- 149
-
- 150
-
- 151
-
- 152
-
- 153
-
- 154
-
- 155
-
- 156
-
- 157
- public static void extractFiles(File archive, File extractTo) throws ExtractionException {
- 158 0 extractFiles(archive, extractTo, null );
- 159 0 }
- 160
-
- 161
-
- 162
-
- 163
-
- 164
-
- 165
-
- 166
-
- 167
-
- 168
-
- 169
-
- 170
-
- 171
- public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
- 172 0 if (archive == null || extractTo == null ) {
- 173 0 return ;
- 174
- }
- 175
-
- 176 0 FileInputStream fis = null ;
- 177 0 ZipInputStream zis = null ;
- 178
-
- 179
- try {
- 180 0 fis = new FileInputStream(archive);
- 181 0 } catch (FileNotFoundException ex) {
- 182 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
- 183 0 throw new ExtractionException("Archive file was not found." , ex);
- 184 0 }
- 185 0 zis = new ZipInputStream(new BufferedInputStream(fis));
- 186
- ZipEntry entry;
- 187
- try {
- 188 0 while ((entry = zis.getNextEntry()) != null ) {
- 189 0 if (entry.isDirectory()) {
- 190 0 final File d = new File(extractTo, entry.getName());
- 191 0 if (!d.exists() && !d.mkdirs()) {
- 192 0 final String msg = String.format("Unable to create '%s'." , d.getAbsolutePath());
- 193 0 throw new ExtractionException(msg);
- 194
- }
- 195 0 } else {
- 196 0 final File file = new File(extractTo, entry.getName());
- 197 0 final String ext = getFileExtension(file.getName());
- 198 0 if (engine == null || engine.supportsExtension(ext)) {
- 199 0 BufferedOutputStream bos = null ;
- 200
- FileOutputStream fos;
- 201
- try {
- 202 0 fos = new FileOutputStream(file);
- 203 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
- 204
- int count;
- 205 0 final byte data[] = new byte [BUFFER_SIZE];
- 206 0 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
- 207 0 bos.write(data, 0, count);
- 208
- }
- 209 0 bos.flush();
- 210 0 } catch (FileNotFoundException ex) {
- 211 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
- 212 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
- 213 0 throw new ExtractionException(msg, ex);
- 214 0 } catch (IOException ex) {
- 215 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
- 216 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
- 217 0 throw new ExtractionException(msg, ex);
- 218
- } finally {
- 219 0 if (bos != null ) {
- 220
- try {
- 221 0 bos.close();
- 222 0 } catch (IOException ex) {
- 223 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
- 224 0 }
- 225
- }
- 226
- }
- 227
- }
- 228 0 }
- 229
}
- 230 0 } catch (IOException ex) {
- 231 0 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
- 232 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg, ex);
- 233 0 throw new ExtractionException(msg, ex);
+ 110
+ }
+ 111 0 final String tempFileName = String.format("%s%s.%s" , prefix, UUID.randomUUID().toString(), extension);
+ 112 0 final File tempFile = new File(dir, tempFileName);
+ 113 0 if (tempFile.exists()) {
+ 114 0 return getTempFile(prefix, extension);
+ 115
+ }
+ 116 0 return tempFile;
+ 117
+ }
+ 118
+
+ 119
+
+ 120
+
+ 121
+
+ 122
+
+ 123
+
+ 124
+
+ 125
+
+ 126
+
+ 127
+
+ 128
+
+ 129
+
+ 130
+
+ 131
+ @java.lang.Deprecated
+ 132
+ public static File getDataDirectory(String configuredFilePath, Class clazz) throws IOException {
+ 133 0 final File file = new File(configuredFilePath);
+ 134 0 if (file.isDirectory() && file.canWrite()) {
+ 135 0 return new File(file.getCanonicalPath());
+ 136
+ } else {
+ 137 0 final File exePath = getPathToJar(clazz);
+ 138 0 return new File(exePath, configuredFilePath);
+ 139
+ }
+ 140
+ }
+ 141
+
+ 142
+
+ 143
+
+ 144
+
+ 145
+
+ 146
+
+ 147
+
+ 148
+
+ 149
+
+ 150
+
+ 151
+ @java.lang.Deprecated
+ 152
+ public static File getPathToJar(Class clazz) throws UnsupportedEncodingException {
+ 153 0 final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath();
+ 154 0 final String decodedPath = URLDecoder.decode(filePath, "UTF-8" );
+ 155 0 final File jarPath = new File(decodedPath);
+ 156 0 return jarPath.getParentFile();
+ 157
+ }
+ 158
+
+ 159
+
+ 160
+
+ 161
+
+ 162
+
+ 163
+
+ 164
+
+ 165
+
+ 166
+ public static void extractFiles(File archive, File extractTo) throws ExtractionException {
+ 167 0 extractFiles(archive, extractTo, null );
+ 168 0 }
+ 169
+
+ 170
+
+ 171
+
+ 172
+
+ 173
+
+ 174
+
+ 175
+
+ 176
+
+ 177
+
+ 178
+
+ 179
+
+ 180
+ public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
+ 181 0 if (archive == null || extractTo == null ) {
+ 182 0 return ;
+ 183
+ }
+ 184
+
+ 185 0 FileInputStream fis = null ;
+ 186 0 ZipInputStream zis = null ;
+ 187
+
+ 188
+ try {
+ 189 0 fis = new FileInputStream(archive);
+ 190 0 } catch (FileNotFoundException ex) {
+ 191 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
+ 192 0 throw new ExtractionException("Archive file was not found." , ex);
+ 193 0 }
+ 194 0 zis = new ZipInputStream(new BufferedInputStream(fis));
+ 195
+ ZipEntry entry;
+ 196
+ try {
+ 197 0 while ((entry = zis.getNextEntry()) != null ) {
+ 198 0 if (entry.isDirectory()) {
+ 199 0 final File d = new File(extractTo, entry.getName());
+ 200 0 if (!d.exists() && !d.mkdirs()) {
+ 201 0 final String msg = String.format("Unable to create '%s'." , d.getAbsolutePath());
+ 202 0 throw new ExtractionException(msg);
+ 203
+ }
+ 204 0 } else {
+ 205 0 final File file = new File(extractTo, entry.getName());
+ 206 0 final String ext = getFileExtension(file.getName());
+ 207 0 if (engine == null || engine.supportsExtension(ext)) {
+ 208 0 BufferedOutputStream bos = null ;
+ 209
+ FileOutputStream fos;
+ 210
+ try {
+ 211 0 fos = new FileOutputStream(file);
+ 212 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+ 213
+ int count;
+ 214 0 final byte data[] = new byte [BUFFER_SIZE];
+ 215 0 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
+ 216 0 bos.write(data, 0, count);
+ 217
+ }
+ 218 0 bos.flush();
+ 219 0 } catch (FileNotFoundException ex) {
+ 220 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
+ 221 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
+ 222 0 throw new ExtractionException(msg, ex);
+ 223 0 } catch (IOException ex) {
+ 224 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
+ 225 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+ 226 0 throw new ExtractionException(msg, ex);
+ 227
+ } finally {
+ 228 0 if (bos != null ) {
+ 229
+ try {
+ 230 0 bos.close();
+ 231 0 } catch (IOException ex) {
+ 232 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
+ 233 0 }
234
+ }
+ 235
+ }
+ 236
+ }
+ 237 0 }
+ 238
+ }
+ 239 0 } catch (IOException ex) {
+ 240 0 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
+ 241 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg, ex);
+ 242 0 throw new ExtractionException(msg, ex);
+ 243
} finally {
- 235 0 try {
- 236 0 zis.close();
- 237 0 } catch (IOException ex) {
- 238 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
- 239 0 }
- 240 0 }
- 241 0 }
- 242
+ 244 0 try {
+ 245 0 zis.close();
+ 246 0 } catch (IOException ex) {
+ 247 0 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
+ 248 0 }
+ 249 0 }
+ 250 0 }
+ 251
+
+ 252
+
+ 253
+
+ 254
+
+ 255
+
+ 256
+
+ 257
+ public static String getBitBucket() {
+ 258 0 if (System.getProperty("os.name" ).startsWith("Windows" )) {
+ 259 0 return BIT_BUCKET_WIN;
+ 260
+ } else {
+ 261 0 return BIT_BUCKET_UNIX;
+ 262
+ }
+ 263
+ }
+ 264
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html
index c4010be4b..a0117cc18 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html
@@ -12,9 +12,9 @@
@@ -57,19 +57,19 @@
19
public Iterator<T> filter(Iterator<T> iterator) {
- 20 1951 return new FilterIterator(iterator);
+ 20 0 return new FilterIterator(iterator);
21
}
22
23
public Iterable<T> filter(final Iterable<T> iterable) {
- 24 1951 return new Iterable<T>() {
+ 24 0 return new Iterable<T>() {
25
26
public Iterator<T> iterator() {
- 27 1951 return filter(iterable.iterator());
+ 27 0 return filter(iterable.iterator());
28
}
29
@@ -78,7 +78,7 @@
}
31
- 32 1951 private class FilterIterator implements Iterator<T> {
+ 32 0 private class FilterIterator implements Iterator<T> {
33
34
@@ -87,28 +87,28 @@
private T next;
36
- 37 1951 private FilterIterator(Iterator<T> iterator) {
- 38 1951 this .iterator = iterator;
- 39 1951 toNext();
- 40 1951 }
+ 37 0 private FilterIterator(Iterator<T> iterator) {
+ 38 0 this .iterator = iterator;
+ 39 0 toNext();
+ 40 0 }
41
42
public boolean hasNext() {
- 43 8206 return next != null ;
+ 43 0 return next != null ;
44
}
45
46
public T next() {
- 47 6765 if (next == null ) {
+ 47 0 if (next == null ) {
48 0 throw new NoSuchElementException();
49
}
- 50 6765 T returnValue = next;
- 51 6765 toNext();
- 52 6765 return returnValue;
+ 50 0 T returnValue = next;
+ 51 0 toNext();
+ 52 0 return returnValue;
53
}
54
@@ -122,22 +122,22 @@
59
private void toNext() {
- 60 8716 next = null ;
- 61 13000 while (iterator.hasNext()) {
- 62 11445 T item = iterator.next();
- 63 11445 if (item != null && passes(item)) {
- 64 7161 next = item;
- 65 7161 break ;
+ 60 0 next = null ;
+ 61 0 while (iterator.hasNext()) {
+ 62 0 T item = iterator.next();
+ 63 0 if (item != null && passes(item)) {
+ 64 0 next = item;
+ 65 0 break ;
66
}
- 67 4284 }
- 68 8716 }
+ 67 0 }
+ 68 0 }
69
}
70
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html
index 4dc87cb51..0a9db20a7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html
@@ -155,6 +155,6 @@
} }
@@ -150,7 +150,7 @@
77
- 78 1 private static boolean verboseLoggingEnabled = false ;
+ 78 0 private static boolean verboseLoggingEnabled = false ;
79
80
@@ -165,13 +165,13 @@
85
public static boolean isVerboseLoggingEnabled() {
- 86 5 return verboseLoggingEnabled;
+ 86 0 return verboseLoggingEnabled;
87
}
88
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html
index ca8e18daf..4548512f3 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html
@@ -12,7 +12,7 @@
@@ -107,11 +107,11 @@
public void close() { 45
- 46 7 }
+ 46 0 }
47
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html
index 2f188b5bb..dd2a9dfcf 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html
@@ -12,7 +12,7 @@
@@ -211,10 +211,10 @@
@Override 97
public int hashCode() {
- 98 236555 int hash = 3;
- 99 236555 hash = 53 * hash + (this .left != null ? this .left.hashCode() : 0);
- 100 236555 hash = 53 * hash + (this .right != null ? this .right.hashCode() : 0);
- 101 236555 return hash;
+ 98 0 int hash = 3;
+ 99 0 hash = 53 * hash + (this .left != null ? this .left.hashCode() : 0);
+ 100 0 hash = 53 * hash + (this .right != null ? this .right.hashCode() : 0);
+ 101 0 return hash;
102
}
103
@@ -259,6 +259,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html
index b15fb1724..c0e31b4fe 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html
@@ -12,8 +12,8 @@
@@ -104,7 +104,7 @@
43
- 44 1 private static final Logger LOGGER = Logger.getLogger(Settings.class .getName());
+ 44 0 private static final Logger LOGGER = Logger.getLogger(Settings.class .getName());
45
46
@@ -314,346 +314,350 @@
148
149
-
+ 150
151
- public static final String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled" ;
+ public static final String ANALYZER_JAR_ENABLED = "analyzer.jar.enabled" ; 152
153
-
+ 154
155
- public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url" ;
+ public static final String ANALYZER_ARCHIVE_ENABLED = "analyzer.archive.enabled" ; 156
157
-
+ 158
159
- public static final String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy" ;
+ public static final String ANALYZER_ASSEMBLY_ENABLED = "analyzer.assembly.enabled" ; 160
161
-
+ 162
163
- public static final String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path" ;
+ public static final String ANALYZER_NUSPEC_ENABLED = "analyzer.nuspec.enabled" ; 164
165
-
+ 166
167
- public static final String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip" ;
+ public static final String ANALYZER_JAVASCRIPT_ENABLED = "analyzer.javascript.enabled" ; 168
169
-
+ 170
171
- public static final String SKIP_TEST_SCOPE = "skip.test.scope" ;
+ public static final String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled" ; 172
173
-
+ 174
175
- public static final String SKIP_RUNTIME_SCOPE = "skip.runtime.scope" ;
+ public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url" ; 176
177
-
+ 178
179
- public static final String SKIP_PROVIDED_SCOPE = "skip.provided.scope" ;
+ public static final String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy" ; 180
- }
+ 181
-
+ 182
-
+ 183
-
+ public static final String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path" ; 184
- private static final String PROPERTIES_FILE = "dependencycheck.properties" ;
+ 185
-
+ 186
-
+ 187
-
- 188 1 private static final Settings INSTANCE = new Settings();
+ public static final String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip" ; 188
+
189
-
+ 190
-
+ 191
-
- 192 1 private Properties props = null ;
+ public static final String SKIP_TEST_SCOPE = "skip.test.scope" ; 192
+
193
-
+ 194
-
+ 195
-
+ public static final String SKIP_RUNTIME_SCOPE = "skip.runtime.scope" ; 196
-
- 197 1 private Settings() {
- 198 1 InputStream in = null ;
- 199 1 props = new Properties();
+ 197
+
+ 198
+
+ 199
+ public static final String SKIP_PROVIDED_SCOPE = "skip.provided.scope" ;
200
- try {
- 201 1 in = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
- 202 1 props.load(in);
- 203 0 } catch (IOException ex) {
- 204 0 Logger.getLogger(Settings.class .getName()).log(Level.SEVERE, "Unable to load default settings." );
- 205 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, null , ex);
+ } 201
+
+ 202
+
+ 203
+
+ 204
+ private static final String PROPERTIES_FILE = "dependencycheck.properties" ;
+ 205
+
206
- } finally {
- 207 1 if (in != null ) {
- 208
- try {
- 209 1 in.close();
- 210 0 } catch (IOException ex) {
- 211 0 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
- 212 1 }
+ 207
+
+ 208 0 private static final Settings INSTANCE = new Settings();
+ 209
+
+ 210
+
+ 211
+
+ 212 0 private Properties props = null ;
213
- }
+ 214
- }
- 215 1 logProperties("Properties loaded" , props);
- 216 1 }
- 217
-
- 218
- 219
-
+ 215
+
+ 216
+
+ 217 0 private Settings() {
+ 218 0 InputStream in = null ;
+ 219 0 props = new Properties();
220
-
- 221
-
- 222
-
- 223
-
- 224
- private static void logProperties(String header, Properties properties) {
- 225 2 if (LOGGER.isLoggable(Level.FINE)) {
- 226 0 final StringWriter sw = new StringWriter();
- 227 0 PrintWriter pw = null ;
+ try { 221 0 in = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+ 222 0 props.load(in);
+ 223 0 } catch (IOException ex) {
+ 224 0 Logger.getLogger(Settings.class .getName()).log(Level.SEVERE, "Unable to load default settings." );
+ 225 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, null , ex);
+ 226
+ } finally {
+ 227 0 if (in != null ) {
228
- try {
- 229 0 pw = new PrintWriter(sw);
- 230 0 pw.format("%s:%n%n" , header);
- 231 0 final Enumeration e = properties.propertyNames();
- 232 0 while (e.hasMoreElements()) {
- 233 0 final String key = (String) e.nextElement();
- 234 0 if (key.contains("password" )) {
- 235 0 pw.format("%s='*****'%n" , key);
- 236
- } else {
- 237 0 final String value = properties.getProperty(key);
- 238 0 if (value != null ) {
- 239 0 pw.format("%s='%s'%n" , key, value);
- 240
- }
- 241
- }
- 242 0 }
- 243 0 pw.flush();
- 244 0 LOGGER.fine(sw.toString());
- 245
- } finally {
- 246 0 if (pw != null ) {
- 247 0 pw.close();
- 248
- }
- 249
+ try {
+ 229 0 in.close();
+ 230 0 } catch (IOException ex) {
+ 231 0 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
+ 232 0 }
+ 233
}
- 250
-
- 251
+ 234
}
- 252 2 }
- 253
+ 235 0 logProperties("Properties loaded" , props);
+ 236 0 }
+ 237
- 254
+ 238
- 255
-
+ 239
+
+ 240
+
+ 241
+
+ 242
+
+ 243
+
+ 244
+ private static void logProperties(String header, Properties properties) {
+ 245 0 if (LOGGER.isLoggable(Level.FINE)) {
+ 246 0 final StringWriter sw = new StringWriter();
+ 247 0 PrintWriter pw = null ;
+ 248
+ try {
+ 249 0 pw = new PrintWriter(sw);
+ 250 0 pw.format("%s:%n%n" , header);
+ 251 0 final Enumeration e = properties.propertyNames();
+ 252 0 while (e.hasMoreElements()) {
+ 253 0 final String key = (String) e.nextElement();
+ 254 0 if (key.contains("password" )) {
+ 255 0 pw.format("%s='*****'%n" , key);
256
-
- 257
-
- 258
-
- 259
-
+ } else { 257 0 final String value = properties.getProperty(key);
+ 258 0 if (value != null ) {
+ 259 0 pw.format("%s='%s'%n" , key, value);
260
- public static void setString(String key, String value) {
- 261 9 INSTANCE.props.setProperty(key, value);
- 262 9 if (LOGGER.isLoggable(Level.FINE)) {
- 263 0 LOGGER.fine(String.format("Setting: %s='%s'" , key, value));
- 264
- }
- 265 9 }
- 266
-
- 267
-
+ } 261
+ }
+ 262 0 }
+ 263 0 pw.flush();
+ 264 0 LOGGER.fine(sw.toString());
+ 265
+ } finally {
+ 266 0 if (pw != null ) {
+ 267 0 pw.close();
268
-
+ } 269
-
+ } 270
-
- 271
-
- 272
-
- 273
- public static void setBoolean(String key, boolean value) {
- 274 10 if (value) {
- 275 0 INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
- 276
- } else {
- 277 10 INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
- 278
- }
- 279 10 if (LOGGER.isLoggable(Level.FINE)) {
- 280 0 LOGGER.fine(String.format("Setting: %s='%b'" , key, value));
- 281
- }
- 282 10 }
- 283
- 284
+ 271
+ }
+ 272 0 }
+ 273
+
+ 274
- 285
-
- 286
-
- 287
-
- 288
+ 275
+
+ 276
+ 277
+
+ 278
+
+ 279
+
+ 280
+ public static void setString(String key, String value) {
+ 281 0 INSTANCE.props.setProperty(key, value);
+ 282 0 if (LOGGER.isLoggable(Level.FINE)) {
+ 283 0 LOGGER.fine(String.format("Setting: %s='%s'" , key, value));
+ 284
+ }
+ 285 0 }
+ 286
+
+ 287
+
+ 288
+
289
-
+ 290
-
+ 291
-
+ 292
293
- public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
- 294 0 final FileInputStream fis = new FileInputStream(filePath);
- 295 0 mergeProperties(fis);
- 296 0 }
- 297
-
+ public static void setBoolean(String key, boolean value) { 294 0 if (value) {
+ 295 0 INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
+ 296
+ } else {
+ 297 0 INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
298
-
- 299
-
- 300
-
- 301
-
- 302
-
- 303
-
- 304
-
- 305
-
- 306
-
- 307
- public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
- 308 1 final FileInputStream fis = new FileInputStream(filePath);
- 309 1 mergeProperties(fis);
- 310 1 }
- 311
-
- 312
-
- 313
-
- 314
-
- 315
-
- 316
-
- 317
-
- 318
-
- 319
-
- 320
- public static void mergeProperties(InputStream stream) throws IOException {
- 321 1 INSTANCE.props.load(stream);
- 322 1 logProperties("Properties updated via merge" , INSTANCE.props);
- 323 1 }
- 324
-
- 325
-
- 326
-
- 327
-
- 328
-
- 329
-
- 330
-
- 331
-
- 332
-
- 333
- public static File getFile(String key) {
- 334 0 final String file = getString(key);
- 335 0 if (file == null ) {
- 336 0 return null ;
- 337
}
- 338 0 return new File(file);
- 339
- }
- 340
+ 299 0 if (LOGGER.isLoggable(Level.FINE)) {
+ 300 0 LOGGER.fine(String.format("Setting: %s='%b'" , key, value));
+ 301
+ }
+ 302 0 }
+ 303
- 341
+ 304
- 342
-
- 343
-
- 344
-
- 345
+ 305
+
+ 306
+
+ 307
+
+ 308
+ 309
+
+ 310
+
+ 311
+
+ 312
+
+ 313
+ public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
+ 314 0 final FileInputStream fis = new FileInputStream(filePath);
+ 315 0 mergeProperties(fis);
+ 316 0 }
+ 317
+
+ 318
+
+ 319
+
+ 320
+
+ 321
+
+ 322
+
+ 323
+
+ 324
+
+ 325
+
+ 326
+
+ 327
+ public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
+ 328 0 final FileInputStream fis = new FileInputStream(filePath);
+ 329 0 mergeProperties(fis);
+ 330 0 }
+ 331
+
+ 332
+
+ 333
+
+ 334
+
+ 335
+
+ 336
+
+ 337
+
+ 338
+
+ 339
+
+ 340
+ public static void mergeProperties(InputStream stream) throws IOException {
+ 341 0 INSTANCE.props.load(stream);
+ 342 0 logProperties("Properties updated via merge" , INSTANCE.props);
+ 343 0 }
+ 344
+
+ 345
+
346
-
+ 347
-
+ 348
-
+ 349
350
@@ -663,281 +667,357 @@
352
353
- public static File getDataFile(String key) {
- 354 35 final String file = getString(key);
- 355 35 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'" , file));
- 356 35 if (file == null ) {
- 357 0 return null ;
- 358
+ public static File getFile(String key) {
+ 354 0 final String file = getString(key);
+ 355 0 if (file == null ) {
+ 356 0 return null ;
+ 357
}
- 359 35 if (file.startsWith("[JAR]" )) {
- 360 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename" );
- 361 0 final File jarPath = getJarPath();
- 362 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'" , jarPath.toString()));
- 363 0 final File retVal = new File(jarPath, file.substring(6));
- 364 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'" , retVal.toString()));
- 365 0 return retVal;
+ 358 0 return new File(file);
+ 359
+ }
+ 360
+
+ 361
+
+ 362
+
+ 363
+
+ 364
+
+ 365
+
366
- }
- 367 35 return new File(file);
+ 367
+
368
- }
+ 369
-
+ 370
-
+ 371
-
+ 372
-
+ 373
-
- 374
-
- 375
- private static File getJarPath() {
- 376 0 final String jarPath = Settings.class .getProtectionDomain().getCodeSource().getLocation().getPath();
- 377 0 String decodedPath = "." ;
+ public static File getDataFile(String key) { 374 0 final String file = getString(key);
+ 375 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'" , file));
+ 376 0 if (file == null ) {
+ 377 0 return null ;
378
- try {
- 379 0 decodedPath = URLDecoder.decode(jarPath, "UTF-8" );
- 380 0 } catch (UnsupportedEncodingException ex) {
- 381 0 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
- 382 0 }
- 383
-
- 384 0 final File path = new File(decodedPath);
- 385 0 if (path.getName().toLowerCase().endsWith(".jar" )) {
- 386 0 return path.getParentFile();
- 387
- } else {
- 388 0 return new File("." );
- 389
}
+ 379 0 if (file.startsWith("[JAR]" )) {
+ 380 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename" );
+ 381 0 final File jarPath = getJarPath();
+ 382 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'" , jarPath.toString()));
+ 383 0 final File retVal = new File(jarPath, file.substring(6));
+ 384 0 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'" , retVal.toString()));
+ 385 0 return retVal;
+ 386
+ }
+ 387 0 return new File(file);
+ 388
+ }
+ 389
+
390
- }
+ 391
-
+ 392
-
+ 393
-
+ 394
-
+ 395
-
- 396
-
- 397
-
+ private static File getJarPath() { 396 0 final String jarPath = Settings.class .getProtectionDomain().getCodeSource().getLocation().getPath();
+ 397 0 String decodedPath = "." ;
398
-
- 399
-
- 400
-
- 401
- public static String getString(String key, String defaultValue) {
- 402 62 final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
- 403 62 return str;
- 404
- }
- 405
-
- 406
-
- 407
-
- 408
-
- 409
-
- 410
-
- 411
- public static File getTempDirectory() {
- 412 29 return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir" )));
- 413
- }
- 414
-
- 415
-
- 416
-
- 417
-
- 418
-
- 419
-
- 420
-
- 421
-
- 422
-
- 423
- public static String getString(String key) {
- 424 78 return System.getProperty(key, INSTANCE.props.getProperty(key));
- 425
- }
- 426
-
- 427
-
- 428
-
- 429
-
- 430
-
- 431
-
- 432
- public static void removeProperty(String key) {
- 433 1 INSTANCE.props.remove(key);
- 434 1 }
- 435
-
- 436
-
- 437
-
- 438
-
- 439
-
- 440
-
- 441
-
- 442
-
- 443
-
- 444
-
- 445
- public static int getInt(String key) throws InvalidSettingException {
- 446
- int value;
- 447
try {
- 448 1 value = Integer.parseInt(Settings.getString(key));
- 449 0 } catch (NumberFormatException ex) {
- 450 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
- 451 1 }
- 452 1 return value;
- 453
- }
- 454
+ 399 0 decodedPath = URLDecoder.decode(jarPath, "UTF-8" );
+ 400 0 } catch (UnsupportedEncodingException ex) {
+ 401 0 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
+ 402 0 }
+ 403
- 455
+ 404 0 final File path = new File(decodedPath);
+ 405 0 if (path.getName().toLowerCase().endsWith(".jar" )) {
+ 406 0 return path.getParentFile();
+ 407
+ } else {
+ 408 0 return new File("." );
+ 409
+ }
+ 410
+ }
+ 411
+
+ 412
- 456
-
- 457
-
- 458
+ 413
+
+ 414
+
+ 415
- 459
+ 416
- 460
+ 417
+ 418
+
+ 419
+
+ 420
+
+ 421
+ public static String getString(String key, String defaultValue) {
+ 422 0 final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
+ 423 0 return str;
+ 424
+ }
+ 425
+
+ 426
+
+ 427
+
+ 428
+
+ 429
+
+ 430
+
+ 431
+ public static File getTempDirectory() {
+ 432 0 return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir" )));
+ 433
+ }
+ 434
+
+ 435
+
+ 436
+
+ 437
+
+ 438
+
+ 439
+
+ 440
+
+ 441
+
+ 442
+
+ 443
+ public static String getString(String key) {
+ 444 0 return System.getProperty(key, INSTANCE.props.getProperty(key));
+ 445
+ }
+ 446
+
+ 447
+
+ 448
+
+ 449
+
+ 450
+
+ 451
+
+ 452
+ public static void removeProperty(String key) {
+ 453 0 INSTANCE.props.remove(key);
+ 454 0 }
+ 455
+
+ 456
+
+ 457
+
+ 458
+
+ 459
+
+ 460
+
461
-
+ 462
-
+ 463
-
+ 464
465
- public static int getInt(String key, int defaultValue) {
+ public static int getInt(String key) throws InvalidSettingException { 466
int value;
467
try {
- 468 7 value = Integer.parseInt(Settings.getString(key));
- 469 7 } catch (NumberFormatException ex) {
- 470 7 final String msg = String.format("Could not convert property '%s' to an int." , key);
- 471 7 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, msg, ex);
- 472 7 value = defaultValue;
- 473 0 }
- 474 7 return value;
+ 468 0 value = Integer.parseInt(Settings.getString(key));
+ 469 0 } catch (NumberFormatException ex) {
+ 470 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
+ 471 0 }
+ 472 0 return value;
+ 473
+ }
+ 474
+
475
- }
+ 476
-
+ 477
-
- 478
-
- 479
- 480
+ 478
+ 479
+
+ 480
+
481
-
+ 482
-
+ 483
-
+ 484
-
+ 485
-
+ public static int getInt(String key, int defaultValue) { 486
- public static long getLong(String key) throws InvalidSettingException {
+ int value; 487
- long value;
- 488
try {
- 489 1 value = Long.parseLong(Settings.getString(key));
- 490 0 } catch (NumberFormatException ex) {
- 491 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
- 492 1 }
- 493 1 return value;
- 494
- }
+ 488 0 value = Integer.parseInt(Settings.getString(key));
+ 489 0 } catch (NumberFormatException ex) {
+ 490 0 final String msg = String.format("Could not convert property '%s' to an int." , key);
+ 491 0 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, msg, ex);
+ 492 0 value = defaultValue;
+ 493 0 }
+ 494 0 return value;
495
-
- 496
-
- 497
-
- 498
-
- 499
-
- 500
-
- 501
-
- 502
-
- 503
-
- 504
-
- 505
- public static boolean getBoolean(String key) throws InvalidSettingException {
- 506
- boolean value;
- 507
- try {
- 508 10 value = Boolean.parseBoolean(Settings.getString(key));
- 509 0 } catch (NumberFormatException ex) {
- 510 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
- 511 10 }
- 512 10 return value;
- 513
}
+ 496
+
+ 497
+
+ 498
+
+ 499
+
+ 500
+
+ 501
+
+ 502
+
+ 503
+
+ 504
+
+ 505
+
+ 506
+ public static long getLong(String key) throws InvalidSettingException {
+ 507
+ long value;
+ 508
+ try {
+ 509 0 value = Long.parseLong(Settings.getString(key));
+ 510 0 } catch (NumberFormatException ex) {
+ 511 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
+ 512 0 }
+ 513 0 return value;
514
+ }
+ 515
+
+ 516
+
+ 517
+
+ 518
+
+ 519
+
+ 520
+
+ 521
+
+ 522
+
+ 523
+
+ 524
+
+ 525
+ public static boolean getBoolean(String key) throws InvalidSettingException {
+ 526
+ boolean value;
+ 527
+ try {
+ 528 0 value = Boolean.parseBoolean(Settings.getString(key));
+ 529 0 } catch (NumberFormatException ex) {
+ 530 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
+ 531 0 }
+ 532 0 return value;
+ 533
+ }
+ 534
+
+ 535
+
+ 536
+
+ 537
+
+ 538
+
+ 539
+
+ 540
+
+ 541
+
+ 542
+
+ 543
+
+ 544
+
+ 545
+ public static boolean getBoolean(String key, boolean defaultValue) throws InvalidSettingException {
+ 546
+ boolean value;
+ 547
+ try {
+ 548 0 final String strValue = Settings.getString(key);
+ 549 0 if (strValue == null ) {
+ 550 0 return defaultValue;
+ 551
+ }
+ 552 0 value = Boolean.parseBoolean(strValue);
+ 553 0 } catch (NumberFormatException ex) {
+ 554 0 throw new InvalidSettingException("Could not convert property '" + key + "' to an int." , ex);
+ 555 0 }
+ 556 0 return value;
+ 557
+ }
+ 558
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html
index ea433a6b8..7b771a68f 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html
@@ -12,7 +12,7 @@
@@ -198,26 +198,26 @@
104
public static HttpURLConnection createHttpURLConnection(URL url, boolean proxy) throws URLConnectionFailureException {
- 105 6 if (proxy) {
+ 105 0 if (proxy) {
106 0 return createHttpURLConnection(url);
107
}
- 108 6 HttpURLConnection conn = null ;
+ 108 0 HttpURLConnection conn = null ;
109
try {
- 110 6 conn = (HttpURLConnection) url.openConnection();
- 111 6 final int timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT, 60000);
- 112 6 conn.setConnectTimeout(timeout);
+ 110 0 conn = (HttpURLConnection) url.openConnection();
+ 111 0 final int timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT, 60000);
+ 112 0 conn.setConnectTimeout(timeout);
113 0 } catch (IOException ioe) {
114 0 throw new URLConnectionFailureException("Error getting connection." , ioe);
- 115 6 }
- 116 6 return conn;
+ 115 0 }
+ 116 0 return conn;
117
}
118
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html
index e42622ec2..c635dd8df 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html
@@ -155,6 +155,6 @@
}
@@ -99,14 +99,14 @@
41
- 42 1 private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$" , Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
+ 42 0 private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$" , Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
43
44
45
- 46 1 private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*" , Pattern.CASE_INSENSITIVE);
+ 46 0 private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*" , Pattern.CASE_INSENSITIVE);
47
48
@@ -125,7 +125,7 @@
55
public static boolean containsUrl(String text) {
- 56 29267 return CONTAINS_URL_TEST.matcher(text).matches();
+ 56 0 return CONTAINS_URL_TEST.matcher(text).matches();
57
}
58
@@ -144,7 +144,7 @@
65
public static boolean isUrl(String text) {
- 66 134 return IS_URL_TEST.matcher(text).matches();
+ 66 0 return IS_URL_TEST.matcher(text).matches();
67
}
68
@@ -153,7 +153,7 @@
70
- 71 1 private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
+ 71 0 private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
72
Arrays.asList("www" , "com" , "org" , "gov" , "info" , "name" , "net" , "pro" , "tel" , "mobi" , "xxx" ));
73
@@ -188,40 +188,40 @@
88
public static List<String> extractImportantUrlData(String text) throws MalformedURLException {
- 89 134 final ArrayList<String> importantParts = new ArrayList<String>();
- 90 134 final URL url = new URL(text);
- 91 134 final String[] domain = url.getHost().split("\\." );
+ 89 0 final ArrayList<String> importantParts = new ArrayList<String>();
+ 90 0 final URL url = new URL(text);
+ 91 0 final String[] domain = url.getHost().split("\\." );
92
- 93 401 for (int i = 0; i < domain.length - 1; i++) {
- 94 267 final String sub = domain[i];
- 95 267 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
- 96 184 importantParts.add(sub);
+ 93 0 for (int i = 0; i < domain.length - 1; i++) {
+ 94 0 final String sub = domain[i];
+ 95 0 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
+ 96 0 importantParts.add(sub);
97
}
98
}
- 99 134 final String document = url.getPath();
- 100 134 final String[] pathParts = document.split("[\\//]" );
- 101 134 for (int i = 0; i < pathParts.length - 2; i++) {
+ 99 0 final String document = url.getPath();
+ 100 0 final String[] pathParts = document.split("[\\//]" );
+ 101 0 for (int i = 0; i < pathParts.length - 2; i++) {
102 0 if (!pathParts[i].isEmpty()) {
103 0 importantParts.add(pathParts[i]);
104
}
105
}
- 106 134 if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
- 107 47 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$" , "" );
- 108 47 importantParts.add(fileNameNoExt);
+ 106 0 if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
+ 107 0 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$" , "" );
+ 108 0 importantParts.add(fileNameNoExt);
109
}
- 110 134 return importantParts;
+ 110 0 return importantParts;
111
}
112
}
-
+
diff --git a/dependency-check-core/cpd.html b/dependency-check-core/cpd.html
index f23803bc7..041628ea0 100644
--- a/dependency-check-core/cpd.html
+++ b/dependency-check-core/cpd.html
@@ -1,13 +1,13 @@
dependency-check-core - CPD Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
@@ -147,13 +147,6 @@
Surefire Report
-
-
-
-
-
-
@@ -248,14 +241,14 @@
Line
org\owasp\dependencycheck\analyzer\ArchiveAnalyzer.java
-149
+157
org\owasp\dependencycheck\analyzer\JarAnalyzer.java
-906
+924
@Override
- public void initialize() throws Exception {
+ public void initializeFileTypeAnalyzer() throws Exception {
final File baseDir = Settings.getTempDirectory();
if (!baseDir.exists()) {
if (!baseDir.mkdirs()) {
diff --git a/dependency-check-core/dependency-updates-report.html b/dependency-check-core/dependency-updates-report.html
index 67a47eb5e..e6969a97e 100644
--- a/dependency-check-core/dependency-updates-report.html
+++ b/dependency-check-core/dependency-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-core - Dependency Updates Report
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-03-10
+
| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
Project Information
-
+
@@ -145,13 +145,6 @@
Surefire Report
-
-
-
-
-
-
@@ -256,7 +249,7 @@
# of dependencies where the next version available is a minor version update
-10
+ 11
# of dependencies where the next version available is a major version update
@@ -485,6 +478,18 @@
org.apache.openjpa
+openjpa
+2.0.1
+provided
+jar
+2.1.0
+
+org.apache.struts
struts2-core
2.1.2
@@ -495,7 +500,7 @@
2.1.6 2.2.1
-
+
org.apache.velocity
velocity
@@ -507,7 +512,7 @@
-
+
org.apache.velocity
velocity-tools
@@ -519,7 +524,7 @@
-
+
org.dojotoolkit
dojo-war
@@ -531,7 +536,7 @@
1.3.1 1.4.2
-
+
org.glassfish.main.admingui
war
@@ -543,7 +548,7 @@
-
+
org.jsoup
jsoup
@@ -555,7 +560,7 @@
1.7.3
-
+
org.mortbay.jetty
jetty
@@ -567,7 +572,7 @@
6.1.17
-
+
org.springframework
spring-webmvc
@@ -579,7 +584,7 @@
2.5.6 3.0.0.RELEASE
-
+
Status
Group Id
Artifact Id
@@ -597,28 +602,28 @@
com.google.code.findbugs:annotations
-
+
Status
-
+
Group Id
com.google.code.findbugs
-
+
Artifact Id
annotations
-
+
Current Version
2.0.1
-
+
Scope
compile
-
+
Classifier
-
+
Type
jar
-
+
Newer versions
2.0.2 Next Incremental 2.0.3 Latest Incremental
@@ -674,7 +679,7 @@
jar
Newer versions
-2.5.1 Next Incremental 2.6 Next Minor 3.0-RC2 Latest Minor 3.0 Next Major 3.2-RC2 Latest Major
+2.5.1 Next Incremental 2.6 Next Minor 3.0-RC2 Latest Minor 3.0 Next Major 3.2 Latest Major
commons-cli:commons-cli
@@ -881,7 +886,7 @@
jar
Newer versions
-1.6 Next Minor 1.7 Latest Minor
+1.6 Next Minor 1.8 Latest Minor
org.apache.geronimo.daytrader:daytrader-ear
@@ -1042,6 +1047,33 @@
Newer versions
1.9 Next Minor
+
org.apache.openjpa:openjpa
+
+
+Status
+
+
+Group Id
+org.apache.openjpa
+
+Artifact Id
+openjpa
+
+Current Version
+2.0.1
+
+Scope
+provided
+
+Classifier
+
+
+Type
+jar
+
+Newer versions
+2.1.0 Next Minor 2.3.0 Latest Minor
org.apache.struts:struts2-core
@@ -1247,7 +1279,7 @@
jar
Newer versions
-2.5.6 Next Incremental 2.5.6.SEC03 Latest Incremental 3.0.0.RELEASE Next Major 4.0.2.RELEASE Latest Major
+2.5.6 Next Incremental 2.5.6.SEC03 Latest Incremental 3.0.0.RELEASE Next Major 4.0.3.RELEASE Latest Major dependency-check-core - FindBugs Bug Detector Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
@@ -147,13 +147,6 @@
Surefire Report
-
-
-
-
-
-
@@ -252,8 +245,8 @@
Errors
Missing Classes
-205
-8
+209
+9
0
0
1
-
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
+
org.owasp.dependencycheck.analyzer.AssemblyAnalyzer
Bug
@@ -290,72 +283,78 @@
Line
Priority
+Found reliance on default encoding in org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.analyzeFileType(Dependency, Engine): new java.io.InputStreamReader(InputStream)
+I18N
+DM_DEFAULT_ENCODING 120 High
+
+Found reliance on default encoding in org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer(): new java.io.InputStreamReader(InputStream)
+I18N
+DM_DEFAULT_ENCODING 232 High
+
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
+
+
+Bug
+Category
+Details
+Line
+Priority
+
Possible null pointer dereference of currentVersion in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency)
CORRECTNESS
NP_NULL_ON_SOME_PATH 164 141 Medium
-
+
Possible null pointer dereference of nextVersion on branch that might be infeasible in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency)
STYLE
NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE 164 141 Medium
org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer
-
+
Bug
Category
Details
Line
Priority
-
-Found reliance on default encoding in org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.analyze(Dependency, Engine): new java.io.FileReader(File)
+
+Found reliance on default encoding in org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.analyzeFileType(Dependency, Engine): new java.io.FileReader(File)
I18N
DM_DEFAULT_ENCODING 111 115 High
org.owasp.dependencycheck.data.update.task.CallableDownloadTask
-
+
Bug
Category
Details
Line
Priority
-
+
new org.owasp.dependencycheck.data.update.task.CallableDownloadTask(NvdCveInfo, ExecutorService, CveDB) might ignore java.io.IOException
BAD_PRACTICE
DE_MIGHT_IGNORE 59 Medium
-
org.owasp.dependencycheck.utils.FileUtils
-
-
-Bug
-Category
-Details
-Line
-Priority
-
-exceptional return value of java.io.File.mkdirs() ignored in org.owasp.dependencycheck.utils.FileUtils.getTempFile(String, String)
-BAD_PRACTICE
-RV_RETURN_VALUE_IGNORED_BAD_PRACTICE 100 Medium
org.owasp.dependencycheck.utils.LogUtils
-
+
Bug
Category
Details
Line
Priority
-
+
Changes to logger could be lost in org.owasp.dependencycheck.utils.LogUtils.prepareLogger(InputStream, String)
EXPERIMENTAL
LG_LOST_LOGGER_DUE_TO_WEAK_REFERENCE
org.owasp.dependencycheck.utils.URLConnectionFactory
-
+
Bug
Category
Details
Line
Priority
-
+
Redundant nullcheck of conn which is known to be null in org.owasp.dependencycheck.utils.URLConnectionFactory.createHttpURLConnection(URL)
STYLE
RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE dependency-check-core - About
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -111,7 +111,7 @@
-
+
diff --git a/dependency-check-core/javancss.html b/dependency-check-core/javancss.html
index 7cb0c6542..08a6a4e75 100644
--- a/dependency-check-core/javancss.html
+++ b/dependency-check-core/javancss.html
@@ -1,13 +1,13 @@
dependency-check-core - JavaNCSS Metric Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
-
+
@@ -147,13 +147,6 @@
Surefire Report
-
-
-
-
-
-
@@ -257,13 +250,13 @@
Multi lines comment
org.owasp.dependencycheck.analyzer
-21
-170
-2064
+23
+169
+2131
187
-1261
-154
-597
+1260
+164
+631
org.owasp.dependencycheck.jaxb.pom.generated
86
@@ -276,12 +269,12 @@
org.owasp.dependencycheck.utils
22
-100
-825
-107
-663
-9
-433
+102
+845
+109
+679
+8
+454
org.owasp.dependencycheck.data.nvdcve
9
@@ -294,10 +287,10 @@
org.owasp.dependencycheck.dependency
14
-160
-723
-157
-994
+161
+725
+158
+1000
13
222
@@ -319,6 +312,15 @@
5
124
+org.owasp.dependencycheck.agent
+1
+64
+294
+65
+442
+0
+32
+
org.owasp.dependencycheck.data.update
6
35
@@ -327,7 +329,7 @@
267
5
125
-
+
org.owasp.dependencycheck.data.lucene
11
30
@@ -336,6 +338,15 @@
259
20
228
+
+org.owasp.dependencycheck
+1
+21
+218
+21
+118
+6
+42
org.owasp.dependencycheck.data.cpe
4
@@ -346,15 +357,6 @@
0
99
-org.owasp.dependencycheck
-1
-18
-201
-19
-109
-5
-39
-
org.owasp.dependencycheck.data.update.task
2
17
@@ -363,7 +365,7 @@
121
0
54
-
+
org.owasp.dependencycheck.reporting
2
11
@@ -372,7 +374,7 @@
94
1
65
-
+
org.owasp.dependencycheck.data.nexus
2
15
@@ -381,7 +383,7 @@
102
11
62
-
+
org.owasp.dependencycheck.data.nuget
4
21
@@ -390,7 +392,7 @@
134
0
85
-
+
org.owasp.dependencycheck.data.cwe
2
5
@@ -399,6 +401,15 @@
29
1
50
+
+org.owasp.dependencycheck.exception
+2
+8
+25
+10
+48
+0
+50
org.owasp.dependencycheck.analyzer.exception
2
@@ -425,18 +436,9 @@
5
39
0
-30
-
-org.owasp.dependencycheck.exception
-1
-4
-13
-5
-24
-0
30
-
+
Classes total
Methods total
NCSS total
@@ -444,43 +446,49 @@
Javadoc lines
Single lines comment
Multi lines comment
-
-202
-1318
-8366
-1470
-12444
-488
-2755
+
+206
+1391
+8778
+1545
+12940
+498
+2865
[ package ] [ object ] [ method ] [ explanation ]
TOP 30 classes containing the most NCSS.
+
11
TOP 30 classes containing the most methods.
-
+
Object
NCSS
Methods
Classes
Javadocs
-
+
org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory 175
87
0
88
+
+org.owasp.dependencycheck.agent.DependencyCheckScanAgent 277
+64
+0
+65
org.owasp.dependencycheck.jaxb.pom.generated.Model 217
@@ -665,10 +673,10 @@
83
org.owasp.dependencycheck.dependency.Dependency 171
-40
+173
+41
0
-41
+42
org.owasp.dependencycheck.dependency.Vulnerability 108
@@ -677,7 +685,7 @@
35
org.owasp.dependencycheck.analyzer.JarAnalyzer 641
+643
31
1
37
@@ -700,35 +708,35 @@
0
25
+org.owasp.dependencycheck.Engine 189
+21
+0
+21
+
org.owasp.dependencycheck.data.nvdcve.CveDB 402
20
0
21
-
-org.owasp.dependencycheck.analyzer.CPEAnalyzer 263
-19
-2
-32
+org.owasp.dependencycheck.utils.Settings 169
+19
+1
+22
+
org.owasp.dependencycheck.dependency.EvidenceCollection 118
18
5
19
-
+
org.owasp.dependencycheck.dependency.VulnerableSoftware 107
18
0
19
-
-org.owasp.dependencycheck.Engine 173
-18
-0
-19
org.owasp.dependencycheck.jaxb.pom.generated.Dependency 52
@@ -748,11 +756,11 @@
4
27
-org.owasp.dependencycheck.utils.Settings 155
-18
-1
-21
+org.owasp.dependencycheck.analyzer.CPEAnalyzer 259
+17
+2
+30
org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element 51
@@ -802,8 +810,8 @@
1
17
-org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer 161
+org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer 50
13
0
14
@@ -824,68 +832,57 @@
37
12
0
-12
-
-org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement 31
-12
-0
-13
+
12
Averages.
-
+
NCSS average
Program NCSS
Classes average
Methods average
Javadocs average
-
-38.20
-8,366.00
+
+39.33
+8,778.00
0.32
-6.52
-7.72
+6.75
+7.93
[ package ] [ object ] [ method ] [ explanation ]
TOP 30 Methods containing the most NCSS.
-
+
Methods
NCSS
CCN
Javadocs
-
+
org.owasp.dependencycheck.analyzer.JarAnalyzer.parseManifest(Dependency,ClassNameInformation) 118
44
1
-
+
org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability(Vulnerability) 116
17
1
-
+
org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.endElement(String,String,String) 71
27
0
-
+
org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.initialize() 60
25
1
-
+
org.owasp.dependencycheck.data.update.StandardUpdate.update() 60
25
1
-
-org.owasp.dependencycheck.Engine.analyzeDependencies() 59
-18
-1
org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.startElement(String,String,String,Attributes) 55
@@ -912,24 +909,44 @@
23
1
+org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer() 50
+18
+1
+
org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.extractArchive(ArchiveInputStream,File,Engine) 49
23
1
+
+org.owasp.dependencycheck.analyzer.JarAnalyzer.extractPom(String,JarFile,Dependency) 49
+9
+1
org.owasp.dependencycheck.analyzer.JarAnalyzer.setPomEvidence(Dependency,Model,Properties,ClassNameInformation) 49
22
1
+org.owasp.dependencycheck.agent.DependencyCheckScanAgent.populateSettings() 48
+38
+1
+
+org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.analyzeFileType(Dependency,Engine) 48
+24
+1
+
org.owasp.dependencycheck.analyzer.CPEAnalyzer.determineIdentifiers(Dependency,String,String) 47
22
1
-org.owasp.dependencycheck.analyzer.JarAnalyzer.extractPom(String,JarFile,Dependency) org.owasp.dependencycheck.Engine.analyzeDependencies() 47
-9
+14
1
org.owasp.dependencycheck.analyzer.JarAnalyzer.analyzePOM(Dependency,ClassNameInformation,Engine) 17
1
-org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initialize() org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.loadSuppressionData() 41
-14
+16
1
org.owasp.dependencycheck.reporting.ReportGenerator.generateReport(String,String) 14
0
-org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.loadSuppressionData() 38
-16
-1
-
org.owasp.dependencycheck.suppression.SuppressionRule.process(Dependency) 37
25
1
-
+
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency) 35
18
1
-
+
org.owasp.dependencycheck.dependency.Dependency.equals(Object) 35
53
1
-
+
org.owasp.dependencycheck.dependency.VulnerableSoftware.compareTo(VulnerableSoftware) 34
19
1
-
+
org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.extractFiles(File,File,Engine) 32
14
1
-
+
org.owasp.dependencycheck.utils.DependencyVersion.compareTo(DependencyVersion) 32
19
-0
-
-org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.analyze(Dependency,Engine) 30
-14
-1
-
-org.owasp.dependencycheck.data.nvdcve.CveDB.getVulnerabilities(String) 30
-7
-1
+
0
Averages.
-
+
Program NCSS
NCSS average
CCN average
Javadocs average
-
-8,366.00
-4.85
+
+8,778.00
+4.83
2.31
0.97
@@ -1026,46 +1028,46 @@
Statements for JavaNCSS are not statements as specified in the Java Language Specification but include all kinds of declarations too. Roughly spoken, NCSS is approximately equivalent to counting ';' and '{' characters in Java source files.
Not counted are empty statements, empty blocks or semicolons after closing brackets. Of course, comments don't get counted too. Closing brackets also never get counted, the same applies to blocks in general.
-
+
Examples
-
+
Package declaration
package java.lang;
-
+
Import declaration
import java.awt.*;
-
+
Class declaration
public class Foo { public class Foo extends Bla {
-
+
Interface declaration
public interface Able ; {
-
+
Field declaration
int a; int a, b, c = 5, d = 6;
-
+
Method declaration
public void cry(); public void gib() throws DeadException {
-
+
Constructor declaration
public Foo() {
-
+
Constructor invocation
-
+
Statement declaration
@@ -1075,7 +1077,7 @@
if (3 == 4); if (4 == 4) { ; } else {
-
+
Label declaration
fine :
In some cases consecutive semicolons are illegal according to the JLS but JavaNCSS still tolerates them (thought JavaNCSS is still more strict as 'javac'). Nevertheless they are never counted as two statements.
diff --git a/dependency-check-core/license.html b/dependency-check-core/license.html
index c9b87f622..c26213e90 100644
--- a/dependency-check-core/license.html
+++ b/dependency-check-core/license.html
@@ -1,13 +1,13 @@
-
+
dependency-check-core - Project License
@@ -54,7 +54,7 @@
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-03-10
+
| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -111,7 +111,7 @@
-
+
diff --git a/dependency-check-core/plugin-updates-report.html b/dependency-check-core/plugin-updates-report.html
index 96524463a..3931b37c6 100644
--- a/dependency-check-core/plugin-updates-report.html
+++ b/dependency-check-core/plugin-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-core - Plugin Updates Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
-
+
@@ -145,13 +145,6 @@
Surefire Report
-
-
-
-
-
-
diff --git a/dependency-check-core/pmd.html b/dependency-check-core/pmd.html
index c35efe63e..4e27c2302 100644
--- a/dependency-check-core/pmd.html
+++ b/dependency-check-core/pmd.html
@@ -1,13 +1,13 @@
dependency-check-core - PMD Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
-
+
@@ -147,13 +147,6 @@
Surefire Report
-
-
-
-
-
-
@@ -250,64 +243,73 @@
Line
These nested if statements could be combined
-153 - 156
+161 - 164
These nested if statements could be combined
-319 - 322
+326 - 329
These nested if statements could be combined
-333 - 336 340 - 343
+
org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
+
+
+Violation
+Line
+
+Avoid unused local variables such as 'line'.
+233
+
+Avoid empty while statements
+234 - 236
org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
-
+
Violation
Line
-
+
Useless parentheses.
-183
-
-These nested if statements could be combined
-552 - 557
+213
These nested if statements could be combined
-553 - 556
+531 - 536
These nested if statements could be combined
-562 - 565
+532 - 535
+These nested if statements could be combined
+541 - 544
org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
-
+
Violation
Line
-
+
These nested if statements could be combined
-246 - 248
+223 - 225
org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
-
+
Violation
Line
-
+
These nested if statements could be combined
-152 - 173
+129 - 150
org/owasp/dependencycheck/analyzer/JarAnalyzer.java
-
+
Violation
Line
-
-Useless parentheses.
-358
-These nested if statements could be combined
-910 - 913
-
Useless parentheses.
-1008
+374
+These nested if statements could be combined
+928 - 931
org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java
@@ -316,10 +318,10 @@
Line
An empty statement (semicolon) not part of a loop
-106
+110
Avoid unused local variables such as 'extractComments'.
-109
+113
org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java
@@ -391,28 +393,28 @@
Line
Useless parentheses.
-484
+494
Useless parentheses.
-487
+497
Useless parentheses.
-490
+500
Useless parentheses.
-493
+503
Useless parentheses.
-496
+506
Useless parentheses.
-499
+509
Useless parentheses.
-514
+524
Useless parentheses.
-517
+527
org/owasp/dependencycheck/dependency/Evidence.java
@@ -502,7 +504,16 @@
135
Useless parentheses.
-194
+194
+
org/owasp/dependencycheck/utils/FileUtils.java
+
+
+Violation
+Line
+
+These nested if statements could be combined
+107 - 109
dependency-check-core - Project Information
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -111,7 +111,7 @@
-
+
diff --git a/dependency-check-core/project-reports.html b/dependency-check-core/project-reports.html
index fbd467520..c8b4f35cf 100644
--- a/dependency-check-core/project-reports.html
+++ b/dependency-check-core/project-reports.html
@@ -1,13 +1,13 @@
dependency-check-core - Generated Reports
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
-
+
-
-
-
-
-
-
@@ -268,24 +261,21 @@
Surefire Report Report on the test results of the project.
-Failsafe Report Report on the integration test results of the project.
-
Tag List Report on various tags found in the code.
-
+
Checkstyle Report on coding style conventions.
-
+
CPD Report Duplicate code detection.
-
+
PMD Report Verification of coding rules.
-
+
FindBugs Report Generates a source code report with the FindBugs Library.
-
+
JavaNCSS Report Code metric analysis.
diff --git a/dependency-check-core/project-summary.html b/dependency-check-core/project-summary.html
index 70cf86675..10dee0583 100644
--- a/dependency-check-core/project-summary.html
+++ b/dependency-check-core/project-summary.html
@@ -1,13 +1,13 @@
dependency-check-core - Project Summary
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -111,7 +111,7 @@
-
+
@@ -203,7 +203,7 @@
dependency-check-core
Version
-1.1.3
+1.1.4
Type
jar
diff --git a/dependency-check-core/surefire-report.html b/dependency-check-core/surefire-report.html
index f8ae4e4e4..625a6e660 100644
--- a/dependency-check-core/surefire-report.html
+++ b/dependency-check-core/surefire-report.html
@@ -1,13 +1,13 @@
dependency-check-core - Surefire Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
@@ -145,13 +145,6 @@
-
-
-
-
-
-
@@ -257,8 +250,7 @@ function toggleDisplay(elementId) {
-
Summary
-
[Summary ] [Package List ] [Test Cases ]
+
Summary
Tests
@@ -268,1568 +260,13 @@ function toggleDisplay(elementId) {
Success Rate
Time
-193
-0
-0
-1
-99.482%
-74.865
-
Note: failures are anticipated and checked for with assertions while errors are unanticipated.
-
Package List
-
[Summary ] [Package List ] [Test Cases ]
-
-
Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.
-
-
org.owasp.dependencycheck.reporting
-
-
-Class
-Tests
-Errors
-Failures
-Skipped
-Success Rate
-Time
-
-ReportGeneratorTest 2
-0
-0
-0
-100%
-1.546
-
-
org.owasp.dependencycheck.data.cwe
-
-
-Class
-Tests
-Errors
-Failures
-Skipped
-Success Rate
-Time
-
-CweDBTest 1
-0
-0
-0
-100%
-0
-
-
org.owasp.dependencycheck.data.nuget
-
-
-Class
-Tests
-Errors
-Failures
-Skipped
-Success Rate
-Time
-
-XPathNuspecParserTest 3
-0
-0
-0
-100%
-0.019
-
-
org.owasp.dependencycheck.data.nexus
-
-
-Class
-Tests
-Errors
-Failures
-Skipped
-Success Rate
-Time
-
-NexusSearchTest 4
-0
-0
-0
-100%
-2.506
-
-
org.owasp.dependencycheck.dependency
-
-
-
org.owasp.dependencycheck.utils
-
-
-
org.owasp.dependencycheck.data.update.xml
-
-
-
org.owasp.dependencycheck.analyzer
-
-
-
org.owasp.dependencycheck.data.update
-
-
-
org.owasp.dependencycheck.data.nvdcve
-
-
-
org.owasp.dependencycheck.suppression
-
-
-
org.owasp.dependencycheck.data.lucene
-
-
-
org.owasp.dependencycheck.data.cpe
-
-
-Class
-Tests
-Errors
-Failures
-Skipped
-Success Rate
-Time
-
-IndexEntryTest 1
-0
-0
-0
-100%
-0
-
Test Cases
-
[Summary ] [Package List ] [Test Cases ]
-
-
AbstractAnalyzerTest
-
-
-testNewHashSet
-0.039
-
-
-
AnalyzerServiceTest
-
-
-testGetAnalyzers
-0.484
-
-
-
-
-
-
-
-
-
-
-
IndexEntryTest
-
-
-testSetName
-0
-
-
CweDBTest
-
-
-testGetCweName
-0
-
-
FieldAnalyzerTest
-
-
-testAnalyzers
-0
-
-
-
TokenPairConcatenatingFilterTest
-
-
-testExamples
-0.046
-
-testClear
-0.008
-
-
UrlTokenizingFilterTest
-
-
-testEmptyTerm
-0.006
-
-testRandomStrings
-0.61
-
-testExamples
-0.006
-
-
-
XPathNuspecParserTest
-
-
-testGoodDocument
-0
-
-testMissingDocument
-0.013
-
-testNotNuspec
-0.006
-
-
CveDBTest
-
-
-testOpen
-0.001
-
-testGetCPEs
-0.004
-
-testGetVulnerabilities
-0.108
-
-
-
-
-
-
NvdCve_1_2_HandlerTest
-
-
-testParse
-0.012
-
-
NvdCve_2_0_HandlerTest
-
-
-testParse
-0.059
-
-
-
VulnerableSoftwareTest
-
-
-testCompareTo
-0
-
-testHashCode
-0
-
-testEquals
-0
-
-
ReportGeneratorTest
-
-
-testGenerateXMLReport
-1.546
-
-testGenerateReport
-0
-
-
-
SuppressionHandlerTest
-
-
-testHandler
-0
-
-
SuppressionParserTest
-
-
-testParseSuppressionRules
-0
-
-
-
-
-
DependencyVersionUtilTest
-
-
-testParseVersionFromFileName
-0.001
-
-
DownloaderTest
-
-
-testGetLastModified_file
-0
-
-
FileUtilsTest
-
-
-testGetFileExtension
-0
-
-testDelete
-0
-
-
FilterTest
-
-
-testFilter_Iterable
-0
-
-testPasses
-0
-
Note: failures are anticipated and checked for with assertions while errors are unanticipated.
dependency-check-core - Tag List report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -90,7 +90,7 @@
-
+
@@ -147,13 +147,6 @@
Surefire Report
-
-
-
-
-
-
Line
- can we get more evidence from the parent? EAR contains module name, etc. analyze the dependency (i.e. extract files) if it is a supported type.
-222
+229
org.owasp.dependencycheck.analyzer.CPEAnalyzer
Line
- likely need to change the split... not sure if this will work for CPE with special chars
-412
+442
the following isn't quite right is it? need to think about this guessing game a bit more.
-549
+528
org.owasp.dependencycheck.analyzer.CPEAnalyzerTest
Line
@@ -283,28 +276,28 @@
Line
review the generated test code and remove the default call to fail. fail("The test case is a prototype.");
-108
+84
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
Line
fix the version problem below
-150
+127
- can we utilize the pom's groupid and artifactId to filter??? most of these are due to low quality data. Other idea would be to say any CPE found based on LOW confidence evidence should have a different CPE type? (this might be a better solution then just removing the URL for "best-guess" matches).
-259
+236
move this startswith expression to a configuration file?
-268
+245
org.owasp.dependencycheck.analyzer.JarAnalyzer
Line
remove weighting
-632
+650
change this to a regex?
