Initialization phase.
+
+
org/owasp/dependencycheck/dependency/Dependency.java
+
+Severity
+Category
+Rule
+Message
+Line
+
sizes
MethodCount
diff --git a/dependency-check-core/checkstyle.rss b/dependency-check-core/checkstyle.rss
index 84569fdfd..c8ac109d8 100644
--- a/dependency-check-core/checkstyle.rss
+++ b/dependency-check-core/checkstyle.rss
@@ -25,9 +25,9 @@ under the License.
en-us
©2012 - 2015 OWASP
-
-
File: 165,
- Errors: 24,
- Warnings: 0,
+ <title>File: 189,
+ Errors: 42,
+ Warnings: 288,
Infos: 0
0
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/mojo.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -183,6 +197,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -225,6 +253,20 @@ under the License.
0
+
+
+
+ dependency-check-core/src/main/resources/data/dbStatements_postgreSQL.properties
+
+
+ 0
+
+
+ 23
+
+
+ 0
+
@@ -253,20 +295,6 @@ under the License.
1
-
-
-
- dependency-check-gradle/src/main/resources/META-INF/gradle-plugins/dependency-check.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -281,6 +309,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/task.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -295,6 +337,20 @@ under the License.
0
+
+
+
+ dependency-check-maven/target/maven-archiver/pom.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -379,6 +435,20 @@ under the License.
0
+
+
+
+ dependency-check-maven/target/maven-plugin-help.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -421,6 +491,34 @@ under the License.
0
+
+
+
+ dependency-check-core/src/main/resources/data/dbStatements_mysql.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
+
+
+
+ data/dbStatements_h2.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
@@ -435,6 +533,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/classes/task.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -491,20 +603,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/NonClosingStream.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -575,6 +673,20 @@ under the License.
0
+
+
+
+ org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
+
+
+ 0
+
+
+ 0
+
+
+ 22
+
@@ -589,6 +701,20 @@ under the License.
0
+
+
+
+ dependency-check-core/target/classes/data/dbStatements_h2.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
@@ -626,7 +752,7 @@ under the License.
0
- 0
+ 1
0
@@ -687,6 +813,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/classes/dependency-check-taskdefs.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -757,6 +897,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/maven-archiver/pom.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -785,6 +939,20 @@ under the License.
0
+
+
+
+ data/dbStatements_mysql.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
@@ -827,6 +995,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/dependency-check-taskdefs.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -883,6 +1065,20 @@ under the License.
5
+
+
+
+ dependency-check-cli/target/maven-archiver/pom.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -1079,6 +1275,34 @@ under the License.
0
+
+
+
+ dependency-check-core/target/generated-classes/cobertura/data/dbStatements_postgreSQL.properties
+
+
+ 0
+
+
+ 23
+
+
+ 0
+
+
+
+
+ dependency-check-core/target/generated-classes/cobertura/data/dbStatements_h2.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
@@ -1191,6 +1415,20 @@ under the License.
0
+
+
+
+ dependency-check-core/target/classes/data/dbStatements_postgreSQL.properties
+
+
+ 0
+
+
+ 23
+
+
+ 0
+
@@ -1203,7 +1441,7 @@ under the License.
0
- 2
+ 0
@@ -1228,7 +1466,7 @@ under the License.
0
- 0
+ 1
0
@@ -1373,20 +1611,6 @@ under the License.
0
-
-
-
- dependency-check-gradle/.gradle/2.3/taskArtifacts/cache.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1457,6 +1681,20 @@ under the License.
0
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -1502,7 +1740,7 @@ under the License.
- org/owasp/dependencycheck/data/cwe/CweHandler.java
+ org/owasp/dependencycheck/data/cpe/IndexException.java
0
@@ -1516,7 +1754,7 @@ under the License.
- org/owasp/dependencycheck/data/cpe/IndexException.java
+ org/owasp/dependencycheck/data/cwe/CweHandler.java
0
@@ -1662,7 +1900,7 @@ under the License.
0
- 0
+ 1
0
@@ -1821,6 +2059,20 @@ under the License.
0
+
+
+
+ dependency-check-core/target/generated-classes/cobertura/data/dbStatements_mysql.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
@@ -1847,7 +2099,7 @@ under the License.
0
- 0
+ 1
@@ -1905,6 +2157,20 @@ under the License.
0
+
+
+
+ dependency-check-cli/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -2017,6 +2283,48 @@ under the License.
0
+
+
+
+ dependency-check-core/target/classes/data/dbStatements_mysql.properties
+
+
+ 0
+
+
+ 24
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/test-classes/mojo.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ data/dbStatements_postgreSQL.properties
+
+
+ 0
+
+
+ 23
+
+
+ 0
+
@@ -2155,7 +2463,7 @@ under the License.
0
- 4
+ 0
@@ -2199,6 +2507,20 @@ under the License.
0
+
+
+
+ dependency-check-maven/target/classes/mojo.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -2267,7 +2589,7 @@ under the License.
0
- 0
+ 1
@@ -2291,9 +2613,23 @@ under the License.
0
+
+ 1
+
0
+
+
+
+ dependency-check-core/src/main/resources/data/dbStatements_h2.properties
+
+
+ 0
+
+
+ 24
+
0
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.exception.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.exception.html
index b324ea9c4..ac31abc01 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.exception.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.exception.html
@@ -15,7 +15,7 @@ org.owasp.dependencycheck.analyzer.exception
-AnalysisException (25%) AnalysisException (50%)
ArchiveExtractionException (0%) ArchiveAnalyzer (37%)
-AssemblyAnalyzer (67%) AssemblyAnalyzer (65%)
AutoconfAnalyzer (92%) CMakeAnalyzer (93%)
-CPEAnalyzer (74%) CPEAnalyzer (72%)
CentralAnalyzer (27%) FalsePositiveAnalyzer (48%)
-FileNameAnalyzer (85%) FileNameAnalyzer (83%)
FileTypeAnalyzer (N/A) PythonPackageAnalyzer (92%)
+RubyBundleAuditAnalyzer (13%)
+
RubyGemspecAnalyzer (92%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html
index 4f8990e90..7e7493c5d 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.cpe.html
@@ -15,7 +15,7 @@ org.owasp.dependencycheck.data.cpe
-CpeMemoryIndex (72%) CpeMemoryIndex (79%)
Fields (0%)
-ConnectionFactory (33%) ConnectionFactory (40%)
CorruptDatabaseException (0%)
-CveDB (44%) CveDB (47%)
DatabaseException (0%) DriverLoadException (33%)
-DriverLoader (59%) DriverLoader (60%)
DriverShim (17%) SuppressionParser (65%)
-SuppressionRule (75%) SuppressionRule (73%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html
index e838ce520..1d6f84490 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html
@@ -27,7 +27,7 @@ org.owasp.dependencycheck.utils
DependencyVersionUtil (89%)
-ExtractionUtil (30%) ExtractionUtil (29%)
FileFilterBuilder (96%) Filter (92%)
-NonClosingStream (0%)
-
Pair (42%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.xml.pom.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.xml.pom.html
index 328b5c110..42c8e5cfe 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.xml.pom.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.xml.pom.html
@@ -18,7 +18,7 @@ org.owasp.dependencycheck.xml.pom
License (37%)
-Model (92%) Model (94%)
PomHandler (77%) AlphaNumericTokenizer (60%)
-AnalysisException (25%) AnalysisException (50%)
AnalysisPhase (100%) ArchiveExtractionException (0%)
-AssemblyAnalyzer (67%) AssemblyAnalyzer (65%)
AutoconfAnalyzer (92%) CMakeAnalyzer (93%)
-CPEAnalyzer (74%) CPEAnalyzer (72%)
CPEHandler (0%) Confidence (100%)
-ConnectionFactory (33%) ConnectionFactory (40%)
CorruptDatabaseException (0%) Cpe (0%)
-CpeMemoryIndex (72%) CpeMemoryIndex (79%)
CpeSuppressionAnalyzer (90%) CpeUpdater (0%)
-CveDB (44%) CveDB (47%)
CweDB (52%) DriverLoadException (33%)
-DriverLoader (59%) DriverLoader (60%)
DriverShim (17%)
-Engine (52%) Engine (54%)
EngineVersionCheck (47%) EvidenceCollection (73%)
-ExtractionUtil (30%) ExtractionUtil (29%)
FalsePositiveAnalyzer (48%) FileFilterBuilder (96%)
-FileNameAnalyzer (85%) FileNameAnalyzer (83%)
FileTypeAnalyzer (N/A) MavenArtifact (53%)
-Model (92%) Model (94%)
NexusAnalyzer (20%) NodePackageAnalyzer (86%)
-NonClosingStream (0%)
-
NugetPackage (58%)
@@ -306,6 +303,9 @@ All Packages
ReportGenerator (0%)
+RubyBundleAuditAnalyzer (13%)
+
RubyGemspecAnalyzer (92%)
@@ -327,7 +327,7 @@ All Packages
SuppressionParser (65%)
-SuppressionRule (75%) SuppressionRule (73%)
TokenPairConcatenatingFilter (60%)
Package # Classes Line Coverage Branch Coverage Complexity
- org.owasp.dependencycheck.data.update 6 5.434782608695652; 5.435org.owasp.dependencycheck.data.update 6 5.375; 5.375org.owasp.dependencycheck.data.update.cpe 3 1.5; 1.5org.owasp.dependencycheck.data.update.exception 2 1.0; 1org.owasp.dependencycheck.data.update.nvd 8 2.546666666666667; 2.547EngineVersionCheck 4.285714285714286; 4.286NvdCveUpdater 12.25; 12.25NvdCveUpdater 10.6; 10.6UpdateService 1.0; 1
@@ -98,243 +98,244 @@
40
import java.util.ArrayList;
41
- import java.util.EnumMap;
+ import java.util.Collection; 42
- import java.util.HashSet;
+ import java.util.EnumMap; 43
- import java.util.Iterator;
+ import java.util.HashSet; 44
- import java.util.List;
+ import java.util.Iterator; 45
- import java.util.Map;
+ import java.util.List; 46
- import java.util.Set;
+ import java.util.Map; 47
-
+ import java.util.Set; 48
-
+ 49
-
+ 50
-
+ 51
-
+ 52
-
+ 53
-
+ 54
- public class Engine implements FileFilter {
+ 55
-
+ public class Engine implements FileFilter { 56
-
+ 57
-
+ 58
+
+ 59
- 59 3 private List<Dependency> dependencies = new ArrayList<Dependency>();
- 60
-
+ 60 3 private List<Dependency> dependencies = new ArrayList<Dependency>();
61
-
+ 62
-
- 63 3 private Map<AnalysisPhase, List<Analyzer>> analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
- 64
-
- 65
-
- 66
+ 63
+
+ 64 3 private Map<AnalysisPhase, List<Analyzer>> analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
+ 65
+
+ 66
+
67
+
+ 68
- 68 3 private Set<FileTypeAnalyzer> fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
- 69
-
+ 69 3 private Set<FileTypeAnalyzer> fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
70
-
+ 71
-
+ 72
+
+ 73
- 73 3 private ClassLoader serviceClassLoader = Thread.currentThread().getContextClassLoader();
- 74
-
+ 74 3 private ClassLoader serviceClassLoader = Thread.currentThread().getContextClassLoader();
75
-
+ 76
+
+ 77
- 77 1 private static final Logger LOGGER = LoggerFactory.getLogger(Engine.class );
- 78
-
+ 78 1 private static final Logger LOGGER = LoggerFactory.getLogger(Engine.class );
79
-
+ 80
-
+ 81
-
- 82
-
- 83
-
- 84 3 public Engine() throws DatabaseException {
- 85 3 initializeEngine();
- 86 3 }
- 87
-
- 88
-
- 89
+ 82
+
+ 83
+
+ 84
+
+ 85 3 public Engine() throws DatabaseException {
+ 86 3 initializeEngine();
+ 87 3 }
+ 88
+
+ 89
+
90
-
+ 91
-
+ 92
-
+ 93
-
- 94 0 public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
- 95 0 this .serviceClassLoader = serviceClassLoader;
- 96 0 initializeEngine();
- 97 0 }
- 98
-
- 99
-
- 100
-
- 101
-
- 102
+ 94
+
+ 95 0 public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
+ 96 0 this .serviceClassLoader = serviceClassLoader;
+ 97 0 initializeEngine();
+ 98 0 }
+ 99
+
+ 100
+
+ 101
+
+ 102
+
103
-
+ 104
+
+ 105
protected final void initializeEngine() throws DatabaseException {
- 105 3 ConnectionFactory.initialize();
- 106 3 loadAnalyzers();
- 107 3 }
- 108
-
+ 106 3 ConnectionFactory.initialize();
+ 107 3 loadAnalyzers();
+ 108 3 }
109
-
+ 110
-
+ 111
-
+ 112
+
+ 113
public void cleanup() {
- 113 0 ConnectionFactory.cleanup();
- 114 0 }
- 115
-
+ 114 0 ConnectionFactory.cleanup();
+ 115 0 }
116
-
+ 117
-
+ 118
-
+ 119
+
+ 120
private void loadAnalyzers() {
- 120 3 if (!analyzers.isEmpty()) {
- 121 0 return ;
- 122
- }
- 123 30 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 124 27 analyzers.put(phase, new ArrayList<Analyzer>());
- 125
+ 121 3 if (!analyzers.isEmpty()) {
+ 122 0 return ;
+ 123
}
+ 124 33 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 125 30 analyzers.put(phase, new ArrayList<Analyzer>());
126
+ }
+ 127
- 127 3 final AnalyzerService service = new AnalyzerService(serviceClassLoader);
- 128 3 final Iterator<Analyzer> iterator = service.getAnalyzers();
- 129 69 while (iterator.hasNext()) {
- 130 66 final Analyzer a = iterator.next();
- 131 66 analyzers.get(a.getAnalysisPhase()).add(a);
- 132 66 if (a instanceof FileTypeAnalyzer) {
- 133 42 this .fileTypeAnalyzers.add((FileTypeAnalyzer) a);
- 134
+ 128 3 final AnalyzerService service = new AnalyzerService(serviceClassLoader);
+ 129 3 final Iterator<Analyzer> iterator = service.getAnalyzers();
+ 130 72 while (iterator.hasNext()) {
+ 131 69 final Analyzer a = iterator.next();
+ 132 69 analyzers.get(a.getAnalysisPhase()).add(a);
+ 133 69 if (a instanceof FileTypeAnalyzer) {
+ 134 45 this .fileTypeAnalyzers.add((FileTypeAnalyzer) a);
+ 135
}
- 135 66 }
- 136 3 }
- 137
-
+ 136 69 }
+ 137 3 }
138
-
+ 139
-
+ 140
-
+ 141
-
+ 142
-
+ 143
-
+ 144
+
+ 145
public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
- 145 0 return analyzers.get(phase);
- 146
- }
+ 146 0 return analyzers.get(phase);
147
-
- 148
-
- 149
-
- 150
-
- 151
-
- 152
-
- 153
- public List<Dependency> getDependencies() {
- 154 45 return dependencies;
- 155
}
+ 148
+
+ 149
+
+ 150
+
+ 151
+
+ 152
+
+ 153
+
+ 154
+ public List<Dependency> getDependencies() {
+ 155 45 return dependencies;
156
-
+ } 157
-
- 158
-
- 159
-
- 160
-
- 161
-
- 162
- public void setDependencies(List<Dependency> dependencies) {
- 163 0 this .dependencies = dependencies;
- 164 0 }
- 165
- 166
+ 158
- 167
-
- 168
-
- 169
+ 159
+
+ 160
- 170
-
- 171
-
- 172
-
- 173
+ 161
+
+ 162
+ 163
+ public void setDependencies(List<Dependency> dependencies) {
+ 164 0 this .dependencies = dependencies;
+ 165 0 }
+ 166
+
+ 167
+
+ 168
+
+ 169
+
+ 170
+
+ 171
+
+ 172
+
+ 173
+
174
+
+ 175
public List<Dependency> scan(String[] paths) {
- 175 0 final List<Dependency> deps = new ArrayList<Dependency>();
- 176 0 for (String path : paths) {
- 177 0 final File file = new File(path);
- 178 0 final List<Dependency> d = scan(file);
+ 176 0 final List<Dependency> deps = new ArrayList<Dependency>();
+ 177 0 for (String path : paths) {
+ 178 0 final List<Dependency> d = scan(path);
179 0 if (d != null ) {
180 0 deps.addAll(d);
181
@@ -403,7 +404,7 @@
217
218
-
+ 219
220
@@ -417,7 +418,7 @@
224
225
- public List<Dependency> scan(Set<File> files) {
+ public List<Dependency> scan(Collection<File> files) { 226 0 final List<Dependency> deps = new ArrayList<Dependency>();
227 0 for (File file : files) {
228 0 final List<Dependency> d = scan(file);
@@ -434,107 +435,107 @@
236
237
-
+ 238
-
+ 239
240
-
+ 241
242
-
+ 243
244
- public List<Dependency> scan(List<File> files) {
- 245 0 final List<Dependency> deps = new ArrayList<Dependency>();
- 246 0 for (File file : files) {
- 247 0 final List<Dependency> d = scan(file);
- 248 0 if (d != null ) {
- 249 0 deps.addAll(d);
- 250
- }
- 251 0 }
- 252 0 return deps;
- 253
- }
- 254
-
- 255
-
- 256
-
- 257
-
- 258
-
- 259
-
- 260
-
- 261
-
- 262
-
- 263
public List<Dependency> scan(File file) {
- 264 4 if (file.exists()) {
- 265 4 if (file.isDirectory()) {
- 266 2 return scanDirectory(file);
- 267
+ 245 4 if (file.exists()) {
+ 246 4 if (file.isDirectory()) {
+ 247 2 return scanDirectory(file);
+ 248
} else {
- 268 2 final Dependency d = scanFile(file);
- 269 2 if (d != null ) {
- 270 2 final List<Dependency> deps = new ArrayList<Dependency>();
- 271 2 deps.add(d);
- 272 2 return deps;
- 273
+ 249 2 final Dependency d = scanFile(file);
+ 250 2 if (d != null ) {
+ 251 2 final List<Dependency> deps = new ArrayList<Dependency>();
+ 252 2 deps.add(d);
+ 253 2 return deps;
+ 254
}
- 274
+ 255
}
- 275
+ 256
}
- 276 0 return null ;
- 277
+ 257 0 return null ;
+ 258
}
- 278
+ 259
- 279
+ 260
- 280
+ 261
- 281
+ 262
- 282
+ 263
- 283
+ 264
- 284
+ 265
- 285
+ 266
protected List<Dependency> scanDirectory(File dir) {
- 286 38 final File[] files = dir.listFiles();
- 287 38 final List<Dependency> deps = new ArrayList<Dependency>();
- 288 38 if (files != null ) {
- 289 74 for (File f : files) {
- 290 36 if (f.isDirectory()) {
- 291 36 final List<Dependency> d = scanDirectory(f);
- 292 36 if (d != null ) {
- 293 36 deps.addAll(d);
- 294
+ 267 38 final File[] files = dir.listFiles();
+ 268 38 final List<Dependency> deps = new ArrayList<Dependency>();
+ 269 38 if (files != null ) {
+ 270 74 for (File f : files) {
+ 271 36 if (f.isDirectory()) {
+ 272 36 final List<Dependency> d = scanDirectory(f);
+ 273 36 if (d != null ) {
+ 274 36 deps.addAll(d);
+ 275
}
- 295 36 } else {
- 296 0 final Dependency d = scanFile(f);
- 297 0 deps.add(d);
- 298
+ 276 36 } else {
+ 277 0 final Dependency d = scanFile(f);
+ 278 0 deps.add(d);
+ 279
}
- 299
+ 280
}
+ 281
+ }
+ 282 38 return deps;
+ 283
+ }
+ 284
+
+ 285
+
+ 286
+
+ 287
+
+ 288
+
+ 289
+
+ 290
+
+ 291
+ protected Dependency scanFile(File file) {
+ 292 2 Dependency dependency = null ;
+ 293 2 if (file.isFile()) {
+ 294 2 if (accept(file)) {
+ 295 2 dependency = new Dependency(file);
+ 296 2 dependencies.add(dependency);
+ 297
+ }
+ 298
+ } else {
+ 299 0 LOGGER.debug("Path passed to scanFile(File) is not a file: {}. Skipping the file." , file);
300
}
- 301 38 return deps;
+ 301 2 return dependency;
302
}
303
@@ -542,336 +543,305 @@
304
305
-
+ 306
-
+ 307
-
+ 308
-
+ 309
310
- protected Dependency scanFile(File file) {
- 311 2 Dependency dependency = null ;
- 312 2 if (file.isFile()) {
- 313 2 if (accept(file)) {
- 314 2 dependency = new Dependency(file);
- 315 2 dependencies.add(dependency);
- 316
- }
- 317
- } else {
- 318 0 LOGGER.debug("Path passed to scanFile(File) is not a file: {}. Skipping the file." , file);
+ public void analyzeDependencies() { 311 1 boolean autoUpdate = true ;
+ 312
+ try {
+ 313 1 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+ 314 0 } catch (InvalidSettingException ex) {
+ 315 0 LOGGER.debug("Invalid setting for auto-update; using true." );
+ 316 1 }
+ 317 1 if (autoUpdate) {
+ 318 0 doUpdates();
319
}
- 320 2 return dependency;
+ 320
+
321
- }
- 322
-
- 323
-
- 324
-
- 325
-
- 326
-
- 327
-
- 328
-
- 329
- public void analyzeDependencies() {
- 330 1 boolean autoUpdate = true ;
- 331
- try {
- 332 1 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
- 333 0 } catch (InvalidSettingException ex) {
- 334 0 LOGGER.debug("Invalid setting for auto-update; using true." );
- 335 1 }
- 336 1 if (autoUpdate) {
- 337 0 doUpdates();
- 338
- }
- 339
-
- 340
- 341
+ 322
try {
- 342 1 ensureDataExists();
- 343 0 } catch (NoDataException ex) {
- 344 0 LOGGER.error("{}\n\nUnable to continue dependency-check analysis." , ex.getMessage());
- 345 0 LOGGER.debug("" , ex);
- 346 0 return ;
- 347 0 } catch (DatabaseException ex) {
- 348 0 LOGGER.error("{}\n\nUnable to continue dependency-check analysis." , ex.getMessage());
- 349 0 LOGGER.debug("" , ex);
- 350 0 return ;
- 351
+ 323 1 ensureDataExists();
+ 324 0 } catch (NoDataException ex) {
+ 325 0 LOGGER.error("{}\n\nUnable to continue dependency-check analysis." , ex.getMessage());
+ 326 0 LOGGER.debug("" , ex);
+ 327 0 return ;
+ 328 0 } catch (DatabaseException ex) {
+ 329 0 LOGGER.error("{}\n\nUnable to continue dependency-check analysis." , ex.getMessage());
+ 330 0 LOGGER.debug("" , ex);
+ 331 0 return ;
+ 332
- 352 1 }
- 353
+ 333 1 }
+ 334
- 354 1 LOGGER.debug("\n----------------------------------------------------\nBEGIN ANALYSIS\n----------------------------------------------------" );
- 355 1 LOGGER.info("Analysis Starting" );
- 356 1 final long analysisStart = System.currentTimeMillis();
- 357
+ 335 1 LOGGER.debug("\n----------------------------------------------------\nBEGIN ANALYSIS\n----------------------------------------------------" );
+ 336 1 LOGGER.info("Analysis Starting" );
+ 337 1 final long analysisStart = System.currentTimeMillis();
+ 338
- 358
+ 339
- 359 10 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 360 9 final List<Analyzer> analyzerList = analyzers.get(phase);
- 361
+ 340 11 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 341 10 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 342
- 362 9 for (Analyzer a : analyzerList) {
- 363 22 a = initializeAnalyzer(a);
- 364
+ 343 10 for (Analyzer a : analyzerList) {
+ 344 23 a = initializeAnalyzer(a);
+ 345
- 365
+ 346
- 366
+ 347
- 367
+ 348
- 368
+ 349
- 369 22 LOGGER.debug("Begin Analyzer '{}'" , a.getName());
- 370 22 final Set<Dependency> dependencySet = new HashSet<Dependency>(dependencies);
- 371 22 for (Dependency d : dependencySet) {
- 372 44 boolean shouldAnalyze = true ;
- 373 44 if (a instanceof FileTypeAnalyzer) {
- 374 28 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
- 375 28 shouldAnalyze = fAnalyzer.accept(d.getActualFile());
- 376
+ 350 23 LOGGER.debug("Begin Analyzer '{}'" , a.getName());
+ 351 23 final Set<Dependency> dependencySet = new HashSet<Dependency>(dependencies);
+ 352 23 for (Dependency d : dependencySet) {
+ 353 46 boolean shouldAnalyze = true ;
+ 354 46 if (a instanceof FileTypeAnalyzer) {
+ 355 30 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
+ 356 30 shouldAnalyze = fAnalyzer.accept(d.getActualFile());
+ 357
}
- 377 44 if (shouldAnalyze) {
- 378 20 LOGGER.debug("Begin Analysis of '{}'" , d.getActualFilePath());
- 379
+ 358 46 if (shouldAnalyze) {
+ 359 20 LOGGER.debug("Begin Analysis of '{}'" , d.getActualFilePath());
