-
+
@@ -205,10 +207,16 @@
-
-
+
+
+
+
+
+
+
@@ -220,10 +228,17 @@
-
-
+
+
-
+
+
+
+
+
@@ -270,7 +285,7 @@
Line
Total number of methods is 52 (max allowed is 40).
+Total number of methods is 64 (max allowed is 40).
51
@@ -280,15 +295,17 @@
-
Copyright © 2012-2014
+
+
Copyright © 2012–2014
OWASP .
- All Rights Reserved.
+ All rights reserved.
-
+
+
-
+
diff --git a/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html
index 1fa3510f1..257736f50 100644
--- a/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html
+++ b/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html
@@ -15,7 +15,7 @@ org.owasp.dependencycheck.taskdefs
diff --git a/dependency-check-ant/cobertura/frame-sourcefiles.html b/dependency-check-ant/cobertura/frame-sourcefiles.html
index 18211c2dd..4832b5048 100644
--- a/dependency-check-ant/cobertura/frame-sourcefiles.html
+++ b/dependency-check-ant/cobertura/frame-sourcefiles.html
@@ -15,7 +15,7 @@ All Packages
diff --git a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html
index 23ee6e079..a63d91121 100644
--- a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html
+++ b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-ant/cobertura/frame-summary.html b/dependency-check-ant/cobertura/frame-summary.html
index 7dec1a579..bdd9e4310 100644
--- a/dependency-check-ant/cobertura/frame-summary.html
+++ b/dependency-check-ant/cobertura/frame-summary.html
@@ -16,8 +16,8 @@
-
+
diff --git a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html
index 0679a98af..97683a652 100644
--- a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html
+++ b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html
@@ -12,8 +12,8 @@
@@ -307,7 +307,8 @@
157
public String getApplicationName() {
- 158 0 return applicationName;
+ 158
+ return applicationName;
159
}
160
@@ -324,8 +325,10 @@
166
public void setApplicationName(String applicationName) {
- 167 4 this .applicationName = applicationName;
- 168 4 }
+ 167
+ this .applicationName = applicationName;
+ 168
+ }
169
170
@@ -347,7 +350,8 @@
179
public String getDataDirectory() {
- 180 0 return dataDirectory;
+ 180
+ return dataDirectory;
181
}
182
@@ -364,8 +368,10 @@
188
public void setDataDirectory(String dataDirectory) {
- 189 0 this .dataDirectory = dataDirectory;
- 190 0 }
+ 189
+ this .dataDirectory = dataDirectory;
+ 190
+ }
191
192
@@ -387,7 +393,8 @@
201
public String getReportOutputDirectory() {
- 202 0 return reportOutputDirectory;
+ 202
+ return reportOutputDirectory;
203
}
204
@@ -404,8 +411,10 @@
210
public void setReportOutputDirectory(String reportOutputDirectory) {
- 211 4 this .reportOutputDirectory = reportOutputDirectory;
- 212 4 }
+ 211
+ this .reportOutputDirectory = reportOutputDirectory;
+ 212
+ }
213
214
@@ -431,7 +440,8 @@
225
public float getFailBuildOnCVSS() {
- 226 0 return failBuildOnCVSS;
+ 226
+ return failBuildOnCVSS;
227
}
228
@@ -448,8 +458,10 @@
234
public void setFailBuildOnCVSS(float failBuildOnCVSS) {
- 235 1 this .failBuildOnCVSS = failBuildOnCVSS;
- 236 1 }
+ 235
+ this .failBuildOnCVSS = failBuildOnCVSS;
+ 236
+ }
237
238
@@ -473,7 +485,8 @@
248
public boolean isAutoUpdate() {
- 249 0 return autoUpdate;
+ 249
+ return autoUpdate;
250
}
251
@@ -490,8 +503,10 @@
257
public void setAutoUpdate(boolean autoUpdate) {
- 258 4 this .autoUpdate = autoUpdate;
- 259 4 }
+ 258
+ this .autoUpdate = autoUpdate;
+ 259
+ }
260
261
@@ -515,7 +530,8 @@
271
public String getReportFormat() {
- 272 0 return reportFormat;
+ 272
+ return reportFormat;
273
}
274
@@ -556,7 +572,8 @@
293
public String getProxyUrl() {
- 294 0 return proxyUrl;
