github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-25 10:32:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

patch to remove additional false positives due to SCM entries in the pom

Browse Source 
Former-commit-id: 6101fae1b5957254ddbece5afc2db8edeb7bf9b8
This commit is contained in:
Jeremy Long
2014-05-10 06:59:34 -04:00
parent 1485733715
commit 9bde80357f
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
View File

@@ -138,7 +138,8 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
"include-resource", "include-resource",
"embed-dependency", "embed-dependency",
"ipojo-components", "ipojo-components",
"ipojo-extension"); "ipojo-extension",
"eclipse-sourcereferences");
/** /**
* item in some manifest, should be considered medium confidence. * item in some manifest, should be considered medium confidence.
*/ */
@@ -764,6 +765,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
&& !key.endsWith("class-path") && !key.endsWith("class-path")
&& !key.endsWith("-scm") //todo change this to a regex? && !key.endsWith("-scm") //todo change this to a regex?
&& !key.startsWith("scm-") && !key.startsWith("scm-")
&& !value.trim().startsWith("scm:")
&& !isImportPackage(key, value) && !isImportPackage(key, value)
&& !isPackage(key, value)) { && !isPackage(key, value)) {