+ 360
try {
- 380 20 a.analyze(d, this );
- 381 0 } catch (AnalysisException ex) {
- 382 0 LOGGER.warn("An error occurred while analyzing '{}'." , d.getActualFilePath());
- 383 0 LOGGER.debug("" , ex);
- 384 0 } catch (Throwable ex) {
- 385
+ 361 20 a.analyze(d, this );
+ 362 0 } catch (AnalysisException ex) {
+ 363 0 LOGGER.warn("An error occurred while analyzing '{}'." , d.getActualFilePath());
+ 364 0 LOGGER.debug("" , ex);
+ 365 0 } catch (Throwable ex) {
+ 366
- 386 0 LOGGER.warn("An unexpected error occurred during analysis of '{}'" , d.getActualFilePath());
- 387 0 LOGGER.debug("" , ex);
- 388 20 }
- 389
+ 367 0 LOGGER.warn("An unexpected error occurred during analysis of '{}'" , d.getActualFilePath());
+ 368 0 LOGGER.debug("" , ex);
+ 369 20 }
+ 370
}
- 390 44 }
- 391 22 }
- 392
+ 371 46 }
+ 372 23 }
+ 373
}
- 393 10 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 394 9 final List<Analyzer> analyzerList = analyzers.get(phase);
- 395
+ 374 11 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 375 10 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 376
- 396 9 for (Analyzer a : analyzerList) {
- 397 22 closeAnalyzer(a);
- 398 22 }
- 399
+ 377 10 for (Analyzer a : analyzerList) {
+ 378 23 closeAnalyzer(a);
+ 379 23 }
+ 380
}
- 400
+ 381
- 401 1 LOGGER.debug("\n----------------------------------------------------\nEND ANALYSIS\n----------------------------------------------------" );
- 402 1 LOGGER.info("Analysis Complete ({} ms)" , System.currentTimeMillis() - analysisStart);
- 403 1 }
- 404
+ 382 1 LOGGER.debug("\n----------------------------------------------------\nEND ANALYSIS\n----------------------------------------------------" );
+ 383 1 LOGGER.info("Analysis Complete ({} ms)" , System.currentTimeMillis() - analysisStart);
+ 384 1 }
+ 385
- 405
+ 386
- 406
+ 387
- 407
+ 388
- 408
+ 389
- 409
+ 390
- 410
+ 391
- 411
+ 392
protected Analyzer initializeAnalyzer(Analyzer analyzer) {
- 412
+ 393
try {
- 413 22 LOGGER.debug("Initializing {}" , analyzer.getName());
- 414 22 analyzer.initialize();
- 415 0 } catch (Throwable ex) {
- 416 0 LOGGER.error("Exception occurred initializing {}." , analyzer.getName());
- 417 0 LOGGER.debug("" , ex);
- 418
+ 394 23 LOGGER.debug("Initializing {}" , analyzer.getName());
+ 395 23 analyzer.initialize();
+ 396 0 } catch (Throwable ex) {
+ 397 0 LOGGER.error("Exception occurred initializing {}." , analyzer.getName());
+ 398 0 LOGGER.debug("" , ex);
+ 399
try {
- 419 0 analyzer.close();
- 420 0 } catch (Throwable ex1) {
- 421 0 LOGGER.trace("" , ex1);
- 422 0 }
- 423 22 }
- 424 22 return analyzer;
- 425
+ 400 0 analyzer.close();
+ 401 0 } catch (Throwable ex1) {
+ 402 0 LOGGER.trace("" , ex1);
+ 403 0 }
+ 404 23 }
+ 405 23 return analyzer;
+ 406
}
- 426
+ 407
- 427
+ 408
- 428
+ 409
- 429
+ 410
- 430
+ 411
- 431
+ 412
- 432
+ 413
protected void closeAnalyzer(Analyzer analyzer) {
- 433 22 LOGGER.debug("Closing Analyzer '{}'" , analyzer.getName());
- 434
+ 414 23 LOGGER.debug("Closing Analyzer '{}'" , analyzer.getName());
+ 415
try {
- 435 22 analyzer.close();
- 436 0 } catch (Throwable ex) {
- 437 0 LOGGER.trace("" , ex);
- 438 22 }
- 439 22 }
- 440
+ 416 23 analyzer.close();
+ 417 0 } catch (Throwable ex) {
+ 418 0 LOGGER.trace("" , ex);
+ 419 23 }
+ 420 23 }
+ 421
- 441
+ 422
- 442
+ 423
- 443
+ 424
- 444
+ 425
public void doUpdates() {
- 445 0 LOGGER.info("Checking for updates" );
- 446 0 final long updateStart = System.currentTimeMillis();
- 447 0 final UpdateService service = new UpdateService(serviceClassLoader);
- 448 0 final Iterator<CachedWebDataSource> iterator = service.getDataSources();
- 449 0 while (iterator.hasNext()) {
- 450 0 final CachedWebDataSource source = iterator.next();
- 451
+ 426 0 LOGGER.info("Checking for updates" );
+ 427 0 final long updateStart = System.currentTimeMillis();
+ 428 0 final UpdateService service = new UpdateService(serviceClassLoader);
+ 429 0 final Iterator<CachedWebDataSource> iterator = service.getDataSources();
+ 430 0 while (iterator.hasNext()) {
+ 431 0 final CachedWebDataSource source = iterator.next();
+ 432
try {
- 452 0 source.update();
- 453 0 } catch (UpdateException ex) {
- 454 0 LOGGER.warn(
- 455
+ 433 0 source.update();
+ 434 0 } catch (UpdateException ex) {
+ 435 0 LOGGER.warn(
+ 436
"Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities." );
- 456 0 LOGGER.debug("Unable to update details for {}" , source.getClass().getName(), ex);
- 457 0 }
- 458 0 }
- 459 0 LOGGER.info("Check for updates complete ({} ms)" , System.currentTimeMillis() - updateStart);
- 460 0 }
- 461
+ 437 0 LOGGER.debug("Unable to update details for {}" , source.getClass().getName(), ex);
+ 438 0 }
+ 439 0 }
+ 440 0 LOGGER.info("Check for updates complete ({} ms)" , System.currentTimeMillis() - updateStart);
+ 441 0 }
+ 442
- 462
+ 443
- 463
+ 444
- 464
+ 445
- 465
+ 446
- 466
+ 447
- 467
+ 448
public List<Analyzer> getAnalyzers() {
- 468 0 final List<Analyzer> ret = new ArrayList<Analyzer>();
- 469 0 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 470 0 final List<Analyzer> analyzerList = analyzers.get(phase);
- 471 0 ret.addAll(analyzerList);
- 472
+ 449 0 final List<Analyzer> ret = new ArrayList<Analyzer>();
+ 450 0 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 451 0 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 452 0 ret.addAll(analyzerList);
+ 453
}
- 473 0 return ret;
- 474
+ 454 0 return ret;
+ 455
}
- 475
+ 456
- 476
+ 457
- 477
+ 458
- 478
+ 459
- 479
+ 460
- 480
+ 461
+ 462
+
+ 463
+ @Override
+ 464
+ public boolean accept(File file) {
+ 465 851 if (file == null ) {
+ 466 0 return false ;
+ 467
+ }
+ 468 851 boolean scan = false ;
+ 469 851 for (FileTypeAnalyzer a : this .fileTypeAnalyzers) {
+ 470
+
+ 471
+
+ 472 12765 scan |= a.accept(file);
+ 473 12765 }
+ 474 851 return scan;
+ 475
+ }
+ 476
+
+ 477
+
+ 478
+
+ 479
+
+ 480
+
481
482
- @Override
- 483
- public boolean accept(File file) {
- 484 851 if (file == null ) {
- 485 0 return false ;
- 486
- }
- 487 851 boolean scan = false ;
- 488 851 for (FileTypeAnalyzer a : this .fileTypeAnalyzers) {
- 489
-
- 490
-
- 491 11914 scan |= a.accept(file);
- 492 11914 }
- 493 851 return scan;
- 494
- }
- 495
-
- 496
-
- 497
-
- 498
-
- 499
-
- 500
-
- 501
public Set<FileTypeAnalyzer> getFileTypeAnalyzers() {
- 502 0 return this .fileTypeAnalyzers;
- 503
+ 483 0 return this .fileTypeAnalyzers;
+ 484
}
- 504
+ 485
- 505
+ 486
- 506
+ 487
- 507
+ 488
- 508
+ 489
- 509
+ 490
- 510
+ 491
- 511
+ 492
private void ensureDataExists() throws NoDataException, DatabaseException {
- 512 1 final CveDB cve = new CveDB();
- 513
+ 493 1 final CveDB cve = new CveDB();
+ 494
try {
- 514 1 cve.open();
- 515 1 if (!cve.dataExists()) {
- 516 0 throw new NoDataException("No documents exist" );
- 517
+ 495 1 cve.open();
+ 496 1 if (!cve.dataExists()) {
+ 497 0 throw new NoDataException("No documents exist" );
+ 498
}
- 518 0 } catch (DatabaseException ex) {
- 519 0 throw new NoDataException(ex.getMessage(), ex);
- 520
+ 499 0 } catch (DatabaseException ex) {
+ 500 0 throw new NoDataException(ex.getMessage(), ex);
+ 501
} finally {
- 521 1 cve.close();
- 522 1 }
- 523 1 }
- 524
+ 502 1 cve.close();
+ 503 1 }
+ 504 1 }
+ 505
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
index 03b57515b..8a15ce6fa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
@@ -12,7 +12,7 @@
@@ -1587,328 +1587,268 @@
841
private Engine executeDependencyCheck() throws DatabaseException {
842 0 populateSettings();
- 843 0 Engine engine = null ;
- 844 0 engine = new Engine();
- 845 0 engine.setDependencies(this .dependencies);
- 846 0 engine.analyzeDependencies();
- 847 0 return engine;
- 848
+ 843 0 final Engine engine = new Engine();
+ 844 0 engine.setDependencies(this .dependencies);
+ 845 0 engine.analyzeDependencies();
+ 846 0 return engine;
+ 847
}
+ 848
+
849
-
+ 850
-
- 851
- 852
+ 851
- 853
+ 852
- 854
+ 853
+ 854
+
855
-
- 856
private void generateExternalReports(Engine engine, File outDirectory) {
- 857 0 DatabaseProperties prop = null ;
- 858 0 CveDB cve = null ;
- 859
+ 856 0 DatabaseProperties prop = null ;
+ 857 0 CveDB cve = null ;
+ 858
try {
- 860 0 cve = new CveDB();
- 861 0 cve.open();
- 862 0 prop = cve.getDatabaseProperties();
- 863 0 } catch (DatabaseException ex) {
- 864 0 LOGGER.debug("Unable to retrieve DB Properties" , ex);
- 865
+ 859 0 cve = new CveDB();
+ 860 0 cve.open();
+ 861 0 prop = cve.getDatabaseProperties();
+ 862 0 } catch (DatabaseException ex) {
+ 863 0 LOGGER.debug("Unable to retrieve DB Properties" , ex);
+ 864
} finally {
- 866 0 if (cve != null ) {
- 867 0 cve.close();
- 868
+ 865 0 if (cve != null ) {
+ 866 0 cve.close();
+ 867
}
- 869
+ 868
}
- 870 0 final ReportGenerator r = new ReportGenerator(this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
- 871
+ 869 0 final ReportGenerator r = new ReportGenerator(this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
+ 870
try {
- 872 0 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
- 873 0 } catch (IOException ex) {
- 874 0 LOGGER.error(
- 875
+ 871 0 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
+ 872 0 } catch (IOException ex) {
+ 873 0 LOGGER.error(
+ 874
"Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 876 0 LOGGER.debug("" , ex);
- 877 0 } catch (Throwable ex) {
- 878 0 LOGGER.error(
- 879
+ 875 0 LOGGER.debug("" , ex);
+ 876 0 } catch (Throwable ex) {
+ 877 0 LOGGER.error(
+ 878
"Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 880 0 LOGGER.debug("" , ex);
- 881 0 }
- 882 0 }
+ 879 0 LOGGER.debug("" , ex);
+ 880 0 }
+ 881 0 }
+ 882
+
883
-
- 884
- 885
+ 884
- 886
+ 885
- 887
+ 886
- 888
+ 887
private void populateSettings() {
- 889 0 Settings.initialize();
- 890 0 if (dataDirectory != null ) {
- 891 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
- 892
+ 888 0 Settings.initialize();
+ 889 0 if (dataDirectory != null ) {
+ 890 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ 891
} else {
- 893 0 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
- 894 0 final File base = jarPath.getParentFile();
- 895 0 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
- 896 0 final File dataDir = new File(base, sub);
- 897 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ 892 0 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
+ 893 0 final File base = jarPath.getParentFile();
+ 894 0 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+ 895 0 final File dataDir = new File(base, sub);
+ 896 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ 897
+ }
898
- }
- 899
- 900 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
- 901
-
- 902 0 if (proxyServer != null && !proxyServer.isEmpty()) {
- 903 0 Settings.setString(Settings.KEYS.PROXY_SERVER, proxyServer);
- 904
- }
- 905 0 if (proxyPort != null && !proxyPort.isEmpty()) {
- 906 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
- 907
- }
- 908 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
- 909 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
- 910
- }
- 911 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
- 912 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
- 913
- }
- 914 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
- 915 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
- 916
- }
- 917 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
- 918 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
- 919
- }
- 920 0 Settings.setBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, centralAnalyzerEnabled);
- 921 0 if (centralUrl != null && !centralUrl.isEmpty()) {
- 922 0 Settings.setString(Settings.KEYS.ANALYZER_CENTRAL_URL, centralUrl);
+ 899 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 900 0 Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_SERVER, proxyServer);
+ 901 0 Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PORT, proxyPort);
+ 902 0 Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+ 903 0 Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
+ 904 0 Settings.setStringIfNotEmpty(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+ 905 0 Settings.setStringIfNotEmpty(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+ 906 0 Settings.setBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, centralAnalyzerEnabled);
+ 907 0 Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_CENTRAL_URL, centralUrl);
+ 908 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+ 909 0 Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 910 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY, nexusUsesProxy);
+ 911 0 Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 912 0 Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 913 0 Settings.setStringIfNotEmpty(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 914 0 Settings.setStringIfNotEmpty(Settings.KEYS.DB_USER, databaseUser);
+ 915 0 Settings.setStringIfNotEmpty(Settings.KEYS.DB_PASSWORD, databasePassword);
+ 916 0 Settings.setStringIfNotEmpty(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+ 917 0 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+ 918 0 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+ 919 0 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+ 920 0 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+ 921 0 Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+ 922 0 }
923
- }
- 924 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
- 925 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
- 926 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 924
+
+ 925
+
+ 926
+
927
- }
- 928 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
- 929 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
- 930 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
- 931
- }
- 932 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
- 933 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
- 934
- }
- 935 0 if (connectionString != null && !connectionString.isEmpty()) {
- 936 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
- 937
- }
- 938 0 if (databaseUser != null && !databaseUser.isEmpty()) {
- 939 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
- 940
- }
- 941 0 if (databasePassword != null && !databasePassword.isEmpty()) {
- 942 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
- 943
- }
- 944 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
- 945 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
- 946
- }
- 947 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
- 948 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
- 949
- }
- 950 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
- 951 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+ 928
+
+ 929
+
+ 930
+ public Engine execute() throws ScanAgentException {
+ 931 0 Engine engine = null ;
+ 932
+ try {
+ 933 0 engine = executeDependencyCheck();
+ 934 0 if (this .generateReport) {
+ 935 0 generateExternalReports(engine, new File(this .reportOutputDirectory));
+ 936
+ }
+ 937 0 if (this .showSummary) {
+ 938 0 showSummary(engine.getDependencies());
+ 939
+ }
+ 940 0 if (this .failBuildOnCVSS <= 10) {
+ 941 0 checkForFailure(engine.getDependencies());
+ 942
+ }
+ 943 0 } catch (DatabaseException ex) {
+ 944 0 LOGGER.error(
+ 945
+ "Unable to connect to the dependency-check database; analysis has stopped" );
+ 946 0 LOGGER.debug("" , ex);
+ 947
+ } finally {
+ 948 0 Settings.cleanup(true );
+ 949 0 if (engine != null ) {
+ 950 0 engine.cleanup();
+ 951
+ }
952
}
- 953 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
- 954 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
- 955
- }
- 956 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
- 957 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
- 958
- }
- 959 0 if (pathToMono != null && !pathToMono.isEmpty()) {
- 960 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
- 961
- }
- 962 0 }
- 963
-
- 964
-
- 965
-
- 966
-
- 967
-
- 968
-
- 969
-
- 970
- public Engine execute() throws ScanAgentException {
- 971 0 Engine engine = null ;
- 972
- try {
- 973 0 engine = executeDependencyCheck();
- 974 0 if (this .generateReport) {
- 975 0 generateExternalReports(engine, new File(this .reportOutputDirectory));
- 976
- }
- 977 0 if (this .showSummary) {
- 978 0 showSummary(engine.getDependencies());
- 979
- }
- 980 0 if (this .failBuildOnCVSS <= 10) {
- 981 0 checkForFailure(engine.getDependencies());
- 982
- }
- 983 0 } catch (DatabaseException ex) {
- 984 0 LOGGER.error(
- 985
- "Unable to connect to the dependency-check database; analysis has stopped" );
- 986 0 LOGGER.debug("" , ex);
- 987
- } finally {
- 988 0 Settings.cleanup(true );
- 989 0 if (engine != null ) {
- 990 0 engine.cleanup();
- 991
- }
- 992
- }
- 993 0 return engine;
- 994
+ 953 0 return engine;
+ 954
}
- 995
+ 955
- 996
+ 956
- 997
+ 957
- 998
+ 958
- 999
+ 959
- 1000
+ 960
- 1001
+ 961
- 1002
+ 962
- 1003
+ 963
private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
- 1004 0 final StringBuilder ids = new StringBuilder();
- 1005 0 for (Dependency d : dependencies) {
- 1006 0 boolean addName = true ;
- 1007 0 for (Vulnerability v : d.getVulnerabilities()) {
- 1008 0 if (v.getCvssScore() >= failBuildOnCVSS) {
- 1009 0 if (addName) {
- 1010 0 addName = false ;
- 1011 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
- 1012 0 ids.append(v.getName());
- 1013
+ 964 0 final StringBuilder ids = new StringBuilder();
+ 965 0 for (Dependency d : dependencies) {
+ 966 0 boolean addName = true ;
+ 967 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 968 0 if (v.getCvssScore() >= failBuildOnCVSS) {
+ 969 0 if (addName) {
+ 970 0 addName = false ;
+ 971 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+ 972 0 ids.append(v.getName());
+ 973
} else {
- 1014 0 ids.append(", " ).append(v.getName());
- 1015
+ 974 0 ids.append(", " ).append(v.getName());
+ 975
}
- 1016
+ 976
}
- 1017 0 }
- 1018 0 }
- 1019 0 if (ids.length() > 0) {
- 1020 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
- 1021
+ 977 0 }
+ 978 0 }
+ 979 0 if (ids.length() > 0) {
+ 980 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 981
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
- 1022
+ 982
+ "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
- 1023
+ 983
- 1024 0 throw new ScanAgentException(msg);
- 1025
+ 984 0 throw new ScanAgentException(msg);
+ 985
}
- 1026 0 }
- 1027
+ 986 0 }
+ 987
- 1028
+ 988
- 1029
+ 989
- 1030
+ 990
- 1031
+ 991
- 1032
+ 992
- 1033
+ 993
private void showSummary(List<Dependency> dependencies) {
- 1034 0 final StringBuilder summary = new StringBuilder();
- 1035 0 for (Dependency d : dependencies) {
- 1036 0 boolean firstEntry = true ;
- 1037 0 final StringBuilder ids = new StringBuilder();
- 1038 0 for (Vulnerability v : d.getVulnerabilities()) {
- 1039 0 if (firstEntry) {
- 1040 0 firstEntry = false ;
- 1041
+ 994 0 final StringBuilder summary = new StringBuilder();
+ 995 0 for (Dependency d : dependencies) {
+ 996 0 boolean firstEntry = true ;
+ 997 0 final StringBuilder ids = new StringBuilder();
+ 998 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 999 0 if (firstEntry) {
+ 1000 0 firstEntry = false ;
+ 1001
} else {
- 1042 0 ids.append(", " );
- 1043
+ 1002 0 ids.append(", " );
+ 1003
}
- 1044 0 ids.append(v.getName());
- 1045 0 }
- 1046 0 if (ids.length() > 0) {
- 1047 0 summary.append(d.getFileName()).append(" (" );
- 1048 0 firstEntry = true ;
- 1049 0 for (Identifier id : d.getIdentifiers()) {
- 1050 0 if (firstEntry) {
- 1051 0 firstEntry = false ;
- 1052
+ 1004 0 ids.append(v.getName());
+ 1005 0 }
+ 1006 0 if (ids.length() > 0) {
+ 1007 0 summary.append(d.getFileName()).append(" (" );
+ 1008 0 firstEntry = true ;
+ 1009 0 for (Identifier id : d.getIdentifiers()) {
+ 1010 0 if (firstEntry) {
+ 1011 0 firstEntry = false ;
+ 1012
} else {
- 1053 0 summary.append(", " );
- 1054
+ 1013 0 summary.append(", " );
+ 1014
}
- 1055 0 summary.append(id.getValue());
- 1056 0 }
- 1057 0 summary.append(") : " ).append(ids).append(NEW_LINE);
- 1058
+ 1015 0 summary.append(id.getValue());
+ 1016 0 }
+ 1017 0 summary.append(") : " ).append(ids).append(NEW_LINE);
+ 1018
}
- 1059 0 }
- 1060 0 if (summary.length() > 0) {
- 1061 0 LOGGER.warn("\n\nOne or more dependencies were identified with known vulnerabilities:\n\n{}\n\n"
- 1062
+ 1019 0 }
+ 1020 0 if (summary.length() > 0) {
+ 1021 0 LOGGER.warn("\n\nOne or more dependencies were identified with known vulnerabilities:\n\n{}\n\n"
+ 1022
+ "See the dependency-check report for more details.\n\n" ,
- 1063
+ 1023
summary.toString());
- 1064
+ 1024
}
- 1065 0 }
- 1066
+ 1025 0 }
+ 1026
- 1067
+ 1027
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
index 88571e922..1b1ac22ef 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
@@ -63,7 +63,7 @@
23
- 24 145 public abstract class AbstractAnalyzer implements Analyzer {
+ 24 152 public abstract class AbstractAnalyzer implements Analyzer {
25
26
@@ -101,11 +101,11 @@
public void close() throws Exception {
43
- 44 50 }
+ 44 54 }
45
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
index ad27bd7bd..cdbbdb62c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
@@ -105,9 +105,9 @@
44
- 45 102 public AbstractFileTypeAnalyzer() {
- 46 102 reset();
- 47 102 }
+ 45 109 public AbstractFileTypeAnalyzer() {
+ 46 109 reset();
+ 47 109 }
48
49
@@ -127,7 +127,7 @@
57
- 58 102 private boolean filesMatched = false ;
+ 58 109 private boolean filesMatched = false ;
59
60
@@ -159,8 +159,8 @@
74
protected void setFilesMatched(boolean filesMatched) {