+ 294
+ return proxyUrl;
295
}
296
@@ -573,8 +590,10 @@
302
public void setProxyUrl(String proxyUrl) {
- 303 0 this .proxyUrl = proxyUrl;
- 304 0 }
+ 303
+ this .proxyUrl = proxyUrl;
+ 304
+ }
305
306
@@ -597,7 +616,8 @@
315
public String getProxyPort() {
- 316 0 return proxyPort;
+ 316
+ return proxyPort;
317
}
318
@@ -614,8 +634,10 @@
324
public void setProxyPort(String proxyPort) {
- 325 0 this .proxyPort = proxyPort;
- 326 0 }
+ 325
+ this .proxyPort = proxyPort;
+ 326
+ }
327
328
@@ -638,7 +660,8 @@
337
public String getProxyUsername() {
- 338 0 return proxyUsername;
+ 338
+ return proxyUsername;
339
}
340
@@ -655,8 +678,10 @@
346
public void setProxyUsername(String proxyUsername) {
- 347 0 this .proxyUsername = proxyUsername;
- 348 0 }
+ 347
+ this .proxyUsername = proxyUsername;
+ 348
+ }
349
350
@@ -679,7 +704,8 @@
359
public String getProxyPassword() {
- 360 0 return proxyPassword;
+ 360
+ return proxyPassword;
361
}
362
@@ -696,8 +722,10 @@
368
public void setProxyPassword(String proxyPassword) {
- 369 0 this .proxyPassword = proxyPassword;
- 370 0 }
+ 369
+ this .proxyPassword = proxyPassword;
+ 370
+ }
371
372
@@ -720,7 +748,8 @@
381
public String getConnectionTimeout() {
- 382 0 return connectionTimeout;
+ 382
+ return connectionTimeout;
383
}
384
@@ -737,8 +766,10 @@
390
public void setConnectionTimeout(String connectionTimeout) {
- 391 0 this .connectionTimeout = connectionTimeout;
- 392 0 }
+ 391
+ this .connectionTimeout = connectionTimeout;
+ 392
+ }
393
394
@@ -760,7 +791,8 @@
403
public String getLogFile() {
- 404 0 return logFile;
+ 404
+ return logFile;
405
}
406
@@ -777,8 +809,10 @@
412
public void setLogFile(String logFile) {
- 413 0 this .logFile = logFile;
- 414 0 }
+ 413
+ this .logFile = logFile;
+ 414
+ }
415
416
@@ -801,7 +835,8 @@
425
public String getSuppressionFile() {
- 426 0 return suppressionFile;
+ 426
+ return suppressionFile;
427
}
428
@@ -818,8 +853,10 @@
434
public void setSuppressionFile(String suppressionFile) {
- 435 0 this .suppressionFile = suppressionFile;
- 436 0 }
+ 435
+ this .suppressionFile = suppressionFile;
+ 436
+ }
437
438
@@ -841,7 +878,8 @@
447
public boolean isShowSummary() {
- 448 0 return showSummary;
+ 448
+ return showSummary;
449
}
450
@@ -858,8 +896,10 @@
456
public void setShowSummary(boolean showSummary) {
- 457 0 this .showSummary = showSummary;
- 458 0 }
+ 457
+ this .showSummary = showSummary;
+ 458
+ }
459
460
@@ -883,7 +923,8 @@
470
public boolean isNexusAnalyzerEnabled() {
- 471 0 return nexusAnalyzerEnabled;
+ 471
+ return nexusAnalyzerEnabled;
472
}
473
@@ -900,8 +941,10 @@
479
public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
- 480 0 this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
- 481 0 }
+ 480
+ this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
+ 481
+ }
482
483
@@ -926,7 +969,8 @@
493
public String getNexusUrl() {
- 494 0 return nexusUrl;
+ 494
+ return nexusUrl;
495
}
496
@@ -943,117 +987,125 @@
502
public void setNexusUrl(String nexusUrl) {
- 503 0 this .nexusUrl = nexusUrl;
- 504 0 }
+ 503
+ this .nexusUrl = nexusUrl;
+ 504
+ }
505
-
+ 506
-
+ 507
-
- 508
+ 508 4 private boolean nexusUsesProxy = true ;
509
- private String databaseDriverName;
+ 510
-
+ 511
-
+ 512
-
+ 513
-
+ 514
-
+ 515
-
+ public boolean isNexusUsesProxy() { 516
- public String getDatabaseDriverName() {
- 517 0 return databaseDriverName;
+ return nexusUsesProxy; 517
+ }
518
- }
+ 519
-
+ 520
-
+ 521
-
+ 522
-
+ 523
-
+ 524
-
+ public void setNexusUsesProxy(boolean nexusUsesProxy) { 525
- public void setDatabaseDriverName(String databaseDriverName) {