-751
+769
org.owasp.dependencycheck.analyzer.JavaScriptAnalyzerTest
Line
diff --git a/dependency-check-core/xref-test/allclasses-frame.html b/dependency-check-core/xref-test/allclasses-frame.html
index e4e858932..11fcf00a9 100644
--- a/dependency-check-core/xref-test/allclasses-frame.html
+++ b/dependency-check-core/xref-test/allclasses-frame.html
@@ -12,7 +12,10 @@
- AbstractAnalyzerTest
+ AbstractDatabaseTestCase
+
+
+ AbstractFileTypeAnalyzerTest
AbstractSuppressionAnalyzerImpl
@@ -31,9 +34,6 @@
BaseDBTestCase
-
-
- BaseIndexTestCase
CPEAnalyzerTest
@@ -151,6 +151,9 @@
UrlTokenizingFilterTest
+
+
+ VulnerabilitySuppressionAnalyzerTest
VulnerableSoftwareTest
diff --git a/dependency-check-core/xref-test/index.html b/dependency-check-core/xref-test/index.html
index 223cf4279..e68cdab66 100644
--- a/dependency-check-core/xref-test/index.html
+++ b/dependency-check-core/xref-test/index.html
@@ -4,7 +4,7 @@
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html
index ca7c93fbd..3b21c63f5 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html
@@ -33,53 +33,75 @@
25 import org.junit.Test;
26 import org.owasp.dependencycheck.data.nvdcve.CveDB;
27 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
-28 import org.owasp.dependencycheck.reporting.ReportGenerator;
-29
-30
-31
-32
-33
-34 public class EngineIntegrationTest {
-35
-36 @BeforeClass
-37 public static void setUpClass() throws Exception {
-38 }
-39
-40 @AfterClass
-41 public static void tearDownClass() throws Exception {
-42 }
-43
-44 @Before
-45 public void setUp() throws Exception {
-46 org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase.ensureDBExists();
-47 }
-48
-49 @After
-50 public void tearDown() {
-51 }
-52
-53
-54
-55
-56
-57
-58 @Test
-59 public void testScan() throws Exception {
-60 String testClasses = "target/test-classes" ;
-61 Engine instance = new Engine();
-62 instance.scan(testClasses);
-63 assertTrue(instance.getDependencies().size() > 0);
-64 instance.analyzeDependencies();
-65 CveDB cveDB = new CveDB();
-66 cveDB.open();
-67 DatabaseProperties dbProp = cveDB.getDatabaseProperties();
-68 cveDB.close();
-69 ReportGenerator rg = new ReportGenerator("DependencyCheck" ,
-70 instance.getDependencies(), instance.getAnalyzers(), dbProp);
-71 rg.generateReports("./target/" , "ALL" );
+28 import org.owasp.dependencycheck.dependency.Dependency;
+29 import org.owasp.dependencycheck.reporting.ReportGenerator;
+30 import org.owasp.dependencycheck.utils.Settings;
+31
+32
+33
+34
+35
+36 public class EngineIntegrationTest {
+37
+38 @BeforeClass
+39 public static void setUpClass() throws Exception {
+40 }
+41
+42 @AfterClass
+43 public static void tearDownClass() throws Exception {
+44 }
+45
+46 @Before
+47 public void setUp() throws Exception {
+48 org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase.ensureDBExists();
+49 }
+50
+51 @After
+52 public void tearDown() {
+53 }
+54
+55
+56
+57
+58
+59
+60 @Test
+61 public void testScan() throws Exception {
+62 String testClasses = "target/test-classes/*.zip" ;
+63 boolean autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+64 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+65 Engine instance = new Engine();
+66 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+67 instance.scan(testClasses);
+68 assertTrue(instance.getDependencies().size() > 0);
+69 for (Dependency d : instance.getDependencies()) {
+70 assertTrue("non-zip file collected " + d.getFileName(), d.getFileName().toLowerCase().endsWith(".zip" ));
+71 }
72 instance.cleanup();
73 }
-74 }
+74
+75
+76
+77
+78
+79
+80 @Test
+81 public void testEngine() throws Exception {
+82 String testClasses = "target/test-classes" ;
+83 Engine instance = new Engine();
+84 instance.scan(testClasses);
+85 assertTrue(instance.getDependencies().size() > 0);
+86 instance.analyzeDependencies();
+87 CveDB cveDB = new CveDB();
+88 cveDB.open();
+89 DatabaseProperties dbProp = cveDB.getDatabaseProperties();
+90 cveDB.close();
+91 ReportGenerator rg = new ReportGenerator("DependencyCheck" ,
+92 instance.getDependencies(), instance.getAnalyzers(), dbProp);
+93 rg.generateReports("./target/" , "ALL" );
+94 instance.cleanup();
+95 }
+96 }
AbstractFileTypeAnalyzerTest xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.analyzer;
+19
+20 import java.util.Set;
+21 import org.junit.After;
+22 import org.junit.AfterClass;
+23 import static org.junit.Assert.assertEquals;
+24 import static org.junit.Assert.assertTrue;
+25 import org.junit.Before;
+26 import org.junit.BeforeClass;
+27 import org.junit.Test;
+28
+29
+30
+31
+32
+33 public class AbstractFileTypeAnalyzerTest {
+34
+35 public AbstractFileTypeAnalyzerTest () {
+36 }
+37
+38 @BeforeClass
+39 public static void setUpClass() throws Exception {
+40 }
+41
+42 @AfterClass
+43 public static void tearDownClass() throws Exception {
+44 }
+45
+46 @Before
+47 public void setUp() {
+48 }
+49
+50 @After
+51 public void tearDown() {
+52 }
+53
+54
+55
+56
+57 @Test
+58 public void testNewHashSet() {
+59 Set result = AbstractFileTypeAnalyzer.newHashSet("one" , "two" );
+60 assertEquals(2, result.size());
+61 assertTrue(result.contains("one" ));
+62 assertTrue(result.contains("two" ));
+63 }
+64 }
+
+80 }
81
82
-83
+83
84
85 @Test
-86 public void testSupportsExtension() {
-87 String extension = "jar" ;
-88 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl ();
-89 boolean expResult = true ;
-90 boolean result = instance.supportsExtension(extension);
-91 assertEquals(expResult, result);
-92 }
-93
-94
-95
-96
-97 @Test
-98 public void testInitialize() throws Exception {
-99 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl ();
-100 instance.initialize();
+86 public void testInitialize() throws Exception {
+87 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl ();
+88 instance.initialize();
+89 }
+90
+91
+92
+93
+94 @Test
+95 public void testGetRules() throws Exception {
+96 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl ();
+97 instance.initialize();
+98 int expCount = 5;
+99 List<SuppressionRule> result = instance.getRules();
+100 assertEquals(expCount, result.size());
101 }
102
-103
-104
-105
-106 @Test
-107 public void testGetRules() throws Exception {
-108 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl ();
-109 instance.initialize();
-110 int expCount = 5;
-111 List<SuppressionRule> result = instance.getRules();
-112 assertEquals(expCount, result.size());
-113 }
+103 public class AbstractSuppressionAnalyzerImpl extends AbstractSuppressionAnalyzer {
+104
+105 @Override
+106 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+107 throw new UnsupportedOperationException("Not supported yet." );
+108 }
+109
+110 @Override
+111 public String getName() {
+112 throw new UnsupportedOperationException("Not supported yet." );
+113 }
114
-115 public class AbstractSuppressionAnalyzerImpl extends AbstractSuppressionAnalyzer {
-116
-117 @Override
-118 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-119 throw new UnsupportedOperationException("Not supported yet." );
-120 }
-121
-122 @Override
-123 public String getName() {
-124 throw new UnsupportedOperationException("Not supported yet." );
-125 }
-126
-127 @Override
-128 public AnalysisPhase getAnalysisPhase() {
-129 throw new UnsupportedOperationException("Not supported yet." );
-130 }
-131 }
-132
-133 }
+115 @Override
+116 public AnalysisPhase getAnalysisPhase() {
+117 throw new UnsupportedOperationException("Not supported yet." );
+118 }
+119 }
+120
+121 }
18 package org.owasp.dependencycheck.analyzer;
19
20 import java.util.Iterator;
-21 import java.util.Set;
-22 import org.junit.After;
-23 import org.junit.AfterClass;
-24 import static org.junit.Assert.assertTrue;
-25 import org.junit.Before;
-26 import org.junit.BeforeClass;
-27 import org.junit.Test;
-28
-29
-30
-31
-32
-33 public class AnalyzerServiceTest {
-34
-35 public AnalyzerServiceTest () {
-36 }
-37
-38 @BeforeClass
-39 public static void setUpClass() throws Exception {
-40 }
-41
-42 @AfterClass
-43 public static void tearDownClass() throws Exception {
-44 }
-45
-46 @Before
-47 public void setUp() {
-48 }
-49
-50 @After
-51 public void tearDown() {
-52 }
-53
-54
-55
-56
-57 @Test
-58 public void testGetAnalyzers() {
-59 AnalyzerService instance = AnalyzerService.getInstance();
-60 Iterator<Analyzer> result = instance.getAnalyzers();
-61
-62 boolean found = false;
-63 while (result.hasNext()) {
-64 Analyzer a = result.next();
-65 Set<String> e = a.getSupportedExtensions();
-66 if (e != null && e.contains("jar" )) {
-67 found = true ;
-68 }
-69 }
-70 assertTrue("JarAnalyzer loaded" , found);
-71 }
-72 }
+21 import org.junit.After;
+22 import org.junit.AfterClass;
+23 import static org.junit.Assert.assertTrue;
+24 import org.junit.Before;
+25 import org.junit.BeforeClass;
+26 import org.junit.Test;
+27
+28
+29
+30
+31
+32 public class AnalyzerServiceTest {
+33
+34 public AnalyzerServiceTest () {
+35 }
+36
+37 @BeforeClass
+38 public static void setUpClass() throws Exception {
+39 }
+40
+41 @AfterClass
+42 public static void tearDownClass() throws Exception {
+43 }
+44
+45 @Before
+46 public void setUp() {
+47 }
+48
+49 @After
+50 public void tearDown() {
+51 }
+52
+53
+54
+55
+56 @Test
+57 public void testGetAnalyzers() {
+58 AnalyzerService instance = AnalyzerService.getInstance();
+59 Iterator<Analyzer> result = instance.getAnalyzers();
+60
+61 boolean found = false;
+62 while (result.hasNext()) {
+63 Analyzer a = result.next();
+64 if ("Jar Analyzer" .equals(a.getName())) {
+65 found = true ;
+66 }
+67 }
+68 assertTrue("JarAnalyzer loaded" , found);
+69 }
+70 }
26 import org.junit.BeforeClass;
27 import org.junit.Test;
28 import org.owasp.dependencycheck.Engine;
-29 import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase;
+29 import org.owasp.dependencycheck.data.cpe.AbstractDatabaseTestCase;
30 import org.owasp.dependencycheck.dependency.Dependency;
31 import org.owasp.dependencycheck.utils.Settings;
32
@@ -42,7 +42,7 @@
34
35
36
-37 public class ArchiveAnalyzerTest extends BaseIndexTestCase {
+37 public class ArchiveAnalyzerTest extends AbstractDatabaseTestCase {
38
39 public ArchiveAnalyzerTest () {
40 }
@@ -155,161 +155,165 @@
147 @Test
148 public void testAnalyze() throws Exception {
149 ArchiveAnalyzer instance = new ArchiveAnalyzer();
-150 try {
-151 instance.initialize();
-152
-153 File file = new File(this .getClass().getClassLoader().getResource("daytrader-ear-2.1.7.ear" ).getPath());
-154 Dependency dependency = new Dependency(file);
-155 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
-156 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
-157 Engine engine = new Engine();
-158
-159 int initial_size = engine.getDependencies().size();
-160 instance.analyze(dependency, engine);
-161 int ending_size = engine.getDependencies().size();
-162
-163 engine.cleanup();
+150
+151 instance.supportsExtension("ear" );
+152 try {
+153 instance.initialize();
+154
+155 File file = new File(this .getClass().getClassLoader().getResource("daytrader-ear-2.1.7.ear" ).getPath());
+156 Dependency dependency = new Dependency(file);
+157 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+158 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
+159 Engine engine = new Engine();
+160
+161 int initial_size = engine.getDependencies().size();
+162 instance.analyze(dependency, engine);
+163 int ending_size = engine.getDependencies().size();
164
-165 assertTrue(initial_size < ending_size);
+165 engine.cleanup();
166
-167 } finally {
-168 instance.close();
-169 }
-170 }
-171
-172
-173
-174
-175 @Test
-176 public void testAnalyzeTar() throws Exception {
-177 ArchiveAnalyzer instance = new ArchiveAnalyzer();
-178 try {
-179 instance.initialize();
-180
-181
-182 File file = new File(this .getClass().getClassLoader().getResource("stagedhttp-modified.tar" ).getPath());
-183 Dependency dependency = new Dependency(file);
-184 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
-185 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
-186 Engine engine = new Engine();
-187
-188 int initial_size = engine.getDependencies().size();
-189 instance.analyze(dependency, engine);
-190 int ending_size = engine.getDependencies().size();
-191 engine.cleanup();
-192
-193 assertTrue(initial_size < ending_size);
-194
-195 } finally {
-196 instance.close();
-197 }
-198 }
-199
-200
-201
-202
-203 @Test
-204 public void testAnalyzeTarGz() throws Exception {
-205 ArchiveAnalyzer instance = new ArchiveAnalyzer();
-206 try {
-207 instance.initialize();
-208
-209 File file = new File(this .getClass().getClassLoader().getResource("file.tar.gz" ).getPath());
-210
-211 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
-212 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
-213 Engine engine = new Engine();
-214
-215 int initial_size = engine.getDependencies().size();
-216
-217 engine.scan(file);
-218 engine.analyzeDependencies();
-219 int ending_size = engine.getDependencies().size();
-220 engine.cleanup();
-221 assertTrue(initial_size < ending_size);
-222
-223 } finally {
-224 instance.close();
-225 }
-226 }
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252 @Test
-253 public void testAnalyzeTgz() throws Exception {
-254 ArchiveAnalyzer instance = new ArchiveAnalyzer();
-255 try {
-256 instance.initialize();
-257
-258 File file = new File(this .getClass().getClassLoader().getResource("file.tgz" ).getPath());
-259 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
-260 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
-261 Engine engine = new Engine();
-262
-263 int initial_size = engine.getDependencies().size();
-264 engine.scan(file);
-265 engine.analyzeDependencies();
-266 int ending_size = engine.getDependencies().size();
-267 engine.cleanup();
-268 assertTrue(initial_size < ending_size);
-269
-270 } finally {
-271 instance.close();
-272 }
-273 }
-274
-275
-276
-277
-278 @Test
-279 public void testAnalyze_badZip() throws Exception {
-280 ArchiveAnalyzer instance = new ArchiveAnalyzer();
-281 try {
-282 instance.initialize();
-283
-284 File file = new File(this .getClass().getClassLoader().getResource("test.zip" ).getPath());
-285 Dependency dependency = new Dependency(file);
-286 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
-287 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
-288 Engine engine = new Engine();
-289 int initial_size = engine.getDependencies().size();
-290
-291
-292 instance.analyze(dependency, engine);
-293
-294
-295
-296
-297 int ending_size = engine.getDependencies().size();
-298 engine.cleanup();
-299 assertEquals(initial_size, ending_size);
-300 } finally {
-301 instance.close();
-302 }
-303 }
-304 }
+167 assertTrue(initial_size < ending_size);
+168
+169 } finally {
+170 instance.close();
+171 }
+172 }
+173
+174
+175
+176
+177 @Test
+178 public void testAnalyzeTar() throws Exception {
+179 ArchiveAnalyzer instance = new ArchiveAnalyzer();
+180
+181 instance.supportsExtension("tar" );
+182 try {
+183 instance.initialize();
+184
+185
+186 File file = new File(this .getClass().getClassLoader().getResource("stagedhttp-modified.tar" ).getPath());
+187 Dependency dependency = new Dependency(file);
+188 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+189 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
+190 Engine engine = new Engine();
+191
+192 int initial_size = engine.getDependencies().size();
+193 instance.analyze(dependency, engine);
+194 int ending_size = engine.getDependencies().size();
+195 engine.cleanup();
+196
+197 assertTrue(initial_size < ending_size);
+198
+199 } finally {
+200 instance.close();
+201 }
+202 }
+203
+204
+205
+206
+207 @Test
+208 public void testAnalyzeTarGz() throws Exception {
+209 ArchiveAnalyzer instance = new ArchiveAnalyzer();
+210 try {
+211 instance.initialize();
+212
+213 File file = new File(this .getClass().getClassLoader().getResource("file.tar.gz" ).getPath());
+214
+215 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+216 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
+217 Engine engine = new Engine();
+218
+219 int initial_size = engine.getDependencies().size();
+220
+221 engine.scan(file);
+222 engine.analyzeDependencies();
+223 int ending_size = engine.getDependencies().size();
+224 engine.cleanup();
+225 assertTrue(initial_size < ending_size);
+226
+227 } finally {
+228 instance.close();
+229 }
+230 }
+231
+232
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243
+244
+245
+246
+247
+248
+249
+250
+251
+252
+253
+254
+255
+256 @Test
+257 public void testAnalyzeTgz() throws Exception {
+258 ArchiveAnalyzer instance = new ArchiveAnalyzer();
+259 try {
+260 instance.initialize();
+261
+262 File file = new File(this .getClass().getClassLoader().getResource("file.tgz" ).getPath());
+263 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+264 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
+265 Engine engine = new Engine();
+266
+267 int initial_size = engine.getDependencies().size();
+268 engine.scan(file);
+269 engine.analyzeDependencies();
+270 int ending_size = engine.getDependencies().size();
+271 engine.cleanup();
+272 assertTrue(initial_size < ending_size);
+273
+274 } finally {
+275 instance.close();
+276 }
+277 }
+278
+279
+280
+281
+282 @Test
+283 public void testAnalyze_badZip() throws Exception {
+284 ArchiveAnalyzer instance = new ArchiveAnalyzer();
+285 try {
+286 instance.initialize();
+287
+288 File file = new File(this .getClass().getClassLoader().getResource("test.zip" ).getPath());
+289 Dependency dependency = new Dependency(file);
+290 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+291 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
+292 Engine engine = new Engine();
+293 int initial_size = engine.getDependencies().size();
+294
+295
+296 instance.analyze(dependency, engine);
+297
+298
+299
+300
+301 int ending_size = engine.getDependencies().size();
+302 engine.cleanup();
+303 assertEquals(initial_size, ending_size);
+304 } finally {
+305 instance.close();
+306 }
+307 }
+308 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import java.io.File;
-21 import java.util.logging.Level;
-22 import java.util.logging.Logger;
-23 import org.junit.After;
-24 import static org.junit.Assert.assertEquals;
-25 import static org.junit.Assert.assertTrue;
-26 import org.junit.Assume;
-27 import static org.junit.Assume.assumeFalse;
-28 import org.junit.Before;
-29 import org.junit.Test;
-30 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-31 import org.owasp.dependencycheck.dependency.Confidence;
-32 import org.owasp.dependencycheck.dependency.Dependency;
-33 import org.owasp.dependencycheck.dependency.Evidence;
-34 import org.owasp.dependencycheck.utils.Settings;
-35
-36
-37
-38
-39
-40
-41
-42 public class AssemblyAnalyzerTest {
-43
-44 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzerTest.class .getName());
-45
-46 AssemblyAnalyzer analyzer;
-47
-48
-49
-50
-51
-52
-53 @Before
-54 public void setUp() {
-55 try {
-56 analyzer = new AssemblyAnalyzer();
-57 analyzer.initialize();
-58 } catch (Exception e) {
-59 LOGGER.log(Level.WARNING, "Exception setting up AssemblyAnalyzer. Tests will be incomplete" , e);
-60 Assume.assumeNoException("Is mono installed? TESTS WILL BE INCOMPLETE" , e);
-61 }
-62 }
-63
-64
-65
-66
-67 @Test
-68 public void testGetName() {
-69 assertEquals("Assembly Analyzer" , analyzer.getName());
-70 }
-71
-72 @Test
-73 public void testAnalysis() throws Exception {
-74 File f = new File(AssemblyAnalyzerTest.class .getClassLoader().getResource("GrokAssembly.exe" ).getPath());
-75 Dependency d = new Dependency(f);
-76 analyzer.analyze(d, null );
-77 assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly" , "version" , "1.0.5176.23901" , Confidence.HIGHEST)));
-78 }
-79
-80 @Test
-81 public void testLog4Net() throws Exception {
-82 File f = new File(AssemblyAnalyzerTest.class .getClassLoader().getResource("log4net.dll" ).getPath());
-83 Dependency d = new Dependency(f);
-84 analyzer.analyze(d, null );
-85 assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly" , "version" , "1.2.13.0" , Confidence.HIGHEST)));
-86 assertTrue(d.getVendorEvidence().getEvidence().contains(new Evidence("grokassembly" , "vendor" , "The Apache Software Foundation" , Confidence.HIGH)));
-87 assertTrue(d.getProductEvidence().getEvidence().contains(new Evidence("grokassembly" , "product" , "log4net" , Confidence.HIGH)));
-88 }
-89
-90 @Test(expected = AnalysisException.class )
-91 public void testNonexistent() throws Exception {
-92 File f = new File(AssemblyAnalyzerTest.class .getClassLoader().getResource("log4net.dll" ).getPath());
-93 File test = new File(f.getParent(), "nonexistent.dll" );
-94 Dependency d = new Dependency(test);
-95 analyzer.analyze(d, null );
+20 import static org.junit.Assert.assertEquals;
+21 import static org.junit.Assert.assertTrue;
+22 import static org.junit.Assert.fail;
+23 import static org.junit.Assume.assumeFalse;
+24
+25 import java.io.File;
+26 import java.util.logging.Level;
+27 import java.util.logging.Logger;
+28
+29 import org.junit.After;
+30 import org.junit.Assume;
+31 import org.junit.Before;
+32 import org.junit.Test;
+33 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+34 import org.owasp.dependencycheck.dependency.Confidence;
+35 import org.owasp.dependencycheck.dependency.Dependency;
+36 import org.owasp.dependencycheck.dependency.Evidence;
+37 import org.owasp.dependencycheck.utils.Settings;
+38
+39
+40
+41
+42
+43
+44
+45 public class AssemblyAnalyzerTest {
+46
+47 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzerTest.class .getName());
+48
+49 AssemblyAnalyzer analyzer;
+50
+51
+52
+53
+54
+55
+56 @Before
+57 public void setUp() {
+58 try {
+59 analyzer = new AssemblyAnalyzer();
+60 analyzer.supportsExtension("dll" );
+61 analyzer.initialize();
+62 } catch (Exception e) {
+63 LOGGER.log(Level.WARNING, "Exception setting up AssemblyAnalyzer. Tests will be incomplete" , e);
+64 Assume.assumeNoException("Is mono installed? TESTS WILL BE INCOMPLETE" , e);
+65 }
+66 }
+67
+68
+69
+70
+71 @Test
+72 public void testGetName() {
+73 assertEquals("Assembly Analyzer" , analyzer.getName());
+74 }
+75
+76 @Test
+77 public void testAnalysis() throws Exception {
+78 File f = new File(AssemblyAnalyzerTest.class .getClassLoader().getResource("GrokAssembly.exe" ).getPath());
+79 Dependency d = new Dependency(f);
+80 analyzer.analyze(d, null );
+81 boolean foundVendor = false;
+82 for (Evidence e : d.getVendorEvidence().getEvidence("grokassembly" , "vendor" )) {
+83 if ("OWASP" .equals(e.getValue())) {
+84 foundVendor = true ;
+85 }
+86 }
+87 assertTrue(foundVendor);
+88
+89 boolean foundProduct = false;
+90 for (Evidence e : d.getProductEvidence().getEvidence("grokassembly" , "product" )) {
+91 if ("GrokAssembly" .equals(e.getValue())) {
+92 foundProduct = true ;
+93 }
+94 }
+95 assertTrue(foundProduct);
96 }
97
-98 @Test(expected = AnalysisException.class )
-99 public void testWithSettingMono() throws Exception {
-100
-101
-102 assumeFalse(System.getProperty("os.name" ).startsWith("Windows" ));
-103
-104 String oldValue = Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH);
-105
-106
-107
-108
-109 if (oldValue == null ) {
-110 System.setProperty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono" );
-111 } else {
-112 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono" );
-113 }
-114
-115 try {
-116
-117 AssemblyAnalyzer aanalyzer = new AssemblyAnalyzer();
-118 aanalyzer.initialize();
-119 } finally {
-120
-121
-122 if (oldValue == null ) {
-123 System.getProperties().remove(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH);
-124 } else {
-125 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, oldValue);
-126 }
+98 @Test
+99 public void testLog4Net() throws Exception {
+100 File f = new File(AssemblyAnalyzerTest.class .getClassLoader().getResource("log4net.dll" ).getPath());
+101 Dependency d = new Dependency(f);
+102 analyzer.analyze(d, null );
+103 assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly" , "version" , "1.2.13.0" , Confidence.HIGHEST)));
+104 assertTrue(d.getVendorEvidence().getEvidence().contains(new Evidence("grokassembly" , "vendor" , "The Apache Software Foundation" , Confidence.HIGH)));
+105 assertTrue(d.getProductEvidence().getEvidence().contains(new Evidence("grokassembly" , "product" , "log4net" , Confidence.HIGH)));
+106 }
+107
+108 @Test
+109 public void testNonexistent() {
+110 Level oldLevel = Logger.getLogger(AssemblyAnalyzer.class .getName()).getLevel();
+111 Level oldDependency = Logger.getLogger(Dependency.class .getName()).getLevel();
+112
+113 Logger.getLogger(AssemblyAnalyzer.class .getName()).setLevel(Level.OFF);
+114 Logger.getLogger(Dependency.class .getName()).setLevel(Level.OFF);
+115 File f = new File(AssemblyAnalyzerTest.class .getClassLoader().getResource("log4net.dll" ).getPath());
+116 File test = new File(f.getParent(), "nonexistent.dll" );
+117 Dependency d = new Dependency(test);
+118
+119 try {
+120 analyzer.analyze(d, null );
+121 fail("Expected an AnalysisException" );
+122 } catch (AnalysisException ae) {
+123 assertEquals("File does not exist" , ae.getMessage());
+124 } finally {
+125 Logger.getLogger(AssemblyAnalyzer.class .getName()).setLevel(oldLevel);
+126 Logger.getLogger(Dependency.class .getName()).setLevel(oldDependency);
127 }
128 }
129
-130 @After
-131 public void tearDown() throws Exception {
-132 analyzer.close();
-133 }
-134 }
+130 @Test
+131 public void testWithSettingMono() throws Exception {
+132
+133
+134 assumeFalse(System.getProperty("os.name" ).startsWith("Windows" ));
+135
+136 String oldValue = Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH);
+137
+138
+139
+140
+141 if (oldValue == null ) {
+142 System.setProperty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono" );
+143 } else {
+144 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono" );
+145 }
+146
+147 Level oldLevel = Logger.getLogger(AssemblyAnalyzer.class .getName()).getLevel();
+148 try {
+149
+150 Logger.getLogger(AssemblyAnalyzer.class .getName()).setLevel(Level.OFF);
+151
+152 AssemblyAnalyzer aanalyzer = new AssemblyAnalyzer();
+153 aanalyzer.supportsExtension("dll" );
+154 aanalyzer.initialize();
+155 fail("Expected an AnalysisException" );
+156 } catch (AnalysisException ae) {
+157 assertEquals("An error occured with the .NET AssemblyAnalyzer" , ae.getMessage());
+158 } finally {
+159
+160 Logger.getLogger(AssemblyAnalyzer.class .getName()).setLevel(oldLevel);
+161
+162
+163 if (oldValue == null ) {
+164 System.getProperties().remove(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH);
+165 } else {
+166 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, oldValue);
+167 }
+168 }
+169 }
+170
+171 @After
+172 public void tearDown() throws Exception {
+173 analyzer.close();
+174 }
+175 }
30 import org.junit.Before;
31 import org.junit.BeforeClass;
32 import org.junit.Test;
-33 import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase;
+33 import org.owasp.dependencycheck.data.cpe.AbstractDatabaseTestCase;
34 import org.owasp.dependencycheck.data.cpe.IndexEntry;
35 import org.owasp.dependencycheck.dependency.Dependency;
36 import org.owasp.dependencycheck.dependency.Identifier;
@@ -47,7 +47,7 @@
39
40
41
-42 public class CPEAnalyzerTest extends BaseIndexTestCase {
+42 public class CPEAnalyzerTest extends AbstractDatabaseTestCase {
43
44 @BeforeClass
45 public static void setUpClass() throws Exception {
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html
index cee6f927a..1e7f1efad 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html
@@ -25,122 +25,98 @@
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import java.util.Set;
-21 import org.junit.After;
-22 import org.junit.AfterClass;
-23 import static org.junit.Assert.assertEquals;
-24 import static org.junit.Assert.assertNull;
-25 import org.junit.Before;
-26 import org.junit.BeforeClass;
-27 import org.junit.Test;
-28 import org.owasp.dependencycheck.dependency.Dependency;
-29
-30
-31
-32
-33
-34 public class DependencyBundlingAnalyzerTest {
-35
-36 public DependencyBundlingAnalyzerTest () {
-37 }
-38
-39 @BeforeClass
-40 public static void setUpClass() {
-41 }
-42
-43 @AfterClass
-44 public static void tearDownClass() {
-45 }
-46
-47 @Before
-48 public void setUp() {
-49 }
-50
-51 @After
-52 public void tearDown() {
-53 }
-54
-55
-56
-57
-58 @Test
-59 public void testGetSupportedExtensions() {
-60 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
-61 Set<String> result = instance.getSupportedExtensions();
-62 assertNull(result);
-63 }
-64
-65
-66
-67
-68 @Test
-69 public void testGetName() {
-70 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
-71 String expResult = "Dependency Bundling Analyzer" ;
-72 String result = instance.getName();
-73 assertEquals(expResult, result);
-74 }
-75
-76
-77
-78
-79 @Test
-80 public void testSupportsExtension() {
-81 String extension = "jar" ;
-82 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
-83 boolean expResult = true ;
-84 boolean result = instance.supportsExtension(extension);
-85 assertEquals(expResult, result);
+20 import org.junit.After;
+21 import org.junit.AfterClass;
+22 import static org.junit.Assert.assertEquals;
+23 import org.junit.Before;
+24 import org.junit.BeforeClass;
+25 import org.junit.Test;
+26 import org.owasp.dependencycheck.dependency.Dependency;
+27
+28
+29
+30
+31
+32 public class DependencyBundlingAnalyzerTest {
+33
+34 public DependencyBundlingAnalyzerTest () {
+35 }
+36
+37 @BeforeClass
+38 public static void setUpClass() {
+39 }
+40
+41 @AfterClass
+42 public static void tearDownClass() {
+43 }
+44
+45 @Before
+46 public void setUp() {
+47 }
+48
+49 @After
+50 public void tearDown() {
+51 }
+52
+53
+54
+55
+56 @Test
+57 public void testGetName() {
+58 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+59 String expResult = "Dependency Bundling Analyzer" ;
+60 String result = instance.getName();
+61 assertEquals(expResult, result);
+62 }
+63
+64
+65
+66
+67 @Test
+68 public void testGetAnalysisPhase() {
+69 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+70 AnalysisPhase expResult = AnalysisPhase.PRE_FINDING_ANALYSIS;
+71 AnalysisPhase result = instance.getAnalysisPhase();
+72 assertEquals(expResult, result);
+73 }
+74
+75
+76
+77
+78 @Test
+79 public void testAnalyze() throws Exception {
+80
+81
+82
+83
+84
+85
86 }
87
88
-89
+89
90
91 @Test
-92 public void testGetAnalysisPhase() {
-93 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
-94 AnalysisPhase expResult = AnalysisPhase.PRE_FINDING_ANALYSIS;
-95 AnalysisPhase result = instance.getAnalysisPhase();
-96 assertEquals(expResult, result);
-97 }
-98
-99
-100
-101
-102 @Test
-103 public void testAnalyze() throws Exception {
-104
-105
-106
-107
-108
-109
-110 }
-111
-112
-113
-114
-115 @Test
-116 public void testIsCore() {
-117 Dependency left = new Dependency();
-118 Dependency right = new Dependency();
-119
-120 left.setFileName("axis2-kernel-1.4.1.jar" );
-121 right.setFileName("axis2-adb-1.4.1.jar" );
-122 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
-123 boolean expResult = true ;
-124 boolean result = instance.isCore(left, right);
-125 assertEquals(expResult, result);
-126
-127 left.setFileName("struts-1.2.7.jar" );
-128 right.setFileName("file.tar.gz\\file.tar\\struts.jar" );
-129
-130 expResult = true ;
-131 result = instance.isCore(left, right);
-132 assertEquals(expResult, result);
-133 }
-134
-135 }
+92 public void testIsCore() {
+93 Dependency left = new Dependency();
+94 Dependency right = new Dependency();
+95
+96 left.setFileName("axis2-kernel-1.4.1.jar" );
+97 right.setFileName("axis2-adb-1.4.1.jar" );
+98 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+99 boolean expResult = true ;
+100 boolean result = instance.isCore(left, right);
+101 assertEquals(expResult, result);
+102
+103 left.setFileName("struts-1.2.7.jar" );
+104 right.setFileName("file.tar.gz\\file.tar\\struts.jar" );
+105
+106 expResult = true ;
+107 result = instance.isCore(left, right);
+108 assertEquals(expResult, result);
+109 }
+110
+111 }
15
16 package org.owasp.dependencycheck.analyzer;
17
-18 import java.util.Set;
-19 import org.junit.After;
-20 import org.junit.AfterClass;
-21 import static org.junit.Assert.assertEquals;
-22 import static org.junit.Assert.assertNull;
-23 import static org.junit.Assert.assertTrue;
-24 import org.junit.Before;
-25 import org.junit.BeforeClass;
-26 import org.junit.Test;
-27 import org.owasp.dependencycheck.Engine;
-28 import org.owasp.dependencycheck.dependency.Dependency;
-29
-30
-31
-32
-33
-34 public class FalsePositiveAnalyzerTest {
-35
-36 public FalsePositiveAnalyzerTest () {
-37 }
-38
-39 @BeforeClass
-40 public static void setUpClass() {
-41 }
-42
-43 @AfterClass
-44 public static void tearDownClass() {
-45 }
-46
-47 @Before
-48 public void setUp() {
-49 }
-50
-51 @After
-52 public void tearDown() {
-53 }
-54
-55
-56
-57
-58 @Test
-59 public void testGetSupportedExtensions() {
-60 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
-61 Set<String> result = instance.getSupportedExtensions();
-62 assertNull(result);
+18 import org.junit.After;
+19 import org.junit.AfterClass;
+20 import static org.junit.Assert.assertEquals;
+21 import static org.junit.Assert.assertTrue;
+22 import org.junit.Before;
+23 import org.junit.BeforeClass;
+24 import org.junit.Test;
+25 import org.owasp.dependencycheck.Engine;
+26 import org.owasp.dependencycheck.dependency.Dependency;
+27
+28
+29
+30
+31
+32 public class FalsePositiveAnalyzerTest {
+33
+34 public FalsePositiveAnalyzerTest () {
+35 }
+36
+37 @BeforeClass
+38 public static void setUpClass() {
+39 }
+40
+41 @AfterClass
+42 public static void tearDownClass() {
+43 }
+44
+45 @Before
+46 public void setUp() {
+47 }
+48
+49 @After
+50 public void tearDown() {
+51 }
+52
+53
+54
+55
+56 @Test
+57 public void testGetName() {
+58 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+59 String expResult = "False Positive Analyzer" ;
+60 String result = instance.getName();
+61 assertEquals(expResult, result);
+62 }
63
-64 }
-65
-66
-67
-68
-69 @Test
-70 public void testGetName() {
-71 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
-72 String expResult = "False Positive Analyzer" ;
-73 String result = instance.getName();
-74 assertEquals(expResult, result);
-75 }
-76
-77
-78
-79
-80 @Test
-81 public void testSupportsExtension() {
-82 String extension = "any" ;
-83 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
-84 boolean expResult = true ;
-85 boolean result = instance.supportsExtension(extension);
-86 assertEquals(expResult, result);
-87 }
-88
-89
-90
-91
-92 @Test
-93 public void testGetAnalysisPhase() {
-94 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
-95 AnalysisPhase expResult = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
-96 AnalysisPhase result = instance.getAnalysisPhase();
-97 assertEquals(expResult, result);
-98 }
-99
-100
-101
-102
-103 @Test
-104 public void testAnalyze() throws Exception {
-105 Dependency dependency = new Dependency();
-106 dependency.setFileName("pom.xml" );
-107 dependency.addIdentifier("cpe" , "cpe:/a:file:file:1.2.1" , "http://some.org/url" );
-108 Engine engine = null ;
-109 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
-110 int before = dependency.getIdentifiers().size();
-111 instance.analyze(dependency, engine);
-112 int after = dependency.getIdentifiers().size();
-113 assertTrue(before > after);
-114 }
-115
-116 }
+64
+65
+66
+67 @Test
+68 public void testGetAnalysisPhase() {
+69 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+70 AnalysisPhase expResult = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+71 AnalysisPhase result = instance.getAnalysisPhase();
+72 assertEquals(expResult, result);
+73 }
+74
+75
+76
+77
+78 @Test
+79 public void testAnalyze() throws Exception {
+80 Dependency dependency = new Dependency();
+81 dependency.setFileName("pom.xml" );
+82 dependency.addIdentifier("cpe" , "cpe:/a:file:file:1.2.1" , "http://some.org/url" );
+83 Engine engine = null ;
+84 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+85 int before = dependency.getIdentifiers().size();
+86 instance.analyze(dependency, engine);
+87 int after = dependency.getIdentifiers().size();
+88 assertTrue(before > after);
+89 }
+90
+91 }
18 package org.owasp.dependencycheck.analyzer;
19
20 import java.io.File;
-21 import java.util.Set;
-22 import org.junit.After;
-23 import org.junit.AfterClass;
-24 import static org.junit.Assert.assertEquals;
-25 import static org.junit.Assert.assertTrue;
-26 import org.junit.Before;
-27 import org.junit.BeforeClass;
-28 import org.junit.Test;
-29 import org.owasp.dependencycheck.dependency.Dependency;
-30
-31
-32
-33
-34
-35 public class FileNameAnalyzerTest {
-36
-37 public FileNameAnalyzerTest () {
-38 }
-39
-40 @BeforeClass
-41 public static void setUpClass() throws Exception {
-42 }
-43
-44 @AfterClass
-45 public static void tearDownClass() throws Exception {
-46 }
-47
-48 @Before
-49 public void setUp() {
-50 }
-51
-52 @After
-53 public void tearDown() {
-54 }
-55
-56
-57
-58
-59 @Test
-60 public void testGetSupportedExtensions() {
-61 FileNameAnalyzer instance = new FileNameAnalyzer();
-62 Set expResult = null ;
-63 Set result = instance.getSupportedExtensions();
-64 assertEquals(expResult, result);
-65 }
-66
-67
-68
-69
-70 @Test
-71 public void testGetName() {
-72 FileNameAnalyzer instance = new FileNameAnalyzer();
-73 String expResult = "File Name Analyzer" ;
-74 String result = instance.getName();
-75 assertEquals(expResult, result);
-76 }
-77
-78
-79
-80
-81 @Test
-82 public void testSupportsExtension() {
-83 String extension = "any" ;
-84 FileNameAnalyzer instance = new FileNameAnalyzer();
-85 boolean expResult = true ;
-86 boolean result = instance.supportsExtension(extension);
-87 assertEquals(expResult, result);
-88 }
+21 import org.junit.After;
+22 import org.junit.AfterClass;
+23 import static org.junit.Assert.assertEquals;
+24 import static org.junit.Assert.assertTrue;
+25 import org.junit.Before;
+26 import org.junit.BeforeClass;
+27 import org.junit.Test;
+28 import org.owasp.dependencycheck.dependency.Dependency;
+29
+30
+31
+32
+33
+34 public class FileNameAnalyzerTest {
+35
+36 public FileNameAnalyzerTest () {
+37 }
+38
+39 @BeforeClass
+40 public static void setUpClass() throws Exception {
+41 }
+42
+43 @AfterClass
+44 public static void tearDownClass() throws Exception {
+45 }
+46
+47 @Before
+48 public void setUp() {
+49 }
+50
+51 @After
+52 public void tearDown() {
+53 }
+54
+55
+56
+57
+58 @Test
+59 public void testGetName() {
+60 FileNameAnalyzer instance = new FileNameAnalyzer();
+61 String expResult = "File Name Analyzer" ;
+62 String result = instance.getName();
+63 assertEquals(expResult, result);
+64 }
+65
+66
+67
+68
+69 @Test
+70 public void testGetAnalysisPhase() {
+71 FileNameAnalyzer instance = new FileNameAnalyzer();
+72 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION;
+73 AnalysisPhase result = instance.getAnalysisPhase();
+74 assertEquals(expResult, result);
+75 }
+76
+77
+78
+79
+80 @Test
+81 public void testAnalyze() throws Exception {
+82 File struts = new File(this .getClass().getClassLoader().getResource("struts2-core-2.1.2.jar" ).getPath());
+83 Dependency resultStruts = new Dependency(struts);
+84 File axis = new File(this .getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar" ).getPath());
+85 Dependency resultAxis = new Dependency(axis);
+86 FileNameAnalyzer instance = new FileNameAnalyzer();
+87 instance.analyze(resultStruts, null );
+88 assertTrue(resultStruts.getVendorEvidence().toString().toLowerCase().contains("struts" ));
89
-90
-91
-92
-93 @Test
-94 public void testGetAnalysisPhase() {
-95 FileNameAnalyzer instance = new FileNameAnalyzer();
-96 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION;
-97 AnalysisPhase result = instance.getAnalysisPhase();
-98 assertEquals(expResult, result);
-99 }
-100
-101
-102
-103
-104 @Test
-105 public void testAnalyze() throws Exception {
-106 File struts = new File(this .getClass().getClassLoader().getResource("struts2-core-2.1.2.jar" ).getPath());
-107 Dependency resultStruts = new Dependency(struts);
-108 File axis = new File(this .getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar" ).getPath());
-109 Dependency resultAxis = new Dependency(axis);
+90 instance.analyze(resultAxis, null );
+91 assertTrue(resultStruts.getVersionEvidence().toString().toLowerCase().contains("2.1.2" ));
+92
+93 }
+94
+95
+96
+97
+98 @Test
+99 public void testInitialize() throws Exception {
+100 FileNameAnalyzer instance = new FileNameAnalyzer();
+101 instance.initialize();
+102 assertTrue(true );
+103 }
+104
+105
+106
+107
+108 @Test
+109 public void testClose() throws Exception {
110 FileNameAnalyzer instance = new FileNameAnalyzer();
-111 instance.analyze(resultStruts, null );
-112 assertTrue(resultStruts.getVendorEvidence().toString().toLowerCase().contains("struts" ));
-113
-114 instance.analyze(resultAxis, null );
-115 assertTrue(resultStruts.getVersionEvidence().toString().toLowerCase().contains("2.1.2" ));
-116
-117 }
-118
-119
-120
-121
-122 @Test
-123 public void testInitialize() throws Exception {
-124 FileNameAnalyzer instance = new FileNameAnalyzer();
-125 instance.initialize();
-126 assertTrue(true );
-127 }
-128
-129
-130
-131
-132 @Test
-133 public void testClose() throws Exception {
-134 FileNameAnalyzer instance = new FileNameAnalyzer();
-135 instance.close();
-136 assertTrue(true );
-137 }
-138 }
+111 instance.close();
+112 assertTrue(true );
+113 }
+114 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import org.junit.Before;
-21 import org.junit.Test;
-22 import static org.junit.Assert.*;
-23
-24 public class NuspecAnalyzerTest {
-25 private NuspecAnalyzer instance;
-26
-27 @Before
-28 public void setUp() {
-29 instance = new NuspecAnalyzer();
-30 }
-31
-32 @Test
-33 public void testGetAnalyzerName() {
-34 assertEquals("Nuspec Analyzer" , instance.getName());
-35 }
-36
-37 @Test
-38 public void testGetSupportedExtensions() {
-39 assertTrue(instance.getSupportedExtensions().contains("nuspec" ));
-40 assertFalse(instance.getSupportedExtensions().contains("nupkg" ));
-41 }
-42
-43 @Test
-44 public void testSupportsExtension() {
-45 assertTrue(instance.supportsExtension("nuspec" ));
-46 assertFalse(instance.supportsExtension("nupkg" ));
-47 }
-48
-49 @Test
-50 public void testGetAnalysisPhaze() {
-51 assertEquals(AnalysisPhase.INFORMATION_COLLECTION, instance.getAnalysisPhase());
-52 }
-53 }
-54
-55
+20 import static org.junit.Assert.assertEquals;
+21 import static org.junit.Assert.assertFalse;
+22 import static org.junit.Assert.assertTrue;
+23 import org.junit.Before;
+24 import org.junit.Test;
+25
+26 public class NuspecAnalyzerTest {
+27
+28 private NuspecAnalyzer instance;
+29
+30 @Before
+31 public void setUp() {
+32 instance = new NuspecAnalyzer();
+33 instance.setEnabled(true );
+34 }
+35
+36 @Test
+37 public void testGetAnalyzerName() {
+38 assertEquals("Nuspec Analyzer" , instance.getName());
+39 }
+40
+41 @Test
+42 public void testGetSupportedExtensions() {
+43 assertTrue(instance.getSupportedExtensions().contains("nuspec" ));
+44 assertFalse(instance.getSupportedExtensions().contains("nupkg" ));
+45 }
+46
+47 @Test
+48 public void testSupportsExtension() {
+49 assertTrue(instance.supportsExtension("nuspec" ));
+50 assertFalse(instance.supportsExtension("nupkg" ));
+51 }
+52
+53 @Test
+54 public void testGetAnalysisPhaze() {
+55 assertEquals(AnalysisPhase.INFORMATION_COLLECTION, instance.getAnalysisPhase());
+56 }
+57 }
+58
+59
VulnerabilitySuppressionAnalyzerTest xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.analyzer;
+19
+20 import java.io.File;
+21 import org.junit.After;
+22 import org.junit.AfterClass;
+23 import org.junit.Before;
+24 import org.junit.BeforeClass;
+25 import org.junit.Test;
+26 import org.owasp.dependencycheck.Engine;
+27 import org.owasp.dependencycheck.data.cpe.AbstractDatabaseTestCase;
+28 import org.owasp.dependencycheck.dependency.Dependency;
+29 import org.owasp.dependencycheck.utils.Settings;
+30
+31
+32
+33
+34
+35
+36 public class VulnerabilitySuppressionAnalyzerTest extends AbstractDatabaseTestCase {
+37
+38 public VulnerabilitySuppressionAnalyzerTest () {
+39 }
+40
+41 @BeforeClass
+42 public static void setUpClass() {
+43 }
+44
+45 @AfterClass
+46 public static void tearDownClass() {
+47 }
+48 private boolean update = true ;
+49 private boolean nexus = false;
+50
+51 @Before
+52 @Override
+53 public void setUp() throws Exception {
+54 super .setUp();
+55 update = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+56 nexus = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED);
+57 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
+58 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
+59 }
+60
+61 @After
+62 @Override
+63 public void tearDown() throws Exception {
+64 super .tearDown();
+65 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, update);
+66 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexus);
+67 }
+68
+69
+70
+71
+72 @Test
+73 public void testGetName() {
+74 VulnerabilitySuppressionAnalyzer instance = new VulnerabilitySuppressionAnalyzer();
+75 String expResult = "Vulnerability Suppression Analyzer" ;
+76 String result = instance.getName();
+77 assertEquals(expResult, result);
+78 }
+79
+80
+81
+82
+83 @Test
+84 public void testGetAnalysisPhase() {
+85 VulnerabilitySuppressionAnalyzer instance = new VulnerabilitySuppressionAnalyzer();
+86 AnalysisPhase expResult = AnalysisPhase.POST_FINDING_ANALYSIS;;
+87 AnalysisPhase result = instance.getAnalysisPhase();
+88 assertEquals(expResult, result);
+89 }
+90
+91
+92
+93
+94 @Test
+95 public void testAnalyze() throws Exception {
+96
+97 File file = new File(this .getClass().getClassLoader().getResource("FileHelpers.2.0.0.0.nupkg" ).getPath());
+98 File suppression = new File(this .getClass().getClassLoader().getResource("FileHelpers.2.0.0.0.suppression.xml" ).getPath());
+99
+100 Engine engine = new Engine();
+101 engine.scan(file);
+102 engine.analyzeDependencies();
+103 Dependency dependency = getDependency(engine, file);
+104 assertTrue(dependency.getVulnerabilities().size() > 0);
+105 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppression.getAbsolutePath());
+106 VulnerabilitySuppressionAnalyzer instance = new VulnerabilitySuppressionAnalyzer();
+107 instance.initialize();
+108 instance.analyze(dependency, engine);
+109 assertTrue(dependency.getVulnerabilities().size() == 0);
+110 }
+111
+112
+113
+114
+115
+116
+117
+118
+119 private Dependency getDependency(Engine engine, File file) {
+120 for (Dependency d : engine.getDependencies()) {
+121 if (d.getFileName().equals(file.getName())) {
+122 return d;
+123 }
+124 }
+125 return null ;
+126 }
+127 }
+
+Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer
- AbstractAnalyzerTest
+ AbstractFileTypeAnalyzerTest
@@ -99,6 +99,11 @@
NuspecAnalyzerTest
+
+
+
+ VulnerabilitySuppressionAnalyzerTest
+
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html
new file mode 100644
index 000000000..fac6d587a
--- /dev/null
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html
@@ -0,0 +1,68 @@
+
+
+AbstractDatabaseTestCase xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.data.cpe;
+19
+20 import junit.framework.TestCase;
+21 import org.junit.After;
+22 import org.junit.AfterClass;
+23 import org.junit.Before;
+24 import org.junit.BeforeClass;
+25 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase;
+26
+27
+28
+29
+30
+31
+32
+33 public abstract class AbstractDatabaseTestCase extends TestCase {
+34
+35 @BeforeClass
+36 public static void setUpClass() throws Exception {
+37 }
+38
+39 @AfterClass
+40 public static void tearDownClass() throws Exception {
+41 }
+42
+43 @Before
+44 @Override
+45 public void setUp() throws Exception {
+46 BaseDBTestCase.ensureDBExists();
+47 super .setUp();
+48 }
+49
+50 @After
+51 @Override
+52 public void tearDown() throws Exception {
+53 super .tearDown();
+54 }
+55 }
+
+Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe
- BaseIndexTestCase
+ AbstractDatabaseTestCase
IndexEntryTest
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html
index 5638d64f4..c6de3d8dc 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe
- BaseIndexTestCase
+ AbstractDatabaseTestCase
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html
index 25a7a04e1..b23f13537 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.reporting
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.reporting
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.suppression
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.suppression
155 boolean expResult = false;
156 boolean result = Settings.getBoolean(key);
157 Assert.assertEquals(expResult, result);
-158 }
-159
-160
-161
-162
-163 @Test
-164 public void testRemoveProperty() {
-165 String key = "SomeKey" ;
-166 String value = "value" ;
-167 String dfault = "default" ;
-168 Settings.setString(key, value);
-169 String ret = Settings.getString(key);
-170 Assert.assertEquals(value, ret);
-171 Settings.removeProperty(key);
-172 ret = Settings.getString(key, dfault);
-173 Assert.assertEquals(dfault, ret);
-174 }
-175 }
+158
+159 key = "something that does not exist" ;
+160 expResult = true ;
+161 result = Settings.getBoolean(key, true );
+162 Assert.assertEquals(expResult, result);
+163 }
+164
+165
+166
+167
+168 @Test
+169 public void testRemoveProperty() {
+170 String key = "SomeKey" ;
+171 String value = "value" ;
+172 String dfault = "default" ;
+173 Settings.setString(key, value);
+174 String ret = Settings.getString(key);
+175 Assert.assertEquals(value, ret);
+176 Settings.removeProperty(key);
+177 ret = Settings.getString(key, dfault);
+178 Assert.assertEquals(dfault, ret);
+179 }
+180 }
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.utils
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.utils
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
diff --git a/dependency-check-core/xref/allclasses-frame.html b/dependency-check-core/xref/allclasses-frame.html
index 03f81448d..54c3f9ed5 100644
--- a/dependency-check-core/xref/allclasses-frame.html
+++ b/dependency-check-core/xref/allclasses-frame.html
@@ -13,6 +13,9 @@
AbstractAnalyzer
+
+
+ AbstractFileTypeAnalyzer
AbstractSuppressionAnalyzer
@@ -130,6 +133,9 @@
DependencyBundlingAnalyzer
+
+
+ DependencyCheckScanAgent
DependencyManagement
@@ -214,6 +220,9 @@
FileNameAnalyzer
+
+
+ FileTypeAnalyzer
FileUtils
@@ -439,6 +448,9 @@
Roles
+
+
+ ScanAgentException
Scm
diff --git a/dependency-check-core/xref/index.html b/dependency-check-core/xref/index.html
index 223cf4279..e68cdab66 100644
--- a/dependency-check-core/xref/index.html
+++ b/dependency-check-core/xref/index.html
@@ -4,7 +4,7 @@
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html
index 11f2fcf4b..19ce1d4bd 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html
@@ -37,425 +37,462 @@
29 import org.owasp.dependencycheck.analyzer.AnalysisPhase;
30 import org.owasp.dependencycheck.analyzer.Analyzer;
31 import org.owasp.dependencycheck.analyzer.AnalyzerService;
-32 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-33 import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
-34 import org.owasp.dependencycheck.data.cpe.IndexException;
-35 import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory;
-36 import org.owasp.dependencycheck.data.nvdcve.CveDB;
-37 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
-38 import org.owasp.dependencycheck.data.update.CachedWebDataSource;
-39 import org.owasp.dependencycheck.data.update.UpdateService;
-40 import org.owasp.dependencycheck.data.update.exception.UpdateException;
-41 import org.owasp.dependencycheck.dependency.Dependency;
-42 import org.owasp.dependencycheck.exception.NoDataException;
-43 import org.owasp.dependencycheck.utils.FileUtils;
-44 import org.owasp.dependencycheck.utils.InvalidSettingException;
-45 import org.owasp.dependencycheck.utils.Settings;
-46
-47
-48
-49
-50
-51
-52
-53
-54 public class Engine {
-55
-56
-57
-58
-59 private final List<Dependency> dependencies;
-60
-61
-62
-63 private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
-64
-65
-66
-67 private final Set<String> extensions;
-68
-69
-70
-71
-72
-73
-74 public Engine () throws DatabaseException {
-75 this .extensions = new HashSet<String>();
+32 import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer;
+33 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+34 import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
+35 import org.owasp.dependencycheck.data.cpe.IndexException;
+36 import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory;
+37 import org.owasp.dependencycheck.data.nvdcve.CveDB;
+38 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+39 import org.owasp.dependencycheck.data.update.CachedWebDataSource;
+40 import org.owasp.dependencycheck.data.update.UpdateService;
+41 import org.owasp.dependencycheck.data.update.exception.UpdateException;
+42 import org.owasp.dependencycheck.dependency.Dependency;
+43 import org.owasp.dependencycheck.exception.NoDataException;
+44 import org.owasp.dependencycheck.utils.FileUtils;
+45 import org.owasp.dependencycheck.utils.InvalidSettingException;
+46 import org.owasp.dependencycheck.utils.Settings;
+47
+48
+49
+50
+51
+52
+53
+54
+55 public class Engine {
+56
+57
+58
+59
+60 private List<Dependency> dependencies;
+61
+62
+63
+64 private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
+65
+66
+67
+68 private final Set<FileTypeAnalyzer> fileTypeAnalyzers;
+69
+70
+71
+72
+73
+74
+75 public Engine () throws DatabaseException {
76 this .dependencies = new ArrayList<Dependency>();
77 this .analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
-78 ConnectionFactory.initialize();
+78 this .fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
79
-80 boolean autoUpdate = true ;
-81 try {
-82 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
-83 } catch (InvalidSettingException ex) {
-84 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "Invalid setting for auto-update; using true." );
-85 }
-86 if (autoUpdate) {
-87 doUpdates();
-88 }
-89 loadAnalyzers();
-90 }
-91
-92
-93
-94
-95 public void cleanup() {
-96 ConnectionFactory.cleanup();
-97 }
-98
-99
-100
-101
-102 private void loadAnalyzers() {
-103
-104 for (AnalysisPhase phase : AnalysisPhase.values()) {
-105 analyzers.put(phase, new ArrayList<Analyzer>());
-106 }
-107
-108 final AnalyzerService service = AnalyzerService.getInstance();
-109 final Iterator<Analyzer> iterator = service.getAnalyzers();
-110 while (iterator.hasNext()) {
-111 final Analyzer a = iterator.next();
-112 analyzers.get(a.getAnalysisPhase()).add(a);
-113 if (a.getSupportedExtensions() != null ) {
-114 extensions.addAll(a.getSupportedExtensions());
-115 }
-116 }
-117 }
-118
-119
-120
-121
-122
-123
-124
-125 public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
-126 return analyzers.get(phase);
-127 }
-128
-129
-130
-131
-132
-133
-134 public List<Dependency> getDependencies() {
-135 return dependencies;
-136 }
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146 public void scan(String[] paths) {
-147 for (String path : paths) {
-148 final File file = new File(path);
-149 scan(file);
-150 }
-151 }
-152
-153
-154
-155
-156
-157
-158
-159 public void scan(String path) {
-160 final File file = new File(path);
-161 scan(file);
-162 }
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172 public void scan(File[] files) {
-173 for (File file : files) {
-174 scan(file);
-175 }
-176 }
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186 public void scan(Set<File> files) {
-187 for (File file : files) {
-188 scan(file);
-189 }
-190 }
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200 public void scan(List<File> files) {
-201 for (File file : files) {
-202 scan(file);
-203 }
-204 }
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214 public void scan(File file) {
-215 if (file.exists()) {
-216 if (file.isDirectory()) {
-217 scanDirectory(file);
-218 } else {
-219 scanFile(file);
-220 }
-221 }
-222 }
-223
-224
-225
-226
-227
-228
-229 protected void scanDirectory(File dir) {
-230 final File[] files = dir.listFiles();
-231 if (files != null ) {
-232 for (File f : files) {
-233 if (f.isDirectory()) {
-234 scanDirectory(f);
-235 } else {
-236 scanFile(f);
-237 }
-238 }
-239 }
-240 }
-241
-242
-243
-244
-245
-246
-247 protected void scanFile(File file) {
-248 if (!file.isFile()) {
-249 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file." , file.toString());
-250 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
-251 return ;
-252 }
-253 final String fileName = file.getName();
-254 final String extension = FileUtils.getFileExtension(fileName);
-255 if (extension != null ) {
-256 if (extensions.contains(extension)) {
-257 final Dependency dependency = new Dependency (file);
-258 dependencies.add(dependency);
-259 }
-260 } else {
-261 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed." ,
-262 file.toString());
-263 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, msg);
-264 }
-265 }
-266
-267
-268
-269
-270 public void analyzeDependencies() {
-271
-272 try {
-273 ensureDataExists();
-274 } catch (NoDataException ex) {
-275 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
-276 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
-277 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
-278 return ;
-279 } catch (DatabaseException ex) {
-280 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
-281 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
-282 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
-283 return ;
-284
-285 }
-286
-287 final String logHeader = String.format("%n"
-288 + "----------------------------------------------------%n"
-289 + "BEGIN ANALYSIS%n"
-290 + "----------------------------------------------------" );
-291 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logHeader);
-292 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Starting" );
-293
-294
-295 for (AnalysisPhase phase : AnalysisPhase.values()) {
-296 final List<Analyzer> analyzerList = analyzers.get(phase);
-297 for (Analyzer a : analyzerList) {
-298 try {
-299 final String msg = String.format("Initializing %s" , a.getName());
-300 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
-301 a.initialize();
-302 } catch (Throwable ex) {
-303 final String msg = String.format("Exception occurred initializing %s." , a.getName());
-304 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
-305 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
-306 try {
-307 a.close();
-308 } catch (Throwable ex1) {
-309 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex1);
-310 }
-311 }
-312 }
-313 }
-314
-315
-316 for (AnalysisPhase phase : AnalysisPhase.values()) {
-317 final List<Analyzer> analyzerList = analyzers.get(phase);
-318
-319 for (Analyzer a : analyzerList) {
-320
-321
-322
-323
-324 final String msg = String.format("Begin Analyzer '%s'" , a.getName());
-325 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
-326 final Set<Dependency> dependencySet = new HashSet<Dependency>();
-327 dependencySet.addAll(dependencies);
-328 for (Dependency d : dependencySet) {
-329 if (a.supportsExtension(d.getFileExtension())) {
-330 final String msgFile = String.format("Begin Analysis of '%s'" , d.getActualFilePath());
-331 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msgFile);
-332 try {
-333 a.analyze(d, this );
-334 } catch (AnalysisException ex) {
-335 final String exMsg = String.format("An error occured while analyzing '%s'." , d.getActualFilePath());
-336 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, exMsg);
-337 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
-338 } catch (Throwable ex) {
-339 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'" , d.getActualFilePath());
-340
-341 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, axMsg);
-342 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
-343 }
-344 }
-345 }
-346 }
-347 }
-348
-349
-350 for (AnalysisPhase phase : AnalysisPhase.values()) {
-351 final List<Analyzer> analyzerList = analyzers.get(phase);
-352 for (Analyzer a : analyzerList) {
-353 final String msg = String.format("Closing Analyzer '%s'" , a.getName());
-354 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
-355 try {
-356 a.close();
-357 } catch (Throwable ex) {
-358 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex);
-359 }
-360 }
-361 }
-362
-363 final String logFooter = String.format("%n"
-364 + "----------------------------------------------------%n"
-365 + "END ANALYSIS%n"
-366 + "----------------------------------------------------" );
-367 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logFooter);
-368 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Complete" );
-369 }
-370
-371
-372
-373
-374 private void doUpdates() {
-375 final UpdateService service = UpdateService.getInstance();
-376 final Iterator<CachedWebDataSource> iterator = service.getDataSources();
-377 while (iterator.hasNext()) {
-378 final CachedWebDataSource source = iterator.next();
-379 try {
-380 source.update();
-381 } catch (UpdateException ex) {
-382 Logger.getLogger(Engine.class .getName()).log(Level.WARNING,
-383 "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities." );
-384 Logger.getLogger(Engine.class .getName()).log(Level.FINE,
-385 String.format("Unable to update details for %s" , source.getClass().getName()), ex);
-386 }
-387 }
-388 }
-389
-390
-391
-392
-393
-394
-395 public List<Analyzer> getAnalyzers() {
-396 final List<Analyzer> ret = new ArrayList<Analyzer>();
-397 for (AnalysisPhase phase : AnalysisPhase.values()) {
-398 final List<Analyzer> analyzerList = analyzers.get(phase);
-399 ret.addAll(analyzerList);
-400 }
-401 return ret;
-402 }
-403
-404
-405
-406
-407
-408
-409
-410 public boolean supportsExtension(String ext) {
-411 if (ext == null ) {
-412 return false;
-413 }
-414 for (AnalysisPhase phase : AnalysisPhase.values()) {
-415 final List<Analyzer> analyzerList = analyzers.get(phase);
-416 for (Analyzer a : analyzerList) {
-417 if (a.getSupportedExtensions() != null && a.supportsExtension(ext)) {
-418 return true ;
-419 }
-420 }
-421 }
-422 return false;
-423 }
-424
-425
-426
-427
-428
-429
-430
-431 private void ensureDataExists() throws NoDataException, DatabaseException {
-432 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
-433 final CveDB cve = new CveDB ();
-434
-435 try {
-436 cve.open();
-437 cpe.open(cve);
-438 } catch (IndexException ex) {
-439 throw new NoDataException (ex.getMessage(), ex);
-440 } catch (DatabaseException ex) {
-441 throw new NoDataException (ex.getMessage(), ex);
-442 } finally {
-443 cve.close();
-444 }
-445 if (cpe.numDocs() <= 0) {
-446 cpe.close();
-447 throw new NoDataException ("No documents exist" );
-448 }
-449 }
-450 }
+80 ConnectionFactory.initialize();
+81
+82 boolean autoUpdate = true ;
+83 try {
+84 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+85 } catch (InvalidSettingException ex) {
+86 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "Invalid setting for auto-update; using true." );
+87 }
+88 if (autoUpdate) {
+89 doUpdates();
+90 }
+91 loadAnalyzers();
+92 }
+93
+94
+95
+96
+97 public void cleanup() {
+98 ConnectionFactory.cleanup();
+99 }
+100
+101
+102
+103
+104 private void loadAnalyzers() {
+105
+106 for (AnalysisPhase phase : AnalysisPhase.values()) {
+107 analyzers.put(phase, new ArrayList<Analyzer>());
+108 }
+109
+110 final AnalyzerService service = AnalyzerService.getInstance();
+111 final Iterator<Analyzer> iterator = service.getAnalyzers();
+112 while (iterator.hasNext()) {
+113 final Analyzer a = iterator.next();
+114 analyzers.get(a.getAnalysisPhase()).add(a);
+115 if (a instanceof FileTypeAnalyzer) {
+116 this .fileTypeAnalyzers.add((FileTypeAnalyzer) a);
+117 }
+118 }
+119 }
+120
+121
+122
+123
+124
+125
+126
+127 public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
+128 return analyzers.get(phase);
+129 }
+130
+131
+132
+133
+134
+135
+136 public List<Dependency> getDependencies() {
+137 return dependencies;
+138 }
+139
+140 public void setDependencies(List<Dependency> dependencies) {
+141 this .dependencies = dependencies;
+142
+143
+144
+145 }
+146
+147
+148
+149
+150
+151
+152
+153
+154
+155 public void scan(String[] paths) {
+156 for (String path : paths) {
+157 final File file = new File(path);
+158 scan(file);
+159 }
+160 }
+161
+162
+163
+164
+165
+166
+167
+168 public void scan(String path) {
+169 if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$" )) {
+170 final String[] parts = path.split("\\*\\." );
+171 final String[] ext = new String[]{parts[parts.length - 1]};
+172 final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2));
+173 if (dir.isDirectory()) {
+174 final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true );
+175 scan(files);
+176 } else {
+177 final String msg = String.format("Invalid file path provided to scan '%s'" , path);
+178 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+179 }
+180 } else {
+181 final File file = new File(path);
+182 scan(file);
+183 }
+184 }
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194 public void scan(File[] files) {
+195 for (File file : files) {
+196 scan(file);
+197 }
+198 }
+199
+200
+201
+202
+203
+204
+205
+206
+207
+208 public void scan(Set<File> files) {
+209 for (File file : files) {
+210 scan(file);
+211 }
+212 }
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222 public void scan(List<File> files) {
+223 for (File file : files) {
+224 scan(file);
+225 }
+226 }
+227
+228
+229
+230
+231
+232
+233
+234
+235
+236 public void scan(File file) {
+237 if (file.exists()) {
+238 if (file.isDirectory()) {
+239 scanDirectory(file);
+240 } else {
+241 scanFile(file);
+242 }
+243 }
+244 }
+245
+246
+247
+248
+249
+250
+251 protected void scanDirectory(File dir) {
+252 final File[] files = dir.listFiles();
+253 if (files != null ) {
+254 for (File f : files) {
+255 if (f.isDirectory()) {
+256 scanDirectory(f);
+257 } else {
+258 scanFile(f);
+259 }
+260 }
+261 }
+262 }
+263
+264
+265
+266
+267
+268
+269 protected void scanFile(File file) {
+270 if (!file.isFile()) {
+271 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file." , file.toString());
+272 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+273 return ;
+274 }
+275 final String fileName = file.getName();
+276 final String extension = FileUtils.getFileExtension(fileName);
+277 if (extension != null ) {
+278 if (supportsExtension(extension)) {
+279 final Dependency dependency = new Dependency (file);
+280 dependencies.add(dependency);
+281 }
+282 } else {
+283 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed." ,
+284 file.toString());
+285 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, msg);
+286 }
+287 }
+288
+289
+290
+291
+292 public void analyzeDependencies() {
+293
+294 try {
+295 ensureDataExists();
+296 } catch (NoDataException ex) {
+297 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
+298 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+299 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
+300 return ;
+301 } catch (DatabaseException ex) {
+302 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
+303 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+304 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
+305 return ;
+306
+307 }
+308
+309 final String logHeader = String.format("%n"
+310 + "----------------------------------------------------%n"
+311 + "BEGIN ANALYSIS%n"
+312 + "----------------------------------------------------" );
+313 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logHeader);
+314 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Starting" );
+315
+316
+317 for (AnalysisPhase phase : AnalysisPhase.values()) {
+318 final List<Analyzer> analyzerList = analyzers.get(phase);
+319
+320 for (Analyzer a : analyzerList) {
+321 initializeAnalyzer(a);
+322
+323
+324
+325
+326
+327 final String msg = String.format("Begin Analyzer '%s'" , a.getName());
+328 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+329 final Set<Dependency> dependencySet = new HashSet<Dependency>();
+330 dependencySet.addAll(dependencies);
+331 for (Dependency d : dependencySet) {
+332 boolean shouldAnalyze = true ;
+333 if (a instanceof FileTypeAnalyzer) {
+334 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
+335 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension());
+336 }
+337 if (shouldAnalyze) {
+338 final String msgFile = String.format("Begin Analysis of '%s'" , d.getActualFilePath());
+339 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msgFile);
+340 try {
+341 a.analyze(d, this );
+342 } catch (AnalysisException ex) {
+343 final String exMsg = String.format("An error occured while analyzing '%s'." , d.getActualFilePath());
+344 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, exMsg);
+345 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
+346 } catch (Throwable ex) {
+347 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'" , d.getActualFilePath());
+348
+349 Logger.getLogger(Engine.class .getName()).log(Level.WARNING, axMsg);
+350 Logger.getLogger(Engine.class .getName()).log(Level.FINE, "" , ex);
+351 }
+352 }
+353 }
+354 }
+355 }
+356 for (AnalysisPhase phase : AnalysisPhase.values()) {
+357 final List<Analyzer> analyzerList = analyzers.get(phase);
+358
+359 for (Analyzer a : analyzerList) {
+360 closeAnalyzer(a);
+361 }
+362 }
+363
+364 final String logFooter = String.format("%n"
+365 + "----------------------------------------------------%n"
+366 + "END ANALYSIS%n"
+367 + "----------------------------------------------------" );
+368 Logger.getLogger(Engine.class .getName()).log(Level.FINE, logFooter);
+369 Logger.getLogger(Engine.class .getName()).log(Level.INFO, "Analysis Complete" );
+370 }
+371
+372
+373
+374
+375
+376
+377 private void initializeAnalyzer(Analyzer analyzer) {
+378 try {
+379 final String msg = String.format("Initializing %s" , analyzer.getName());