- 75 35 this .filesMatched = filesMatched;
- 76 35 }
+ 75 38 this .filesMatched = filesMatched;
+ 76 38 }
77
78
@@ -169,7 +169,7 @@
80
- 81 102 private boolean enabled = true ;
+ 81 109 private boolean enabled = true ;
82
83
@@ -303,14 +303,14 @@
@Override
149
public final void initialize() throws Exception {
- 150 58 if (filesMatched) {
- 151 42 initializeFileTypeAnalyzer();
+ 150 62 if (filesMatched) {
+ 151 45 initializeFileTypeAnalyzer();
152
} else {
- 153 16 enabled = false ;
+ 153 17 enabled = false ;
154
}
- 155 58 }
+ 155 59 }
156
157
@@ -323,16 +323,16 @@
@Override
161
public final void reset() {
- 162 102 final String key = getAnalyzerEnabledSettingKey();
+ 162 109 final String key = getAnalyzerEnabledSettingKey();
163
try {
- 164 102 enabled = Settings.getBoolean(key, true );
+ 164 109 enabled = Settings.getBoolean(key, true );
165 0 } catch (InvalidSettingException ex) {
166 0 LOGGER.warn("Invalid setting for property '{}'" , key);
167 0 LOGGER.debug("" , ex);
168 0 LOGGER.warn("{} has been disabled" , getName());
- 169 102 }
- 170 102 }
+ 169 109 }
+ 170 109 }
171
172
@@ -366,19 +366,19 @@
@Override
188
public boolean accept(File pathname) {
- 189 11967 final FileFilter filter = getFileFilter();
- 190 11967 boolean accepted = false ;
- 191 11967 if (null == filter) {
+ 189 12820 final FileFilter filter = getFileFilter();
+ 190 12820 boolean accepted = false ;
+ 191 12820 if (null == filter) {
192 0 LOGGER.error("The '{}' analyzer is misconfigured and does not have a file filter; it will be disabled" , getName());
- 193 11967 } else if (enabled) {
- 194 10241 accepted = filter.accept(pathname);
- 195 10241 if (accepted) {
+ 193 12820 } else if (enabled) {
+ 194 11092 accepted = filter.accept(pathname);
+ 195 11092 if (accepted) {
196 32 filesMatched = true ;
197
}
198
}
- 199 11967 return accepted;
+ 199 12820 return accepted;
200
}
201
@@ -413,7 +413,7 @@
216
protected static Set<String> newHashSet(String... strings) {
- 217 5 final Set<String> set = new HashSet<String>();
+ 217 5 final Set<String> set = new HashSet<String>(strings.length);
218 5 Collections.addAll(set, strings);
219 5 return set;
220
@@ -426,6 +426,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
index 3e124ed90..6e2f0d5ae 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
@@ -313,6 +313,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
index c815dd9ee..f23f1c0c1 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
@@ -12,7 +12,7 @@
@@ -65,7 +65,7 @@
24
-
25 16 public enum AnalysisPhase {
+
25 17 public enum AnalysisPhase {
26
27
@@ -78,63 +78,70 @@
31
32
-
+
33
-
34 1 INFORMATION_COLLECTION,
+
34 1 PRE_INFORMATION_COLLECTION,
35
36
-
+
37
-
38 1 PRE_IDENTIFIER_ANALYSIS,
+
38 1 INFORMATION_COLLECTION,
39
40
-
+
41
-
42 1 IDENTIFIER_ANALYSIS,
+
42 1 PRE_IDENTIFIER_ANALYSIS,
43
44
-
+
45
-
46 1 POST_IDENTIFIER_ANALYSIS,
+
46 1 IDENTIFIER_ANALYSIS,
47
48
-
+
49
-
50 1 PRE_FINDING_ANALYSIS,
+
50 1 POST_IDENTIFIER_ANALYSIS,
51
52
-
+
53
-
54 1 FINDING_ANALYSIS,
+
54 1 PRE_FINDING_ANALYSIS,
55
56
-
+
57
-
58 1 POST_FINDING_ANALYSIS,
+
58 1 FINDING_ANALYSIS,
59
60
-
+
61
-
62 1 FINAL
+
62 1 POST_FINDING_ANALYSIS,
63
+
+
64
+
+
65
+
+
66 1 FINAL
+
67
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
index 705c1980f..ce81497f7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
@@ -161,6 +161,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html
index 0693d1497..c6a9450ee 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html
@@ -121,6 +121,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
index 956a232c2..e6728675a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
@@ -12,7 +12,7 @@
@@ -237,8 +237,8 @@
static { 115 1 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
116 1 if (additionalZipExt != null ) {
-
117 0 final Set<String> ext = new HashSet<String>(Collections.singletonList(additionalZipExt));
-
118 0 ZIPPABLES.addAll(ext);
+
117 0 final String[] ext = additionalZipExt.split("\\s*,\\s*" );
+
118 0 Collections.addAll(ZIPPABLES, ext);
119
}
120 1 EXTENSIONS.addAll(ZIPPABLES);
@@ -378,476 +378,477 @@
195 1 if (tempFileLocation != null && tempFileLocation.exists()) {
196 1 LOGGER.debug("Attempting to delete temporary files" );
197 1 final boolean success = FileUtils.delete(tempFileLocation);
-
198 1 if (!success && tempFileLocation.exists() && tempFileLocation.list().length > 0) {
-
199 0 LOGGER.warn("Failed to delete some temporary files, see the log for more details" );
-
200
- }
-
201
- }
-
202 1 }
+
198 1 if (!success && tempFileLocation.exists()) {
+
199 0 final String[] l = tempFileLocation.list();
+
200 0 if (l != null && l.length > 0) {
+
201 0 LOGGER.warn("Failed to delete some temporary files, see the log for more details" );
+
202
+ }
203
-
+
} 204
-
-
205
-
+
}
+
205 1 }
206
-
+
207
-
+
208
-
+
209
-
+
210
-
+
211
-
+
212
- @Override
+
213
+
+
214
+
+
215
+ @Override
+
216
public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
-
214 2 final File f = new File(dependency.getActualFilePath());
-
215 2 final File tmpDir = getNextTempDirectory();
-
216 2 extractFiles(f, tmpDir, engine);
-
217
+ 217 2 final File f = new File(dependency.getActualFilePath());
+
218 2 final File tmpDir = getNextTempDirectory();
+
219 2 extractFiles(f, tmpDir, engine);
+
220
-
218
+ 221
-
219 2 final Set<Dependency> dependencySet = findMoreDependencies(engine, tmpDir);
-
220 2 if (!dependencySet.isEmpty()) {
-
221 0 for (Dependency d : dependencySet) {
-
222
-
-
223 0 final String displayPath = String.format("%s%s" ,
-
224
- dependency.getFilePath(),
+
222 2 final Set<Dependency> dependencySet = findMoreDependencies(engine, tmpDir);
+
223 2 if (!dependencySet.isEmpty()) {
+
224 0 for (Dependency d : dependencySet) {
225
- d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
-
226 0 final String displayName = String.format("%s: %s" ,
+
+
226 0 final String displayPath = String.format("%s%s" ,
227
- dependency.getFileName(),
+
dependency.getFilePath(), 228
- d.getFileName());
-
229 0 d.setFilePath(displayPath);
-
230 0 d.setFileName(displayName);
+
d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
+
229 0 final String displayName = String.format("%s: %s" ,
+
230
+ dependency.getFileName(),
231
+ d.getFileName());
+
232 0 d.setFilePath(displayPath);
+
233 0 d.setFileName(displayName);
+
234
-
232
+ 235
-
233
+ 236
-
234 0 if (this .accept(d.getActualFile()) && scanDepth < MAX_SCAN_DEPTH) {
-
235 0 scanDepth += 1;
-
236 0 analyze(d, engine);
-
237 0 scanDepth -= 1;
-
238
+ 237 0 if (this .accept(d.getActualFile()) && scanDepth < MAX_SCAN_DEPTH) {
+
238 0 scanDepth += 1;
+
239 0 analyze(d, engine);
+
240 0 scanDepth -= 1;
+
241
}
-
239 0 }
-
240
+ 242 0 }
+
243
}
-
241 2 if (REMOVE_FROM_ANALYSIS.accept(dependency.getActualFile())) {
-
242 0 addDisguisedJarsToDependencies(dependency, engine);
-
243 0 engine.getDependencies().remove(dependency);
-
244
- }
-
245 2 Collections.sort(engine.getDependencies());
-
246 2 }
+
244 2 if (REMOVE_FROM_ANALYSIS.accept(dependency.getActualFile())) {
+
245 0 addDisguisedJarsToDependencies(dependency, engine);
+
246 0 engine.getDependencies().remove(dependency);
247
-
-
248
-
-
249
-
+
}
+
248 2 Collections.sort(engine.getDependencies());
+
249 2 }
250
-
+
251
-
+
252
-
+
253
-
+
254
-
+
255
+
+
256
+
+
257
+
+
258
private void addDisguisedJarsToDependencies(Dependency dependency, Engine engine) throws AnalysisException {
-
256 0 if (ZIP_FILTER.accept(dependency.getActualFile()) && isZipFileActuallyJarFile(dependency)) {
-
257 0 final File tdir = getNextTempDirectory();
-
258 0 final String fileName = dependency.getFileName();
-
259
+ 259 0 if (ZIP_FILTER.accept(dependency.getActualFile()) && isZipFileActuallyJarFile(dependency)) {
+
260 0 final File tdir = getNextTempDirectory();
+
261 0 final String fileName = dependency.getFileName();
+
262
-
260 0 LOGGER.info("The zip file '{}' appears to be a JAR file, making a copy and analyzing it as a JAR." , fileName);
-
261
+ 263 0 LOGGER.info("The zip file '{}' appears to be a JAR file, making a copy and analyzing it as a JAR." , fileName);
+
264
-
262 0 final File tmpLoc = new File(tdir, fileName.substring(0, fileName.length() - 3) + "jar" );
-
263
+ 265 0 final File tmpLoc = new File(tdir, fileName.substring(0, fileName.length() - 3) + "jar" );
+
266
try {
-
264 0 org.apache.commons.io.FileUtils.copyFile(tdir, tmpLoc);
-
265 0 final Set<Dependency> dependencySet = findMoreDependencies(engine, tmpLoc);
-
266 0 if (!dependencySet.isEmpty()) {
-
267 0 if (dependencySet.size() != 1) {
-
268 0 LOGGER.info("Deep copy of ZIP to JAR file resulted in more than one dependency?" );
-
269
+ 267 0 org.apache.commons.io.FileUtils.copyFile(tdir, tmpLoc);
+
268 0 final Set<Dependency> dependencySet = findMoreDependencies(engine, tmpLoc);
+
269 0 if (!dependencySet.isEmpty()) {
+
270 0 if (dependencySet.size() != 1) {
+
271 0 LOGGER.info("Deep copy of ZIP to JAR file resulted in more than one dependency?" );
+
272
}
-
270 0 for (Dependency d : dependencySet) {
-
271
+ 273 0 for (Dependency d : dependencySet) {
+
274
-
272 0 d.setFilePath(dependency.getFilePath());
-
273 0 d.setDisplayFileName(dependency.getFileName());
-
274 0 }
-
275
+ 275 0 d.setFilePath(dependency.getFilePath());
+
276 0 d.setDisplayFileName(dependency.getFileName());
+
277 0 }
+
278
}
-
276 0 } catch (IOException ex) {
-
277 0 LOGGER.debug("Unable to perform deep copy on '{}'" , dependency.getActualFile().getPath(), ex);
-
278 0 }
-
279
- }
-
280 0 }
-
281
-
+
279 0 } catch (IOException ex) {
+
280 0 LOGGER.debug("Unable to perform deep copy on '{}'" , dependency.getActualFile().getPath(), ex);
+
281 0 }
282
-
-
283
-
-
284 1 private static final Set<Dependency> EMPTY_DEPENDENCY_SET = Collections.emptySet();
+
}
+
283 0 }
+
284
+
285
-
+
286
-
-
287
-
+
+
287 1 private static final Set<Dependency> EMPTY_DEPENDENCY_SET = Collections.emptySet();
288
-
+
289
-
+
290
-
+
291
-
+
292
-
+
293
+
+
294
+
+
295
+
+
296
private static Set<Dependency> findMoreDependencies(Engine engine, File file) {
-
294 2 final List<Dependency> before = new ArrayList<Dependency>(engine.getDependencies());
-
295 2 engine.scan(file);
-
296 2 final List<Dependency> after = engine.getDependencies();
-
297 2 final boolean sizeChanged = before.size() != after.size();
-
298
+ 297 2 final List<Dependency> before = new ArrayList<Dependency>(engine.getDependencies());
+
298 2 engine.scan(file);
+
299 2 final List<Dependency> after = engine.getDependencies();
+
300 2 final boolean sizeChanged = before.size() != after.size();
+
301
final Set<Dependency> newDependencies;
-
299 2 if (sizeChanged) {
-
300
-
-
301 0 newDependencies = new HashSet<Dependency>(after);
-
302 0 newDependencies.removeAll(before);
+
302 2 if (sizeChanged) {
303
+
+
304 0 newDependencies = new HashSet<Dependency>(after);
+
305 0 newDependencies.removeAll(before);
+
306
} else {
-
304 2 newDependencies = EMPTY_DEPENDENCY_SET;
-
305
- }
-
306 2 return newDependencies;
-
307
- }
+
307 2 newDependencies = EMPTY_DEPENDENCY_SET;
308
-
-
309
-
+
}
+
309 2 return newDependencies;
310
-
+
} 311
-
+
312
-
+
313
-
+
314
-
+
315
- private File getNextTempDirectory() throws AnalysisException {
-
316 2 dirCount += 1;
-
317 2 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+
+
316
+
+
317
+
318
-
-
319 2 if (directory.exists()) {
-
320 0 return getNextTempDirectory();
+
private File getNextTempDirectory() throws AnalysisException {
+
319 2 dirCount += 1;
+
320 2 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
321
+
+
322 2 if (directory.exists()) {
+
323 0 return getNextTempDirectory();
+
324
}
-
322 2 if (!directory.mkdirs()) {
-
323 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
-
324 0 throw new AnalysisException(msg);
-
325
- }
-
326 2 return directory;
-
327
- }
+
325 2 if (!directory.mkdirs()) {
+
326 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+
327 0 throw new AnalysisException(msg);
328
-
-
329
-
+
}
+
329 2 return directory;
330
-
-
331
-
-
332
-
-
333
-
-
334
-
-
335
-
-
336
-
-
337
- private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
-
338 2 if (archive != null && destination != null ) {
-
339
- FileInputStream fis;
-
340
- try {
-
341 2 fis = new FileInputStream(archive);
-
342 0 } catch (FileNotFoundException ex) {
-
343 0 LOGGER.debug("" , ex);
-
344 0 throw new AnalysisException("Archive file was not found." , ex);
-
345 2 }
-
346 2 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
-
347
- try {
-
348 2 if (ZIPPABLES.contains(archiveExt)) {
-
349 2 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
-
350 0 } else if ("tar" .equals(archiveExt)) {
-
351 0 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
-
352 0 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
-
353 0 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
-
354 0 final File f = new File(destination, uncompressedName);
-
355 0 if (engine.accept(f)) {
-
356 0 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), f);
-
357
- }
-
358 0 } else if ("bz2" .equals(archiveExt) || "tbz2" .equals(archiveExt)) {
-
359 0 final String uncompressedName = BZip2Utils.getUncompressedFilename(archive.getName());
-
360 0 final File f = new File(destination, uncompressedName);
-
361 0 if (engine.accept(f)) {
-
362 0 decompressFile(new BZip2CompressorInputStream(new BufferedInputStream(fis)), f);
-
363
- }
-
364
- }
-
365 0 } catch (ArchiveExtractionException ex) {
-
366 0 LOGGER.warn("Exception extracting archive '{}'." , archive.getName());
-
367 0 LOGGER.debug("" , ex);
-
368 0 } catch (IOException ex) {
-
369 0 LOGGER.warn("Exception reading archive '{}'." , archive.getName());
-
370 0 LOGGER.debug("" , ex);
-
371
- } finally {
-
372 2 close(fis);
-
373 2 }
-
374
- }
-
375 2 }
-
376
-
-
377
-
-
378
-
-
379
-
-
380
-
-
381
-
-
382
-
-
383
-
-
384
-
-
385
- private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
-
386
- ArchiveEntry entry;
-
387
- try {
-
388 887 while ((entry = input.getNextEntry()) != null ) {
-
389 885 final File file = new File(destination, entry.getName());
-
390 885 if (entry.isDirectory()) {
-
391 36 if (!file.exists() && !file.mkdirs()) {
-
392 0 final String msg = String.format("Unable to create directory '%s'." , file.getAbsolutePath());
-
393 0 throw new AnalysisException(msg);
-
394
- }
-
395 849 } else if (engine.accept(file)) {
-
396 0 extractAcceptedFile(input, file);
-
397
- }
-
398 885 }
-
399 0 } catch (Throwable ex) {
-
400 0 throw new ArchiveExtractionException(ex);
-
401
- } finally {
-
402 2 close(input);
-
403 2 }
-
404 2 }
-
405
-
-
406
-
-
407
-
-
408
-
-
409
-
-
410
-
-
411
-
-
412
-
-
413
- private static void extractAcceptedFile(ArchiveInputStream input, File file) throws AnalysisException {
-
414 0 LOGGER.debug("Extracting '{}'" , file.getPath());
-
415 0 FileOutputStream fos = null ;
-
416
- try {
-
417 0 final File parent = file.getParentFile();
-
418 0 if (!parent.isDirectory()) {
-
419 0 if (!parent.mkdirs()) {
-
420 0 final String msg = String.format("Unable to build directory '%s'." , parent.getAbsolutePath());
-
421 0 throw new AnalysisException(msg);
-
422
- }
-
423
- }
-
424 0 fos = new FileOutputStream(file);
-
425 0 IOUtils.copy(input, fos);
-
426 0 } catch (FileNotFoundException ex) {
-
427 0 LOGGER.debug("" , ex);
-
428 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
-
429 0 throw new AnalysisException(msg, ex);
-
430 0 } catch (IOException ex) {
-
431 0 LOGGER.debug("" , ex);
-
432 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
-
433 0 throw new AnalysisException(msg, ex);
-
434
- } finally {
-
435 0 close(fos);
-
436 0 }
-
437 0 }
-
438
-
-
439
-
-
440
-
-
441
-
-
442
-
-
443
-
-
444
-
-
445
-
-
446
- private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
-
447 0 LOGGER.debug("Decompressing '{}'" , outputFile.getPath());
-
448 0 FileOutputStream out = null ;
-
449
- try {
-
450 0 out = new FileOutputStream(outputFile);
-
451 0 IOUtils.copy(inputStream, out);
-
452 0 } catch (FileNotFoundException ex) {
-
453 0 LOGGER.debug("" , ex);
-
454 0 throw new ArchiveExtractionException(ex);
-
455 0 } catch (IOException ex) {
-
456 0 LOGGER.debug("" , ex);
-
457 0 throw new ArchiveExtractionException(ex);
-
458
- } finally {
-
459 0 close(out);
-
460 0 }
-
461 0 }
-
462
-
-
463
-
-
464
-
-
465
-
-
466
-
-
467
-
-
468
- private static void close(Closeable closeable) {
-
469 4 if (null != closeable) {
-
470
- try {
-
471 4 closeable.close();
-
472 0 } catch (IOException ex) {
-
473 0 LOGGER.trace("" , ex);
-
474 4 }
-
475
- }
-
476 4 }
-
477
-
-
478
-
-
479
-
-
480
-
-
481
-
-
482
-
-
483
-
-
484
- private boolean isZipFileActuallyJarFile(Dependency dependency) {
-
485 0 boolean isJar = false ;
-
486 0 ZipFile zip = null ;
-
487
- try {
-
488 0 zip = new ZipFile(dependency.getActualFilePath());
-
489 0 if (zip.getEntry("META-INF/MANIFEST.MF" ) != null
-
490
- || zip.getEntry("META-INF/maven" ) != null ) {
-
491 0 final Enumeration<ZipArchiveEntry> entries = zip.getEntries();
-
492 0 while (entries.hasMoreElements()) {
-
493 0 final ZipArchiveEntry entry = entries.nextElement();
-
494 0 if (!entry.isDirectory()) {
-
495 0 final String name = entry.getName().toLowerCase();
-
496 0 if (name.endsWith(".class" )) {
-
497 0 isJar = true ;
-
498 0 break ;
-
499
- }
-
500
- }
-
501 0 }
-
502
- }
-
503 0 } catch (IOException ex) {
-
504 0 LOGGER.debug("Unable to unzip zip file '{}'" , dependency.getFilePath(), ex);
-
505
- } finally {
-
506 0 ZipFile.closeQuietly(zip);
-
507 0 }
-
508
-
-
509 0 return isJar;
-
510
}
+
331
+
+
332
+
+
333
+
+
334
+
+
335
+
+
336
+
+
337
+
+
338
+
+
339
+
+
340
+ private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
+
341 2 if (archive != null && destination != null ) {
+
342
+ FileInputStream fis;
+
343
+ try {
+
344 2 fis = new FileInputStream(archive);
+
345 0 } catch (FileNotFoundException ex) {
+
346 0 LOGGER.debug("" , ex);
+
347 0 throw new AnalysisException("Archive file was not found." , ex);
+
348 2 }
+
349 2 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
+
350
+ try {
+
351 2 if (ZIPPABLES.contains(archiveExt)) {
+
352 2 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+
353 0 } else if ("tar" .equals(archiveExt)) {
+
354 0 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+
355 0 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
+
356 0 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
+
357 0 final File f = new File(destination, uncompressedName);
+
358 0 if (engine.accept(f)) {
+
359 0 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), f);
+
360
+ }
+
361 0 } else if ("bz2" .equals(archiveExt) || "tbz2" .equals(archiveExt)) {
+
362 0 final String uncompressedName = BZip2Utils.getUncompressedFilename(archive.getName());
+
363 0 final File f = new File(destination, uncompressedName);
+
364 0 if (engine.accept(f)) {
+
365 0 decompressFile(new BZip2CompressorInputStream(new BufferedInputStream(fis)), f);
+
366
+ }
+
367
+ }
+
368 0 } catch (ArchiveExtractionException ex) {
+
369 0 LOGGER.warn("Exception extracting archive '{}'." , archive.getName());
+
370 0 LOGGER.debug("" , ex);
+
371 0 } catch (IOException ex) {
+
372 0 LOGGER.warn("Exception reading archive '{}'." , archive.getName());
+
373 0 LOGGER.debug("" , ex);
+
374
+ } finally {
+
375 2 close(fis);
+
376 2 }
+
377
+ }
+
378 2 }
+
379
+
+
380
+
+
381
+
+
382
+
+
383
+
+
384
+
+
385
+
+
386
+
+
387
+
+
388
+ private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
+
389
+ ArchiveEntry entry;
+
390
+ try {
+
391 887 while ((entry = input.getNextEntry()) != null ) {
+
392 885 final File file = new File(destination, entry.getName());
+
393 885 if (entry.isDirectory()) {
+
394 36 if (!file.exists() && !file.mkdirs()) {
+
395 0 final String msg = String.format("Unable to create directory '%s'." , file.getAbsolutePath());
+
396 0 throw new AnalysisException(msg);
+
397
+ }
+
398 849 } else if (engine.accept(file)) {
+
399 0 extractAcceptedFile(input, file);
+
400
+ }
+
401 885 }
+
402 0 } catch (Throwable ex) {
+
403 0 throw new ArchiveExtractionException(ex);
+
404
+ } finally {
+
405 2 close(input);
+
406 2 }
+
407 2 }
+
408
+
+
409
+
+
410
+
+
411
+
+
412
+
+
413
+
+
414
+
+
415
+
+
416
+ private static void extractAcceptedFile(ArchiveInputStream input, File file) throws AnalysisException {
+
417 0 LOGGER.debug("Extracting '{}'" , file.getPath());
+
418 0 FileOutputStream fos = null ;
+
419
+ try {
+
420 0 final File parent = file.getParentFile();
+
421 0 if (!parent.isDirectory() && !parent.mkdirs()) {
+
422 0 final String msg = String.format("Unable to build directory '%s'." , parent.getAbsolutePath());
+
423 0 throw new AnalysisException(msg);
+
424
+ }
+
425 0 fos = new FileOutputStream(file);
+
426 0 IOUtils.copy(input, fos);
+
427 0 } catch (FileNotFoundException ex) {
+
428 0 LOGGER.debug("" , ex);
+
429 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
+
430 0 throw new AnalysisException(msg, ex);
+
431 0 } catch (IOException ex) {
+
432 0 LOGGER.debug("" , ex);
+
433 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+
434 0 throw new AnalysisException(msg, ex);
+
435
+ } finally {
+
436 0 close(fos);
+
437 0 }
+
438 0 }
+
439
+
+
440
+
+
441
+
+
442
+
+
443
+
+
444
+
+
445
+
+
446
+
+
447
+ private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
+
448 0 LOGGER.debug("Decompressing '{}'" , outputFile.getPath());
+
449 0 FileOutputStream out = null ;
+
450
+ try {
+
451 0 out = new FileOutputStream(outputFile);
+
452 0 IOUtils.copy(inputStream, out);
+
453 0 } catch (FileNotFoundException ex) {
+
454 0 LOGGER.debug("" , ex);