- 526 0 this .databaseDriverName = databaseDriverName;
- 527 0 }
- 528
-
- 529
-
- 530
-
- 531
-
- 532
- private String databaseDriverPath;
- 533
-
- 534
-
- 535
-
- 536
-
- 537
-
- 538
-
- 539
- public String getDatabaseDriverPath() {
- 540 0 return databaseDriverPath;
- 541
+ this .nexusUsesProxy = nexusUsesProxy;
+ 526
}
- 542
+ 527
- 543
+ 528
- 544
-
- 545
-
- 546
-
- 547
+ 529
+
+ 530
+ 531
+ private String databaseDriverName;
+ 532
+
+ 533
+
+ 534
+
+ 535
+
+ 536
+
+ 537
+
+ 538
+ public String getDatabaseDriverName() {
+ 539
+ return databaseDriverName;
+ 540
+ }
+ 541
+
+ 542
+
+ 543
+
+ 544
+
+ 545
+
+ 546
+
+ 547
+ public void setDatabaseDriverName(String databaseDriverName) {
548
- public void setDatabaseDriverPath(String databaseDriverPath) {
- 549 0 this .databaseDriverPath = databaseDriverPath;
- 550 0 }
+ this .databaseDriverName = databaseDriverName; 549
+ }
+ 550
+
551
552
-
+ 553
554
- private String connectionString;
+ private String databaseDriverPath; 555
556
557
-
+ 558
559
-
+ 560
561
- public String getConnectionString() {
- 562 0 return connectionString;
+ public String getDatabaseDriverPath() { 562
+ return databaseDriverPath;
563
}
564
@@ -1061,40 +1113,43 @@
565
566
-
+ 567
568
-
+ 569
570
- public void setConnectionString(String connectionString) {
- 571 0 this .connectionString = connectionString;
- 572 0 }
+ public void setDatabaseDriverPath(String databaseDriverPath) { 571
+ this .databaseDriverPath = databaseDriverPath;
+ 572
+ }
573
574
-
+ 575
576
- private String databaseUser;
+ private String connectionString; 577
578
579
-
+ 580
581
-
+ 582
583
- public String getDatabaseUser() {
- 584 0 return databaseUser;
+ public String getConnectionString() { 584
+ return connectionString;
585
}
586
@@ -1102,388 +1157,713 @@
587
588
-
+ 589
590
-
+ 591
592
- public void setDatabaseUser(String databaseUser) {
- 593 0 this .databaseUser = databaseUser;
- 594 0 }
- 595
-
- 596
-
- 597
-
- 598
-
- 599
- private String databasePassword;
- 600
-
- 601
-
- 602
-
- 603
-
- 604
-
- 605
-
- 606
- public String getDatabasePassword() {
- 607 0 return databasePassword;
- 608
+ public void setConnectionString(String connectionString) {
+ 593
+ this .connectionString = connectionString;
+ 594
}
- 609
-
- 610
+ 595
- 611
-
- 612
-
- 613
-
- 614
+ 596
+
+ 597
+ 598
+ private String databaseUser;
+ 599
+
+ 600
+
+ 601
+
+ 602
+
+ 603
+
+ 604
+
+ 605
+ public String getDatabaseUser() {
+ 606
+ return databaseUser;
+ 607
+ }
+ 608
+
+ 609
+
+ 610
+
+ 611
+
+ 612
+
+ 613
+
+ 614
+ public void setDatabaseUser(String databaseUser) {
615
- public void setDatabasePassword(String databasePassword) {
- 616 0 this .databasePassword = databasePassword;
- 617 0 }
+ this .databaseUser = databaseUser; 616
+ }
+ 617
+
618
-
+ 619
- @Override
+ 620
- public void execute() throws BuildException {
- 621 4 final InputStream in = DependencyCheckTask.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
- 622 4 LogUtils.prepareLogger(in, logFile);
+ 621
+ private String databasePassword;
+ 622
+
623
-
- 624 4 dealWithReferences();
- 625 4 validateConfiguration();
- 626 3 populateSettings();
+ 624
+
+ 625
+
+ 626
+
627
+
+ 628
+ public String getDatabasePassword() {
+ 629
+ return databasePassword;
+ 630
+ }
+ 631
- 628 3 final Engine engine = new Engine();
- 629 3 for (Resource resource : path) {
- 630 5 final FileProvider provider = resource.as(FileProvider.class );
- 631 5 if (provider != null ) {
- 632 5 final File file = provider.getFile();
- 633 5 if (file != null && file.exists()) {
- 634 4 engine.scan(file);