+380 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+381 analyzer.initialize();
+382 } catch (Throwable ex) {
+383 final String msg = String.format("Exception occurred initializing %s." , analyzer.getName());
+384 Logger.getLogger(Engine.class .getName()).log(Level.SEVERE, msg);
+385 Logger.getLogger(Engine.class .getName()).log(Level.FINE, null , ex);
+386 try {
+387 analyzer.close();
+388 } catch (Throwable ex1) {
+389 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex1);
+390 }
+391 }
+392 }
+393
+394
+395
+396
+397
+398
+399 private void closeAnalyzer(Analyzer analyzer) {
+400 final String msg = String.format("Closing Analyzer '%s'" , analyzer.getName());
+401 Logger.getLogger(Engine.class .getName()).log(Level.FINE, msg);
+402 try {
+403 analyzer.close();
+404 } catch (Throwable ex) {
+405 Logger.getLogger(Engine.class .getName()).log(Level.FINEST, null , ex);
+406 }
+407 }
+408
+409
+410
+411
+412 private void doUpdates() {
+413 final UpdateService service = UpdateService.getInstance();
+414 final Iterator<CachedWebDataSource> iterator = service.getDataSources();
+415 while (iterator.hasNext()) {
+416 final CachedWebDataSource source = iterator.next();
+417 try {
+418 source.update();
+419 } catch (UpdateException ex) {
+420 Logger.getLogger(Engine.class .getName()).log(Level.WARNING,
+421 "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities." );
+422 Logger.getLogger(Engine.class .getName()).log(Level.FINE,
+423 String.format("Unable to update details for %s" , source.getClass().getName()), ex);
+424 }
+425 }
+426 }
+427
+428
+429
+430
+431
+432
+433 public List<Analyzer> getAnalyzers() {
+434 final List<Analyzer> ret = new ArrayList<Analyzer>();
+435 for (AnalysisPhase phase : AnalysisPhase.values()) {
+436 final List<Analyzer> analyzerList = analyzers.get(phase);
+437 ret.addAll(analyzerList);
+438 }
+439 return ret;
+440 }
+441
+442
+443
+444
+445
+446
+447
+448 public boolean supportsExtension(String ext) {
+449 if (ext == null ) {
+450 return false;
+451 }
+452 boolean scan = false;
+453 for (FileTypeAnalyzer a : this .fileTypeAnalyzers) {
+454
+455
+456 scan |= a.supportsExtension(ext);
+457 }
+458 return scan;
+459 }
+460
+461
+462
+463
+464
+465
+466
+467 private void ensureDataExists() throws NoDataException, DatabaseException {
+468 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
+469 final CveDB cve = new CveDB ();
+470
+471 try {
+472 cve.open();
+473 cpe.open(cve);
+474 } catch (IndexException ex) {
+475 throw new NoDataException (ex.getMessage(), ex);
+476 } catch (DatabaseException ex) {
+477 throw new NoDataException (ex.getMessage(), ex);
+478 } finally {
+479 cve.close();
+480 }
+481 if (cpe.numDocs() <= 0) {
+482 cpe.close();
+483 throw new NoDataException ("No documents exist" );
+484 }
+485 }
+486
+487 }
DependencyCheckScanAgent xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.agent;
+19
+20 import java.io.File;
+21 import java.io.IOException;
+22 import java.util.List;
+23 import java.util.logging.Level;
+24 import java.util.logging.Logger;
+25 import org.owasp.dependencycheck.Engine;
+26 import org.owasp.dependencycheck.data.nvdcve.CveDB;
+27 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+28 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+29 import org.owasp.dependencycheck.dependency.Dependency;
+30 import org.owasp.dependencycheck.dependency.Identifier;
+31 import org.owasp.dependencycheck.dependency.Vulnerability;
+32 import org.owasp.dependencycheck.exception.ScanAgentException;
+33 import org.owasp.dependencycheck.reporting.ReportGenerator;
+34 import org.owasp.dependencycheck.utils.Settings;
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60 @SuppressWarnings("unused" )
+61 public class DependencyCheckScanAgent {
+62
+63
+64
+65
+66 private static final String NEW_LINE = System.getProperty("line.separator" , "\n" ).intern();
+67
+68
+69
+70
+71 private String applicationName = "Dependency-Check" ;
+72
+73
+74
+75
+76
+77
+78 public String getApplicationName() {
+79 return applicationName;
+80 }
+81
+82
+83
+84
+85
+86
+87 public void setApplicationName(String applicationName) {
+88 this .applicationName = applicationName;
+89 }
+90
+91
+92
+93
+94 private List<Dependency> dependencies;
+95
+96
+97
+98
+99
+100
+101 public List<Dependency> getDependencies() {
+102 return dependencies;
+103 }
+104
+105
+106
+107
+108
+109
+110 public void setDependencies(List<Dependency> dependencies) {
+111 this .dependencies = dependencies;
+112 }
+113
+114
+115
+116
+117 private String dataDirectory = null ;
+118
+119
+120
+121
+122
+123
+124 public String getDataDirectory() {
+125 return dataDirectory;
+126 }
+127
+128
+129
+130
+131
+132
+133 public void setDataDirectory(String dataDirectory) {
+134 this .dataDirectory = dataDirectory;
+135 }
+136
+137
+138
+139
+140 private String reportOutputDirectory;
+141
+142
+143
+144
+145
+146
+147 public String getReportOutputDirectory() {
+148 return reportOutputDirectory;
+149 }
+150
+151
+152
+153
+154
+155
+156 public void setReportOutputDirectory(String reportOutputDirectory) {
+157 this .reportOutputDirectory = reportOutputDirectory;
+158 }
+159
+160
+161
+162
+163
+164
+165 private float failBuildOnCVSS = 11;
+166
+167
+168
+169
+170
+171
+172 public float getFailBuildOnCVSS() {
+173 return failBuildOnCVSS;
+174 }
+175
+176
+177
+178
+179
+180
+181 public void setFailBuildOnCVSS(float failBuildOnCVSS) {
+182 this .failBuildOnCVSS = failBuildOnCVSS;
+183 }
+184
+185
+186
+187
+188
+189 private boolean autoUpdate = true ;
+190
+191
+192
+193
+194
+195
+196 public boolean isAutoUpdate() {
+197 return autoUpdate;
+198 }
+199
+200
+201
+202
+203
+204
+205 public void setAutoUpdate(boolean autoUpdate) {
+206 this .autoUpdate = autoUpdate;
+207 }
+208
+209
+210
+211
+212
+213 private ReportGenerator.Format reportFormat = ReportGenerator.Format.HTML;
+214
+215
+216
+217
+218
+219
+220 public ReportGenerator.Format getReportFormat() {
+221 return reportFormat;
+222 }
+223
+224
+225
+226
+227
+228
+229 public void setReportFormat(ReportGenerator.Format reportFormat) {
+230 this .reportFormat = reportFormat;
+231 }
+232
+233
+234
+235
+236 private String proxyUrl;
+237
+238
+239
+240
+241
+242
+243 public String getProxyUrl() {
+244 return proxyUrl;
+245 }
+246
+247
+248
+249
+250
+251
+252 public void setProxyUrl(String proxyUrl) {
+253 this .proxyUrl = proxyUrl;
+254 }
+255
+256
+257
+258
+259 private String proxyPort;
+260
+261
+262
+263
+264
+265
+266 public String getProxyPort() {
+267 return proxyPort;
+268 }
+269
+270
+271
+272
+273
+274
+275 public void setProxyPort(String proxyPort) {
+276 this .proxyPort = proxyPort;
+277 }
+278
+279
+280
+281
+282 private String proxyUsername;
+283
+284
+285
+286
+287
+288
+289 public String getProxyUsername() {
+290 return proxyUsername;
+291 }
+292
+293
+294
+295
+296
+297
+298 public void setProxyUsername(String proxyUsername) {
+299 this .proxyUsername = proxyUsername;
+300 }
+301
+302
+303
+304
+305 private String proxyPassword;
+306
+307
+308
+309
+310
+311
+312 public String getProxyPassword() {
+313 return proxyPassword;
+314 }
+315
+316
+317
+318
+319
+320
+321 public void setProxyPassword(String proxyPassword) {
+322 this .proxyPassword = proxyPassword;
+323 }
+324
+325
+326
+327
+328 private String connectionTimeout;
+329
+330
+331
+332
+333
+334
+335 public String getConnectionTimeout() {
+336 return connectionTimeout;
+337 }
+338
+339
+340
+341
+342
+343
+344 public void setConnectionTimeout(String connectionTimeout) {
+345 this .connectionTimeout = connectionTimeout;
+346 }
+347
+348
+349
+350
+351 private String logFile = null ;
+352
+353
+354
+355
+356
+357
+358 public String getLogFile() {
+359 return logFile;
+360 }
+361
+362
+363
+364
+365
+366
+367 public void setLogFile(String logFile) {
+368 this .logFile = logFile;
+369 }
+370
+371
+372
+373
+374 private String suppressionFile;
+375
+376
+377
+378
+379
+380
+381 public String getSuppressionFile() {
+382 return suppressionFile;
+383 }
+384
+385
+386
+387
+388
+389
+390 public void setSuppressionFile(String suppressionFile) {
+391 this .suppressionFile = suppressionFile;
+392 }
+393
+394
+395
+396
+397 private boolean showSummary = true ;
+398
+399
+400
+401
+402
+403
+404 public boolean isShowSummary() {
+405 return showSummary;
+406 }
+407
+408
+409
+410
+411
+412
+413 public void setShowSummary(boolean showSummary) {
+414 this .showSummary = showSummary;
+415 }
+416
+417
+418
+419
+420 private boolean nexusAnalyzerEnabled = true ;
+421
+422
+423
+424
+425
+426
+427 public boolean isNexusAnalyzerEnabled() {
+428 return nexusAnalyzerEnabled;
+429 }
+430
+431
+432
+433
+434
+435
+436 public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
+437 this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
+438 }
+439
+440
+441
+442
+443 private String nexusUrl;
+444
+445
+446
+447
+448
+449
+450 public String getNexusUrl() {
+451 return nexusUrl;
+452 }
+453
+454
+455
+456
+457
+458
+459 public void setNexusUrl(String nexusUrl) {
+460 this .nexusUrl = nexusUrl;
+461 }
+462
+463
+464
+465
+466 private boolean nexusUsesProxy = true ;
+467
+468
+469
+470
+471
+472
+473 public boolean isNexusUsesProxy() {
+474 return nexusUsesProxy;
+475 }
+476
+477
+478
+479
+480
+481
+482 public void setNexusUsesProxy(boolean nexusUsesProxy) {
+483 this .nexusUsesProxy = nexusUsesProxy;
+484 }
+485
+486
+487
+488
+489 private String databaseDriverName;
+490
+491
+492
+493
+494
+495
+496 public String getDatabaseDriverName() {
+497 return databaseDriverName;
+498 }
+499
+500
+501
+502
+503
+504
+505 public void setDatabaseDriverName(String databaseDriverName) {
+506 this .databaseDriverName = databaseDriverName;
+507 }
+508
+509
+510
+511
+512 private String databaseDriverPath;
+513
+514
+515
+516
+517
+518
+519 public String getDatabaseDriverPath() {
+520 return databaseDriverPath;
+521 }
+522
+523
+524
+525
+526
+527
+528 public void setDatabaseDriverPath(String databaseDriverPath) {
+529 this .databaseDriverPath = databaseDriverPath;
+530 }
+531
+532
+533
+534
+535 private String connectionString;
+536
+537
+538
+539
+540
+541
+542 public String getConnectionString() {
+543 return connectionString;
+544 }
+545
+546
+547
+548
+549
+550
+551 public void setConnectionString(String connectionString) {
+552 this .connectionString = connectionString;
+553 }
+554
+555
+556
+557
+558 private String databaseUser;
+559
+560
+561
+562
+563
+564
+565 public String getDatabaseUser() {
+566 return databaseUser;
+567 }
+568
+569
+570
+571
+572
+573
+574 public void setDatabaseUser(String databaseUser) {
+575 this .databaseUser = databaseUser;
+576 }
+577
+578
+579
+580
+581 private String databasePassword;
+582
+583
+584
+585
+586
+587
+588 public String getDatabasePassword() {
+589 return databasePassword;
+590 }
+591
+592
+593
+594
+595
+596
+597 public void setDatabasePassword(String databasePassword) {
+598 this .databasePassword = databasePassword;
+599 }
+600
+601
+602
+603
+604
+605 private String zipExtensions;
+606
+607
+608
+609
+610
+611
+612 public String getZipExtensions() {
+613 return zipExtensions;
+614 }
+615
+616
+617
+618
+619
+620
+621 public void setZipExtensions(String zipExtensions) {
+622 this .zipExtensions = zipExtensions;
+623 }
+624
+625
+626
+627
+628 private String cveUrl12Modified;
+629
+630
+631
+632
+633
+634
+635 public String getCveUrl12Modified() {
+636 return cveUrl12Modified;
+637 }
+638
+639
+640
+641
+642
+643
+644 public void setCveUrl12Modified(String cveUrl12Modified) {
+645 this .cveUrl12Modified = cveUrl12Modified;
+646 }
+647
+648
+649
+650
+651 private String cveUrl20Modified;
+652
+653
+654
+655
+656
+657
+658 public String getCveUrl20Modified() {
+659 return cveUrl20Modified;
+660 }
+661
+662
+663
+664
+665
+666
+667 public void setCveUrl20Modified(String cveUrl20Modified) {
+668 this .cveUrl20Modified = cveUrl20Modified;
+669 }
+670
+671
+672
+673
+674 private String cveUrl12Base;
+675
+676
+677
+678
+679
+680
+681 public String getCveUrl12Base() {
+682 return cveUrl12Base;
+683 }
+684
+685
+686
+687
+688
+689
+690 public void setCveUrl12Base(String cveUrl12Base) {
+691 this .cveUrl12Base = cveUrl12Base;
+692 }
+693
+694
+695
+696
+697 private String cveUrl20Base;
+698
+699
+700
+701
+702
+703
+704 public String getCveUrl20Base() {
+705 return cveUrl20Base;
+706 }
+707
+708
+709
+710
+711
+712
+713 public void setCveUrl20Base(String cveUrl20Base) {
+714 this .cveUrl20Base = cveUrl20Base;
+715 }
+716
+717
+718
+719
+720 private String pathToMono;
+721
+722
+723
+724
+725
+726
+727 public String getPathToMono() {
+728 return pathToMono;
+729 }
+730
+731
+732
+733
+734
+735
+736 public void setPathToMono(String pathToMono) {
+737 this .pathToMono = pathToMono;
+738 }
+739
+740
+741
+742
+743
+744
+745
+746
+747 private Engine executeDependencyCheck() throws DatabaseException {
+748 populateSettings();
+749 Engine engine = null ;
+750 try {
+751 engine = new Engine ();
+752 engine.setDependencies(this .dependencies);
+753 engine.analyzeDependencies();
+754
+755 } finally {
+756 if (engine != null ) {
+757 engine.cleanup();
+758 }
+759 }
+760 return engine;
+761 }
+762
+763
+764
+765
+766
+767
+768
+769 private void generateExternalReports(Engine engine, File outDirectory) {
+770 DatabaseProperties prop = null ;
+771 CveDB cve = null ;
+772 try {
+773 cve = new CveDB ();
+774 cve.open();
+775 prop = cve.getDatabaseProperties();
+776 } catch (DatabaseException ex) {
+777 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+778 } finally {
+779 if (cve != null ) {
+780 cve.close();
+781 }
+782 }
+783 final ReportGenerator r = new ReportGenerator (this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
+784 try {
+785 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
+786 } catch (IOException ex) {
+787 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.SEVERE,
+788 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+789 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, null , ex);
+790 } catch (Throwable ex) {
+791 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.SEVERE,
+792 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+793 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, null , ex);
+794 }
+795 }
+796
+797
+798
+799
+800
+801 private void populateSettings() {
+802 if (dataDirectory != null ) {
+803 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+804 } else {
+805 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
+806 final File base = jarPath.getParentFile();
+807 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+808 final File dataDir = new File(base, sub);
+809 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+810 }
+811
+812 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+813
+814 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+815 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+816 }
+817 if (proxyPort != null && !proxyPort.isEmpty()) {
+818 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+819 }
+820 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+821 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+822 }
+823 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+824 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+825 }
+826 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+827 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+828 }
+829 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+830 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+831 }
+832 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+833 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+834 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+835 }
+836 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+837 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+838 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+839 }
+840 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+841 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+842 }
+843 if (connectionString != null && !connectionString.isEmpty()) {
+844 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+845 }
+846 if (databaseUser != null && !databaseUser.isEmpty()) {
+847 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+848 }
+849 if (databasePassword != null && !databasePassword.isEmpty()) {
+850 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+851 }
+852 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+853 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+854 }
+855 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+856 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+857 }
+858 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+859 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+860 }
+861 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+862 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+863 }
+864 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+865 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+866 }
+867 if (pathToMono != null && !pathToMono.isEmpty()) {
+868 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+869 }
+870 }
+871
+872
+873
+874
+875
+876
+877
+878 public void execute() throws ScanAgentException {
+879 Engine engine = null ;
+880 try {
+881 engine = executeDependencyCheck();
+882 generateExternalReports(engine, new File(this .reportOutputDirectory));
+883 if (this .showSummary) {
+884 showSummary(engine.getDependencies());
+885 }
+886 if (this .failBuildOnCVSS <= 10) {
+887 checkForFailure(engine.getDependencies());
+888 }
+889 } catch (DatabaseException ex) {
+890 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.SEVERE,
+891 "Unable to connect to the dependency-check database; analysis has stopped" );
+892 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.FINE, "" , ex);
+893 } finally {
+894 if (engine != null ) {
+895 engine.cleanup();
+896 }
+897 }
+898 }
+899
+900
+901
+902
+903
+904
+905
+906
+907
+908 private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
+909 final StringBuilder ids = new StringBuilder();
+910 for (Dependency d : dependencies) {
+911 boolean addName = true ;
+912 for (Vulnerability v : d.getVulnerabilities()) {
+913 if (v.getCvssScore() >= failBuildOnCVSS) {
+914 if (addName) {
+915 addName = false;
+916 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+917 ids.append(v.getName());
+918 } else {
+919 ids.append(", " ).append(v.getName());
+920 }
+921 }
+922 }
+923 }
+924 if (ids.length() > 0) {
+925 final String msg = String.format("%n%nDependency-Check Failure:%n"
+926 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+927 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+928
+929 throw new ScanAgentException (msg);
+930 }
+931 }
+932
+933
+934
+935
+936
+937
+938 private void showSummary(List<Dependency> dependencies) {
+939 final StringBuilder summary = new StringBuilder();
+940 for (Dependency d : dependencies) {
+941 boolean firstEntry = true ;
+942 final StringBuilder ids = new StringBuilder();
+943 for (Vulnerability v : d.getVulnerabilities()) {
+944 if (firstEntry) {
+945 firstEntry = false;
+946 } else {
+947 ids.append(", " );
+948 }
+949 ids.append(v.getName());
+950 }
+951 if (ids.length() > 0) {
+952 summary.append(d.getFileName()).append(" (" );
+953 firstEntry = true ;
+954 for (Identifier id : d.getIdentifiers()) {
+955 if (firstEntry) {
+956 firstEntry = false;
+957 } else {
+958 summary.append(", " );
+959 }
+960 summary.append(id.getValue());
+961 }
+962 summary.append(") : " ).append(ids).append(NEW_LINE);
+963 }
+964 }
+965 if (summary.length() > 0) {
+966 final String msg = String.format("%n%n"
+967 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+968 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+969 Logger.getLogger(DependencyCheckScanAgent.class .getName()).log(Level.WARNING, msg);
+970 }
+971 }
+972
+973 }
+
+Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.agent
+ Classes
+
+
+
+
+
\ No newline at end of file
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html
new file mode 100644
index 000000000..413ad0f46
--- /dev/null
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html
@@ -0,0 +1,69 @@
+
+
+
+
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.agent
+ Package org.owasp.dependencycheck.agent
+
+
+
+
+
+ 17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import java.util.Collections;
-21 import java.util.HashSet;
-22 import java.util.Set;
-23
-24
-25
-26
-27
-28 public abstract class AbstractAnalyzer implements Analyzer {
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40 protected static Set<String> newHashSet(String... strings) {
-41 final Set<String> set = new HashSet<String>();
-42
-43 Collections.addAll(set, strings);
-44 return set;
-45 }
-46
-47
-48
-49
-50
-51
-52 @Override
-53 public void initialize() throws Exception {
-54
-55 }
-56
-57
-58
-59
-60
-61
-62 @Override
-63 public void close() throws Exception {
-64
-65 }
-66 }
+20
+21
+22
+23
+24 public abstract class AbstractAnalyzer implements Analyzer {
+25
+26
+27
+28
+29
+30
+31 @Override
+32 public void initialize() throws Exception {
+33
+34 }
+35
+36
+37
+38
+39
+40
+41 @Override
+42 public void close() throws Exception {
+43
+44 }
+45 }
AbstractFileTypeAnalyzer xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.analyzer;
+19
+20 import java.util.Collections;
+21 import java.util.HashSet;
+22 import java.util.Set;
+23 import java.util.logging.Level;
+24 import java.util.logging.Logger;
+25 import org.owasp.dependencycheck.Engine;
+26 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+27 import org.owasp.dependencycheck.dependency.Dependency;
+28 import org.owasp.dependencycheck.utils.InvalidSettingException;
+29 import org.owasp.dependencycheck.utils.Settings;
+30
+31
+32
+33
+34
+35
+36 public abstract class AbstractFileTypeAnalyzer extends AbstractAnalyzer implements FileTypeAnalyzer {
+37
+38
+39
+40
+41
+42
+43 public AbstractFileTypeAnalyzer () {
+44 final String key = getAnalyzerEnabledSettingKey();
+45 try {
+46 enabled = Settings.getBoolean(key, true );
+47 } catch (InvalidSettingException ex) {
+48 String msg = String.format("Invalid settting for property '%s'" , key);
+49 LOGGER.log(Level.WARNING, msg);
+50 LOGGER.log(Level.FINE, "" , ex);
+51 msg = String.format("%s has been disabled" , getName());
+52 LOGGER.log(Level.WARNING, msg);
+53 }
+54 }
+55
+56
+57
+58
+59
+60
+61 private static final Logger LOGGER = Logger.getLogger(AbstractFileTypeAnalyzer.class .getName());
+62
+63
+64
+65 private boolean filesMatched = false;
+66
+67
+68
+69
+70
+71
+72 protected boolean isFilesMatched() {
+73 return filesMatched;
+74 }
+75
+76
+77
+78
+79
+80
+81 protected void setFilesMatched(boolean filesMatched) {
+82 this .filesMatched = filesMatched;
+83 }
+84
+85
+86
+87
+88 private boolean enabled = true ;
+89
+90
+91
+92
+93
+94
+95 public boolean isEnabled() {
+96 return enabled;
+97 }
+98
+99
+100
+101
+102
+103
+104 public void setEnabled(boolean enabled) {
+105 this .enabled = enabled;
+106 }
+107
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117
+118
+119
+120
+121
+122
+123
+124 protected abstract Set<String> getSupportedExtensions();
+125
+126
+127
+128
+129
+130
+131 protected abstract void initializeFileTypeAnalyzer() throws Exception;
+132
+133
+134
+135
+136
+137
+138
+139
+140
+141 protected abstract void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException;
+142
+143
+144
+145
+146
+147
+148
+149 protected abstract String getAnalyzerEnabledSettingKey();
+150
+151
+152
+153
+154
+155
+156
+157
+158 @Override
+159 public final void initialize() throws Exception {
+160 if (filesMatched) {
+161 initializeFileTypeAnalyzer();
+162 } else {
+163 enabled = false;
+164 }
+165 }
+166
+167
+168
+169
+170
+171
+172
+173
+174
+175 @Override
+176 public final void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+177 if (enabled) {
+178 analyzeFileType(dependency, engine);
+179 }
+180 }
+181
+182
+183
+184
+185
+186
+187
+188 @Override
+189 public final boolean supportsExtension(String extension) {
+190 if (!enabled) {
+191 return false;
+192 }
+193 final Set<String> ext = getSupportedExtensions();
+194 if (ext == null ) {
+195 final String msg = String.format("The '%s' analyzer is misconfigured and does not have any file extensions;"
+196 + " it will be disabled" , getName());
+197 Logger.getLogger(AbstractFileTypeAnalyzer.class .getName()).log(Level.SEVERE, msg);
+198 return false;
+199 } else {
+200 final boolean match = ext.contains(extension);
+201 if (match) {
+202 filesMatched = match;
+203 }
+204 return match;
+205 }
+206 }
+207
+208
+209
+210
+211
+212
+213
+214
+215
+216
+217
+218
+219
+220
+221
+222 protected static Set<String> newHashSet(String... strings) {
+223 final Set<String> set = new HashSet<String>();
+224
+225 Collections.addAll(set, strings);
+226 return set;
+227 }
+228
+229 }
+
+51 return null ;
52 }
53
-54
-55
-56
-57
-58
+54
+55
+56
+57
+58
59
60 @Override
-61 public boolean supportsExtension(String extension) {
-62 return true ;
-63 }
-64
-65
-66
-67
-68
-69
-70
-71 @Override
-72 public void initialize() throws Exception {
-73 super .initialize();
-74 loadSuppressionData();
-75 }
-76
-77
-78
-79 private List<SuppressionRule> rules;
-80
-81
-82
-83
-84
-85
-86 public List<SuppressionRule> getRules() {
-87 return rules;
-88 }
-89
-90
-91
-92
-93
-94
-95 public void setRules(List<SuppressionRule> rules) {
-96 this .rules = rules;
-97 }
-98
-99
-100
-101
-102
-103
-104 private void loadSuppressionData() throws SuppressionParseException {
-105 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
-106 if (suppressionFilePath == null ) {
-107 return ;
-108 }
-109 File file = null ;
-110 boolean deleteTempFile = false;
-111 try {
-112 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
-113 if (uriRx.matcher(suppressionFilePath).matches()) {
-114 deleteTempFile = true ;
-115 file = FileUtils.getTempFile("suppression" , "xml" );
-116 final URL url = new URL(suppressionFilePath);
+61 public void initialize() throws Exception {
+62 super .initialize();
+63 loadSuppressionData();
+64 }
+65
+66
+67
+68 private List<SuppressionRule> rules;
+69
+70
+71
+72
+73
+74
+75 public List<SuppressionRule> getRules() {
+76 return rules;
+77 }
+78
+79
+80
+81
+82
+83
+84 public void setRules(List<SuppressionRule> rules) {
+85 this .rules = rules;
+86 }
+87
+88
+89
+90
+91
+92
+93 private void loadSuppressionData() throws SuppressionParseException {
+94 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
+95 if (suppressionFilePath == null ) {
+96 return ;
+97 }
+98 File file = null ;
+99 boolean deleteTempFile = false;
+100 try {
+101 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
+102 if (uriRx.matcher(suppressionFilePath).matches()) {
+103 deleteTempFile = true ;
+104 file = FileUtils.getTempFile("suppression" , "xml" );
+105 final URL url = new URL(suppressionFilePath);
+106 try {
+107 Downloader.fetchFile(url, file, false);
+108 } catch (DownloadFailedException ex) {
+109 Downloader.fetchFile(url, file, true );
+110 }
+111 } else {
+112 file = new File(suppressionFilePath);
+113 }
+114
+115 if (file != null ) {
+116 final SuppressionParser parser = new SuppressionParser ();
117 try {
-118 Downloader.fetchFile(url, file, false);
-119 } catch (DownloadFailedException ex) {
-120 Downloader.fetchFile(url, file, true );
-121 }
-122 }
-123
-124 if (file != null ) {
-125 final SuppressionParser parser = new SuppressionParser ();
-126 try {
-127 rules = parser.parseSuppressionRules(file);
-128 } catch (SuppressionParseException ex) {
-129 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
-130 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, msg);
-131 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, ex.getMessage());
-132 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, null , ex);
-133 throw ex;
-134 }
-135 }
-136 } catch (DownloadFailedException ex) {
-137 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
-138 "Unable to fetch the configured suppression file" );
-139 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
-140 throw new SuppressionParseException ("Unable to fetch the configured suppression file" , ex);
-141 } catch (MalformedURLException ex) {
-142 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
-143 "Configured suppression file has an invalid URL" );
-144 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
-145 throw new SuppressionParseException ("Configured suppression file has an invalid URL" , ex);
-146 } catch (IOException ex) {
-147 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
-148 "Unable to create temp file for suppressions" );
-149 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
-150 throw new SuppressionParseException ("Unable to create temp file for suppressions" , ex);
-151 } finally {
-152 if (deleteTempFile && file != null ) {
-153 FileUtils.delete(file);
-154 }
-155 }
-156 }
-157 }
+118 rules = parser.parseSuppressionRules(file);
+119 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, rules.size() + " suppression rules were loaded." );
+120 } catch (SuppressionParseException ex) {
+121 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
+122 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, msg);
+123 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING, ex.getMessage());
+124 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+125 throw ex;
+126 }
+127 }
+128 } catch (DownloadFailedException ex) {
+129 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
+130 "Unable to fetch the configured suppression file" );
+131 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+132 throw new SuppressionParseException ("Unable to fetch the configured suppression file" , ex);
+133 } catch (MalformedURLException ex) {
+134 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
+135 "Configured suppression file has an invalid URL" );
+136 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+137 throw new SuppressionParseException ("Configured suppression file has an invalid URL" , ex);
+138 } catch (IOException ex) {
+139 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.WARNING,
+140 "Unable to create temp file for suppressions" );
+141 Logger.getLogger(AbstractSuppressionAnalyzer.class .getName()).log(Level.FINE, "" , ex);
+142 throw new SuppressionParseException ("Unable to create temp file for suppressions" , ex);
+143 } finally {
+144 if (deleteTempFile && file != null ) {
+145 FileUtils.delete(file);
+146 }
+147 }
+148 }
+149 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-21 import java.util.Set;
-22 import org.owasp.dependencycheck.Engine;
-23 import org.owasp.dependencycheck.dependency.Dependency;
-24
-25
-26
-27
-28
-29
-30
-31 public interface Analyzer {
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43 void analyze(Dependency dependency, Engine engine) throws AnalysisException;
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57
-58
-59 Set<String> getSupportedExtensions();
-60
-61
-62
-63
-64
-65
-66 String getName();
-67
-68
-69
-70
-71
-72
-73
-74 boolean supportsExtension(String extension);
-75
-76
-77
-78
-79
-80
-81 AnalysisPhase getAnalysisPhase();
-82
-83
-84
-85
-86
-87
-88 void initialize() throws Exception;
-89
-90
-91
-92
-93
-94
-95 void close() throws Exception;
-96 }
+20 import org.owasp.dependencycheck.Engine;
+21 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+22 import org.owasp.dependencycheck.dependency.Dependency;
+23
+24
+25
+26
+27
+28
+29
+30 public interface Analyzer {
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42 void analyze(Dependency dependency, Engine engine) throws AnalysisException;
+43
+44
+45
+46
+47
+48
+49 String getName();
+50
+51
+52
+53
+54
+55
+56 AnalysisPhase getAnalysisPhase();
+57
+58
+59
+60
+61
+62
+63 void initialize() throws Exception;
+64
+65
+66
+67
+68
+69
+70 void close() throws Exception;
+71 }
53
54
55
-56 public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
+56 public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
57
58
-59
+59
60
-61 private static final int BUFFER_SIZE = 4096;
+61 private static final Logger LOGGER = Logger.getLogger(ArchiveAnalyzer.class .getName());
62
-63
+63
64
-65 private static int dirCount = 0;
+65 private static final int BUFFER_SIZE = 4096;
66
-67
+67
68
-69 private File tempFileLocation = null ;
+69 private static int dirCount = 0;
70
-71
+71
72
-73 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth" , 3);
+73 private File tempFileLocation = null ;
74
-75
+75
76
-77 private int scanDepth = 0;
-78
-79
-80
-81
-82 private static final String ANALYZER_NAME = "Archive Analyzer" ;
-83
-84
-85
-86 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
-87
-88
-89
-90 private static final Set<String> ZIPPABLES = newHashSet("zip" , "ear" , "war" , "nupkg" );
-91
-92
-93
+77 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth" , 3);
+78
+79
+80
+81 private int scanDepth = 0;
+82
+83
+84
+85
+86
+87 private static final String ANALYZER_NAME = "Archive Analyzer" ;
+88
+89
+90
+91 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
+92
+93
94
-95 private static final Set<String> EXTENSIONS = newHashSet("tar" , "gz" , "tgz" );
-96
-97 static {
-98 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
-99 if (additionalZipExt != null ) {
-100 final HashSet ext = new HashSet<String>(Arrays.asList(additionalZipExt));
-101 ZIPPABLES.addAll(ext);
-102 }
-103 EXTENSIONS.addAll(ZIPPABLES);
-104 }
-105
-106
-107
-108
-109
-110
-111 public Set<String> getSupportedExtensions() {
-112 return EXTENSIONS;
-113 }
-114
-115
-116
-117
-118
-119
-120 public String getName() {
-121 return ANALYZER_NAME;
-122 }
-123
-124
-125
-126
-127
-128
-129
-130 public boolean supportsExtension(String extension) {
-131 return EXTENSIONS.contains(extension);
-132 }
-133
-134
-135
-136
-137
-138
-139 public AnalysisPhase getAnalysisPhase() {
-140 return ANALYSIS_PHASE;
-141 }
-142
-143
-144
-145
-146
-147
-148
-149 @Override
-150 public void initialize() throws Exception {
-151 final File baseDir = Settings.getTempDirectory();
-152 if (!baseDir.exists()) {
-153 if (!baseDir.mkdirs()) {
-154 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
-155 throw new AnalysisException (msg);
-156 }
-157 }
-158 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
-159 if (!tempFileLocation.delete()) {
-160 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
-161 throw new AnalysisException (msg);
-162 }
-163 if (!tempFileLocation.mkdirs()) {
-164 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
-165 throw new AnalysisException (msg);
-166 }
-167 }
-168
-169
-170
-171
-172
-173
-174 @Override
-175 public void close() throws Exception {
-176 if (tempFileLocation != null && tempFileLocation.exists()) {
-177 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, "Attempting to delete temporary files" );
-178 final boolean success = FileUtils.delete(tempFileLocation);
-179 if (!success) {
-180 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.WARNING,
-181 "Failed to delete some temporary files, see the log for more details" );
-182 }
-183 }
-184 }
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194 @Override
-195 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-196 final File f = new File(dependency.getActualFilePath());
-197 final File tmpDir = getNextTempDirectory();
-198 extractFiles(f, tmpDir, engine);
-199
-200
-201 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
-202 engine.scan(tmpDir);
-203 final List<Dependency> newDependencies = engine.getDependencies();
-204 if (dependencies.size() != newDependencies.size()) {
-205
-206 final Set<Dependency> dependencySet = new HashSet<Dependency>();
-207 dependencySet.addAll(newDependencies);
-208 dependencySet.removeAll(dependencies);
-209
-210 for (Dependency d : dependencySet) {
-211
-212 final String displayPath = String.format("%s%s" ,
-213 dependency.getFilePath(),
-214 d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
-215 final String displayName = String.format("%s%s%s" ,
-216 dependency.getFileName(),
-217 File.separator,
-218 d.getFileName());
-219 d.setFilePath(displayPath);
-220 d.setFileName(displayName);
-221
-222
-223
-224 if (this .supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) {
-225 scanDepth += 1;
-226 analyze(d, engine);
-227 scanDepth -= 1;
-228 }
-229 }
-230 }
-231 Collections.sort(engine.getDependencies());
-232 }
-233
-234
-235
-236
-237
-238
-239
-240 private File getNextTempDirectory() throws AnalysisException {
-241 dirCount += 1;
-242 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
-243
-244 if (directory.exists()) {
-245 return getNextTempDirectory();
-246 }
-247 if (!directory.mkdirs()) {
-248 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
-249 throw new AnalysisException (msg);
-250 }
-251 return directory;
-252 }
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262 private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
-263 if (archive == null || destination == null ) {
-264 return ;
-265 }
-266
-267 FileInputStream fis = null ;
-268 try {
-269 fis = new FileInputStream(archive);
-270 } catch (FileNotFoundException ex) {
-271 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
-272 throw new AnalysisException ("Archive file was not found." , ex);
-273 }
-274 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
+95 private static final Set<String> ZIPPABLES = newHashSet("zip" , "ear" , "war" , "nupkg" );
+96
+97
+98
+99
+100 private static final Set<String> EXTENSIONS = newHashSet("tar" , "gz" , "tgz" );
+101
+102 static {
+103 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
+104 if (additionalZipExt != null ) {
+105 final HashSet ext = new HashSet<String>(Arrays.asList(additionalZipExt));
+106 ZIPPABLES.addAll(ext);
+107 }
+108 EXTENSIONS.addAll(ZIPPABLES);
+109 }
+110
+111
+112
+113
+114
+115
+116 @Override
+117 public Set<String> getSupportedExtensions() {
+118 return EXTENSIONS;
+119 }
+120
+121
+122
+123
+124
+125
+126 @Override
+127 public String getName() {
+128 return ANALYZER_NAME;
+129 }
+130
+131
+132
+133
+134
+135
+136 @Override
+137 public AnalysisPhase getAnalysisPhase() {
+138 return ANALYSIS_PHASE;
+139 }
+140
+141
+142
+143
+144
+145
+146
+147 @Override
+148 protected String getAnalyzerEnabledSettingKey() {
+149 return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
+150 }
+151
+152
+153
+154
+155
+156
+157 @Override
+158 public void initializeFileTypeAnalyzer() throws Exception {
+159 final File baseDir = Settings.getTempDirectory();
+160 if (!baseDir.exists()) {
+161 if (!baseDir.mkdirs()) {
+162 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
+163 throw new AnalysisException (msg);
+164 }
+165 }
+166 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+167 if (!tempFileLocation.delete()) {
+168 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
+169 throw new AnalysisException (msg);
+170 }
+171 if (!tempFileLocation.mkdirs()) {
+172 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
+173 throw new AnalysisException (msg);
+174 }
+175 }
+176
+177
+178
+179
+180
+181
+182 @Override
+183 public void close() throws Exception {
+184 if (tempFileLocation != null && tempFileLocation.exists()) {
+185 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+186 final boolean success = FileUtils.delete(tempFileLocation);
+187 if (!success) {
+188 LOGGER.log(Level.WARNING, "Failed to delete some temporary files, see the log for more details" );
+189 }
+190 }
+191 }
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201 @Override
+202 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+203 final File f = new File(dependency.getActualFilePath());
+204 final File tmpDir = getNextTempDirectory();
+205 extractFiles(f, tmpDir, engine);
+206
+207
+208 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
+209 engine.scan(tmpDir);
+210 final List<Dependency> newDependencies = engine.getDependencies();
+211 if (dependencies.size() != newDependencies.size()) {
+212
+213 final Set<Dependency> dependencySet = new HashSet<Dependency>();
+214 dependencySet.addAll(newDependencies);
+215 dependencySet.removeAll(dependencies);
+216
+217 for (Dependency d : dependencySet) {
+218
+219 final String displayPath = String.format("%s%s" ,
+220 dependency.getFilePath(),
+221 d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
+222 final String displayName = String.format("%s%s%s" ,
+223 dependency.getFileName(),
+224 File.separator,
+225 d.getFileName());
+226 d.setFilePath(displayPath);
+227 d.setFileName(displayName);
+228
+229
+230
+231 if (this .supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) {
+232 scanDepth += 1;
+233 analyze(d, engine);
+234 scanDepth -= 1;
+235 }
+236 }
+237 }
+238 Collections.sort(engine.getDependencies());
+239 }
+240
+241
+242
+243
+244
+245
+246
+247 private File getNextTempDirectory() throws AnalysisException {
+248 dirCount += 1;
+249 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+250
+251 if (directory.exists()) {
+252 return getNextTempDirectory();
+253 }
+254 if (!directory.mkdirs()) {
+255 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+256 throw new AnalysisException (msg);
+257 }
+258 return directory;
+259 }
+260
+261
+262
+263
+264
+265
+266
+267
+268
+269 private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
+270 if (archive == null || destination == null ) {
+271 return ;
+272 }
+273
+274 FileInputStream fis = null ;
275 try {
-276 if (ZIPPABLES.contains(archiveExt)) {
-277 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
-278 } else if ("tar" .equals(archiveExt)) {
-279 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
-280 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
-281 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
-282 final String uncompressedExt = FileUtils.getFileExtension(uncompressedName).toLowerCase();
-283 if (engine.supportsExtension(uncompressedExt)) {
-284 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName));
-285 }
-286 }
-287 } catch (ArchiveExtractionException ex) {
-288 final String msg = String.format("Exception extracting archive '%s'." , archive.getName());
-289 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.WARNING, msg);
-290 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
-291 } catch (IOException ex) {
-292 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
-293 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.WARNING, msg);
-294 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
-295 } finally {
-296 try {
-297 fis.close();
-298 } catch (IOException ex) {
-299 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-300 }
-301 }
-302 }
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312 private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
-313 ArchiveEntry entry;
-314 try {
-315 while ((entry = input.getNextEntry()) != null ) {
-316 if (entry.isDirectory()) {
-317 final File d = new File(destination, entry.getName());
-318 if (!d.exists()) {
-319 if (!d.mkdirs()) {
-320 final String msg = String.format("Unable to create directory '%s'." , d.getAbsolutePath());
-321 throw new AnalysisException (msg);
-322 }
-323 }
-324 } else {
-325 final File file = new File(destination, entry.getName());
-326 final String ext = FileUtils.getFileExtension(file.getName());
-327 if (engine.supportsExtension(ext)) {
-328 BufferedOutputStream bos = null ;
-329 FileOutputStream fos;
-330 try {
-331 final File parent = file.getParentFile();
-332 if (!parent.isDirectory()) {
-333 if (!parent.mkdirs()) {
-334 final String msg = String.format("Unable to build directory '%s'." , parent.getAbsolutePath());
-335 throw new AnalysisException (msg);
-336 }
-337 }
-338 fos = new FileOutputStream(file);
-339 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
-340 int count;
-341 final byte data[] = new byte[BUFFER_SIZE];
-342 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
-343 bos.write(data, 0, count);
+276 fis = new FileInputStream(archive);
+277 } catch (FileNotFoundException ex) {
+278 LOGGER.log(Level.FINE, null , ex);
+279 throw new AnalysisException ("Archive file was not found." , ex);
+280 }
+281 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
+282 try {
+283 if (ZIPPABLES.contains(archiveExt)) {
+284 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+285 } else if ("tar" .equals(archiveExt)) {
+286 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+287 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
+288 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
+289 final String uncompressedExt = FileUtils.getFileExtension(uncompressedName).toLowerCase();
+290 if (engine.supportsExtension(uncompressedExt)) {
+291 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName));
+292 }
+293 }
+294 } catch (ArchiveExtractionException ex) {
+295 final String msg = String.format("Exception extracting archive '%s'." , archive.getName());
+296 LOGGER.log(Level.WARNING, msg);
+297 LOGGER.log(Level.FINE, null , ex);
+298 } catch (IOException ex) {
+299 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
+300 LOGGER.log(Level.WARNING, msg);
+301 LOGGER.log(Level.FINE, null , ex);
+302 } finally {
+303 try {
+304 fis.close();
+305 } catch (IOException ex) {
+306 LOGGER.log(Level.FINEST, null , ex);
+307 }
+308 }
+309 }
+310
+311
+312
+313
+314
+315
+316
+317
+318
+319 private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
+320 ArchiveEntry entry;
+321 try {
+322 while ((entry = input.getNextEntry()) != null ) {
+323 if (entry.isDirectory()) {
+324 final File d = new File(destination, entry.getName());
+325 if (!d.exists()) {
+326 if (!d.mkdirs()) {
+327 final String msg = String.format("Unable to create directory '%s'." , d.getAbsolutePath());
+328 throw new AnalysisException (msg);
+329 }
+330 }
+331 } else {
+332 final File file = new File(destination, entry.getName());
+333 final String ext = FileUtils.getFileExtension(file.getName());
+334 if (engine.supportsExtension(ext)) {
+335 BufferedOutputStream bos = null ;
+336 FileOutputStream fos;
+337 try {
+338 final File parent = file.getParentFile();
+339 if (!parent.isDirectory()) {
+340 if (!parent.mkdirs()) {
+341 final String msg = String.format("Unable to build directory '%s'." , parent.getAbsolutePath());
+342 throw new AnalysisException (msg);
+343 }
344 }
-345 bos.flush();
-346 } catch (FileNotFoundException ex) {
-347 Logger.getLogger(ArchiveAnalyzer.class
-348 .getName()).log(Level.FINE, null , ex);
-349 final String msg = String.format("Unable to find file '%s'." , file.getName());
-350 throw new AnalysisException (msg, ex);
-351 } catch (IOException ex) {
-352 Logger.getLogger(ArchiveAnalyzer.class
-353 .getName()).log(Level.FINE, null , ex);
-354 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
-355 throw new AnalysisException (msg, ex);
-356 } finally {
-357 if (bos != null ) {
-358 try {
-359 bos.close();
-360 } catch (IOException ex) {
-361 Logger.getLogger(ArchiveAnalyzer.class
-362 .getName()).log(Level.FINEST, null , ex);
-363 }
-364 }
-365 }
-366 }
-367 }
-368 }
-369 } catch (IOException ex) {
-370 throw new ArchiveExtractionException (ex);
-371 } catch (Throwable ex) {
-372 throw new ArchiveExtractionException (ex);
-373 } finally {
-374 if (input != null ) {
-375 try {
-376 input.close();
-377 } catch (IOException ex) {
-378 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-379 }
-380 }
-381 }
-382 }
-383
-384
-385
-386
-387
-388
-389
-390
-391 private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
-392 FileOutputStream out = null ;
-393 try {
-394 out = new FileOutputStream(outputFile);
-395 final byte[] buffer = new byte[BUFFER_SIZE];
-396 int n = 0;
-397 while (-1 != (n = inputStream.read(buffer))) {
-398 out.write(buffer, 0, n);
-399 }
-400 } catch (FileNotFoundException ex) {
-401 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
-402 throw new ArchiveExtractionException (ex);
-403 } catch (IOException ex) {
-404 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINE, null , ex);
-405 throw new ArchiveExtractionException (ex);
-406 } finally {
-407 if (out != null ) {
-408 try {
-409 out.close();
-410 } catch (IOException ex) {
-411 Logger.getLogger(ArchiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-412 }
-413 }
-414 }
-415 }
-416 }
+345 fos = new FileOutputStream(file);
+346 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+347 int count;
+348 final byte data[] = new byte[BUFFER_SIZE];
+349 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
+350 bos.write(data, 0, count);
+351 }
+352 bos.flush();
+353 } catch (FileNotFoundException ex) {
+354 Logger.getLogger(ArchiveAnalyzer.class
+355 .getName()).log(Level.FINE, null , ex);
+356 final String msg = String.format("Unable to find file '%s'." , file.getName());
+357 throw new AnalysisException (msg, ex);
+358 } catch (IOException ex) {
+359 Logger.getLogger(ArchiveAnalyzer.class
+360 .getName()).log(Level.FINE, null , ex);
+361 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+362 throw new AnalysisException (msg, ex);
+363 } finally {
+364 if (bos != null ) {
+365 try {
+366 bos.close();
+367 } catch (IOException ex) {
+368 Logger.getLogger(ArchiveAnalyzer.class
+369 .getName()).log(Level.FINEST, null , ex);
+370 }
+371 }
+372 }
+373 }
+374 }
+375 }
+376 } catch (IOException ex) {
+377 throw new ArchiveExtractionException (ex);
+378 } catch (Throwable ex) {
+379 throw new ArchiveExtractionException (ex);
+380 } finally {
+381 if (input != null ) {
+382 try {
+383 input.close();
+384 } catch (IOException ex) {
+385 LOGGER.log(Level.FINEST, null , ex);
+386 }
+387 }
+388 }
+389 }
+390
+391
+392
+393
+394
+395
+396
+397
+398 private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
+399 FileOutputStream out = null ;
+400 try {
+401 out = new FileOutputStream(outputFile);
+402 final byte[] buffer = new byte[BUFFER_SIZE];
+403 int n = 0;
+404 while (-1 != (n = inputStream.read(buffer))) {
+405 out.write(buffer, 0, n);
+406 }
+407 } catch (FileNotFoundException ex) {
+408 LOGGER.log(Level.FINE, null , ex);
+409 throw new ArchiveExtractionException (ex);
+410 } catch (IOException ex) {
+411 LOGGER.log(Level.FINE, null , ex);
+412 throw new ArchiveExtractionException (ex);
+413 } finally {
+414 if (out != null ) {
+415 try {
+416 out.close();
+417 } catch (IOException ex) {
+418 LOGGER.log(Level.FINEST, null , ex);
+419 }
+420 }
+421 }
+422 }
+423 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import java.io.File;
-21 import java.io.FileOutputStream;
-22 import java.io.IOException;
-23 import java.io.InputStream;
-24 import java.util.ArrayList;
-25 import java.util.List;
-26 import java.util.Set;
-27 import java.util.logging.Level;
-28 import java.util.logging.Logger;
-29 import javax.xml.parsers.DocumentBuilder;
-30 import javax.xml.parsers.DocumentBuilderFactory;
-31 import javax.xml.xpath.XPath;
-32 import javax.xml.xpath.XPathExpressionException;
-33 import javax.xml.xpath.XPathFactory;
-34 import org.owasp.dependencycheck.Engine;
-35 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-36 import org.owasp.dependencycheck.dependency.Confidence;
-37 import org.owasp.dependencycheck.dependency.Dependency;
-38 import org.owasp.dependencycheck.dependency.Evidence;
-39 import org.owasp.dependencycheck.utils.Settings;
-40 import org.w3c.dom.Document;
-41 import org.xml.sax.SAXException;
-42
-43
-44
-45
-46
+20 import java.io.BufferedReader;
+21 import java.io.File;
+22 import java.io.FileOutputStream;
+23 import java.io.IOException;
+24 import java.io.InputStream;
+25 import java.io.InputStreamReader;
+26 import java.util.ArrayList;
+27 import java.util.List;
+28 import java.util.Set;
+29 import java.util.logging.Level;
+30 import java.util.logging.Logger;
+31 import javax.xml.parsers.DocumentBuilder;
+32 import javax.xml.parsers.DocumentBuilderFactory;
+33 import javax.xml.xpath.XPath;
+34 import javax.xml.xpath.XPathExpressionException;
+35 import javax.xml.xpath.XPathFactory;
+36 import org.owasp.dependencycheck.Engine;
+37 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+38 import org.owasp.dependencycheck.dependency.Confidence;
+39 import org.owasp.dependencycheck.dependency.Dependency;
+40 import org.owasp.dependencycheck.dependency.Evidence;
+41 import org.owasp.dependencycheck.utils.Settings;
+42 import org.w3c.dom.Document;
+43 import org.xml.sax.SAXException;
+44
+45
+46
47
-48
-49 public class AssemblyAnalyzer extends AbstractAnalyzer {
-50
-51
-52
-53
-54 private static final String ANALYZER_NAME = "Assembly Analyzer" ;
-55
-56
-57
-58 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-59
-60
-61
-62 private static final Set<String> SUPORTED_EXTENSIONS = newHashSet("dll" , "exe" );
-63
-64
-65
-66 private File grokAssemblyExe;
-67
-68
-69
-70 private DocumentBuilder builder;
-71
-72
-73
-74 private static final Logger LOG = Logger.getLogger(AbstractAnalyzer.class .getName());
-75
-76
-77
-78
-79
-80
-81 private List<String> buildArgumentList() {
-82
-83 final List<String> args = new ArrayList<String>();
-84 if (!"\\" .equals(System.getProperty("file.separator" ))) {
-85 if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null ) {
-86 args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
-87 } else {
-88 args.add("mono" );
-89 }
-90 }
-91 args.add(grokAssemblyExe.getPath());
-92
-93 return args;
-94 }
-95
-96
-97
-98
-99
-100
-101
-102
-103 @Override
-104 public void analyze(Dependency dependency, Engine engine)
-105 throws AnalysisException {
-106 if (grokAssemblyExe == null ) {
-107 LOG.warning("GrokAssembly didn't get deployed" );
-108 return ;
-109 }
-110
-111 final List<String> args = buildArgumentList();
-112 args.add(dependency.getActualFilePath());
-113 final ProcessBuilder pb = new ProcessBuilder(args);
-114 try {
-115 final Process proc = pb.start();
-116 final Document doc = builder.parse(proc.getInputStream());
-117 final XPath xpath = XPathFactory.newInstance().newXPath();
-118
-119
-120 final String error = xpath.evaluate("/assembly/error" , doc);
-121 if (error != null && !"" .equals(error)) {
-122 throw new AnalysisException (error);
-123 }
-124
-125 final String version = xpath.evaluate("/assembly/version" , doc);
-126 if (version != null ) {
-127 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
-128 version, Confidence.HIGHEST));
-129 }
-130
-131 final String vendor = xpath.evaluate("/assembly/company" , doc);
-132 if (vendor != null ) {
-133 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
-134 vendor, Confidence.HIGH));
-135 }
-136
-137 final String product = xpath.evaluate("/assembly/product" , doc);
-138 if (product != null ) {
-139 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
-140 product, Confidence.HIGH));
-141 }
-142
-143 } catch (IOException ioe) {
-144 throw new AnalysisException (ioe);
-145 } catch (SAXException saxe) {
-146 throw new AnalysisException ("Couldn't parse GrokAssembly result" , saxe);
-147 } catch (XPathExpressionException xpe) {
-148
-149 throw new AnalysisException (xpe);
-150 }
-151 }
+48
+49
+50
+51 public class AssemblyAnalyzer extends AbstractFileTypeAnalyzer {
+52
+53
+54
+55
+56 private static final String ANALYZER_NAME = "Assembly Analyzer" ;
+57
+58
+59
+60 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+61
+62
+63
+64 private static final Set<String> SUPORTED_EXTENSIONS = newHashSet("dll" , "exe" );
+65
+66
+67
+68 private File grokAssemblyExe = null ;
+69
+70
+71
+72 private DocumentBuilder builder;
+73
+74
+75
+76 private static final Logger LOG = Logger.getLogger(AssemblyAnalyzer.class .getName());
+77
+78
+79
+80
+81
+82
+83 private List<String> buildArgumentList() {
+84
+85 final List<String> args = new ArrayList<String>();
+86 if (!"\\" .equals(System.getProperty("file.separator" ))) {
+87 if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null ) {
+88 args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
+89 } else {
+90 args.add("mono" );
+91 }
+92 }
+93 args.add(grokAssemblyExe.getPath());
+94
+95 return args;
+96 }
+97
+98
+99
+100
+101
+102
+103
+104
+105 @Override
+106 public void analyzeFileType(Dependency dependency, Engine engine)
+107 throws AnalysisException {
+108 if (grokAssemblyExe == null ) {
+109 LOG.warning("GrokAssembly didn't get deployed" );
+110 return ;
+111 }
+112
+113 final List<String> args = buildArgumentList();
+114 args.add(dependency.getActualFilePath());
+115 final ProcessBuilder pb = new ProcessBuilder(args);
+116 BufferedReader rdr = null ;
+117 try {
+118 final Process proc = pb.start();
+119
+120 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream()));
+121 String line = null ;
+122 while (rdr.ready() && (line = rdr.readLine()) != null ) {
+123 LOG.log(Level.WARNING, "Error from GrokAssembly: {0}" , line);
+124 }
+125 int rc = 0;
+126 final Document doc = builder.parse(proc.getInputStream());
+127 final XPath xpath = XPathFactory.newInstance().newXPath();
+128
+129
+130 final String error = xpath.evaluate("/assembly/error" , doc);
+131 if (error != null && !"" .equals(error)) {
+132 throw new AnalysisException (error);
+133 }
+134
+135 final String version = xpath.evaluate("/assembly/version" , doc);
+136 if (version != null ) {
+137 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
+138 version, Confidence.HIGHEST));
+139 }
+140
+141 final String vendor = xpath.evaluate("/assembly/company" , doc);
+142 if (vendor != null ) {
+143 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
+144 vendor, Confidence.HIGH));
+145 }
+146
+147 final String product = xpath.evaluate("/assembly/product" , doc);
+148 if (product != null ) {
+149 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
+150 product, Confidence.HIGH));
+151 }
152
-153
-154
-155
-156
-157
-158 @Override
-159 public void initialize() throws Exception {
-160 super .initialize();
-161 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
-162 FileOutputStream fos = null ;
-163 InputStream is = null ;
-164 try {
-165 fos = new FileOutputStream(tempFile);
-166 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
-167 final byte[] buff = new byte[4096];
-168 int bread = -1;
-169 while ((bread = is.read(buff)) >= 0) {
-170 fos.write(buff, 0, bread);
-171 }
-172 grokAssemblyExe = tempFile;
-173
-174 grokAssemblyExe.deleteOnExit();
-175 LOG.log(Level.FINE, "Extracted GrokAssembly.exe to {0}" , grokAssemblyExe.getPath());
-176 } catch (IOException ioe) {
-177 LOG.log(Level.WARNING, "Could not extract GrokAssembly.exe: {0}" , ioe.getMessage());
-178 throw new AnalysisException ("Could not extract GrokAssembly.exe" , ioe);
-179 } finally {
-180 if (fos != null ) {
-181 try {
-182 fos.close();
-183 } catch (Throwable e) {
-184 LOG.fine("Error closing output stream" );
-185 }
-186 }
-187 if (is != null ) {
-188 try {
-189 is.close();
-190 } catch (Throwable e) {
-191 LOG.fine("Error closing input stream" );
-192 }
-193 }
-194 }
-195
-196
-197 final List<String> args = buildArgumentList();
-198 try {
-199 final Process p = new ProcessBuilder(args).start();
-200 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
-201 final XPath xpath = XPathFactory.newInstance().newXPath();
-202 final String error = xpath.evaluate("/assembly/error" , doc);
-203 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
-204 LOG.warning("An error occured with the .NET AssemblyAnalyzer, please see the log for more details." );
-205 LOG.fine("GrokAssembly.exe is not working properly" );
-206 grokAssemblyExe = null ;
-207 throw new AnalysisException ("Could not execute .NET AssemblyAnalyzer" );
-208 }
-209 } catch (Throwable e) {
-210 LOG.warning("An error occured with the .NET AssemblyAnalyzer; "
-211 + "this can be ignored unless you are scanning .NET dlls. Please see the log for more details." );
-212 LOG.log(Level.FINE, "Could not execute GrokAssembly {0}" , e.getMessage());
-213 throw new AnalysisException ("An error occured with the .NET AssemblyAnalyzer" , e);
-214 }
-215
-216 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
-217 }
-218
-219 @Override
-220 public void close() throws Exception {
-221 super .close();
-222 try {
-223 grokAssemblyExe.delete();
-224 } catch (SecurityException se) {
-225 LOG.fine("Can't delete temporary GrokAssembly.exe" );
-226 }
-227 }
-228
-229
-230
-231
-232
-233
-234 @Override
-235 public Set<String> getSupportedExtensions() {
-236 return SUPORTED_EXTENSIONS;
-237 }
-238
-239
-240
-241
-242
-243
-244 @Override
-245 public String getName() {
-246 return ANALYZER_NAME;
-247 }
-248
-249
-250
-251
-252
-253
-254
-255 @Override
-256 public boolean supportsExtension(String extension) {
-257 return SUPORTED_EXTENSIONS.contains(extension);
-258 }
-259
-260
-261
-262
-263
-264
-265 @Override
-266 public AnalysisPhase getAnalysisPhase() {
-267 return ANALYSIS_PHASE;
-268 }
-269 }
+153 try {
+154 rc = proc.waitFor();
+155 } catch (InterruptedException ie) {
+156 return ;
+157 }
+158 if (rc == 3) {
+159 LOG.log(Level.INFO, "{0} is not a valid assembly" , dependency.getActualFilePath());
+160 return ;
+161 } else if (rc != 0) {
+162 LOG.log(Level.WARNING, "Return code {0} from GrokAssembly" , rc);
+163 }
+164
+165 } catch (IOException ioe) {
+166 throw new AnalysisException (ioe);
+167 } catch (SAXException saxe) {
+168 throw new AnalysisException ("Couldn't parse GrokAssembly result" , saxe);
+169 } catch (XPathExpressionException xpe) {
+170
+171 throw new AnalysisException (xpe);
+172 } finally {
+173 if (rdr != null ) {
+174 try {
+175 rdr.close();
+176 } catch (IOException ex) {
+177 Logger.getLogger(AssemblyAnalyzer.class .getName()).log(Level.FINEST, "ignore" , ex);
+178 }
+179 }
+180 }
+181 }
+182
+183
+184
+185
+186
+187
+188 @Override
+189 public void initializeFileTypeAnalyzer() throws Exception {
+190 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
+191 FileOutputStream fos = null ;
+192 InputStream is = null ;
+193 try {
+194 fos = new FileOutputStream(tempFile);
+195 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
+196 final byte[] buff = new byte[4096];
+197 int bread = -1;
+198 while ((bread = is.read(buff)) >= 0) {
+199 fos.write(buff, 0, bread);
+200 }
+201 grokAssemblyExe = tempFile;
+202
+203 grokAssemblyExe.deleteOnExit();
+204 LOG.log(Level.FINE, "Extracted GrokAssembly.exe to {0}" , grokAssemblyExe.getPath());
+205 } catch (IOException ioe) {
+206 LOG.log(Level.WARNING, "Could not extract GrokAssembly.exe: {0}" , ioe.getMessage());
+207 throw new AnalysisException ("Could not extract GrokAssembly.exe" , ioe);
+208 } finally {
+209 if (fos != null ) {
+210 try {
+211 fos.close();
+212 } catch (Throwable e) {
+213 LOG.fine("Error closing output stream" );
+214 }
+215 }
+216 if (is != null ) {
+217 try {
+218 is.close();
+219 } catch (Throwable e) {
+220 LOG.fine("Error closing input stream" );
+221 }
+222 }
+223 }
+224
+225
+226 final List<String> args = buildArgumentList();
+227 BufferedReader rdr = null ;
+228 try {
+229 final ProcessBuilder pb = new ProcessBuilder(args);
+230 final Process p = pb.start();
+231
+232 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream()));
+233 String line;
+234 while (rdr.ready() && (line = rdr.readLine()) != null ) {
+235
+236 }
+237 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
+238 final XPath xpath = XPathFactory.newInstance().newXPath();
+239 final String error = xpath.evaluate("/assembly/error" , doc);
+240 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
+241 LOG.warning("An error occured with the .NET AssemblyAnalyzer, please see the log for more details." );
+242 LOG.fine("GrokAssembly.exe is not working properly" );
+243 grokAssemblyExe = null ;
+244 throw new AnalysisException ("Could not execute .NET AssemblyAnalyzer" );
+245 }
+246 } catch (Throwable e) {
+247 LOG.warning("An error occured with the .NET AssemblyAnalyzer; "
+248 + "this can be ignored unless you are scanning .NET dlls. Please see the log for more details." );
+249 LOG.log(Level.FINE, "Could not execute GrokAssembly {0}" , e.getMessage());
+250 throw new AnalysisException ("An error occured with the .NET AssemblyAnalyzer" , e);
+251 } finally {
+252 if (rdr != null ) {
+253 try {
+254 rdr.close();
+255 } catch (IOException ex) {
+256 Logger.getLogger(AssemblyAnalyzer.class .getName()).log(Level.FINEST, "ignore" , ex);
+257 }
+258 }
+259 }
+260
+261 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+262 }
+263
+264 @Override
+265 public void close() throws Exception {
+266 super .close();
+267 try {
+268 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
+269 grokAssemblyExe.deleteOnExit();
+270 }
+271 } catch (SecurityException se) {
+272 LOG.fine("Can't delete temporary GrokAssembly.exe" );
+273 }
+274 }
+275
+276
+277
+278
+279
+280
+281 @Override
+282 public Set<String> getSupportedExtensions() {
+283 return SUPORTED_EXTENSIONS;
+284 }
+285
+286
+287
+288
+289
+290
+291 @Override
+292 public String getName() {
+293 return ANALYZER_NAME;
+294 }
+295
+296
+297
+298
+299
+300
+301 @Override
+302 public AnalysisPhase getAnalysisPhase() {
+303 return ANALYSIS_PHASE;
+304 }
+305
+306
+307
+308
+309
+310
+311 @Override
+312 protected String getAnalyzerEnabledSettingKey() {
+313 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
+314 }
+315 }
88 private CveDB cve;
89
90
-91
+91
92
-93
-94
-95
-96
-97 public void open() throws IOException, DatabaseException {
-98 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Opening the CVE Database" );
-99 cve = new CveDB ();
-100 cve.open();
-101 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Creating the Lucene CPE Index" );
-102 cpe = CpeMemoryIndex.getInstance();
-103 try {
-104 cpe.open(cve);
-105 } catch (IndexException ex) {
-106 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "IndexException" , ex);
-107 throw new DatabaseException (ex);
-108 }
-109 }
-110
-111
-112
-113
-114 @Override
-115 public void close() {
-116 if (cpe != null ) {
-117 cpe.close();
-118 }
-119 if (cve != null ) {
-120 cve.close();
-121 }
-122 }
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133 protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
-134 Confidence confidence = Confidence.HIGHEST;
-135
-136 String vendors = addEvidenceWithoutDuplicateTerms("" , dependency.getVendorEvidence(), confidence);
-137 String products = addEvidenceWithoutDuplicateTerms("" , dependency.getProductEvidence(), confidence);
-138
-139
-140 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
-141
-142 int ctr = 0;
-143 do {
-144 if (!vendors.isEmpty() && !products.isEmpty()) {
-145 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
-146 dependency.getVendorEvidence().getWeighting());
-147
-148 for (IndexEntry e : entries) {
-149 if (verifyEntry(e, dependency)) {
-150 final String vendor = e.getVendor();
-151 final String product = e.getProduct();
-152 determineIdentifiers(dependency, vendor, product);
-153 }
-154 }
-155 }
-156 confidence = reduceConfidence(confidence);
-157 if (dependency.getVendorEvidence().contains(confidence)) {
-158 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
-159 }
-160 if (dependency.getProductEvidence().contains(confidence)) {
-161 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
-162 }
-163
-164
-165 if (dependency.getVersionEvidence().contains(confidence)) {
-166 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
-167 }
-168 } while ((++ctr) < 4);
-169 }
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181 private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
-182 final String txt = (text == null ) ? "" : text;
-183 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
-184 sb.append(' ').append(txt).append(' ');
-185 for (Evidence e : ec.iterator(confidenceFilter)) {
-186 String value = e.getValue();
-187
-188
-189
-190 if (value.startsWith("http://" )) {
-191 value = value.substring(7).replaceAll("\\." , " " );
+93
+94
+95 @Override
+96 public String getName() {
+97 return "CPE Analyzer" ;
+98 }
+99
+100
+101
+102
+103
+104
+105 @Override
+106 public AnalysisPhase getAnalysisPhase() {
+107 return AnalysisPhase.IDENTIFIER_ANALYSIS;
+108 }
+109
+110
+111
+112
+113
+114
+115 @Override
+116 public void initialize() throws Exception {
+117 this .open();
+118 }
+119
+120
+121
+122
+123
+124
+125
+126
+127 public void open() throws IOException, DatabaseException {
+128 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Opening the CVE Database" );
+129 cve = new CveDB ();
+130 cve.open();
+131 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "Creating the Lucene CPE Index" );
+132 cpe = CpeMemoryIndex.getInstance();
+133 try {
+134 cpe.open(cve);
+135 } catch (IndexException ex) {
+136 Logger.getLogger(CPEAnalyzer.class .getName()).log(Level.FINE, "IndexException" , ex);
+137 throw new DatabaseException (ex);
+138 }
+139 }
+140
+141
+142
+143
+144 @Override
+145 public void close() {
+146 if (cpe != null ) {
+147 cpe.close();
+148 }
+149 if (cve != null ) {
+150 cve.close();
+151 }
+152 }
+153
+154
+155
+156
+157
+158
+159
+160
+161
+162
+163 protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
+164 Confidence confidence = Confidence.HIGHEST;
+165
+166 String vendors = addEvidenceWithoutDuplicateTerms("" , dependency.getVendorEvidence(), confidence);
+167 String products = addEvidenceWithoutDuplicateTerms("" , dependency.getProductEvidence(), confidence);
+168
+169
+170 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
+171
+172 int ctr = 0;
+173 do {
+174 if (!vendors.isEmpty() && !products.isEmpty()) {
+175 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
+176 dependency.getVendorEvidence().getWeighting());
+177
+178 for (IndexEntry e : entries) {
+179 if (verifyEntry(e, dependency)) {
+180 final String vendor = e.getVendor();
+181 final String product = e.getProduct();
+182 determineIdentifiers(dependency, vendor, product);
+183 }
+184 }
+185 }
+186 confidence = reduceConfidence(confidence);
+187 if (dependency.getVendorEvidence().contains(confidence)) {
+188 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
+189 }
+190 if (dependency.getProductEvidence().contains(confidence)) {
+191 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
192 }