+
455 0 throw new ArchiveExtractionException(ex);
+
456 0 } catch (IOException ex) {
+
457 0 LOGGER.debug("" , ex);
+
458 0 throw new ArchiveExtractionException(ex);
+
459
+ } finally {
+
460 0 close(out);
+
461 0 }
+
462 0 }
+
463
+
+
464
+
+
465
+
+
466
+
+
467
+
+
468
+
+
469
+ private static void close(Closeable closeable) {
+
470 4 if (null != closeable) {
+
471
+ try {
+
472 4 closeable.close();
+
473 0 } catch (IOException ex) {
+
474 0 LOGGER.trace("" , ex);
+
475 4 }
+
476
+ }
+
477 4 }
+
478
+
+
479
+
+
480
+
+
481
+
+
482
+
+
483
+
+
484
+
+
485
+ private boolean isZipFileActuallyJarFile(Dependency dependency) {
+
486 0 boolean isJar = false ;
+
487 0 ZipFile zip = null ;
+
488
+ try {
+
489 0 zip = new ZipFile(dependency.getActualFilePath());
+
490 0 if (zip.getEntry("META-INF/MANIFEST.MF" ) != null
+
491
+ || zip.getEntry("META-INF/maven" ) != null ) {
+
492 0 final Enumeration<ZipArchiveEntry> entries = zip.getEntries();
+
493 0 while (entries.hasMoreElements()) {
+
494 0 final ZipArchiveEntry entry = entries.nextElement();
+
495 0 if (!entry.isDirectory()) {
+
496 0 final String name = entry.getName().toLowerCase();
+
497 0 if (name.endsWith(".class" )) {
+
498 0 isJar = true ;
+
499 0 break ;
+
500
+ }
+
501
+ }
+
502 0 }
+
503
+ }
+
504 0 } catch (IOException ex) {
+
505 0 LOGGER.debug("Unable to unzip zip file '{}'" , dependency.getFilePath(), ex);
+
506
+ } finally {
+
507 0 ZipFile.closeQuietly(zip);
+
508 0 }
+
509
+
+
510 0 return isJar;
511
+ }
+
512
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
index c1537cea3..7648569a9 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
@@ -12,7 +12,7 @@
@@ -56,19 +56,19 @@
19
20
- import java.io.BufferedReader;
-
21
import java.io.File;
-
22
+ 21
import java.io.FileFilter;
-
23
+ 22
import java.io.FileOutputStream;
-
24
+ 23
import java.io.IOException;
-
25
+ 24
import java.io.InputStream;
+
25
+ import org.apache.commons.io.IOUtils;
26
- import java.io.InputStreamReader;
+
import org.apache.commons.io.output.NullOutputStream; 27
import org.owasp.dependencycheck.Engine;
28
@@ -233,336 +233,297 @@
115 3 final List<String> args = buildArgumentList();
116 3 args.add(dependency.getActualFilePath());
117 3 final ProcessBuilder pb = new ProcessBuilder(args);
-
118 3 BufferedReader rdr = null ;
-
119 3 Document doc = null ;
-
120
+ 118 3 Document doc = null ;
+
119
try {
-
121 3 final Process proc = pb.start();
-
122
+ 120 3 final Process proc = pb.start();
+
121
+
+
122 3 doc = builder.parse(proc.getInputStream());
+
123
+
+
124
-
123 3 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8" ));
-
124 3 String line = null ;
-
125
-
-
126 3 while (rdr.ready() && (line = rdr.readLine()) != null ) {
-
127 0 LOGGER.warn("Error from GrokAssembly: {}" , line);
+
125 3 final String errorStream = IOUtils.toString(proc.getErrorStream(), "UTF-8" );
+
126 3 if (null != errorStream && !errorStream.isEmpty()) {
+
127 0 LOGGER.warn("Error from GrokAssembly: {}" , errorStream);
128
}
129
-
-
130 3 int rc = 0;
-
131 3 doc = builder.parse(proc.getInputStream());
-
132
-
133
+ 130 3 int rc = 0;
+
131
try {
-
134 3 rc = proc.waitFor();
-
135 0 } catch (InterruptedException ie) {
-
136
- return ;
-
137 3 }
-
138 3 if (rc == 3) {
-
139 0 LOGGER.debug("{} is not a .NET assembly or executable and as such cannot be analyzed by dependency-check" ,
-
140
+ 132 3 rc = proc.waitFor();
+
133 0 } catch (InterruptedException ie) {
+
134 0 return ;
+
135 3 }
+
136 3 if (rc == 3) {
+
137 0 LOGGER.debug("{} is not a .NET assembly or executable and as such cannot be analyzed by dependency-check" ,
+
138
dependency.getActualFilePath());
-
141
- return ;
-
142 3 } else if (rc != 0) {
-
143 1 LOGGER.warn("Return code {} from GrokAssembly" , rc);
-
144
+ 139 0 return ;
+
140 3 } else if (rc != 0) {
+
141 1 LOGGER.warn("Return code {} from GrokAssembly" , rc);
+
142
}
+
143
+
+
144 3 final XPath xpath = XPathFactory.newInstance().newXPath();
145
-
146 3 final XPath xpath = XPathFactory.newInstance().newXPath();
-
147
-
-
148
+ 146
-
149 3 final String error = xpath.evaluate("/assembly/error" , doc);
-
150 3 if (error != null && !error.isEmpty()) {
-
151 1 throw new AnalysisException(error);
-
152
+ 147 3 final String error = xpath.evaluate("/assembly/error" , doc);
+
148 3 if (error != null && !error.isEmpty()) {
+
149 1 throw new AnalysisException(error);
+
150
}
-
153
+ 151
-
154 2 final String version = xpath.evaluate("/assembly/version" , doc);
-
155 2 if (version != null ) {
-
156 2 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
-
157
+ 152 2 final String version = xpath.evaluate("/assembly/version" , doc);
+
153 2 if (version != null ) {
+
154 2 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
+
155
version, Confidence.HIGHEST));
-
158
+ 156
}
-
159
+ 157
-
160 2 final String vendor = xpath.evaluate("/assembly/company" , doc);
-
161 2 if (vendor != null ) {
-
162 2 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
-
163
+ 158 2 final String vendor = xpath.evaluate("/assembly/company" , doc);
+
159 2 if (vendor != null ) {
+
160 2 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
+
161
vendor, Confidence.HIGH));
-
164
+ 162
}
-
165
+ 163
-
166 2 final String product = xpath.evaluate("/assembly/product" , doc);
-
167 2 if (product != null ) {
-
168 2 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
-
169
+ 164 2 final String product = xpath.evaluate("/assembly/product" , doc);
+
165 2 if (product != null ) {
+
166 2 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
+
167
product, Confidence.HIGH));
-
170
+ 168
}
-
171
+ 169
-
172 0 } catch (IOException ioe) {
-
173 0 throw new AnalysisException(ioe);
-
174 0 } catch (SAXException saxe) {
-
175 0 throw new AnalysisException("Couldn't parse GrokAssembly result" , saxe);
-
176 0 } catch (XPathExpressionException xpe) {
-
177
+ 170 0 } catch (IOException ioe) {
+
171 0 throw new AnalysisException(ioe);
+
172 0 } catch (SAXException saxe) {
+
173 0 throw new AnalysisException("Couldn't parse GrokAssembly result" , saxe);
+
174 0 } catch (XPathExpressionException xpe) {
+
175
-
178 0 throw new AnalysisException(xpe);
+
176 0 throw new AnalysisException(xpe);
+
177 2 }
+
178 2 }
179
- } finally {
-
180 3 if (rdr != null ) {
+
+
180
+
181
- try {
-
182 3 rdr.close();
-
183 0 } catch (IOException ex) {
-
184 0 LOGGER.debug("ignore" , ex);
-
185 4 }
-
186
- }
-
187
- }
-
188 2 }
-
189
-
-
190
-
-
191
-
192
+ 182
-
193
+ 183
-
194
+ 184
-
195
+ 185
@Override
-
196
+ 186
public void initializeFileTypeAnalyzer() throws Exception {
-
197 5 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
-
198 5 FileOutputStream fos = null ;
-
199 5 InputStream is = null ;
-
200
+ 187 5 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
+
188 5 FileOutputStream fos = null ;
+
189 5 InputStream is = null ;
+
190
try {
-
201 5 fos = new FileOutputStream(tempFile);
-
202 5 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
-
203 5 final byte [] buff = new byte [4096];
-
204 5 int bread = -1;
-
205 15 while ((bread = is.read(buff)) >= 0) {
-
206 10 fos.write(buff, 0, bread);
-
207
- }
-
208 5 grokAssemblyExe = tempFile;
-
209
+ 191 5 fos = new FileOutputStream(tempFile);
+
192 5 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
+
193 5 IOUtils.copy(is, fos);
+
194
+
+
195 5 grokAssemblyExe = tempFile;
+
196
-
210 5 grokAssemblyExe.deleteOnExit();
-
211 5 LOGGER.debug("Extracted GrokAssembly.exe to {}" , grokAssemblyExe.getPath());
-
212 0 } catch (IOException ioe) {
-
213 0 this .setEnabled(false );
-
214 0 LOGGER.warn("Could not extract GrokAssembly.exe: {}" , ioe.getMessage());
-
215 0 throw new AnalysisException("Could not extract GrokAssembly.exe" , ioe);
-
216
+ 197 5 grokAssemblyExe.deleteOnExit();
+
198 5 LOGGER.debug("Extracted GrokAssembly.exe to {}" , grokAssemblyExe.getPath());
+
199 0 } catch (IOException ioe) {
+
200 0 this .setEnabled(false );
+
201 0 LOGGER.warn("Could not extract GrokAssembly.exe: {}" , ioe.getMessage());
+
202 0 throw new AnalysisException("Could not extract GrokAssembly.exe" , ioe);
+
203
} finally {
-
217 5 if (fos != null ) {
+
204 5 if (fos != null ) {
+
205
+ try {
+
206 5 fos.close();
+
207 0 } catch (Throwable e) {
+
208 0 LOGGER.debug("Error closing output stream" );
+
209 5 }
+
210
+ }
+
211 5 if (is != null ) {
+
212
+ try {
+
213 5 is.close();
+
214 0 } catch (Throwable e) {
+
215 0 LOGGER.debug("Error closing input stream" );
+
216 5 }
+
217
+ }
218
- try {
-
219 5 fos.close();
-
220 0 } catch (Throwable e) {
-
221 0 LOGGER.debug("Error closing output stream" );
-
222 5 }
-
223
- }
-
224 5 if (is != null ) {
-
225
- try {
-
226 5 is.close();
-
227 0 } catch (Throwable e) {
-
228 0 LOGGER.debug("Error closing input stream" );
-
229 5 }
-
230
- }
-
231
}
-
232
+ 219
-
233
+ 220
-
234 5 final List<String> args = buildArgumentList();
-
235 5 BufferedReader rdr = null ;
-
236
+ 221 5 final List<String> args = buildArgumentList();
+
222
try {
-
237 5 final ProcessBuilder pb = new ProcessBuilder(args);
-
238 5 final Process p = pb.start();
-
239
+ 223 5 final ProcessBuilder pb = new ProcessBuilder(args);
+
224 5 final Process p = pb.start();
+
225
-
240 5 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8" ));
+
226 5 IOUtils.copy(p.getErrorStream(), NullOutputStream.NULL_OUTPUT_STREAM);
+
227
+
+
228 5 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
+
229 5 final XPath xpath = XPathFactory.newInstance().newXPath();
+
230 5 final String error = xpath.evaluate("/assembly/error" , doc);
+
231 5 if (p.waitFor() != 1 || error == null || error.isEmpty()) {
+
232 0 LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details." );
+
233 0 LOGGER.debug("GrokAssembly.exe is not working properly" );
+
234 0 grokAssemblyExe = null ;
+
235 0 this .setEnabled(false );
+
236 0 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer" );
+
237
+ }
+
238 0 } catch (Throwable e) {
+
239 0 if (e instanceof AnalysisException) {
+
240 0 throw (AnalysisException) e;
241
-
-
242 5 while (rdr.ready() && rdr.readLine() != null ) {
-
243
-
-
244
- }
-
245
-
-
246 5 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
-
247 5 final XPath xpath = XPathFactory.newInstance().newXPath();
-
248 5 final String error = xpath.evaluate("/assembly/error" , doc);
-
249 5 if (p.waitFor() != 1 || error == null || error.isEmpty()) {
-
250 0 LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details." );
-
251 0 LOGGER.debug("GrokAssembly.exe is not working properly" );
-
252 0 grokAssemblyExe = null ;
-
253 0 this .setEnabled(false );
-
254 0 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer" );
-
255
- }
-
256 0 } catch (Throwable e) {
-
257 0 if (e instanceof AnalysisException) {
-
258 0 throw (AnalysisException) e;
-
259
} else {
-
260 0 LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
-
261
+ 242 0 LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
+
243
+ "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details." );
-
262 0 LOGGER.debug("Could not execute GrokAssembly {}" , e.getMessage());
-
263 0 this .setEnabled(false );
-
264 0 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer" , e);
-
265
+ 244 0 LOGGER.debug("Could not execute GrokAssembly {}" , e.getMessage());
+
245 0 this .setEnabled(false );
+
246 0 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer" , e);
+
247
}
-
266
- } finally {
-
267 5 if (rdr != null ) {
-
268
- try {
-
269 5 rdr.close();
-
270 0 } catch (IOException ex) {
-
271 0 LOGGER.trace("ignore" , ex);
-
272 5 }
-
273
- }
-
274
- }
-
275 5 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
-
276 5 }
-
277
+ 248 5 }
+
249 5 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+
250 5 }
+
251
-
278
+ 252
-
279
+ 253
-
280
+ 254
-
281
+ 255
-
282
+ 256
-
283
+ 257
@Override
-
284
+ 258
public void close() throws Exception {
-
285 6 super .close();
-
286
+ 259 6 super .close();
+
260
try {
-
287 6 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
-
288 0 grokAssemblyExe.deleteOnExit();
-
289
+ 261 6 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
+
262 0 grokAssemblyExe.deleteOnExit();
+
263
}
-
290 0 } catch (SecurityException se) {
-
291 0 LOGGER.debug("Can't delete temporary GrokAssembly.exe" );
-
292 6 }
-
293 6 }
-
294
+ 264 0 } catch (SecurityException se) {
+
265 0 LOGGER.debug("Can't delete temporary GrokAssembly.exe" );
+
266 6 }
+
267 6 }
+
268
-
295
+ 269
-
296
+ 270
-
297
+ 271
-
298 1 private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(
-
299
+ 272 1 private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(
+
273
SUPPORTED_EXTENSIONS).build();
-
300
+ 274
-
301
+ 275
@Override
-
302
+ 276
protected FileFilter getFileFilter() {
-
303 858 return FILTER;
-
304
+ 277 858 return FILTER;
+
278
}
-
305
+ 279
-
306
+ 280
-
307
+ 281
-
308
+ 282
-
309
+ 283
-
310
+ 284
-
311
+ 285
@Override
-
312
+ 286
public String getName() {
-
313 5 return ANALYZER_NAME;
-
314
+ 287 5 return ANALYZER_NAME;
+
288
}
-
315
+ 289
-
316
+ 290
-
317
+ 291
-
318
+ 292
-
319
+ 293
-
320
+ 294
-
321
+ 295
@Override
-
322
+ 296
public AnalysisPhase getAnalysisPhase() {
-
323 3 return ANALYSIS_PHASE;
-
324
+ 297 3 return ANALYSIS_PHASE;
+
298
}
-
325
+ 299
-
326
+ 300
-
327
+ 301
-
328
+ 302
-
329
+ 303
-
330
+ 304
-
331
+ 305
@Override
-
332
+ 306
protected String getAnalyzerEnabledSettingKey() {
-
333 9 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
-
334
+ 307 9 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
+
308
}
-
335
+ 309
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AutoconfAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AutoconfAnalyzer.html
index 91efeb77e..c1cd74e30 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AutoconfAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AutoconfAnalyzer.html
@@ -510,6 +510,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CMakeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CMakeAnalyzer.html
index c92364949..6dc732a04 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CMakeAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CMakeAnalyzer.html
@@ -143,249 +143,283 @@
| Pattern.CASE_INSENSITIVE | Pattern.MULTILINE; 64
-
65 1 private static final Pattern PROJECT = Pattern.compile(
-
66
- "^ *project *\\([ \\n]*(\\w+)[ \\n]*.*?\\)" , REGEX_OPTIONS);
-
67
-
-
68
-
-
69
-
-
70 1 private static final Pattern SET_VERSION = Pattern
-
71
- .compile(
-
72
- "^ *set\\s*\\(\\s*(\\w+)_version\\s+\"?(\\d+(?:\\.\\d+)+)[\\s\"]?\\)" ,
-
73
- REGEX_OPTIONS);
-
74
-
-
75
+ 65
+
66
+
+
67
+
+
68 1 private static final Pattern PROJECT = Pattern.compile(
+
69
+ "^ *project *\\([ \\n]*(\\w+)[ \\n]*.*?\\)" , REGEX_OPTIONS);
+
70
+
+
71
+
+
72
+
+
73
+
+
74
+
+
75
+
76
-
+
77
-
78 1 private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(".cmake" )
+
78 1 private static final Pattern SET_VERSION = Pattern
79
- .addFilenames("CMakeLists.txt" ).build();
+
.compile( 80
-
+
"^ *set\\s*\\(\\s*(\\w+)_version\\s+\"?(\\d+(?:\\.\\d+)+)[\\s\"]?\\)" , 81
-
+
REGEX_OPTIONS); 82
-
-
83
-
-
84 1 private static MessageDigest sha1 = null ;
-
85
-
86
- static {
+
83
+
+
84
+
+
85
+
+
86 1 private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(".cmake" )
87
- try {
-
88 1 sha1 = MessageDigest.getInstance("SHA1" );
-
89 0 } catch (NoSuchAlgorithmException e) {
-
90 0 LOGGER.error(e.getMessage());
-
91 1 }
-
92 1 }
+
.addFilenames("CMakeLists.txt" ).build();
+
88
+
+
89
+
+
90
+
+
91
+
+
92 1 private static MessageDigest sha1 = null ;
93
94
-
+
static { 95
-
-
96
-
-
97
-
-
98
-
-
99
-
-
100
- @Override
-
101
- public String getName() {
-
102 5 return "CMake Analyzer" ;
-
103
- }
-
104
-
-
105
-
-
106
-
-
107
-
-
108
-
-
109
-
-
110
- @Override
-
111
- public AnalysisPhase getAnalysisPhase() {
-
112 3 return AnalysisPhase.INFORMATION_COLLECTION;
-
113
- }
-
114
-
-
115
-
-
116
-
-
117
-
-
118
-
-
119
-
-
120
- @Override
-
121
- protected FileFilter getFileFilter() {
-
122 855 return FILTER;
-
123
- }
-
124
-
-
125
-
-
126
-
-
127
-
-
128
-
-
129
-
-
130
- @Override
-
131
- protected void initializeFileTypeAnalyzer() throws Exception {
-
132
-
-
133 5 }
-
134
-
-
135
-
-
136
-
-
137
-
-
138
-
-
139
-
-
140
-
-
141
-
-
142
- @Override
-
143
- protected void analyzeFileType(Dependency dependency, Engine engine)
-
144
- throws AnalysisException {
-
145 3 final File file = dependency.getActualFile();
-
146 3 final String parentName = file.getParentFile().getName();
-
147 3 final String name = file.getName();
-
148 3 dependency.setDisplayFileName(String.format("%s%c%s" , parentName, File.separatorChar, name));
-
149
- String contents;
-
150
try {
-
151 3 contents = FileUtils.readFileToString(file).trim();
-
152 0 } catch (IOException e) {
-
153 0 throw new AnalysisException(
-
154
- "Problem occurred while reading dependency file." , e);
-
155 3 }
-
156
+ 96 1 sha1 = MessageDigest.getInstance("SHA1" );
+
97 0 } catch (NoSuchAlgorithmException e) {
+
98 0 LOGGER.error(e.getMessage());
+
99 1 }
+
100 1 }
+
101
-
157 3 if (StringUtils.isNotBlank(contents)) {
-
158 3 final Matcher m = PROJECT.matcher(contents);
-
159 3 int count = 0;
-
160 5 while (m.find()) {
-
161 2 count++;
-
162 2 LOGGER.debug(String.format(
-
163
- "Found project command match with %d groups: %s" ,
-
164
- m.groupCount(), m.group(0)));
-
165 2 final String group = m.group(1);
-
166 2 LOGGER.debug("Group 1: " + group);
-
167 2 dependency.getProductEvidence().addEvidence(name, "Project" ,
-
168
- group, Confidence.HIGH);
-
169 2 }
-
170 3 LOGGER.debug("Found {} matches." , count);
-
171 3 analyzeSetVersionCommand(dependency, engine, contents);
-
172
- }
-
173 3 }
-
174
-
-
175
- private void analyzeSetVersionCommand(Dependency dependency, Engine engine, String contents) {
-
176 3 final Dependency orig = dependency;
-
177 3 final Matcher m = SET_VERSION.matcher(contents);
-
178 3 int count = 0;
-
179 8 while (m.find()) {
-
180 5 count++;
-
181 5 LOGGER.debug("Found project command match with {} groups: {}" ,
-
182
- m.groupCount(), m.group(0));
-
183 5 String product = m.group(1);
-
184 5 final String version = m.group(2);
-
185 5 LOGGER.debug("Group 1: " + product);
-
186 5 LOGGER.debug("Group 2: " + version);
-
187 5 final String aliasPrefix = "ALIASOF_" ;
-
188 5 if (product.startsWith(aliasPrefix)) {
-
189 5 product = product.replaceFirst(aliasPrefix, "" );
-
190
- }
-
191 5 if (count > 1) {
-
192
-
-
193 4 dependency = new Dependency(orig.getActualFile());
-
194 4 dependency.setDisplayFileName(String.format("%s:%s" , orig.getDisplayFileName(), product));
-
195 4 final String filePath = String.format("%s:%s" , orig.getFilePath(), product);
-
196 4 dependency.setFilePath(filePath);
-
197
-
-
198
-
-
199 4 dependency.setSha1sum(Checksum.getHex(sha1.digest(filePath.getBytes())));
-
200 4 engine.getDependencies().add(dependency);
-
201
- }
-
202 5 final String source = dependency.getDisplayFileName();
-
203 5 dependency.getProductEvidence().addEvidence(source, "Product" ,
-
204
- product, Confidence.MEDIUM);
-
205 5 dependency.getVersionEvidence().addEvidence(source, "Version" ,
-
206
- version, Confidence.MEDIUM);
-
207 5 }
-
208 3 LOGGER.debug(String.format("Found %d matches." , count));
-
209 3 }
-
210
-
-
211
+ 102
+
+
103
+
+
104
+
+
105
+
+
106
+
+
107
+
+
108
@Override
-
212
- protected String getAnalyzerEnabledSettingKey() {
-
213 9 return Settings.KEYS.ANALYZER_CMAKE_ENABLED;
-
214
+ 109
+ public String getName() {
+
110 5 return "CMake Analyzer" ;
+
111
}
+
112
+
+
113
+
+
114
+
+
115
+
+
116
+
+
117
+
+
118
+ @Override
+
119
+ public AnalysisPhase getAnalysisPhase() {
+
120 3 return AnalysisPhase.INFORMATION_COLLECTION;
+
121
+ }
+
122
+
+
123
+
+
124
+
+
125
+
+
126
+
+
127
+
+
128
+ @Override
+
129
+ protected FileFilter getFileFilter() {
+
130 855 return FILTER;
+
131
+ }
+
132
+
+
133
+
+
134
+
+
135
+
+
136
+
+
137
+
+
138
+ @Override
+
139
+ protected void initializeFileTypeAnalyzer() throws Exception {
+
140
+
+
141 5 }
+
142
+
+
143
+
+
144
+
+
145
+
+
146
+
+
147
+
+
148
+
+
149
+
+
150
+ @Override
+
151
+ protected void analyzeFileType(Dependency dependency, Engine engine)
+
152
+ throws AnalysisException {
+
153 3 final File file = dependency.getActualFile();
+
154 3 final String parentName = file.getParentFile().getName();
+
155 3 final String name = file.getName();
+
156 3 dependency.setDisplayFileName(String.format("%s%c%s" , parentName, File.separatorChar, name));
+
157
+ String contents;
+
158
+ try {
+
159 3 contents = FileUtils.readFileToString(file).trim();
+
160 0 } catch (IOException e) {
+
161 0 throw new AnalysisException(
+
162
+ "Problem occurred while reading dependency file." , e);
+
163 3 }
+
164
+
+
165 3 if (StringUtils.isNotBlank(contents)) {
+
166 3 final Matcher m = PROJECT.matcher(contents);
+
167 3 int count = 0;
+
168 5 while (m.find()) {
+
169 2 count++;
+
170 2 LOGGER.debug(String.format(
+
171
+ "Found project command match with %d groups: %s" ,
+
172
+ m.groupCount(), m.group(0)));
+
173 2 final String group = m.group(1);
+
174 2 LOGGER.debug("Group 1: " + group);
+
175 2 dependency.getProductEvidence().addEvidence(name, "Project" ,
+
176
+ group, Confidence.HIGH);
+
177 2 }
+
178 3 LOGGER.debug("Found {} matches." , count);
+
179 3 analyzeSetVersionCommand(dependency, engine, contents);
+
180
+ }
+
181 3 }
+
182
+
+
183
+
+
184
+
+
185
+
+
186
+
+
187
+
+
188
+
+
189
+
+
190
+
+
191
+ private void analyzeSetVersionCommand(Dependency dependency, Engine engine, String contents) {
+
192 3 Dependency currentDep = dependency;
+
193
+
+