+ 632
+
+ 633
+
+ 634
+
635
- }
+ 636
- }
- 637 5 }
+ 637
+ public void setDatabasePassword(String databasePassword) {
638
- try {
- 639 3 engine.analyzeDependencies();
- 640 3 DatabaseProperties prop = null ;
- 641 3 CveDB cve = null ;
+ this .databasePassword = databasePassword; 639
+ }
+ 640
+
+ 641
+
642
- try {
- 643 3 cve = new CveDB();
- 644 3 cve.open();
- 645 3 prop = cve.getDatabaseProperties();
- 646 0 } catch (DatabaseException ex) {
- 647 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+ 643
+
+ 644
+
+ 645
+ private String zipExtensions;
+ 646
+
+ 647
+
648
- } finally {
- 649 3 if (cve != null ) {
- 650 3 cve.close();
+ 649
+
+ 650
+
651
- }
+ 652
- }
- 653 3 final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
- 654 3 reporter.generateReports(reportOutputDirectory, reportFormat);
+ public String getZipExtensions() { 653
+ return zipExtensions;
+ 654
+ }
655
- 656 3 if (this .failBuildOnCVSS <= 10) {
- 657 0 checkForFailure(engine.getDependencies());
+ 656
+
+ 657
+
658
- }
- 659 3 if (this .showSummary) {
- 660 3 showSummary(engine.getDependencies());
- 661
- }
- 662 0 } catch (IOException ex) {
- 663 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, "Unable to generate dependency-check report" , ex);
- 664 0 throw new BuildException("Unable to generate dependency-check report" , ex);
- 665 0 } catch (Exception ex) {
- 666 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, "An exception occurred; unable to continue task" , ex);
- 667 0 throw new BuildException("An exception occurred; unable to continue task" , ex);
- 668 3 }
- 669 3 }
- 670
-
- 671
-
- 672
-
- 673
- 674
-
- 675
+ 659
+
+ 660
- 676
- private void validateConfiguration() throws BuildException {
- 677 4 if (path == null ) {
- 678 1 throw new BuildException("No project dependencies have been defined to analyze." );
- 679
- }
- 680 3 if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
- 681 0 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11." );
- 682
- }
- 683 3 }
- 684
+ 661
+ public void setZipExtensions(String zipExtensions) {
+ 662
+ this .zipExtensions = zipExtensions;
+ 663
+ }
+ 664
- 685
+ 665
- 686
-
- 687
-
- 688
+ 666
+
+ 667
+ 668
+ private String cveUrl12Modified;
+ 669
+
+ 670
+
+ 671
+
+ 672
+
+ 673
+
+ 674
+
+ 675
+ public String getCveUrl12Modified() {
+ 676
+ return cveUrl12Modified;
+ 677
+ }
+ 678
+
+ 679
+
+ 680
+
+ 681
+
+ 682
+
+ 683
+
+ 684
+ public void setCveUrl12Modified(String cveUrl12Modified) {
+ 685
+ this .cveUrl12Modified = cveUrl12Modified;
+ 686
+ }
+ 687
+
+ 688
+
689
- private void populateSettings() {
- 690 3 InputStream taskProperties = null ;
+ 690
+
691
- try {
- 692 3 taskProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
- 693 3 Settings.mergeProperties(taskProperties);
- 694 0 } catch (IOException ex) {
- 695 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
- 696 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, null , ex);
+ private String cveUrl20Modified; 692
+
+ 693
+
+ 694
+
+ 695
+
+ 696
+
697
- } finally {
- 698 3 if (taskProperties != null ) {
+ 698
+ public String getCveUrl20Modified() {
699
- try {
- 700 3 taskProperties.close();
- 701 0 } catch (IOException ex) {
- 702 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINEST, null , ex);
- 703 3 }
+ return cveUrl20Modified; 700
+ }
+ 701
+
+ 702
+
+ 703
+
704
- }
+ 705
- }
- 706 3 if (dataDirectory != null ) {
- 707 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ 706
+
+ 707
+ public void setCveUrl20Modified(String cveUrl20Modified) {
708
- } else {