-193 if (value.startsWith("https://" )) {
-194 value = value.substring(8).replaceAll("\\." , " " );
-195 }
-196 if (sb.indexOf(" " + value + " " ) < 0) {
-197 sb.append(value).append(' ');
-198 }
-199 }
-200 return sb.toString().trim();
-201 }
-202
-203
-204
+193
+194
+195 if (dependency.getVersionEvidence().contains(confidence)) {
+196 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
+197 }
+198 } while ((++ctr) < 4);
+199 }
+200
+201
+202
+203
+204
205
-206
-207
-208
-209 private Confidence reduceConfidence(final Confidence c) {
-210 if (c == Confidence.HIGHEST) {
-211 return Confidence.HIGH;
-212 } else if (c == Confidence.HIGH) {
-213 return Confidence.MEDIUM;
-214 } else {
-215 return Confidence.LOW;
-216 }
-217 }
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237 protected List<IndexEntry> searchCPE(String vendor, String product,
-238 Set<String> vendorWeightings, Set<String> productWeightings)
-239 throws CorruptIndexException, IOException, ParseException {
-240 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
-241
-242 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
-243 if (searchString == null ) {
-244 return ret;
-245 }
-246
-247 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
-248 for (ScoreDoc d : docs.scoreDocs) {
-249 if (d.score >= 0.08) {
-250 final Document doc = cpe.getDocument(d.doc);
-251 final IndexEntry entry = new IndexEntry ();
-252 entry.setVendor(doc.get(Fields.VENDOR));
-253 entry.setProduct(doc.get(Fields.PRODUCT));
-254
-255
-256
-257
-258
-259
-260
-261 entry.setSearchScore(d.score);
-262 if (!ret.contains(entry)) {
-263 ret.add(entry);
-264 }
-265 }
-266 }
-267 return ret;
-268 }
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284 protected String buildSearch(String vendor, String product,
-285 Set<String> vendorWeighting, Set<String> productWeightings) {
-286 final String v = vendor;
-287 final String p = product;
-288 final StringBuilder sb = new StringBuilder(v.length() + p.length()
-289 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
-290
-291 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
-292 return null ;
-293 }
-294 sb.append(" AND " );
-295 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
-296 return null ;
-297 }
-298 return sb.toString();
-299 }
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312 private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
-313 sb.append(" " ).append(field).append(":( " );
-314
-315 final String cleanText = cleanseText(searchText);
-316
-317 if ("" .equals(cleanText)) {
-318 return false;
-319 }
+206
+207
+208
+209
+210
+211 private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
+212 final String txt = (text == null ) ? "" : text;
+213 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
+214 sb.append(' ').append(txt).append(' ');
+215 for (Evidence e : ec.iterator(confidenceFilter)) {
+216 String value = e.getValue();
+217
+218
+219
+220 if (value.startsWith("http://" )) {
+221 value = value.substring(7).replaceAll("\\." , " " );
+222 }
+223 if (value.startsWith("https://" )) {
+224 value = value.substring(8).replaceAll("\\." , " " );
+225 }
+226 if (sb.indexOf(" " + value + " " ) < 0) {
+227 sb.append(value).append(' ');
+228 }
+229 }
+230 return sb.toString().trim();
+231 }
+232
+233
+234
+235
+236
+237
+238
+239 private Confidence reduceConfidence(final Confidence c) {
+240 if (c == Confidence.HIGHEST) {
+241 return Confidence.HIGH;
+242 } else if (c == Confidence.HIGH) {
+243 return Confidence.MEDIUM;
+244 } else {
+245 return Confidence.LOW;
+246 }
+247 }
+248
+249
+250
+251
+252
+253
+254
+255
+256
+257
+258
+259
+260
+261
+262
+263
+264
+265
+266
+267 protected List<IndexEntry> searchCPE(String vendor, String product,
+268 Set<String> vendorWeightings, Set<String> productWeightings)
+269 throws CorruptIndexException, IOException, ParseException {
+270 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
+271
+272 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
+273 if (searchString == null ) {
+274 return ret;
+275 }
+276
+277 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
+278 for (ScoreDoc d : docs.scoreDocs) {
+279 if (d.score >= 0.08) {
+280 final Document doc = cpe.getDocument(d.doc);
+281 final IndexEntry entry = new IndexEntry ();
+282 entry.setVendor(doc.get(Fields.VENDOR));
+283 entry.setProduct(doc.get(Fields.PRODUCT));
+284
+285
+286
+287
+288
+289
+290
+291 entry.setSearchScore(d.score);
+292 if (!ret.contains(entry)) {
+293 ret.add(entry);
+294 }
+295 }
+296 }
+297 return ret;
+298 }
+299
+300
+301
+302
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313
+314 protected String buildSearch(String vendor, String product,
+315 Set<String> vendorWeighting, Set<String> productWeightings) {
+316 final String v = vendor;
+317 final String p = product;
+318 final StringBuilder sb = new StringBuilder(v.length() + p.length()
+319 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
320
-321 if (weightedText == null || weightedText.isEmpty()) {
-322 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
-323 } else {
-324 final StringTokenizer tokens = new StringTokenizer(cleanText);
-325 while (tokens.hasMoreElements()) {
-326 final String word = tokens.nextToken();
-327 String temp = null ;
-328 for (String weighted : weightedText) {
-329 final String weightedStr = cleanseText(weighted);
-330 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
-331 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
-332 if (!word.equalsIgnoreCase(weightedStr)) {
-333 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
-334 }
-335 }
-336 }
-337 if (temp == null ) {
-338 temp = LuceneUtils.escapeLuceneQuery(word);
-339 }
-340 sb.append(" " ).append(temp);
-341 }
-342 }
-343 sb.append(" ) " );
-344 return true ;
-345 }
+321 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
+322 return null ;
+323 }
+324 sb.append(" AND " );
+325 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
+326 return null ;
+327 }
+328 return sb.toString();
+329 }
+330
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340
+341
+342 private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
+343 sb.append(" " ).append(field).append(":( " );
+344
+345 final String cleanText = cleanseText(searchText);
346
-347
-348
-349
-350
-351
-352
-353 private String cleanseText(String text) {
-354 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
-355 }
-356
-357
-358
-359
-360
-361
-362
-363
-364 private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
-365 if (l == null || r == null ) {
-366 return false;
-367 }
-368
-369 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
-370 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
-371 return left.equalsIgnoreCase(right);
-372 }
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382 private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
-383 boolean isValid = false;
-384
-385 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
-386 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
-387
-388 isValid = true ;
-389 }
-390 return isValid;
-391 }
-392
-393
-394
-395
-396
-397
-398
-399
-400 private boolean collectionContainsString(EvidenceCollection ec, String text) {
-401
-402
-403
-404
-405
-406
-407
-408
-409
-410
-411
-412
-413 if (text == null ) {
-414 return false;
-415 }
-416 final String[] words = text.split("[\\s_-]" );
-417 final List<String> list = new ArrayList<String>();
-418 String tempWord = null ;
-419 for (String word : words) {
-420
-421
-422
-423
-424 if (tempWord != null ) {
-425 list.add(tempWord + word);
-426 tempWord = null ;
-427 } else if (word.length() <= 2) {
-428 tempWord = word;
-429 } else {
-430 list.add(word);
-431 }
-432 }
-433 if (tempWord != null && !list.isEmpty()) {
-434 final String tmp = list.get(list.size() - 1) + tempWord;
-435 list.add(tmp);
-436 }
-437 boolean contains = true ;
-438 for (String word : list) {
-439 contains &= ec.containsUsedString(word);
-440 }
-441 return contains;
-442 }
-443
-444
-445
-446
-447
-448
-449
-450
-451 @Override
-452 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-453 try {
-454 determineCPE(dependency);
-455 } catch (CorruptIndexException ex) {
-456 throw new AnalysisException ("CPE Index is corrupt." , ex);
-457 } catch (IOException ex) {
-458 throw new AnalysisException ("Failure opening the CPE Index." , ex);
-459 } catch (ParseException ex) {
-460 throw new AnalysisException ("Unable to parse the generated Lucene query for this dependency." , ex);
-461 }
-462 }
-463
-464
-465
-466
-467
-468
-469 @Override
-470 public Set<String> getSupportedExtensions() {
-471 return null ;
+347 if ("" .equals(cleanText)) {
+348 return false;
+349 }
+350
+351 if (weightedText == null || weightedText.isEmpty()) {
+352 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
+353 } else {
+354 final StringTokenizer tokens = new StringTokenizer(cleanText);
+355 while (tokens.hasMoreElements()) {
+356 final String word = tokens.nextToken();
+357 String temp = null ;
+358 for (String weighted : weightedText) {
+359 final String weightedStr = cleanseText(weighted);
+360 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
+361 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
+362 if (!word.equalsIgnoreCase(weightedStr)) {
+363 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
+364 }
+365 }
+366 }
+367 if (temp == null ) {
+368 temp = LuceneUtils.escapeLuceneQuery(word);
+369 }
+370 sb.append(" " ).append(temp);
+371 }
+372 }
+373 sb.append(" ) " );
+374 return true ;
+375 }
+376
+377
+378
+379
+380
+381
+382
+383 private String cleanseText(String text) {
+384 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
+385 }
+386
+387
+388
+389
+390
+391
+392
+393
+394 private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
+395 if (l == null || r == null ) {
+396 return false;
+397 }
+398
+399 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
+400 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
+401 return left.equalsIgnoreCase(right);
+402 }
+403
+404
+405
+406
+407
+408
+409
+410
+411
+412 private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
+413 boolean isValid = false;
+414
+415 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
+416 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
+417
+418 isValid = true ;
+419 }
+420 return isValid;
+421 }
+422
+423
+424
+425
+426
+427
+428
+429
+430 private boolean collectionContainsString(EvidenceCollection ec, String text) {
+431
+432
+433
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443 if (text == null ) {
+444 return false;
+445 }
+446 final String[] words = text.split("[\\s_-]" );
+447 final List<String> list = new ArrayList<String>();
+448 String tempWord = null ;
+449 for (String word : words) {
+450
+451
+452
+453
+454 if (tempWord != null ) {
+455 list.add(tempWord + word);
+456 tempWord = null ;
+457 } else if (word.length() <= 2) {
+458 tempWord = word;
+459 } else {
+460 list.add(word);
+461 }
+462 }
+463 if (tempWord != null && !list.isEmpty()) {
+464 final String tmp = list.get(list.size() - 1) + tempWord;
+465 list.add(tmp);
+466 }
+467 boolean contains = true ;
+468 for (String word : list) {
+469 contains &= ec.containsUsedString(word);
+470 }
+471 return contains;
472 }
473
474
-475
+475
476
-477
-478
-479 @Override
-480 public String getName() {
-481 return "CPE Analyzer" ;
-482 }
-483
-484
-485
-486
-487
-488
-489
-490 @Override
-491 public boolean supportsExtension(String extension) {
-492 return true ;
-493 }
-494
-495
-496
-497
-498
-499
-500 @Override
-501 public AnalysisPhase getAnalysisPhase() {
-502 return AnalysisPhase.IDENTIFIER_ANALYSIS;
-503 }
-504
-505
-506
-507
-508
-509
-510 @Override
-511 public void initialize() throws Exception {
-512 this .open();
-513 }
-514
-515
-516
-517
-518
-519
-520
-521
-522
-523
-524
-525 private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException {
-526 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
-527 DependencyVersion bestGuess = new DependencyVersion ("-" );
-528 Confidence bestGuessConf = null ;
-529 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
-530 for (Confidence conf : Confidence.values()) {
-531 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
-532 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
-533 if (evVer == null ) {
-534 continue ;
-535 }
-536 for (VulnerableSoftware vs : cpes) {
-537 DependencyVersion dbVer;
-538 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
-539 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
-540 } else {
-541 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
-542 }
-543 if (dbVer == null
-544 || evVer.equals(dbVer)) {
-545 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(vs.getName(), "UTF-8" ));
-546 final IdentifierMatch match = new IdentifierMatch ("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
-547 collected.add(match);
-548 } else {
-549
-550 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
-551 && evVer.matchesAtLeastThreeLevels(dbVer)) {
-552 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
-553 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
-554 bestGuess = dbVer;
-555 bestGuessConf = conf;
-556 }
-557 }
-558 }
-559 }
-560 }
-561 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
-562 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
-563 bestGuess = evVer;
-564 bestGuessConf = conf;
-565 }
-566 }
-567 }
-568 }
-569 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
-570 final String url = null ;
-571 if (bestGuessConf == null ) {
-572 bestGuessConf = Confidence.LOW;
-573 }
-574 final IdentifierMatch match = new IdentifierMatch ("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
-575 collected.add(match);
-576
-577 Collections.sort(collected);
-578 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
-579 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
-580 for (IdentifierMatch m : collected) {
-581 if (bestIdentifierQuality.equals(m.getConfidence())
-582 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
-583 final Identifier i = m.getIdentifier();
-584 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
-585 i.setConfidence(Confidence.LOW);
-586 } else {
-587 i.setConfidence(bestEvidenceQuality);
-588 }
-589 dependency.addIdentifier(i);
-590 }
-591 }
-592 }
-593
-594
-595
-596
-597 private enum IdentifierConfidence {
-598
-599
-600
+477
+478
+479
+480
+481 @Override
+482 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+483 try {
+484 determineCPE(dependency);
+485 } catch (CorruptIndexException ex) {
+486 throw new AnalysisException ("CPE Index is corrupt." , ex);
+487 } catch (IOException ex) {
+488 throw new AnalysisException ("Failure opening the CPE Index." , ex);
+489 } catch (ParseException ex) {
+490 throw new AnalysisException ("Unable to parse the generated Lucene query for this dependency." , ex);
+491 }
+492 }
+493
+494
+495
+496
+497
+498
+499
+500
+501
+502
+503
+504 private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException {
+505 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
+506 DependencyVersion bestGuess = new DependencyVersion ("-" );
+507 Confidence bestGuessConf = null ;
+508 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
+509 for (Confidence conf : Confidence.values()) {
+510 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
+511 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
+512 if (evVer == null ) {
+513 continue ;
+514 }
+515 for (VulnerableSoftware vs : cpes) {
+516 DependencyVersion dbVer;
+517 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
+518 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
+519 } else {
+520 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
+521 }
+522 if (dbVer == null
+523 || evVer.equals(dbVer)) {
+524 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(vs.getName(), "UTF-8" ));
+525 final IdentifierMatch match = new IdentifierMatch ("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
+526 collected.add(match);
+527 } else {
+528
+529 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
+530 && evVer.matchesAtLeastThreeLevels(dbVer)) {
+531 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+532 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
+533 bestGuess = dbVer;
+534 bestGuessConf = conf;
+535 }
+536 }
+537 }
+538 }
+539 }
+540 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+541 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
+542 bestGuess = evVer;
+543 bestGuessConf = conf;
+544 }
+545 }
+546 }
+547 }
+548 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
+549 final String url = null ;
+550 if (bestGuessConf == null ) {
+551 bestGuessConf = Confidence.LOW;
+552 }
+553 final IdentifierMatch match = new IdentifierMatch ("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
+554 collected.add(match);
+555
+556 Collections.sort(collected);
+557 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
+558 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
+559 for (IdentifierMatch m : collected) {
+560 if (bestIdentifierQuality.equals(m.getConfidence())
+561 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
+562 final Identifier i = m.getIdentifier();
+563 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
+564 i.setConfidence(Confidence.LOW);
+565 } else {
+566 i.setConfidence(bestEvidenceQuality);
+567 }
+568 dependency.addIdentifier(i);
+569 }
+570 }
+571 }
+572
+573
+574
+575
+576 private enum IdentifierConfidence {
+577
+578
+579
+580
+581 EXACT_MATCH,
+582
+583
+584
+585 BEST_GUESS
+586 }
+587
+588
+589
+590
+591 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
+592
+593
+594
+595
+596
+597
+598
+599
+600
601
-602 EXACT_MATCH,
-603
-604
-605
-606 BEST_GUESS
-607 }
-608
-609
-610
-611
-612 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
-613
-614
-615
-616
-617
-618
-619
-620
-621
-622
-623 IdentifierMatch (String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
-624 this .identifier = new Identifier (type, value, url);
-625 this .confidence = identifierConfidence;
-626 this .evidenceConfidence = evidenceConfidence;
-627 }
-628
-629
-630
-631
-632 private Confidence evidenceConfidence;
-633
-634
-635
-636
-637
-638
-639 public Confidence getEvidenceConfidence() {
-640 return evidenceConfidence;
-641 }
-642
-643
-644
-645
-646
-647
-648 public void setEvidenceConfidence(Confidence evidenceConfidence) {
-649 this .evidenceConfidence = evidenceConfidence;
-650 }
-651
-652
-653
-654 private IdentifierConfidence confidence;
-655
-656
-657
-658
-659
-660
-661 public IdentifierConfidence getConfidence() {
-662 return confidence;
-663 }
-664
-665
-666
-667
-668
-669
-670 public void setConfidence(IdentifierConfidence confidence) {
-671 this .confidence = confidence;
-672 }
-673
-674
-675
-676 private Identifier identifier;
-677
-678
-679
-680
-681
-682
-683 public Identifier getIdentifier() {
-684 return identifier;
-685 }
-686
-687
-688
-689
-690
-691
-692 public void setIdentifier(Identifier identifier) {
-693 this .identifier = identifier;
-694 }
-695
-696
-697
-698
-699
-700
-701
-702
-703 @Override
-704 public String toString() {
-705 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
-706 + ", confidence=" + confidence + ", identifier=" + identifier + '}';
-707 }
-708
-709
-710
-711
-712
-713
-714 @Override
-715 public int hashCode() {
-716 int hash = 5;
-717 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
-718 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
-719 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
-720 return hash;
-721 }
-722
-723
-724
-725
-726
-727
-728
-729 @Override
-730 public boolean equals(Object obj) {
-731 if (obj == null ) {
-732 return false;
-733 }
-734 if (getClass() != obj.getClass()) {
-735 return false;
-736 }
-737 final IdentifierMatch other = (IdentifierMatch) obj;
-738 if (this .evidenceConfidence != other.evidenceConfidence) {
-739 return false;
-740 }
-741 if (this .confidence != other.confidence) {
-742 return false;
-743 }
-744 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
-745 return false;
-746 }
-747 return true ;
-748 }
-749
-750
-751
-752
-753
-754
-755
-756
-757
-758 @Override
-759 public int compareTo(IdentifierMatch o) {
-760 int conf = this .confidence.compareTo(o.confidence);
-761 if (conf == 0) {
-762 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
-763 if (conf == 0) {
-764 conf = identifier.compareTo(o.identifier);
-765 }
-766 }
-767 return conf;
-768 }
-769 }
-770 }
+602 IdentifierMatch (String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
+603 this .identifier = new Identifier (type, value, url);
+604 this .confidence = identifierConfidence;
+605 this .evidenceConfidence = evidenceConfidence;
+606 }
+607
+608
+609
+610
+611 private Confidence evidenceConfidence;
+612
+613
+614
+615
+616
+617
+618 public Confidence getEvidenceConfidence() {
+619 return evidenceConfidence;
+620 }
+621
+622
+623
+624
+625
+626
+627 public void setEvidenceConfidence(Confidence evidenceConfidence) {
+628 this .evidenceConfidence = evidenceConfidence;
+629 }
+630
+631
+632
+633 private IdentifierConfidence confidence;
+634
+635
+636
+637
+638
+639
+640 public IdentifierConfidence getConfidence() {
+641 return confidence;
+642 }
+643
+644
+645
+646
+647
+648
+649 public void setConfidence(IdentifierConfidence confidence) {
+650 this .confidence = confidence;
+651 }
+652
+653
+654
+655 private Identifier identifier;
+656
+657
+658
+659
+660
+661
+662 public Identifier getIdentifier() {
+663 return identifier;
+664 }
+665
+666
+667
+668
+669
+670
+671 public void setIdentifier(Identifier identifier) {
+672 this .identifier = identifier;
+673 }
+674
+675
+676
+677
+678
+679
+680
+681
+682 @Override
+683 public String toString() {
+684 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
+685 + ", confidence=" + confidence + ", identifier=" + identifier + '}';
+686 }
+687
+688
+689
+690
+691
+692
+693 @Override
+694 public int hashCode() {
+695 int hash = 5;
+696 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
+697 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
+698 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
+699 return hash;
+700 }
+701
+702
+703
+704
+705
+706
+707
+708 @Override
+709 public boolean equals(Object obj) {
+710 if (obj == null ) {
+711 return false;
+712 }
+713 if (getClass() != obj.getClass()) {
+714 return false;
+715 }
+716 final IdentifierMatch other = (IdentifierMatch) obj;
+717 if (this .evidenceConfidence != other.evidenceConfidence) {
+718 return false;
+719 }
+720 if (this .confidence != other.confidence) {
+721 return false;
+722 }
+723 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
+724 return false;
+725 }
+726 return true ;
+727 }
+728
+729
+730
+731
+732
+733
+734
+735
+736
+737 @Override
+738 public int compareTo(IdentifierMatch o) {
+739 int conf = this .confidence.compareTo(o.confidence);
+740 if (conf == 0) {
+741 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
+742 if (conf == 0) {
+743 conf = identifier.compareTo(o.identifier);
+744 }
+745 }
+746 return conf;
+747 }
+748 }
+749 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-21 import java.io.File;
-22 import java.util.HashSet;
-23 import java.util.Iterator;
-24 import java.util.ListIterator;
-25 import java.util.Set;
-26 import java.util.logging.Level;
-27 import java.util.logging.Logger;
-28 import java.util.regex.Matcher;
-29 import java.util.regex.Pattern;
-30 import org.owasp.dependencycheck.Engine;
+20 import java.io.File;
+21 import java.util.HashSet;
+22 import java.util.Iterator;
+23 import java.util.ListIterator;
+24 import java.util.Set;
+25 import java.util.logging.Level;
+26 import java.util.logging.Logger;
+27 import java.util.regex.Matcher;
+28 import java.util.regex.Pattern;
+29 import org.owasp.dependencycheck.Engine;
+30 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
31 import org.owasp.dependencycheck.dependency.Dependency;
32 import org.owasp.dependencycheck.dependency.Identifier;
33 import org.owasp.dependencycheck.utils.DependencyVersion;
@@ -66,357 +66,334 @@
58
59
60
-61
+61
62
-63 private static final Set<String> EXTENSIONS = null ;
+63 private static final String ANALYZER_NAME = "Dependency Bundling Analyzer" ;
64
-65
+65
66
-67 private static final String ANALYZER_NAME = "Dependency Bundling Analyzer" ;
-68
-69
-70
-71 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
-72
-73
-74
-75
-76
-77
-78 public Set<String> getSupportedExtensions() {
-79 return EXTENSIONS;
-80 }
-81
-82
-83
-84
-85
-86
-87 public String getName() {
-88 return ANALYZER_NAME;
-89 }
-90
-91
-92
-93
-94
-95
-96
-97 public boolean supportsExtension(String extension) {
-98 return true ;
-99 }
-100
-101
-102
-103
-104
-105
-106 public AnalysisPhase getAnalysisPhase() {
-107 return ANALYSIS_PHASE;
-108 }
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119 @Override
-120 public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
-121 if (!analyzed) {
-122 analyzed = true ;
-123 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
-124 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
-125
-126 while (mainIterator.hasNext()) {
-127 final Dependency dependency = mainIterator.next();
-128 if (mainIterator.hasNext()) {
-129 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
-130 while (subIterator.hasNext()) {
-131 final Dependency nextDependency = subIterator.next();
-132 if (isShadedJar(dependency, nextDependency)) {
-133 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )) {
-134 dependenciesToRemove.add(dependency);
-135 } else {
-136 dependenciesToRemove.add(nextDependency);
-137 }
-138 } else if (hashesMatch(dependency, nextDependency)) {
-139 if (isCore(dependency, nextDependency)) {
-140 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
-141 } else {
-142 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
-143 }
-144 } else if (cpeIdentifiersMatch(dependency, nextDependency)
-145 && hasSameBasePath(dependency, nextDependency)
-146 && fileNameMatch(dependency, nextDependency)) {
-147
-148 if (isCore(dependency, nextDependency)) {
-149 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
-150 } else {
-151 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
-152 }
-153 }
-154 }
-155 }
-156 }
-157
-158
-159 for (Dependency d : dependenciesToRemove) {
-160 engine.getDependencies().remove(d);
-161 }
-162 }
-163 }
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174 private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
-175 dependency.addRelatedDependency(relatedDependency);
-176 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
-177 while (i.hasNext()) {
-178 dependency.addRelatedDependency(i.next());
-179 i.remove();
-180 }
-181 dependenciesToRemove.add(relatedDependency);
-182 }
-183
-184
-185
-186
-187
-188
-189
-190
-191 private String getBaseRepoPath(final String path) {
-192 int pos = path.indexOf("repository" + File.separator) + 11;
-193 if (pos < 0) {
-194 return path;
-195 }
-196 int tmp = path.indexOf(File.separator, pos);
-197 if (tmp <= 0) {
-198 return path;
-199 }
-200 if (tmp > 0) {
-201 pos = tmp + 1;
-202 }
-203 tmp = path.indexOf(File.separator, pos);
-204 if (tmp > 0) {
-205 pos = tmp + 1;
-206 }
-207 return path.substring(0, pos);
-208 }
-209
-210
-211
-212
-213
-214
-215
-216
-217 private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
-218 if (dependency1 == null || dependency1.getFileName() == null
-219 || dependency2 == null || dependency2.getFileName() == null ) {
-220 return false;
-221 }
-222 String fileName1 = dependency1.getFileName();
-223 String fileName2 = dependency2.getFileName();
-224
-225
-226
-227 final File one = new File(fileName1);
-228 final File two = new File(fileName2);
-229 final String oneParent = one.getParent();
-230 final String twoParent = two.getParent();
-231 if (oneParent != null ) {
-232 if (oneParent.equals(twoParent)) {
-233 fileName1 = one.getName();
-234 fileName2 = two.getName();
-235 } else {
-236 return false;
-237 }
-238 } else if (twoParent != null ) {
-239 return false;
-240 }
-241
-242
-243 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
-244 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
-245 if (version1 != null && version2 != null ) {
-246 if (!version1.equals(version2)) {
-247 return false;
-248 }
+67 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
+68
+69
+70
+71
+72
+73
+74 public String getName() {
+75 return ANALYZER_NAME;
+76 }
+77
+78
+79
+80
+81
+82
+83 public AnalysisPhase getAnalysisPhase() {
+84 return ANALYSIS_PHASE;
+85 }
+86
+87
+88
+89
+90
+91
+92
+93
+94
+95
+96 @Override
+97 public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
+98 if (!analyzed) {
+99 analyzed = true ;
+100 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
+101 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
+102
+103 while (mainIterator.hasNext()) {
+104 final Dependency dependency = mainIterator.next();
+105 if (mainIterator.hasNext()) {
+106 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
+107 while (subIterator.hasNext()) {
+108 final Dependency nextDependency = subIterator.next();
+109 if (isShadedJar(dependency, nextDependency)) {
+110 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )) {
+111 dependenciesToRemove.add(dependency);
+112 } else {
+113 dependenciesToRemove.add(nextDependency);
+114 }
+115 } else if (hashesMatch(dependency, nextDependency)) {
+116 if (isCore(dependency, nextDependency)) {
+117 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
+118 } else {
+119 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+120 }
+121 } else if (cpeIdentifiersMatch(dependency, nextDependency)
+122 && hasSameBasePath(dependency, nextDependency)
+123 && fileNameMatch(dependency, nextDependency)) {
+124
+125 if (isCore(dependency, nextDependency)) {
+126 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
+127 } else {
+128 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+129 }
+130 }
+131 }
+132 }
+133 }
+134
+135
+136 for (Dependency d : dependenciesToRemove) {
+137 engine.getDependencies().remove(d);
+138 }
+139 }
+140 }
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151 private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
+152 dependency.addRelatedDependency(relatedDependency);
+153 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
+154 while (i.hasNext()) {
+155 dependency.addRelatedDependency(i.next());
+156 i.remove();
+157 }
+158 dependenciesToRemove.add(relatedDependency);
+159 }
+160
+161
+162
+163
+164
+165
+166
+167
+168 private String getBaseRepoPath(final String path) {
+169 int pos = path.indexOf("repository" + File.separator) + 11;
+170 if (pos < 0) {
+171 return path;
+172 }
+173 int tmp = path.indexOf(File.separator, pos);
+174 if (tmp <= 0) {
+175 return path;
+176 }
+177 if (tmp > 0) {
+178 pos = tmp + 1;
+179 }
+180 tmp = path.indexOf(File.separator, pos);
+181 if (tmp > 0) {
+182 pos = tmp + 1;
+183 }
+184 return path.substring(0, pos);
+185 }
+186
+187
+188
+189
+190
+191
+192
+193
+194 private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
+195 if (dependency1 == null || dependency1.getFileName() == null
+196 || dependency2 == null || dependency2.getFileName() == null ) {
+197 return false;
+198 }
+199 String fileName1 = dependency1.getFileName();
+200 String fileName2 = dependency2.getFileName();
+201
+202
+203
+204 final File one = new File(fileName1);
+205 final File two = new File(fileName2);
+206 final String oneParent = one.getParent();
+207 final String twoParent = two.getParent();
+208 if (oneParent != null ) {
+209 if (oneParent.equals(twoParent)) {
+210 fileName1 = one.getName();
+211 fileName2 = two.getName();
+212 } else {
+213 return false;
+214 }
+215 } else if (twoParent != null ) {
+216 return false;
+217 }
+218
+219
+220 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
+221 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
+222 if (version1 != null && version2 != null ) {
+223 if (!version1.equals(version2)) {
+224 return false;
+225 }
+226 }
+227
+228
+229 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
+230 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
+231 if (match1.find() && match2.find()) {
+232 return match1.group().equals(match2.group());
+233 }
+234
+235 return false;
+236 }
+237
+238
+239
+240
+241
+242
+243
+244
+245 private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
+246 if (dependency1 == null || dependency1.getIdentifiers() == null
+247 || dependency2 == null || dependency2.getIdentifiers() == null ) {
+248 return false;
249 }
-250
-251
-252 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
-253 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
-254 if (match1.find() && match2.find()) {
-255 return match1.group().equals(match2.group());
-256 }
-257
-258 return false;
-259 }
-260
-261
-262
-263
-264
-265
-266
-267
-268 private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
-269 if (dependency1 == null || dependency1.getIdentifiers() == null
-270 || dependency2 == null || dependency2.getIdentifiers() == null ) {
-271 return false;
-272 }
-273 boolean matches = false;
-274 int cpeCount1 = 0;
-275 int cpeCount2 = 0;
-276 for (Identifier i : dependency1.getIdentifiers()) {
-277 if ("cpe" .equals(i.getType())) {
-278 cpeCount1 += 1;
-279 }
-280 }
-281 for (Identifier i : dependency2.getIdentifiers()) {
-282 if ("cpe" .equals(i.getType())) {
-283 cpeCount2 += 1;
-284 }
-285 }
-286 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
-287 for (Identifier i : dependency1.getIdentifiers()) {
-288 matches |= dependency2.getIdentifiers().contains(i);
-289 if (!matches) {
-290 break ;
-291 }
-292 }
-293 }
-294 if (LogUtils.isVerboseLoggingEnabled()) {
-295 final String msg = String.format("IdentifiersMatch=%s (%s, %s)" , matches, dependency1.getFileName(), dependency2.getFileName());
-296 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
-297 }
-298 return matches;
-299 }
-300
-301
-302
-303
-304
-305
-306
-307
-308 private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
-309 if (dependency1 == null || dependency2 == null ) {
-310 return false;
+250 boolean matches = false;
+251 int cpeCount1 = 0;
+252 int cpeCount2 = 0;
+253 for (Identifier i : dependency1.getIdentifiers()) {
+254 if ("cpe" .equals(i.getType())) {
+255 cpeCount1 += 1;
+256 }
+257 }
+258 for (Identifier i : dependency2.getIdentifiers()) {
+259 if ("cpe" .equals(i.getType())) {
+260 cpeCount2 += 1;
+261 }
+262 }
+263 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
+264 for (Identifier i : dependency1.getIdentifiers()) {
+265 matches |= dependency2.getIdentifiers().contains(i);
+266 if (!matches) {
+267 break ;
+268 }
+269 }
+270 }
+271 if (LogUtils.isVerboseLoggingEnabled()) {
+272 final String msg = String.format("IdentifiersMatch=%s (%s, %s)" , matches, dependency1.getFileName(), dependency2.getFileName());
+273 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
+274 }
+275 return matches;
+276 }
+277
+278
+279
+280
+281
+282
+283
+284
+285 private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
+286 if (dependency1 == null || dependency2 == null ) {
+287 return false;
+288 }
+289 final File lFile = new File(dependency1.getFilePath());
+290 String left = lFile.getParent();
+291 final File rFile = new File(dependency2.getFilePath());
+292 String right = rFile.getParent();
+293 if (left == null ) {
+294 return right == null ;
+295 }
+296 if (left.equalsIgnoreCase(right)) {
+297 return true ;
+298 }
+299 if (left.matches(".*[/\\\\]repository[/\\\\].*" ) && right.matches(".*[/\\\\]repository[/\\\\].*" )) {
+300 left = getBaseRepoPath(left);
+301 right = getBaseRepoPath(right);
+302 }
+303 if (left.equalsIgnoreCase(right)) {
+304 return true ;
+305 }
+306
+307 for (Dependency child : dependency2.getRelatedDependencies()) {
+308 if (hasSameBasePath(dependency1, child)) {
+309 return true ;
+310 }
311 }
-312 final File lFile = new File(dependency1.getFilePath());
-313 String left = lFile.getParent();
-314 final File rFile = new File(dependency2.getFilePath());
-315 String right = rFile.getParent();
-316 if (left == null ) {
-317 return right == null ;
-318 }
-319 if (left.equalsIgnoreCase(right)) {
-320 return true ;
-321 }
-322 if (left.matches(".*[/\\\\]repository[/\\\\].*" ) && right.matches(".*[/\\\\]repository[/\\\\].*" )) {
-323 left = getBaseRepoPath(left);
-324 right = getBaseRepoPath(right);
-325 }
-326 if (left.equalsIgnoreCase(right)) {
-327 return true ;
-328 }
-329
-330 for (Dependency child : dependency2.getRelatedDependencies()) {
-331 if (hasSameBasePath(dependency1, child)) {
-332 return true ;
-333 }
-334 }
-335 return false;
-336 }
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346 boolean isCore(Dependency left, Dependency right) {
-347 final String leftName = left.getFileName().toLowerCase();
-348 final String rightName = right.getFileName().toLowerCase();
-349
-350 final boolean returnVal;
-351 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
-352 || rightName.contains("core" ) && !leftName.contains("core" )
-353 || rightName.contains("kernel" ) && !leftName.contains("kernel" )) {
-354 returnVal = false;
-355 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
-356 || !rightName.contains("core" ) && leftName.contains("core" )
-357 || !rightName.contains("kernel" ) && leftName.contains("kernel" )) {
-358 returnVal = true ;
-359 } else {
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369 returnVal = leftName.length() <= rightName.length();
-370 }
-371 if (LogUtils.isVerboseLoggingEnabled()) {
-372 final String msg = String.format("IsCore=%s (%s, %s)" , returnVal, left.getFileName(), right.getFileName());
-373 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
-374 }
-375 return returnVal;
-376 }
-377
-378
-379
-380
-381
-382
-383
-384
-385 private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
-386 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
-387 return false;
-388 }
-389 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
-390 }
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401 private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
-402 final String mainName = dependency.getFileName().toLowerCase();
-403 final String nextName = nextDependency.getFileName().toLowerCase();
-404 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
-405 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
-406 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
-407 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
-408 }
-409 return false;
-410 }
-411 }
+312 return false;
+313 }
+314
+315
+316
+317
+318
+319
+320
+321
+322
+323 boolean isCore(Dependency left, Dependency right) {
+324 final String leftName = left.getFileName().toLowerCase();
+325 final String rightName = right.getFileName().toLowerCase();
+326
+327 final boolean returnVal;
+328 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+329 || rightName.contains("core" ) && !leftName.contains("core" )
+330 || rightName.contains("kernel" ) && !leftName.contains("kernel" )) {
+331 returnVal = false;
+332 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+333 || !rightName.contains("core" ) && leftName.contains("core" )
+334 || !rightName.contains("kernel" ) && leftName.contains("kernel" )) {
+335 returnVal = true ;
+336 } else {
+337
+338
+339
+340
+341
+342
+343
+344
+345
+346 returnVal = leftName.length() <= rightName.length();
+347 }
+348 if (LogUtils.isVerboseLoggingEnabled()) {
+349 final String msg = String.format("IsCore=%s (%s, %s)" , returnVal, left.getFileName(), right.getFileName());
+350 Logger.getLogger(DependencyBundlingAnalyzer.class .getName()).log(Level.FINE, msg);
+351 }
+352 return returnVal;
+353 }
+354
+355
+356
+357
+358
+359
+360
+361
+362 private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
+363 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
+364 return false;
+365 }
+366 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
+367 }
+368
+369
+370
+371
+372
+373
+374
+375
+376
+377
+378 private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
+379 final String mainName = dependency.getFileName().toLowerCase();
+380 final String nextName = nextDependency.getFileName().toLowerCase();
+381 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
+382 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
+383 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
+384 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
+385 }
+386 return false;
+387 }
+388 }
44
45
46
-47
+47
48
-49 private static final Set<String> EXTENSIONS = null ;
+49 private static final String ANALYZER_NAME = "False Positive Analyzer" ;
50
-51
+51
52
-53 private static final String ANALYZER_NAME = "False Positive Analyzer" ;
-54
-55
-56
-57 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
-58
-59
-60
-61
-62
-63
-64 public Set<String> getSupportedExtensions() {
-65 return EXTENSIONS;
-66 }
-67
-68
-69
-70
-71
-72
-73 public String getName() {
-74 return ANALYZER_NAME;
-75 }
-76
-77
-78
-79
-80
-81
-82
-83 public boolean supportsExtension(String extension) {
-84 return true ;
-85 }
-86
-87
-88
-89
-90
-91
-92 public AnalysisPhase getAnalysisPhase() {
-93 return ANALYSIS_PHASE;
-94 }
-95
-96
-97
-98
-99
-100
-101
-102
-103
-104 @Override
-105 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-106 removeJreEntries(dependency);
-107 removeBadMatches(dependency);
-108 removeWrongVersionMatches(dependency);
-109 removeSpuriousCPE(dependency);
-110 addFalseNegativeCPEs(dependency);
-111 }
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131 @SuppressWarnings("null" )
-132 private void removeSpuriousCPE(Dependency dependency) {
-133 final List<Identifier> ids = new ArrayList<Identifier>();
-134 ids.addAll(dependency.getIdentifiers());
-135 Collections.sort(ids);
-136 final ListIterator<Identifier> mainItr = ids.listIterator();
-137 while (mainItr.hasNext()) {
-138 final Identifier currentId = mainItr.next();
-139 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
-140 if (currentCpe == null ) {
-141 continue ;
-142 }
-143 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
-144 while (subItr.hasNext()) {
-145 final Identifier nextId = subItr.next();
-146 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
-147 if (nextCpe == null ) {
-148 continue ;
-149 }
-150
-151 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
-152 if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
-153
-154 final String currentVersion = currentCpe.getVersion();
-155 final String nextVersion = nextCpe.getVersion();
-156 if (currentVersion == null && nextVersion == null ) {
-157
-158 Logger.getLogger(FalsePositiveAnalyzer.class
-159 .getName()).log(Level.FINE, "currentVersion and nextVersion are both null?" );
-160 } else if (currentVersion == null && nextVersion != null ) {
-161 dependency.getIdentifiers().remove(currentId);
-162 } else if (nextVersion == null && currentVersion != null ) {
-163 dependency.getIdentifiers().remove(nextId);
-164 } else if (currentVersion.length() < nextVersion.length()) {
-165 if (nextVersion.startsWith(currentVersion) || "-" .equals(currentVersion)) {
-166 dependency.getIdentifiers().remove(currentId);
-167 }
-168 } else {
-169 if (currentVersion.startsWith(nextVersion) || "-" .equals(nextVersion)) {
-170 dependency.getIdentifiers().remove(nextId);
-171 }
-172 }
-173 }
-174 }
-175 }
-176 }
-177 }
-178
-179
-180
-181 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
-182 + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
-183 + "jdk|jre|jsf|jsse)($|:.*)" );
-184
-185
-186
-187 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
-188
-189
-190
-191
-192
-193
-194 private void removeJreEntries(Dependency dependency) {
-195 final Set<Identifier> identifiers = dependency.getIdentifiers();
-196 final Iterator<Identifier> itr = identifiers.iterator();
-197 while (itr.hasNext()) {
-198 final Identifier i = itr.next();
-199 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
-200 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
-201 if (coreCPE.matches() && !coreFiles.matches()) {
-202 itr.remove();
-203 }
+53 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+54
+55
+56
+57
+58
+59
+60 public String getName() {
+61 return ANALYZER_NAME;
+62 }
+63
+64
+65
+66
+67
+68
+69 public AnalysisPhase getAnalysisPhase() {
+70 return ANALYSIS_PHASE;
+71 }
+72
+73
+74
+75
+76
+77
+78
+79
+80
+81 @Override
+82 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+83 removeJreEntries(dependency);
+84 removeBadMatches(dependency);
+85 removeWrongVersionMatches(dependency);
+86 removeSpuriousCPE(dependency);
+87 addFalseNegativeCPEs(dependency);
+88 }
+89
+90
+91
+92
+93
+94
+95
+96
+97
+98
+99
+100
+101
+102
+103
+104
+105
+106
+107
+108 @SuppressWarnings("null" )
+109 private void removeSpuriousCPE(Dependency dependency) {
+110 final List<Identifier> ids = new ArrayList<Identifier>();
+111 ids.addAll(dependency.getIdentifiers());
+112 Collections.sort(ids);
+113 final ListIterator<Identifier> mainItr = ids.listIterator();
+114 while (mainItr.hasNext()) {
+115 final Identifier currentId = mainItr.next();
+116 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
+117 if (currentCpe == null ) {
+118 continue ;
+119 }
+120 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
+121 while (subItr.hasNext()) {
+122 final Identifier nextId = subItr.next();
+123 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
+124 if (nextCpe == null ) {
+125 continue ;
+126 }
+127
+128 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
+129 if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
+130
+131 final String currentVersion = currentCpe.getVersion();
+132 final String nextVersion = nextCpe.getVersion();
+133 if (currentVersion == null && nextVersion == null ) {
+134
+135 Logger.getLogger(FalsePositiveAnalyzer.class
+136 .getName()).log(Level.FINE, "currentVersion and nextVersion are both null?" );
+137 } else if (currentVersion == null && nextVersion != null ) {
+138 dependency.getIdentifiers().remove(currentId);
+139 } else if (nextVersion == null && currentVersion != null ) {
+140 dependency.getIdentifiers().remove(nextId);
+141 } else if (currentVersion.length() < nextVersion.length()) {
+142 if (nextVersion.startsWith(currentVersion) || "-" .equals(currentVersion)) {
+143 dependency.getIdentifiers().remove(currentId);
+144 }
+145 } else {
+146 if (currentVersion.startsWith(nextVersion) || "-" .equals(nextVersion)) {
+147 dependency.getIdentifiers().remove(nextId);
+148 }
+149 }
+150 }
+151 }
+152 }
+153 }
+154 }
+155
+156
+157
+158 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
+159 + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
+160 + "jdk|jre|jsf|jsse)($|:.*)" );
+161
+162
+163
+164 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
+165
+166
+167
+168
+169
+170
+171 private void removeJreEntries(Dependency dependency) {
+172 final Set<Identifier> identifiers = dependency.getIdentifiers();
+173 final Iterator<Identifier> itr = identifiers.iterator();
+174 while (itr.hasNext()) {
+175 final Identifier i = itr.next();
+176 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
+177 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
+178 if (coreCPE.matches() && !coreFiles.matches()) {
+179 itr.remove();
+180 }
+181
+182
+183
+184
+185
+186
+187
+188
+189
+190
+191
+192
+193
+194
+195
+196
+197
+198
+199
+200
+201
+202 }
+203 }
204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225 }
-226 }
-227
-228
-229
-230
-231
-232
-233
-234
-235 private VulnerableSoftware parseCpe(String type, String value) {
-236 if (!"cpe" .equals(type)) {
-237 return null ;
-238 }
-239 final VulnerableSoftware cpe = new VulnerableSoftware ();
-240 try {
-241 cpe.parseName(value);
-242 } catch (UnsupportedEncodingException ex) {
-243 Logger.getLogger(FalsePositiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-244 return null ;
-245 }
-246 return cpe;
-247 }
-248
-249
-250
-251
-252
-253
-254
-255 private void removeBadMatches(Dependency dependency) {
-256 final Set<Identifier> identifiers = dependency.getIdentifiers();
-257 final Iterator<Identifier> itr = identifiers.iterator();
-258
-259
-260
-261
-262
-263
-264
-265
-266 while (itr.hasNext()) {
-267 final Identifier i = itr.next();
-268
-269 if ("cpe" .equals(i.getType())) {
-270 if ((i.getValue().matches(".*c\\+\\+.*" )
-271 || i.getValue().startsWith("cpe:/a:jquery:jquery" )
-272 || i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
-273 || i.getValue().startsWith("cpe:/a:yahoo:yui" )
-274 || i.getValue().startsWith("cpe:/a:file:file" )
-275 || i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
-276 || i.getValue().startsWith("cpe:/a:cvs:cvs" )
-277 || i.getValue().startsWith("cpe:/a:ftp:ftp" )
-278 || i.getValue().startsWith("cpe:/a:ssh:ssh" ))
-279 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
-280 || dependency.getFileName().toLowerCase().endsWith("pom.xml" ))) {
-281 itr.remove();
-282 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
-283 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
-284 itr.remove();
-285 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
-286 && !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
-287 itr.remove();
-288 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
-289 && !dependency.getFileName().toLowerCase().matches("jboss-[\\d\\.]+(GA)?\\.jar" )) {
-290 itr.remove();
+205
+206
+207
+208
+209
+210
+211
+212 private VulnerableSoftware parseCpe(String type, String value) {
+213 if (!"cpe" .equals(type)) {
+214 return null ;
+215 }
+216 final VulnerableSoftware cpe = new VulnerableSoftware ();
+217 try {
+218 cpe.parseName(value);
+219 } catch (UnsupportedEncodingException ex) {
+220 Logger.getLogger(FalsePositiveAnalyzer.class .getName()).log(Level.FINEST, null , ex);
+221 return null ;
+222 }
+223 return cpe;
+224 }
+225
+226
+227
+228
+229
+230
+231
+232 private void removeBadMatches(Dependency dependency) {
+233 final Set<Identifier> identifiers = dependency.getIdentifiers();
+234 final Iterator<Identifier> itr = identifiers.iterator();
+235
+236
+237
+238
+239
+240
+241
+242
+243 while (itr.hasNext()) {
+244 final Identifier i = itr.next();
+245
+246 if ("cpe" .equals(i.getType())) {
+247 if ((i.getValue().matches(".*c\\+\\+.*" )
+248 || i.getValue().startsWith("cpe:/a:jquery:jquery" )
+249 || i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
+250 || i.getValue().startsWith("cpe:/a:yahoo:yui" )
+251 || i.getValue().startsWith("cpe:/a:file:file" )
+252 || i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
+253 || i.getValue().startsWith("cpe:/a:cvs:cvs" )
+254 || i.getValue().startsWith("cpe:/a:ftp:ftp" )
+255 || i.getValue().startsWith("cpe:/a:ssh:ssh" ))
+256 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
+257 || dependency.getFileName().toLowerCase().endsWith("pom.xml" ))) {
+258 itr.remove();
+259 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
+260 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
+261 itr.remove();
+262 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
+263 && !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
+264 itr.remove();
+265 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
+266 && !dependency.getFileName().toLowerCase().matches("jboss-[\\d\\.]+(GA)?\\.jar" )) {
+267 itr.remove();
+268 }
+269 }
+270 }
+271 }
+272
+273
+274
+275
+276
+277
+278 private void removeWrongVersionMatches(Dependency dependency) {
+279 final Set<Identifier> identifiers = dependency.getIdentifiers();
+280 final Iterator<Identifier> itr = identifiers.iterator();
+281
+282 final String fileName = dependency.getFileName();
+283 if (fileName != null && fileName.contains("axis2" )) {
+284 while (itr.hasNext()) {
+285 final Identifier i = itr.next();
+286 if ("cpe" .equals(i.getType())) {
+287 final String cpe = i.getValue();
+288 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
+289 itr.remove();
+290 }
291 }
292 }
-293 }
-294 }
-295
-296
-297
-298
-299
-300
-301 private void removeWrongVersionMatches(Dependency dependency) {
-302 final Set<Identifier> identifiers = dependency.getIdentifiers();
-303 final Iterator<Identifier> itr = identifiers.iterator();
-304
-305 final String fileName = dependency.getFileName();
-306 if (fileName != null && fileName.contains("axis2" )) {
-307 while (itr.hasNext()) {
-308 final Identifier i = itr.next();
-309 if ("cpe" .equals(i.getType())) {
-310 final String cpe = i.getValue();
-311 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
-312 itr.remove();
-313 }
-314 }
-315 }
-316 } else if (fileName != null && fileName.contains("axis" )) {
-317 while (itr.hasNext()) {
-318 final Identifier i = itr.next();
-319 if ("cpe" .equals(i.getType())) {
-320 final String cpe = i.getValue();
-321 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
-322 itr.remove();
-323 }
-324 }
-325 }
-326 }
-327 }
-328
-329
-330
-331
-332
-333
-334
-335
-336 private void addFalseNegativeCPEs(Dependency dependency) {
-337 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
-338 while (itr.hasNext()) {
-339 final Identifier i = itr.next();
-340 if ("cpe" .equals(i.getType()) && i.getValue() != null
-341 && (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
-342 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
-343 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
-344 || i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
-345 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
-346 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
-347 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
-348 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
-349 try {
-350 dependency.addIdentifier("cpe" ,
-351 newCpe,
-352 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe, "UTF-8" )));
-353 dependency.addIdentifier("cpe" ,
-354 newCpe2,
-355 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe2, "UTF-8" )));
-356 dependency.addIdentifier("cpe" ,
-357 newCpe3,
-358 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe3, "UTF-8" )));
-359 dependency.addIdentifier("cpe" ,
-360 newCpe4,
-361 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe4, "UTF-8" )));
-362 } catch (UnsupportedEncodingException ex) {
-363 Logger.getLogger(FalsePositiveAnalyzer.class
-364 .getName()).log(Level.FINE, null , ex);
-365 }
-366 }
-367 }
-368 }
-369 }
+293 } else if (fileName != null && fileName.contains("axis" )) {
+294 while (itr.hasNext()) {
+295 final Identifier i = itr.next();
+296 if ("cpe" .equals(i.getType())) {
+297 final String cpe = i.getValue();
+298 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
+299 itr.remove();
+300 }
+301 }
+302 }
+303 }
+304 }
+305
+306
+307
+308
+309
+310
+311
+312
+313 private void addFalseNegativeCPEs(Dependency dependency) {
+314 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+315 while (itr.hasNext()) {
+316 final Identifier i = itr.next();
+317 if ("cpe" .equals(i.getType()) && i.getValue() != null
+318 && (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
+319 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
+320 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
+321 || i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
+322 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
+323 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
+324 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
+325 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
+326 try {
+327 dependency.addIdentifier("cpe" ,
+328 newCpe,
+329 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe, "UTF-8" )));
+330 dependency.addIdentifier("cpe" ,
+331 newCpe2,
+332 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe2, "UTF-8" )));
+333 dependency.addIdentifier("cpe" ,
+334 newCpe3,
+335 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe3, "UTF-8" )));
+336 dependency.addIdentifier("cpe" ,
+337 newCpe4,
+338 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s" , URLEncoder.encode(newCpe4, "UTF-8" )));
+339 } catch (UnsupportedEncodingException ex) {
+340 Logger.getLogger(FalsePositiveAnalyzer.class
+341 .getName()).log(Level.FINE, null , ex);
+342 }
+343 }
+344 }
+345 }
+346 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-21 import java.io.File;
-22 import java.util.Set;
-23 import org.owasp.dependencycheck.Engine;
-24 import org.owasp.dependencycheck.dependency.Confidence;
-25 import org.owasp.dependencycheck.dependency.Dependency;
-26 import org.owasp.dependencycheck.utils.DependencyVersion;
-27 import org.owasp.dependencycheck.utils.DependencyVersionUtil;
-28
-29
-30
-31
-32
-33
-34
-35 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
-36
-37
-38
-39
-40
-41 private static final String ANALYZER_NAME = "File Name Analyzer" ;
-42
-43
-44
-45 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+20 import java.io.File;
+21 import org.owasp.dependencycheck.Engine;
+22 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+23 import org.owasp.dependencycheck.dependency.Confidence;
+24 import org.owasp.dependencycheck.dependency.Dependency;
+25 import org.owasp.dependencycheck.utils.DependencyVersion;
+26 import org.owasp.dependencycheck.utils.DependencyVersionUtil;
+27
+28
+29
+30
+31
+32
+33
+34 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
+35
+36
+37
+38
+39
+40 private static final String ANALYZER_NAME = "File Name Analyzer" ;
+41
+42
+43
+44 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+45
46
-47
-48
-49 private static final Set<String> EXTENSIONS = null ;
-50
-51
-52
-53
-54
-55
-56 public Set<String> getSupportedExtensions() {
-57 return EXTENSIONS;
-58 }
-59
-60
-61
-62
-63
-64
-65 public String getName() {
-66 return ANALYZER_NAME;
-67 }
-68
-69
-70
-71
-72
-73
-74
-75 public boolean supportsExtension(String extension) {
-76 return true ;
-77 }
+47
+48
+49
+50
+51 public String getName() {
+52 return ANALYZER_NAME;
+53 }
+54
+55
+56
+57
+58
+59
+60 public AnalysisPhase getAnalysisPhase() {
+61 return ANALYSIS_PHASE;
+62 }
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72 @Override
+73 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+74
+75
+76 final File f = new File(dependency.getFileName());
+77 String fileName = f.getName();
78
-79
-80
-81
-82
-83
-84 public AnalysisPhase getAnalysisPhase() {
-85 return ANALYSIS_PHASE;
-86 }
-87
-88
-89
-90
-91
-92
-93
-94
-95
-96 @Override
-97 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-98
-99
-100 final File f = new File(dependency.getFileName());
-101 String fileName = f.getName();
-102
-103
-104 final int pos = fileName.lastIndexOf("." );
-105 if (pos > 0) {
-106 fileName = fileName.substring(0, pos);
-107 }
-108
-109
-110 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
-111 if (version != null ) {
-112
-113
-114
-115 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
-116 dependency.getVersionEvidence().addEvidence("file" , "name" ,
-117 version.toString(), Confidence.MEDIUM);
-118 } else {
-119 dependency.getVersionEvidence().addEvidence("file" , "name" ,
-120 version.toString(), Confidence.HIGHEST);
-121 }
-122 dependency.getVersionEvidence().addEvidence("file" , "name" ,
-123 fileName, Confidence.MEDIUM);
-124 }
-125
-126
-127 if (fileName.contains("-" )) {
-128 dependency.getProductEvidence().addEvidence("file" , "name" ,
-129 fileName, Confidence.HIGHEST);
-130 dependency.getVendorEvidence().addEvidence("file" , "name" ,
-131 fileName, Confidence.HIGHEST);
-132 } else {
-133 dependency.getProductEvidence().addEvidence("file" , "name" ,
-134 fileName, Confidence.HIGH);
-135 dependency.getVendorEvidence().addEvidence("file" , "name" ,
-136 fileName, Confidence.HIGH);
-137 }
-138 }
-139 }
+79
+80 final int pos = fileName.lastIndexOf("." );
+81 if (pos > 0) {
+82 fileName = fileName.substring(0, pos);
+83 }
+84
+85
+86 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
+87 if (version != null ) {
+88
+89
+90
+91 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
+92 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+93 version.toString(), Confidence.MEDIUM);
+94 } else {
+95 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+96 version.toString(), Confidence.HIGHEST);
+97 }
+98 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+99 fileName, Confidence.MEDIUM);
+100 }
+101
+102
+103 if (fileName.contains("-" )) {
+104 dependency.getProductEvidence().addEvidence("file" , "name" ,
+105 fileName, Confidence.HIGHEST);
+106 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+107 fileName, Confidence.HIGHEST);
+108 } else {
+109 dependency.getProductEvidence().addEvidence("file" , "name" ,
+110 fileName, Confidence.HIGH);
+111 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+112 fileName, Confidence.HIGH);
+113 }
+114 }
+115 }
FileTypeAnalyzer xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.analyzer;
+19
+20
+21
+22
+23
+24
+25 public interface FileTypeAnalyzer extends Analyzer {
+26
+27
+28
+29
+30
+31
+32
+33 boolean supportsExtension(String extension);
+34 }
+
+17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-21 import java.util.ArrayList;
-22 import java.util.Iterator;
-23 import java.util.Set;
-24 import org.owasp.dependencycheck.Engine;
+20 import java.util.ArrayList;
+21 import java.util.Iterator;
+22 import java.util.Set;
+23 import org.owasp.dependencycheck.Engine;
+24 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
25 import org.owasp.dependencycheck.dependency.Confidence;
26 import org.owasp.dependencycheck.dependency.Dependency;
27 import org.owasp.dependencycheck.dependency.Evidence;
@@ -49,104 +49,83 @@
41
42
43 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
-44
-45
-46
-47 private static final Set<String> EXTENSIONS = null ;
-48
-49
-50
-51
-52
-53
-54 public Set<String> getSupportedExtensions() {
-55 return EXTENSIONS;
-56 }
-57
-58
-59
-60
-61
-62
-63 public String getName() {
-64 return ANALYZER_NAME;
-65 }
-66
-67
-68
+44
+45
+46
+47
+48
+49
+50 @Override
+51 public String getName() {
+52 return ANALYZER_NAME;
+53 }
+54
+55
+56
+57
+58
+59
+60 @Override
+61 public AnalysisPhase getAnalysisPhase() {
+62 return ANALYSIS_PHASE;
+63 }
+64
+65
+66
+67
+68
69
-70
-71
-72
-73 public boolean supportsExtension(String extension) {
-74 return true ;
-75 }
-76
-77
-78
-79
-80
-81
-82 public AnalysisPhase getAnalysisPhase() {
-83 return ANALYSIS_PHASE;
-84 }
-85
-86
-87
-88
-89
-90
-91
-92
-93
-94
-95 @Override
-96 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-97 final Evidence springTest1 = new Evidence ("Manifest" ,
-98 "Implementation-Title" ,
-99 "Spring Framework" ,
-100 Confidence.HIGH);
-101
-102 final Evidence springTest2 = new Evidence ("Manifest" ,
-103 "Implementation-Title" ,
-104 "org.springframework.core" ,
-105 Confidence.HIGH);
-106
-107 final Evidence springTest3 = new Evidence ("Manifest" ,
-108 "Bundle-Vendor" ,
-109 "SpringSource" ,
-110 Confidence.HIGH);
-111
-112 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
-113 if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
-114 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
-115 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "SpringSource" , Confidence.HIGH);
-116 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+70
+71
+72
+73
+74 @Override
+75 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+76 final Evidence springTest1 = new Evidence ("Manifest" ,
+77 "Implementation-Title" ,
+78 "Spring Framework" ,
+79 Confidence.HIGH);
+80
+81 final Evidence springTest2 = new Evidence ("Manifest" ,
+82 "Implementation-Title" ,
+83 "org.springframework.core" ,
+84 Confidence.HIGH);
+85
+86 final Evidence springTest3 = new Evidence ("Manifest" ,
+87 "Bundle-Vendor" ,
+88 "SpringSource" ,
+89 Confidence.HIGH);
+90
+91 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
+92 if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
+93 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
+94 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "SpringSource" , Confidence.HIGH);
+95 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+96 }
+97
+98 evidence = dependency.getVendorEvidence().getEvidence();
+99 if (evidence.contains(springTest3)) {
+100 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
+101 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+102 }
+103 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
+104 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
+105 while (itr.hasNext()) {
+106 final Evidence e = itr.next();
+107 if ("sun" .equalsIgnoreCase(e.getValue(false))) {
+108 final Evidence newEvidence = new Evidence (e.getSource() + " (hint)" , e.getName(), "oracle" , e.getConfidence());
+109 newEntries.add(newEvidence);
+110 } else if ("oracle" .equalsIgnoreCase(e.getValue(false))) {
+111 final Evidence newEvidence = new Evidence (e.getSource() + " (hint)" , e.getName(), "sun" , e.getConfidence());
+112 newEntries.add(newEvidence);
+113 }
+114 }
+115 for (Evidence e : newEntries) {
+116 dependency.getVendorEvidence().addEvidence(e);
117 }
118
-119 evidence = dependency.getVendorEvidence().getEvidence();
-120 if (evidence.contains(springTest3)) {
-121 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
-122 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
-123 }
-124 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
-125 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
-126 while (itr.hasNext()) {
-127 final Evidence e = itr.next();
-128 if ("sun" .equalsIgnoreCase(e.getValue(false))) {
-129 final Evidence newEvidence = new Evidence (e.getSource() + " (hint)" , e.getName(), "oracle" , e.getConfidence());
-130 newEntries.add(newEvidence);
-131 } else if ("oracle" .equalsIgnoreCase(e.getValue(false))) {
-132 final Evidence newEvidence = new Evidence (e.getSource() + " (hint)" , e.getName(), "sun" , e.getConfidence());
-133 newEntries.add(newEvidence);
-134 }
-135 }
-136 for (Evidence e : newEntries) {
-137 dependency.getVendorEvidence().addEvidence(e);
-138 }
-139
-140 }
-141 }
+119 }
+120 }
79
80
81
-82 public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
+82 public class JarAnalyzer extends AbstractFileTypeAnalyzer {
83
84
85
-86
+86
87
-88 private static final int BUFFER_SIZE = 4096;
+88 private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class .getName());
89
-90
+90
91
-92 private static int dirCount = 0;
+92 private static final int BUFFER_SIZE = 4096;
93
-94
+94
95
-96 private static final String NEWLINE = System.getProperty("line.separator" );
+96 private static int dirCount = 0;
97
-98
+98
99
-100 private static final Set<String> IGNORE_VALUES = newHashSet(
-101 "Sun Java System Application Server" );
-102
-103
-104
-105 private static final Set<String> IGNORE_KEYS = newHashSet(
-106 "built-by" ,
-107 "created-by" ,
-108 "builtby" ,
-109 "createdby" ,
-110 "build-jdk" ,
-111 "buildjdk" ,
-112 "ant-version" ,
-113 "antversion" ,
-114 "import-package" ,
-115 "export-package" ,
-116 "importpackage" ,
-117 "exportpackage" ,
-118 "sealed" ,
-119 "manifest-version" ,
-120 "archiver-version" ,
-121 "manifestversion" ,
-122 "archiverversion" ,
-123 "classpath" ,
-124 "class-path" ,
-125 "tool" ,
-126 "bundle-manifestversion" ,
-127 "bundlemanifestversion" ,
-128 "include-resource" );
-129
-130
-131
-132 private static final String BUNDLE_VERSION = "Bundle-Version" ;
-133
-134
-135
-136 private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
-137
-138
-139
-140 private static final String BUNDLE_NAME = "Bundle-Name" ;
-141
-142
-143
-144 private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
-145
-146
-147
-148 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
-149
-150
-151
-152 private Unmarshaller pomUnmarshaller;
-153
-154
-155
-156
-157
-158 public JarAnalyzer () {
-159 try {
-160 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
-161 pomUnmarshaller = jaxbContext.createUnmarshaller();
-162 } catch (JAXBException ex) {
-163 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details." );
-164 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-165 }
-166 }
-167
+100 private static final String NEWLINE = System.getProperty("line.separator" );
+101
+102
+103
+104 private static final Set<String> IGNORE_VALUES = newHashSet(
+105 "Sun Java System Application Server" );
+106
+107
+108
+109 private static final Set<String> IGNORE_KEYS = newHashSet(
+110 "built-by" ,
+111 "created-by" ,
+112 "builtby" ,
+113 "createdby" ,
+114 "build-jdk" ,
+115 "buildjdk" ,
+116 "ant-version" ,
+117 "antversion" ,
+118 "dynamicimportpackage" ,
+119 "dynamicimport-package" ,
+120 "dynamic-importpackage" ,
+121 "dynamic-import-package" ,
+122 "import-package" ,
+123 "ignore-package" ,
+124 "export-package" ,
+125 "importpackage" ,
+126 "ignorepackage" ,
+127 "exportpackage" ,
+128 "sealed" ,
+129 "manifest-version" ,
+130 "archiver-version" ,
+131 "manifestversion" ,
+132 "archiverversion" ,
+133 "classpath" ,
+134 "class-path" ,
+135 "tool" ,
+136 "bundle-manifestversion" ,
+137 "bundlemanifestversion" ,
+138 "include-resource" ,
+139 "embed-dependency" ,
+140 "ipojo-components" ,
+141 "ipojo-extension" );
+142
+143
+144
+145 private static final String BUNDLE_VERSION = "Bundle-Version" ;
+146
+147
+148
+149 private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
+150
+151
+152
+153 private static final String BUNDLE_NAME = "Bundle-Name" ;
+154
+155
+156
+157 private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
+158
+159
+160
+161 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
+162
+163
+164
+165 private Unmarshaller pomUnmarshaller;
+166
+167
168
-169
+169
170
-171 private static final String ANALYZER_NAME = "Jar Analyzer" ;
-172
-173
-174
-175 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-176
-177
-178
-179 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
+171 public JarAnalyzer () {
+172 try {
+173 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
+174 pomUnmarshaller = jaxbContext.createUnmarshaller();
+175 } catch (JAXBException ex) {
+176 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details." );
+177 LOGGER.log(Level.FINE, null , ex);
+178 }
+179 }
180
-181
-182
-183
-184
-185
-186 public Set<String> getSupportedExtensions() {