194 3 final Matcher m = SET_VERSION.matcher(contents);
+
195 3 int count = 0;
+
196 8 while (m.find()) {
+
197 5 count++;
+
198 5 LOGGER.debug("Found project command match with {} groups: {}" ,
+
199
+ m.groupCount(), m.group(0));
+
200 5 String product = m.group(1);
+
201 5 final String version = m.group(2);
+
202 5 LOGGER.debug("Group 1: " + product);
+
203 5 LOGGER.debug("Group 2: " + version);
+
204 5 final String aliasPrefix = "ALIASOF_" ;
+
205 5 if (product.startsWith(aliasPrefix)) {
+
206 5 product = product.replaceFirst(aliasPrefix, "" );
+
207
+ }
+
208 5 if (count > 1) {
+
209
+
+
210 4 currentDep = new Dependency(dependency.getActualFile());
+
211 4 currentDep.setDisplayFileName(String.format("%s:%s" , dependency.getDisplayFileName(), product));
+
212 4 final String filePath = String.format("%s:%s" , dependency.getFilePath(), product);
+
213 4 currentDep.setFilePath(filePath);
+
214
+
215
+
+
216 4 currentDep.setSha1sum(Checksum.getHex(sha1.digest(filePath.getBytes())));
+
217 4 engine.getDependencies().add(currentDep);
+
218
+ }
+
219 5 final String source = currentDep.getDisplayFileName();
+
220 5 currentDep.getProductEvidence().addEvidence(source, "Product" ,
+
221
+ product, Confidence.MEDIUM);
+
222 5 currentDep.getVersionEvidence().addEvidence(source, "Version" ,
+
223
+ version, Confidence.MEDIUM);
+
224 5 }
+
225 3 LOGGER.debug(String.format("Found %d matches." , count));
+
226 3 }
+
227
+
+
228
+ @Override
+
229
+ protected String getAnalyzerEnabledSettingKey() {
+
230 9 return Settings.KEYS.ANALYZER_CMAKE_ENABLED;
+
231
+ }
+
232
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
index b5406a311..be2d8d7d1 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
@@ -12,7 +12,7 @@
Classes in this File Line Coverage Branch Coverage Complexity CPEAnalyzer 4.571428571428571; 4.571CPEAnalyzer 4.571428571428571; 4.571CPEAnalyzer$IdentifierConfidence 4.571428571428571; 4.571CPEAnalyzer$IdentifierMatch 4.571428571428571; 4.571 } 198 6 boolean identifierAdded = false ;
199 6 for (IndexEntry e : entries) {
- 200 43 LOGGER.debug("Verifying entry: {}" , e);
- 201 43 if (verifyEntry(e, dependency)) {
- 202 3 final String vendor = e.getVendor();
- 203 3 final String product = e.getProduct();
- 204 3 LOGGER.debug("identified vendor/product: {}/{}" , vendor, product);
- 205 3 identifierAdded |= determineIdentifiers(dependency, vendor, product, confidence);
+ 200 23 LOGGER.debug("Verifying entry: {}" , e);
+ 201 23 if (verifyEntry(e, dependency)) {
+ 202 2 final String vendor = e.getVendor();
+ 203 2 final String product = e.getProduct();
+ 204 2 LOGGER.debug("identified vendor/product: {}/{}" , vendor, product);
+ 205 2 identifierAdded |= determineIdentifiers(dependency, vendor, product, confidence);
206
}
- 207 43 }
+ 207 23 }
208 6 if (identifierAdded) {
209 1 break ;
210
@@ -496,13 +496,13 @@
272 6 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
273 156 for (ScoreDoc d : docs.scoreDocs) {
274 150 if (d.score >= 0.08) {
- 275 43 final Document doc = cpe.getDocument(d.doc);
- 276 43 final IndexEntry entry = new IndexEntry();
- 277 43 entry.setVendor(doc.get(Fields.VENDOR));
- 278 43 entry.setProduct(doc.get(Fields.PRODUCT));
- 279 43 entry.setSearchScore(d.score);
- 280 43 if (!ret.contains(entry)) {
- 281 43 ret.add(entry);
+ 275 23 final Document doc = cpe.getDocument(d.doc);
+ 276 23 final IndexEntry entry = new IndexEntry();
+ 277 23 entry.setVendor(doc.get(Fields.VENDOR));
+ 278 23 entry.setProduct(doc.get(Fields.PRODUCT));
+ 279 23 entry.setSearchScore(d.score);
+ 280 23 if (!ret.contains(entry)) {
+ 281 23 ret.add(entry);
282
}
283
@@ -597,7 +597,7 @@
337
private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
- 338 12 sb.append(" " ).append(field).append(":( " );
+ 338 12 sb.append(' ' ).append(field).append(":( " );
339
340 12 final String cleanText = cleanseText(searchText);
@@ -616,675 +616,684 @@
349 12 final StringTokenizer tokens = new StringTokenizer(cleanText);
350 154 while (tokens.hasMoreElements()) {
351 142 final String word = tokens.nextToken();
- 352 142 String temp = null ;
+ 352 142 StringBuilder temp = null ;
353 142 for (String weighted : weightedText) {
- 354 330 final String weightedStr = cleanseText(weighted);
- 355 330 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
- 356 22 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
- 357 22 if (!word.equalsIgnoreCase(weightedStr)) {
- 358 0 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
- 359
+ 354 308 final String weightedStr = cleanseText(weighted);
+ 355 308 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
+ 356 22 temp = new StringBuilder(word.length() + 2);
+ 357 22 LuceneUtils.appendEscapedLuceneQuery(temp, word);
+ 358 22 temp.append(WEIGHTING_BOOST);
+ 359 22 if (!word.equalsIgnoreCase(weightedStr)) {
+ 360 0 temp.append(' ' );
+ 361 0 LuceneUtils.appendEscapedLuceneQuery(temp, weightedStr);
+ 362 0 temp.append(WEIGHTING_BOOST);
+ 363
}
- 360
- }
- 361 330 }
- 362 142 if (temp == null ) {
- 363 120 temp = LuceneUtils.escapeLuceneQuery(word);
364
- }
- 365 142 sb.append(" " ).append(temp);
- 366 142 }
- 367
- }
- 368 12 sb.append(" ) " );
- 369 12 return true ;
+ break ; 365
+ }
+ 366 286 }
+ 367 142 sb.append(' ' );
+ 368 142 if (temp == null ) {
+ 369 120 LuceneUtils.appendEscapedLuceneQuery(sb, word);
370
- }
- 371
-
- 372
-
- 373
-
- 374
-
- 375
-
- 376
-
- 377
-
- 378
- private String cleanseText(String text) {
- 379 342 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
- 380
- }
- 381
-
- 382
-
- 383
-
- 384
-
- 385
-
- 386
-
- 387
-
- 388
-
- 389
- private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
- 390 330 if (l == null || r == null ) {
- 391 0 return false ;
- 392
- }
- 393
-
- 394 330 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
- 395 330 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
- 396 330 return left.equalsIgnoreCase(right);
- 397
- }
- 398
-
- 399
-
- 400
-
- 401
-
- 402
-
- 403
-
- 404
-
- 405
-
- 406
-
- 407
- private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
- 408 43 boolean isValid = false ;
- 409
-
- 410
-
- 411
-
- 412 43 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
- 413
- && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
- 414
-
- 415 3 isValid = true ;
- 416
- }
- 417 43 return isValid;
- 418
- }
- 419
-
- 420
-
- 421
-
- 422
-
- 423
-
- 424
-
- 425
-
- 426
-
- 427
- private boolean collectionContainsString(EvidenceCollection ec, String text) {
- 428
-
- 429 47 if (text == null ) {
- 430 0 return false ;
- 431
- }
- 432 47 final String[] words = text.split("[\\s_-]" );
- 433 47 final List<String> list = new ArrayList<String>();
- 434 47 String tempWord = null ;
- 435 170 for (String word : words) {
- 436
-
- 437
-
- 438
-
- 439
-
- 440 123 if (tempWord != null ) {
- 441 5 list.add(tempWord + word);
- 442 5 tempWord = null ;
- 443 118 } else if (word.length() <= 2) {
- 444 5 tempWord = word;
- 445
- } else {
- 446 113 list.add(word);
- 447
- }
- 448
- }
- 449 47 if (tempWord != null ) {
- 450 0 if (!list.isEmpty()) {
- 451 0 final String tmp = list.get(list.size() - 1) + tempWord;
- 452 0 list.add(tmp);
- 453 0 } else {
- 454 0 list.add(tempWord);
- 455
- }
- 456
- }
- 457 47 if (list.isEmpty()) {
- 458 0 return false ;
- 459
- }
- 460 47 boolean contains = true ;
- 461 47 for (String word : list) {
- 462 118 contains &= ec.containsUsedString(word);
- 463 118 }
- 464 47 return contains;
- 465
- }
- 466
-
- 467
-
- 468
-
- 469
-
- 470
-
- 471
-
- 472
-
- 473
-
- 474
- @Override
- 475
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 476
- try {
- 477 2 determineCPE(dependency);
- 478 0 } catch (CorruptIndexException ex) {
- 479 0 throw new AnalysisException("CPE Index is corrupt." , ex);
- 480 0 } catch (IOException ex) {
- 481 0 throw new AnalysisException("Failure opening the CPE Index." , ex);
- 482 0 } catch (ParseException ex) {
- 483 0 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency." , ex);
- 484 2 }
- 485 2 }
- 486
-
- 487
-
- 488
-
- 489
-
- 490
-
- 491
-
- 492
-
- 493
-
- 494
-
- 495
-
- 496
-
- 497
-
- 498
-
- 499
- protected boolean determineIdentifiers(Dependency dependency, String vendor, String product,
- 500
- Confidence currentConfidence) throws UnsupportedEncodingException {
- 501 3 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
- 502 3 DependencyVersion bestGuess = new DependencyVersion("-" );
- 503 3 Confidence bestGuessConf = null ;
- 504 3 boolean hasBroadMatch = false ;
- 505 3 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
- 506 15 for (Confidence conf : Confidence.values()) {
- 507
-
- 508
-
- 509
-
- 510 12 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
- 511 12 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
- 512 12 if (evVer == null ) {
- 513 0 continue ;
- 514
- }
- 515 12 for (VulnerableSoftware vs : cpes) {
- 516
- DependencyVersion dbVer;
- 517 436 if (vs.getUpdate() != null && !vs.getUpdate().isEmpty()) {
- 518 128 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getUpdate());
- 519
- } else {
- 520 308 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
- 521
- }
- 522 436 if (dbVer == null ) {
- 523 0 hasBroadMatch = true ;
- 524 0 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
- 525 0 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.BROAD_MATCH, conf);
- 526 0 collected.add(match);
- 527 0 } else if (evVer.equals(dbVer)) {
- 528 8 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
- 529 8 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
- 530 8 collected.add(match);
- 531 8 } else {
- 532
-
- 533 428 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
- 534
- && evVer.matchesAtLeastThreeLevels(dbVer)) {
- 535 64 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
- 536 2 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
- 537 2 bestGuess = dbVer;
- 538 2 bestGuessConf = conf;
- 539
- }
- 540
- }
- 541
- }
- 542
- }
- 543 436 }
- 544 12 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
- 545 1 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
- 546 1 bestGuess = evVer;
- 547 1 bestGuessConf = conf;
- 548
- }
- 549
- }
- 550 12 }
- 551
- }
- 552 3 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
- 553 3 String url = null ;
- 554 3 if (hasBroadMatch) {
- 555 0 final String cpeUrlName = String.format("cpe:/a:%s:%s" , vendor, product);
- 556 0 url = String.format(NVD_SEARCH_URL, URLEncoder.encode(cpeUrlName, "UTF-8" ));
- 557
- }
- 558 3 if (bestGuessConf == null ) {
- 559 0 bestGuessConf = Confidence.LOW;
- 560
- }
- 561 3 final IdentifierMatch match = new IdentifierMatch("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
- 562 3 collected.add(match);
- 563
-
- 564 3 Collections.sort(collected);
- 565 3 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
- 566 3 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
- 567 3 boolean identifierAdded = false ;
- 568 3 for (IdentifierMatch m : collected) {
- 569 11 if (bestIdentifierQuality.equals(m.getConfidence())
- 570
- && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
- 571 3 final Identifier i = m.getIdentifier();
- 572 3 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
- 573 1 i.setConfidence(Confidence.LOW);
- 574
} else {
- 575 2 i.setConfidence(bestEvidenceQuality);
- 576
+ 371 22 sb.append(temp);
+ 372
}
- 577 3 dependency.addIdentifier(i);
- 578 3 identifierAdded = true ;
- 579
+ 373 142 }
+ 374
+ }
+ 375 12 sb.append(" ) " );
+ 376 12 return true ;
+ 377
+ }
+ 378
+
+ 379
+
+ 380
+
+ 381
+
+ 382
+
+ 383
+
+ 384
+
+ 385
+ private String cleanseText(String text) {
+ 386 320 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
+ 387
+ }
+ 388
+
+ 389
+
+ 390
+
+ 391
+
+ 392
+
+ 393
+
+ 394
+
+ 395
+
+ 396
+ private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
+ 397 308 if (l == null || r == null ) {
+ 398 0 return false ;
+ 399
+ }
+ 400
+
+ 401 308 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
+ 402 308 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
+ 403 308 return left.equalsIgnoreCase(right);
+ 404
+ }
+ 405
+
+ 406
+
+ 407
+
+ 408
+
+ 409
+
+ 410
+
+ 411
+
+ 412
+
+ 413
+
+ 414
+ private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
+ 415 23 boolean isValid = false ;
+ 416
+
+ 417
+
+ 418
+
+ 419 23 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
+ 420
+ && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
+ 421
+
+ 422 2 isValid = true ;
+ 423
+ }
+ 424 23 return isValid;
+ 425
+ }
+ 426
+
+ 427
+
+ 428
+
+ 429
+
+ 430
+
+ 431
+
+ 432
+
+ 433
+
+ 434
+ private boolean collectionContainsString(EvidenceCollection ec, String text) {
+ 435
+
+ 436 25 if (text == null ) {
+ 437 0 return false ;
+ 438
+ }
+ 439 25 final String[] words = text.split("[\\s_-]" );
+ 440 25 final List<String> list = new ArrayList<String>();
+ 441 25 String tempWord = null ;
+ 442 83 for (String word : words) {
+ 443
+
+ 444
+
+ 445
+
+ 446
+
+ 447 58 if (tempWord != null ) {
+ 448 2 list.add(tempWord + word);
+ 449 2 tempWord = null ;
+ 450 56 } else if (word.length() <= 2) {
+ 451 2 tempWord = word;
+ 452
+ } else {
+ 453 54 list.add(word);
+ 454
}
- 580 11 }
- 581 3 return identifierAdded;
- 582
+ 455
+ }
+ 456 25 if (tempWord != null ) {
+ 457 0 if (!list.isEmpty()) {
+ 458 0 final String tmp = list.get(list.size() - 1) + tempWord;
+ 459 0 list.add(tmp);
+ 460 0 } else {
+ 461 0 list.add(tempWord);
+ 462
+ }
+ 463
+ }
+ 464 25 if (list.isEmpty()) {
+ 465 0 return false ;
+ 466
+ }
+ 467 25 boolean contains = true ;
+ 468 25 for (String word : list) {
+ 469 56 contains &= ec.containsUsedString(word);
+ 470 56 }
+ 471 25 return contains;
+ 472
}
+ 473
+
+ 474
+
+ 475
+
+ 476
+
+ 477
+
+ 478
+
+ 479
+
+ 480
+
+ 481
+ @Override
+ 482
+ public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+ 483
+ try {
+ 484 2 determineCPE(dependency);
+ 485 0 } catch (CorruptIndexException ex) {
+ 486 0 throw new AnalysisException("CPE Index is corrupt." , ex);
+ 487 0 } catch (IOException ex) {
+ 488 0 throw new AnalysisException("Failure opening the CPE Index." , ex);
+ 489 0 } catch (ParseException ex) {
+ 490 0 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency." , ex);
+ 491 2 }
+ 492 2 }
+ 493
+
+ 494
+
+ 495
+
+ 496
+
+ 497
+
+ 498
+
+ 499
+
+ 500
+
+ 501
+
+ 502
+
+ 503
+
+ 504
+
+ 505
+
+ 506
+ protected boolean determineIdentifiers(Dependency dependency, String vendor, String product,
+ 507
+ Confidence currentConfidence) throws UnsupportedEncodingException {
+ 508 2 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
+ 509 2 DependencyVersion bestGuess = new DependencyVersion("-" );
+ 510 2 Confidence bestGuessConf = null ;
+ 511 2 boolean hasBroadMatch = false ;
+ 512 2 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
+ 513 10 for (Confidence conf : Confidence.values()) {
+ 514
+
+ 515
+
+ 516
+
+ 517 8 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
+ 518 8 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
+ 519 8 if (evVer == null ) {
+ 520 0 continue ;
+ 521
+ }
+ 522 8 for (VulnerableSoftware vs : cpes) {
+ 523
+ DependencyVersion dbVer;
+ 524 312 if (vs.getUpdate() != null && !vs.getUpdate().isEmpty()) {
+ 525 128 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + '.' + vs.getUpdate());
+ 526
+ } else {
+ 527 184 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
+ 528
+ }
+ 529 312 if (dbVer == null ) {
+ 530 0 hasBroadMatch = true ;
+ 531 0 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
+ 532 0 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.BROAD_MATCH, conf);
+ 533 0 collected.add(match);
+ 534 0 } else if (evVer.equals(dbVer)) {
+ 535 8 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
+ 536 8 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
+ 537 8 collected.add(match);
+ 538 8 } else {
+ 539
+
+ 540 304 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
+ 541
+ && evVer.matchesAtLeastThreeLevels(dbVer)) {
+ 542 64 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+ 543 2 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
+ 544 2 bestGuess = dbVer;
+ 545 2 bestGuessConf = conf;
+ 546
+ }
+ 547
+ }
+ 548
+ }
+ 549
+ }
+ 550 312 }
+ 551 8 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+ 552 0 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
+ 553 0 bestGuess = evVer;
+ 554 0 bestGuessConf = conf;
+ 555
+ }
+ 556
+ }
+ 557 8 }
+ 558
+ }
+ 559 2 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
+ 560 2 String url = null ;
+ 561 2 if (hasBroadMatch) {
+ 562 0 final String cpeUrlName = String.format("cpe:/a:%s:%s" , vendor, product);
+ 563 0 url = String.format(NVD_SEARCH_URL, URLEncoder.encode(cpeUrlName, "UTF-8" ));
+ 564
+ }
+ 565 2 if (bestGuessConf == null ) {
+ 566 0 bestGuessConf = Confidence.LOW;
+ 567
+ }
+ 568 2 final IdentifierMatch match = new IdentifierMatch("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
+ 569 2 collected.add(match);
+ 570
+
+ 571 2 Collections.sort(collected);
+ 572 2 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
+ 573 2 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
+ 574 2 boolean identifierAdded = false ;
+ 575 2 for (IdentifierMatch m : collected) {
+ 576 10 if (bestIdentifierQuality.equals(m.getConfidence())
+ 577
+ && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
+ 578 2 final Identifier i = m.getIdentifier();
+ 579 2 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
+ 580 0 i.setConfidence(Confidence.LOW);
+ 581
+ } else {
+ 582 2 i.setConfidence(bestEvidenceQuality);
583
-
- 584
-
- 585
-
+ } 584 2 dependency.addIdentifier(i);
+ 585 2 identifierAdded = true ;
586
-
- 587 4 private enum IdentifierConfidence {
- 588
-
+ } 587 10 }
+ 588 2 return identifierAdded;
589
-
- 590
-
- 591
-
- 592 1 EXACT_MATCH,
- 593
-
- 594
-
- 595
-
- 596 1 BEST_GUESS,
- 597
-
- 598
-
- 599
-
- 600
-
- 601 1 BROAD_MATCH
- 602
}
- 603
+ 590
- 604
+ 591
- 605
-
- 606
+ 592
+
+ 593
- 607 8 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
- 608
+ 594 4 private enum IdentifierConfidence {
+ 595
+ 596
+
+ 597
+
+ 598
+
+ 599 1 EXACT_MATCH,
+ 600
+
+ 601
+
+ 602
+
+ 603 1 BEST_GUESS,
+ 604
+
+ 605
+
+ 606
+
+ 607
+
+ 608 1 BROAD_MATCH
609
-
+ } 610
-
- 611
-
- 612
-
- 613
-
- 614
-
- 615
-
- 616
-
- 617
-
- 618 11 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
- 619 11 this .identifier = new Identifier(type, value, url);
- 620 11 this .confidence = identifierConfidence;
- 621 11 this .evidenceConfidence = evidenceConfidence;
- 622 11 }
- 623
-
- 624
-
- 625
-
- 626
-
- 627
- private Confidence evidenceConfidence;
- 628
- 629
+ 611
+
+ 612
+
+ 613
+
+ 614 8 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
+ 615
+
+ 616
- 630
-
- 631
+ 617
+
+ 618
+ 619
+
+ 620
+
+ 621
+
+ 622
+
+ 623
+
+ 624
+
+ 625 10 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
+ 626 10 this .identifier = new Identifier(type, value, url);
+ 627 10 this .confidence = identifierConfidence;
+ 628 10 this .evidenceConfidence = evidenceConfidence;
+ 629 10 }
+ 630
+
+ 631
+
632
-
+ 633
634
- public Confidence getEvidenceConfidence() {
- 635 12 return evidenceConfidence;
+ private Confidence evidenceConfidence; 635
+
636
- }
+ 637
-
+ 638
-
+ 639
-
+ 640
-
+ 641
-
- 642
-
+ public Confidence getEvidenceConfidence() { 642 10 return evidenceConfidence;
643
- public void setEvidenceConfidence(Confidence evidenceConfidence) {
- 644 0 this .evidenceConfidence = evidenceConfidence;
- 645 0 }
- 646
-
- 647
-
- 648
-
- 649
- private IdentifierConfidence confidence;
- 650
+ }
+ 644
- 651
+ 645
- 652
-
- 653
+ 646
+
+ 647
+ 648
+
+ 649
+
+ 650
+ public void setEvidenceConfidence(Confidence evidenceConfidence) {
+ 651 0 this .evidenceConfidence = evidenceConfidence;
+ 652 0 }
+ 653
+
654
-
+ 655
656
- public IdentifierConfidence getConfidence() {
- 657 14 return confidence;
+ private IdentifierConfidence confidence; 657
+
658
- }
+ 659
-
+ 660
-
+ 661
-
+ 662
-
+ 663
-
- 664
-
+ public IdentifierConfidence getConfidence() { 664 12 return confidence;
665
- public void setConfidence(IdentifierConfidence confidence) {
- 666 0 this .confidence = confidence;
- 667 0 }
- 668
-
- 669
-
- 670
-
- 671
- private Identifier identifier;
- 672
+ }
+ 666
- 673
+ 667
- 674
-
- 675
+ 668
+
+ 669
+ 670
+
+ 671
+
+ 672
+ public void setConfidence(IdentifierConfidence confidence) {
+ 673 0 this .confidence = confidence;
+ 674 0 }
+ 675
+
676
-
+ 677
678
- public Identifier getIdentifier() {
- 679 3 return identifier;
+ private Identifier identifier; 679
+
680
- }
+ 681
-
+ 682
-
+ 683
-
+ 684
-
+ 685
-
- 686
-
+ public Identifier getIdentifier() { 686 2 return identifier;
687
- public void setIdentifier(Identifier identifier) {
- 688 0 this .identifier = identifier;
- 689 0 }
+ } 688
+
+ 689
+
690
-
+ 691
-
+ 692
-
+ 693
-
+ 694
-
- 695
-
- 696
-
+ public void setIdentifier(Identifier identifier) { 695 0 this .identifier = identifier;
+ 696 0 }
697
-
+ 698
- @Override
+ 699
- public String toString() {
- 700 0 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
+ 700
+
701
- + ", confidence=" + confidence + ", identifier=" + identifier + '}' ;
+ 702
- }
+ 703
-
+ 704
-
+ 705
-
+ @Override 706
-
- 707
-
+ public String toString() { 707 0 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
708
-
+ + ", confidence=" + confidence + ", identifier=" + identifier + '}' ; 709
- @Override
- 710
- public int hashCode() {
- 711 0 int hash = 5;
- 712 0 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
- 713 0 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
- 714 0 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