- 709 3 final File jarPath = new File(DependencyCheckTask.class .getProtectionDomain().getCodeSource().getLocation().getPath());
- 710 3 final File base = jarPath.getParentFile();
- 711 3 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
- 712 3 final File dataDir = new File(base, sub);
- 713 3 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ this .cveUrl20Modified = cveUrl20Modified; 709
+ }
+ 710
+
+ 711
+
+ 712
+
+ 713
+
714
- }
+ private String cveUrl12Base; 715
- 716 3 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 716
+
717
-
- 718 3 if (proxyUrl != null && !proxyUrl.isEmpty()) {
- 719 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+ 718
+
+ 719
+
720
- }
- 721 3 if (proxyPort != null && !proxyPort.isEmpty()) {
- 722 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+ 721
+ public String getCveUrl12Base() {
+ 722
+ return cveUrl12Base;
723
- }
- 724 3 if (proxyUsername != null && !proxyUsername.isEmpty()) {
- 725 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+ } 724
+
+ 725
+
726
- }
- 727 3 if (proxyPassword != null && !proxyPassword.isEmpty()) {
- 728 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+ 727
+
+ 728
+
729
- }
- 730 3 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
- 731 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+ 730
+ public void setCveUrl12Base(String cveUrl12Base) {
+ 731
+ this .cveUrl12Base = cveUrl12Base;
732
- }
- 733 3 if (suppressionFile != null && !suppressionFile.isEmpty()) {
- 734 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+ } 733
+
+ 734
+
735
- }
- 736 3 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
- 737 3 if (nexusUrl != null && !nexusUrl.isEmpty()) {
- 738 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 736
+
+ 737
+ private String cveUrl20Base;
+ 738
+
739
- }
- 740 3 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
- 741 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 740
+
+ 741
+
742
- }
- 743 3 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
- 744 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 743
+
+ 744
+ public String getCveUrl20Base() {
745
- }
- 746 3 if (connectionString != null && !connectionString.isEmpty()) {
- 747 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ return cveUrl20Base; 746
+ }
+ 747
+
748
- }
- 749 3 if (databaseUser != null && !databaseUser.isEmpty()) {
- 750 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+ 749
+
+ 750
+
751
- }
- 752 3 if (databasePassword != null && !databasePassword.isEmpty()) {
- 753 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+ 752
+
+ 753
+ public void setCveUrl20Base(String cveUrl20Base) {
754
- }
- 755 3 }
+ this .cveUrl20Base = cveUrl20Base; 755
+ }
756
757
-
+ @Override 758
-
- 759
-
- 760
-
+ public void execute() throws BuildException { 759 4 final InputStream in = DependencyCheckTask.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+ 760 4 LogUtils.prepareLogger(in, logFile);
761
-
- 762
-
- 763
-
- 764
- private void checkForFailure(List<Dependency> dependencies) throws BuildException {
- 765 0 final StringBuilder ids = new StringBuilder();
- 766 0 for (Dependency d : dependencies) {
- 767 0 for (Vulnerability v : d.getVulnerabilities()) {
- 768 0 if (v.getCvssScore() >= failBuildOnCVSS) {
- 769 0 if (ids.length() == 0) {
- 770 0 ids.append(v.getName());
- 771
- } else {
- 772 0 ids.append(", " ).append(v.getName());
- 773
+
+ 762 4 dealWithReferences();
+ 763 4 validateConfiguration();
+ 764 3 populateSettings();
+ 765
+
+ 766 3 Engine engine = null ;
+ 767
+ try {
+ 768 3 engine = new Engine();
+ 769
+
+ 770 3 for (Resource resource : path) {