-187 return EXTENSIONS;
-188 }
-189
+181
+182
+183
+184
+185 private static final String ANALYZER_NAME = "Jar Analyzer" ;
+186
+187
+188
+189 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
190
-191
-192
-193
-194
-195 public String getName() {
-196 return ANALYZER_NAME;
-197 }
-198
-199
-200
-201
-202
-203
-204
-205 public boolean supportsExtension(String extension) {
-206 return EXTENSIONS.contains(extension);
-207 }
-208
-209
-210
-211
-212
-213
-214 public AnalysisPhase getAnalysisPhase() {
-215 return ANALYSIS_PHASE;
-216 }
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227 @Override
-228 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-229 try {
-230 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
-231 final String fileName = dependency.getFileName().toLowerCase();
-232 if (classNames.isEmpty()
-233 && (fileName.endsWith("-sources.jar" )
-234 || fileName.endsWith("-javadoc.jar" )
-235 || fileName.endsWith("-src.jar" )
-236 || fileName.endsWith("-doc.jar" ))) {
-237 engine.getDependencies().remove(dependency);
-238 }
-239 final boolean hasManifest = parseManifest(dependency, classNames);
-240 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
-241 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
-242 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
-243 } catch (IOException ex) {
-244 throw new AnalysisException ("Exception occurred reading the JAR file." , ex);
-245 }
-246 }
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258 protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
-259 boolean foundSomething = false;
-260 final JarFile jar;
-261 try {
-262 jar = new JarFile(dependency.getActualFilePath());
-263 } catch (IOException ex) {
-264 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
-265
-266 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-267 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-268 return false;
-269 }
-270 List<String> pomEntries;
-271 try {
-272 pomEntries = retrievePomListing(jar);
-273 } catch (IOException ex) {
-274 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
-275
-276 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-277 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, msg, ex);
-278 return false;
-279 }
-280 if (pomEntries.isEmpty()) {
-281 return false;
-282 }
-283 for (String path : pomEntries) {
-284 Properties pomProperties = null ;
-285 try {
-286 pomProperties = retrievePomProperties(path, jar);
-287 } catch (IOException ex) {
-288 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
-289 }
-290 Model pom = null ;
-291 try {
-292 if (pomEntries.size() > 1) {
-293
-294 final Dependency newDependency = new Dependency ();
-295 pom = extractPom(path, jar, newDependency);
-296
-297 final String displayPath = String.format("%s%s%s" ,
-298 dependency.getFilePath(),
-299 File.separator,
-300 path);
-301 final String displayName = String.format("%s%s%s" ,
-302 dependency.getFileName(),
-303 File.separator,
-304 path);
-305
-306 newDependency.setFileName(displayName);
-307 newDependency.setFilePath(displayPath);
-308 addPomEvidence(newDependency, pom, pomProperties);
-309 engine.getDependencies().add(newDependency);
-310 Collections.sort(engine.getDependencies());
-311 } else {
-312 pom = retrievePom(path, jar);
-313 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
-314 }
-315 } catch (AnalysisException ex) {
-316 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
-317 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-318 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, "" , ex);
-319 }
-320 }
-321 return foundSomething;
-322 }
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
-333 justification = "The reader is closed by closing the zipEntry" )
-334 private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
-335 Properties pomProperties = null ;
-336 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
-337 final ZipEntry propEntry = jar.getEntry(propPath);
-338 if (propEntry != null ) {
-339 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
-340 pomProperties = new Properties ();
-341 pomProperties.load(reader);
-342 }
-343 return pomProperties;
-344 }
-345
-346
-347
-348
-349
-350
-351
-352
-353 private List<String> retrievePomListing(final JarFile jar) throws IOException {
-354 final List<String> pomEntries = new ArrayList<String>();
-355 final Enumeration<JarEntry> entries = jar.entries();
-356 while (entries.hasMoreElements()) {
-357 final JarEntry entry = entries.nextElement();
-358 final String entryName = (new File(entry.getName())).getName().toLowerCase();
-359 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
-360 pomEntries.add(entry.getName());
-361 }
-362 }
-363 return pomEntries;
-364 }
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376 private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
-377 InputStream input = null ;
-378 FileOutputStream fos = null ;
-379 BufferedOutputStream bos = null ;
-380 final File tmpDir = getNextTempDirectory();
-381 final File file = new File(tmpDir, "pom.xml" );
-382 try {
-383 final ZipEntry entry = jar.getEntry(path);
-384 input = jar.getInputStream(entry);
-385 fos = new FileOutputStream(file);
-386 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
-387 int count;
-388 final byte data[] = new byte[BUFFER_SIZE];
-389 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
-390 bos.write(data, 0, count);
-391 }
-392 bos.flush();
-393 dependency.setActualFilePath(file.getAbsolutePath());
-394 } catch (IOException ex) {
-395 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.SEVERE, null , ex);
-396 } finally {
-397 closeStream(bos);
-398 closeStream(fos);
-399 closeStream(input);
-400 }
-401 Model model = null ;
-402 FileInputStream fis = null ;
-403 try {
-404 fis = new FileInputStream(file);
-405 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
-406 final InputSource xml = new InputSource(reader);
-407 final SAXSource source = new SAXSource(xml);
-408 model = readPom(source);
-409 } catch (FileNotFoundException ex) {
-410 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
-411 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-412 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-413 throw new AnalysisException (ex);
-414 } catch (UnsupportedEncodingException ex) {
-415 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
-416 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-417 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-418 throw new AnalysisException (ex);
-419 } catch (AnalysisException ex) {
-420 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
-421 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-422 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-423 throw ex;
-424 } finally {
-425 closeStream(fis);
-426 }
-427 return model;
-428 }
-429
-430
-431
-432
-433
-434
-435 private void closeStream(InputStream stream) {
-436 if (stream != null ) {
-437 try {
-438 stream.close();
-439 } catch (IOException ex) {
-440 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-441 }
-442 }
-443 }
-444
-445
-446
-447
-448
-449
-450 private void closeStream(OutputStream stream) {
-451 if (stream != null ) {
-452 try {
-453 stream.close();
-454 } catch (IOException ex) {
-455 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-456 }
-457 }
-458 }
-459
-460
-461
-462
-463
-464
-465
-466
-467
-468
-469 private Model retrievePom(String path, JarFile jar) throws AnalysisException {
-470 final ZipEntry entry = jar.getEntry(path);
-471 Model model = null ;
-472 if (entry != null ) {
-473 try {
-474 final NonClosingStream stream = new NonClosingStream (jar.getInputStream(entry));
-475 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
-476 final InputSource xml = new InputSource(reader);
-477 final SAXSource source = new SAXSource(xml);
-478 model = readPom(source);
-479 } catch (SecurityException ex) {
-480 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
-481 Logger
-482 .getLogger(JarAnalyzer.class
-483 .getName()).log(Level.WARNING, msg);
-484 Logger.getLogger(JarAnalyzer.class
-485 .getName()).log(Level.FINE, null , ex);
-486 throw new AnalysisException (ex);
-487 } catch (IOException ex) {
-488 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
-489 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-490 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-491 throw new AnalysisException (ex);
-492 } catch (Throwable ex) {
-493 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
-494 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING, msg);
-495 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, null , ex);
-496 throw new AnalysisException (ex);
-497 }
-498 }
-499 return model;
-500 }
-501
-502
-503
-504
-505
-506
-507
-508
-509
-510 private Model readPom(SAXSource source) throws AnalysisException {
-511 Model model = null ;
-512 try {
-513 final XMLFilter filter = new MavenNamespaceFilter ();
-514 final SAXParserFactory spf = SAXParserFactory.newInstance();
-515 final SAXParser sp = spf.newSAXParser();
-516 final XMLReader xr = sp.getXMLReader();
-517 filter.setParent(xr);
-518 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
-519 model = el.getValue();
-520 } catch (SecurityException ex) {
-521 throw new AnalysisException (ex);
-522 } catch (ParserConfigurationException ex) {
-523 throw new AnalysisException (ex);
-524 } catch (SAXException ex) {
-525 throw new AnalysisException (ex);
-526 } catch (JAXBException ex) {
-527 throw new AnalysisException (ex);
-528 } catch (Throwable ex) {
-529 throw new AnalysisException (ex);
-530 }
-531 return model;
-532 }
-533
-534
-535
-536
-537
-538
-539
-540
-541
-542
-543
-544 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
-545 boolean foundSomething = false;
-546 if (pom == null ) {
-547 return foundSomething;
+191
+192
+193 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
+194
+195
+196
+197
+198
+199
+200 @Override
+201 public Set<String> getSupportedExtensions() {
+202 return EXTENSIONS;
+203 }
+204
+205
+206
+207
+208
+209
+210 @Override
+211 public String getName() {
+212 return ANALYZER_NAME;
+213 }
+214
+215
+216
+217
+218
+219
+220 public AnalysisPhase getAnalysisPhase() {
+221 return ANALYSIS_PHASE;
+222 }
+223
+224
+225
+226
+227
+228
+229
+230 @Override
+231 protected String getAnalyzerEnabledSettingKey() {
+232 return Settings.KEYS.ANALYZER_JAR_ENABLED;
+233 }
+234
+235
+236
+237
+238
+239
+240
+241
+242
+243 @Override
+244 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+245 try {
+246 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
+247 final String fileName = dependency.getFileName().toLowerCase();
+248 if (classNames.isEmpty()
+249 && (fileName.endsWith("-sources.jar" )
+250 || fileName.endsWith("-javadoc.jar" )
+251 || fileName.endsWith("-src.jar" )
+252 || fileName.endsWith("-doc.jar" ))) {
+253 engine.getDependencies().remove(dependency);
+254 }
+255 final boolean hasManifest = parseManifest(dependency, classNames);
+256 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
+257 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
+258 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
+259 } catch (IOException ex) {
+260 throw new AnalysisException ("Exception occurred reading the JAR file." , ex);
+261 }
+262 }
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273
+274 protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
+275 boolean foundSomething = false;
+276 final JarFile jar;
+277 try {
+278 jar = new JarFile(dependency.getActualFilePath());
+279 } catch (IOException ex) {
+280 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
+281
+282 LOGGER.log(Level.WARNING, msg);
+283 LOGGER.log(Level.FINE, "" , ex);
+284 return false;
+285 }
+286 List<String> pomEntries;
+287 try {
+288 pomEntries = retrievePomListing(jar);
+289 } catch (IOException ex) {
+290 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
+291
+292 LOGGER.log(Level.WARNING, msg);
+293 LOGGER.log(Level.FINE, msg, ex);
+294 return false;
+295 }
+296 if (pomEntries.isEmpty()) {
+297 return false;
+298 }
+299 for (String path : pomEntries) {
+300 Properties pomProperties = null ;
+301 try {
+302 pomProperties = retrievePomProperties(path, jar);
+303 } catch (IOException ex) {
+304 LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
+305 }
+306 Model pom = null ;
+307 try {
+308 if (pomEntries.size() > 1) {
+309
+310 final Dependency newDependency = new Dependency ();
+311 pom = extractPom(path, jar, newDependency);
+312
+313 final String displayPath = String.format("%s%s%s" ,
+314 dependency.getFilePath(),
+315 File.separator,
+316 path);
+317 final String displayName = String.format("%s%s%s" ,
+318 dependency.getFileName(),
+319 File.separator,
+320 path);
+321
+322 newDependency.setFileName(displayName);
+323 newDependency.setFilePath(displayPath);
+324 addPomEvidence(newDependency, pom, pomProperties);
+325 engine.getDependencies().add(newDependency);
+326 Collections.sort(engine.getDependencies());
+327 } else {
+328 pom = retrievePom(path, jar);
+329 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
+330 }
+331 } catch (AnalysisException ex) {
+332 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
+333 LOGGER.log(Level.WARNING, msg);
+334 LOGGER.log(Level.FINE, "" , ex);
+335 }
+336 }
+337 return foundSomething;
+338 }
+339
+340
+341
+342
+343
+344
+345
+346
+347
+348 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
+349 justification = "The reader is closed by closing the zipEntry" )
+350 private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
+351 Properties pomProperties = null ;
+352 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
+353 final ZipEntry propEntry = jar.getEntry(propPath);
+354 if (propEntry != null ) {
+355 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
+356 pomProperties = new Properties ();
+357 pomProperties.load(reader);
+358 }
+359 return pomProperties;
+360 }
+361
+362
+363
+364
+365
+366
+367
+368
+369 private List<String> retrievePomListing(final JarFile jar) throws IOException {
+370 final List<String> pomEntries = new ArrayList<String>();
+371 final Enumeration<JarEntry> entries = jar.entries();
+372 while (entries.hasMoreElements()) {
+373 final JarEntry entry = entries.nextElement();
+374 final String entryName = (new File(entry.getName())).getName().toLowerCase();
+375 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
+376 pomEntries.add(entry.getName());
+377 }
+378 }
+379 return pomEntries;
+380 }
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391
+392 private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
+393 InputStream input = null ;
+394 FileOutputStream fos = null ;
+395 BufferedOutputStream bos = null ;
+396 final File tmpDir = getNextTempDirectory();
+397 final File file = new File(tmpDir, "pom.xml" );
+398 try {
+399 final ZipEntry entry = jar.getEntry(path);
+400 input = jar.getInputStream(entry);
+401 fos = new FileOutputStream(file);
+402 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+403 int count;
+404 final byte data[] = new byte[BUFFER_SIZE];
+405 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
+406 bos.write(data, 0, count);
+407 }
+408 bos.flush();
+409 dependency.setActualFilePath(file.getAbsolutePath());
+410 } catch (IOException ex) {
+411 final String msg = String.format("An error occured reading '%s' from '%s'." , path, dependency.getFilePath());
+412 LOGGER.warning(msg);
+413 LOGGER.log(Level.SEVERE, "" , ex);
+414 } finally {
+415 closeStream(bos);
+416 closeStream(fos);
+417 closeStream(input);
+418 }
+419 Model model = null ;
+420 FileInputStream fis = null ;
+421 try {
+422 fis = new FileInputStream(file);
+423 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
+424 final InputSource xml = new InputSource(reader);
+425 final SAXSource source = new SAXSource(xml);
+426 model = readPom(source);
+427 } catch (FileNotFoundException ex) {
+428 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
+429 LOGGER.log(Level.WARNING, msg);
+430 LOGGER.log(Level.FINE, "" , ex);
+431 throw new AnalysisException (ex);
+432 } catch (UnsupportedEncodingException ex) {
+433 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+434 LOGGER.log(Level.WARNING, msg);
+435 LOGGER.log(Level.FINE, "" , ex);
+436 throw new AnalysisException (ex);
+437 } catch (AnalysisException ex) {
+438 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
+439 LOGGER.log(Level.WARNING, msg);
+440 LOGGER.log(Level.FINE, "" , ex);
+441 throw ex;
+442 } finally {
+443 closeStream(fis);
+444 }
+445 return model;
+446 }
+447
+448
+449
+450
+451
+452
+453 private void closeStream(InputStream stream) {
+454 if (stream != null ) {
+455 try {
+456 stream.close();
+457 } catch (IOException ex) {
+458 LOGGER.log(Level.FINEST, null , ex);
+459 }
+460 }
+461 }
+462
+463
+464
+465
+466
+467
+468 private void closeStream(OutputStream stream) {
+469 if (stream != null ) {
+470 try {
+471 stream.close();
+472 } catch (IOException ex) {
+473 LOGGER.log(Level.FINEST, null , ex);
+474 }
+475 }
+476 }
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486
+487 private Model retrievePom(String path, JarFile jar) throws AnalysisException {
+488 final ZipEntry entry = jar.getEntry(path);
+489 Model model = null ;
+490 if (entry != null ) {
+491 try {
+492 final NonClosingStream stream = new NonClosingStream (jar.getInputStream(entry));
+493 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
+494 final InputSource xml = new InputSource(reader);
+495 final SAXSource source = new SAXSource(xml);
+496 model = readPom(source);
+497 } catch (SecurityException ex) {
+498 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
+499 Logger
+500 .getLogger(JarAnalyzer.class
+501 .getName()).log(Level.WARNING, msg);
+502 Logger.getLogger(JarAnalyzer.class
+503 .getName()).log(Level.FINE, null , ex);
+504 throw new AnalysisException (ex);
+505 } catch (IOException ex) {
+506 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+507 LOGGER.log(Level.WARNING, msg);
+508 LOGGER.log(Level.FINE, "" , ex);
+509 throw new AnalysisException (ex);
+510 } catch (Throwable ex) {
+511 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
+512 LOGGER.log(Level.WARNING, msg);
+513 LOGGER.log(Level.FINE, "" , ex);
+514 throw new AnalysisException (ex);
+515 }
+516 }
+517 return model;
+518 }
+519
+520
+521
+522
+523
+524
+525
+526
+527
+528 private Model readPom(SAXSource source) throws AnalysisException {
+529 Model model = null ;
+530 try {
+531 final XMLFilter filter = new MavenNamespaceFilter ();
+532 final SAXParserFactory spf = SAXParserFactory.newInstance();
+533 final SAXParser sp = spf.newSAXParser();
+534 final XMLReader xr = sp.getXMLReader();
+535 filter.setParent(xr);
+536 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
+537 model = el.getValue();
+538 } catch (SecurityException ex) {
+539 throw new AnalysisException (ex);
+540 } catch (ParserConfigurationException ex) {
+541 throw new AnalysisException (ex);
+542 } catch (SAXException ex) {
+543 throw new AnalysisException (ex);
+544 } catch (JAXBException ex) {
+545 throw new AnalysisException (ex);
+546 } catch (Throwable ex) {
+547 throw new AnalysisException (ex);
548 }
-549 String groupid = interpolateString(pom.getGroupId(), pomProperties);
-550 if (groupid != null && !groupid.isEmpty()) {
-551 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
-552 groupid = groupid.substring(4);
-553 }
-554 foundSomething = true ;
-555 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
-556 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
-557 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
-558 addMatchingValues(classes, groupid, dependency.getProductEvidence());
-559 }
-560 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
-561 if (artifactid != null && !artifactid.isEmpty()) {
-562 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
-563 artifactid = artifactid.substring(4);
-564 }
-565 foundSomething = true ;
-566 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
-567 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
-568 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
-569 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
-570 }
-571
-572 final String version = interpolateString(pom.getVersion(), pomProperties);
-573 if (version != null && !version.isEmpty()) {
-574 foundSomething = true ;
-575 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
-576 }
-577
-578 final Organization org = pom.getOrganization();
-579 if (org != null && org.getName() != null ) {
-580 foundSomething = true ;
-581 final String orgName = interpolateString(org.getName(), pomProperties);
-582 if (orgName != null && !orgName.isEmpty()) {
-583 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
-584 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
-585 }
-586 }
-587
-588 final String pomName = interpolateString(pom.getName(), pomProperties);
-589 if (pomName != null && !pomName.isEmpty()) {
-590 foundSomething = true ;
-591 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-592 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-593 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
-594 addMatchingValues(classes, pomName, dependency.getProductEvidence());
-595 }
-596
-597
-598 if (pom.getDescription() != null ) {
-599 foundSomething = true ;
-600 final String description = interpolateString(pom.getDescription(), pomProperties);
-601 if (description != null && !description.isEmpty()) {
-602 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
-603 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
-604 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
-605 }
-606 }
-607 extractLicense(pom, pomProperties, dependency);
-608 return foundSomething;
-609 }
-610
-611
-612
-613
-614
-615
-616
-617
-618
-619 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
-620 Dependency dependency, boolean addPackagesAsEvidence) {
-621 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
-622 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
-623 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
-624
-625 final int classCount = classNames.size();
-626 final EvidenceCollection vendor = dependency.getVendorEvidence();
-627 final EvidenceCollection product = dependency.getProductEvidence();
+549 return model;
+550 }
+551
+552
+553
+554
+555
+556
+557
+558
+559
+560
+561
+562 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
+563 boolean foundSomething = false;
+564 if (pom == null ) {
+565 return foundSomething;
+566 }
+567 String groupid = interpolateString(pom.getGroupId(), pomProperties);
+568 if (groupid != null && !groupid.isEmpty()) {
+569 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
+570 groupid = groupid.substring(4);
+571 }
+572 foundSomething = true ;
+573 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
+574 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+575 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
+576 addMatchingValues(classes, groupid, dependency.getProductEvidence());
+577 }
+578 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+579 if (artifactid != null && !artifactid.isEmpty()) {
+580 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
+581 artifactid = artifactid.substring(4);
+582 }
+583 foundSomething = true ;
+584 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
+585 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+586 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
+587 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
+588 }
+589
+590 final String version = interpolateString(pom.getVersion(), pomProperties);
+591 if (version != null && !version.isEmpty()) {
+592 foundSomething = true ;
+593 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+594 }
+595
+596 final Organization org = pom.getOrganization();
+597 if (org != null && org.getName() != null ) {
+598 foundSomething = true ;
+599 final String orgName = interpolateString(org.getName(), pomProperties);
+600 if (orgName != null && !orgName.isEmpty()) {
+601 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+602 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
+603 }
+604 }
+605
+606 final String pomName = interpolateString(pom.getName(), pomProperties);
+607 if (pomName != null && !pomName.isEmpty()) {
+608 foundSomething = true ;
+609 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+610 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+611 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
+612 addMatchingValues(classes, pomName, dependency.getProductEvidence());
+613 }
+614
+615
+616 if (pom.getDescription() != null ) {
+617 foundSomething = true ;
+618 final String description = interpolateString(pom.getDescription(), pomProperties);
+619 if (description != null && !description.isEmpty()) {
+620 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
+621 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
+622 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
+623 }
+624 }
+625 extractLicense(pom, pomProperties, dependency);
+626 return foundSomething;
+627 }
628
-629 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
-630 final float ratio = entry.getValue() / (float ) classCount;
-631 if (ratio > 0.5) {
-632
-633 vendor.addWeighting(entry.getKey());
-634 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
-635 vendor.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
-636 }
-637 }
-638 }
-639 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
-640 final float ratio = entry.getValue() / (float ) classCount;
-641 if (ratio > 0.5) {
-642 product.addWeighting(entry.getKey());
-643 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
-644 product.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
-645 }
-646 }
-647 }
-648 }
-649
-650
-651
-652
-653
-654
-655
-656
-657
-658
-659
-660
-661
-662
-663
-664 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
-665 boolean foundSomething = false;
-666 JarFile jar = null ;
-667 try {
-668 jar = new JarFile(dependency.getActualFilePath());
-669
-670 final Manifest manifest = jar.getManifest();
-671
-672 if (manifest == null ) {
-673
-674 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
-675 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
-676 && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
-677 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
-678 Logger.getLogger(JarAnalyzer.class
-679 .getName()).log(Level.INFO,
-680 String.format("Jar file '%s' does not contain a manifest." ,
-681 dependency.getFileName()));
-682 }
-683 return false;
-684 }
-685 final Attributes atts = manifest.getMainAttributes();
-686
-687 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
-688 final EvidenceCollection productEvidence = dependency.getProductEvidence();
-689 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
-690
-691 final String source = "Manifest" ;
-692
-693 for (Entry<Object, Object> entry : atts.entrySet()) {
-694 String key = entry.getKey().toString();
-695 String value = atts.getValue(key);
-696 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
-697 value = Jsoup.parse(value).text();
-698 }
-699 if (IGNORE_VALUES.contains(value)) {
-700 continue ;
-701 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
-702 foundSomething = true ;
-703 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
-704 addMatchingValues(classInformation, value, productEvidence);
-705 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
-706 foundSomething = true ;
-707 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
-708 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
-709 foundSomething = true ;
-710 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
-711 addMatchingValues(classInformation, value, vendorEvidence);
-712 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
-713 foundSomething = true ;
-714 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-715 addMatchingValues(classInformation, value, vendorEvidence);
-716 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
-717 foundSomething = true ;
-718 addDescription(dependency, value, "manifest" , key);
-719
-720 addMatchingValues(classInformation, value, productEvidence);
-721 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
-722 foundSomething = true ;
-723 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-724 addMatchingValues(classInformation, value, productEvidence);
-725 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
-726 foundSomething = true ;
-727 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
-728 addMatchingValues(classInformation, value, vendorEvidence);
-729 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
-730 foundSomething = true ;
-731 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
-732 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
-733 continue ;
-734
-735
-736
-737
-738
-739
-740
-741
-742 } else {
-743 key = key.toLowerCase();
-744
-745 if (!IGNORE_KEYS.contains(key)
-746 && !key.endsWith("jdk" )
-747 && !key.contains("lastmodified" )
-748 && !key.endsWith("package" )
-749 && !key.endsWith("classpath" )
-750 && !key.endsWith("class-path" )
-751 && !key.endsWith("-scm" )
-752 && !key.startsWith("scm-" )
-753 && !isImportPackage(key, value)
-754 && !isPackage(key, value)) {
-755
-756 foundSomething = true ;
-757 if (key.contains("version" )) {
-758 if (key.contains("specification" )) {
-759 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
-760 } else {
-761 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-762 }
-763 } else if ("build-id" .equals(key)) {
-764 int pos = value.indexOf('(');
-765 if (pos >= 0) {
-766 value = value.substring(0, pos - 1);
-767 }
-768 pos = value.indexOf('[');
-769 if (pos >= 0) {
-770 value = value.substring(0, pos - 1);
-771 }
-772 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-773 } else if (key.contains("title" )) {
-774 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-775 addMatchingValues(classInformation, value, productEvidence);
-776 } else if (key.contains("vendor" )) {
-777 if (key.contains("specification" )) {
-778 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
-779 } else {
-780 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-781 addMatchingValues(classInformation, value, vendorEvidence);
-782 }
-783 } else if (key.contains("name" )) {
-784 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-785 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-786 addMatchingValues(classInformation, value, vendorEvidence);
-787 addMatchingValues(classInformation, value, productEvidence);
-788 } else if (key.contains("license" )) {
-789 addLicense(dependency, value);
-790 } else {
-791 if (key.contains("description" )) {
-792 addDescription(dependency, value, "manifest" , key);
-793 } else {
-794 productEvidence.addEvidence(source, key, value, Confidence.LOW);
-795 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
-796 addMatchingValues(classInformation, value, vendorEvidence);
-797 addMatchingValues(classInformation, value, productEvidence);
-798 if (value.matches(".*\\d.*" )) {
-799 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
-800 while (tokenizer.hasMoreElements()) {
-801 final String s = tokenizer.nextToken();
-802 if (s.matches("^[0-9.]+$" )) {
-803 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
-804 }
-805 }
-806 }
-807 }
-808 }
-809 }
-810 }
-811 }
-812 } finally {
-813 if (jar != null ) {
-814 jar.close();
-815 }
-816 }
-817 return foundSomething;
-818 }
-819
-820
-821
-822
-823
-824
-825
-826
-827
-828
-829
-830
-831
-832 private String addDescription(Dependency dependency, String description, String source, String key) {
-833 if (dependency.getDescription() == null ) {
-834 dependency.setDescription(description);
-835 }
-836 String desc;
-837 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
-838 desc = Jsoup.parse(description).text();
-839 } else {
-840 desc = description;
-841 }
-842 dependency.setDescription(desc);
-843 if (desc.length() > 100) {
-844 desc = desc.replaceAll("\\s\\s+" , " " );
-845 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
-846 final int posLike = desc.toLowerCase().indexOf("like " , 100);
-847 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
-848 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
-849 int pos = -1;
-850 pos = Math.max(pos, posSuchAs);
-851 if (pos >= 0 && posLike >= 0) {
-852 pos = Math.min(pos, posLike);
-853 } else {
-854 pos = Math.max(pos, posLike);
-855 }
-856 if (pos >= 0 && posWillUse >= 0) {
-857 pos = Math.min(pos, posWillUse);
-858 } else {
-859 pos = Math.max(pos, posWillUse);
-860 }
-861 if (pos >= 0 && posUses >= 0) {
-862 pos = Math.min(pos, posUses);
-863 } else {
-864 pos = Math.max(pos, posUses);
-865 }
-866
-867 if (pos > 0) {
-868 final StringBuilder sb = new StringBuilder(pos + 3);
-869 sb.append(desc.substring(0, pos));
-870 sb.append("..." );
-871 desc = sb.toString();
-872 }
-873 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
-874 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
-875 } else {
-876 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
-877 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
-878 }
-879 return desc;
-880 }
-881
-882
-883
-884
-885
-886
-887
-888 private void addLicense(Dependency d, String license) {
-889 if (d.getLicense() == null ) {
-890 d.setLicense(license);
-891 } else if (!d.getLicense().contains(license)) {
-892 d.setLicense(d.getLicense() + NEWLINE + license);
-893 }
-894 }
-895
-896
-897
-898
-899 private File tempFileLocation = null ;
-900
-901
-902
-903
-904
+629
+630
+631
+632
+633
+634
+635
+636
+637 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
+638 Dependency dependency, boolean addPackagesAsEvidence) {
+639 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
+640 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
+641 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
+642
+643 final int classCount = classNames.size();
+644 final EvidenceCollection vendor = dependency.getVendorEvidence();
+645 final EvidenceCollection product = dependency.getProductEvidence();
+646
+647 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
+648 final float ratio = entry.getValue() / (float ) classCount;
+649 if (ratio > 0.5) {
+650
+651 vendor.addWeighting(entry.getKey());
+652 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+653 vendor.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
+654 }
+655 }
+656 }
+657 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
+658 final float ratio = entry.getValue() / (float ) classCount;
+659 if (ratio > 0.5) {
+660 product.addWeighting(entry.getKey());
+661 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+662 product.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
+663 }
+664 }
+665 }
+666 }
+667
+668
+669
+670
+671
+672
+673
+674
+675
+676
+677
+678
+679
+680
+681
+682 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
+683 boolean foundSomething = false;
+684 JarFile jar = null ;
+685 try {
+686 jar = new JarFile(dependency.getActualFilePath());
+687
+688 final Manifest manifest = jar.getManifest();
+689
+690 if (manifest == null ) {
+691
+692 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
+693 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
+694 && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
+695 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
+696 Logger.getLogger(JarAnalyzer.class
+697 .getName()).log(Level.INFO,
+698 String.format("Jar file '%s' does not contain a manifest." ,
+699 dependency.getFileName()));
+700 }
+701 return false;
+702 }
+703 final Attributes atts = manifest.getMainAttributes();
+704
+705 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
+706 final EvidenceCollection productEvidence = dependency.getProductEvidence();
+707 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
+708
+709 final String source = "Manifest" ;
+710
+711 for (Entry<Object, Object> entry : atts.entrySet()) {
+712 String key = entry.getKey().toString();
+713 String value = atts.getValue(key);
+714 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
+715 value = Jsoup.parse(value).text();
+716 }
+717 if (IGNORE_VALUES.contains(value)) {
+718 continue ;
+719 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
+720 foundSomething = true ;
+721 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
+722 addMatchingValues(classInformation, value, productEvidence);
+723 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
+724 foundSomething = true ;
+725 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+726 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
+727 foundSomething = true ;
+728 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+729 addMatchingValues(classInformation, value, vendorEvidence);
+730 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
+731 foundSomething = true ;
+732 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+733 addMatchingValues(classInformation, value, vendorEvidence);
+734 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
+735 foundSomething = true ;
+736 addDescription(dependency, value, "manifest" , key);
+737
+738 addMatchingValues(classInformation, value, productEvidence);
+739 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
+740 foundSomething = true ;
+741 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+742 addMatchingValues(classInformation, value, productEvidence);
+743 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
+744 foundSomething = true ;
+745 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+746 addMatchingValues(classInformation, value, vendorEvidence);
+747 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
+748 foundSomething = true ;
+749 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+750 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
+751 continue ;
+752
+753
+754
+755
+756
+757
+758
+759
+760 } else {
+761 key = key.toLowerCase();
+762
+763 if (!IGNORE_KEYS.contains(key)
+764 && !key.endsWith("jdk" )
+765 && !key.contains("lastmodified" )
+766 && !key.endsWith("package" )
+767 && !key.endsWith("classpath" )
+768 && !key.endsWith("class-path" )
+769 && !key.endsWith("-scm" )
+770 && !key.startsWith("scm-" )
+771 && !isImportPackage(key, value)
+772 && !isPackage(key, value)) {
+773
+774 foundSomething = true ;
+775 if (key.contains("version" )) {
+776 if (key.contains("specification" )) {
+777 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
+778 } else {
+779 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+780 }
+781 } else if ("build-id" .equals(key)) {
+782 int pos = value.indexOf('(');
+783 if (pos >= 0) {
+784 value = value.substring(0, pos - 1);
+785 }
+786 pos = value.indexOf('[');
+787 if (pos >= 0) {
+788 value = value.substring(0, pos - 1);
+789 }
+790 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+791 } else if (key.contains("title" )) {
+792 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+793 addMatchingValues(classInformation, value, productEvidence);
+794 } else if (key.contains("vendor" )) {
+795 if (key.contains("specification" )) {
+796 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+797 } else {
+798 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+799 addMatchingValues(classInformation, value, vendorEvidence);
+800 }
+801 } else if (key.contains("name" )) {
+802 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+803 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+804 addMatchingValues(classInformation, value, vendorEvidence);
+805 addMatchingValues(classInformation, value, productEvidence);
+806 } else if (key.contains("license" )) {
+807 addLicense(dependency, value);
+808 } else {
+809 if (key.contains("description" )) {
+810 addDescription(dependency, value, "manifest" , key);
+811 } else {
+812 productEvidence.addEvidence(source, key, value, Confidence.LOW);
+813 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+814 addMatchingValues(classInformation, value, vendorEvidence);
+815 addMatchingValues(classInformation, value, productEvidence);
+816 if (value.matches(".*\\d.*" )) {
+817 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
+818 while (tokenizer.hasMoreElements()) {
+819 final String s = tokenizer.nextToken();
+820 if (s.matches("^[0-9.]+$" )) {
+821 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
+822 }
+823 }
+824 }
+825 }
+826 }
+827 }
+828 }
+829 }
+830 } finally {
+831 if (jar != null ) {
+832 jar.close();
+833 }
+834 }
+835 return foundSomething;
+836 }
+837
+838
+839
+840
+841
+842
+843
+844
+845
+846
+847
+848
+849
+850 private String addDescription(Dependency dependency, String description, String source, String key) {
+851 if (dependency.getDescription() == null ) {
+852 dependency.setDescription(description);
+853 }
+854 String desc;
+855 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
+856 desc = Jsoup.parse(description).text();
+857 } else {
+858 desc = description;
+859 }
+860 dependency.setDescription(desc);
+861 if (desc.length() > 100) {
+862 desc = desc.replaceAll("\\s\\s+" , " " );
+863 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
+864 final int posLike = desc.toLowerCase().indexOf("like " , 100);
+865 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
+866 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
+867 int pos = -1;
+868 pos = Math.max(pos, posSuchAs);
+869 if (pos >= 0 && posLike >= 0) {
+870 pos = Math.min(pos, posLike);
+871 } else {
+872 pos = Math.max(pos, posLike);
+873 }
+874 if (pos >= 0 && posWillUse >= 0) {
+875 pos = Math.min(pos, posWillUse);
+876 } else {
+877 pos = Math.max(pos, posWillUse);
+878 }
+879 if (pos >= 0 && posUses >= 0) {
+880 pos = Math.min(pos, posUses);
+881 } else {
+882 pos = Math.max(pos, posUses);
+883 }
+884
+885 if (pos > 0) {
+886 final StringBuilder sb = new StringBuilder(pos + 3);
+887 sb.append(desc.substring(0, pos));
+888 sb.append("..." );
+889 desc = sb.toString();
+890 }
+891 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
+892 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
+893 } else {
+894 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
+895 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
+896 }
+897 return desc;
+898 }
+899
+900
+901
+902
+903
+904
905
-906 @Override
-907 public void initialize() throws Exception {
-908 final File baseDir = Settings.getTempDirectory();
-909 if (!baseDir.exists()) {
-910 if (!baseDir.mkdirs()) {
-911 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
-912 throw new AnalysisException (msg);
-913 }
-914 }
-915 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
-916 if (!tempFileLocation.delete()) {
-917 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
-918 throw new AnalysisException (msg);
-919 }
-920 if (!tempFileLocation.mkdirs()) {
-921 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
-922 throw new AnalysisException (msg);
-923 }
-924 }
-925
-926
-927
-928
-929 @Override
-930 public void close() {
-931 if (tempFileLocation != null && tempFileLocation.exists()) {
-932 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINE, "Attempting to delete temporary files" );
-933 final boolean success = FileUtils.delete(tempFileLocation);
-934 if (!success) {
-935 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.WARNING,
-936 "Failed to delete some temporary files, see the log for more details" );
-937 }
-938 }
-939 }
-940
-941
-942
-943
-944
-945
-946
-947
-948
-949
-950
-951
-952
-953
-954
-955
-956
-957
-958
-959
-960
-961
-962
-963
-964
-965
-966
-967
-968 protected String interpolateString(String text, Properties properties) {
-969 Properties props = properties;
-970 if (text == null ) {
-971 return text;
-972 }
-973 if (props == null ) {
-974 props = new Properties ();
-975 }
-976
-977 final int pos = text.indexOf("${" );
-978 if (pos < 0) {
-979 return text;
-980 }
-981 final int end = text.indexOf("}" );
-982 if (end < pos) {
-983 return text;
-984 }
-985
-986 final String propName = text.substring(pos + 2, end);
-987 String propValue = interpolateString(props.getProperty(propName), props);
-988 if (propValue == null ) {
-989 propValue = "" ;
+906 private void addLicense(Dependency d, String license) {
+907 if (d.getLicense() == null ) {
+908 d.setLicense(license);
+909 } else if (!d.getLicense().contains(license)) {
+910 d.setLicense(d.getLicense() + NEWLINE + license);
+911 }
+912 }
+913
+914
+915
+916
+917 private File tempFileLocation = null ;
+918
+919
+920
+921
+922
+923
+924 @Override
+925 public void initializeFileTypeAnalyzer() throws Exception {
+926 final File baseDir = Settings.getTempDirectory();
+927 if (!baseDir.exists()) {
+928 if (!baseDir.mkdirs()) {
+929 final String msg = String.format("Unable to make a temporary folder '%s'" , baseDir.getPath());
+930 throw new AnalysisException (msg);
+931 }
+932 }
+933 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+934 if (!tempFileLocation.delete()) {
+935 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
+936 throw new AnalysisException (msg);
+937 }
+938 if (!tempFileLocation.mkdirs()) {
+939 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
+940 throw new AnalysisException (msg);
+941 }
+942 }
+943
+944
+945
+946
+947 @Override
+948 public void close() {
+949 if (tempFileLocation != null && tempFileLocation.exists()) {
+950 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+951 final boolean success = FileUtils.delete(tempFileLocation);
+952 if (!success) {
+953 LOGGER.log(Level.WARNING,
+954 "Failed to delete some temporary files, see the log for more details" );
+955 }
+956 }
+957 }
+958
+959
+960
+961
+962
+963
+964
+965
+966
+967
+968
+969
+970
+971
+972
+973
+974
+975
+976
+977
+978
+979
+980
+981
+982
+983
+984
+985
+986 protected String interpolateString(String text, Properties properties) {
+987 Properties props = properties;
+988 if (text == null ) {
+989 return text;
990 }
-991 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
-992 sb.append(text.subSequence(0, pos));
-993 sb.append(propValue);
-994 sb.append(text.substring(end + 1));
-995 return interpolateString(sb.toString(), props);
-996 }
-997
-998
-999
-1000
-1001
-1002
-1003
-1004
-1005 private boolean isImportPackage(String key, String value) {
-1006 final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$" );
-1007 if (packageRx.matcher(value).matches()) {
-1008 return (key.contains("import" ) || key.contains("include" ));
-1009 }
-1010 return false;
-1011 }
-1012
-1013
-1014
-1015
-1016
-1017
-1018
-1019
-1020 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
-1021 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
-1022 JarFile jar = null ;
-1023 try {
-1024 jar = new JarFile(dependency.getActualFilePath());
-1025 final Enumeration entries = jar.entries();
-1026 while (entries.hasMoreElements()) {
-1027 final JarEntry entry = (JarEntry) entries.nextElement();
-1028 final String name = entry.getName().toLowerCase();
-1029
-1030 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
-1031 final ClassNameInformation className = new ClassNameInformation (name.substring(0, name.length() - 6));
-1032 classNames.add(className);
-1033 }
-1034 }
-1035 } catch (IOException ex) {
-1036 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
-1037 Logger
-1038 .getLogger(JarAnalyzer.class
-1039 .getName()).log(Level.WARNING, msg);
-1040 Logger.getLogger(JarAnalyzer.class
-1041 .getName()).log(Level.FINE, null , ex);
-1042 } finally {
-1043 if (jar != null ) {
-1044 try {
-1045 jar.close();
-1046 } catch (IOException ex) {
-1047 Logger.getLogger(JarAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-1048 }
-1049 }
-1050 }
-1051 return classNames;
-1052 }
-1053
-1054
-1055
-1056
-1057
-1058
-1059
-1060
-1061
-1062 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
-1063 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
-1064 for (ClassNameInformation entry : classNames) {
-1065 final ArrayList<String> list = entry.getPackageStructure();
-1066 addEntry(vendor, list.get(0));
-1067
-1068 if (list.size() == 2) {
-1069 addEntry(product, list.get(1));
-1070 }
-1071 if (list.size() == 3) {
-1072 addEntry(vendor, list.get(1));
-1073 addEntry(product, list.get(1));
-1074 addEntry(product, list.get(2));
-1075 }
-1076 if (list.size() >= 4) {
-1077 addEntry(vendor, list.get(1));
-1078 addEntry(vendor, list.get(2));
-1079 addEntry(product, list.get(1));
-1080 addEntry(product, list.get(2));
-1081 addEntry(product, list.get(3));
-1082 }
-1083 }
-1084 }
-1085
-1086
-1087
-1088
-1089
-1090
-1091
-1092
-1093 private void addEntry(HashMap<String, Integer> collection, String key) {
-1094 if (collection.containsKey(key)) {
-1095 collection.put(key, collection.get(key) + 1);
-1096 } else {
-1097 collection.put(key, 1);
-1098 }
-1099 }
-1100
-1101
-1102
-1103
-1104
+991 if (props == null ) {
+992 props = new Properties ();
+993 }
+994
+995 final int pos = text.indexOf("${" );
+996 if (pos < 0) {
+997 return text;
+998 }
+999 final int end = text.indexOf("}" );
+1000 if (end < pos) {
+1001 return text;
+1002 }
+1003
+1004 final String propName = text.substring(pos + 2, end);
+1005 String propValue = interpolateString(props.getProperty(propName), props);
+1006 if (propValue == null ) {
+1007 propValue = "" ;
+1008 }
+1009 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
+1010 sb.append(text.subSequence(0, pos));
+1011 sb.append(propValue);
+1012 sb.append(text.substring(end + 1));
+1013 return interpolateString(sb.toString(), props);
+1014 }
+1015
+1016
+1017
+1018
+1019
+1020
+1021
+1022
+1023 private boolean isImportPackage(String key, String value) {
+1024 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$" );
+1025 final boolean matches = packageRx.matcher(value).matches();
+1026 return matches && (key.contains("import" ) || key.contains("include" ) || value.length() > 10);
+1027 }
+1028
+1029
+1030
+1031
+1032
+1033
+1034
+1035
+1036 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
+1037 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
+1038 JarFile jar = null ;
+1039 try {
+1040 jar = new JarFile(dependency.getActualFilePath());
+1041 final Enumeration entries = jar.entries();
+1042 while (entries.hasMoreElements()) {
+1043 final JarEntry entry = (JarEntry) entries.nextElement();
+1044 final String name = entry.getName().toLowerCase();
+1045
+1046 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
+1047 final ClassNameInformation className = new ClassNameInformation (name.substring(0, name.length() - 6));
+1048 classNames.add(className);
+1049 }
+1050 }
+1051 } catch (IOException ex) {
+1052 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
+1053 Logger
+1054 .getLogger(JarAnalyzer.class
+1055 .getName()).log(Level.WARNING, msg);
+1056 Logger.getLogger(JarAnalyzer.class
+1057 .getName()).log(Level.FINE, null , ex);
+1058 } finally {
+1059 if (jar != null ) {
+1060 try {
+1061 jar.close();
+1062 } catch (IOException ex) {
+1063 LOGGER.log(Level.FINEST, null , ex);
+1064 }
+1065 }
+1066 }
+1067 return classNames;
+1068 }
+1069
+1070
+1071
+1072
+1073
+1074
+1075
+1076
+1077
+1078 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
+1079 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
+1080 for (ClassNameInformation entry : classNames) {
+1081 final ArrayList<String> list = entry.getPackageStructure();
+1082 addEntry(vendor, list.get(0));
+1083
+1084 if (list.size() == 2) {
+1085 addEntry(product, list.get(1));
+1086 }
+1087 if (list.size() == 3) {
+1088 addEntry(vendor, list.get(1));
+1089 addEntry(product, list.get(1));
+1090 addEntry(product, list.get(2));
+1091 }
+1092 if (list.size() >= 4) {
+1093 addEntry(vendor, list.get(1));
+1094 addEntry(vendor, list.get(2));
+1095 addEntry(product, list.get(1));
+1096 addEntry(product, list.get(2));
+1097 addEntry(product, list.get(3));
+1098 }
+1099 }
+1100 }
+1101
+1102
+1103
+1104
1105
-1106
-1107
-1108
-1109
-1110 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
-1111 if (value == null || value.isEmpty()) {
-1112 return ;
-1113 }
-1114 final String text = value.toLowerCase();
-1115 for (ClassNameInformation cni : classes) {
-1116 for (String key : cni.getPackageStructure()) {
-1117 if (text.contains(key)) {
-1118 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
-1119 }
-1120 }
-1121 }
-1122 }
-1123
-1124
-1125
-1126
-1127
-1128
-1129
-1130
-1131 private boolean isPackage(String key, String value) {
-1132
-1133 return !key.matches(".*(version|title|vendor|name|license|description).*" )
-1134 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
-1135
-1136 }
-1137
-1138
-1139
-1140
-1141
-1142
-1143
-1144
-1145
-1146 private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) {
-1147 if (pom == null ) {
-1148 return ;
-1149 }
-1150 String groupid = interpolateString(pom.getGroupId(), pomProperties);
-1151 if (groupid != null && !groupid.isEmpty()) {
-1152 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
-1153 groupid = groupid.substring(4);
-1154 }
-1155 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
-1156 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
-1157 }
-1158 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
-1159 if (artifactid != null && !artifactid.isEmpty()) {
-1160 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
-1161 artifactid = artifactid.substring(4);
-1162 }
-1163 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
-1164 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+1106
+1107
+1108
+1109 private void addEntry(HashMap<String, Integer> collection, String key) {
+1110 if (collection.containsKey(key)) {
+1111 collection.put(key, collection.get(key) + 1);
+1112 } else {
+1113 collection.put(key, 1);
+1114 }
+1115 }
+1116
+1117
+1118
+1119
+1120
+1121
+1122
+1123
+1124
+1125
+1126 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
+1127 if (value == null || value.isEmpty()) {
+1128 return ;
+1129 }
+1130 final String text = value.toLowerCase();
+1131 for (ClassNameInformation cni : classes) {
+1132 for (String key : cni.getPackageStructure()) {
+1133 if (text.contains(key)) {
+1134 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
+1135 }
+1136 }
+1137 }
+1138 }
+1139
+1140
+1141
+1142
+1143
+1144
+1145
+1146
+1147 private boolean isPackage(String key, String value) {
+1148
+1149 return !key.matches(".*(version|title|vendor|name|license|description).*" )
+1150 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
+1151
+1152 }
+1153
+1154
+1155
+1156
+1157
+1158
+1159
+1160
+1161
+1162 private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) {
+1163 if (pom == null ) {
+1164 return ;
1165 }
-1166 final String version = interpolateString(pom.getVersion(), pomProperties);
-1167 if (version != null && !version.isEmpty()) {
-1168 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
-1169 }
-1170
-1171 final Parent parent = pom.getParent();
-1172 if (parent != null ) {
-1173 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
-1174 if (parentGroupId != null && !parentGroupId.isEmpty()) {
-1175 if (groupid == null || groupid.isEmpty()) {
-1176 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.HIGH);
-1177 } else {
-1178 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.MEDIUM);
-1179 }
-1180 dependency.getProductEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.LOW);
-1181 }
-1182 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
-1183 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
-1184 if (artifactid == null || artifactid.isEmpty()) {
-1185 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.HIGH);
-1186 } else {
-1187 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.MEDIUM);
-1188 }
-1189 dependency.getVendorEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.LOW);
-1190 }
-1191 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
-1192 if (parentVersion != null && !parentVersion.isEmpty()) {
-1193 if (version == null || version.isEmpty()) {
-1194 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.HIGH);
-1195 } else {
-1196 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.LOW);
-1197 }
-1198 }
-1199 }
-1200
-1201 final Organization org = pom.getOrganization();
-1202 if (org != null && org.getName() != null ) {
-1203 final String orgName = interpolateString(org.getName(), pomProperties);
-1204 if (orgName != null && !orgName.isEmpty()) {
-1205 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+1166 String groupid = interpolateString(pom.getGroupId(), pomProperties);
+1167 if (groupid != null && !groupid.isEmpty()) {
+1168 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
+1169 groupid = groupid.substring(4);
+1170 }
+1171 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
+1172 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+1173 }
+1174 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+1175 if (artifactid != null && !artifactid.isEmpty()) {
+1176 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
+1177 artifactid = artifactid.substring(4);
+1178 }
+1179 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
+1180 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+1181 }
+1182 final String version = interpolateString(pom.getVersion(), pomProperties);
+1183 if (version != null && !version.isEmpty()) {
+1184 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+1185 }
+1186
+1187 final Parent parent = pom.getParent();
+1188 if (parent != null ) {
+1189 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
+1190 if (parentGroupId != null && !parentGroupId.isEmpty()) {
+1191 if (groupid == null || groupid.isEmpty()) {
+1192 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.HIGH);
+1193 } else {
+1194 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.MEDIUM);
+1195 }
+1196 dependency.getProductEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.LOW);
+1197 }
+1198 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
+1199 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
+1200 if (artifactid == null || artifactid.isEmpty()) {
+1201 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.HIGH);
+1202 } else {
+1203 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.MEDIUM);
+1204 }
+1205 dependency.getVendorEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.LOW);
1206 }
-1207 }
-1208
-1209 final String pomName = interpolateString(pom.getName(), pomProperties);
-1210 if (pomName != null && !pomName.isEmpty()) {
-1211 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-1212 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-1213 }
-1214
-1215
-1216 if (pom.getDescription() != null ) {
-1217 final String description = interpolateString(pom.getDescription(), pomProperties);
-1218 if (description != null && !description.isEmpty()) {
-1219 addDescription(dependency, description, "pom" , "description" );
-1220 }
-1221 }
-1222 extractLicense(pom, pomProperties, dependency);
-1223 }
-1224
-1225
-1226
-1227
-1228
-1229
-1230
-1231
-1232 private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
-1233
-1234 if (pom.getLicenses() != null ) {
-1235 String license = null ;
-1236 for (License lic : pom.getLicenses().getLicense()) {
-1237 String tmp = null ;
-1238 if (lic.getName() != null ) {
-1239 tmp = interpolateString(lic.getName(), pomProperties);
-1240 }
-1241 if (lic.getUrl() != null ) {
-1242 if (tmp == null ) {
-1243 tmp = interpolateString(lic.getUrl(), pomProperties);
-1244 } else {
-1245 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
-1246 }
-1247 }
-1248 if (tmp == null ) {
-1249 continue ;
-1250 }
-1251 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
-1252 tmp = Jsoup.parse(tmp).text();
-1253 }
-1254 if (license == null ) {
-1255 license = tmp;
-1256 } else {
-1257 license += "\n" + tmp;
-1258 }
-1259 }
-1260 if (license != null ) {
-1261 dependency.setLicense(license);
-1262 }
-1263 }
-1264 }
-1265
-1266
-1267
-1268
-1269 protected static class ClassNameInformation {
-1270
-1271
-1272
-1273
-1274
-1275
-1276
-1277
-1278
-1279
-1280
-1281
-1282
-1283
-1284
-1285
-1286
-1287
-1288
-1289
-1290
-1291 ClassNameInformation (String className) {
-1292 name = className;
-1293 if (name.contains("/" )) {
-1294 final String[] tmp = className.toLowerCase().split("/" );
-1295 int start = 0;
-1296 int end = 3;
-1297 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
-1298 start = 1;
-1299 end = 4;
-1300 }
-1301 if (tmp.length <= end) {
-1302 end = tmp.length - 1;
-1303 }
-1304 for (int i = start; i <= end; i++) {
-1305 packageStructure.add(tmp[i]);
-1306 }
-1307 } else {
-1308 packageStructure.add(name);
-1309 }
-1310 }
-1311
-1312
-1313
-1314 private String name;
-1315
-1316
-1317
-1318
-1319
-1320
-1321 public String getName() {
-1322 return name;
-1323 }
-1324
-1325
-1326
-1327
-1328
+1207 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
+1208 if (parentVersion != null && !parentVersion.isEmpty()) {
+1209 if (version == null || version.isEmpty()) {
+1210 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.HIGH);
+1211 } else {
+1212 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.LOW);
+1213 }
+1214 }
+1215 }
+1216
+1217 final Organization org = pom.getOrganization();
+1218 if (org != null && org.getName() != null ) {
+1219 final String orgName = interpolateString(org.getName(), pomProperties);
+1220 if (orgName != null && !orgName.isEmpty()) {
+1221 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+1222 }
+1223 }
+1224
+1225 final String pomName = interpolateString(pom.getName(), pomProperties);
+1226 if (pomName != null && !pomName.isEmpty()) {
+1227 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+1228 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+1229 }
+1230
+1231
+1232 if (pom.getDescription() != null ) {
+1233 final String description = interpolateString(pom.getDescription(), pomProperties);
+1234 if (description != null && !description.isEmpty()) {
+1235 addDescription(dependency, description, "pom" , "description" );
+1236 }
+1237 }
+1238 extractLicense(pom, pomProperties, dependency);
+1239 }
+1240
+1241
+1242
+1243
+1244
+1245
+1246
+1247
+1248 private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
+1249
+1250 if (pom.getLicenses() != null ) {
+1251 String license = null ;
+1252 for (License lic : pom.getLicenses().getLicense()) {
+1253 String tmp = null ;
+1254 if (lic.getName() != null ) {
+1255 tmp = interpolateString(lic.getName(), pomProperties);
+1256 }
+1257 if (lic.getUrl() != null ) {
+1258 if (tmp == null ) {
+1259 tmp = interpolateString(lic.getUrl(), pomProperties);
+1260 } else {
+1261 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
+1262 }
+1263 }
+1264 if (tmp == null ) {
+1265 continue ;
+1266 }
+1267 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
+1268 tmp = Jsoup.parse(tmp).text();
+1269 }
+1270 if (license == null ) {
+1271 license = tmp;
+1272 } else {
+1273 license += "\n" + tmp;
+1274 }
+1275 }
+1276 if (license != null ) {
+1277 dependency.setLicense(license);
+1278 }
+1279 }
+1280 }
+1281
+1282
+1283
+1284
+1285 protected static class ClassNameInformation {
+1286
+1287
+1288
+1289
+1290
+1291
+1292
+1293
+1294
+1295
+1296
+1297
+1298
+1299
+1300
+1301
+1302
+1303
+1304
+1305
+1306
+1307 ClassNameInformation (String className) {
+1308 name = className;
+1309 if (name.contains("/" )) {
+1310 final String[] tmp = className.toLowerCase().split("/" );
+1311 int start = 0;
+1312 int end = 3;
+1313 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
+1314 start = 1;
+1315 end = 4;
+1316 }
+1317 if (tmp.length <= end) {
+1318 end = tmp.length - 1;
+1319 }
+1320 for (int i = start; i <= end; i++) {
+1321 packageStructure.add(tmp[i]);
+1322 }
+1323 } else {
+1324 packageStructure.add(name);
+1325 }
+1326 }
+1327
+1328
1329
-1330 public void setName(String name) {
-1331 this .name = name;
-1332 }
-1333
-1334
-1335
-1336 private final ArrayList<String> packageStructure = new ArrayList<String>();
-1337
-1338
-1339
-1340
-1341
-1342
-1343 public ArrayList<String> getPackageStructure() {
-1344 return packageStructure;
-1345 }
-1346 }
-1347
-1348
-1349
-1350
-1351
-1352
-1353
-1354 private File getNextTempDirectory() throws AnalysisException {
-1355 dirCount += 1;
-1356 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
-1357
-1358 if (directory.exists()) {
-1359 return getNextTempDirectory();
-1360 }
-1361 if (!directory.mkdirs()) {
-1362 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
-1363 throw new AnalysisException (msg);
-1364 }
-1365 return directory;
-1366 }
-1367 }
+1330 private String name;
+1331
+1332
+1333
+1334
+1335
+1336
+1337 public String getName() {
+1338 return name;
+1339 }
+1340
+1341
+1342
+1343
+1344
+1345
+1346 public void setName(String name) {
+1347 this .name = name;
+1348 }
+1349
+1350
+1351
+1352 private final ArrayList<String> packageStructure = new ArrayList<String>();
+1353
+1354
+1355
+1356
+1357
+1358
+1359 public ArrayList<String> getPackageStructure() {
+1360 return packageStructure;
+1361 }
+1362 }
+1363
+1364
+1365
+1366
+1367
+1368
+1369
+1370 private File getNextTempDirectory() throws AnalysisException {
+1371 dirCount += 1;
+1372 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+1373
+1374 if (directory.exists()) {
+1375 return getNextTempDirectory();
+1376 }
+1377 if (!directory.mkdirs()) {
+1378 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+1379 throw new AnalysisException (msg);
+1380 }
+1381 return directory;
+1382 }
+1383 }
29 import org.owasp.dependencycheck.Engine;
30 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
31 import org.owasp.dependencycheck.dependency.Dependency;
-32
-33
-34
-35
-36
-37
-38
-39 public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
-40
-41
+32 import org.owasp.dependencycheck.utils.Settings;
+33
+34
+35
+36
+37
+38
+39
+40 public class JavaScriptAnalyzer extends AbstractFileTypeAnalyzer {
+41
42
-43
+43
44
-45 private static final String ANALYZER_NAME = "JavaScript Analyzer" ;
-46
-47
-48
-49 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-50
-51
-52
-53 private static final Set<String> EXTENSIONS = newHashSet("js" );
-54
-55
-56
-57
-58
-59
-60 @Override
-61 public Set<String> getSupportedExtensions() {
-62 return EXTENSIONS;
-63 }
-64
-65
-66
-67
-68
-69
-70 @Override
-71 public String getName() {
-72 return ANALYZER_NAME;
-73 }
-74
-75
-76
-77
-78
-79
-80
-81 @Override
-82 public boolean supportsExtension(String extension) {
-83 return EXTENSIONS.contains(extension);
-84 }
-85
-86
-87
-88
-89
-90
-91 @Override
-92 public AnalysisPhase getAnalysisPhase() {
-93 return ANALYSIS_PHASE;
-94 }
-95
-96
-97
-98
-99
-100
-101
-102
-103
-104 @Override
-105 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-106 BufferedReader fin = null ;;
-107 try {
-108
-109 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)" , Pattern.MULTILINE);
-110 File file = dependency.getActualFile();
-111 fin = new BufferedReader(new FileReader(file));
-112 StringBuilder sb = new StringBuilder(2000);
-113 String text;
-114 while ((text = fin.readLine()) != null ) {
-115 sb.append(text);
-116 }
-117 } catch (FileNotFoundException ex) {
-118 final String msg = String.format("Dependency file not found: '%s'" , dependency.getActualFilePath());
-119 throw new AnalysisException (msg, ex);
-120 } catch (IOException ex) {
-121 Logger.getLogger(JavaScriptAnalyzer.class .getName()).log(Level.SEVERE, null , ex);
-122 } finally {
-123 if (fin != null ) {
-124 try {
-125 fin.close();
-126 } catch (IOException ex) {
-127 Logger.getLogger(JavaScriptAnalyzer.class .getName()).log(Level.FINEST, null , ex);
-128 }
-129 }
-130 }
-131 }
-132 }
+45 private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class .getName());
+46
+47
+48
+49
+50
+51 private static final String ANALYZER_NAME = "JavaScript Analyzer" ;
+52
+53
+54
+55 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+56
+57
+58
+59 private static final Set<String> EXTENSIONS = newHashSet("js" );
+60
+61
+62
+63
+64
+65
+66 @Override
+67 public Set<String> getSupportedExtensions() {
+68 return EXTENSIONS;
+69 }
+70
+71
+72
+73
+74
+75
+76 @Override
+77 public String getName() {
+78 return ANALYZER_NAME;
+79 }
+80
+81
+82
+83
+84
+85
+86 @Override
+87 public AnalysisPhase getAnalysisPhase() {
+88 return ANALYSIS_PHASE;
+89 }
+90
+91
+92
+93
+94
+95
+96 @Override
+97 protected String getAnalyzerEnabledSettingKey() {
+98 return Settings.KEYS.ANALYZER_JAVASCRIPT_ENABLED;
+99 }
+100
+101
+102
+103
+104
+105
+106
+107
+108 @Override
+109 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+110 BufferedReader fin = null ;;
+111 try {
+112
+113 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)" , Pattern.MULTILINE);
+114 File file = dependency.getActualFile();
+115 fin = new BufferedReader(new FileReader(file));
+116 StringBuilder sb = new StringBuilder(2000);
+117 String text;
+118 while ((text = fin.readLine()) != null ) {
+119 sb.append(text);
+120 }
+121 } catch (FileNotFoundException ex) {
+122 final String msg = String.format("Dependency file not found: '%s'" , dependency.getActualFilePath());
+123 throw new AnalysisException (msg, ex);
+124 } catch (IOException ex) {
+125 LOGGER.log(Level.SEVERE, null , ex);
+126 } finally {
+127 if (fin != null ) {
+128 try {
+129 fin.close();
+130 } catch (IOException ex) {
+131 LOGGER.log(Level.FINEST, null , ex);
+132 }
+133 }
+134 }
+135 }
+136
+137 @Override
+138 protected void initializeFileTypeAnalyzer() throws Exception {
+139
+140 }
+141 }
46
47
48
-49 public class NexusAnalyzer extends AbstractAnalyzer {
+49 public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
50
51
-52
+52
53
54 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
55
56
-57
+57
58
59 private static final String ANALYZER_NAME = "Nexus Analyzer" ;
60
61
-62
+62
63
64 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
65
@@ -77,127 +77,113 @@
69 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
70
71
-72
+72
73
-74 private boolean enabled = false;
+74 private NexusSearch searcher;
75
76
-77
-78
-79 private NexusSearch searcher;
-80
-81
-82
-83
-84
-85
-86 @Override
-87 public void initialize() throws Exception {
-88 enabled = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED);