- 715 0 return hash;
- 716
}
- 717
+ 710
- 718
+ 711
- 719
-
- 720
+ 712
+
+ 713
- 721
-
- 722
-
- 723
+ 714
+
+ 715
- 724
+ 716
@Override
+ 717
+ public int hashCode() {
+ 718 0 int hash = 5;
+ 719 0 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
+ 720 0 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
+ 721 0 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
+ 722 0 return hash;
+ 723
+ }
+ 724
+
725
- public boolean equals(Object obj) {
- 726 0 if (obj == null ) {
- 727 0 return false ;
+ 726
+
+ 727
+
728
- }
- 729 0 if (getClass() != obj.getClass()) {
- 730 0 return false ;
+ 729
+
+ 730
+
731
- }
- 732 0 final IdentifierMatch other = (IdentifierMatch) obj;
- 733 0 if (this .evidenceConfidence != other.evidenceConfidence) {
+ @Override 732
+ public boolean equals(Object obj) {
+ 733 0 if (obj == null ) {
734 0 return false ;
735
}
- 736 0 if (this .confidence != other.confidence) {
+ 736 0 if (getClass() != obj.getClass()) {
737 0 return false ;
738
}
- 739 0 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
- 740 0 return false ;
- 741
+ 739 0 final IdentifierMatch other = (IdentifierMatch) obj;
+ 740 0 if (this .evidenceConfidence != other.evidenceConfidence) {
+ 741 0 return false ;
+ 742
}
- 742 0 return true ;
- 743
- }
- 744
-
+ 743 0 if (this .confidence != other.confidence) {
+ 744 0 return false ;
745
-
- 746
-
- 747
-
- 748
-
- 749
-
- 750
-
- 751
-
- 752
- @Override
- 753
- public int compareTo(IdentifierMatch o) {
- 754 8 int conf = this .confidence.compareTo(o.confidence);
- 755 8 if (conf == 0) {
- 756 6 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
- 757 6 if (conf == 0) {
- 758 2 conf = identifier.compareTo(o.identifier);
- 759
- }
- 760
}
- 761 8 return conf;
- 762
+ 746 0 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
+ 747 0 return false ;
+ 748
+ }
+ 749 0 return true ;
+ 750
}
- 763
+ 751
+
+ 752
+
+ 753
+
+ 754
+
+ 755
+
+ 756
+
+ 757
+
+ 758
+
+ 759
+ @Override
+ 760
+ public int compareTo(IdentifierMatch o) {
+ 761 8 int conf = this .confidence.compareTo(o.confidence);
+ 762 8 if (conf == 0) {
+ 763 6 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
+ 764 6 if (conf == 0) {
+ 765 2 conf = identifier.compareTo(o.identifier);
+ 766
+ }
+ 767
+ }
+ 768 8 return conf;
+ 769
+ }
+ 770
}
- 764
+ 771
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CentralAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CentralAnalyzer.html
index 3e5ee81ec..3f0c1c0ed 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CentralAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CentralAnalyzer.html
@@ -12,7 +12,7 @@
@@ -219,7 +219,7 @@
104
try {
105 4 if (Settings.getBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED)) {
-
106 3 if (!Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)
+
106 3 if (!Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)
107
|| NexusAnalyzer.DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL))) {
108 3 LOGGER.debug("Enabling the Central analyzer" );
@@ -371,7 +371,7 @@
192 0 final List<MavenArtifact> mas = searcher.searchSha1(dependency.getSha1sum());
193 0 final Confidence confidence = mas.size() > 1 ? Confidence.HIGH : Confidence.HIGHEST;
194 0 for (MavenArtifact ma : mas) {
-
195 0 LOGGER.debug("Central analyzer found artifact ({}) for dependency ({})" , ma.toString(), dependency.getFileName());
+
195 0 LOGGER.debug("Central analyzer found artifact ({}) for dependency ({})" , ma, dependency.getFileName());
196 0 dependency.addAsEvidence("central" , ma, confidence);
197 0 boolean pomAnalyzed = false ;
198 0 for (Evidence e : dependency.getVendorEvidence()) {
@@ -429,6 +429,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ComposerLockAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ComposerLockAnalyzer.html
index a19e8c4cb..766b727c7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ComposerLockAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ComposerLockAnalyzer.html
@@ -306,6 +306,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
index ac78298c1..470eaf4c2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
@@ -152,13 +152,13 @@
70
71 2 for (final SuppressionRule rule : getRules()) {
-
72 40 rule.process(dependency);
-
73 40 }
+
72 48 rule.process(dependency);
+
73 48 }
74 2 }
75
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
index 16361e26a..cd5d6efb7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
@@ -12,7 +12,7 @@
@@ -382,355 +382,352 @@
214 0 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
215 0 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
-
216 0 if (version1 != null && version2 != null ) {
-
217 0 if (!version1.equals(version2)) {
-
218 0 return false ;
+
216 0 if (version1 != null && version2 != null && !version1.equals(version2)) {
+
217 0 return false ;
+
218
+ }
219
- }
+
220
- }
-
221
-
-
222
-
223 0 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
-
224 0 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
-
225 0 if (match1.find() && match2.find()) {
-
226 0 return match1.group().equals(match2.group());
-
227
+ 221 0 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
+
222 0 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
+
223 0 if (match1.find() && match2.find()) {
+
224 0 return match1.group().equals(match2.group());
+
225
}
+
226
+
+
227 0 return false ;
228
+ }
+
229
-
229 0 return false ;
230
- }
+
231
-
-
232
-
-
233
-
234
+ 232
-
235
+ 233
-
236
+ 234
-
237
+ 235
-
238
+ 236
-
239
+ 237
private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
-
240 1 if (dependency1 == null || dependency1.getIdentifiers() == null
-
241
+ 238 1 if (dependency1 == null || dependency1.getIdentifiers() == null
+
239
|| dependency2 == null || dependency2.getIdentifiers() == null ) {
-
242 0 return false ;
-
243
+ 240 0 return false ;
+
241
}
-
244 1 boolean matches = false ;
-
245 1 int cpeCount1 = 0;
-
246 1 int cpeCount2 = 0;
-
247 1 for (Identifier i : dependency1.getIdentifiers()) {
-
248 0 if ("cpe" .equals(i.getType())) {
-
249 0 cpeCount1 += 1;
-
250
+ 242 1 boolean matches = false ;
+
243 1 int cpeCount1 = 0;
+
244 1 int cpeCount2 = 0;
+
245 1 for (Identifier i : dependency1.getIdentifiers()) {
+
246 0 if ("cpe" .equals(i.getType())) {
+
247 0 cpeCount1 += 1;
+
248
}
-
251 0 }
-
252 1 for (Identifier i : dependency2.getIdentifiers()) {
-
253 3 if ("cpe" .equals(i.getType())) {
-
254 3 cpeCount2 += 1;
-
255
+ 249 0 }
+
250 1 for (Identifier i : dependency2.getIdentifiers()) {
+
251 2 if ("cpe" .equals(i.getType())) {
+
252 2 cpeCount2 += 1;
+
253
}
-
256 3 }
-
257 1 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
-
258 0 for (Identifier i : dependency1.getIdentifiers()) {
-
259 0 if ("cpe" .equals(i.getType())) {
-
260 0 matches |= dependency2.getIdentifiers().contains(i);
-
261 0 if (!matches) {
-
262 0 break ;
-
263
+ 254 2 }
+
255 1 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
+
256 0 for (Identifier i : dependency1.getIdentifiers()) {
+
257 0 if ("cpe" .equals(i.getType())) {
+
258 0 matches |= dependency2.getIdentifiers().contains(i);
+
259 0 if (!matches) {
+
260 0 break ;
+
261
}
-
264
+ 262
}
-
265 0 }
-
266
+ 263 0 }
+
264
}
-
267 1 LOGGER.debug("IdentifiersMatch={} ({}, {})" , matches, dependency1.getFileName(), dependency2.getFileName());
-
268 1 return matches;
+
265 1 LOGGER.debug("IdentifiersMatch={} ({}, {})" , matches, dependency1.getFileName(), dependency2.getFileName());
+
266 1 return matches;
+
267
+ }
+
268
+
269
- }
+
270
-
-
271
-
-
272
-
273
+ 271
-
274
+ 272
-
275
+ 273
-
276
+ 274
-
277
+ 275
-
278
+ 276
private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
-
279 0 if (dependency1 == null || dependency2 == null ) {
-
280 0 return false ;
-
281
+ 277 0 if (dependency1 == null || dependency2 == null ) {
+
278 0 return false ;
+
279
}
-
282 0 final File lFile = new File(dependency1.getFilePath());
-
283 0 String left = lFile.getParent();
-
284 0 final File rFile = new File(dependency2.getFilePath());
-
285 0 String right = rFile.getParent();
-
286 0 if (left == null ) {
-
287 0 return right == null ;
-
288
+ 280 0 final File lFile = new File(dependency1.getFilePath());
+
281 0 String left = lFile.getParent();
+
282 0 final File rFile = new File(dependency2.getFilePath());
+
283 0 String right = rFile.getParent();
+
284 0 if (left == null ) {
+
285 0 return right == null ;
+
286
}
-
289 0 if (left.equalsIgnoreCase(right)) {
-
290 0 return true ;
-
291
+ 287 0 if (left.equalsIgnoreCase(right)) {
+
288 0 return true ;
+
289
}
-
292 0 if (left.matches(".*[/\\\\]repository[/\\\\].*" ) && right.matches(".*[/\\\\]repository[/\\\\].*" )) {
-
293 0 left = getBaseRepoPath(left);
-
294 0 right = getBaseRepoPath(right);
-
295
+ 290 0 if (left.matches(".*[/\\\\]repository[/\\\\].*" ) && right.matches(".*[/\\\\]repository[/\\\\].*" )) {
+
291 0 left = getBaseRepoPath(left);
+
292 0 right = getBaseRepoPath(right);
+
293
}
-
296 0 if (left.equalsIgnoreCase(right)) {
-
297 0 return true ;
-
298
+ 294 0 if (left.equalsIgnoreCase(right)) {
+
295 0 return true ;
+
296
}
-
299
+ 297
-
300 0 for (Dependency child : dependency2.getRelatedDependencies()) {
-
301 0 if (hasSameBasePath(dependency1, child)) {
-
302 0 return true ;
-
303
+ 298 0 for (Dependency child : dependency2.getRelatedDependencies()) {
+
299 0 if (hasSameBasePath(dependency1, child)) {
+
300 0 return true ;
+
301
}
-
304 0 }
-
305 0 return false ;
+
302 0 }
+
303 0 return false ;
+
304
+ }
+
305
+
306
- }
+
307
-
-
308
-
-
309
-
310
+ 308
-
311
+ 309
-
312
+ 310
-
313
+ 311
-
314
+ 312
-
315
+ 313
-
316
+ 314
boolean isCore(Dependency left, Dependency right) {
-
317 2 final String leftName = left.getFileName().toLowerCase();
-
318 2 final String rightName = right.getFileName().toLowerCase();
-
319
+ 315 2 final String leftName = left.getFileName().toLowerCase();
+
316 2 final String rightName = right.getFileName().toLowerCase();
+
317
-
320
+ 318
final boolean returnVal;
-
321 2 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
-
322
+ 319 2 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+
320
|| rightName.contains("core" ) && !leftName.contains("core" )
-
323
+ 321
|| rightName.contains("kernel" ) && !leftName.contains("kernel" )) {
-
324 0 returnVal = false ;
-
325 2 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
-
326
+ 322 0 returnVal = false ;
+
323 2 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+
324
|| !rightName.contains("core" ) && leftName.contains("core" )
-
327
+ 325
|| !rightName.contains("kernel" ) && leftName.contains("kernel" )) {
-
328 2 returnVal = true ;
-
329
+ 326 2 returnVal = true ;
+
327
-
330
+ 328
-
331
+ 329
-
332
+ 330
-
333
+ 331
} else {
-
334
+ 332
-
335
+ 333
-
336
+ 334
-
337
+ 335
-
338
+ 336
-
339
+ 337
-
340
+ 338
-
341
+ 339
-
342
+ 340
-
343 0 returnVal = leftName.length() <= rightName.length();
-
344
+ 341 0 returnVal = leftName.length() <= rightName.length();
+
342
}
-
345 2 LOGGER.debug("IsCore={} ({}, {})" , returnVal, left.getFileName(), right.getFileName());
-
346 2 return returnVal;
+
343 2 LOGGER.debug("IsCore={} ({}, {})" , returnVal, left.getFileName(), right.getFileName());
+
344 2 return returnVal;
+
345
+ }
+
346
+
347
- }
+
348
-
-
349
-
-
350
-
351
+ 349
-
352
+ 350
-
353
+ 351
-
354
+ 352
-
355
+ 353
-
356
+ 354
private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
-
357 1 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
-
358 0 return false ;
+
355 1 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
+
356 0 return false ;
+
357
+ }
+
358 1 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
359
- }
-
360 1 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
+
}
+
360
+
361
- }
+
362
-
-
363
-
-
364
-
365
+ 363
-
366
+ 364
-
367
+ 365
-
368
+ 366
-
369
+ 367
-
370
+ 368
-
371
+ 369
private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
-
372 1 final String mainName = dependency.getFileName().toLowerCase();
-
373 1 final String nextName = nextDependency.getFileName().toLowerCase();
-
374 1 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
-
375 0 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
-
376 1 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
-
377 0 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
+
370 1 final String mainName = dependency.getFileName().toLowerCase();
+
371 1 final String nextName = nextDependency.getFileName().toLowerCase();
+
372 1 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
+
373 0 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
+
374 1 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
+
375 0 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
+
376
+ }
+
377 1 return false ;
378
- }
-
379 1 return false ;
+
}
+
379
+
380
- }
+
381
-
-
382
-
-
383
-
384
+ 382
-
385
+ 383
-
386
+ 384
-
387
+ 385
-
388
+ 386
-
389
+ 387
-
390
+ 388
protected boolean firstPathIsShortest(String left, String right) {
-
391 5 final String leftPath = left.replace('\\' , '/' );
-
392 5 final String rightPath = right.replace('\\' , '/' );
-
393
+ 389 5 final String leftPath = left.replace('\\' , '/' );
+
390 5 final String rightPath = right.replace('\\' , '/' );
+
391
-
394 5 final int leftCount = countChar(leftPath, '/' );
-
395 5 final int rightCount = countChar(rightPath, '/' );
-
396 5 if (leftCount == rightCount) {
-
397 3 return leftPath.compareTo(rightPath) <= 0;
-
398
+ 392 5 final int leftCount = countChar(leftPath, '/' );
+
393 5 final int rightCount = countChar(rightPath, '/' );
+
394 5 if (leftCount == rightCount) {
+
395 3 return leftPath.compareTo(rightPath) <= 0;
+
396
} else {
-
399 2 return leftCount < rightCount;
+
397 2 return leftCount < rightCount;
+
398
+ }
+
399
+ }
400
- }
+
401
- }
+
402
-
-
403
-
-
404
-
405
+ 403
-
406
+ 404
-
407
+ 405
-
408
+ 406
-
409
+ 407
-
410
+ 408
private int countChar(String string, char c) {
-
411 10 int count = 0;
-
412 10 final int max = string.length();
-
413 116 for (int i = 0; i < max; i++) {
-
414 106 if (c == string.charAt(i)) {
-
415 28 count++;
-
416
+ 409 10 int count = 0;
+
410 10 final int max = string.length();
+
411 116 for (int i = 0; i < max; i++) {
+
412 106 if (c == string.charAt(i)) {
+
413 28 count++;
+
414
}
-
417
+ 415
}
-
418 10 return count;
-
419
+ 416 10 return count;
+
417
}
-
420
+ 418
-
421
+ 419
-
422
+ 420
-
423
+ 421
-
424
+ 422
-
425
+ 423
-
426
+ 424
-
427
+ 425
private boolean containedInWar(String filePath) {
-
428 0 return filePath == null ? false : filePath.matches(".*\\.(ear|war)[\\\\/].*" );
-
429
+ 426 0 return filePath == null ? false : filePath.matches(".*\\.(ear|war)[\\\\/].*" );
+
427
}
-
430
+ 428
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
index 92a17a58e..97424d7fa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
@@ -227,9 +227,9 @@
private void removeBadSpringMatches(Dependency dependency) { 112 3 String mustContain = null ;
113 3 for (Identifier i : dependency.getIdentifiers()) {
-
114 3 if ("maven" .contains(i.getType())) {
+
114 2 if ("maven" .contains(i.getType())) {
115 0 if (i.getValue() != null && i.getValue().startsWith("org.springframework." )) {
-
116 0 final int endPoint = i.getValue().indexOf(":" , 19);
+
116 0 final int endPoint = i.getValue().indexOf(':' , 19);
117 0 if (endPoint >= 0) {
118 0 mustContain = i.getValue().substring(19, endPoint).toLowerCase();
119 0 break ;
@@ -239,7 +239,7 @@
} 122
}
-
123 3 }
+
123 2 }
124 3 if (mustContain != null ) {
125 0 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
126 0 while (itr.hasNext()) {
@@ -305,24 +305,24 @@
159 3 final List<Identifier> ids = new ArrayList<Identifier>(dependency.getIdentifiers());
160 3 Collections.sort(ids);
161 3 final ListIterator<Identifier> mainItr = ids.listIterator();
-
162 6 while (mainItr.hasNext()) {
-
163 3 final Identifier currentId = mainItr.next();
-
164 3 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
-
165 3 if (currentCpe == null ) {
+
162 5 while (mainItr.hasNext()) {
+
163 2 final Identifier currentId = mainItr.next();
+
164 2 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
+
165 2 if (currentCpe == null ) {
166 0 continue ;
167
}
-
168 3 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
-
169 6 while (subItr.hasNext()) {
-
170 3 final Identifier nextId = subItr.next();
-
171 3 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
-
172 3 if (nextCpe == null ) {
+
168 2 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
+
169 3 while (subItr.hasNext()) {
+
170 1 final Identifier nextId = subItr.next();
+
171 1 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
+
172 1 if (nextCpe == null ) {
173 0 continue ;
174
}
175
-
176 3 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
+
176 1 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
177 0 if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
178
@@ -353,8 +353,8 @@
} 198
}
-
199 3 }
-
200 3 }
+
199 1 }
+
200 2 }
201 3 }
202
@@ -406,21 +406,21 @@
private void removeJreEntries(Dependency dependency) { 228 3 final Set<Identifier> identifiers = dependency.getIdentifiers();
229 3 final Iterator<Identifier> itr = identifiers.iterator();
-
230 7 while (itr.hasNext()) {
-
231 4 final Identifier i = itr.next();
-
232 4 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
-
233 4 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
-
234 4 if (coreCPE.matches() && !coreFiles.matches()) {
+
230 6 while (itr.hasNext()) {
+
231 3 final Identifier i = itr.next();
+
232 3 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
+
233 3 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
+
234 3 if (coreCPE.matches() && !coreFiles.matches()) {
235 0 itr.remove();
236
}
-
237 4 final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue());
-
238 4 final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName());
-
239 4 if (coreJsfCPE.matches() && !coreJsfFiles.matches()) {
+
237 3 final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue());
+
238 3 final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName());
+
239 3 if (coreJsfCPE.matches() && !coreJsfFiles.matches()) {
240 0 itr.remove();
241
}
-
242 4 }
+
242 3 }
243 3 }
244
@@ -440,19 +440,19 @@
252
private VulnerableSoftware parseCpe(String type, String value) {
-
253 6 if (!"cpe" .equals(type)) {
+
253 3 if (!"cpe" .equals(type)) {
254 0 return null ;
255
}
-
256 6 final VulnerableSoftware cpe = new VulnerableSoftware();
+
256 3 final VulnerableSoftware cpe = new VulnerableSoftware();
257
try {
-
258 6 cpe.parseName(value);
+
258 3 cpe.parseName(value);
259 0 } catch (UnsupportedEncodingException ex) {
260 0 LOGGER.trace("" , ex);
261 0 return null ;
-
262 6 }
-
263 6 return cpe;
+
262 3 }
+
263 3 return cpe;
264
}
265
@@ -489,12 +489,12 @@
282
-
283 7 while (itr.hasNext()) {
-
284 4 final Identifier i = itr.next();
+
283 6 while (itr.hasNext()) {
+
284 3 final Identifier i = itr.next();
285
-
286 4 if ("cpe" .equals(i.getType())) {
-
287 4 if ((i.getValue().matches(".*c\\+\\+.*" )
+
286 3 if ("cpe" .equals(i.getType())) {
+
287 3 if ((i.getValue().matches(".*c\\+\\+.*" )
288
|| i.getValue().startsWith("cpe:/a:file:file" )
289
@@ -536,7 +536,7 @@
307
|| dependency.getFileName().toLowerCase().endsWith(".war" ))) {
308 1 itr.remove();
-
309 3 } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery" )
+
309 2 } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery" )
310
|| i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
311
@@ -550,7 +550,7 @@
315
|| dependency.getFileName().toLowerCase().endsWith(".exe" ))) {
316 0 itr.remove();
-
317 3 } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel" )
+
317 2 } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel" )
318
|| i.getValue().startsWith("cpe:/a:microsoft:word" )
319
@@ -570,15 +570,15 @@
326
|| dependency.getFileName().toLowerCase().endsWith("pom.xml" ))) {
327 0 itr.remove();
-
328 3 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
+
328 2 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
329
&& !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
330 0 itr.remove();
-
331 3 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
+
331 2 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
332
&& !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
333 0 itr.remove();
-
334 3 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
+
334 2 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
335
&& !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar" )) {
336 0 itr.remove();
@@ -586,7 +586,7 @@
} 338
}
-
339 4 }
+
339 3 }
340 3 }
341
@@ -653,7 +653,7 @@
382
383 3 for (final Identifier identifier : dependency.getIdentifiers()) {
-
384 3 if ("cpe" .equals(identifier.getType()) && identifier.getValue() != null
+
384 2 if ("cpe" .equals(identifier.getType()) && identifier.getValue() != null
385
&& (identifier.getValue().startsWith("cpe:/a:oracle:opensso:" )
386
@@ -693,7 +693,7 @@
408 0 }
409
}
-
410 3 }
+
410 2 }
411 3 }
412
@@ -796,8 +796,8 @@
private String trimCpeToVendor(String value) { 474
-
475 0 final int pos1 = value.indexOf(":" , 7);
-
476 0 final int pos2 = value.indexOf(":" , pos1 + 1);
+
475 0 final int pos1 = value.indexOf(':' , 7);
+
476 0 final int pos2 = value.indexOf(':' , pos1 + 1);
477 0 if (pos2 < 0) {
478 0 return value;
479
@@ -811,6 +811,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
index 4b71f8ab1..d8a86beae 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
@@ -12,7 +12,7 @@
@@ -58,180 +58,173 @@
20
import java.io.File;
21
- import org.owasp.dependencycheck.Engine;
+