+ 771 5 final FileProvider provider = resource.as(FileProvider.class );
+ 772 5 if (provider != null ) {
+ 773 5 final File file = provider.getFile();
+ 774 5 if (file != null && file.exists()) {
+ 775 4 engine.scan(file);
+ 776
}
- 774
+ 777
}
- 775 0 }
- 776 0 }
- 777 0 if (ids.length() > 0) {
- 778 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 778 5 }
779
- + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
- 780
- + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
- 781 0 throw new BuildException(msg);
- 782
- }
- 783 0 }
- 784
-
- 785
-
- 786
-
- 787
-
- 788
-
+ try { 780 3 engine.analyzeDependencies();
+ 781 3 DatabaseProperties prop = null ;
+ 782 3 CveDB cve = null ;
+ 783
+ try {
+ 784 3 cve = new CveDB();
+ 785 3 cve.open();
+ 786 3 prop = cve.getDatabaseProperties();
+ 787 0 } catch (DatabaseException ex) {
+ 788 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, "Unable to retrieve DB Properties" , ex);
789
-
- 790
- private void showSummary(List<Dependency> dependencies) {
- 791 3 final StringBuilder summary = new StringBuilder();
- 792 3 for (Dependency d : dependencies) {
- 793 5 boolean firstEntry = true ;
- 794 5 final StringBuilder ids = new StringBuilder();
- 795 5 for (Vulnerability v : d.getVulnerabilities()) {
- 796 20 if (firstEntry) {
- 797 4 firstEntry = false ;
- 798
- } else {
- 799 16 ids.append(", " );
- 800
- }
- 801 20 ids.append(v.getName());
- 802 20 }
- 803 5 if (ids.length() > 0) {
- 804 4 summary.append(d.getFileName()).append(" (" );
- 805 4 firstEntry = true ;
- 806 4 for (Identifier id : d.getIdentifiers()) {
- 807 12 if (firstEntry) {
- 808 4 firstEntry = false ;
- 809
- } else {
- 810 8 summary.append(", " );
- 811
+ } finally {
+ 790 3 if (cve != null ) {
+ 791 3 cve.close();
+ 792
}
- 812 12 summary.append(id.getValue());
- 813 12 }
- 814 4 summary.append(") : " ).append(ids).append(NEW_LINE);
- 815
- }
- 816 5 }
- 817 3 if (summary.length() > 0) {
- 818 3 final String msg = String.format("%n%n"
- 819
- + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
- 820
- + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
- 821 3 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.WARNING, msg);
- 822
- }
- 823 3 }
- 824
+ 793
+ }
+ 794 3 final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
+ 795 3 reporter.generateReports(reportOutputDirectory, reportFormat);
+ 796
- 825
+ 797 3 if (this .failBuildOnCVSS <= 10) {
+ 798 0 checkForFailure(engine.getDependencies());
+ 799
+ }
+ 800 3 if (this .showSummary) {
+ 801 3 showSummary(engine.getDependencies());
+ 802
+ }
+ 803 0 } catch (IOException ex) {
+ 804 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE,
+ 805
+ "Unable to generate dependency-check report" , ex);
+ 806 0 throw new BuildException("Unable to generate dependency-check report" , ex);
+ 807 0 } catch (Exception ex) {
+ 808 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE,
+ 809
+ "An exception occurred; unable to continue task" , ex);
+ 810 0 throw new BuildException("An exception occurred; unable to continue task" , ex);
+ 811 3 }
+ 812 0 } catch (DatabaseException ex) {
+ 813 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.SEVERE,
+ 814
+ "Unable to connect to the dependency-check database; analysis has stopped" );
+ 815 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, "" , ex);
+ 816
+ } finally {
+ 817 3 if (engine != null ) {
+ 818 3 engine.cleanup();
+ 819
+ }
+ 820
+ }
+ 821 3 }
+ 822
+
+ 823
+ 824
+
+ 825
+
826
-
+ 827
- 828 4 public static class ReportFormats extends EnumeratedAttribute {
- 829