-89 LOGGER.fine("Initializing Nexus Analyzer" );
-90 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , enabled));
-91 if (enabled) {
-92 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
-93 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
-94 try {
-95 searcher = new NexusSearch (new URL(searchUrl));
-96 if (!searcher.preflightRequest()) {
-97 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
-98 enabled = false;
-99 }
-100 } catch (MalformedURLException mue) {
-101
-102
-103 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
-104 enabled = false;
-105 }
-106 }
-107 }
-108
-109
-110
-111
-112
-113
-114 @Override
-115 public String getName() {
-116 return ANALYZER_NAME;
-117 }
-118
-119
-120
-121
-122
-123
-124 @Override
-125 public AnalysisPhase getAnalysisPhase() {
-126 return ANALYSIS_PHASE;
-127 }
-128
-129
-130
-131
-132
-133
-134 @Override
-135 public Set<String> getSupportedExtensions() {
-136 return SUPPORTED_EXTENSIONS;
-137 }
-138
-139
-140
-141
-142
-143
-144
-145 @Override
-146 public boolean supportsExtension(String extension) {
-147 return SUPPORTED_EXTENSIONS.contains(extension);
-148 }
-149
-150
-151
-152
-153
-154
-155
-156
-157 @Override
-158 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-159
-160 if (!enabled) {
-161 return ;
-162 }
-163
-164 try {
-165 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
-166 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
-167 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
-168 }
-169 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
-170 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
-171 }
-172 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
-173 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
-174 }
-175 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
-176 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
-177 }
-178 } catch (IllegalArgumentException iae) {
-179
-180 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
-181 } catch (FileNotFoundException fnfe) {
-182
-183 LOGGER.fine(String.format("Artificat not found in repository '%s'" , dependency.getFileName()));
-184 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
-185 } catch (IOException ioe) {
-186
-187 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
-188 }
-189 }
-190 }
-191
-192
+77
+78
+79
+80
+81 @Override
+82 public void initializeFileTypeAnalyzer() throws Exception {
+83 LOGGER.fine("Initializing Nexus Analyzer" );
+84 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , isEnabled()));
+85 if (isEnabled()) {
+86 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+87 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
+88 try {
+89 searcher = new NexusSearch (new URL(searchUrl));
+90 if (!searcher.preflightRequest()) {
+91 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
+92 setEnabled(false);
+93 }
+94 } catch (MalformedURLException mue) {
+95
+96
+97 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
+98 setEnabled(false);
+99 }
+100 }
+101 }
+102
+103
+104
+105
+106
+107
+108 @Override
+109 public String getName() {
+110 return ANALYZER_NAME;
+111 }
+112
+113
+114
+115
+116
+117
+118 @Override
+119 protected String getAnalyzerEnabledSettingKey() {
+120 return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
+121 }
+122
+123
+124
+125
+126
+127
+128 @Override
+129 public AnalysisPhase getAnalysisPhase() {
+130 return ANALYSIS_PHASE;
+131 }
+132
+133
+134
+135
+136
+137
+138 @Override
+139 public Set<String> getSupportedExtensions() {
+140 return SUPPORTED_EXTENSIONS;
+141 }
+142
+143
+144
+145
+146
+147
+148
+149
+150 @Override
+151 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+152 try {
+153 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
+154 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
+155 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
+156 }
+157 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
+158 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
+159 }
+160 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
+161 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
+162 }
+163 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
+164 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
+165 }
+166 } catch (IllegalArgumentException iae) {
+167
+168 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
+169 } catch (FileNotFoundException fnfe) {
+170
+171 LOGGER.fine(String.format("Artificat not found in repository '%s'" , dependency.getFileName()));
+172 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
+173 } catch (IOException ioe) {
+174
+175 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
+176 }
+177 }
+178 }
18 package org.owasp.dependencycheck.analyzer;
19
20 import java.io.FileInputStream;
-21 import java.util.Set;
-22 import java.util.logging.Level;
-23 import java.util.logging.Logger;
-24 import org.owasp.dependencycheck.Engine;
-25 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-26 import org.owasp.dependencycheck.data.nuget.NugetPackage;
-27 import org.owasp.dependencycheck.data.nuget.NuspecParser;
-28 import org.owasp.dependencycheck.data.nuget.XPathNuspecParser;
-29 import org.owasp.dependencycheck.dependency.Confidence;
-30 import org.owasp.dependencycheck.dependency.Dependency;
-31
-32
-33
-34
-35
-36
-37 public class NuspecAnalyzer extends AbstractAnalyzer {
-38
-39
-40
-41
-42 private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class .getName());
-43
-44
-45
-46
-47 private static final String ANALYZER_NAME = "Nuspec Analyzer" ;
-48
-49
-50
-51
-52 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-53
-54
-55
-56
-57 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec" );
-58
-59
-60
-61
-62
-63
-64 @Override
-65 public void initialize() throws Exception {
-66 }
-67
-68
-69
-70
-71
-72
-73 @Override
-74 public String getName() {
-75 return ANALYZER_NAME;
-76 }
-77
-78
-79
-80
-81
-82
-83 @Override
-84 public AnalysisPhase getAnalysisPhase() {
-85 return ANALYSIS_PHASE;
-86 }
-87
-88
-89
-90
-91
-92
-93 @Override
-94 public Set<String> getSupportedExtensions() {
-95 return SUPPORTED_EXTENSIONS;
-96 }
-97
-98
-99
-100
-101
-102
-103
-104 @Override
-105 public boolean supportsExtension(String extension) {
-106 return SUPPORTED_EXTENSIONS.contains(extension);
-107 }
-108
-109
-110
-111
-112
-113
-114
-115
-116 @Override
-117 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-118 LOGGER.log(Level.INFO, "Checking Nuspec file {0}" , dependency.toString());
-119 try {
-120 final NuspecParser parser = new XPathNuspecParser ();
-121 NugetPackage np = null ;
-122 FileInputStream fis = null ;
-123 try {
-124 fis = new FileInputStream(dependency.getActualFilePath());
-125 np = parser.parse(fis);
-126 } finally {
-127 if (fis != null ) {
-128 try {
-129 fis.close();
-130 } catch (Throwable e) {
-131 LOGGER.fine("Error closing input stream" );
-132 }
-133 }
-134 }
-135
-136 if (np.getOwners() != null ) {
-137 dependency.getVendorEvidence().addEvidence("nuspec" , "owners" , np.getOwners(), Confidence.HIGHEST);
-138 }
-139 dependency.getVendorEvidence().addEvidence("nuspec" , "authors" , np.getAuthors(), Confidence.HIGH);
-140 dependency.getVersionEvidence().addEvidence("nuspec" , "version" , np.getVersion(), Confidence.HIGHEST);
-141 dependency.getProductEvidence().addEvidence("nuspec" , "id" , np.getId(), Confidence.HIGHEST);
-142 if (np.getTitle() != null ) {
-143 dependency.getProductEvidence().addEvidence("nuspec" , "title" , np.getTitle(), Confidence.MEDIUM);
-144 }
-145 } catch (Throwable e) {
-146 throw new AnalysisException (e);
-147 }
-148 }
-149 }
-150
-151
+21 import java.io.FileNotFoundException;
+22 import java.io.IOException;
+23 import java.util.Set;
+24 import java.util.logging.Level;
+25 import java.util.logging.Logger;
+26 import org.owasp.dependencycheck.Engine;
+27 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+28 import org.owasp.dependencycheck.data.nuget.NugetPackage;
+29 import org.owasp.dependencycheck.data.nuget.NuspecParseException;
+30 import org.owasp.dependencycheck.data.nuget.NuspecParser;
+31 import org.owasp.dependencycheck.data.nuget.XPathNuspecParser;
+32 import org.owasp.dependencycheck.dependency.Confidence;
+33 import org.owasp.dependencycheck.dependency.Dependency;
+34 import org.owasp.dependencycheck.utils.Settings;
+35
+36
+37
+38
+39
+40
+41 public class NuspecAnalyzer extends AbstractFileTypeAnalyzer {
+42
+43
+44
+45
+46 private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class .getName());
+47
+48
+49
+50
+51 private static final String ANALYZER_NAME = "Nuspec Analyzer" ;
+52
+53
+54
+55
+56 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+57
+58
+59
+60
+61 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec" );
+62
+63
+64
+65
+66
+67
+68 @Override
+69 public void initializeFileTypeAnalyzer() throws Exception {
+70 }
+71
+72
+73
+74
+75
+76
+77 @Override
+78 public String getName() {
+79 return ANALYZER_NAME;
+80 }
+81
+82
+83
+84
+85
+86
+87 @Override
+88 protected String getAnalyzerEnabledSettingKey() {
+89 return Settings.KEYS.ANALYZER_NUSPEC_ENABLED;
+90 }
+91
+92
+93
+94
+95
+96
+97 @Override
+98 public AnalysisPhase getAnalysisPhase() {
+99 return ANALYSIS_PHASE;
+100 }
+101
+102
+103
+104
+105
+106
+107 @Override
+108 public Set<String> getSupportedExtensions() {
+109 return SUPPORTED_EXTENSIONS;
+110 }
+111
+112
+113
+114
+115
+116
+117
+118
+119 @Override
+120 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+121 LOGGER.log(Level.FINE, "Checking Nuspec file {0}" , dependency.toString());
+122 try {
+123 final NuspecParser parser = new XPathNuspecParser ();
+124 NugetPackage np = null ;
+125 FileInputStream fis = null ;
+126 try {
+127 fis = new FileInputStream(dependency.getActualFilePath());
+128 np = parser.parse(fis);
+129 } catch (NuspecParseException ex) {
+130 throw new AnalysisException (ex);
+131 } catch (FileNotFoundException ex) {
+132 throw new AnalysisException (ex);
+133 } finally {
+134 if (fis != null ) {
+135 try {
+136 fis.close();
+137 } catch (IOException e) {
+138 LOGGER.fine("Error closing input stream" );
+139 }
+140 }
+141 }
+142
+143 if (np.getOwners() != null ) {
+144 dependency.getVendorEvidence().addEvidence("nuspec" , "owners" , np.getOwners(), Confidence.HIGHEST);
+145 }
+146 dependency.getVendorEvidence().addEvidence("nuspec" , "authors" , np.getAuthors(), Confidence.HIGH);
+147 dependency.getVersionEvidence().addEvidence("nuspec" , "version" , np.getVersion(), Confidence.HIGHEST);
+148 dependency.getProductEvidence().addEvidence("nuspec" , "id" , np.getId(), Confidence.HIGHEST);
+149 if (np.getTitle() != null ) {
+150 dependency.getProductEvidence().addEvidence("nuspec" , "title" , np.getTitle(), Confidence.MEDIUM);
+151 }
+152 } catch (Throwable e) {
+153 throw new AnalysisException (e);
+154 }
+155 }
+156 }
17
18 package org.owasp.dependencycheck.analyzer;
19
-20 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-21 import java.io.IOException;
-22 import java.sql.SQLException;
-23 import java.util.List;
-24 import java.util.Set;
-25 import org.owasp.dependencycheck.Engine;
-26 import org.owasp.dependencycheck.data.nvdcve.CveDB;
-27 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
-28 import org.owasp.dependencycheck.dependency.Dependency;
-29 import org.owasp.dependencycheck.dependency.Identifier;
-30 import org.owasp.dependencycheck.dependency.Vulnerability;
-31
-32
-33
-34
-35
-36
-37
-38 public class NvdCveAnalyzer implements Analyzer {
-39
-40
-41
-42
-43 static final int MAX_QUERY_RESULTS = 100;
-44
-45
-46
-47 private CveDB cveDB;
-48
-49
-50
-51
-52
-53
-54
-55
-56
-57 public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException {
-58 cveDB = new CveDB ();
-59 cveDB.open();
-60 }
-61
-62
-63
-64
+20 import java.io.IOException;
+21 import java.sql.SQLException;
+22 import java.util.List;
+23 import org.owasp.dependencycheck.Engine;
+24 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+25 import org.owasp.dependencycheck.data.nvdcve.CveDB;
+26 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+27 import org.owasp.dependencycheck.dependency.Dependency;
+28 import org.owasp.dependencycheck.dependency.Identifier;
+29 import org.owasp.dependencycheck.dependency.Vulnerability;
+30
+31
+32
+33
+34
+35
+36
+37 public class NvdCveAnalyzer implements Analyzer {
+38
+39
+40
+41
+42 static final int MAX_QUERY_RESULTS = 100;
+43
+44
+45
+46 private CveDB cveDB;
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56 public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException {
+57 cveDB = new CveDB ();
+58 cveDB.open();
+59 }
+60
+61
+62
+63
+64 @Override
65 public void close() {
66 cveDB.close();
67 cveDB = null ;
@@ -104,66 +104,51 @@
96
97
98
-99 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-100 for (Identifier id : dependency.getIdentifiers()) {
-101 if ("cpe" .equals(id.getType())) {
-102 try {
-103 final String value = id.getValue();
-104 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
-105 dependency.getVulnerabilities().addAll(vulns);
-106 } catch (DatabaseException ex) {
-107 throw new AnalysisException (ex);
-108 }
-109 }
-110 }
-111 }
-112
-113
-114
-115
-116
-117
-118 public Set<String> getSupportedExtensions() {
-119 return null ;
-120 }
-121
-122
-123
-124
-125
-126
-127 public String getName() {
-128 return "NVD CVE Analyzer" ;
-129 }
-130
-131
-132
-133
-134
-135
-136
-137 public boolean supportsExtension(String extension) {
-138 return true ;
-139 }
-140
-141
-142
-143
-144
-145
-146 public AnalysisPhase getAnalysisPhase() {
-147 return AnalysisPhase.FINDING_ANALYSIS;
-148 }
-149
-150
-151
-152
-153
-154
-155 public void initialize() throws Exception {
-156 this .open();
-157 }
-158 }
+99 @Override
+100 public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+101 for (Identifier id : dependency.getIdentifiers()) {
+102 if ("cpe" .equals(id.getType())) {
+103 try {
+104 final String value = id.getValue();
+105 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
+106 dependency.getVulnerabilities().addAll(vulns);
+107 } catch (DatabaseException ex) {
+108 throw new AnalysisException (ex);
+109 }
+110 }
+111 }
+112 }
+113
+114
+115
+116
+117
+118
+119 @Override
+120 public String getName() {
+121 return "NVD CVE Analyzer" ;
+122 }
+123
+124
+125
+126
+127
+128
+129 @Override
+130 public AnalysisPhase getAnalysisPhase() {
+131 return AnalysisPhase.FINDING_ANALYSIS;
+132 }
+133
+134
+135
+136
+137
+138
+139 @Override
+140 public void initialize() throws Exception {
+141 this .open();
+142 }
+143 }
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.analyzer.exception
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer.exception
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.analyzer.exception
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer.exception
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer
AbstractAnalyzer
+
+
+ AbstractFileTypeAnalyzer
AbstractSuppressionAnalyzer
@@ -53,6 +56,9 @@
FileNameAnalyzer
+
+
+ FileTypeAnalyzer
HintAnalyzer
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html
index d6f9a1795..3766e6d54 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer
AbstractAnalyzer
+
+
+
+ AbstractFileTypeAnalyzer
+
@@ -99,6 +104,11 @@
FileNameAnalyzer
+
+
+
+ FileTypeAnalyzer
+
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html
index a21a6a231..7b19902cb 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.exception
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.exception
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.exception
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.exception
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.task
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.task
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.task
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.task
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.xml
106
107
108
-109
+109
110
111 public String getFileName() {
112 return this .fileName;
113 }
114
115
-116
-117
-118
-119
-120 public void setFileName(String fileName) {
-121 this .fileName = fileName;
-122 }
-123
-124
-125
-126
-127
-128
-129 public void setActualFilePath(String actualFilePath) {
-130 this .actualFilePath = actualFilePath;
-131 if (this .sha1sum == null ) {
-132 final File file = new File(this .actualFilePath);
-133 determineHashes(file);
-134 }
-135 }
-136
-137
-138
-139
-140
-141
-142 public String getActualFilePath() {
-143 return this .actualFilePath;
-144 }
-145
-146
-147
-148
-149
-150
-151 public File getActualFile() {
-152 return new File(this .actualFilePath);
-153 }
-154
-155
-156
-157
-158
-159
-160 public void setFilePath(String filePath) {
-161 this .filePath = filePath;
-162 }
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173 public String getFilePath() {
-174 return this .filePath;
-175 }
-176
-177
-178
-179
-180
-181
-182 public void setFileExtension(String fileExtension) {
-183 this .fileExtension = fileExtension;
-184 }
-185
-186
-187
-188
-189
-190
-191 public String getFileExtension() {
-192 return this .fileExtension;
-193 }
-194
-195
-196
-197
-198
-199
-200 public String getMd5sum() {
-201 return this .md5sum;
-202 }
-203
-204
-205
-206
-207
-208
-209 public void setMd5sum(String md5sum) {
-210 this .md5sum = md5sum;
-211 }
-212
-213
-214
-215
-216
-217
-218 public String getSha1sum() {
-219 return this .sha1sum;
-220 }
-221
-222
-223
-224
-225
-226
-227 public void setSha1sum(String sha1sum) {
-228 this .sha1sum = sha1sum;
-229 }
-230
-231
-232
-233
-234
-235
-236 public Set<Identifier> getIdentifiers() {
-237 return this .identifiers;
-238 }
-239
-240
-241
-242
-243
-244
-245 public void setIdentifiers(Set<Identifier> identifiers) {
-246 this .identifiers = identifiers;
-247 }
-248
-249
-250
-251
-252
-253
-254
-255
-256 public void addIdentifier(String type, String value, String url) {
-257 final Identifier i = new Identifier (type, value, url);
-258 this .identifiers.add(i);
-259 }
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269 public void addIdentifier(String type, String value, String url, Confidence confidence) {
-270 final Identifier i = new Identifier (type, value, url);
-271 i.setConfidence(confidence);
-272 this .identifiers.add(i);
-273 }
-274
-275
-276
-277
-278
-279
-280 public void addIdentifier(Identifier identifier) {
-281 this .identifiers.add(identifier);
-282 }
-283
-284
-285
-286
-287
-288
-289 public EvidenceCollection getEvidence() {
-290 return EvidenceCollection.merge(this .productEvidence, this .vendorEvidence, this .versionEvidence);
-291 }
-292
-293
-294
-295
-296
-297
-298 public EvidenceCollection getEvidenceUsed() {
-299 return EvidenceCollection.mergeUsed(this .productEvidence, this .vendorEvidence, this .versionEvidence);
-300 }
-301
-302
-303
-304
-305
-306
-307 public EvidenceCollection getVendorEvidence() {
-308 return this .vendorEvidence;
-309 }
-310
-311
-312
-313
-314
-315
-316 public EvidenceCollection getProductEvidence() {
-317 return this .productEvidence;
-318 }
-319
-320
-321
-322
-323
-324
-325 public EvidenceCollection getVersionEvidence() {
-326 return this .versionEvidence;
-327 }
-328
-329
-330
-331 private String description;
-332
-333
-334
-335
-336
-337
-338 public String getDescription() {
-339 return description;
-340 }
-341
-342
-343
-344
-345
-346
-347 public void setDescription(String description) {
-348 this .description = description;
-349 }
-350
-351
-352
-353 private String license;
-354
-355
-356
-357
-358
-359
-360 public String getLicense() {
-361 return license;
-362 }
-363
-364
-365
-366
-367
-368
-369 public void setLicense(String license) {
-370 this .license = license;
-371 }
-372
-373
-374
-375 private SortedSet<Vulnerability> vulnerabilities;
-376
-377
-378
-379
-380
-381
-382 public SortedSet<Vulnerability> getVulnerabilities() {
-383 return vulnerabilities;
-384 }
-385
-386
-387
-388
-389
-390
-391 public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
-392 this .vulnerabilities = vulnerabilities;
-393 }
-394
-395
-396
-397
-398
-399
-400 private void determineHashes(File file) {
-401 String md5 = null ;
-402 String sha1 = null ;
-403 try {
-404 md5 = Checksum.getMD5Checksum(file);
-405 sha1 = Checksum.getSHA1Checksum(file);
-406 } catch (IOException ex) {
-407 final String msg = String.format("Unable to read '%s' to determine hashes." , file.getName());
-408 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
-409 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
-410 } catch (NoSuchAlgorithmException ex) {
-411 final String msg = "Unable to use MD5 of SHA1 checksums." ;
-412 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
-413 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
-414 }
-415 this .setMd5sum(md5);
-416 this .setSha1sum(sha1);
-417 }
-418
-419
-420
-421
-422
-423
-424 public void addVulnerability(Vulnerability vulnerability) {
-425 this .vulnerabilities.add(vulnerability);
-426 }
-427
-428
-429
-430 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
-431
-432
-433
-434
-435
-436
-437 public Set<Dependency> getRelatedDependencies() {
-438 return relatedDependencies;
-439 }
-440
-441
-442
-443
-444
-445
-446 public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
-447 this .relatedDependencies = relatedDependencies;
-448 }
-449
-450
-451
-452
-453
-454
-455 public void addRelatedDependency(Dependency dependency) {
-456 relatedDependencies.add(dependency);
-457 }
-458
-459
-460
-461
-462
-463
+116
+117
+118
+119
+120
+121 public String getFileNameForJavaScript() {
+122 return this .fileName.replace("\\" , "\\\\" );
+123 }
+124
+125
+126
+127
+128
+129
+130 public void setFileName(String fileName) {
+131 this .fileName = fileName;
+132 }
+133
+134
+135
+136
+137
+138
+139 public void setActualFilePath(String actualFilePath) {
+140 this .actualFilePath = actualFilePath;
+141 if (this .sha1sum == null ) {
+142 final File file = new File(this .actualFilePath);
+143 determineHashes(file);
+144 }
+145 }
+146
+147
+148
+149
+150
+151
+152 public String getActualFilePath() {
+153 return this .actualFilePath;
+154 }
+155
+156
+157
+158
+159
+160
+161 public File getActualFile() {
+162 return new File(this .actualFilePath);
+163 }
+164
+165
+166
+167
+168
+169
+170 public void setFilePath(String filePath) {
+171 this .filePath = filePath;
+172 }
+173
+174
+175
+176
+177
+178
+179
+180
+181
+182
+183 public String getFilePath() {
+184 return this .filePath;
+185 }
+186
+187
+188
+189
+190
+191
+192 public void setFileExtension(String fileExtension) {
+193 this .fileExtension = fileExtension;
+194 }
+195
+196
+197
+198
+199
+200
+201 public String getFileExtension() {
+202 return this .fileExtension;
+203 }
+204
+205
+206
+207
+208
+209
+210 public String getMd5sum() {
+211 return this .md5sum;
+212 }
+213
+214
+215
+216
+217
+218
+219 public void setMd5sum(String md5sum) {
+220 this .md5sum = md5sum;
+221 }
+222
+223
+224
+225
+226
+227
+228 public String getSha1sum() {
+229 return this .sha1sum;
+230 }
+231
+232
+233
+234
+235
+236
+237 public void setSha1sum(String sha1sum) {
+238 this .sha1sum = sha1sum;
+239 }
+240
+241
+242
+243
+244
+245
+246 public Set<Identifier> getIdentifiers() {
+247 return this .identifiers;
+248 }
+249
+250
+251
+252
+253
+254
+255 public void setIdentifiers(Set<Identifier> identifiers) {
+256 this .identifiers = identifiers;
+257 }
+258
+259
+260
+261
+262
+263
+264
+265
+266 public void addIdentifier(String type, String value, String url) {
+267 final Identifier i = new Identifier (type, value, url);
+268 this .identifiers.add(i);
+269 }
+270
+271
+272
+273
+274
+275
+276
+277
+278
+279 public void addIdentifier(String type, String value, String url, Confidence confidence) {
+280 final Identifier i = new Identifier (type, value, url);
+281 i.setConfidence(confidence);
+282 this .identifiers.add(i);
+283 }
+284
+285
+286
+287
+288
+289
+290 public void addIdentifier(Identifier identifier) {
+291 this .identifiers.add(identifier);
+292 }
+293
+294
+295
+296
+297
+298
+299 public EvidenceCollection getEvidence() {
+300 return EvidenceCollection.merge(this .productEvidence, this .vendorEvidence, this .versionEvidence);
+301 }
+302
+303
+304
+305
+306
+307
+308 public EvidenceCollection getEvidenceUsed() {
+309 return EvidenceCollection.mergeUsed(this .productEvidence, this .vendorEvidence, this .versionEvidence);
+310 }
+311
+312
+313
+314
+315
+316
+317 public EvidenceCollection getVendorEvidence() {
+318 return this .vendorEvidence;
+319 }
+320
+321
+322
+323
+324
+325
+326 public EvidenceCollection getProductEvidence() {
+327 return this .productEvidence;
+328 }
+329
+330
+331
+332
+333
+334
+335 public EvidenceCollection getVersionEvidence() {
+336 return this .versionEvidence;
+337 }
+338
+339
+340
+341 private String description;
+342
+343
+344
+345
+346
+347
+348 public String getDescription() {
+349 return description;
+350 }
+351
+352
+353
+354
+355
+356
+357 public void setDescription(String description) {
+358 this .description = description;
+359 }
+360
+361
+362
+363 private String license;
+364
+365
+366
+367
+368
+369
+370 public String getLicense() {
+371 return license;
+372 }
+373
+374
+375
+376
+377
+378
+379 public void setLicense(String license) {
+380 this .license = license;
+381 }
+382
+383
+384
+385 private SortedSet<Vulnerability> vulnerabilities;
+386
+387
+388
+389
+390
+391
+392 public SortedSet<Vulnerability> getVulnerabilities() {
+393 return vulnerabilities;
+394 }
+395
+396
+397
+398
+399
+400
+401 public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
+402 this .vulnerabilities = vulnerabilities;
+403 }
+404
+405
+406
+407
+408
+409
+410 private void determineHashes(File file) {
+411 String md5 = null ;
+412 String sha1 = null ;
+413 try {
+414 md5 = Checksum.getMD5Checksum(file);
+415 sha1 = Checksum.getSHA1Checksum(file);
+416 } catch (IOException ex) {
+417 final String msg = String.format("Unable to read '%s' to determine hashes." , file.getName());
+418 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
+419 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
+420 } catch (NoSuchAlgorithmException ex) {
+421 final String msg = "Unable to use MD5 of SHA1 checksums." ;
+422 Logger.getLogger(Dependency.class .getName()).log(Level.WARNING, msg);
+423 Logger.getLogger(Dependency.class .getName()).log(Level.FINE, null , ex);
+424 }
+425 this .setMd5sum(md5);
+426 this .setSha1sum(sha1);
+427 }
+428
+429
+430
+431
+432
+433
+434 public void addVulnerability(Vulnerability vulnerability) {
+435 this .vulnerabilities.add(vulnerability);
+436 }
+437
+438
+439
+440 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
+441
+442
+443
+444
+445
+446
+447 public Set<Dependency> getRelatedDependencies() {
+448 return relatedDependencies;
+449 }
+450
+451
+452
+453
+454
+455
+456 public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
+457 this .relatedDependencies = relatedDependencies;
+458 }
+459
+460
+461
+462
+463
464
-465 public int compareTo(Dependency o) {
-466 return this .getFileName().compareToIgnoreCase(o.getFileName());
+465 public void addRelatedDependency(Dependency dependency) {
+466 relatedDependencies.add(dependency);
467 }
468
469
-470
+470
471
-472
-473
+472
+473
474
-475 @Override
-476 public boolean equals(Object obj) {
-477 if (obj == null ) {
-478 return false;
-479 }
-480 if (getClass() != obj.getClass()) {
-481 return false;
-482 }
-483 final Dependency other = (Dependency) obj;
-484 if ((this .actualFilePath == null ) ? (other.actualFilePath != null ) : !this .actualFilePath.equals(other.actualFilePath)) {
-485 return false;
-486 }
-487 if ((this .filePath == null ) ? (other.filePath != null ) : !this .filePath.equals(other.filePath)) {
+475 public int compareTo(Dependency o) {
+476 return this .getFileName().compareToIgnoreCase(o.getFileName());
+477 }
+478
+479
+480
+481
+482
+483
+484
+485 @Override
+486 public boolean equals(Object obj) {
+487 if (obj == null ) {
488 return false;
489 }
-490 if ((this .fileName == null ) ? (other.fileName != null ) : !this .fileName.equals(other.fileName)) {
+490 if (getClass() != obj.getClass()) {
491 return false;
492 }
-493 if ((this .fileExtension == null ) ? (other.fileExtension != null ) : !this .fileExtension.equals(other.fileExtension)) {
-494 return false;
-495 }
-496 if ((this .md5sum == null ) ? (other.md5sum != null ) : !this .md5sum.equals(other.md5sum)) {
-497 return false;
-498 }
-499 if ((this .sha1sum == null ) ? (other.sha1sum != null ) : !this .sha1sum.equals(other.sha1sum)) {
-500 return false;
-501 }
-502 if (this .identifiers != other.identifiers && (this .identifiers == null || !this .identifiers.equals(other.identifiers))) {
-503 return false;
-504 }
-505 if (this .vendorEvidence != other.vendorEvidence && (this .vendorEvidence == null || !this .vendorEvidence.equals(other.vendorEvidence))) {
-506 return false;
-507 }
-508 if (this .productEvidence != other.productEvidence && (this .productEvidence == null || !this .productEvidence.equals(other.productEvidence))) {
-509 return false;
-510 }
-511 if (this .versionEvidence != other.versionEvidence && (this .versionEvidence == null || !this .versionEvidence.equals(other.versionEvidence))) {
-512 return false;
-513 }
-514 if ((this .description == null ) ? (other.description != null ) : !this .description.equals(other.description)) {
-515 return false;
-516 }
-517 if ((this .license == null ) ? (other.license != null ) : !this .license.equals(other.license)) {
-518 return false;
-519 }
-520 if (this .vulnerabilities != other.vulnerabilities && (this .vulnerabilities == null || !this .vulnerabilities.equals(other.vulnerabilities))) {
-521 return false;
-522 }
-523 if (this .relatedDependencies != other.relatedDependencies
-524 && (this .relatedDependencies == null || !this .relatedDependencies.equals(other.relatedDependencies))) {
+493 final Dependency other = (Dependency) obj;
+494 if ((this .actualFilePath == null ) ? (other.actualFilePath != null ) : !this .actualFilePath.equals(other.actualFilePath)) {
+495 return false;
+496 }
+497 if ((this .filePath == null ) ? (other.filePath != null ) : !this .filePath.equals(other.filePath)) {
+498 return false;
+499 }
+500 if ((this .fileName == null ) ? (other.fileName != null ) : !this .fileName.equals(other.fileName)) {
+501 return false;
+502 }
+503 if ((this .fileExtension == null ) ? (other.fileExtension != null ) : !this .fileExtension.equals(other.fileExtension)) {
+504 return false;
+505 }
+506 if ((this .md5sum == null ) ? (other.md5sum != null ) : !this .md5sum.equals(other.md5sum)) {
+507 return false;
+508 }
+509 if ((this .sha1sum == null ) ? (other.sha1sum != null ) : !this .sha1sum.equals(other.sha1sum)) {
+510 return false;
+511 }
+512 if (this .identifiers != other.identifiers && (this .identifiers == null || !this .identifiers.equals(other.identifiers))) {
+513 return false;
+514 }
+515 if (this .vendorEvidence != other.vendorEvidence && (this .vendorEvidence == null || !this .vendorEvidence.equals(other.vendorEvidence))) {
+516 return false;
+517 }
+518 if (this .productEvidence != other.productEvidence && (this .productEvidence == null || !this .productEvidence.equals(other.productEvidence))) {
+519 return false;
+520 }
+521 if (this .versionEvidence != other.versionEvidence && (this .versionEvidence == null || !this .versionEvidence.equals(other.versionEvidence))) {
+522 return false;
+523 }
+524 if ((this .description == null ) ? (other.description != null ) : !this .description.equals(other.description)) {
525 return false;
526 }
-527 return true ;
-528 }
-529
-530
-531
-532
-533
-534
-535 @Override
-536 public int hashCode() {
-537 int hash = 3;
-538 hash = 47 * hash + (this .actualFilePath != null ? this .actualFilePath.hashCode() : 0);
-539 hash = 47 * hash + (this .filePath != null ? this .filePath.hashCode() : 0);
-540 hash = 47 * hash + (this .fileName != null ? this .fileName.hashCode() : 0);
-541 hash = 47 * hash + (this .fileExtension != null ? this .fileExtension.hashCode() : 0);
-542 hash = 47 * hash + (this .md5sum != null ? this .md5sum.hashCode() : 0);
-543 hash = 47 * hash + (this .sha1sum != null ? this .sha1sum.hashCode() : 0);
-544 hash = 47 * hash + (this .identifiers != null ? this .identifiers.hashCode() : 0);
-545 hash = 47 * hash + (this .vendorEvidence != null ? this .vendorEvidence.hashCode() : 0);
-546 hash = 47 * hash + (this .productEvidence != null ? this .productEvidence.hashCode() : 0);
-547 hash = 47 * hash + (this .versionEvidence != null ? this .versionEvidence.hashCode() : 0);
-548 hash = 47 * hash + (this .description != null ? this .description.hashCode() : 0);
-549 hash = 47 * hash + (this .license != null ? this .license.hashCode() : 0);
-550 hash = 47 * hash + (this .vulnerabilities != null ? this .vulnerabilities.hashCode() : 0);
-551 hash = 47 * hash + (this .relatedDependencies != null ? this .relatedDependencies.hashCode() : 0);
-552 return hash;
-553 }
-554
-555
-556
-557
-558
-559
-560 @Override
-561 public String toString() {
-562 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}" ;
+527 if ((this .license == null ) ? (other.license != null ) : !this .license.equals(other.license)) {
+528 return false;
+529 }
+530 if (this .vulnerabilities != other.vulnerabilities && (this .vulnerabilities == null || !this .vulnerabilities.equals(other.vulnerabilities))) {
+531 return false;
+532 }
+533 if (this .relatedDependencies != other.relatedDependencies
+534 && (this .relatedDependencies == null || !this .relatedDependencies.equals(other.relatedDependencies))) {
+535 return false;
+536 }
+537 return true ;
+538 }
+539
+540
+541
+542
+543
+544
+545 @Override
+546 public int hashCode() {
+547 int hash = 3;
+548 hash = 47 * hash + (this .actualFilePath != null ? this .actualFilePath.hashCode() : 0);
+549 hash = 47 * hash + (this .filePath != null ? this .filePath.hashCode() : 0);
+550 hash = 47 * hash + (this .fileName != null ? this .fileName.hashCode() : 0);
+551 hash = 47 * hash + (this .fileExtension != null ? this .fileExtension.hashCode() : 0);
+552 hash = 47 * hash + (this .md5sum != null ? this .md5sum.hashCode() : 0);
+553 hash = 47 * hash + (this .sha1sum != null ? this .sha1sum.hashCode() : 0);
+554 hash = 47 * hash + (this .identifiers != null ? this .identifiers.hashCode() : 0);
+555 hash = 47 * hash + (this .vendorEvidence != null ? this .vendorEvidence.hashCode() : 0);
+556 hash = 47 * hash + (this .productEvidence != null ? this .productEvidence.hashCode() : 0);
+557 hash = 47 * hash + (this .versionEvidence != null ? this .versionEvidence.hashCode() : 0);
+558 hash = 47 * hash + (this .description != null ? this .description.hashCode() : 0);
+559 hash = 47 * hash + (this .license != null ? this .license.hashCode() : 0);
+560 hash = 47 * hash + (this .vulnerabilities != null ? this .vulnerabilities.hashCode() : 0);
+561 hash = 47 * hash + (this .relatedDependencies != null ? this .relatedDependencies.hashCode() : 0);
+562 return hash;
563 }
-564 }
+564
+565
+566
+567
+568
+569
+570 @Override
+571 public String toString() {
+572 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}" ;
+573 }
+574 }
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.dependency
ScanAgentException xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.exception;
+19
+20 import java.io.IOException;
+21
+22
+23
+24
+25
+26
+27 public class ScanAgentException extends IOException {
+28
+29
+30
+31
+32 private static final long serialVersionUID = 1L;
+33
+34
+35
+36
+37 public ScanAgentException () {
+38 super ();
+39 }
+40
+41
+42
+43
+44
+45
+46 public ScanAgentException (String msg) {
+47 super (msg);
+48 }
+49
+50
+51
+52
+53
+54
+55 public ScanAgentException (Throwable ex) {
+56 super (ex);
+57 }
+58
+59
+60
+61
+62
+63
+64
+65 public ScanAgentException (String msg, Throwable ex) {
+66 super (msg, ex);
+67 }
+68 }
+
+Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.exception
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.exception
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.exception
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.exception
NoDataException
+
+
+
+ ScanAgentException
+
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html
index 2783ca381..85a9a3600 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.jaxb.pom
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.jaxb.pom
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck
140
141 public void generateReports(String outputDir, Format format) throws IOException, Exception {
142 if (format == Format.XML || format == Format.ALL) {
-143 generateReport("XmlReport" , outputDir + File.separator + "DependencyCheck-Report.xml" );
+143 generateReport("XmlReport" , outputDir + File.separator + "dependency-check-report.xml" );
144 }
145 if (format == Format.HTML || format == Format.ALL) {
-146 generateReport("HtmlReport" , outputDir + File.separator + "DependencyCheck-Report.html" );
+146 generateReport("HtmlReport" , outputDir + File.separator + "dependency-check-report.html" );
147 }
148 if (format == Format.VULN || format == Format.ALL) {
-149 generateReport("VulnerabilityReport" , outputDir + File.separator + "DependencyCheck-Vulnerability.html" );
+149 generateReport("VulnerabilityReport" , outputDir + File.separator + "dependency-check-vulnerability.html" );
150 }
151 }
152
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html
index 42df2610d..2f9df700b 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.reporting
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.reporting
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.suppression
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.suppression
41 public final class FileUtils {
42
43
-44
+44
45
-46 private static final int BUFFER_SIZE = 4096;
+46 private static final String BIT_BUCKET_UNIX = "/dev/null" ;
47
48
-49
+49
50
-51 private FileUtils () {
-52 }
-53
-54
-55
-56
-57
-58
-59
-60 public static String getFileExtension(String fileName) {
-61 String ret = null ;
-62 final int pos = fileName.lastIndexOf("." );
-63 if (pos >= 0) {
-64 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
-65 }
-66 return ret;
-67 }
-68
-69
-70
-71
-72
-73
-74
-75 public static boolean delete(File file) {
-76 boolean success = true ;
-77 if (file.isDirectory()) {
-78 for (File f : file.listFiles()) {
-79 success &= delete(f);
-80 }
-81 }
-82 if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
-83 success = false;
-84 final String msg = String.format("Failed to delete file: %s" , file.getPath());
-85 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg);
-86 }
-87 return success;
-88 }
-89
-90
-91
-92
-93
-94
-95
-96
-97 public static File getTempFile(String prefix, String extension) {
-98 final File dir = Settings.getTempDirectory();
-99 if (!dir.exists()) {
-100 dir.mkdirs();
-101 }
-102 final String tempFileName = String.format("%s%s.%s" , prefix, UUID.randomUUID().toString(), extension);
-103 final File tempFile = new File(dir, tempFileName);
-104 if (tempFile.exists()) {
-105 return getTempFile(prefix, extension);
-106 }
-107 return tempFile;
-108 }
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122 @java.lang.Deprecated
-123 public static File getDataDirectory(String configuredFilePath, Class clazz) throws IOException {
-124 final File file = new File(configuredFilePath);
-125 if (file.isDirectory() && file.canWrite()) {
-126 return new File(file.getCanonicalPath());
-127 } else {
-128 final File exePath = getPathToJar(clazz);
-129 return new File(exePath, configuredFilePath);
-130 }
-131 }
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142 @java.lang.Deprecated
-143 public static File getPathToJar(Class clazz) throws UnsupportedEncodingException {
-144 final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath();
-145 final String decodedPath = URLDecoder.decode(filePath, "UTF-8" );
-146 final File jarPath = new File(decodedPath);
-147 return jarPath.getParentFile();
-148 }
-149
-150
-151
-152
-153
-154
-155
-156
-157 public static void extractFiles(File archive, File extractTo) throws ExtractionException {
-158 extractFiles(archive, extractTo, null );
-159 }
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171 public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
-172 if (archive == null || extractTo == null ) {
-173 return ;
-174 }
-175
-176 FileInputStream fis = null ;
-177 ZipInputStream zis = null ;
-178
-179 try {
-180 fis = new FileInputStream(archive);
-181 } catch (FileNotFoundException ex) {
-182 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
-183 throw new ExtractionException ("Archive file was not found." , ex);
-184 }
-185 zis = new ZipInputStream(new BufferedInputStream(fis));
-186 ZipEntry entry;
-187 try {
-188 while ((entry = zis.getNextEntry()) != null ) {
-189 if (entry.isDirectory()) {
-190 final File d = new File(extractTo, entry.getName());
-191 if (!d.exists() && !d.mkdirs()) {
-192 final String msg = String.format("Unable to create '%s'." , d.getAbsolutePath());
-193 throw new ExtractionException (msg);
-194 }
-195 } else {
-196 final File file = new File(extractTo, entry.getName());
-197 final String ext = getFileExtension(file.getName());
-198 if (engine == null || engine.supportsExtension(ext)) {
-199 BufferedOutputStream bos = null ;
-200 FileOutputStream fos;
-201 try {
-202 fos = new FileOutputStream(file);
-203 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
-204 int count;
-205 final byte data[] = new byte[BUFFER_SIZE];
-206 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
-207 bos.write(data, 0, count);
-208 }
-209 bos.flush();
-210 } catch (FileNotFoundException ex) {
-211 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
-212 final String msg = String.format("Unable to find file '%s'." , file.getName());
-213 throw new ExtractionException (msg, ex);
-214 } catch (IOException ex) {
-215 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
-216 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
-217 throw new ExtractionException (msg, ex);
-218 } finally {
-219 if (bos != null ) {
-220 try {
-221 bos.close();
-222 } catch (IOException ex) {
-223 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
-224 }
-225 }
-226 }
-227 }
-228 }
-229 }
-230 } catch (IOException ex) {
-231 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
-232 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg, ex);
-233 throw new ExtractionException (msg, ex);
-234 } finally {
-235 try {
-236 zis.close();
-237 } catch (IOException ex) {
-238 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
-239 }
-240 }
-241 }
-242 }
+51 private static final String BIT_BUCKET_WIN = "NUL" ;
+52
+53
+54
+55
+56 private static final int BUFFER_SIZE = 4096;
+57
+58
+59
+60
+61 private FileUtils () {
+62 }
+63
+64
+65
+66
+67
+68
+69
+70 public static String getFileExtension(String fileName) {
+71 String ret = null ;
+72 final int pos = fileName.lastIndexOf("." );
+73 if (pos >= 0) {
+74 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
+75 }
+76 return ret;
+77 }
+78
+79
+80
+81
+82
+83
+84
+85 public static boolean delete(File file) {
+86 boolean success = true ;
+87 if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
+88 success = false;
+89 final String msg = String.format("Failed to delete file: %s; attempting to delete on exit." , file.getPath());
+90 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg);
+91 file.deleteOnExit();
+92 }
+93 return success;
+94 }
+95
+96
+97
+98
+99
+100
+101
+102
+103
+104 public static File getTempFile(String prefix, String extension) throws IOException {
+105 final File dir = Settings.getTempDirectory();
+106 if (!dir.exists()) {
+107 if (!dir.mkdirs()) {
+108 throw new IOException("Unable to create temporary folder" );
+109 }
+110 }
+111 final String tempFileName = String.format("%s%s.%s" , prefix, UUID.randomUUID().toString(), extension);
+112 final File tempFile = new File(dir, tempFileName);
+113 if (tempFile.exists()) {
+114 return getTempFile(prefix, extension);
+115 }
+116 return tempFile;
+117 }
+118
+119
+120
+121
+122
+123
+124
+125
+126
+127
+128
+129
+130
+131 @java.lang.Deprecated
+132 public static File getDataDirectory(String configuredFilePath, Class clazz) throws IOException {
+133 final File file = new File(configuredFilePath);
+134 if (file.isDirectory() && file.canWrite()) {
+135 return new File(file.getCanonicalPath());
+136 } else {
+137 final File exePath = getPathToJar(clazz);
+138 return new File(exePath, configuredFilePath);
+139 }
+140 }
+141
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151 @java.lang.Deprecated
+152 public static File getPathToJar(Class clazz) throws UnsupportedEncodingException {
+153 final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath();
+154 final String decodedPath = URLDecoder.decode(filePath, "UTF-8" );
+155 final File jarPath = new File(decodedPath);
+156 return jarPath.getParentFile();
+157 }
+158
+159
+160
+161
+162
+163
+164
+165
+166 public static void extractFiles(File archive, File extractTo) throws ExtractionException {
+167 extractFiles(archive, extractTo, null );
+168 }
+169
+170
+171
+172
+173
+174
+175
+176
+177
+178
+179
+180 public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
+181 if (archive == null || extractTo == null ) {
+182 return ;
+183 }
+184
+185 FileInputStream fis = null ;
+186 ZipInputStream zis = null ;
+187
+188 try {
+189 fis = new FileInputStream(archive);
+190 } catch (FileNotFoundException ex) {
+191 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
+192 throw new ExtractionException ("Archive file was not found." , ex);
+193 }
+194 zis = new ZipInputStream(new BufferedInputStream(fis));
+195 ZipEntry entry;
+196 try {
+197 while ((entry = zis.getNextEntry()) != null ) {
+198 if (entry.isDirectory()) {
+199 final File d = new File(extractTo, entry.getName());
+200 if (!d.exists() && !d.mkdirs()) {
+201 final String msg = String.format("Unable to create '%s'." , d.getAbsolutePath());
+202 throw new ExtractionException (msg);
+203 }
+204 } else {
+205 final File file = new File(extractTo, entry.getName());
+206 final String ext = getFileExtension(file.getName());
+207 if (engine == null || engine.supportsExtension(ext)) {
+208 BufferedOutputStream bos = null ;
+209 FileOutputStream fos;
+210 try {
+211 fos = new FileOutputStream(file);
+212 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+213 int count;
+214 final byte data[] = new byte[BUFFER_SIZE];
+215 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
+216 bos.write(data, 0, count);
+217 }
+218 bos.flush();
+219 } catch (FileNotFoundException ex) {
+220 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
+221 final String msg = String.format("Unable to find file '%s'." , file.getName());
+222 throw new ExtractionException (msg, ex);
+223 } catch (IOException ex) {
+224 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, null , ex);
+225 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+226 throw new ExtractionException (msg, ex);
+227 } finally {
+228 if (bos != null ) {
+229 try {
+230 bos.close();
+231 } catch (IOException ex) {
+232 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
+233 }
+234 }
+235 }
+236 }
+237 }
+238 }
+239 } catch (IOException ex) {
+240 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
+241 Logger.getLogger(FileUtils.class .getName()).log(Level.FINE, msg, ex);
+242 throw new ExtractionException (msg, ex);
+243 } finally {
+244 try {
+245 zis.close();
+246 } catch (IOException ex) {
+247 Logger.getLogger(FileUtils.class .getName()).log(Level.FINEST, null , ex);
+248 }
+249 }
+250 }
+251
+252
+253
+254
+255
+256
+257 public static String getBitBucket() {
+258 if (System.getProperty("os.name" ).startsWith("Windows" )) {
+259 return BIT_BUCKET_WIN;
+260 } else {
+261 return BIT_BUCKET_UNIX;
+262 }
+263 }
+264 }
146
147 public static final String SUPPRESSION_FILE = "suppression.file" ;
148
-149
+149
150
-151 public static final String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled" ;
+151 public static final String ANALYZER_JAR_ENABLED = "analyzer.jar.enabled" ;
152
-153
+153
154
-155 public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url" ;
+155 public static final String ANALYZER_ARCHIVE_ENABLED = "analyzer.archive.enabled" ;
156
-157
+157
158
-159 public static final String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy" ;
+159 public static final String ANALYZER_ASSEMBLY_ENABLED = "analyzer.assembly.enabled" ;
160
-161
+161
162
-163 public static final String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path" ;
+163 public static final String ANALYZER_NUSPEC_ENABLED = "analyzer.nuspec.enabled" ;
164
-165
+165
166
-167 public static final String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip" ;
+167 public static final String ANALYZER_JAVASCRIPT_ENABLED = "analyzer.javascript.enabled" ;
168
-169
+169
170
-171 public static final String SKIP_TEST_SCOPE = "skip.test.scope" ;
+171 public static final String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled" ;
172
-173
+173
174
-175 public static final String SKIP_RUNTIME_SCOPE = "skip.runtime.scope" ;
+175 public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url" ;
176
-177
+177
178
-179 public static final String SKIP_PROVIDED_SCOPE = "skip.provided.scope" ;
-180 }
-181
-182
-183
-184 private static final String PROPERTIES_FILE = "dependencycheck.properties" ;
-185
-186
-187
-188 private static final Settings INSTANCE = new Settings ();
-189
-190
-191
-192 private Properties props = null ;
-193
-194
-195
-196
-197 private Settings () {
-198 InputStream in = null ;
-199 props = new Properties();
-200 try {
-201 in = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
-202 props.load(in);
-203 } catch (IOException ex) {
-204 Logger.getLogger(Settings.class .getName()).log(Level.SEVERE, "Unable to load default settings." );
-205 Logger.getLogger(Settings.class .getName()).log(Level.FINE, null , ex);
-206 } finally {
-207 if (in != null ) {
-208 try {
-209 in.close();
-210 } catch (IOException ex) {
-211 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
-212 }
-213 }
-214 }
-215 logProperties("Properties loaded" , props);
-216 }
-217
-218
-219
-220
-221
-222
-223
-224 private static void logProperties(String header, Properties properties) {
-225 if (LOGGER.isLoggable(Level.FINE)) {
-226 final StringWriter sw = new StringWriter();
-227 PrintWriter pw = null ;
-228 try {
-229 pw = new PrintWriter(sw);
-230 pw.format("%s:%n%n" , header);
-231 final Enumeration e = properties.propertyNames();
-232 while (e.hasMoreElements()) {
-233 final String key = (String) e.nextElement();
-234 if (key.contains("password" )) {
-235 pw.format("%s='*****'%n" , key);
-236 } else {
-237 final String value = properties.getProperty(key);
-238 if (value != null ) {
-239 pw.format("%s='%s'%n" , key, value);
-240 }
-241 }
-242 }
-243 pw.flush();
-244 LOGGER.fine(sw.toString());
-245 } finally {
-246 if (pw != null ) {
-247 pw.close();
-248 }
-249 }
-250
-251 }
-252 }
-253
-254
-255
-256
-257
-258
-259
-260 public static void setString(String key, String value) {
-261 INSTANCE.props.setProperty(key, value);
-262 if (LOGGER.isLoggable(Level.FINE)) {
-263 LOGGER.fine(String.format("Setting: %s='%s'" , key, value));
-264 }
-265 }
-266
-267
-268
-269
-270
-271
-272
-273 public static void setBoolean(String key, boolean value) {
-274 if (value) {
-275 INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
-276 } else {
-277 INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
-278 }
-279 if (LOGGER.isLoggable(Level.FINE)) {
-280 LOGGER.fine(String.format("Setting: %s='%b'" , key, value));
-281 }
-282 }
-283
-284
-285
-286
-287
-288
-289
-290
-291
+179 public static final String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy" ;
+180
+181
+182
+183 public static final String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path" ;
+184
+185
+186
+187 public static final String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip" ;
+188
+189
+190
+191 public static final String SKIP_TEST_SCOPE = "skip.test.scope" ;
+192
+193
+194
+195 public static final String SKIP_RUNTIME_SCOPE = "skip.runtime.scope" ;
+196
+197
+198
+199 public static final String SKIP_PROVIDED_SCOPE = "skip.provided.scope" ;
+200 }
+201
+202
+203
+204 private static final String PROPERTIES_FILE = "dependencycheck.properties" ;
+205
+206
+207
+208 private static final Settings INSTANCE = new Settings ();
+209
+210
+211
+212 private Properties props = null ;
+213
+214
+215
+216
+217 private Settings () {
+218 InputStream in = null ;
+219 props = new Properties();
+220 try {
+221 in = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+222 props.load(in);
+223 } catch (IOException ex) {
+224 Logger.getLogger(Settings.class .getName()).log(Level.SEVERE, "Unable to load default settings." );
+225 Logger.getLogger(Settings.class .getName()).log(Level.FINE, null , ex);
+226 } finally {
+227 if (in != null ) {
+228 try {
+229 in.close();
+230 } catch (IOException ex) {
+231 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
+232 }
+233 }
+234 }
+235 logProperties("Properties loaded" , props);
+236 }
+237
+238
+239
+240
+241
+242
+243
+244 private static void logProperties(String header, Properties properties) {
+245 if (LOGGER.isLoggable(Level.FINE)) {
+246 final StringWriter sw = new StringWriter();
+247 PrintWriter pw = null ;
+248 try {
+249 pw = new PrintWriter(sw);
+250 pw.format("%s:%n%n" , header);
+251 final Enumeration e = properties.propertyNames();
+252 while (e.hasMoreElements()) {
+253 final String key = (String) e.nextElement();
+254 if (key.contains("password" )) {
+255 pw.format("%s='*****'%n" , key);
+256 } else {
+257 final String value = properties.getProperty(key);
+258 if (value != null ) {
+259 pw.format("%s='%s'%n" , key, value);
+260 }
+261 }
+262 }
+263 pw.flush();
+264 LOGGER.fine(sw.toString());
+265 } finally {
+266 if (pw != null ) {
+267 pw.close();
+268 }
+269 }
+270
+271 }
+272 }
+273
+274
+275
+276
+277
+278
+279
+280 public static void setString(String key, String value) {
+281 INSTANCE.props.setProperty(key, value);
+282 if (LOGGER.isLoggable(Level.FINE)) {
+283 LOGGER.fine(String.format("Setting: %s='%s'" , key, value));
+284 }
+285 }
+286
+287
+288
+289
+290
+291
292
-293 public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
-294 final FileInputStream fis = new FileInputStream(filePath);
-295 mergeProperties(fis);
-296 }
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307 public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
-308 final FileInputStream fis = new FileInputStream(filePath);
-309 mergeProperties(fis);
-310 }
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320 public static void mergeProperties(InputStream stream) throws IOException {
-321 INSTANCE.props.load(stream);
-322 logProperties("Properties updated via merge" , INSTANCE.props);
-323 }
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333 public static File getFile(String key) {
-334 final String file = getString(key);
-335 if (file == null ) {
-336 return null ;
-337 }
-338 return new File(file);
-339 }
-340
-341
-342
-343
-344
-345
-346
-347
-348
+293 public static void setBoolean(String key, boolean value) {
+294 if (value) {
+295 INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
+296 } else {
+297 INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
+298 }
+299 if (LOGGER.isLoggable(Level.FINE)) {
+300 LOGGER.fine(String.format("Setting: %s='%b'" , key, value));
+301 }
+302 }
+303
+304
+305
+306
+307
+308
+309
+310
+311
+312
+313 public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
+314 final FileInputStream fis = new FileInputStream(filePath);
+315 mergeProperties(fis);
+316 }
+317
+318
+319
+320
+321
+322
+323
+324
+325
+326
+327 public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
+328 final FileInputStream fis = new FileInputStream(filePath);
+329 mergeProperties(fis);
+330 }
+331
+332
+333
+334
+335
+336
+337
+338
+339
+340 public static void mergeProperties(InputStream stream) throws IOException {
+341 INSTANCE.props.load(stream);
+342 logProperties("Properties updated via merge" , INSTANCE.props);
+343 }
+344
+345
+346
+347
+348
349
350
351
352
-353 public static File getDataFile(String key) {
+353 public static File getFile(String key) {
354 final String file = getString(key);
-355 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'" , file));
-356 if (file == null ) {
-357 return null ;
-358 }
-359 if (file.startsWith("[JAR]" )) {
-360 Logger.getLogger(Settings.class .getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename" );
-361 final File jarPath = getJarPath();
-362 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'" , jarPath.toString()));
-363 final File retVal = new File(jarPath, file.substring(6));
-364 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'" , retVal.toString()));
-365 return retVal;
-366 }
-367 return new File(file);
-368 }
-369
-370
-371
-372
-373
-374
-375 private static File getJarPath() {
-376 final String jarPath = Settings.class .getProtectionDomain().getCodeSource().getLocation().getPath();
-377 String decodedPath = "." ;
-378 try {
-379 decodedPath = URLDecoder.decode(jarPath, "UTF-8" );
-380 } catch (UnsupportedEncodingException ex) {
-381 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
-382 }
-383
-384 final File path = new File(decodedPath);
-385 if (path.getName().toLowerCase().endsWith(".jar" )) {
-386 return path.getParentFile();
-387 } else {
-388 return new File("." );
-389 }
-390 }
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401 public static String getString(String key, String defaultValue) {
-402 final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
-403 return str;
-404 }
-405
-406
-407
-408
-409
-410
-411 public static File getTempDirectory() {
-412 return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir" )));
-413 }
-414
-415
-416
-417
-418
-419
-420
-421
-422
-423 public static String getString(String key) {
-424 return System.getProperty(key, INSTANCE.props.getProperty(key));
-425 }
-426
-427
-428
-429
-430
-431
-432 public static void removeProperty(String key) {
-433 INSTANCE.props.remove(key);
-434 }
-435
-436
-437
-438
-439
-440
-441
-442
-443
-444
-445 public static int getInt(String key) throws InvalidSettingException {
-446 int value;
-447 try {
-448 value = Integer.parseInt(Settings.getString(key));
-449 } catch (NumberFormatException ex) {
-450 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
-451 }
-452 return value;
-453 }
-454
-455
-456
-457
-458
-459
-460
-461
-462
-463
+355 if (file == null ) {
+356 return null ;
+357 }
+358 return new File(file);
+359 }
+360
+361
+362
+363
+364
+365
+366
+367
+368
+369
+370
+371
+372
+373 public static File getDataFile(String key) {
+374 final String file = getString(key);
+375 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'" , file));
+376 if (file == null ) {
+377 return null ;
+378 }
+379 if (file.startsWith("[JAR]" )) {
+380 Logger.getLogger(Settings.class .getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename" );
+381 final File jarPath = getJarPath();
+382 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'" , jarPath.toString()));
+383 final File retVal = new File(jarPath, file.substring(6));
+384 Logger.getLogger(Settings.class .getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'" , retVal.toString()));
+385 return retVal;
+386 }
+387 return new File(file);
+388 }
+389
+390
+391
+392
+393
+394
+395 private static File getJarPath() {
+396 final String jarPath = Settings.class .getProtectionDomain().getCodeSource().getLocation().getPath();
+397 String decodedPath = "." ;
+398 try {
+399 decodedPath = URLDecoder.decode(jarPath, "UTF-8" );
+400 } catch (UnsupportedEncodingException ex) {
+401 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, null , ex);
+402 }
+403
+404 final File path = new File(decodedPath);
+405 if (path.getName().toLowerCase().endsWith(".jar" )) {
+406 return path.getParentFile();
+407 } else {
+408 return new File("." );
+409 }
+410 }
+411
+412
+413
+414
+415
+416
+417
+418
+419
+420
+421 public static String getString(String key, String defaultValue) {
+422 final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
+423 return str;
+424 }
+425
+426
+427
+428
+429
+430
+431 public static File getTempDirectory() {
+432 return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir" )));
+433 }
+434
+435
+436
+437
+438
+439
+440
+441
+442
+443 public static String getString(String key) {
+444 return System.getProperty(key, INSTANCE.props.getProperty(key));
+445 }
+446
+447
+448
+449
+450
+451
+452 public static void removeProperty(String key) {
+453 INSTANCE.props.remove(key);
+454 }
+455
+456
+457
+458
+459
+460
+461
+462
+463
464
-465 public static int getInt(String key, int defaultValue) {
+465 public static int getInt(String key) throws InvalidSettingException {
466 int value;
467 try {
468 value = Integer.parseInt(Settings.getString(key));
469 } catch (NumberFormatException ex) {
-470 final String msg = String.format("Could not convert property '%s' to an int." , key);
-471 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, msg, ex);
-472 value = defaultValue;
-473 }
-474 return value;
-475 }
-476
-477
-478
-479
-480
-481
-482
-483
-484
-485
-486 public static long getLong(String key) throws InvalidSettingException {
-487 long value;
-488 try {
-489 value = Long.parseLong(Settings.getString(key));
-490 } catch (NumberFormatException ex) {
-491 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
-492 }
-493 return value;
-494 }
-495
-496
-497
-498
-499
-500
-501
-502
-503
-504
-505 public static boolean getBoolean(String key) throws InvalidSettingException {
-506 boolean value;
-507 try {
-508 value = Boolean.parseBoolean(Settings.getString(key));
-509 } catch (NumberFormatException ex) {
-510 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
-511 }
-512 return value;
-513 }
-514 }
+470 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
+471 }
+472 return value;
+473 }
+474
+475
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485 public static int getInt(String key, int defaultValue) {
+486 int value;
+487 try {
+488 value = Integer.parseInt(Settings.getString(key));
+489 } catch (NumberFormatException ex) {
+490 final String msg = String.format("Could not convert property '%s' to an int." , key);
+491 Logger.getLogger(Settings.class .getName()).log(Level.FINEST, msg, ex);
+492 value = defaultValue;
+493 }
+494 return value;
+495 }
+496
+497
+498
+499
+500
+501
+502
+503
+504
+505
+506 public static long getLong(String key) throws InvalidSettingException {
+507 long value;
+508 try {
+509 value = Long.parseLong(Settings.getString(key));
+510 } catch (NumberFormatException ex) {
+511 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
+512 }
+513 return value;
+514 }
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524
+525 public static boolean getBoolean(String key) throws InvalidSettingException {
+526 boolean value;
+527 try {
+528 value = Boolean.parseBoolean(Settings.getString(key));
+529 } catch (NumberFormatException ex) {
+530 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
+531 }
+532 return value;
+533 }
+534
+535
+536
+537
+538
+539
+540
+541
+542
+543
+544
+545 public static boolean getBoolean(String key, boolean defaultValue) throws InvalidSettingException {
+546 boolean value;
+547 try {
+548 final String strValue = Settings.getString(key);
+549 if (strValue == null ) {
+550 return defaultValue;
+551 }
+552 value = Boolean.parseBoolean(strValue);
+553 } catch (NumberFormatException ex) {
+554 throw new InvalidSettingException ("Could not convert property '" + key + "' to an int." , ex);
+555 }
+556 return value;
+557 }
+558 }
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.utils
Dependency-Check Core 1.1.3 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.utils
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
org.owasp.dependencycheck
+
+
+ org.owasp.dependencycheck.agent
org.owasp.dependencycheck.analyzer
diff --git a/dependency-check-core/xref/overview-summary.html b/dependency-check-core/xref/overview-summary.html
index e710ea98f..eee5f918e 100644
--- a/dependency-check-core/xref/overview-summary.html
+++ b/dependency-check-core/xref/overview-summary.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
- Dependency-Check Core 1.1.3 Reference
+ Dependency-Check Core 1.1.4 Reference
@@ -37,6 +37,11 @@
org.owasp.dependencycheck
+
+
+
+ org.owasp.dependencycheck.agent
+
diff --git a/dependency-check-jenkins/index.html b/dependency-check-jenkins/index.html
index 2205c58f4..33cf42f71 100644
--- a/dependency-check-jenkins/index.html
+++ b/dependency-check-jenkins/index.html
@@ -1,13 +1,13 @@
dependency-check-jenkins -
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-jenkins/license.html b/dependency-check-jenkins/license.html
index 965bb3cd4..f2fdada0a 100644
--- a/dependency-check-jenkins/license.html
+++ b/dependency-check-jenkins/license.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project License
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-jenkins/project-info.html b/dependency-check-jenkins/project-info.html
index 32e98b983..1013eddd7 100644
--- a/dependency-check-jenkins/project-info.html
+++ b/dependency-check-jenkins/project-info.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Information
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-jenkins/project-summary.html b/dependency-check-jenkins/project-summary.html
index d3b0c71d3..6564d9b9c 100644
--- a/dependency-check-jenkins/project-summary.html
+++ b/dependency-check-jenkins/project-summary.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Summary
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -196,7 +196,7 @@
dependency-check-jenkins
Version
-1.1.3
+1.1.4
Type
pom
diff --git a/dependency-check-maven/apidocs/allclasses-frame.html b/dependency-check-maven/apidocs/allclasses-frame.html
index fec86613b..4d263d3cb 100644
--- a/dependency-check-maven/apidocs/allclasses-frame.html
+++ b/dependency-check-maven/apidocs/allclasses-frame.html
@@ -2,10 +2,10 @@
-
+
All Classes (Dependency-Check Maven Plugin 1.1.3 API)
-All Classes (Dependency-Check Maven Plugin 1.1.4 API)
+All Classes (Dependency-Check Maven Plugin 1.1.3 API)
-All Classes (Dependency-Check Maven Plugin 1.1.4 API)
+Constant Field Values (Dependency-Check Maven Plugin 1.1.3 API)
-Constant Field Values (Dependency-Check Maven Plugin 1.1.4 API)
+Deprecated List (Dependency-Check Maven Plugin 1.1.3 API)
-Deprecated List (Dependency-Check Maven Plugin 1.1.4 API)
+API Help (Dependency-Check Maven Plugin 1.1.3 API)
-API Help (Dependency-Check Maven Plugin 1.1.4 API)
+Index (Dependency-Check Maven Plugin 1.1.3 API)
-Index (Dependency-Check Maven Plugin 1.1.4 API)
+Dependency-Check Maven Plugin 1.1.3 API
+Dependency-Check Maven Plugin 1.1.4 API
diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html
index 3559fa0dc..7f320a222 100644
--- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html
+++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html
@@ -2,16 +2,16 @@
-
+
HelpMojo (Dependency-Check Maven Plugin 1.1.3 API)
-HelpMojo (Dependency-Check Maven Plugin 1.1.4 API)
+Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.1.3 API)
-Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.1.4 API)
+Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.1.3 API)
-Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.1.4 API)
+org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.3 API)
-org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.4 API)
+org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.3 API)
-org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.4 API)
+org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.1.3 API)
-org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.1.4 API)
+Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.3 API)
-Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.4 API)
+Class Hierarchy (Dependency-Check Maven Plugin 1.1.3 API)
-Class Hierarchy (Dependency-Check Maven Plugin 1.1.4 API)
+dependency-check-maven -
dependency-check:check
@@ -55,7 +55,7 @@
-
+
/
@@ -69,9 +69,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -165,7 +165,7 @@
Full name :
-org.owasp:dependency-check-maven:1.1.3:check
+org.owasp:dependency-check-maven:1.1.4:check
Description :
@@ -260,7 +260,7 @@ plugin unless the externalReport is set to true. Default is HTML.Defaul
- The output directory.Default value is : ${project.build.directory} .
+The output directory. This generally maps to "target".Default value is : ${project.build.directory} .
@@ -272,7 +272,7 @@ plugin unless the externalReport is set to true. Default is HTML.Defaul
- Specifies the destination directory for the generated
-Dependency-Check report.Default value is : ${project.reporting.outputDirectory} .User property is : reportOutputDirectory .
+Dependency-Check report. This generally maps to "target/site".Default value is : ${project.reporting.outputDirectory} .User property is : reportOutputDirectory .
@@ -295,6 +295,28 @@ Dependency-Check report.Default value is : ${project.reporting.o
+archiveAnalyzerEnabled boolean - Whether or not the Archive Analyzer is enabled.Default value is : true .User property is : archiveAnalyzerEnabled .
+
+
+
+
+assemblyAnalyzerEnabled boolean - Whether or not the .NET Assembly Analyzer is enabled.Default value is : true .User property is : assemblyAnalyzerEnabled .
+
+
+
+
connectionString String Default value is : A report pro
+jarAnalyzerEnabled boolean - Whether or not the Jar Analyzer is enabled.Default value is : true .User property is : jarAnalyzerEnabled .
+
+
+
+
logFile String Default value is : A report pro
The path to the verbose log.User property is : logfile .
+
+
+mavenSettings Settings - The maven settings.Default value is : ${settings} .User property is : mavenSettings .