import org.apache.commons.io.FilenameUtils; 22
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+
import org.owasp.dependencycheck.Engine; 23
- import org.owasp.dependencycheck.dependency.Confidence;
+
import org.owasp.dependencycheck.analyzer.exception.AnalysisException; 24
- import org.owasp.dependencycheck.dependency.Dependency;
+
import org.owasp.dependencycheck.dependency.Confidence; 25
- import org.owasp.dependencycheck.utils.DependencyVersion;
+
import org.owasp.dependencycheck.dependency.Dependency; 26
- import org.owasp.dependencycheck.utils.DependencyVersionUtil;
+
import org.owasp.dependencycheck.utils.DependencyVersion; 27
-
+
import org.owasp.dependencycheck.utils.DependencyVersionUtil; 28
-
+
29
-
+
30
-
-
31
+
31
+
32
-
+
33
+
+
34
-
34 9 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
-
35
-
+
35 9 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
36
-
+
37
-
+
38
-
+
39
-
+
40
- private static final String ANALYZER_NAME = "File Name Analyzer" ;
+
41
-
+
private static final String ANALYZER_NAME = "File Name Analyzer" ; 42
-
+
43
+
+
44
-
44 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-
45
-
+
45 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
46
-
+
47
-
+
48
-
+
49
-
+
50
-
+
51
- @Override
+
52
+ @Override
+
53
public String getName() {
-
53 5 return ANALYZER_NAME;
-
54
- }
+
54 5 return ANALYZER_NAME;
55
-
-
56
-
-
57
-
-
58
-
-
59
-
-
60
-
-
61
- @Override
-
62
- public AnalysisPhase getAnalysisPhase() {
-
63 4 return ANALYSIS_PHASE;
-
64
}
-
65
-
-
66
+ 56
-
67
+ 57
-
68
-
-
69
+ 58
+
+
59
-
70
-
-
71
-
-
72
-
-
73
+ 60
+
+
61
-
74
+ 62
@Override
+
63
+ public AnalysisPhase getAnalysisPhase() {
+
64 4 return ANALYSIS_PHASE;
+
65
+ }
+
66
+
+
67
+
+
68
+
+
69
+
+
70
+
+
71
+
+
72
+
+
73
+
+
74
+
75
- public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
+
@Override 76
-
+
public void analyze(Dependency dependency, Engine engine) throws AnalysisException { 77
+
+
78
-
78 4 final File f = dependency.getActualFile();
-
79 4 String fileName = f.getName();
-
80
-
+
79 4 final File f = dependency.getActualFile();
+
80 4 final String fileName = FilenameUtils.removeExtension(f.getName());
81
-
-
82 4 final int pos = fileName.lastIndexOf("." );
-
83 4 if (pos > 0) {
-
84 4 fileName = fileName.substring(0, pos);
-
85
- }
-
86
-
87
+ 82
-
88 4 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
-
89 4 if (version != null ) {
-
90
+ 83 4 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
+
84 4 if (version != null ) {
+
85
-
91
+ 86
-
92
+ 87
-
93 4 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
-
94 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
-
95
+ 88 4 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
+
89 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+
90
version.toString(), Confidence.MEDIUM);
-
96
+ 91
} else {
-
97 4 dependency.getVersionEvidence().addEvidence("file" , "name" ,
-
98
+ 92 4 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+
93
version.toString(), Confidence.HIGHEST);
-
99
+ 94
}
-
100 4 dependency.getVersionEvidence().addEvidence("file" , "name" ,
-
101
+ 95 4 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+
96
fileName, Confidence.MEDIUM);
-
102
+ 97
}
-
103
+ 98
-
104
+ 99
-
105 4 if (fileName.contains("-" )) {
-
106 4 dependency.getProductEvidence().addEvidence("file" , "name" ,
-
107
+ 100 4 if (fileName.contains("-" )) {
+
101 4 dependency.getProductEvidence().addEvidence("file" , "name" ,
+
102
fileName, Confidence.HIGHEST);
-
108 4 dependency.getVendorEvidence().addEvidence("file" , "name" ,
-
109
+ 103 4 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+
104
fileName, Confidence.HIGHEST);
-
110
+ 105
} else {
-
111 0 dependency.getProductEvidence().addEvidence("file" , "name" ,
-
112
+ 106 0 dependency.getProductEvidence().addEvidence("file" , "name" ,
+
107
fileName, Confidence.HIGH);
-
113 0 dependency.getVendorEvidence().addEvidence("file" , "name" ,
-
114
+ 108 0 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+
109
fileName, Confidence.HIGH);
-
115
+ 110
}
-
116 4 }
-
117
+ 111 4 }
+
112
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
index 0f2c58acc..dd8c40254 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
@@ -85,6 +85,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html
index 147f10c60..6b2aceefd 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html
@@ -322,6 +322,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
index 21bcef9e1..f317239ea 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
@@ -12,7 +12,7 @@
@@ -107,418 +107,419 @@
44
import org.apache.commons.compress.utils.IOUtils;
45
- import org.jsoup.Jsoup;
+
import org.apache.commons.io.FilenameUtils; 46
- import org.owasp.dependencycheck.Engine;
+
import org.jsoup.Jsoup; 47
- import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+
import org.owasp.dependencycheck.Engine; 48
- import org.owasp.dependencycheck.dependency.Confidence;
+
import org.owasp.dependencycheck.analyzer.exception.AnalysisException; 49
- import org.owasp.dependencycheck.dependency.Dependency;
+
import org.owasp.dependencycheck.dependency.Confidence; 50
- import org.owasp.dependencycheck.dependency.EvidenceCollection;
+
import org.owasp.dependencycheck.dependency.Dependency; 51
- import org.owasp.dependencycheck.utils.FileFilterBuilder;
+
import org.owasp.dependencycheck.dependency.EvidenceCollection; 52
- import org.owasp.dependencycheck.xml.pom.License;
+
import org.owasp.dependencycheck.utils.FileFilterBuilder; 53
- import org.owasp.dependencycheck.xml.pom.PomUtils;
+
import org.owasp.dependencycheck.xml.pom.License; 54
- import org.owasp.dependencycheck.xml.pom.Model;
+
import org.owasp.dependencycheck.xml.pom.PomUtils; 55
- import org.owasp.dependencycheck.utils.FileUtils;
+
import org.owasp.dependencycheck.xml.pom.Model; 56
- import org.owasp.dependencycheck.utils.Settings;
+
import org.owasp.dependencycheck.utils.FileUtils; 57
- import org.slf4j.Logger;
+
import org.owasp.dependencycheck.utils.Settings; 58
- import org.slf4j.LoggerFactory;
+
import org.slf4j.Logger; 59
-
+
import org.slf4j.LoggerFactory; 60
-
+
61
-
+
62
-
+
63
-
+
64
-
+
65
- public class JarAnalyzer extends AbstractFileTypeAnalyzer {
+
66
-
+
public class JarAnalyzer extends AbstractFileTypeAnalyzer { 67
-
+
68
-
+
69
-
+
70
+
+
71
-
71 1 private static final Logger LOGGER = LoggerFactory.getLogger(JarAnalyzer.class );
-
72
-
+
72 1 private static final Logger LOGGER = LoggerFactory.getLogger(JarAnalyzer.class );
73
-
+
74
+
+
75
-
75 1 private static int dirCount = 0;
-
76
-
+
76 1 private static int dirCount = 0;
77
-
+
78
+
+
79
-
79 1 private static final String NEWLINE = System.getProperty("line.separator" );
-
80
-
+
80 1 private static final String NEWLINE = System.getProperty("line.separator" );
81
-
+
82
+
+
83
-
83 1 private static final Set<String> IGNORE_VALUES = newHashSet(
-
84
- "Sun Java System Application Server" );
+
84 1 private static final Set<String> IGNORE_VALUES = newHashSet(
85
-
+
"Sun Java System Application Server" ); 86
-
+
87
+
+
88
-
88 1 private static final Set<String> IGNORE_KEYS = newHashSet(
-
89
- "built-by" ,
+
89 1 private static final Set<String> IGNORE_KEYS = newHashSet(
90
- "created-by" ,
+
"built-by" , 91
- "builtby" ,
+
"created-by" , 92
- "createdby" ,
+
"builtby" , 93
- "build-jdk" ,
+
"createdby" , 94
- "buildjdk" ,
+
"build-jdk" , 95
- "ant-version" ,
+
"buildjdk" , 96
- "antversion" ,
+
"ant-version" , 97
- "dynamicimportpackage" ,
+
"antversion" , 98
- "dynamicimport-package" ,
+
"dynamicimportpackage" , 99
- "dynamic-importpackage" ,
+
"dynamicimport-package" , 100
- "dynamic-import-package" ,
+
"dynamic-importpackage" , 101
- "import-package" ,
+
"dynamic-import-package" , 102
- "ignore-package" ,
+
"import-package" , 103
- "export-package" ,
+
"ignore-package" , 104
- "importpackage" ,
+
"export-package" , 105
- "ignorepackage" ,
+
"importpackage" , 106
- "exportpackage" ,
+
"ignorepackage" , 107
- "sealed" ,
+
"exportpackage" , 108
- "manifest-version" ,
+
"sealed" , 109
- "archiver-version" ,
+
"manifest-version" , 110
- "manifestversion" ,
+
"archiver-version" , 111
- "archiverversion" ,
+
"manifestversion" , 112
- "classpath" ,
+
"archiverversion" , 113
- "class-path" ,
+
"classpath" , 114
- "tool" ,
+
"class-path" , 115
- "bundle-manifestversion" ,
+
"tool" , 116
- "bundlemanifestversion" ,
+
"bundle-manifestversion" , 117
- "bundle-vendor" ,
+
"bundlemanifestversion" , 118
- "include-resource" ,
+
"bundle-vendor" , 119
- "embed-dependency" ,
+
"include-resource" , 120
- "ipojo-components" ,
+
"embed-dependency" , 121
- "ipojo-extension" ,
+
"ipojo-components" , 122
- "eclipse-sourcereferences" );
+
"ipojo-extension" , 123
-
+
"eclipse-sourcereferences" ); 124
-
+
125
-
+
126
+
+
127
@SuppressWarnings("deprecation" )
-
127 1 private static final String IMPLEMENTATION_VENDOR_ID = Attributes.Name.IMPLEMENTATION_VENDOR_ID
-
128
- .toString();
+
128 1 private static final String IMPLEMENTATION_VENDOR_ID = Attributes.Name.IMPLEMENTATION_VENDOR_ID
129
-
+
.toString(); 130
-
+
131
-
+
132
- private static final String BUNDLE_VERSION = "Bundle-Version" ;
+
133
-
+
private static final String BUNDLE_VERSION = "Bundle-Version" ; 134
-
+
135
-
-
136
- private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
-
137
-
-
138
+
136
+
+
137
+ private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
+
138
+
139
-
+
140
- private static final String BUNDLE_NAME = "Bundle-Name" ;
+
141
-
+
private static final String BUNDLE_NAME = "Bundle-Name" ; 142
-
+
143
+
+
144
-
144 1 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
-
145
-
+
145 1 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
146
-
+
147
-
-
148
-
-
149
-
-
150 7 public JarAnalyzer() {
-
151 7 }
-
152
-
-
153
-
-
154
-
-
155
-
-
156
-
-
157
- private static final String ANALYZER_NAME = "Jar Analyzer" ;
-
158
-
-
159
-
-
160
-
-
161 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-
162
-
-
163
-
-
164
-
-
165 1 private static final String[] EXTENSIONS = {"jar" , "war" };
-
166
-
-
167
-
-
168
-
-
169
-
-
170 1 private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(EXTENSIONS).build();
-
171
-
-
172
-
-
173
-
-
174
-
-
175
-
-
176
-
-
177
- @Override
-
178
- protected FileFilter getFileFilter() {
-
179 855 return FILTER;
-
180
- }
-
181
-
-
182
-
-
183
-
-
184
-
-
185
-
-
186
-
-
187
- @Override
-
188
- public String getName() {
-
189 5 return ANALYZER_NAME;
-
190
- }
-
191
-
-
192
-
-
193
-
-
194
-
-
195
-
-
196
-
-
197
- @Override
-
198
- public AnalysisPhase getAnalysisPhase() {
-
199 3 return ANALYSIS_PHASE;
-
200
- }
-
201
-
202
-
-
203
+ 148
-
204
-
-
205
-
-
206
-
-
207
+ 149
+
+
150
-
208
+ 151 7 public JarAnalyzer() {
+
152 7 }
+
153
+
+
154
+
+
155
+
+
156
+
+
157
+
+
158
+ private static final String ANALYZER_NAME = "Jar Analyzer" ;
+
159
+
+
160
+
+
161
+
+
162 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+
163
+
+
164
+
+
165
+
+
166 1 private static final String[] EXTENSIONS = {"jar" , "war" };
+
167
+
+
168
+
+
169
+
+
170
+
+
171 1 private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(EXTENSIONS).build();
+
172
+
+
173
+
+
174
+
+
175
+
+
176
+
+
177
+
+
178
@Override
-
209
- protected String getAnalyzerEnabledSettingKey() {
-
210 7 return Settings.KEYS.ANALYZER_JAR_ENABLED;
-
211
+ 179
+ protected FileFilter getFileFilter() {
+
180 855 return FILTER;
+
181
}
-
212
+ 182
-
213
+ 183
-
214
-
-
215
-
-
216
+ 184
+
+
185
-
217
-
-
218
-
-
219
-
-
220
+ 186
+
+
187
-
221
+ 188
@Override
-
222
- public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
-
223
- try {
-
224 5 final List<ClassNameInformation> classNames = collectClassNames(dependency);
-
225 5 final String fileName = dependency.getFileName().toLowerCase();
-
226 5 if (classNames.isEmpty()
-
227
- && (fileName.endsWith("-sources.jar" )
-
228
- || fileName.endsWith("-javadoc.jar" )
-
229
- || fileName.endsWith("-src.jar" )
-
230
- || fileName.endsWith("-doc.jar" ))) {
-
231 0 engine.getDependencies().remove(dependency);
-
232
- }
-
233 5 final boolean hasManifest = parseManifest(dependency, classNames);
-
234 5 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
-
235 5 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
-
236 5 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
-
237 0 } catch (IOException ex) {
-
238 0 throw new AnalysisException("Exception occurred reading the JAR file." , ex);
-
239 5 }
-
240 5 }
-
241
+ 189
+ public String getName() {
+
190 5 return ANALYZER_NAME;
+
191
+ }
+
192
-
242
+ 193
-
243
-
-
244
-
-
245
+ 194
+
+
195
-
246
-
-
247
-
-
248
-
-
249
-
-
250
-
-
251
+ 196
+
+
197
+
198
+ @Override
+
199
+ public AnalysisPhase getAnalysisPhase() {
+
200 3 return ANALYSIS_PHASE;
+
201
+ }
+
202
+
+
203
+
+
204
+
+
205
+
+
206
+
+
207
+
+
208
+
+
209
+ @Override
+
210
+ protected String getAnalyzerEnabledSettingKey() {
+
211 7 return Settings.KEYS.ANALYZER_JAR_ENABLED;
+
212
+ }
+
213
+
+
214
+
+
215
+
+
216
+
+
217
+
+
218
+
+
219
+
+
220
+
+
221
+
+
222
+ @Override
+
223
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+
224
+ try {
+
225 5 final List<ClassNameInformation> classNames = collectClassNames(dependency);
+
226 5 final String fileName = dependency.getFileName().toLowerCase();
+
227 5 if (classNames.isEmpty()
+
228
+ && (fileName.endsWith("-sources.jar" )
+
229
+ || fileName.endsWith("-javadoc.jar" )
+
230
+ || fileName.endsWith("-src.jar" )
+
231
+ || fileName.endsWith("-doc.jar" ))) {
+
232 0 engine.getDependencies().remove(dependency);
+
233
+ }
+
234 5 final boolean hasManifest = parseManifest(dependency, classNames);
+
235 5 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
+
236 5 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
+
237 5 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
+
238 0 } catch (IOException ex) {
+
239 0 throw new AnalysisException("Exception occurred reading the JAR file." , ex);
+
240 5 }
+
241 5 }
+
242
+
+
243
+
+
244
+
+
245
+
+
246
+
+
247
+
+
248
+
+
249
+
+
250
+
+
251
+
252
+
+
253
protected boolean analyzePOM(Dependency dependency, List<ClassNameInformation> classes, Engine engine) throws AnalysisException {
-
253 5 boolean foundSomething = false ;
-
254
- final JarFile jar;
+
254 5 boolean foundSomething = false ;
255
+ final JarFile jar;
+
256
try {
-
256 5 jar = new JarFile(dependency.getActualFilePath());
-
257 0 } catch (IOException ex) {
-
258 0 LOGGER.warn("Unable to read JarFile '{}'." , dependency.getActualFilePath());
-
259 0 LOGGER.trace("" , ex);
-
260 0 return false ;
-
261 5 }
-
262
- List<String> pomEntries;
+
257 5 jar = new JarFile(dependency.getActualFilePath());
+
258 0 } catch (IOException ex) {
+
259 0 LOGGER.warn("Unable to read JarFile '{}'." , dependency.getActualFilePath());
+
260 0 LOGGER.trace("" , ex);
+
261 0 return false ;
+
262 5 }
263
+ List<String> pomEntries;
+
264
try {
-
264 5 pomEntries = retrievePomListing(jar);
-
265 0 } catch (IOException ex) {
-
266 0 LOGGER.warn("Unable to read Jar file entries in '{}'." , dependency.getActualFilePath());
-
267 0 LOGGER.trace("" , ex);
-
268 0 return false ;
-
269 5 }
-
270 5 File externalPom = null ;
-
271 5 if (pomEntries.isEmpty()) {
-
272 4 String pomPath = dependency.getActualFilePath();
-
273 4 pomPath = pomPath.substring(0, pomPath.lastIndexOf('.' )) + ".pom" ;
+
265 5 pomEntries = retrievePomListing(jar);
+
266 0 } catch (IOException ex) {
+
267 0 LOGGER.warn("Unable to read Jar file entries in '{}'." , dependency.getActualFilePath());
+
268 0 LOGGER.trace("" , ex);
+
269 0 return false ;
+
270 5 }
+
271 5 File externalPom = null ;
+
272 5 if (pomEntries.isEmpty()) {
+
273 4 final String pomPath = FilenameUtils.removeExtension(dependency.getActualFilePath()) + ".pom" ;
274 4 externalPom = new File(pomPath);
275 4 if (externalPom.isFile()) {
276 0 pomEntries.add(pomPath);
@@ -1884,6 +1885,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
index c8942b28b..2a8e3d6f8 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
@@ -224,7 +224,7 @@
105 4 boolean retval = false ;
106
try {
-
107 4 if ((!DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL)))
+
107 4 if (!DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL))
108
&& Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)) {
109 0 LOGGER.info("Enabling Nexus analyzer" );
@@ -472,6 +472,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.html
index ae26b3af4..f4de4e974 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.html
@@ -343,6 +343,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
index e92268656..a91cc6a0c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
@@ -264,7 +264,7 @@
@Override 128
public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
-
129 0 LOGGER.debug("Checking Nuspec file {}" , dependency.toString());
+
129 0 LOGGER.debug("Checking Nuspec file {}" , dependency);
130
try {
131 0 final NuspecParser parser = new XPathNuspecParser();
@@ -312,6 +312,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
index e6d0a5209..61ec85900 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
@@ -160,7 +160,7 @@
75
public boolean isOpen() {
-
76 3 return (cveDB != null );
+
76 3 return cveDB != null ;
77
}
78
@@ -206,18 +206,18 @@
100
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
101 2 for (Identifier id : dependency.getIdentifiers()) {
-
102 3 if ("cpe" .equals(id.getType())) {
+
102 2 if ("cpe" .equals(id.getType())) {
103
try {
-
104 3 final String value = id.getValue();
-
105 3 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
-
106 3 dependency.getVulnerabilities().addAll(vulns);
+
104 2 final String value = id.getValue();
+
105 2 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
+
106 2 dependency.getVulnerabilities().addAll(vulns);
107 0 } catch (DatabaseException ex) {
108 0 throw new AnalysisException(ex);
-
109 3 }
+
109 2 }
110
}
-
111 3 }
+
111 2 }
112 2 for (Identifier id : dependency.getSuppressedIdentifiers()) {
113 0 if ("cpe" .equals(id.getType())) {
114
@@ -292,6 +292,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer.html
index e7c4f11e1..865cc0f9a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer.html
@@ -333,6 +333,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonDistributionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonDistributionAnalyzer.html
index c1689d2a9..d87aa3cd8 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonDistributionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonDistributionAnalyzer.html
@@ -675,6 +675,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonPackageAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonPackageAnalyzer.html
index 5f13f857e..d9f23cfd6 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonPackageAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.PythonPackageAnalyzer.html
@@ -12,7 +12,7 @@
@@ -334,7 +334,7 @@
166
167
-
+
168
169
@@ -350,235 +350,239 @@
175 1 final String parentName = parent.getName();
176 1 boolean found = false ;
177 1 if (INIT_PY_FILTER.accept(file)) {
-
178 4 for (final File sourceFile : parent.listFiles(PY_FILTER)) {
-
179 3 found |= analyzeFileContents(dependency, sourceFile);
-
180
+ 178 1 final File[] fileList = parent.listFiles(PY_FILTER);
+
179 1 if (fileList != null ) {
+
180 4 for (final File sourceFile : fileList) {
+
181 3 found |= analyzeFileContents(dependency, sourceFile);
+
182
+ }
+
183
}
-
181
+ 184
}
-
182 1 if (found) {
-
183 1 dependency.setDisplayFileName(parentName + "/__init__.py" );
-
184 1 dependency.getProductEvidence().addEvidence(file.getName(),
-
185
+ 185 1 if (found) {
+
186 1 dependency.setDisplayFileName(parentName + "/__init__.py" );
+
187 1 dependency.getProductEvidence().addEvidence(file.getName(),
+
188
"PackageName" , parentName, Confidence.MEDIUM);
-
186
- } else {
-
187
-
-
188 0 final List<Dependency> dependencies = new ArrayList<Dependency>(
189
- engine.getDependencies());
-
190 0 dependencies.remove(dependency);
-
191 0 engine.setDependencies(dependencies);
+
} else {
+
190
+
+
191 0 final List<Dependency> dependencies = new ArrayList<Dependency>(
192
- }
-
193 1 }
-
194
-
+
engine.getDependencies());
+
193 0 dependencies.remove(dependency);
+
194 0 engine.setDependencies(dependencies);
195
-
-
196
-
+
}
+
196 1 }
197
-
+
198
-
+
199
-
+
200
-
+
201
-
+
202
-
-
203
-
-
204
- private boolean analyzeFileContents(Dependency dependency, File file)
-
205
- throws AnalysisException {
-
206
- String contents;
-
207
- try {
-
208 3 contents = FileUtils.readFileToString(file).trim();
-
209 0 } catch (IOException e) {
-
210 0 throw new AnalysisException(
-
211
- "Problem occurred while reading dependency file." , e);
-
212 3 }
-
213 3 boolean found = false ;
-
214 3 if (!contents.isEmpty()) {
-
215 3 final String source = file.getName();
-
216 3 found = gatherEvidence(VERSION_PATTERN, contents, source,
-
217
- dependency.getVersionEvidence(), "SourceVersion" ,
-
218
- Confidence.MEDIUM);
-
219 3 found |= addSummaryInfo(dependency, SUMMARY_PATTERN, 4, contents,
-
220
- source, "summary" );
-
221 3 if (INIT_PY_FILTER.accept(file)) {
-
222 1 found |= addSummaryInfo(dependency, MODULE_DOCSTRING, 2,
-
223
- contents, source, "docstring" );
-
224
- }
-
225 3 found |= gatherEvidence(TITLE_PATTERN, contents, source,
-
226
- dependency.getProductEvidence(), "SourceTitle" ,
-
227
- Confidence.LOW);
-
228 3 final EvidenceCollection vendorEvidence = dependency
-
229
- .getVendorEvidence();
-
230 3 found |= gatherEvidence(AUTHOR_PATTERN, contents, source,
-
231
- vendorEvidence, "SourceAuthor" , Confidence.MEDIUM);