-
- 830
-
+ 828
+ private void validateConfiguration() throws BuildException {
+ 829 4 if (path == null ) {
+ 830 1 throw new BuildException("No project dependencies have been defined to analyze." );
831
-
- 832
-
- 833
-
- 834
-
- 835
- @Override
- 836
- public String[] getValues() {
- 837 4 int i = 0;
- 838 4 final Format[] formats = Format.values();
- 839 4 final String[] values = new String[formats.length];
- 840 20 for (Format format : formats) {
- 841 16 values[i++] = format.name();
- 842
- }
- 843 4 return values;
- 844
}
- 845
+ 832 3 if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
+ 833 0 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11." );
+ 834
+ }
+ 835 3 }
+ 836
+
+ 837
+
+ 838
+
+ 839
+
+ 840
+
+ 841
+ private void populateSettings() {
+ 842 3 InputStream taskProperties = null ;
+ 843
+ try {
+ 844 3 taskProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+ 845 3 Settings.mergeProperties(taskProperties);
+ 846 0 } catch (IOException ex) {
+ 847 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
+ 848 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINE, null , ex);
+ 849
+ } finally {
+ 850 3 if (taskProperties != null ) {
+ 851
+ try {
+ 852 3 taskProperties.close();
+ 853 0 } catch (IOException ex) {
+ 854 0 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.FINEST, null , ex);
+ 855 3 }
+ 856
+ }
+ 857
+ }
+ 858 3 if (dataDirectory != null ) {
+ 859 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ 860
+ } else {
+ 861 3 final File jarPath = new File(DependencyCheckTask.class .getProtectionDomain().getCodeSource().getLocation().getPath());
+ 862 3 final File base = jarPath.getParentFile();
+ 863 3 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+ 864 3 final File dataDir = new File(base, sub);
+ 865 3 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ 866
+ }
+ 867
+
+ 868 3 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 869
+
+ 870 3 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+ 871 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+ 872
+ }
+ 873 3 if (proxyPort != null && !proxyPort.isEmpty()) {
+ 874 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+ 875
+ }
+ 876 3 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+ 877 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+ 878
+ }
+ 879 3 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+ 880 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+ 881
+ }
+ 882 3 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+ 883 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+ 884
+ }
+ 885 3 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+ 886 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+ 887
+ }
+ 888 3 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+ 889 3 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+ 890 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 891
+ }
+ 892 3 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+ 893 3 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+ 894 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 895
+ }
+ 896 3 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+ 897 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 898
+ }
+ 899 3 if (connectionString != null && !connectionString.isEmpty()) {
+ 900 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 901
+ }
+ 902 3 if (databaseUser != null && !databaseUser.isEmpty()) {
+ 903 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+ 904
+ }
+ 905 3 if (databasePassword != null && !databasePassword.isEmpty()) {