+
+
+mavenSettingsProxyId String - The maven settings proxy id.User property is : mavenSettingsProxyId .
+
+
+
+
name String Default value is : A report pro
Reports page.Default value is : Dependency-Check .User property is : name .
-
+
nexusAnalyzerEnabled Default value is : Dependency-Check .U
Whether or not the Nexus Analyzer is enabled.Default value is : true .User property is : nexusAnalyzerEnabled .
-
+
nexusUrl Default value is : Dependency-Check .U
Whether or not the Nexus Analyzer is enabled.User property is : nexusUrl .
-
+
nexusUsesProxy Default value is : Dependency-Check .U
Whether or not the configured proxy is used to connect to Nexus.Default value is : true .User property is : nexusUsesProxy .
+
+
+nuspecAnalyzerEnabled boolean - Whether or not the .NET Nuspec Analyzer is enabled.Default value is : true .User property is : nuspecAnalyzerEnabled .
+
+
pathToMono Default value is : Dependency-Check .U
- The Proxy password.User property is : proxyPassword .
+Deprecated. Please use mavenSettings insteadUser property is : proxyPassword .
@@ -512,7 +578,7 @@ Reports page.Default value is : Dependency-Check .U
- The Proxy Port.User property is : proxyPort .
+Deprecated. Please use mavenSettings insteadUser property is : proxyPort .
@@ -523,7 +589,7 @@ Reports page.Default value is : Dependency-Check .U
- The Proxy URL.User property is : proxyUrl .
+Deprecated. Please use mavenSettings insteadUser property is : proxyUrl .
@@ -534,22 +600,11 @@ Reports page.Default value is : Dependency-Check .U
- The Proxy username.User property is : proxyUsername .
+Deprecated. Please use mavenSettings insteadUser property is : proxyUsername .
-reportName String - The name of the site report destination.Default value is : dependency-check-report .User property is : report-name .
-
-
-
-
showSummary boolean Default value is : Dependency-Check .U
Flag indicating whether or not to show a summary in the output.Default value is : true .User property is : showSummary .
-
+
skipProvidedScope Default value is : Dependency-Check .U
Skip Analisys for Provided Scope Dependencies.Default value is : false .User property is : skipProvidedScope .
-
+
skipRuntimeScope Default value is : Dependency-Check .U
Skip Analisys for Runtime Scope Dependencies.Default value is : false .User property is : skipRuntimeScope .
-
+
skipTestScope Default value is : Dependency-Check .U
Skip Analisys for Test Scope Dependencies.Default value is : true .User property is : skipTestScope .
-
+
suppressionFile Default value is : Dependency-Check .U
The Connection Timeout.User property is : suppressionFile .
-
+
zipExtensions User property is : zipExtensions .
Parameter Details
+
archiveAnalyzerEnabled :
+
+
Whether or not the Archive Analyzer is enabled.
+
+
+
+Type : boolean Required : No User Property : archiveAnalyzerEnabled Default : true
+
assemblyAnalyzerEnabled :
+
+
Whether or not the .NET Assembly Analyzer is enabled.
+
+
+
+Type : boolean Required : No User Property : assemblyAnalyzerEnabled Default : true autoUpdate :
Sets whether auto-updating of the NVD CVE/CPE data is enabled. It
@@ -828,6 +911,20 @@ plugin unless the externalReport is set to true. Default is HTML.
Default : HTML
+
jarAnalyzerEnabled :
+
+
Whether or not the Jar Analyzer is enabled.
+
+
+
+Type : boolean Required : No User Property : jarAnalyzerEnabled Default : true logFile :
The path to the verbose log.
@@ -840,6 +937,32 @@ plugin unless the externalReport is set to true. Default is HTML.
User Property : logfile mavenSettings :
+
+The maven settings.
+
+
+
+Type : org.apache.maven.settings.Settings Required : No User Property : mavenSettings Default : ${settings} mavenSettingsProxyId :
+
+The maven settings proxy id.
+
+
+
+Type : java.lang.String Required : No User Property : mavenSettingsProxyId name :
The name of the report to be displayed in the Maven Generated
@@ -893,11 +1016,25 @@ Reports page.
User Property : nexusUsesProxy Default : true nuspecAnalyzerEnabled :
+
+Whether or not the .NET Nuspec Analyzer is enabled.
+
+
+
+Type : boolean Required : No User Property : nuspecAnalyzerEnabled Default : true outputDirectory :
-The output directory.
+The output directory. This generally maps to "target".
@@ -921,6 +1058,8 @@ Reports page.
proxyPassword :
+Deprecated. Please use mavenSettings instead
+
The Proxy password.
@@ -933,6 +1072,8 @@ Reports page.
proxyPort :
+Deprecated. Please use mavenSettings instead
+
The Proxy Port.
@@ -945,6 +1086,8 @@ Reports page.
proxyUrl :
+Deprecated. Please use mavenSettings instead
+
The Proxy URL.
@@ -957,6 +1100,8 @@ Reports page.
proxyUsername :
+Deprecated. Please use mavenSettings instead
+
The Proxy username.
@@ -967,24 +1112,10 @@ Reports page.
User Property : proxyUsername reportName :
-
-The name of the site report destination.
-
-
-
-Type : java.lang.String Required : No User Property : report-name Default : dependency-check-report reportOutputDirectory :
Specifies the destination directory for the generated
-Dependency-Check report.
+Dependency-Check report. This generally maps to "target/site".
diff --git a/dependency-check-maven/checkstyle.html b/dependency-check-maven/checkstyle.html
index 35410e689..8458642eb 100644
--- a/dependency-check-maven/checkstyle.html
+++ b/dependency-check-maven/checkstyle.html
@@ -1,13 +1,13 @@
dependency-check-maven - Checkstyle Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -260,7 +260,7 @@
15
0
0
-17
+23
+23
Details
@@ -286,43 +286,35 @@
'}' is not preceded with whitespace.
-139
+
136
'}' is not preceded with whitespace.
-145
+
142
'}' is not preceded with whitespace.
-151
+
150
'}' is not preceded with whitespace.
-157
+
158
'}' is not preceded with whitespace.
-163
+
165
'}' is not preceded with whitespace.
-169
+
174
'}' is not preceded with whitespace.
-175
+
183
'}' is not preceded with whitespace.
-181
-
-'}' is not preceded with whitespace.
-187
-
-'}' is not preceded with whitespace.
-193
+
192
'}' is not preceded with whitespace.
@@ -338,19 +330,51 @@
'}' is not preceded with whitespace.
-217
+
218
'}' is not preceded with whitespace.
-223
+
225
'}' is not preceded with whitespace.
-229
+
232
'}' is not preceded with whitespace.
-235
+239
+'}' is not preceded with whitespace.
+246
+
+'}' is not preceded with whitespace.
+252
+
+'}' is not preceded with whitespace.
+258
+
+'}' is not preceded with whitespace.
+264
+
+'}' is not preceded with whitespace.
+270
+
+'}' is not preceded with whitespace.
+276
+
+'}' is not preceded with whitespace.
+282
+
+'}' is not preceded with whitespace.
+288
diff --git a/dependency-check-maven/checkstyle.rss b/dependency-check-maven/checkstyle.rss
index b22b78352..1004dd165 100644
--- a/dependency-check-maven/checkstyle.rss
+++ b/dependency-check-maven/checkstyle.rss
@@ -26,7 +26,7 @@ under the License.
©2013 - 2014 OWASP
-
File: 15,
- Errors: 17,
+ Errors: 23,
Warnings: 0,
Infos: 0
@@ -83,7 +83,7 @@ under the License.
0
- 17
+ 23
diff --git a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html
index 2f063c1c8..69d9a9c27 100644
--- a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html
+++ b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-maven/cobertura/frame-summary.html b/dependency-check-maven/cobertura/frame-summary.html
index 46555a9b7..83156e73b 100644
--- a/dependency-check-maven/cobertura/frame-summary.html
+++ b/dependency-check-maven/cobertura/frame-summary.html
@@ -16,8 +16,8 @@
-
+
diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html
index 9dd59c88c..3cc138816 100644
--- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html
+++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html
@@ -12,7 +12,7 @@
@@ -110,1555 +110,1778 @@
46
import org.apache.maven.reporting.MavenReportException;
47
- import org.owasp.dependencycheck.Engine;
+ import org.apache.maven.settings.Proxy; 48
- import org.owasp.dependencycheck.data.nvdcve.CveDB;
+ import org.owasp.dependencycheck.Engine; 49
- import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+ import org.owasp.dependencycheck.data.nvdcve.CveDB; 50
- import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+ import org.owasp.dependencycheck.data.nvdcve.DatabaseException; 51
- import org.owasp.dependencycheck.dependency.Dependency;
+ import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; 52
- import org.owasp.dependencycheck.dependency.Evidence;
+ import org.owasp.dependencycheck.dependency.Dependency; 53
- import org.owasp.dependencycheck.dependency.Identifier;
+ import org.owasp.dependencycheck.dependency.Evidence; 54
- import org.owasp.dependencycheck.dependency.Reference;
+ import org.owasp.dependencycheck.dependency.Identifier; 55
- import org.owasp.dependencycheck.dependency.Vulnerability;
+ import org.owasp.dependencycheck.dependency.Reference; 56
- import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+ import org.owasp.dependencycheck.dependency.Vulnerability; 57
- import org.owasp.dependencycheck.reporting.ReportGenerator;
+ import org.owasp.dependencycheck.dependency.VulnerableSoftware; 58
- import org.owasp.dependencycheck.utils.LogUtils;
+ import org.owasp.dependencycheck.reporting.ReportGenerator; 59
- import org.owasp.dependencycheck.utils.Settings;
+ import org.owasp.dependencycheck.utils.LogUtils; 60
-
+ import org.owasp.dependencycheck.utils.Settings; 61
-
- 62
-
- 63
-
- 64
-
- 65
-
- 66
- @Mojo(name = "check" , defaultPhase = LifecyclePhase.COMPILE, threadSafe = true ,
- 67
- requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
- 68
- requiresOnline = true )
- 69 0 public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
- 70
+ 62
+
+ 63
+
+ 64
+
+ 65
+
+ 66
+
+ 67
+ @Mojo(name = "check" , defaultPhase = LifecyclePhase.COMPILE, threadSafe = true ,
+ 68
+ requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
+ 69
+ requiresOnline = true )
+ 70 0 public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
71
-
+ 72
-
+ 73
-
+ 74
- private static final String PROPERTIES_FILE = "mojo.properties" ;
+ 75
-
+ private static final String PROPERTIES_FILE = "mojo.properties" ; 76
-
+ 77
-
+ 78
- private static final String LOG_PROPERTIES_FILE = "log.properties" ;
+ 79
-
+ private static final String LOG_PROPERTIES_FILE = "log.properties" ; 80
-
+ 81
+
+ 82
- 82 0 private static final String NEW_LINE = System.getProperty("line.separator" , "\n" ).intern();
- 83
-
+ 83 0 private static final String NEW_LINE = System.getProperty("line.separator" , "\n" ).intern();
84
-
+ 85
-
+ 86
-
+ 87
- @Component
+ 88
- private MavenProject project;
+ @Component 89
-
+ private MavenProject project; 90
-
+ 91
-
- 92
- @Parameter(property = "report-name" , defaultValue = "dependency-check-report" )
- 93
- private String reportName;
- 94
-
- 95
- 96
+ 92
- 97
+ 93
@Parameter(property = "logfile" , defaultValue = "" )
- 98
+ 94
private String logFile;
- 99
+ 95
- 100
+ 96
- 101
+ 97
- 102
+ 98
@Parameter(property = "name" , defaultValue = "Dependency-Check" )
- 103
+ 99
private String name;
- 104
+ 100
- 105
+ 101
- 106
+ 102
- 107
+ 103
@Parameter(property = "description" , defaultValue = "A report providing details on any published "
- 108
+ 104
+ "vulnerabilities within project dependencies. This report is a best effort but may contain "
- 109
+ 105
+ "false positives and false negatives." )
- 110
+ 106
private String description;
+ 107
+
+ 108
+
+ 109
+
+ 110
+
111
-
- 112
-
- 113
-
- 114
@Parameter(property = "reportOutputDirectory" , defaultValue = "${project.reporting.outputDirectory}" , required = true )
- 115
+ 112
private File reportOutputDirectory;
+ 113
+
+ 114
+
+ 115
+
116
-
- 117
-
- 118
-
- 119
-
- 120 0 @SuppressWarnings("CanBeFinal" )
- 121
- @Parameter(property = "failBuildOnCVSS" , defaultValue = "11" , required = true )
- 122
- private float failBuildOnCVSS = 11;
- 123
-
- 124
-
- 125
-
- 126
@Parameter(defaultValue = "${project.build.directory}" , required = true )
- 127
+ 117
private File outputDirectory;
- 128
+ 118
- 129
+ 119
+
+ 120
+
+ 121
+
+ 122 0 @SuppressWarnings("CanBeFinal" )
+ 123
+ @Parameter(property = "failBuildOnCVSS" , defaultValue = "11" , required = true )
+ 124
+ private float failBuildOnCVSS = 11;
+ 125
+
+ 126
- 130
+ 127
- 131
+ 128
- 132 0 @SuppressWarnings("CanBeFinal" )
- 133
+ 129 0 @SuppressWarnings("CanBeFinal" )
+ 130
@Parameter(property = "autoupdate" , defaultValue = "true" , required = true )
- 134
+ 131
private boolean autoUpdate = true ;
- 135
+ 132
- 136
+ 133
- 137
+ 134
- 138
+ 135
- 139 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 140
+ 136 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 137
@Parameter(property = "format" , defaultValue = "HTML" , required = true )
- 141
+ 138
private String format = "HTML" ;
- 142
+ 139
- 143
+ 140
- 144
+ 141
- 145 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 146
+ 142 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 143
@Parameter(property = "externalReport" , defaultValue = "false" , required = true )
- 147
+ 144
private boolean externalReport = false ;
- 148
+ 145
- 149
+ 146
- 150
+ 147
+
+ 148
+
+ 149
- 151 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 152
+ 150 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 151
@Parameter(property = "proxyUrl" , defaultValue = "" , required = false )
+ 152
+ @Deprecated
153
private String proxyUrl = null ;
154
-
+ 155
-
+ 156
+
+ 157
- 157 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
158
- @Parameter(property = "proxyPort" , defaultValue = "" , required = false )
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 159
- private String proxyPort = null ;
+ @Parameter(property = "mavenSettings" , defaultValue = "${settings}" , required = false ) 160
-
+ private org.apache.maven.settings.Settings mavenSettings; 161
-
+ 162
-
- 163 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 163
+
164
- @Parameter(property = "proxyUsername" , defaultValue = "" , required = false )
+ 165
- private String proxyUsername = null ;
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 166
-
+ @Parameter(property = "mavenSettingsProxyId" , required = false ) 167
-
+ private String mavenSettingsProxyId; 168
-
- 169 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 170
- @Parameter(property = "proxyPassword" , defaultValue = "" , required = false )
- 171
- private String proxyPassword = null ;
- 172
+
+ 169
+ 170
+
+ 171
+
+ 172
+
173
-
- 174
- 175 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 174 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 175
+ @Parameter(property = "proxyPort" , defaultValue = "" , required = false )
176
- @Parameter(property = "connectionTimeout" , defaultValue = "" , required = false )
+ @Deprecated 177
- private String connectionTimeout = null ;
+ private String proxyPort = null ; 178
179
-
+ 180
-
- 181 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 181
+
182
- @Parameter(property = "suppressionFile" , defaultValue = "" , required = false )
- 183
- private String suppressionFile = null ;
+ 183 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
184
-
+ @Parameter(property = "proxyUsername" , defaultValue = "" , required = false ) 185
-
+ @Deprecated 186
-
- 187 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 188
- @Parameter(property = "showSummary" , defaultValue = "true" , required = false )
- 189
- private boolean showSummary = true ;
- 190
+ private String proxyUsername = null ;
+ 187
+ 188
+
+ 189
+
+ 190
+
191
-
- 192
- 193 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 192 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 193
+ @Parameter(property = "proxyPassword" , defaultValue = "" , required = false )
194
- @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false )
+ @Deprecated 195
- private boolean nexusAnalyzerEnabled = true ;
+ private String proxyPassword = null ; 196
197
-
+ 198
- 199
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 199 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
200
- @Parameter(property = "nexusUrl" , defaultValue = "" , required = false )
+ @Parameter(property = "connectionTimeout" , defaultValue = "" , required = false ) 201
- private String nexusUrl;
+ private String connectionTimeout = null ; 202
203
-
+ 204
205 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
206
- @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false )
+ @Parameter(property = "suppressionFile" , defaultValue = "" , required = false ) 207
- private boolean nexusUsesProxy = true ;
+ private String suppressionFile = null ; 208
209
-
+ 210
- 211
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 211 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
212
- @Parameter(property = "connectionString" , defaultValue = "" , required = false )
+ @Parameter(property = "showSummary" , defaultValue = "true" , required = false ) 213
- private String connectionString;
+ private boolean showSummary = true ; 214
-
+ 215
-
+ 216
-
+ 217
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 218
- @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false )
+ 218 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
219
- private String databaseDriverName;
+ @Parameter(property = "jarAnalyzerEnabled" , defaultValue = "true" , required = false ) 220
-
+ private boolean jarAnalyzerEnabled = true ; 221
-
+ 222
-
+ 223
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 224
- @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false )
- 225
- private String databaseDriverPath;
+ 225 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
226
-
+ @Parameter(property = "archiveAnalyzerEnabled" , defaultValue = "true" , required = false ) 227
-
+ private boolean archiveAnalyzerEnabled = true ; 228
-
+ 229
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 230
- @Parameter(property = "databaseUser" , defaultValue = "" , required = false )
+ 231
- private String databaseUser;
- 232
-
+ 232 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
233
-
+ @Parameter(property = "assemblyAnalyzerEnabled" , defaultValue = "true" , required = false ) 234
-
+ private boolean assemblyAnalyzerEnabled = true ; 235
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 236
- @Parameter(property = "databasePassword" , defaultValue = "" , required = false )
- 237
- private String databasePassword;
- 238
- 239
-
- 240
+ 237
+
+ 238
+ 239 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 240
+ @Parameter(property = "nuspecAnalyzerEnabled" , defaultValue = "true" , required = false )
241
- @Parameter(property = "zipExtensions" , required = false )
+ private boolean nuspecAnalyzerEnabled = true ; 242
- private String zipExtensions;
+ 243
244
-
+ 245
- 246 0 @SuppressWarnings("CanBeFinal" )
+ 246 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
247
- @Parameter(property = "skipTestScope" , defaultValue = "true" , required = false )
+ @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false ) 248
- private boolean skipTestScope = true ;
+ private boolean nexusAnalyzerEnabled = true ; 249
250
-
+ 251
- 252 0 @SuppressWarnings("CanBeFinal" )
+ 252
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
253
- @Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false )
+ @Parameter(property = "nexusUrl" , defaultValue = "" , required = false ) 254
- private boolean skipRuntimeScope = false ;
+ private String nexusUrl; 255
256
-
+ 257
- 258 0 @SuppressWarnings("CanBeFinal" )
+ 258 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
259
- @Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false )
+ @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false ) 260
- private boolean skipProvidedScope = false ;
+ private boolean nexusUsesProxy = true ; 261
262
-
+ 263
264
- @Parameter(property = "dataDirectory" , defaultValue = "" , required = false )
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 265
- private String dataDirectory;
+ @Parameter(property = "connectionString" , defaultValue = "" , required = false ) 266
-
+ private String connectionString; 267
-
+ 268
-
+ 269
- @Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false )
+ 270
- private String cveUrl12Modified;
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 271
-
+ @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false ) 272
-
+ private String databaseDriverName; 273
-
+ 274
- @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false )
+ 275
- private String cveUrl20Modified;
+ 276
-
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 277
-
+ @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false ) 278
-
+ private String databaseDriverPath; 279
- @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false )
+ 280
- private String cveUrl12Base;
+ 281
-
+ 282
-
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 283
-
+ @Parameter(property = "databaseUser" , defaultValue = "" , required = false ) 284
- @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false )
+ private String databaseUser; 285
- private String cveUrl20Base;
+ 286
-
+ 287
-
+ 288
-
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" }) 289
-
+ @Parameter(property = "databasePassword" , defaultValue = "" , required = false ) 290
- @Parameter(property = "pathToMono" , defaultValue = "" , required = false )
+ private String databasePassword; 291
- private String pathToMono;
- 292
-
- 293
-
- 294
- 295
-
- 296
-
- 297
-
- 298
-
- 299
+ 292
+
+ 293
+ 294
+ @Parameter(property = "zipExtensions" , required = false )
+ 295
+ private String zipExtensions;
+ 296
+
+ 297
+
+ 298
+
+ 299 0 @SuppressWarnings("CanBeFinal" )
300
- private Engine executeDependencyCheck() throws DatabaseException {
+ @Parameter(property = "skipTestScope" , defaultValue = "true" , required = false ) 301
-
- 302 0 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
- 303 0 LogUtils.prepareLogger(in, logFile);
+ private boolean skipTestScope = true ; 302
+
+ 303
+
304
-
- 305 0 populateSettings();
- 306 0 Engine engine = null ;
+ 305 0 @SuppressWarnings("CanBeFinal" )
+ 306
+ @Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false )
307
- try {
- 308 0 engine = new Engine();
- 309 0 final Set<Artifact> artifacts = project.getArtifacts();
- 310 0 for (Artifact a : artifacts) {
- 311 0 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
- 312 0 continue ;
+ private boolean skipRuntimeScope = false ; 308
+
+ 309
+
+ 310
+
+ 311 0 @SuppressWarnings("CanBeFinal" )
+ 312
+ @Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false )
313
- }
+ private boolean skipProvidedScope = false ; 314
-
- 315 0 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
- 316 0 continue ;
+ 315
+
+ 316
+
317
- }
+ @Parameter(property = "dataDirectory" , defaultValue = "" , required = false ) 318
-
- 319 0 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
- 320 0 continue ;
+ private String dataDirectory; 319
+
+ 320
+
321
- }
+ 322
-
- 323 0 engine.scan(a.getFile().getAbsolutePath());
- 324 0 }
- 325 0 engine.analyzeDependencies();
+ @Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false ) 323
+ private String cveUrl12Modified;
+ 324
+
+ 325
+
326
- } finally {
- 327 0 if (engine != null ) {
- 328 0 engine.cleanup();
+ 327
+ @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false )
+ 328
+ private String cveUrl20Modified;
329
- }
+ 330
- }
- 331 0 return engine;
+ 331
+
332
- }
+ @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false ) 333
-
+ private String cveUrl12Base; 334
335
-
+ 336
-
+ 337
-
+ @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false ) 338
-
+ private String cveUrl20Base; 339
- private void generateExternalReports(Engine engine) {
- 340 0 DatabaseProperties prop = null ;
- 341 0 CveDB cve = null ;
- 342
- try {
- 343 0 cve = new CveDB();
- 344 0 cve.open();
- 345 0 prop = cve.getDatabaseProperties();
- 346 0 } catch (DatabaseException ex) {
- 347 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
- 348
- } finally {
- 349 0 if (cve != null ) {
- 350 0 cve.close();
- 351
- }
- 352
- }
- 353 0 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
- 354
- try {
- 355 0 r.generateReports(outputDirectory.getCanonicalPath(), format);
- 356 0 } catch (IOException ex) {
- 357 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
- 358
- "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 359 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
- 360 0 } catch (Throwable ex) {
- 361 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
- 362
- "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 363 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
- 364 0 }
- 365 0 }
- 366
- 367
+ 340
- 368
-
- 369
-
- 370
-
- 371
-
- 372
+ 341
+
+ 342
- 373
- private void generateMavenSiteReport(final Engine engine, Sink sink) {
- 374 0 final List<Dependency> dependencies = engine.getDependencies();
+ 343
+ @Parameter(property = "pathToMono" , defaultValue = "" , required = false )
+ 344
+ private String pathToMono;
+ 345
+
+ 346
+
+ 347
+
+ 348
+
+ 349
+
+ 350
+
+ 351
+
+ 352
+
+ 353
+ private Engine executeDependencyCheck() throws DatabaseException {
+ 354
+
+ 355 0 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+ 356 0 LogUtils.prepareLogger(in, logFile);
+ 357
+
+ 358 0 populateSettings();
+ 359 0 Engine engine = null ;
+ 360
+ try {
+ 361 0 engine = new Engine();
+ 362 0 final Set<Artifact> artifacts = project.getArtifacts();
+ 363 0 for (Artifact a : artifacts) {
+ 364 0 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
+ 365 0 continue ;
+ 366
+ }
+ 367
+
+ 368 0 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
+ 369 0 continue ;
+ 370
+ }
+ 371
+
+ 372 0 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
+ 373 0 continue ;
+ 374
+ }
375
- 376 0 writeSiteReportHeader(sink, project.getName());
- 377 0 writeSiteReportTOC(sink, dependencies);
- 378
+ 376 0 engine.scan(a.getFile().getAbsolutePath());
+ 377 0 }
+ 378 0 engine.analyzeDependencies();
+ 379
+ } finally {
+ 380 0 if (engine != null ) {
+ 381 0 engine.cleanup();
+ 382
+ }
+ 383
+ }
+ 384 0 return engine;
+ 385
+ }
+ 386
- 379 0 int cnt = 0;
- 380 0 for (Dependency d : dependencies) {
- 381 0 writeSiteReportDependencyHeader(sink, d);
- 382 0 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
- 383 0 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
- 384 0 writeSiteReportDependencyIdentifiers(d, sink);
- 385 0 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
- 386 0 }
- 387 0 sink.body_();
- 388 0 }
- 389
-
- 390
-
- 391
+ 387
- 392
-
- 393
+ 388
+
+ 389
- 394
-
- 395
-
- 396
-
- 397
+ 390
+
+ 391
+
+ 392
- 398
- private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
- 399 0 int cnt = collapsibleHeaderCount;
- 400 0 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
- 401 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 393
+ private void generateExternalReports(Engine engine, File outDirectory) {
+ 394 0 DatabaseProperties prop = null ;
+ 395 0 CveDB cve = null ;
+ 396
+ try {
+ 397 0 cve = new CveDB();
+ 398 0 cve.open();
+ 399 0 prop = cve.getDatabaseProperties();
+ 400 0 } catch (DatabaseException ex) {
+ 401 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
402
-
- 403 0 sink.paragraph();
- 404 0 sink.bold();
+ } finally { 403 0 if (cve != null ) {
+ 404 0 cve.close();
405
- try {
- 406 0 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
- 407 0 sink.text(v.getName());
- 408 0 sink.link_();
- 409 0 sink.bold_();
- 410 0 } catch (UnsupportedEncodingException ex) {
- 411 0 sink.text(v.getName());
- 412 0 sink.bold_();
- 413 0 sink.lineBreak();
- 414 0 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
- 415 0 }
- 416 0 sink.paragraph_();
- 417 0 sink.paragraph();
- 418 0 sink.text("Severity: " );
- 419 0 if (v.getCvssScore() < 4.0) {
- 420 0 sink.text("Low" );
+ } 406
+ }
+ 407 0 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
+ 408
+ try {
+ 409 0 r.generateReports(outDirectory.getCanonicalPath(), format);
+ 410 0 } catch (IOException ex) {
+ 411 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+ 412
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 413 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
+ 414 0 } catch (Throwable ex) {
+ 415 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+ 416
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 417 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
+ 418 0 }
+ 419 0 }
+ 420
+
421
- } else {
- 422 0 if (v.getCvssScore() >= 7.0) {
- 423 0 sink.text("High" );
+ 422
+
+ 423
+
424
- } else {
- 425 0 sink.text("Medium" );
+ 425
+
426
- }
+ 427
- }
- 428 0 sink.lineBreak();
- 429 0 sink.text("CVSS Score: " + v.getCvssScore());
- 430 0 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
- 431 0 sink.lineBreak();
- 432 0 sink.text("CWE: " );
- 433 0 sink.text(v.getCwe());
- 434
- }
- 435 0 sink.paragraph_();
- 436 0 sink.paragraph();
- 437 0 sink.text(v.getDescription());
- 438 0 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
- 439 0 sink.list();
- 440 0 for (Reference ref : v.getReferences()) {
- 441 0 sink.listItem();
- 442 0 sink.text(ref.getSource());
- 443 0 sink.text(" - " );
- 444 0 sink.link(ref.getUrl());
- 445 0 sink.text(ref.getName());
- 446 0 sink.link_();
- 447 0 sink.listItem_();
- 448 0 }
- 449 0 sink.list_();
+ private void generateMavenSiteReport(final Engine engine, Sink sink) { 428 0 final List<Dependency> dependencies = engine.getDependencies();
+ 429
+
+ 430 0 writeSiteReportHeader(sink, project.getName());
+ 431 0 writeSiteReportTOC(sink, dependencies);
+ 432
+
+ 433 0 int cnt = 0;
+ 434 0 for (Dependency d : dependencies) {
+ 435 0 writeSiteReportDependencyHeader(sink, d);
+ 436 0 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
+ 437 0 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
+ 438 0 writeSiteReportDependencyIdentifiers(d, sink);
+ 439 0 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
+ 440 0 }
+ 441 0 sink.body_();
+ 442 0 }
+ 443
+
+ 444
+
+ 445
+
+ 446
+
+ 447
+
+ 448
+
+ 449
+
450
- }
- 451 0 sink.paragraph_();
- 452 0 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
- 453 0 sink.paragraph();
- 454
+
+ 451
+
+ 452
+ private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
+ 453 0 int cnt = collapsibleHeaderCount;
+ 454 0 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
+ 455 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 456
- 455 0 cnt += 1;
- 456 0 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
- 457 0 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
- 458 0 sink.list();
- 459 0 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
- 460 0 sink.listItem();
- 461
- try {
- 462 0 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
- 463 0 sink.text(vs.getName());
- 464 0 sink.link_();
- 465 0 if (vs.hasPreviousVersion()) {
- 466 0 sink.text(" and all previous versions." );
- 467
- }
- 468 0 } catch (UnsupportedEncodingException ex) {
- 469 0 sink.text(vs.getName());
- 470 0 if (vs.hasPreviousVersion()) {
- 471 0 sink.text(" and all previous versions." );
- 472
- }
- 473 0 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
- 474 0 }
+ 457 0 sink.paragraph();
+ 458 0 sink.bold();
+ 459
+ try {
+ 460 0 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
+ 461 0 sink.text(v.getName());
+ 462 0 sink.link_();
+ 463 0 sink.bold_();
+ 464 0 } catch (UnsupportedEncodingException ex) {
+ 465 0 sink.text(v.getName());
+ 466 0 sink.bold_();
+ 467 0 sink.lineBreak();
+ 468 0 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
+ 469 0 }
+ 470 0 sink.paragraph_();
+ 471 0 sink.paragraph();
+ 472 0 sink.text("Severity: " );
+ 473 0 if (v.getCvssScore() < 4.0) {
+ 474 0 sink.text("Low" );
475
-
- 476 0 sink.listItem_();
- 477 0 }
- 478 0 sink.list_();
- 479 0 sink.rawText("</div>" );
- 480 0 sink.paragraph_();
+ } else { 476 0 if (v.getCvssScore() >= 7.0) {
+ 477 0 sink.text("High" );
+ 478
+ } else {
+ 479 0 sink.text("Medium" );
+ 480
+ }
481
}
- 482 0 }
- 483
- }
- 484 0 }
- 485
-
- 486
-
- 487
-
+ 482 0 sink.lineBreak();
+ 483 0 sink.text("CVSS Score: " + v.getCvssScore());
+ 484 0 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
+ 485 0 sink.lineBreak();
+ 486 0 sink.text("CWE: " );
+ 487 0 sink.text(v.getCwe());
488
-
- 489
-
- 490
-
- 491
-
- 492
- private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
- 493 0 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
- 494 0 sink.sectionTitle4();
- 495 0 sink.text("Identifiers" );
- 496 0 sink.sectionTitle4_();
- 497 0 sink.list();
- 498 0 for (Identifier i : d.getIdentifiers()) {
- 499 0 sink.listItem();
- 500 0 sink.text(i.getType());
- 501 0 sink.text(": " );
- 502 0 if (i.getUrl() != null && i.getUrl().length() > 0) {
- 503 0 sink.link(i.getUrl());
- 504 0 sink.text(i.getValue());
- 505 0 sink.link_();
- 506
- } else {
- 507 0 sink.text(i.getValue());
+ } 489 0 sink.paragraph_();
+ 490 0 sink.paragraph();
+ 491 0 sink.text(v.getDescription());
+ 492 0 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
+ 493 0 sink.list();
+ 494 0 for (Reference ref : v.getReferences()) {
+ 495 0 sink.listItem();
+ 496 0 sink.text(ref.getSource());
+ 497 0 sink.text(" - " );
+ 498 0 sink.link(ref.getUrl());
+ 499 0 sink.text(ref.getName());
+ 500 0 sink.link_();
+ 501 0 sink.listItem_();
+ 502 0 }
+ 503 0 sink.list_();
+ 504
+ }
+ 505 0 sink.paragraph_();
+ 506 0 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
+ 507 0 sink.paragraph();
508
- }
- 509 0 if (i.getDescription() != null && i.getDescription().length() > 0) {
- 510 0 sink.lineBreak();
- 511 0 sink.text(i.getDescription());
- 512
- }
- 513 0 sink.listItem_();
- 514 0 }
- 515 0 sink.list_();
- 516
- }
- 517 0 }
- 518
- 519
-
- 520
-
+ 509 0 cnt += 1;
+ 510 0 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
+ 511 0 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
+ 512 0 sink.list();
+ 513 0 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
+ 514 0 sink.listItem();
+ 515
+ try {
+ 516 0 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
+ 517 0 sink.text(vs.getName());
+ 518 0 sink.link_();
+ 519 0 if (vs.hasPreviousVersion()) {
+ 520 0 sink.text(" and all previous versions." );
521
-
- 522
-
- 523
-
- 524
-
- 525
-
+ } 522 0 } catch (UnsupportedEncodingException ex) {
+ 523 0 sink.text(vs.getName());
+ 524 0 if (vs.hasPreviousVersion()) {
+ 525 0 sink.text(" and all previous versions." );
526
-
- 527
- private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
- 528 0 int cnt = collapsibleHeaderCount;
- 529 0 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
- 530 0 cnt += 1;
- 531 0 sink.sectionTitle4();
- 532 0 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
- 533 0 sink.sectionTitle4_();
- 534 0 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
- 535 0 sink.list();
- 536 0 for (Dependency r : d.getRelatedDependencies()) {
- 537 0 sink.listItem();
- 538 0 sink.text(r.getFileName());
- 539 0 sink.list();
- 540 0 writeListItem(sink, "File Path: " + r.getFilePath());
- 541 0 writeListItem(sink, "SHA1: " + r.getSha1sum());
- 542 0 writeListItem(sink, "MD5: " + r.getMd5sum());
- 543 0 sink.list_();
- 544 0 sink.listItem_();
- 545 0 }
- 546 0 sink.list_();
- 547 0 sink.rawText("</div>" );
- 548
- }
- 549 0 return cnt;
- 550
- }
- 551
+ }
+ 527 0 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
+ 528 0 }
+ 529
- 552
+ 530 0 sink.listItem_();
+ 531 0 }
+ 532 0 sink.list_();
+ 533 0 sink.rawText("</div>" );
+ 534 0 sink.paragraph_();
+ 535
+ }
+ 536 0 }
+ 537
+ }
+ 538 0 }
+ 539
+
+ 540
- 553
-
- 554
+ 541
+
+ 542
- 555
+ 543
- 556
+ 544
- 557
-
- 558
-
- 559
+ 545
+ 546
+ private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
+ 547 0 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
+ 548 0 sink.sectionTitle4();
+ 549 0 sink.text("Identifiers" );
+ 550 0 sink.sectionTitle4_();
+ 551 0 sink.list();
+ 552 0 for (Identifier i : d.getIdentifiers()) {
+ 553 0 sink.listItem();
+ 554 0 sink.text(i.getType());
+ 555 0 sink.text(": " );
+ 556 0 if (i.getUrl() != null && i.getUrl().length() > 0) {
+ 557 0 sink.link(i.getUrl());
+ 558 0 sink.text(i.getValue());
+ 559 0 sink.link_();
560
- private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
- 561 0 int cnt = collapsibleHeaderCount;
- 562 0 if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
- 563 0 cnt += 1;
- 564 0 sink.sectionTitle4();
- 565 0 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
- 566 0 sink.sectionTitle4_();
- 567 0 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
- 568 0 sink.table();
- 569 0 sink.tableRow();
- 570 0 writeTableHeaderCell(sink, "Source" );
- 571 0 writeTableHeaderCell(sink, "Name" );
- 572 0 writeTableHeaderCell(sink, "Value" );
- 573 0 sink.tableRow_();
- 574 0 for (Evidence e : d.getEvidenceUsed()) {
- 575 0 sink.tableRow();
- 576 0 writeTableCell(sink, e.getSource());
- 577 0 writeTableCell(sink, e.getName());
- 578 0 writeTableCell(sink, e.getValue());
- 579 0 sink.tableRow_();
- 580 0 }
- 581 0 sink.table_();
- 582 0 sink.rawText("</div>" );
- 583
+ } else {
+ 561 0 sink.text(i.getValue());
+ 562
+ }
+ 563 0 if (i.getDescription() != null && i.getDescription().length() > 0) {
+ 564 0 sink.lineBreak();
+ 565 0 sink.text(i.getDescription());
+ 566
+ }
+ 567 0 sink.listItem_();
+ 568 0 }
+ 569 0 sink.list_();
+ 570
}
- 584 0 return cnt;
- 585
- }
- 586
+ 571 0 }
+ 572
- 587
+ 573
- 588
-
- 589
+ 574
+
+ 575
- 590
+ 576
- 591
+ 577
- 592
+ 578
+
+ 579
+
+ 580
- 593
- private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
- 594 0 sink.sectionTitle2();
- 595 0 sink.anchor("sha1" + d.getSha1sum());
- 596 0 sink.text(d.getFileName());
- 597 0 sink.anchor_();
- 598 0 sink.sectionTitle2_();
- 599 0 if (d.getDescription() != null && d.getDescription().length() > 0) {
- 600 0 sink.paragraph();
- 601 0 sink.bold();
- 602 0 sink.text("Description: " );
- 603 0 sink.bold_();
- 604 0 sink.text(d.getDescription());
- 605 0 sink.paragraph_();
+ 581
+ private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
+ 582 0 int cnt = collapsibleHeaderCount;
+ 583 0 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
+ 584 0 cnt += 1;
+ 585 0 sink.sectionTitle4();
+ 586 0 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
+ 587 0 sink.sectionTitle4_();
+ 588 0 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
+ 589 0 sink.list();
+ 590 0 for (Dependency r : d.getRelatedDependencies()) {
+ 591 0 sink.listItem();
+ 592 0 sink.text(r.getFileName());
+ 593 0 sink.list();
+ 594 0 writeListItem(sink, "File Path: " + r.getFilePath());
+ 595 0 writeListItem(sink, "SHA1: " + r.getSha1sum());
+ 596 0 writeListItem(sink, "MD5: " + r.getMd5sum());
+ 597 0 sink.list_();
+ 598 0 sink.listItem_();
+ 599 0 }
+ 600 0 sink.list_();
+ 601 0 sink.rawText("</div>" );
+ 602
+ }
+ 603 0 return cnt;
+ 604
+ }
+ 605
+
606
- }
- 607 0 if (d.getLicense() != null && d.getLicense().length() > 0) {
- 608 0 sink.paragraph();
- 609 0 sink.bold();
- 610 0 sink.text("License: " );
- 611 0 sink.bold_();
- 612 0 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
- 613 0 sink.link(d.getLicense());
- 614 0 sink.text(d.getLicense());
- 615 0 sink.link_();
- 616
- } else {
- 617 0 sink.text(d.getLicense());
- 618
- }
- 619 0 sink.paragraph_();
- 620
- }
- 621 0 }
- 622
-
- 623
- 624
-
- 625
+ 607
+
+ 608
- 626
+ 609
+
+ 610
- 627
-
- 628
+ 611
+
+ 612
+
+ 613
- 629
- private void writeListItem(Sink sink, String text) {
- 630 0 sink.listItem();
- 631 0 sink.text(text);
- 632 0 sink.listItem_();
- 633 0 }
- 634
-
- 635
-
- 636
-
+ 614
+ private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
+ 615 0 int cnt = collapsibleHeaderCount;
+ 616 0 if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
+ 617 0 cnt += 1;
+ 618 0 sink.sectionTitle4();
+ 619 0 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
+ 620 0 sink.sectionTitle4_();
+ 621 0 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
+ 622 0 sink.table();
+ 623 0 sink.tableRow();
+ 624 0 writeTableHeaderCell(sink, "Source" );
+ 625 0 writeTableHeaderCell(sink, "Name" );
+ 626 0 writeTableHeaderCell(sink, "Value" );
+ 627 0 sink.tableRow_();
+ 628 0 for (Evidence e : d.getEvidenceUsed()) {
+ 629 0 sink.tableRow();
+ 630 0 writeTableCell(sink, e.getSource());
+ 631 0 writeTableCell(sink, e.getName());
+ 632 0 writeTableCell(sink, e.getValue());
+ 633 0 sink.tableRow_();
+ 634 0 }
+ 635 0 sink.table_();
+ 636 0 sink.rawText("</div>" );
637
-
- 638
-
+ } 638 0 return cnt;
639
-
+ } 640
-
+ 641
- private void writeTableCell(Sink sink, String text) {
- 642 0 sink.tableCell();
- 643 0 sink.text(text);
- 644 0 sink.tableCell_();
- 645 0 }
+ 642
+
+ 643
+
+ 644
+
+ 645
+
646
-
+ 647
-
- 648
-
- 649
-
- 650
-
- 651
-
- 652
-
- 653
- private void writeTableHeaderCell(Sink sink, String text) {
- 654 0 sink.tableHeaderCell();
- 655 0 sink.text(text);
- 656 0 sink.tableHeaderCell_();
- 657 0 }
- 658
-
- 659
-
+ private void writeSiteReportDependencyHeader(Sink sink, Dependency d) { 648 0 sink.sectionTitle2();
+ 649 0 sink.anchor("sha1" + d.getSha1sum());
+ 650 0 sink.text(d.getFileName());
+ 651 0 sink.anchor_();
+ 652 0 sink.sectionTitle2_();
+ 653 0 if (d.getDescription() != null && d.getDescription().length() > 0) {
+ 654 0 sink.paragraph();
+ 655 0 sink.bold();
+ 656 0 sink.text("Description: " );
+ 657 0 sink.bold_();
+ 658 0 sink.text(d.getDescription());
+ 659 0 sink.paragraph_();
660
-
- 661
-
- 662
-
- 663
-
- 664
-
- 665
- private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
- 666 0 sink.list();
- 667 0 for (Dependency d : dependencies) {
- 668 0 sink.listItem();
- 669 0 sink.link("#sha1" + d.getSha1sum());
- 670 0 sink.text(d.getFileName());
- 671 0 sink.link_();
- 672 0 if (!d.getVulnerabilities().isEmpty()) {
- 673 0 sink.rawText(" <font style=\"color:red\">•</font>" );
+ } 661 0 if (d.getLicense() != null && d.getLicense().length() > 0) {
+ 662 0 sink.paragraph();
+ 663 0 sink.bold();
+ 664 0 sink.text("License: " );
+ 665 0 sink.bold_();
+ 666 0 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
+ 667 0 sink.link(d.getLicense());
+ 668 0 sink.text(d.getLicense());
+ 669 0 sink.link_();
+ 670
+ } else {
+ 671 0 sink.text(d.getLicense());
+ 672
+ }
+ 673 0 sink.paragraph_();
674
- }
- 675 0 if (!d.getRelatedDependencies().isEmpty()) {
- 676 0 sink.list();
- 677 0 for (Dependency r : d.getRelatedDependencies()) {
- 678 0 writeListItem(sink, r.getFileName());
- 679 0 }
- 680 0 sink.list_();
- 681
- }
- 682 0 sink.listItem_();
- 683 0 }
- 684 0 sink.list_();
- 685 0 }
- 686
+ }
+ 675 0 }
+ 676
- 687
+ 677
- 688
-
- 689
+ 678
+
+ 679
- 690
+ 680
- 691
-
- 692
+ 681
+
+ 682
- 693
- private void writeSiteReportHeader(Sink sink, String projectName) {
- 694 0 sink.head();
- 695 0 sink.title();
- 696 0 sink.text("Dependency-Check Report: " + projectName);
- 697 0 sink.title_();
- 698 0 sink.head_();
- 699 0 sink.body();
- 700 0 sink.rawText("<script type=\"text/javascript\">" );
- 701 0 sink.rawText("function toggleElement(el, targetId) {" );
- 702 0 sink.rawText("if (el.innerText == '[+]') {" );
- 703 0 sink.rawText(" el.innerText = '[-]';" );
- 704 0 sink.rawText(" document.getElementById(targetId).style.display='block';" );
- 705 0 sink.rawText("} else {" );
- 706 0 sink.rawText(" el.innerText = '[+]';" );
- 707 0 sink.rawText(" document.getElementById(targetId).style.display='none';" );
- 708 0 sink.rawText("}" );
- 709
+ 683
+ private void writeListItem(Sink sink, String text) {
+ 684 0 sink.listItem();
+ 685 0 sink.text(text);
+ 686 0 sink.listItem_();
+ 687 0 }
+ 688
- 710 0 sink.rawText("}" );
- 711 0 sink.rawText("</script>" );
- 712 0 sink.section1();
- 713 0 sink.sectionTitle1();
- 714 0 sink.text("Project: " + projectName);
- 715 0 sink.sectionTitle1_();
- 716 0 sink.date();
- 717 0 final Date now = new Date();
- 718 0 sink.text(DateFormat.getDateTimeInstance().format(now));
- 719 0 sink.date_();
- 720 0 sink.section1_();
- 721 0 }
- 722
-
- 723
-
- 724
+ 689
- 725
-
- 726
-
- 727
+ 690
+
+ 691
+
+ 692
+
+ 693
+
+ 694
+ 695
+ private void writeTableCell(Sink sink, String text) {
+ 696 0 sink.tableCell();
+ 697 0 sink.text(text);
+ 698 0 sink.tableCell_();
+ 699 0 }
+ 700
+
+ 701
+
+ 702
+
+ 703
+
+ 704
+
+ 705
+
+ 706
+
+ 707
+ private void writeTableHeaderCell(Sink sink, String text) {
+ 708 0 sink.tableHeaderCell();
+ 709 0 sink.text(text);
+ 710 0 sink.tableHeaderCell_();
+ 711 0 }
+ 712
+
+ 713
+
+ 714
+
+ 715
+
+ 716
+
+ 717
+
+ 718
+
+ 719
+ private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
+ 720 0 sink.list();
+ 721 0 for (Dependency d : dependencies) {
+ 722 0 sink.listItem();
+ 723 0 sink.link("#sha1" + d.getSha1sum());
+ 724 0 sink.text(d.getFileName());
+ 725 0 sink.link_();
+ 726 0 if (!d.getVulnerabilities().isEmpty()) {
+ 727 0 sink.rawText(" <font style=\"color:red\">•</font>" );
728
- private void populateSettings() {
- 729 0 InputStream mojoProperties = null ;
- 730
- try {
- 731 0 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
- 732 0 Settings.mergeProperties(mojoProperties);
- 733 0 } catch (IOException ex) {
- 734 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
- 735 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
- 736
- } finally {
- 737 0 if (mojoProperties != null ) {
- 738
- try {
- 739 0 mojoProperties.close();
- 740 0 } catch (IOException ex) {
- 741 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINEST, null , ex);
- 742 0 }
- 743
}
+ 729 0 if (!d.getRelatedDependencies().isEmpty()) {
+ 730 0 sink.list();
+ 731 0 for (Dependency r : d.getRelatedDependencies()) {
+ 732 0 writeListItem(sink, r.getFileName());
+ 733 0 }
+ 734 0 sink.list_();
+ 735
+ }
+ 736 0 sink.listItem_();
+ 737 0 }
+ 738 0 sink.list_();
+ 739 0 }
+ 740
+
+ 741
+
+ 742
+
+ 743
+
744
- }
+ 745
-
- 746 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 746
+
747
+ private void writeSiteReportHeader(Sink sink, String projectName) {
+ 748 0 sink.head();
+ 749 0 sink.title();
+ 750 0 sink.text("Dependency-Check Report: " + projectName);
+ 751 0 sink.title_();
+ 752 0 sink.head_();
+ 753 0 sink.body();
+ 754 0 sink.rawText("<script type=\"text/javascript\">" );
+ 755 0 sink.rawText("function toggleElement(el, targetId) {" );
+ 756 0 sink.rawText("if (el.innerText == '[+]') {" );
+ 757 0 sink.rawText(" el.innerText = '[-]';" );
+ 758 0 sink.rawText(" document.getElementById(targetId).style.display='block';" );
+ 759 0 sink.rawText("} else {" );
+ 760 0 sink.rawText(" el.innerText = '[+]';" );
+ 761 0 sink.rawText(" document.getElementById(targetId).style.display='none';" );
+ 762 0 sink.rawText("}" );
+ 763
- 748 0 if (proxyUrl != null && !proxyUrl.isEmpty()) {
- 749 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
- 750
- }
- 751 0 if (proxyPort != null && !proxyPort.isEmpty()) {
- 752 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
- 753
- }
- 754 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
- 755 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
- 756
- }
- 757 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
- 758 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
- 759
- }
- 760 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
- 761 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
- 762
- }
- 763 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
- 764 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
- 765
- }
- 766 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
- 767 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
- 768 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
- 769
- }
- 770 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
- 771 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
- 772 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
- 773
- }
- 774 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
- 775 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 764 0 sink.rawText("}" );
+ 765 0 sink.rawText("</script>" );
+ 766 0 sink.section1();
+ 767 0 sink.sectionTitle1();
+ 768 0 sink.text("Project: " + projectName);
+ 769 0 sink.sectionTitle1_();
+ 770 0 sink.date();
+ 771 0 final Date now = new Date();
+ 772 0 sink.text(DateFormat.getDateTimeInstance().format(now));
+ 773 0 sink.date_();
+ 774 0 sink.section1_();
+ 775 0 }
776
- }
- 777 0 if (connectionString != null && !connectionString.isEmpty()) {
- 778 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 777
+
+ 778
+
779
- }
- 780 0 if (databaseUser != null && !databaseUser.isEmpty()) {
- 781 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+ 780
+
+ 781
+
782
- }
- 783 0 if (databasePassword != null && !databasePassword.isEmpty()) {
- 784 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
- 785
- }
- 786 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
- 787 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+ 783
+
+ 784
+ private String getMavenSettingsProxyUrl(Proxy proxy) {
+ 785 0 return new StringBuilder(proxy.getProtocol()).append("://" ).append(proxy.getHost()).toString();
+ 786
+ }
+ 787
+
788
- }
+ 789
-
+ 790
-
- 791 0 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
- 792 0 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
- 793 0 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
- 794
-
- 795
-
- 796 0 if (dataDirectory != null && !dataDirectory.isEmpty()) {
- 797 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
- 798
- }
- 799
-
- 800
-
- 801 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
- 802 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
- 803
- }
- 804 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
- 805 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
- 806
- }
- 807 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
- 808 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+ 791
+
+ 792
+
+ 793
+ private Proxy getMavenProxy() {
+ 794 0 if (mavenSettings != null ) {
+ 795 0 final List<Proxy> proxies = mavenSettings.getProxies();
+ 796 0 if (proxies != null && proxies.size() > 0) {
+ 797 0 if (mavenSettingsProxyId != null ) {
+ 798 0 for (Proxy proxy : proxies) {
+ 799 0 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
+ 800 0 return proxy;
+ 801
+ }
+ 802 0 }
+ 803 0 } else if (proxies.size() == 1) {
+ 804 0 return proxies.get(0);
+ 805
+ } else {
+ 806 0 throw new IllegalStateException("Ambigous proxy definition" );
+ 807
+ }
+ 808
+ }
809
}
- 810 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
- 811 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+ 810 0 return null ;
+ 811
+ }
812
- }
- 813 0 if (pathToMono != null && !pathToMono.isEmpty()) {
- 814 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+ 813
+
+ 814
+
815
- }
- 816 0 }
+ 816
+
817
-
- 818
-
+ private void populateSettings() { 818 0 InputStream mojoProperties = null ;
819
-
- 820
-
- 821
-
- 822
-
- 823
-
- 824
- public void execute() throws MojoExecutionException, MojoFailureException {
- 825 0 Engine engine = null ;
- 826
try {
- 827 0 engine = executeDependencyCheck();
- 828 0 generateExternalReports(engine);
- 829 0 if (this .showSummary) {
- 830 0 showSummary(engine.getDependencies());
- 831
+ 820 0 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+ 821 0 Settings.mergeProperties(mojoProperties);
+ 822 0 } catch (IOException ex) {
+ 823 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
+ 824 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
+ 825
+ } finally {
+ 826 0 if (mojoProperties != null ) {
+ 827
+ try {
+ 828 0 mojoProperties.close();
+ 829 0 } catch (IOException ex) {
+ 830 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINEST, null , ex);
+ 831 0 }
+ 832
}
- 832 0 if (this .failBuildOnCVSS <= 10) {
- 833 0 checkForFailure(engine.getDependencies());
+ 833
+ }
834
- }
- 835 0 } catch (DatabaseException ex) {
- 836 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
- 837
- "Unable to connect to the dependency-check database; analysis has stopped" );
- 838 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
- 839
- } finally {
- 840 0 if (engine != null ) {
- 841 0 engine.cleanup();
- 842
- }
- 843
- }
- 844 0 }
- 845
+ 835 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 836
+
+ 837 0 final Proxy proxy = getMavenProxy();
+ 838 0 if (proxy != null ) {
+ 839 0 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy));
+ 840 0 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
+ 841 0 final String userName = proxy.getUsername();
+ 842 0 final String password = proxy.getPassword();
+ 843 0 if (userName != null && password != null ) {
+ 844 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
+ 845 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
846
-
- 847
-
- 848
-
- 849
-
- 850
-
- 851
-
- 852
-
- 853
- public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
- 854
- Locale locale) throws MavenReportException {
- 855 0 generate((Sink) sink, null , locale);
- 856 0 }
- 857
-
- 858
-
- 859
-
- 860
-
- 861
-
- 862
-
- 863
-
- 864
-
- 865
-
- 866
- public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
- 867 0 Engine engine = null ;
- 868
- try {
- 869 0 engine = executeDependencyCheck();
- 870 0 generateMavenSiteReport(engine, sink);
- 871 0 } catch (DatabaseException ex) {
- 872 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
- 873
- "Unable to connect to the dependency-check database; analysis has stopped" );
- 874 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
- 875
- } finally {
- 876 0 if (engine != null ) {
- 877 0 engine.cleanup();
- 878
}
- 879
+ 847
}
- 880 0 }
- 881
+ 848
- 882
-
+ 849 0 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+ 850 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+ 851
+ }
+ 852 0 if (proxyPort != null && !proxyPort.isEmpty()) {
+ 853 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+ 854
+ }
+ 855 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+ 856 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+ 857
+ }
+ 858 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+ 859 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+ 860
+ }
+ 861 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+ 862 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+ 863
+ }
+ 864 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+ 865 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+ 866
+ }
+ 867
+
+ 868
+
+ 869
+
+ 870 0 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
+ 871
+
+ 872 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
+ 873
+
+ 874 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+ 875 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+ 876 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 877
+ }
+ 878 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+ 879
+
+ 880 0 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
+ 881 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+ 882 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
883
-
+ } 884
-
- 885
-
- 886
-
- 887
-
+ 885 0 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
+ 886 0 if (pathToMono != null && !pathToMono.isEmpty()) {
+ 887 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
888
- public String getOutputName() {
- 889 0 return reportName;
+ } 889
+
890
- }
- 891
-
- 892
-
+ 891 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+ 892 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
893
-
- 894
-
- 895
-
+ } 894 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+ 895 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
896
-
- 897
- public String getCategoryName() {
- 898 0 return MavenReport.CATEGORY_PROJECT_REPORTS;
+ } 897 0 if (connectionString != null && !connectionString.isEmpty()) {
+ 898 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
899
- }
- 900
-
- 901
-
+ } 900 0 if (databaseUser != null && !databaseUser.isEmpty()) {
+ 901 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
902
-
- 903
-
- 904
-
+ } 903 0 if (databasePassword != null && !databasePassword.isEmpty()) {
+ 904 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
905
-
+ } 906
-
- 907
- public String getName(Locale locale) {
- 908 0 return name;
+ 907 0 if (dataDirectory != null && !dataDirectory.isEmpty()) {
+ 908 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
909
- }
+ } 910
911
-
- 912
-
- 913
-
- 914
-
+ 912 0 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
+ 913 0 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
+ 914 0 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
915
-
+ 916
- public void setReportOutputDirectory(File directory) {
- 917 0 reportOutputDirectory = directory;
- 918 0 }
+ 917 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+ 918 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
919
-
- 920
-
- 921
-
+ } 920 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+ 921 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
922
-
- 923
-
- 924
-
+ } 923 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+ 924 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
925
- public File getReportOutputDirectory() {
- 926 0 return reportOutputDirectory;
- 927
- }
+ } 926 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+ 927 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
928
-
+ } 929
-
- 930
-
+ 930 0 }
931
-
+ 932
-
+ 933
-
+ 934
-
+ 935
- public String getDescription(Locale locale) {
- 936 0 return description;
+ 936
+
937
- }
+ 938
-
- 939
-
+ public void execute() throws MojoExecutionException, MojoFailureException { 939 0 Engine engine = null ;
940
-
- 941
-
- 942
-
- 943
-
- 944
- public boolean isExternalReport() {
- 945 0 return externalReport;
- 946
- }
- 947
-
- 948
-
- 949
-
- 950
-
- 951
-
- 952
-
- 953
- public boolean canGenerateReport() {
- 954 0 return true ;
- 955
- }
- 956
-
- 957
-
- 958
-
- 959
-
- 960
-
- 961
-
- 962
-
- 963
-
- 964
-
- 965
- private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
- 966 0 final StringBuilder ids = new StringBuilder();
- 967 0 for (Dependency d : dependencies) {
- 968 0 boolean addName = true ;
- 969 0 for (Vulnerability v : d.getVulnerabilities()) {
- 970 0 if (v.getCvssScore() >= failBuildOnCVSS) {
- 971 0 if (addName) {
- 972 0 addName = false ;
- 973 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
- 974 0 ids.append(v.getName());
- 975
- } else {
- 976 0 ids.append(", " ).append(v.getName());
- 977
- }
- 978
- }
- 979 0 }
- 980 0 }
- 981 0 if (ids.length() > 0) {
- 982 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
- 983
- + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
- 984
- + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
- 985 0 throw new MojoFailureException(msg);
- 986
- }
- 987 0 }
- 988
-
- 989
-
- 990
-
- 991
-
- 992
-
- 993
-
- 994
- private void showSummary(List<Dependency> dependencies) {
- 995 0 final StringBuilder summary = new StringBuilder();
- 996 0 for (Dependency d : dependencies) {
- 997 0 boolean firstEntry = true ;
- 998 0 final StringBuilder ids = new StringBuilder();
- 999 0 for (Vulnerability v : d.getVulnerabilities()) {
- 1000 0 if (firstEntry) {
- 1001 0 firstEntry = false ;
- 1002
- } else {
- 1003 0 ids.append(", " );
- 1004
- }
- 1005 0 ids.append(v.getName());
- 1006 0 }
- 1007 0 if (ids.length() > 0) {
- 1008 0 summary.append(d.getFileName()).append(" (" );
- 1009 0 firstEntry = true ;
- 1010 0 for (Identifier id : d.getIdentifiers()) {
- 1011 0 if (firstEntry) {
- 1012 0 firstEntry = false ;
- 1013
- } else {
- 1014 0 summary.append(", " );
- 1015
- }
- 1016 0 summary.append(id.getValue());
- 1017 0 }
- 1018 0 summary.append(") : " ).append(ids).append(NEW_LINE);
- 1019
+ try {
+ 941 0 engine = executeDependencyCheck();
+ 942 0 generateExternalReports(engine, outputDirectory);
+ 943 0 if (this .showSummary) {
+ 944 0 showSummary(engine.getDependencies());
+ 945
}
- 1020 0 }
- 1021 0 if (summary.length() > 0) {
- 1022 0 final String msg = String.format("%n%n"
- 1023
- + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
- 1024
- + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
- 1025 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.WARNING, msg);
- 1026
+ 946 0 if (this .failBuildOnCVSS <= 10) {
+ 947 0 checkForFailure(engine.getDependencies());
+ 948
+ }
+ 949 0 } catch (DatabaseException ex) {
+ 950 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+ 951
+ "Unable to connect to the dependency-check database; analysis has stopped" );
+ 952 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
+ 953
+ } finally {
+ 954 0 if (engine != null ) {
+ 955 0 engine.cleanup();
+ 956
+ }
+ 957
}
- 1027 0 }
+ 958 0 }
+ 959
+
+ 960
+
+ 961
+
+ 962
+
+ 963
+
+ 964
+
+ 965
+
+ 966
+
+ 967
+ public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
+ 968
+ Locale locale) throws MavenReportException {
+ 969 0 generate((Sink) sink, null , locale);
+ 970 0 }
+ 971
+
+ 972
+
+ 973
+
+ 974
+
+ 975
+
+ 976
+
+ 977
+
+ 978
+
+ 979
+
+ 980
+ public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
+ 981 0 Engine engine = null ;
+ 982
+ try {
+ 983 0 engine = executeDependencyCheck();
+ 984 0 if (this .externalReport) {
+ 985 0 generateExternalReports(engine, reportOutputDirectory);
+ 986
+ } else {
+ 987 0 generateMavenSiteReport(engine, sink);
+ 988
+ }
+ 989 0 } catch (DatabaseException ex) {
+ 990 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+ 991
+ "Unable to connect to the dependency-check database; analysis has stopped" );
+ 992 0 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
+ 993
+ } finally {
+ 994 0 if (engine != null ) {
+ 995 0 engine.cleanup();
+ 996
+ }
+ 997
+ }
+ 998 0 }
+ 999
+
+ 1000
+
+ 1001
+
+ 1002
+
+ 1003
+
+ 1004
+
+ 1005
+
+ 1006
+ public String getOutputName() {
+ 1007 0 if ("HTML" .equalsIgnoreCase(this .format)
+ 1008
+ || "ALL" .equalsIgnoreCase(this .format)) {
+ 1009 0 return "dependency-check-report" ;
+ 1010 0 } else if ("XML" .equalsIgnoreCase(this .format)) {
+ 1011 0 return "dependency-check-report.xml#" ;
+ 1012 0 } else if ("VULN" .equalsIgnoreCase(this .format)) {
+ 1013 0 return "dependency-check-vulnerability" ;
+ 1014
+ } else {
+ 1015 0 Logger.getLogger(DependencyCheckMojo.class
+ 1016
+ .getName()).log(Level.WARNING, "Unknown report format used during site generatation." );
+ 1017 0 return "dependency-check-report" ;
+ 1018
+ }
+ 1019
+ }
+ 1020
+
+ 1021
+
+ 1022
+
+ 1023
+
+ 1024
+
+ 1025
+
+ 1026
+ public String getCategoryName() {
+ 1027 0 return MavenReport.CATEGORY_PROJECT_REPORTS;
1028
+ }
+ 1029
+
+ 1030
+
+ 1031
+
+ 1032
+
+ 1033
+
+ 1034
+
+ 1035
+
+ 1036
+ public String getName(Locale locale) {
+ 1037 0 return name;
+ 1038
+ }
+ 1039
+
+ 1040
+
+ 1041
+
+ 1042
+
+ 1043
+
+ 1044
+
+ 1045
+ public void setReportOutputDirectory(File directory) {
+ 1046 0 reportOutputDirectory = directory;
+ 1047 0 }
+ 1048
+
+ 1049
+
+ 1050
+
+ 1051
+
+ 1052
+
+ 1053
+
+ 1054
+ public File getReportOutputDirectory() {
+ 1055 0 return reportOutputDirectory;
+ 1056
+ }
+ 1057
+
+ 1058
+
+ 1059
+
+ 1060
+
+ 1061
+
+ 1062
+
+ 1063
+
+ 1064
+ public String getDescription(Locale locale) {
+ 1065 0 return description;
+ 1066
+ }
+ 1067
+
+ 1068
+
+ 1069
+
+ 1070
+
+ 1071
+
+ 1072
+
+ 1073
+ public boolean isExternalReport() {
+ 1074 0 return externalReport;
+ 1075
+ }
+ 1076
+
+ 1077
+
+ 1078
+
+ 1079
+
+ 1080
+
+ 1081
+
+ 1082
+ public boolean canGenerateReport() {
+ 1083 0 return true ;
+ 1084
+ }
+ 1085
+
+ 1086
+
+ 1087
+
+ 1088
+
+ 1089
+
+ 1090
+
+ 1091
+
+ 1092
+
+ 1093
+
+ 1094
+ private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
+ 1095 0 final StringBuilder ids = new StringBuilder();
+ 1096 0 for (Dependency d : dependencies) {
+ 1097 0 boolean addName = true ;
+ 1098 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 1099 0 if (v.getCvssScore() >= failBuildOnCVSS) {
+ 1100 0 if (addName) {
+ 1101 0 addName = false ;
+ 1102 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+ 1103 0 ids.append(v.getName());
+ 1104
+ } else {
+ 1105 0 ids.append(", " ).append(v.getName());
+ 1106
+ }
+ 1107
+ }
+ 1108 0 }
+ 1109 0 }
+ 1110 0 if (ids.length() > 0) {
+ 1111 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 1112
+ + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+ 1113
+ + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+ 1114 0 throw new MojoFailureException(msg);
+ 1115
+ }
+ 1116 0 }
+ 1117
+
+ 1118
+
+ 1119
+
+ 1120
+
+ 1121
+
+ 1122
+
+ 1123
+ private void showSummary(List<Dependency> dependencies) {
+ 1124 0 final StringBuilder summary = new StringBuilder();
+ 1125 0 for (Dependency d : dependencies) {
+ 1126 0 boolean firstEntry = true ;
+ 1127 0 final StringBuilder ids = new StringBuilder();
+ 1128 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 1129 0 if (firstEntry) {
+ 1130 0 firstEntry = false ;
+ 1131
+ } else {
+ 1132 0 ids.append(", " );
+ 1133
+ }
+ 1134 0 ids.append(v.getName());
+ 1135 0 }
+ 1136 0 if (ids.length() > 0) {
+ 1137 0 summary.append(d.getFileName()).append(" (" );
+ 1138 0 firstEntry = true ;
+ 1139 0 for (Identifier id : d.getIdentifiers()) {
+ 1140 0 if (firstEntry) {
+ 1141 0 firstEntry = false ;
+ 1142
+ } else {
+ 1143 0 summary.append(", " );
+ 1144
+ }
+ 1145 0 summary.append(id.getValue());
+ 1146 0 }
+ 1147 0 summary.append(") : " ).append(ids).append(NEW_LINE);
+ 1148
+ }
+ 1149 0 }
+ 1150 0 if (summary.length() > 0) {
+ 1151 0 final String msg = String.format("%n%n"
+ 1152
+ + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+ 1153
+ + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+ 1154 0 Logger
+ 1155
+ .getLogger(DependencyCheckMojo.class
+ 1156
+ .getName()).log(Level.WARNING, msg);
+ 1157
+ }
+ 1158 0 }
+ 1159
}
-
+
diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html
index 5119d28db..828959ce9 100644
--- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html
+++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html
@@ -744,6 +744,6 @@
} dependency-check-maven - Configuration
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -189,6 +189,15 @@
+outputDirectory
+
+The location to write the report(s). Note, this is not used if generating the report as part of a mvn site build
+
+‘target’
+
+
+
+
failBuildOnCVSS
Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail.