+ 906 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+ 907
+ }
+ 908 3 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+ 909 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+ 910
+ }
+ 911 3 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+ 912 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+ 913
+ }
+ 914 3 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+ 915 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+ 916
+ }
+ 917 3 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+ 918 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+ 919
+ }
+ 920 3 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+ 921 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+ 922
+ }
+ 923 3 }
+ 924
+
+ 925
+
+ 926
+
+ 927
+
+ 928
+
+ 929
+
+ 930
+
+ 931
+
+ 932
+ private void checkForFailure(List<Dependency> dependencies) throws BuildException {
+ 933 0 final StringBuilder ids = new StringBuilder();
+ 934 0 for (Dependency d : dependencies) {
+ 935 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 936 0 if (v.getCvssScore() >= failBuildOnCVSS) {
+ 937 0 if (ids.length() == 0) {
+ 938 0 ids.append(v.getName());
+ 939
+ } else {
+ 940 0 ids.append(", " ).append(v.getName());
+ 941
+ }
+ 942
+ }
+ 943 0 }
+ 944 0 }
+ 945 0 if (ids.length() > 0) {
+ 946 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 947
+ + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+ 948
+ + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+ 949 0 throw new BuildException(msg);
+ 950
+ }
+ 951 0 }
+ 952
+
+ 953
+
+ 954
+
+ 955
+
+ 956
+
+ 957
+
+ 958
+ private void showSummary(List<Dependency> dependencies) {
+ 959 3 final StringBuilder summary = new StringBuilder();
+ 960 3 for (Dependency d : dependencies) {
+ 961 5 boolean firstEntry = true ;
+ 962 5 final StringBuilder ids = new StringBuilder();
+ 963 5 for (Vulnerability v : d.getVulnerabilities()) {
+ 964 20 if (firstEntry) {
+ 965 4 firstEntry = false ;
+ 966
+ } else {
+ 967 16 ids.append(", " );
+ 968
+ }
+ 969 20 ids.append(v.getName());
+ 970 20 }
+ 971 5 if (ids.length() > 0) {
+ 972 4 summary.append(d.getFileName()).append(" (" );
+ 973 4 firstEntry = true ;
+ 974 4 for (Identifier id : d.getIdentifiers()) {
+ 975 12 if (firstEntry) {
+ 976 4 firstEntry = false ;
+ 977
+ } else {
+ 978 8 summary.append(", " );
+ 979
+ }
+ 980 12 summary.append(id.getValue());
+ 981 12 }
+ 982 4 summary.append(") : " ).append(ids).append(NEW_LINE);
+ 983
+ }
+ 984 5 }
+ 985 3 if (summary.length() > 0) {
+ 986 3 final String msg = String.format("%n%n"
+ 987
+ + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+ 988
+ + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+ 989 3 Logger.getLogger(DependencyCheckTask.class .getName()).log(Level.WARNING, msg);
+ 990
+ }
+ 991 3 }
+ 992
+
+ 993
+
+ 994
+
+ 995
+
+ 996
+ public static class ReportFormats extends EnumeratedAttribute {
+ 997
+
+ 998
+
+ 999
+
+ 1000
+
+ 1001
+
+ 1002
+
+ 1003
+ @Override
+ 1004
+ public String[] getValues() {
+ 1005 4 int i = 0;
+ 1006 4 final Format[] formats = Format.values();
+ 1007 4 final String[] values = new String[formats.length];
+ 1008 20 for (Format format : formats) {
+ 1009 16 values[i++] = format.name();
+ 1010
+ }
+ 1011 4 return values;
+ 1012
+ }
+ 1013
}
- 846
+ 1014
}
-
+
diff --git a/dependency-check-ant/configuration.html b/dependency-check-ant/configuration.html
index a767f351c..a56e55abb 100644
--- a/dependency-check-ant/configuration.html
+++ b/dependency-check-ant/configuration.html
@@ -1,27 +1,27 @@
dependency-check-ant - Configuration
- 
+
+
+ 
-
+
+ 
+
+
+ 
+
+
@@ -270,7 +285,7 @@