@@ -196,7 +205,7 @@
11
-
+
format
@@ -205,7 +214,7 @@
HTML
-
+
logFile
@@ -214,7 +223,7 @@
-
+
suppressionFile
@@ -223,49 +232,76 @@
+
+
+skipTestScope
+
+Should be skip analysis for artifacts with Test Scope
+
+true
+
+
-connectionTimeout
+skipProvidedScope
-The Connection Timeout.
+Should be skip analysis for artifacts with Provided Scope
-
+false
-proxyUrl
+skipRuntimeScope
-The Proxy URL.
+Should be skip analysis for artifacts with Runtime Scope
-
+false
+
+
+Analyzer Configuration
+The following properties are used to configure the various file type analyzers. These properties can be used to turn off specific analyzers if it is not needed. Note, that specific analyzers will automatically disable themselves if no file types that they support are detected - so specifically disabling them may not be needed.
+
+
+
+
+
+
+Property
+
+Description
+
+Default Value
+
+
+
-proxyPort
+archiveAnalyzerEnabled
-The Proxy Port.
+Sets whether the Archive Analyzer will be used.
-
+true
-proxyUsername
+zipExtensions
-Defines the proxy user name.
+A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed.
-proxyPassword
+jarAnalyzer
-Defines the proxy password.
+Sets whether Jar Analyzer will be used.
-
+true
@@ -274,7 +310,7 @@
Sets whether Nexus Analyzer will be used.
-
+true
@@ -283,7 +319,7 @@
Defines the Nexus URL.
-
+https://repository.sonatype.org/service/local/
@@ -297,6 +333,105 @@
+nuspecAnalyzerEnabled
+
+Sets whether or not the .NET Nuget Nuspec Analyzer will be used.
+
+true
+
+
+
+
+assemblyAnalyzerEnabled
+
+Sets whether or not the .NET Assembly Analyzer should be used.
+
+true
+
+
+
+
+pathToMono
+
+The path to Mono for .NET assembly analysis on non-windows systems
+
+
+
+
+
+Advanced Configuration
+The following properties can be configured in the plugin. However, they are less frequently changed. One exception may be the cvedUrl properties, which can be used to host a mirror of the NVD within an enterprise environment.
+
+
+Deprecated Configuration
+The following properties have been deprecated. These can stell be set in the dependency-check-maven plugin’s configuration. However, future versions will remove these properties. Instead using these properties you should use Maven’s settings to configure a proxy.
+
+
+
-zipExtensions
+Property
-A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed.
+Description
+
+Default Value
+
+
+
+
+
+
+proxyUrl
+
+The Proxy URL.
+
+
+
+
+
+
+proxyPort
+
+The Proxy Port.
-skipTestScope
+proxyUsername
-Should be skip analysis for artifacts with Test Scope
-
-true
-
-
-
-
-skipProvidedScope
-
-Should be skip analysis for artifacts with Provided Scope
-
-false
-
-
-
-
-skipRuntimeScope
-
-Should be skip analysis for artifacts with Runtime Scope
-
-false
-
-
-
-
-dataDirectory
-
-Data directory to hold SQL CVEs contents. This should generally not be changed.
+Defines the proxy user name.
-
-
-cveUrl12Modified
-
-URL for the modified CVE 1.2
-
-http://nvd.nist.gov/download/nvdcve-modified.xml
-
-cveUrl20Modified
+proxyPassword
-URL for the modified CVE 2.0
-
-http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml
-
-
-
-cveUrl12Base
-
-Base URL for each year’s CVE 1.2, the %d will be replaced with the year
-
-http://nvd.nist.gov/download/nvdcve-%d.xml
-
-
-
-cveUrl20Base
-
-Base URL for each year’s CVE 2.0, the %d will be replaced with the year
-
-http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml
-
-
-
-pathToMono
-
-The path to Mono for .NET assembly analysis on non-windows systems
+Defines the proxy password.
diff --git a/dependency-check-maven/cpd.html b/dependency-check-maven/cpd.html
index 5c791c5c8..42b59b286 100644
--- a/dependency-check-maven/cpd.html
+++ b/dependency-check-maven/cpd.html
@@ -1,13 +1,13 @@
dependency-check-maven - CPD Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/dependency-updates-report.html b/dependency-check-maven/dependency-updates-report.html
index 401a182a7..96726a3b1 100644
--- a/dependency-check-maven/dependency-updates-report.html
+++ b/dependency-check-maven/dependency-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-maven - Dependency Updates Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -260,7 +260,7 @@
# of dependencies where the next version available is an incremental version update
-2
+3
# of dependencies where the next version available is a minor version update
@@ -325,6 +325,18 @@
org.apache.maven
+maven-settings
+3.0
+compile
+jar
+3.0.1 3.1.0
+
+org.apache.maven.plugin-testing
maven-plugin-testing-harness
2.1
@@ -335,7 +347,7 @@
3.0.0
-
+
org.apache.maven.plugin-tools
maven-plugin-annotations
@@ -347,7 +359,7 @@
3.1
-
+
org.apache.maven.plugins
maven-site-plugin
@@ -359,7 +371,7 @@
3.1
-
+
org.apache.maven.reporting
maven-reporting-api
@@ -371,11 +383,11 @@
-
+
org.owasp
dependency-check-core
-1.1.3
+1.1.4
compile
jar
@@ -383,7 +395,7 @@
-
+
Status
Group Id
Artifact Id
@@ -401,25 +413,25 @@
junit:junit
-
+
Status
-
+
Group Id
junit
-
+
Artifact Id
junit
-
+
Current Version
4.11
-
+
Scope
test
-
+
Classifier
-
+
Type
jar
@@ -477,6 +489,33 @@
Newer versions
3.0.1 Next Incremental 3.1.0-alpha-1 Latest Incremental 3.1.0 Next Minor 3.2.1 Latest Minor
+
org.apache.maven:maven-settings
+
+
+Status
+
+
+Group Id
+org.apache.maven
+
+Artifact Id
+maven-settings
+
+Current Version
+3.0
+
+Scope
+compile
+
+Classifier
+
+
+Type
+jar
+
+Newer versions
+3.0.1 Next Incremental 3.1.0-alpha-1 Latest Incremental 3.1.0 Next Minor 3.2.1 Latest Minor
org.apache.maven.plugin-testing:maven-plugin-testing-harness
@@ -595,7 +634,7 @@
dependency-check-core
Current Version
-1.1.3
+1.1.4
Scope
compile
diff --git a/dependency-check-maven/findbugs.html b/dependency-check-maven/findbugs.html
index fac1a8d0c..6472ba885 100644
--- a/dependency-check-maven/findbugs.html
+++ b/dependency-check-maven/findbugs.html
@@ -1,13 +1,13 @@
dependency-check-maven - FindBugs Bug Detector Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/help-mojo.html b/dependency-check-maven/help-mojo.html
index aa04edf26..bb77e7847 100644
--- a/dependency-check-maven/help-mojo.html
+++ b/dependency-check-maven/help-mojo.html
@@ -1,13 +1,13 @@
dependency-check-maven -
dependency-check:help
@@ -55,7 +55,7 @@
-
+
/
@@ -69,9 +69,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -163,7 +163,7 @@
Full name :
-org.owasp:dependency-check-maven:1.1.3:help
+org.owasp:dependency-check-maven:1.1.4:help
Description :
diff --git a/dependency-check-maven/index.html b/dependency-check-maven/index.html
index 2205c58f4..33cf42f71 100644
--- a/dependency-check-maven/index.html
+++ b/dependency-check-maven/index.html
@@ -1,13 +1,13 @@
dependency-check-jenkins -
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/license.html b/dependency-check-maven/license.html
index 965bb3cd4..f2fdada0a 100644
--- a/dependency-check-maven/license.html
+++ b/dependency-check-maven/license.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project License
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/plugin-info.html b/dependency-check-maven/plugin-info.html
index 9dd1d2e18..30c10fb33 100644
--- a/dependency-check-maven/plugin-info.html
+++ b/dependency-check-maven/plugin-info.html
@@ -1,13 +1,13 @@
dependency-check-maven - Plugin Documentation
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -293,7 +293,7 @@ Call mvn dependency-check:help -Ddetail=true
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
</plugin>
...
</plugins>
@@ -303,7 +303,7 @@ Call mvn dependency-check:help -Ddetail=true
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
</plugin>
...
</plugins>
@@ -315,7 +315,7 @@ Call mvn dependency-check:help -Ddetail=true
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
</plugin>
...
</plugins>
diff --git a/dependency-check-maven/plugin-updates-report.html b/dependency-check-maven/plugin-updates-report.html
index e6730809b..f6ba44fb9 100644
--- a/dependency-check-maven/plugin-updates-report.html
+++ b/dependency-check-maven/plugin-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-maven - Plugin Updates Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/pmd.html b/dependency-check-maven/pmd.html
index 5109b023b..55e424e63 100644
--- a/dependency-check-maven/pmd.html
+++ b/dependency-check-maven/pmd.html
@@ -1,13 +1,13 @@
dependency-check-maven - PMD Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/project-info.html b/dependency-check-maven/project-info.html
index 32e98b983..1013eddd7 100644
--- a/dependency-check-maven/project-info.html
+++ b/dependency-check-maven/project-info.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Information
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/project-reports.html b/dependency-check-maven/project-reports.html
index 1ef9679b2..0ddcef943 100644
--- a/dependency-check-maven/project-reports.html
+++ b/dependency-check-maven/project-reports.html
@@ -1,13 +1,13 @@
dependency-check-maven - Generated Reports
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/project-summary.html b/dependency-check-maven/project-summary.html
index d3b0c71d3..6564d9b9c 100644
--- a/dependency-check-maven/project-summary.html
+++ b/dependency-check-maven/project-summary.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Summary
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -196,7 +196,7 @@
dependency-check-jenkins
Version
-1.1.3
+1.1.4
Type
pom
diff --git a/dependency-check-maven/surefire-report.html b/dependency-check-maven/surefire-report.html
index 0c4a6f3b3..4f20b966e 100644
--- a/dependency-check-maven/surefire-report.html
+++ b/dependency-check-maven/surefire-report.html
@@ -1,13 +1,13 @@
dependency-check-maven - Surefire Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -265,8 +265,7 @@ function toggleDisplay(elementId) {
-
Summary
-
[Summary ] [Package List ] [Test Cases ]
+
Summary
Tests
@@ -276,65 +275,13 @@ function toggleDisplay(elementId) {
Success Rate
Time
-1
0
0
0
-100%
-0.1
+
0
+
0%
+
0
Note: failures are anticipated and checked for with assertions while errors are unanticipated.
-
Package List
-
[Summary ] [Package List ] [Test Cases ]
-
-
Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.
-
-
org.owasp.dependencycheck.maven
-
-
-Class
-Tests
-Errors
-Failures
-Skipped
-Success Rate
-Time
-
-DependencyCheckMojoTest 1
-0
-0
-0
-100%
-0.1
dependency-check-maven - Tag List report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/dependency-check-maven/usage.html b/dependency-check-maven/usage.html
index 71c8291da..8e1e1e6ff 100644
--- a/dependency-check-maven/usage.html
+++ b/dependency-check-maven/usage.html
@@ -1,13 +1,13 @@
dependency-check-maven - Usage
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -157,7 +157,8 @@
It is important to understand that the first time this task is executed it may take 20 minutes or more as it downloads and processes the data from the National Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov
After the first batch download, as long as the plugin is executed at least once every seven days the update will only take a few seconds.
-
Example 1:
+
+
Example 1:
Create the DependencyCheck-report.html in the target directory
@@ -168,7 +169,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
<executions>
<execution>
<goals>
@@ -185,7 +186,7 @@
</project>
-
Example 2:
+
Example 2:
Create the DependencyCheck-report.html and fail the build for CVSS greater then 8
@@ -196,7 +197,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
<configuration>
<failBuildOnCVSS>8</failBuildOnCVSS>
</configuration>
@@ -216,7 +217,7 @@
</project>
-
Example 3:
+
Example 3:
Create the dependency-check report within the site
@@ -232,7 +233,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
<configuration>
<externalReport>false</externalReport>
</configuration>
@@ -248,7 +249,7 @@
</project>
-
Example 4:
+
Example 4:
Create the DependencyCheck-report.html and skip artifacts no bundled in distribution (Provided and Runtime scope)
@@ -259,7 +260,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
<configuration>
<skipProvidedScope>true</skipProvidedScope>
<skipRuntimeScope>true</skipRuntimeScope>
@@ -280,7 +281,7 @@
</project>
-
Example 5:
+
Example 5:
Create the DependencyCheck-report.html and use internal mirroring of CVE contents
@@ -291,7 +292,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.1.3</version>
+ <version>1.1.4</version>
<configuration>
<cveUrl12Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-modified.xml</cveUrl12Modified>
<cveUrl20Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-2.0-modified.xml</cveUrl20Modified>
@@ -312,7 +313,7 @@
</build>
...
</project>
-
+
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
index 6df780c66..5175523d1 100644
--- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
+++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Maven Plugin 1.1.3 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.1.3 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
diff --git a/dependency-check-maven/xref/index.html b/dependency-check-maven/xref/index.html
index db7641489..5492a5cd6 100644
--- a/dependency-check-maven/xref/index.html
+++ b/dependency-check-maven/xref/index.html
@@ -4,7 +4,7 @@
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html
index d625a461d..eb1060507 100644
--- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html
+++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html
@@ -52,988 +52,1119 @@
44 import org.apache.maven.reporting.MavenMultiPageReport;
45 import org.apache.maven.reporting.MavenReport;
46 import org.apache.maven.reporting.MavenReportException;
-47 import org.owasp.dependencycheck.Engine;
-48 import org.owasp.dependencycheck.data.nvdcve.CveDB;
-49 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
-50 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
-51 import org.owasp.dependencycheck.dependency.Dependency;
-52 import org.owasp.dependencycheck.dependency.Evidence;
-53 import org.owasp.dependencycheck.dependency.Identifier;
-54 import org.owasp.dependencycheck.dependency.Reference;
-55 import org.owasp.dependencycheck.dependency.Vulnerability;
-56 import org.owasp.dependencycheck.dependency.VulnerableSoftware;
-57 import org.owasp.dependencycheck.reporting.ReportGenerator;
-58 import org.owasp.dependencycheck.utils.LogUtils;
-59 import org.owasp.dependencycheck.utils.Settings;
-60
-61
-62
-63
-64
-65
-66 @Mojo(name = "check" , defaultPhase = LifecyclePhase.COMPILE, threadSafe = true ,
-67 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
-68 requiresOnline = true )
-69 public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
-70
-71
-72
-73
-74 private static final String PROPERTIES_FILE = "mojo.properties" ;
-75
-76
-77
-78 private static final String LOG_PROPERTIES_FILE = "log.properties" ;
-79
-80
-81
-82 private static final String NEW_LINE = System.getProperty("line.separator" , "\n" ).intern();
-83
-84
-85
-86
-87 @Component
-88 private MavenProject project;
-89
-90
-91
-92 @Parameter(property = "report-name" , defaultValue = "dependency-check-report" )
-93 private String reportName;
-94
-95
-96
-97 @Parameter(property = "logfile" , defaultValue = "" )
-98 private String logFile;
-99
-100
-101
-102 @Parameter(property = "name" , defaultValue = "Dependency-Check" )
-103 private String name;
-104
-105
-106
-107 @Parameter(property = "description" , defaultValue = "A report providing details on any published "
-108 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
-109 + "false positives and false negatives." )
-110 private String description;
-111
-112
-113
-114 @Parameter(property = "reportOutputDirectory" , defaultValue = "${project.reporting.outputDirectory}" , required = true )
-115 private File reportOutputDirectory;
-116
-117
-118
-119
-120 @SuppressWarnings("CanBeFinal" )
-121 @Parameter(property = "failBuildOnCVSS" , defaultValue = "11" , required = true )
-122 private float failBuildOnCVSS = 11;
-123
-124
-125
-126 @Parameter(defaultValue = "${project.build.directory}" , required = true )
-127 private File outputDirectory;
-128
-129
-130
-131
-132 @SuppressWarnings("CanBeFinal" )
-133 @Parameter(property = "autoupdate" , defaultValue = "true" , required = true )
-134 private boolean autoUpdate = true ;
-135
-136
-137
-138
-139 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-140 @Parameter(property = "format" , defaultValue = "HTML" , required = true )
-141 private String format = "HTML" ;
-142
-143
-144
-145 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-146 @Parameter(property = "externalReport" , defaultValue = "false" , required = true )
-147 private boolean externalReport = false;
-148
-149
-150
-151 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-152 @Parameter(property = "proxyUrl" , defaultValue = "" , required = false)
+47 import org.apache.maven.settings.Proxy;
+48 import org.owasp.dependencycheck.Engine;
+49 import org.owasp.dependencycheck.data.nvdcve.CveDB;
+50 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+51 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+52 import org.owasp.dependencycheck.dependency.Dependency;
+53 import org.owasp.dependencycheck.dependency.Evidence;
+54 import org.owasp.dependencycheck.dependency.Identifier;
+55 import org.owasp.dependencycheck.dependency.Reference;
+56 import org.owasp.dependencycheck.dependency.Vulnerability;
+57 import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+58 import org.owasp.dependencycheck.reporting.ReportGenerator;
+59 import org.owasp.dependencycheck.utils.LogUtils;
+60 import org.owasp.dependencycheck.utils.Settings;
+61
+62
+63
+64
+65
+66
+67 @Mojo(name = "check" , defaultPhase = LifecyclePhase.COMPILE, threadSafe = true ,
+68 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
+69 requiresOnline = true )
+70 public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
+71
+72
+73
+74
+75 private static final String PROPERTIES_FILE = "mojo.properties" ;
+76
+77
+78
+79 private static final String LOG_PROPERTIES_FILE = "log.properties" ;
+80
+81
+82
+83 private static final String NEW_LINE = System.getProperty("line.separator" , "\n" ).intern();
+84
+85
+86
+87
+88 @Component
+89 private MavenProject project;
+90
+91
+92
+93 @Parameter(property = "logfile" , defaultValue = "" )
+94 private String logFile;
+95
+96
+97
+98 @Parameter(property = "name" , defaultValue = "Dependency-Check" )
+99 private String name;
+100
+101
+102
+103 @Parameter(property = "description" , defaultValue = "A report providing details on any published "
+104 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
+105 + "false positives and false negatives." )
+106 private String description;
+107
+108
+109
+110
+111 @Parameter(property = "reportOutputDirectory" , defaultValue = "${project.reporting.outputDirectory}" , required = true )
+112 private File reportOutputDirectory;
+113
+114
+115
+116 @Parameter(defaultValue = "${project.build.directory}" , required = true )
+117 private File outputDirectory;
+118
+119
+120
+121
+122 @SuppressWarnings("CanBeFinal" )
+123 @Parameter(property = "failBuildOnCVSS" , defaultValue = "11" , required = true )
+124 private float failBuildOnCVSS = 11;
+125
+126
+127
+128
+129 @SuppressWarnings("CanBeFinal" )
+130 @Parameter(property = "autoupdate" , defaultValue = "true" , required = true )
+131 private boolean autoUpdate = true ;
+132
+133
+134
+135
+136 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+137 @Parameter(property = "format" , defaultValue = "HTML" , required = true )
+138 private String format = "HTML" ;
+139
+140
+141
+142 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+143 @Parameter(property = "externalReport" , defaultValue = "false" , required = true )
+144 private boolean externalReport = false;
+145
+146
+147
+148
+149
+150 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+151 @Parameter(property = "proxyUrl" , defaultValue = "" , required = false)
+152 @Deprecated
153 private String proxyUrl = null ;
-154
-155
-156
-157 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-158 @Parameter(property = "proxyPort" , defaultValue = "" , required = false)
-159 private String proxyPort = null ;
-160
-161
-162
-163 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-164 @Parameter(property = "proxyUsername" , defaultValue = "" , required = false)
-165 private String proxyUsername = null ;
-166
-167
-168
-169 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-170 @Parameter(property = "proxyPassword" , defaultValue = "" , required = false)
-171 private String proxyPassword = null ;
-172
-173
-174
-175 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-176 @Parameter(property = "connectionTimeout" , defaultValue = "" , required = false)
-177 private String connectionTimeout = null ;
+154
+155
+156
+157
+158 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+159 @Parameter(property = "mavenSettings" , defaultValue = "${settings}" , required = false)
+160 private org.apache.maven.settings.Settings mavenSettings;
+161
+162
+163
+164
+165 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+166 @Parameter(property = "mavenSettingsProxyId" , required = false)
+167 private String mavenSettingsProxyId;
+168
+169
+170
+171
+172
+173
+174 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+175 @Parameter(property = "proxyPort" , defaultValue = "" , required = false)
+176 @Deprecated
+177 private String proxyPort = null ;
178
-179
-180
-181 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-182 @Parameter(property = "suppressionFile" , defaultValue = "" , required = false)
-183 private String suppressionFile = null ;
-184
-185
-186
-187 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-188 @Parameter(property = "showSummary" , defaultValue = "true" , required = false)
-189 private boolean showSummary = true ;
-190
-191
-192
-193 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-194 @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false)
-195 private boolean nexusAnalyzerEnabled = true ;
+179
+180
+181
+182
+183 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+184 @Parameter(property = "proxyUsername" , defaultValue = "" , required = false)
+185 @Deprecated
+186 private String proxyUsername = null ;
+187
+188
+189
+190
+191
+192 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+193 @Parameter(property = "proxyPassword" , defaultValue = "" , required = false)
+194 @Deprecated
+195 private String proxyPassword = null ;
196
-197
+197
198
199 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-200 @Parameter(property = "nexusUrl" , defaultValue = "" , required = false)
-201 private String nexusUrl;
+200 @Parameter(property = "connectionTimeout" , defaultValue = "" , required = false)
+201 private String connectionTimeout = null ;
202
-203
+203
204
205 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-206 @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false)
-207 private boolean nexusUsesProxy = true ;
+206 @Parameter(property = "suppressionFile" , defaultValue = "" , required = false)
+207 private String suppressionFile = null ;
208
-209
+209
210
211 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-212 @Parameter(property = "connectionString" , defaultValue = "" , required = false)
-213 private String connectionString;
-214
-215
-216
-217 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-218 @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false)
-219 private String databaseDriverName;
-220
-221
-222
-223 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-224 @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false)
-225 private String databaseDriverPath;
-226
-227
-228
-229 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-230 @Parameter(property = "databaseUser" , defaultValue = "" , required = false)
-231 private String databaseUser;
-232
-233
-234
-235 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-236 @Parameter(property = "databasePassword" , defaultValue = "" , required = false)
-237 private String databasePassword;
-238
-239
-240
-241 @Parameter(property = "zipExtensions" , required = false)
-242 private String zipExtensions;
+212 @Parameter(property = "showSummary" , defaultValue = "true" , required = false)
+213 private boolean showSummary = true ;
+214
+215
+216
+217
+218 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+219 @Parameter(property = "jarAnalyzerEnabled" , defaultValue = "true" , required = false)
+220 private boolean jarAnalyzerEnabled = true ;
+221
+222
+223
+224
+225 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+226 @Parameter(property = "archiveAnalyzerEnabled" , defaultValue = "true" , required = false)
+227 private boolean archiveAnalyzerEnabled = true ;
+228
+229
+230
+231
+232 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+233 @Parameter(property = "assemblyAnalyzerEnabled" , defaultValue = "true" , required = false)
+234 private boolean assemblyAnalyzerEnabled = true ;
+235
+236
+237
+238
+239 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+240 @Parameter(property = "nuspecAnalyzerEnabled" , defaultValue = "true" , required = false)
+241 private boolean nuspecAnalyzerEnabled = true ;
+242
243
-244
+244
245
-246 @SuppressWarnings("CanBeFinal" )
-247 @Parameter(property = "skipTestScope" , defaultValue = "true" , required = false)
-248 private boolean skipTestScope = true ;
+246 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+247 @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false)
+248 private boolean nexusAnalyzerEnabled = true ;
249
-250
+250
251
-252 @SuppressWarnings("CanBeFinal" )
-253 @Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false)
-254 private boolean skipRuntimeScope = false;
+252 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+253 @Parameter(property = "nexusUrl" , defaultValue = "" , required = false)
+254 private String nexusUrl;
255
-256
+256
257
-258 @SuppressWarnings("CanBeFinal" )
-259 @Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false)
-260 private boolean skipProvidedScope = false;
+258 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+259 @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false)
+260 private boolean nexusUsesProxy = true ;
261
-262
+262
263
-264 @Parameter(property = "dataDirectory" , defaultValue = "" , required = false)
-265 private String dataDirectory;
-266
-267
-268
-269 @Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false)
-270 private String cveUrl12Modified;
-271
-272
-273
-274 @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false)
-275 private String cveUrl20Modified;
-276
-277
-278
-279 @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false)
-280 private String cveUrl12Base;
-281
-282
-283
-284 @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false)
-285 private String cveUrl20Base;
-286
-287
-288
-289
-290 @Parameter(property = "pathToMono" , defaultValue = "" , required = false)
-291 private String pathToMono;
-292
-293
-294
-295
-296
-297
-298
-299
-300 private Engine executeDependencyCheck() throws DatabaseException {
-301
-302 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
-303 LogUtils.prepareLogger(in, logFile);
-304
-305 populateSettings();
-306 Engine engine = null ;
-307 try {
-308 engine = new Engine();
-309 final Set<Artifact> artifacts = project.getArtifacts();
-310 for (Artifact a : artifacts) {
-311 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
-312 continue ;
-313 }
-314
-315 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
-316 continue ;
-317 }
-318
-319 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
-320 continue ;
-321 }
-322
-323 engine.scan(a.getFile().getAbsolutePath());
-324 }
-325 engine.analyzeDependencies();
-326 } finally {
-327 if (engine != null ) {
-328 engine.cleanup();
-329 }
-330 }
-331 return engine;
-332 }
-333
+264 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+265 @Parameter(property = "connectionString" , defaultValue = "" , required = false)
+266 private String connectionString;
+267
+268
+269
+270 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+271 @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false)
+272 private String databaseDriverName;
+273
+274
+275
+276 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+277 @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false)
+278 private String databaseDriverPath;
+279
+280
+281
+282 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+283 @Parameter(property = "databaseUser" , defaultValue = "" , required = false)
+284 private String databaseUser;
+285
+286
+287
+288 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+289 @Parameter(property = "databasePassword" , defaultValue = "" , required = false)
+290 private String databasePassword;
+291
+292
+293
+294 @Parameter(property = "zipExtensions" , required = false)
+295 private String zipExtensions;
+296
+297
+298
+299 @SuppressWarnings("CanBeFinal" )
+300 @Parameter(property = "skipTestScope" , defaultValue = "true" , required = false)
+301 private boolean skipTestScope = true ;
+302
+303
+304
+305 @SuppressWarnings("CanBeFinal" )
+306 @Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false)
+307 private boolean skipRuntimeScope = false;
+308
+309
+310
+311 @SuppressWarnings("CanBeFinal" )
+312 @Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false)
+313 private boolean skipProvidedScope = false;
+314
+315
+316
+317 @Parameter(property = "dataDirectory" , defaultValue = "" , required = false)
+318 private String dataDirectory;
+319
+320
+321
+322 @Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false)
+323 private String cveUrl12Modified;
+324
+325
+326
+327 @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false)
+328 private String cveUrl20Modified;
+329
+330
+331
+332 @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false)
+333 private String cveUrl12Base;
334
-335
-336
-337
-338
-339 private void generateExternalReports(Engine engine) {
-340 DatabaseProperties prop = null ;
-341 CveDB cve = null ;
-342 try {
-343 cve = new CveDB();
-344 cve.open();
-345 prop = cve.getDatabaseProperties();
-346 } catch (DatabaseException ex) {
-347 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
-348 } finally {
-349 if (cve != null ) {
-350 cve.close();
-351 }
-352 }
-353 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
-354 try {
-355 r.generateReports(outputDirectory.getCanonicalPath(), format);
-356 } catch (IOException ex) {
-357 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
-358 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
-359 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
-360 } catch (Throwable ex) {
-361 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
-362 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
-363 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
-364 }
-365 }
-366
-367
-368
-369
-370
-371
-372
-373 private void generateMavenSiteReport(final Engine engine, Sink sink) {
-374 final List<Dependency> dependencies = engine.getDependencies();
+335
+336
+337 @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false)
+338 private String cveUrl20Base;
+339
+340
+341
+342
+343 @Parameter(property = "pathToMono" , defaultValue = "" , required = false)
+344 private String pathToMono;
+345
+346
+347
+348
+349
+350
+351
+352
+353 private Engine executeDependencyCheck() throws DatabaseException {
+354
+355 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+356 LogUtils.prepareLogger(in, logFile);
+357
+358 populateSettings();
+359 Engine engine = null ;
+360 try {
+361 engine = new Engine();
+362 final Set<Artifact> artifacts = project.getArtifacts();
+363 for (Artifact a : artifacts) {
+364 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
+365 continue ;
+366 }
+367
+368 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
+369 continue ;
+370 }
+371
+372 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
+373 continue ;
+374 }
375
-376 writeSiteReportHeader(sink, project.getName());
-377 writeSiteReportTOC(sink, dependencies);
-378
-379 int cnt = 0;
-380 for (Dependency d : dependencies) {
-381 writeSiteReportDependencyHeader(sink, d);
-382 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
-383 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
-384 writeSiteReportDependencyIdentifiers(d, sink);
-385 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
-386 }
-387 sink.body_();
-388 }
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398 private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
-399 int cnt = collapsibleHeaderCount;
-400 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
-401 for (Vulnerability v : d.getVulnerabilities()) {
-402
-403 sink.paragraph();
-404 sink.bold();
-405 try {
-406 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
-407 sink.text(v.getName());
-408 sink.link_();
-409 sink.bold_();
-410 } catch (UnsupportedEncodingException ex) {
-411 sink.text(v.getName());
-412 sink.bold_();
-413 sink.lineBreak();
-414 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
-415 }
-416 sink.paragraph_();
-417 sink.paragraph();
-418 sink.text("Severity: " );
-419 if (v.getCvssScore() < 4.0) {
-420 sink.text("Low" );
-421 } else {
-422 if (v.getCvssScore() >= 7.0) {
-423 sink.text("High" );
-424 } else {
-425 sink.text("Medium" );
-426 }
-427 }
-428 sink.lineBreak();
-429 sink.text("CVSS Score: " + v.getCvssScore());
-430 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
-431 sink.lineBreak();
-432 sink.text("CWE: " );
-433 sink.text(v.getCwe());
-434 }
-435 sink.paragraph_();
-436 sink.paragraph();
-437 sink.text(v.getDescription());
-438 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
-439 sink.list();
-440 for (Reference ref : v.getReferences()) {
-441 sink.listItem();
-442 sink.text(ref.getSource());
-443 sink.text(" - " );
-444 sink.link(ref.getUrl());
-445 sink.text(ref.getName());
-446 sink.link_();
-447 sink.listItem_();
-448 }
-449 sink.list_();
-450 }
-451 sink.paragraph_();
-452 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
-453 sink.paragraph();
-454
-455 cnt += 1;
-456 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
-457 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
-458 sink.list();
-459 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
-460 sink.listItem();
-461 try {
-462 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
-463 sink.text(vs.getName());
-464 sink.link_();
-465 if (vs.hasPreviousVersion()) {
-466 sink.text(" and all previous versions." );
-467 }
-468 } catch (UnsupportedEncodingException ex) {
-469 sink.text(vs.getName());
-470 if (vs.hasPreviousVersion()) {
-471 sink.text(" and all previous versions." );
-472 }
-473 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
-474 }
-475
-476 sink.listItem_();
-477 }
-478 sink.list_();
-479 sink.rawText("</div>" );
-480 sink.paragraph_();
+376 engine.scan(a.getFile().getAbsolutePath());
+377 }
+378 engine.analyzeDependencies();
+379 } finally {
+380 if (engine != null ) {
+381 engine.cleanup();
+382 }
+383 }
+384 return engine;
+385 }
+386
+387
+388
+389
+390
+391
+392
+393 private void generateExternalReports(Engine engine, File outDirectory) {
+394 DatabaseProperties prop = null ;
+395 CveDB cve = null ;
+396 try {
+397 cve = new CveDB();
+398 cve.open();
+399 prop = cve.getDatabaseProperties();
+400 } catch (DatabaseException ex) {
+401 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+402 } finally {
+403 if (cve != null ) {
+404 cve.close();
+405 }
+406 }
+407 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
+408 try {
+409 r.generateReports(outDirectory.getCanonicalPath(), format);
+410 } catch (IOException ex) {
+411 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+412 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+413 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
+414 } catch (Throwable ex) {
+415 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+416 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+417 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
+418 }
+419 }
+420
+421
+422
+423
+424
+425
+426
+427 private void generateMavenSiteReport(final Engine engine, Sink sink) {
+428 final List<Dependency> dependencies = engine.getDependencies();
+429
+430 writeSiteReportHeader(sink, project.getName());
+431 writeSiteReportTOC(sink, dependencies);
+432
+433 int cnt = 0;
+434 for (Dependency d : dependencies) {
+435 writeSiteReportDependencyHeader(sink, d);
+436 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
+437 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
+438 writeSiteReportDependencyIdentifiers(d, sink);
+439 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
+440 }
+441 sink.body_();
+442 }
+443
+444
+445
+446
+447
+448
+449
+450
+451
+452 private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
+453 int cnt = collapsibleHeaderCount;
+454 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
+455 for (Vulnerability v : d.getVulnerabilities()) {
+456
+457 sink.paragraph();
+458 sink.bold();
+459 try {
+460 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
+461 sink.text(v.getName());
+462 sink.link_();
+463 sink.bold_();
+464 } catch (UnsupportedEncodingException ex) {
+465 sink.text(v.getName());
+466 sink.bold_();
+467 sink.lineBreak();
+468 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
+469 }
+470 sink.paragraph_();
+471 sink.paragraph();
+472 sink.text("Severity: " );
+473 if (v.getCvssScore() < 4.0) {
+474 sink.text("Low" );
+475 } else {
+476 if (v.getCvssScore() >= 7.0) {
+477 sink.text("High" );
+478 } else {
+479 sink.text("Medium" );
+480 }
481 }
-482 }
-483 }
-484 }
-485
-486
-487
-488
-489
-490
-491
-492 private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
-493 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
-494 sink.sectionTitle4();
-495 sink.text("Identifiers" );
-496 sink.sectionTitle4_();
-497 sink.list();
-498 for (Identifier i : d.getIdentifiers()) {
-499 sink.listItem();
-500 sink.text(i.getType());
-501 sink.text(": " );
-502 if (i.getUrl() != null && i.getUrl().length() > 0) {
-503 sink.link(i.getUrl());
-504 sink.text(i.getValue());
-505 sink.link_();
-506 } else {
-507 sink.text(i.getValue());
-508 }
-509 if (i.getDescription() != null && i.getDescription().length() > 0) {
-510 sink.lineBreak();
-511 sink.text(i.getDescription());
-512 }
-513 sink.listItem_();
-514 }
-515 sink.list_();
-516 }
-517 }
-518
-519
-520
-521
-522
-523
-524
-525
-526
-527 private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
-528 int cnt = collapsibleHeaderCount;
-529 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
-530 cnt += 1;
-531 sink.sectionTitle4();
-532 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
-533 sink.sectionTitle4_();
-534 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
-535 sink.list();
-536 for (Dependency r : d.getRelatedDependencies()) {
-537 sink.listItem();
-538 sink.text(r.getFileName());
-539 sink.list();
-540 writeListItem(sink, "File Path: " + r.getFilePath());
-541 writeListItem(sink, "SHA1: " + r.getSha1sum());
-542 writeListItem(sink, "MD5: " + r.getMd5sum());
-543 sink.list_();
-544 sink.listItem_();
-545 }
-546 sink.list_();
-547 sink.rawText("</div>" );
-548 }
-549 return cnt;
-550 }
-551
-552
-553
-554
-555
-556
-557
-558
-559
-560 private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
-561 int cnt = collapsibleHeaderCount;
-562 if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
-563 cnt += 1;
-564 sink.sectionTitle4();
-565 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
-566 sink.sectionTitle4_();
-567 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
-568 sink.table();
-569 sink.tableRow();
-570 writeTableHeaderCell(sink, "Source" );
-571 writeTableHeaderCell(sink, "Name" );
-572 writeTableHeaderCell(sink, "Value" );
-573 sink.tableRow_();
-574 for (Evidence e : d.getEvidenceUsed()) {
-575 sink.tableRow();
-576 writeTableCell(sink, e.getSource());
-577 writeTableCell(sink, e.getName());
-578 writeTableCell(sink, e.getValue());
-579 sink.tableRow_();
-580 }
-581 sink.table_();
-582 sink.rawText("</div>" );
-583 }
-584 return cnt;
-585 }
-586
-587
-588
-589
-590
-591
-592
-593 private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
-594 sink.sectionTitle2();
-595 sink.anchor("sha1" + d.getSha1sum());
-596 sink.text(d.getFileName());
-597 sink.anchor_();
-598 sink.sectionTitle2_();
-599 if (d.getDescription() != null && d.getDescription().length() > 0) {
-600 sink.paragraph();
-601 sink.bold();
-602 sink.text("Description: " );
-603 sink.bold_();
-604 sink.text(d.getDescription());
-605 sink.paragraph_();
-606 }
-607 if (d.getLicense() != null && d.getLicense().length() > 0) {
-608 sink.paragraph();
-609 sink.bold();
-610 sink.text("License: " );
-611 sink.bold_();
-612 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
-613 sink.link(d.getLicense());
-614 sink.text(d.getLicense());
-615 sink.link_();
-616 } else {
-617 sink.text(d.getLicense());
-618 }
-619 sink.paragraph_();
-620 }
-621 }
-622
-623
-624
-625
-626
-627
-628
-629 private void writeListItem(Sink sink, String text) {
-630 sink.listItem();
-631 sink.text(text);
-632 sink.listItem_();
-633 }
-634
-635
-636
-637
-638
-639
-640
-641 private void writeTableCell(Sink sink, String text) {
-642 sink.tableCell();
-643 sink.text(text);
-644 sink.tableCell_();
-645 }
-646
-647
-648
-649
-650
-651
-652
-653 private void writeTableHeaderCell(Sink sink, String text) {
-654 sink.tableHeaderCell();
-655 sink.text(text);
-656 sink.tableHeaderCell_();
-657 }
-658
-659
-660
-661
-662
-663
-664
-665 private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
-666 sink.list();
-667 for (Dependency d : dependencies) {
-668 sink.listItem();
-669 sink.link("#sha1" + d.getSha1sum());
-670 sink.text(d.getFileName());
-671 sink.link_();
-672 if (!d.getVulnerabilities().isEmpty()) {
-673 sink.rawText(" <font style=\"color:red\">•</font>" );
-674 }
-675 if (!d.getRelatedDependencies().isEmpty()) {
-676 sink.list();
-677 for (Dependency r : d.getRelatedDependencies()) {
-678 writeListItem(sink, r.getFileName());
-679 }
-680 sink.list_();
-681 }
-682 sink.listItem_();
-683 }
-684 sink.list_();
-685 }
-686
-687
-688
-689
-690
-691
-692
-693 private void writeSiteReportHeader(Sink sink, String projectName) {
-694 sink.head();
-695 sink.title();
-696 sink.text("Dependency-Check Report: " + projectName);
-697 sink.title_();
-698 sink.head_();
-699 sink.body();
-700 sink.rawText("<script type=\"text/javascript\">" );
-701 sink.rawText("function toggleElement(el, targetId) {" );
-702 sink.rawText("if (el.innerText == '[+]') {" );
-703 sink.rawText(" el.innerText = '[-]';" );
-704 sink.rawText(" document.getElementById(targetId).style.display='block';" );
-705 sink.rawText("} else {" );
-706 sink.rawText(" el.innerText = '[+]';" );
-707 sink.rawText(" document.getElementById(targetId).style.display='none';" );
-708 sink.rawText("}" );
-709
-710 sink.rawText("}" );
-711 sink.rawText("</script>" );
-712 sink.section1();
-713 sink.sectionTitle1();
-714 sink.text("Project: " + projectName);
-715 sink.sectionTitle1_();
-716 sink.date();
-717 final Date now = new Date();
-718 sink.text(DateFormat.getDateTimeInstance().format(now));
-719 sink.date_();
-720 sink.section1_();
-721 }
-722
-723
-724
-725
-726
-727
-728 private void populateSettings() {
-729 InputStream mojoProperties = null ;
-730 try {
-731 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
-732 Settings.mergeProperties(mojoProperties);
-733 } catch (IOException ex) {
-734 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
-735 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
-736 } finally {
-737 if (mojoProperties != null ) {
-738 try {
-739 mojoProperties.close();
-740 } catch (IOException ex) {
-741 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINEST, null , ex);
-742 }
-743 }
-744 }
-745
-746 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
-747
-748 if (proxyUrl != null && !proxyUrl.isEmpty()) {
-749 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
-750 }
-751 if (proxyPort != null && !proxyPort.isEmpty()) {
-752 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
-753 }
-754 if (proxyUsername != null && !proxyUsername.isEmpty()) {
-755 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
-756 }
-757 if (proxyPassword != null && !proxyPassword.isEmpty()) {
-758 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
-759 }
-760 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
-761 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
-762 }
-763 if (suppressionFile != null && !suppressionFile.isEmpty()) {
-764 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
-765 }
-766 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
-767 if (nexusUrl != null && !nexusUrl.isEmpty()) {
-768 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
-769 }
-770 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
-771 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
-772 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
-773 }
-774 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
-775 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
-776 }
-777 if (connectionString != null && !connectionString.isEmpty()) {
-778 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
-779 }
-780 if (databaseUser != null && !databaseUser.isEmpty()) {
-781 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
-782 }
-783 if (databasePassword != null && !databasePassword.isEmpty()) {
-784 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
-785 }
-786 if (zipExtensions != null && !zipExtensions.isEmpty()) {
-787 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
-788 }
-789
-790
-791 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
-792 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
-793 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
-794
-795
-796 if (dataDirectory != null && !dataDirectory.isEmpty()) {
-797 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
-798 }
-799
-800
-801 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
-802 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
-803 }
-804 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
-805 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
-806 }
-807 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
-808 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+482 sink.lineBreak();
+483 sink.text("CVSS Score: " + v.getCvssScore());
+484 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
+485 sink.lineBreak();
+486 sink.text("CWE: " );
+487 sink.text(v.getCwe());
+488 }
+489 sink.paragraph_();
+490 sink.paragraph();
+491 sink.text(v.getDescription());
+492 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
+493 sink.list();
+494 for (Reference ref : v.getReferences()) {
+495 sink.listItem();
+496 sink.text(ref.getSource());
+497 sink.text(" - " );
+498 sink.link(ref.getUrl());
+499 sink.text(ref.getName());
+500 sink.link_();
+501 sink.listItem_();
+502 }
+503 sink.list_();
+504 }
+505 sink.paragraph_();
+506 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
+507 sink.paragraph();
+508
+509 cnt += 1;
+510 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
+511 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
+512 sink.list();
+513 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
+514 sink.listItem();
+515 try {
+516 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
+517 sink.text(vs.getName());
+518 sink.link_();
+519 if (vs.hasPreviousVersion()) {
+520 sink.text(" and all previous versions." );
+521 }
+522 } catch (UnsupportedEncodingException ex) {
+523 sink.text(vs.getName());
+524 if (vs.hasPreviousVersion()) {
+525 sink.text(" and all previous versions." );
+526 }
+527 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
+528 }
+529
+530 sink.listItem_();
+531 }
+532 sink.list_();
+533 sink.rawText("</div>" );
+534 sink.paragraph_();
+535 }
+536 }
+537 }
+538 }
+539
+540
+541
+542
+543
+544
+545
+546 private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
+547 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
+548 sink.sectionTitle4();
+549 sink.text("Identifiers" );
+550 sink.sectionTitle4_();
+551 sink.list();
+552 for (Identifier i : d.getIdentifiers()) {
+553 sink.listItem();
+554 sink.text(i.getType());
+555 sink.text(": " );
+556 if (i.getUrl() != null && i.getUrl().length() > 0) {
+557 sink.link(i.getUrl());
+558 sink.text(i.getValue());
+559 sink.link_();
+560 } else {
+561 sink.text(i.getValue());
+562 }
+563 if (i.getDescription() != null && i.getDescription().length() > 0) {
+564 sink.lineBreak();
+565 sink.text(i.getDescription());
+566 }
+567 sink.listItem_();
+568 }
+569 sink.list_();
+570 }
+571 }
+572
+573
+574
+575
+576
+577
+578
+579
+580
+581 private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
+582 int cnt = collapsibleHeaderCount;
+583 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
+584 cnt += 1;
+585 sink.sectionTitle4();
+586 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
+587 sink.sectionTitle4_();
+588 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
+589 sink.list();
+590 for (Dependency r : d.getRelatedDependencies()) {
+591 sink.listItem();
+592 sink.text(r.getFileName());
+593 sink.list();
+594 writeListItem(sink, "File Path: " + r.getFilePath());
+595 writeListItem(sink, "SHA1: " + r.getSha1sum());
+596 writeListItem(sink, "MD5: " + r.getMd5sum());
+597 sink.list_();
+598 sink.listItem_();
+599 }
+600 sink.list_();
+601 sink.rawText("</div>" );
+602 }
+603 return cnt;
+604 }
+605
+606
+607
+608
+609
+610
+611
+612
+613
+614 private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
+615 int cnt = collapsibleHeaderCount;
+616 if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
+617 cnt += 1;
+618 sink.sectionTitle4();
+619 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
+620 sink.sectionTitle4_();
+621 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
+622 sink.table();
+623 sink.tableRow();
+624 writeTableHeaderCell(sink, "Source" );
+625 writeTableHeaderCell(sink, "Name" );
+626 writeTableHeaderCell(sink, "Value" );
+627 sink.tableRow_();
+628 for (Evidence e : d.getEvidenceUsed()) {
+629 sink.tableRow();
+630 writeTableCell(sink, e.getSource());
+631 writeTableCell(sink, e.getName());
+632 writeTableCell(sink, e.getValue());
+633 sink.tableRow_();
+634 }
+635 sink.table_();
+636 sink.rawText("</div>" );
+637 }
+638 return cnt;
+639 }
+640
+641
+642
+643
+644
+645
+646
+647 private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
+648 sink.sectionTitle2();
+649 sink.anchor("sha1" + d.getSha1sum());
+650 sink.text(d.getFileName());
+651 sink.anchor_();
+652 sink.sectionTitle2_();
+653 if (d.getDescription() != null && d.getDescription().length() > 0) {
+654 sink.paragraph();
+655 sink.bold();
+656 sink.text("Description: " );
+657 sink.bold_();
+658 sink.text(d.getDescription());
+659 sink.paragraph_();
+660 }
+661 if (d.getLicense() != null && d.getLicense().length() > 0) {
+662 sink.paragraph();
+663 sink.bold();
+664 sink.text("License: " );
+665 sink.bold_();
+666 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
+667 sink.link(d.getLicense());
+668 sink.text(d.getLicense());
+669 sink.link_();
+670 } else {
+671 sink.text(d.getLicense());
+672 }
+673 sink.paragraph_();
+674 }
+675 }
+676
+677
+678
+679
+680
+681
+682
+683 private void writeListItem(Sink sink, String text) {
+684 sink.listItem();
+685 sink.text(text);
+686 sink.listItem_();
+687 }
+688
+689
+690
+691
+692
+693
+694
+695 private void writeTableCell(Sink sink, String text) {
+696 sink.tableCell();
+697 sink.text(text);
+698 sink.tableCell_();
+699 }
+700
+701
+702
+703
+704
+705
+706
+707 private void writeTableHeaderCell(Sink sink, String text) {
+708 sink.tableHeaderCell();
+709 sink.text(text);
+710 sink.tableHeaderCell_();
+711 }
+712
+713
+714
+715
+716
+717
+718
+719 private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
+720 sink.list();
+721 for (Dependency d : dependencies) {
+722 sink.listItem();
+723 sink.link("#sha1" + d.getSha1sum());
+724 sink.text(d.getFileName());
+725 sink.link_();
+726 if (!d.getVulnerabilities().isEmpty()) {
+727 sink.rawText(" <font style=\"color:red\">•</font>" );
+728 }
+729 if (!d.getRelatedDependencies().isEmpty()) {
+730 sink.list();
+731 for (Dependency r : d.getRelatedDependencies()) {
+732 writeListItem(sink, r.getFileName());
+733 }
+734 sink.list_();
+735 }
+736 sink.listItem_();
+737 }
+738 sink.list_();
+739 }
+740
+741
+742
+743
+744
+745
+746
+747 private void writeSiteReportHeader(Sink sink, String projectName) {
+748 sink.head();
+749 sink.title();
+750 sink.text("Dependency-Check Report: " + projectName);
+751 sink.title_();
+752 sink.head_();
+753 sink.body();
+754 sink.rawText("<script type=\"text/javascript\">" );
+755 sink.rawText("function toggleElement(el, targetId) {" );
+756 sink.rawText("if (el.innerText == '[+]') {" );
+757 sink.rawText(" el.innerText = '[-]';" );
+758 sink.rawText(" document.getElementById(targetId).style.display='block';" );
+759 sink.rawText("} else {" );
+760 sink.rawText(" el.innerText = '[+]';" );
+761 sink.rawText(" document.getElementById(targetId).style.display='none';" );
+762 sink.rawText("}" );
+763
+764 sink.rawText("}" );
+765 sink.rawText("</script>" );
+766 sink.section1();
+767 sink.sectionTitle1();
+768 sink.text("Project: " + projectName);
+769 sink.sectionTitle1_();
+770 sink.date();
+771 final Date now = new Date();
+772 sink.text(DateFormat.getDateTimeInstance().format(now));
+773 sink.date_();
+774 sink.section1_();
+775 }
+776
+777
+778
+779
+780
+781
+782
+783
+784 private String getMavenSettingsProxyUrl(Proxy proxy) {
+785 return new StringBuilder(proxy.getProtocol()).append("://" ).append(proxy.getHost()).toString();
+786 }
+787
+788
+789
+790
+791
+792
+793 private Proxy getMavenProxy() {
+794 if (mavenSettings != null ) {
+795 final List<Proxy> proxies = mavenSettings.getProxies();
+796 if (proxies != null && proxies.size() > 0) {
+797 if (mavenSettingsProxyId != null ) {
+798 for (Proxy proxy : proxies) {
+799 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
+800 return proxy;
+801 }
+802 }
+803 } else if (proxies.size() == 1) {
+804 return proxies.get(0);
+805 } else {
+806 throw new IllegalStateException("Ambigous proxy definition" );
+807 }
+808 }
809 }
-810 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
-811 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
-812 }
-813 if (pathToMono != null && !pathToMono.isEmpty()) {
-814 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
-815 }
-816 }
-817
-818
-819
-820
-821
-822
-823
-824 public void execute() throws MojoExecutionException, MojoFailureException {
-825 Engine engine = null ;
-826 try {
-827 engine = executeDependencyCheck();
-828 generateExternalReports(engine);
-829 if (this .showSummary) {
-830 showSummary(engine.getDependencies());
-831 }
-832 if (this .failBuildOnCVSS <= 10) {
-833 checkForFailure(engine.getDependencies());
-834 }
-835 } catch (DatabaseException ex) {
-836 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
-837 "Unable to connect to the dependency-check database; analysis has stopped" );
-838 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
-839 } finally {
-840 if (engine != null ) {
-841 engine.cleanup();
-842 }
-843 }
-844 }
-845
-846
-847
-848
-849
-850
-851
-852
-853 public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
-854 Locale locale) throws MavenReportException {
-855 generate((Sink) sink, null , locale);
-856 }
-857
-858
-859
-860
-861
-862
-863
-864
-865
-866 public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
-867 Engine engine = null ;
-868 try {
-869 engine = executeDependencyCheck();
-870 generateMavenSiteReport(engine, sink);
-871 } catch (DatabaseException ex) {
-872 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
-873 "Unable to connect to the dependency-check database; analysis has stopped" );
-874 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
-875 } finally {
-876 if (engine != null ) {
-877 engine.cleanup();
-878 }
-879 }
-880 }
-881
-882
-883
-884
-885
-886
-887
-888 public String getOutputName() {
-889 return reportName;
-890 }
-891
-892
-893
-894
-895
-896
-897 public String getCategoryName() {
-898 return MavenReport.CATEGORY_PROJECT_REPORTS;
-899 }
-900
-901
-902
-903
-904
-905
-906
-907 public String getName(Locale locale) {
-908 return name;
-909 }
+810 return null ;
+811 }
+812
+813
+814
+815
+816
+817 private void populateSettings() {
+818 InputStream mojoProperties = null ;
+819 try {
+820 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+821 Settings.mergeProperties(mojoProperties);
+822 } catch (IOException ex) {
+823 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
+824 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, null , ex);
+825 } finally {
+826 if (mojoProperties != null ) {
+827 try {
+828 mojoProperties.close();
+829 } catch (IOException ex) {
+830 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINEST, null , ex);
+831 }
+832 }
+833 }
+834
+835 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+836
+837 final Proxy proxy = getMavenProxy();
+838 if (proxy != null ) {
+839 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy));
+840 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
+841 final String userName = proxy.getUsername();
+842 final String password = proxy.getPassword();
+843 if (userName != null && password != null ) {
+844 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
+845 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
+846 }
+847 }
+848
+849 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+850 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+851 }
+852 if (proxyPort != null && !proxyPort.isEmpty()) {
+853 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+854 }
+855 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+856 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+857 }
+858 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+859 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+860 }
+861 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+862 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+863 }
+864 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+865 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+866 }
+867
+868
+869
+870 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
+871
+872 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
+873
+874 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+875 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+876 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+877 }
+878 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+879
+880 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
+881 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+882 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+883 }
+884
+885 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
+886 if (pathToMono != null && !pathToMono.isEmpty()) {
+887 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+888 }
+889
+890
+891 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+892 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+893 }
+894 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+895 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+896 }
+897 if (connectionString != null && !connectionString.isEmpty()) {
+898 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+899 }
+900 if (databaseUser != null && !databaseUser.isEmpty()) {
+901 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+902 }
+903 if (databasePassword != null && !databasePassword.isEmpty()) {
+904 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+905 }
+906
+907 if (dataDirectory != null && !dataDirectory.isEmpty()) {
+908 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+909 }
910
-911
-912
-913
-914
-915
-916 public void setReportOutputDirectory(File directory) {
-917 reportOutputDirectory = directory;
-918 }
-919
-920
-921
-922
-923
-924
-925 public File getReportOutputDirectory() {
-926 return reportOutputDirectory;
-927 }
-928
-929
-930
-931
-932
-933
-934
-935 public String getDescription(Locale locale) {
-936 return description;
-937 }
-938
-939
-940
-941
-942
-943
-944 public boolean isExternalReport() {
-945 return externalReport;
-946 }
-947
-948
-949
-950
-951
-952
-953 public boolean canGenerateReport() {
-954 return true ;
-955 }
-956
-957
-958
-959
-960
-961
-962
-963
-964
-965 private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
-966 final StringBuilder ids = new StringBuilder();
-967 for (Dependency d : dependencies) {
-968 boolean addName = true ;
-969 for (Vulnerability v : d.getVulnerabilities()) {
-970 if (v.getCvssScore() >= failBuildOnCVSS) {
-971 if (addName) {
-972 addName = false;
-973 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
-974 ids.append(v.getName());
-975 } else {
-976 ids.append(", " ).append(v.getName());
-977 }
-978 }
-979 }
-980 }
-981 if (ids.length() > 0) {
-982 final String msg = String.format("%n%nDependency-Check Failure:%n"
-983 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
-984 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
-985 throw new MojoFailureException(msg);
-986 }
-987 }
-988
-989
-990
-991
-992
-993
-994 private void showSummary(List<Dependency> dependencies) {
-995 final StringBuilder summary = new StringBuilder();
-996 for (Dependency d : dependencies) {
-997 boolean firstEntry = true ;
-998 final StringBuilder ids = new StringBuilder();
-999 for (Vulnerability v : d.getVulnerabilities()) {
-1000 if (firstEntry) {
-1001 firstEntry = false;
-1002 } else {
-1003 ids.append(", " );
-1004 }
-1005 ids.append(v.getName());
-1006 }
-1007 if (ids.length() > 0) {
-1008 summary.append(d.getFileName()).append(" (" );
-1009 firstEntry = true ;
-1010 for (Identifier id : d.getIdentifiers()) {
-1011 if (firstEntry) {
-1012 firstEntry = false;
-1013 } else {
-1014 summary.append(", " );
-1015 }
-1016 summary.append(id.getValue());
-1017 }
-1018 summary.append(") : " ).append(ids).append(NEW_LINE);
-1019 }
-1020 }
-1021 if (summary.length() > 0) {
-1022 final String msg = String.format("%n%n"
-1023 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
-1024 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
-1025 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.WARNING, msg);
-1026 }
-1027 }
-1028 }
+911
+912 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
+913 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
+914 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
+915
+916
+917 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+918 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+919 }
+920 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+921 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+922 }
+923 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+924 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+925 }
+926 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+927 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+928 }
+929
+930 }
+931
+932
+933
+934
+935
+936
+937
+938 public void execute() throws MojoExecutionException, MojoFailureException {
+939 Engine engine = null ;
+940 try {
+941 engine = executeDependencyCheck();
+942 generateExternalReports(engine, outputDirectory);
+943 if (this .showSummary) {
+944 showSummary(engine.getDependencies());
+945 }
+946 if (this .failBuildOnCVSS <= 10) {
+947 checkForFailure(engine.getDependencies());
+948 }
+949 } catch (DatabaseException ex) {
+950 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+951 "Unable to connect to the dependency-check database; analysis has stopped" );
+952 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
+953 } finally {
+954 if (engine != null ) {
+955 engine.cleanup();
+956 }
+957 }
+958 }
+959
+960
+961
+962
+963
+964
+965
+966
+967 public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
+968 Locale locale) throws MavenReportException {
+969 generate((Sink) sink, null , locale);
+970 }
+971
+972
+973
+974
+975
+976
+977
+978
+979
+980 public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
+981 Engine engine = null ;
+982 try {
+983 engine = executeDependencyCheck();
+984 if (this .externalReport) {
+985 generateExternalReports(engine, reportOutputDirectory);
+986 } else {
+987 generateMavenSiteReport(engine, sink);
+988 }
+989 } catch (DatabaseException ex) {
+990 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.SEVERE,
+991 "Unable to connect to the dependency-check database; analysis has stopped" );
+992 Logger.getLogger(DependencyCheckMojo.class .getName()).log(Level.FINE, "" , ex);
+993 } finally {
+994 if (engine != null ) {
+995 engine.cleanup();
+996 }
+997 }
+998 }
+999
+1000
+1001
+1002
+1003
+1004
+1005
+1006 public String getOutputName() {
+1007 if ("HTML" .equalsIgnoreCase(this .format)
+1008 || "ALL" .equalsIgnoreCase(this .format)) {
+1009 return "dependency-check-report" ;
+1010 } else if ("XML" .equalsIgnoreCase(this .format)) {
+1011 return "dependency-check-report.xml#" ;
+1012 } else if ("VULN" .equalsIgnoreCase(this .format)) {
+1013 return "dependency-check-vulnerability" ;
+1014 } else {
+1015 Logger.getLogger(DependencyCheckMojo.class
+1016 .getName()).log(Level.WARNING, "Unknown report format used during site generatation." );
+1017 return "dependency-check-report" ;
+1018 }
+1019 }
+1020
+1021
+1022
+1023
+1024
+1025
+1026 public String getCategoryName() {
+1027 return MavenReport.CATEGORY_PROJECT_REPORTS;
+1028 }
+1029
+1030
+1031
+1032
+1033
+1034
+1035
+1036 public String getName(Locale locale) {
+1037 return name;
+1038 }
+1039
+1040
+1041
+1042
+1043
+1044
+1045 public void setReportOutputDirectory(File directory) {
+1046 reportOutputDirectory = directory;
+1047 }
+1048
+1049
+1050
+1051
+1052
+1053
+1054 public File getReportOutputDirectory() {
+1055 return reportOutputDirectory;
+1056 }
+1057
+1058
+1059
+1060
+1061
+1062
+1063
+1064 public String getDescription(Locale locale) {
+1065 return description;
+1066 }
+1067
+1068
+1069
+1070
+1071
+1072
+1073 public boolean isExternalReport() {
+1074 return externalReport;
+1075 }
+1076
+1077
+1078
+1079
+1080
+1081
+1082 public boolean canGenerateReport() {
+1083 return true ;
+1084 }
+1085
+1086
+1087
+1088
+1089
+1090
+1091
+1092
+1093
+1094 private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
+1095 final StringBuilder ids = new StringBuilder();
+1096 for (Dependency d : dependencies) {
+1097 boolean addName = true ;
+1098 for (Vulnerability v : d.getVulnerabilities()) {
+1099 if (v.getCvssScore() >= failBuildOnCVSS) {
+1100 if (addName) {
+1101 addName = false;
+1102 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+1103 ids.append(v.getName());
+1104 } else {
+1105 ids.append(", " ).append(v.getName());
+1106 }
+1107 }
+1108 }
+1109 }
+1110 if (ids.length() > 0) {
+1111 final String msg = String.format("%n%nDependency-Check Failure:%n"
+1112 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+1113 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+1114 throw new MojoFailureException(msg);
+1115 }
+1116 }
+1117
+1118
+1119
+1120
+1121
+1122
+1123 private void showSummary(List<Dependency> dependencies) {
+1124 final StringBuilder summary = new StringBuilder();
+1125 for (Dependency d : dependencies) {
+1126 boolean firstEntry = true ;
+1127 final StringBuilder ids = new StringBuilder();
+1128 for (Vulnerability v : d.getVulnerabilities()) {
+1129 if (firstEntry) {
+1130 firstEntry = false;
+1131 } else {
+1132 ids.append(", " );
+1133 }
+1134 ids.append(v.getName());
+1135 }
+1136 if (ids.length() > 0) {
+1137 summary.append(d.getFileName()).append(" (" );
+1138 firstEntry = true ;
+1139 for (Identifier id : d.getIdentifiers()) {
+1140 if (firstEntry) {
+1141 firstEntry = false;
+1142 } else {
+1143 summary.append(", " );
+1144 }
+1145 summary.append(id.getValue());
+1146 }
+1147 summary.append(") : " ).append(ids).append(NEW_LINE);
+1148 }
+1149 }
+1150 if (summary.length() > 0) {
+1151 final String msg = String.format("%n%n"
+1152 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+1153 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+1154 Logger
+1155 .getLogger(DependencyCheckMojo.class
+1156 .getName()).log(Level.WARNING, msg);
+1157 }
+1158 }
+1159 }
Dependency-Check Maven Plugin 1.1.3 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.1.3 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
Dependency-Check Maven Plugin 1.1.3 Reference
+ Dependency-Check Maven Plugin 1.1.4 Reference
diff --git a/index.html b/index.html
index 9a0ffcd49..47d563a7b 100644
--- a/index.html
+++ b/index.html
@@ -1,13 +1,13 @@
dependency-check - About
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/issue-tracking.html b/issue-tracking.html
index 3a8794ce4..74b2f9a99 100644
--- a/issue-tracking.html
+++ b/issue-tracking.html
@@ -1,13 +1,13 @@
dependency-check - Issue Tracking
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/license.html b/license.html
index 7d7f3da73..9c491232c 100644
--- a/license.html
+++ b/license.html
@@ -1,13 +1,13 @@
dependency-check - Project License
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/mail-lists.html b/mail-lists.html
index 7b66f9e0f..5d71b2d88 100644
--- a/mail-lists.html
+++ b/mail-lists.html
@@ -1,13 +1,13 @@
dependency-check - Project Mailing Lists
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/modules.html b/modules.html
index a56a51f1c..93e2db120 100644
--- a/modules.html
+++ b/modules.html
@@ -1,13 +1,13 @@
dependency-check - Project Modules
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/project-info.html b/project-info.html
index de6c4f44a..fd45b0e3a 100644
--- a/project-info.html
+++ b/project-info.html
@@ -1,13 +1,13 @@
dependency-check - Project Information
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/project-summary.html b/project-summary.html
index bd8ebb904..2f21c789f 100644
--- a/project-summary.html
+++ b/project-summary.html
@@ -1,13 +1,13 @@
dependency-check - Project Summary
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
@@ -291,7 +291,7 @@
dependency-check-parent
Version
-1.1.3
+1.1.4
Type
pom
diff --git a/source-repository.html b/source-repository.html
index 4b89db188..e1202f37d 100644
--- a/source-repository.html
+++ b/source-repository.html
@@ -1,13 +1,13 @@
dependency-check - Source Repository
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/suppression.html b/suppression.html
index 3f428548f..ea39143d0 100644
--- a/suppression.html
+++ b/suppression.html
@@ -1,13 +1,13 @@
dependency-check - Suppressing False Positives
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
diff --git a/team-list.html b/team-list.html
index a169d3448..cd20c2a73 100644
--- a/team-list.html
+++ b/team-list.html
@@ -1,13 +1,13 @@
dependency-check - Team list
| Last Published: 2014-03-10| Last Published: 2014-03-29
- Version: 1.1.3
+ Version: 1.1.4