-
232 3 found |= gatherHomePageEvidence(URI_PATTERN, vendorEvidence,
-
233
- source, "URL" , contents);
-
234 3 found |= gatherHomePageEvidence(HOMEPAGE_PATTERN,
-
235
- vendorEvidence, source, "HomePage" , contents);
-
236
- }
-
237 3 return found;
-
238
- }
-
239
-
-
240
-
-
241
-
-
242
-
-
243
-
244
-
-
245
-
-
246
-
-
247
-
-
248
-
-
249
-
-
250
-
-
251
- private boolean addSummaryInfo(Dependency dependency, Pattern pattern,
-
252
- int group, String contents, String source, String key) {
-
253 4 final Matcher matcher = pattern.matcher(contents);
-
254 4 final boolean found = matcher.find();
-
255 4 if (found) {
-
256 1 JarAnalyzer.addDescription(dependency, matcher.group(group),
-
257
- source, key);
-
258
- }
-
259 4 return found;
-
260
- }
-
261
-
-
262
-
-
263
-
-
264
-
-
265
-
-
266
-
-
267
-
-
268
-
-
269
-
-
270
-
-
271
-
-
272
- private boolean gatherHomePageEvidence(Pattern pattern,
-
273
- EvidenceCollection evidence, String source, String name,
-
274
- String contents) {
-
275 6 final Matcher matcher = pattern.matcher(contents);
-
276 6 boolean found = false ;
-
277 6 if (matcher.find()) {
-
278 1 final String url = matcher.group(4);
-
279 1 if (UrlStringUtils.isUrl(url)) {
-
280 1 found = true ;
-
281 1 evidence.addEvidence(source, name, url, Confidence.MEDIUM);
-
282
- }
-
283
- }
-
284 6 return found;
-
285
- }
-
286
-
-
287
-
-
288
-
-
289
-
-
290
-
-
291
-
-
292
-
-
293
-
-
294
-
-
295
-
-
296
+ 203
+
+
204
-
297
+ 205
+
+
206
-
298
- private boolean gatherEvidence(Pattern pattern, String contents,
-
299
- String source, EvidenceCollection evidence, String name,
-
300
- Confidence confidence) {
-
301 9 final Matcher matcher = pattern.matcher(contents);
-
302 9 final boolean found = matcher.find();
-
303 9 if (found) {
-
304 3 evidence.addEvidence(source, name, matcher.group(4), confidence);
-
305
+ 207
+ private boolean analyzeFileContents(Dependency dependency, File file)
+
208
+ throws AnalysisException {
+
209
+ String contents;
+
210
+ try {
+
211 3 contents = FileUtils.readFileToString(file).trim();
+
212 0 } catch (IOException e) {
+
213 0 throw new AnalysisException(
+
214
+ "Problem occurred while reading dependency file." , e);
+
215 3 }
+
216 3 boolean found = false ;
+
217 3 if (!contents.isEmpty()) {
+
218 3 final String source = file.getName();
+
219 3 found = gatherEvidence(VERSION_PATTERN, contents, source,
+
220
+ dependency.getVersionEvidence(), "SourceVersion" ,
+
221
+ Confidence.MEDIUM);
+
222 3 found |= addSummaryInfo(dependency, SUMMARY_PATTERN, 4, contents,
+
223
+ source, "summary" );
+
224 3 if (INIT_PY_FILTER.accept(file)) {
+
225 1 found |= addSummaryInfo(dependency, MODULE_DOCSTRING, 2,
+
226
+ contents, source, "docstring" );
+
227
+ }
+
228 3 found |= gatherEvidence(TITLE_PATTERN, contents, source,
+
229
+ dependency.getProductEvidence(), "SourceTitle" ,
+
230
+ Confidence.LOW);
+
231 3 final EvidenceCollection vendorEvidence = dependency
+
232
+ .getVendorEvidence();
+
233 3 found |= gatherEvidence(AUTHOR_PATTERN, contents, source,
+
234
+ vendorEvidence, "SourceAuthor" , Confidence.MEDIUM);
+
235 3 found |= gatherHomePageEvidence(URI_PATTERN, vendorEvidence,
+
236
+ source, "URL" , contents);
+
237 3 found |= gatherHomePageEvidence(HOMEPAGE_PATTERN,
+
238
+ vendorEvidence, source, "HomePage" , contents);
+
239
}
-
306 9 return found;
-
307
+ 240 3 return found;
+
241
}
-
308
+ 242
-
309
- @Override
-
310
- protected String getAnalyzerEnabledSettingKey() {
-
311 7 return Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED;
-
312
+ 243
+
+
244
+
+
245
+
+
246
+
+
247
+
+
248
+
+
249
+
+
250
+
+
251
+
+
252
+
+
253
+
+
254
+ private boolean addSummaryInfo(Dependency dependency, Pattern pattern,
+
255
+ int group, String contents, String source, String key) {
+
256 4 final Matcher matcher = pattern.matcher(contents);
+
257 4 final boolean found = matcher.find();
+
258 4 if (found) {
+
259 1 JarAnalyzer.addDescription(dependency, matcher.group(group),
+
260
+ source, key);
+
261
+ }
+
262 4 return found;
+
263
}
+
264
+
+
265
+
+
266
+
+
267
+
+
268
+
+
269
+
+
270
+
+
271
+
+
272
+
+
273
+
+
274
+
+
275
+ private boolean gatherHomePageEvidence(Pattern pattern,
+
276
+ EvidenceCollection evidence, String source, String name,
+
277
+ String contents) {
+
278 6 final Matcher matcher = pattern.matcher(contents);
+
279 6 boolean found = false ;
+
280 6 if (matcher.find()) {
+
281 1 final String url = matcher.group(4);
+
282 1 if (UrlStringUtils.isUrl(url)) {
+
283 1 found = true ;
+
284 1 evidence.addEvidence(source, name, url, Confidence.MEDIUM);
+
285
+ }
+
286
+ }
+
287 6 return found;
+
288
+ }
+
289
+
+
290
+
+
291
+
+
292
+
+
293
+
+
294
+
+
295
+
+
296
+
+
297
+
+
298
+
+
299
+
+
300
+
+
301
+ private boolean gatherEvidence(Pattern pattern, String contents,
+
302
+ String source, EvidenceCollection evidence, String name,
+
303
+ Confidence confidence) {
+
304 9 final Matcher matcher = pattern.matcher(contents);
+
305 9 final boolean found = matcher.find();
+
306 9 if (found) {
+
307 3 evidence.addEvidence(source, name, matcher.group(4), confidence);
+
308
+ }
+
309 9 return found;
+
310
+ }
+
311
+
+
312
+ @Override
313
+ protected String getAnalyzerEnabledSettingKey() {
+
314 7 return Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED;
+
315
+ }
+
316
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.html
new file mode 100644
index 000000000..1d2f3e007
--- /dev/null
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.html
@@ -0,0 +1,521 @@
+
+
+
+
+
Coverage Report
+
+
+
+
+
Coverage Report - org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.analyzer;
+ 19
+
+ 20
+ import org.apache.commons.io.FileUtils;
+ 21
+ import org.owasp.dependencycheck.Engine;
+ 22
+ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+ 23
+ import org.owasp.dependencycheck.dependency.Confidence;
+ 24
+ import org.owasp.dependencycheck.dependency.Dependency;
+ 25
+ import org.owasp.dependencycheck.dependency.Reference;
+ 26
+ import org.owasp.dependencycheck.dependency.Vulnerability;
+ 27
+ import org.owasp.dependencycheck.utils.FileFilterBuilder;
+ 28
+ import org.owasp.dependencycheck.utils.Settings;
+ 29
+ import org.slf4j.Logger;
+ 30
+ import org.slf4j.LoggerFactory;
+ 31
+
+ 32
+ import java.io.*;
+ 33
+ import java.util.*;
+ 34
+
+ 35
+
+ 36
+
+ 37
+
+ 38
+
+ 39
+
+ 40 7 public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
+ 41
+
+ 42 1 private static final Logger LOGGER = LoggerFactory.getLogger(RubyBundleAuditAnalyzer.class );
+ 43
+
+ 44
+
+ 45
+
+ 46
+
+ 47
+ private static final String ANALYZER_NAME = "Ruby Bundle Audit Analyzer" ;
+ 48
+
+ 49
+
+ 50
+
+ 51
+
+ 52 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_INFORMATION_COLLECTION;
+ 53
+
+ 54 1 private static final FileFilter FILTER =
+ 55
+ FileFilterBuilder.newInstance().addFilenames("Gemfile.lock" ).build();
+ 56
+ public static final String NAME = "Name: " ;
+ 57
+ public static final String VERSION = "Version: " ;
+ 58
+ public static final String ADVISORY = "Advisory: " ;
+ 59
+ public static final String CRITICALITY = "Criticality: " ;
+ 60
+
+ 61
+
+ 62
+
+ 63
+
+ 64
+ @Override
+ 65
+ protected FileFilter getFileFilter() {
+ 66 853 return FILTER;
+ 67
+ }
+ 68
+
+ 69
+
+ 70
+
+ 71
+
+ 72
+
+ 73
+
+ 74
+ private Process launchBundleAudit(File folder) throws AnalysisException {
+ 75 3 if (!folder.isDirectory()) {
+ 76 0 throw new AnalysisException(String.format("%s should have been a directory." , folder.getAbsolutePath()));
+ 77
+ }
+ 78 3 final List<String> args = new ArrayList<String>();
+ 79 3 final String bundleAuditPath = Settings.getString(Settings.KEYS.ANALYZER_BUNDLE_AUDIT_PATH);
+ 80 3 args.add(null == bundleAuditPath ? "bundle-audit" : bundleAuditPath);
+ 81 3 args.add("check" );
+ 82 3 args.add("--verbose" );
+ 83 3 final ProcessBuilder builder = new ProcessBuilder(args);
+ 84 3 builder.directory(folder);
+ 85
+ try {
+ 86 3 return builder.start();
+ 87 3 } catch (IOException ioe) {
+ 88 3 throw new AnalysisException("bundle-audit failure" , ioe);
+ 89
+ }
+ 90
+ }
+ 91
+
+ 92
+
+ 93
+
+ 94
+
+ 95
+
+ 96
+
+ 97
+ @Override
+ 98
+ public void initializeFileTypeAnalyzer() throws Exception {
+ 99
+
+ 100 3 Process process = launchBundleAudit(Settings.getTempDirectory());
+ 101 0 int exitValue = process.waitFor();
+ 102 0 if (0 == exitValue) {
+ 103 0 LOGGER.warn("Unexpected exit code from bundle-audit process. Disabling {}: {}" , ANALYZER_NAME, exitValue);
+ 104 0 setEnabled(false );
+ 105 0 throw new AnalysisException("Unexpected exit code from bundle-audit process." );
+ 106
+ } else {
+ 107 0 BufferedReader reader = null ;
+ 108
+ try {
+ 109 0 reader = new BufferedReader(new InputStreamReader(process.getErrorStream(), "UTF-8" ));
+ 110 0 if (!reader.ready()) {
+ 111 0 LOGGER.warn("Bundle-audit error stream unexpectedly not ready. Disabling " + ANALYZER_NAME);
+ 112 0 setEnabled(false );
+ 113 0 throw new AnalysisException("Bundle-audit error stream unexpectedly not ready." );
+ 114
+ } else {
+ 115 0 final String line = reader.readLine();
+ 116 0 if (!line.contains("Errno::ENOENT" )) {
+ 117 0 LOGGER.warn("Unexpected bundle-audit output. Disabling {}: {}" , ANALYZER_NAME, line);
+ 118 0 setEnabled(false );
+ 119 0 throw new AnalysisException("Unexpected bundle-audit output." );
+ 120
+ }
+ 121
+ }
+ 122
+ } finally {
+ 123 0 if (null != reader) {
+ 124 0 reader.close();
+ 125
+ }
+ 126
+ }
+ 127
+ }
+ 128 0 if (isEnabled()) {
+ 129 0 LOGGER.info(ANALYZER_NAME + " is enabled. It is necessary to manually run \"bundle-audit update\" " +
+ 130
+ "occasionally to keep its database up to date." );
+ 131
+ }
+ 132 0 }
+ 133
+
+ 134
+
+ 135
+
+ 136
+
+ 137
+
+ 138
+
+ 139
+ @Override
+ 140
+ public String getName() {
+ 141 4 return ANALYZER_NAME;
+ 142
+ }
+ 143
+
+ 144
+
+ 145
+
+ 146
+
+ 147
+
+ 148
+
+ 149
+ @Override
+ 150
+ public AnalysisPhase getAnalysisPhase() {
+ 151 3 return ANALYSIS_PHASE;
+ 152
+ }
+ 153
+
+ 154
+
+ 155
+
+ 156
+
+ 157
+
+ 158
+
+ 159
+ @Override
+ 160
+ protected String getAnalyzerEnabledSettingKey() {
+ 161 7 return Settings.KEYS.ANALYZER_BUNDLE_AUDIT_ENABLED;
+ 162
+ }
+ 163
+
+ 164
+
+ 165
+
+ 166
+
+ 167
+
+ 168 7 private boolean needToDisableGemspecAnalyzer = true ;
+ 169
+
+ 170
+ @Override
+ 171
+ protected void analyzeFileType(Dependency dependency, Engine engine)
+ 172
+ throws AnalysisException {
+ 173 0 if (needToDisableGemspecAnalyzer) {
+ 174 0 boolean failed = true ;
+ 175 0 final String className = RubyGemspecAnalyzer.class .getName();
+ 176 0 for (FileTypeAnalyzer analyzer : engine.getFileTypeAnalyzers()) {
+ 177 0 if (analyzer instanceof RubyGemspecAnalyzer) {
+ 178 0 ((RubyGemspecAnalyzer) analyzer).setEnabled(false );
+ 179 0 LOGGER.info("Disabled " + className + " to avoid noisy duplicate results." );
+ 180 0 failed = false ;
+ 181
+ }
+ 182 0 }
+ 183 0 if (failed) {
+ 184 0 LOGGER.warn("Did not find" + className + '.' );
+ 185
+ }
+ 186 0 needToDisableGemspecAnalyzer = false ;
+ 187
+ }
+ 188 0 final File parentFile = dependency.getActualFile().getParentFile();
+ 189 0 final Process process = launchBundleAudit(parentFile);
+ 190
+ try {
+ 191 0 process.waitFor();
+ 192 0 } catch (InterruptedException ie) {
+ 193 0 throw new AnalysisException("bundle-audit process interrupted" , ie);
+ 194 0 }
+ 195 0 BufferedReader rdr = null ;
+ 196
+ try {
+ 197 0 rdr = new BufferedReader(new InputStreamReader(process.getInputStream(), "UTF-8" ));
+ 198 0 processBundlerAuditOutput(dependency, engine, rdr);
+ 199 0 } catch (IOException ioe) {
+ 200 0 LOGGER.warn("bundle-audit failure" , ioe);
+ 201
+ } finally {
+ 202 0 if (null != rdr) {
+ 203
+ try {
+ 204 0 rdr.close();
+ 205 0 } catch (IOException ioe) {
+ 206 0 LOGGER.warn("bundle-audit close failure" , ioe);
+ 207 0 }
+ 208
+ }
+ 209
+ }
+ 210
+
+ 211 0 }
+ 212
+
+ 213
+ private void processBundlerAuditOutput(Dependency original, Engine engine, BufferedReader rdr) throws IOException {
+ 214 0 final String parentName = original.getActualFile().getParentFile().getName();
+ 215 0 final String fileName = original.getFileName();
+ 216 0 Dependency dependency = null ;
+ 217 0 Vulnerability vulnerability = null ;
+ 218 0 String gem = null ;
+ 219 0 final Map<String, Dependency> map = new HashMap<String, Dependency>();
+ 220 0 boolean appendToDescription = false ;
+ 221 0 while (rdr.ready()) {
+ 222 0 final String nextLine = rdr.readLine();
+ 223 0 if (null == nextLine) {
+ 224 0 break ;
+ 225 0 } else if (nextLine.startsWith(NAME)) {
+ 226 0 appendToDescription = false ;
+ 227 0 gem = nextLine.substring(NAME.length());
+ 228 0 if (!map.containsKey(gem)) {
+ 229 0 map.put(gem, createDependencyForGem(engine, parentName, fileName, gem));
+ 230
+ }
+ 231 0 dependency = map.get(gem);
+ 232 0 LOGGER.debug(String.format("bundle-audit (%s): %s" , parentName, nextLine));
+ 233 0 } else if (nextLine.startsWith(VERSION)) {
+ 234 0 vulnerability = createVulnerability(parentName, dependency, vulnerability, gem, nextLine);
+ 235 0 } else if (nextLine.startsWith(ADVISORY)) {
+ 236 0 setVulnerabilityName(parentName, dependency, vulnerability, nextLine);
+ 237 0 } else if (nextLine.startsWith(CRITICALITY)) {
+ 238 0 addCriticalityToVulnerability(parentName, vulnerability, nextLine);
+ 239 0 } else if (nextLine.startsWith("URL: " )) {
+ 240 0 addReferenceToVulnerability(parentName, vulnerability, nextLine);
+ 241 0 } else if (nextLine.startsWith("Description:" )) {
+ 242 0 appendToDescription = true ;
+ 243 0 if (null != vulnerability) {
+ 244 0 vulnerability.setDescription("*** Vulnerability obtained from bundle-audit verbose report. Title link may not work. CPE below is guessed. CVSS score is estimated (-1.0 indicates unknown). See link below for full details. *** " );
+ 245
+ }
+ 246 0 } else if (appendToDescription) {
+ 247 0 if (null != vulnerability) {
+ 248 0 vulnerability.setDescription(vulnerability.getDescription() + nextLine + "\n" );
+ 249
+ }
+ 250
+ }
+ 251 0 }
+ 252 0 }
+ 253
+
+ 254
+ private void setVulnerabilityName(String parentName, Dependency dependency, Vulnerability vulnerability, String nextLine) {
+ 255 0 final String advisory = nextLine.substring((ADVISORY.length()));
+ 256 0 if (null != vulnerability) {
+ 257 0 vulnerability.setName(advisory);
+ 258
+ }
+ 259 0 if (null != dependency) {
+ 260 0 dependency.getVulnerabilities().add(vulnerability);
+ 261
+ }
+ 262 0 LOGGER.debug(String.format("bundle-audit (%s): %s" , parentName, nextLine));
+ 263 0 }
+ 264
+
+ 265
+ private void addReferenceToVulnerability(String parentName, Vulnerability vulnerability, String nextLine) {
+ 266 0 final String url = nextLine.substring(("URL: " ).length());
+ 267 0 if (null != vulnerability) {
+ 268 0 Reference ref = new Reference();
+ 269 0 ref.setName(vulnerability.getName());
+ 270 0 ref.setSource("bundle-audit" );
+ 271 0 ref.setUrl(url);
+ 272 0 vulnerability.getReferences().add(ref);
+ 273
+ }
+ 274 0 LOGGER.debug(String.format("bundle-audit (%s): %s" , parentName, nextLine));
+ 275 0 }
+ 276
+
+ 277
+ private void addCriticalityToVulnerability(String parentName, Vulnerability vulnerability, String nextLine) {
+ 278 0 if (null != vulnerability) {
+ 279 0 final String criticality = nextLine.substring(CRITICALITY.length()).trim();
+ 280 0 if ("High" .equals(criticality)) {
+ 281 0 vulnerability.setCvssScore(8.5f);
+ 282 0 } else if ("Medium" .equals(criticality)) {
+ 283 0 vulnerability.setCvssScore(5.5f);
+ 284 0 } else if ("Low" .equals(criticality)) {
+ 285 0 vulnerability.setCvssScore(2.0f);
+ 286
+ } else {
+ 287 0 vulnerability.setCvssScore(-1.0f);
+ 288
+ }
+ 289
+ }
+ 290 0 LOGGER.debug(String.format("bundle-audit (%s): %s" , parentName, nextLine));
+ 291 0 }
+ 292
+
+ 293
+ private Vulnerability createVulnerability(String parentName, Dependency dependency, Vulnerability vulnerability, String gem, String nextLine) {
+ 294 0 if (null != dependency) {
+ 295 0 final String version = nextLine.substring(VERSION.length());
+ 296 0 dependency.getVersionEvidence().addEvidence(
+ 297
+ "bundler-audit" ,
+ 298
+ "Version" ,
+ 299
+ version,
+ 300
+ Confidence.HIGHEST);
+ 301 0 vulnerability = new Vulnerability();
+ 302 0 vulnerability.setMatchedCPE(
+ 303
+ String.format("cpe:/a:%1$s_project:%1$s:%2$s::~~~ruby~~" , gem, version),
+ 304
+ null );
+ 305 0 vulnerability.setCvssAccessVector("-" );
+ 306 0 vulnerability.setCvssAccessComplexity("-" );
+ 307 0 vulnerability.setCvssAuthentication("-" );
+ 308 0 vulnerability.setCvssAvailabilityImpact("-" );
+ 309 0 vulnerability.setCvssConfidentialityImpact("-" );
+ 310 0 vulnerability.setCvssIntegrityImpact("-" );
+ 311
+ }
+ 312 0 LOGGER.debug(String.format("bundle-audit (%s): %s" , parentName, nextLine));
+ 313 0 return vulnerability;
+ 314
+ }
+ 315
+
+ 316
+ private Dependency createDependencyForGem(Engine engine, String parentName, String fileName, String gem) throws IOException {
+ 317 0 final File tempFile = File.createTempFile("Gemfile-" + gem, ".lock" , Settings.getTempDirectory());
+ 318 0 final String displayFileName = String.format("%s%c%s:%s" , parentName, File.separatorChar, fileName, gem);
+ 319 0 FileUtils.write(tempFile, displayFileName);
+ 320 0 final Dependency dependency = new Dependency(tempFile);
+ 321 0 dependency.getProductEvidence().addEvidence("bundler-audit" , "Name" , gem, Confidence.HIGHEST);
+ 322 0 dependency.setDisplayFileName(displayFileName);
+ 323 0 engine.getDependencies().add(dependency);
+ 324 0 return dependency;
+ 325
+ }
+ 326
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyGemspecAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyGemspecAnalyzer.html
index 2a34fc329..5b8628db4 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyGemspecAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.RubyGemspecAnalyzer.html
@@ -117,186 +117,188 @@
50 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
51
-
52 1 private static final FileFilter FILTER =
-
53
- FileFilterBuilder.newInstance().addExtensions("gemspec" ).addFilenames("Rakefile" ).build();
-
54
-
-
55
- private static final String EMAIL = "email" ;
-
56
+ 52
private static final String GEMSPEC = "gemspec" ;
+
53
+
+
54 1 private static final FileFilter FILTER =
+
55
+ FileFilterBuilder.newInstance().addExtensions(GEMSPEC).addFilenames("Rakefile" ).build();
+
56
+
57
-
+
private static final String EMAIL = "email" ; 58
-
+
59
-
+
60
-
+
61
- @Override
+
62
+ @Override
+
63
protected FileFilter getFileFilter() {
-
63 855 return FILTER;
-
64
- }
+
64 855 return FILTER;
65
-
+
} 66
- @Override
+
67
- protected void initializeFileTypeAnalyzer() throws Exception {
+
@Override 68
+ protected void initializeFileTypeAnalyzer() throws Exception {
+
69
-
69 3 }
-
70
-
+
70 3 }
71
-
+
72
-
+
73
-
+
74
-
+
75
-
+
76
- @Override
+
77
+ @Override
+
78
public String getName() {
-
78 5 return ANALYZER_NAME;
-
79
- }
+
79 5 return ANALYZER_NAME;
80
-
+
} 81
-
+
82
-
+
83
-
+
84
-
-
85
-
-
86
- @Override
-
87
- public AnalysisPhase getAnalysisPhase() {
-
88 3 return ANALYSIS_PHASE;
-
89
- }
-
90
-
-
91
-
-
92
-
-
93
-
94
-
-
95
+ 85
+
+
86
-
96
+ 87
@Override
-
97
- protected String getAnalyzerEnabledSettingKey() {
-
98 7 return Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED;
-
99
+ 88
+ public AnalysisPhase getAnalysisPhase() {
+
89 3 return ANALYSIS_PHASE;
+
90
}
-
100
+ 91
-
101
+ 92
-
102
-
-
103
+ 93
+
+
94
+
+
95
+
+
96
-
104 1 private static final Pattern GEMSPEC_BLOCK_INIT =
-
105
- Pattern.compile("Gem::Specification\\.new\\s+?do\\s+?\\|(.+?)\\|" );
-
106
-
-
107
+ 97
@Override
-
108
- protected void analyzeFileType(Dependency dependency, Engine engine)
-
109
- throws AnalysisException {
-
110
- String contents;
-
111
- try {
-
112 1 contents = FileUtils.readFileToString(dependency.getActualFile());
-
113 0 } catch (IOException e) {
-
114 0 throw new AnalysisException(
-
115
- "Problem occurred while reading dependency file." , e);
-
116 1 }
-
117 1 final Matcher matcher = GEMSPEC_BLOCK_INIT.matcher(contents);
-
118 1 if (matcher.find()) {
-
119 1 contents = contents.substring(matcher.end());
-
120 1 final String blockVariable = matcher.group(1);
-
121 1 final EvidenceCollection vendor = dependency.getVendorEvidence();
-
122 1 addStringEvidence(vendor, contents, blockVariable, "author" , Confidence.HIGHEST);
-
123 1 addListEvidence(vendor, contents, blockVariable, "authors" , Confidence.HIGHEST);
-
124 1 final String email = addStringEvidence(vendor, contents, blockVariable, EMAIL, Confidence.MEDIUM);
-
125 1 if (email.isEmpty()) {
-
126 0 addListEvidence(vendor, contents, blockVariable, EMAIL, Confidence.MEDIUM);
-
127
- }
-
128 1 addStringEvidence(vendor, contents, blockVariable, "homepage" , Confidence.MEDIUM);
-
129 1 final EvidenceCollection product = dependency.getProductEvidence();
-
130 1 final String name = addStringEvidence(product, contents, blockVariable, "name" , Confidence.HIGHEST);
-
131 1 if (!name.isEmpty()) {
-
132 1 vendor.addEvidence(GEMSPEC, "name_project" , name + "_project" , Confidence.LOW);
-
133
- }
-
134 1 addStringEvidence(product, contents, blockVariable, "summary" , Confidence.LOW);
-
135 1 addStringEvidence(dependency.getVersionEvidence(), contents, blockVariable, "version" , Confidence.HIGHEST);
-
136
- }
-
137 1 }
-
138
-
-
139
- private void addListEvidence(EvidenceCollection evidences, String contents,
-
140
- String blockVariable, String field, Confidence confidence) {
-
141 1 final Matcher matcher = Pattern.compile(
-
142
- String.format("\\s+?%s\\.%s\\s*?=\\s*?\\[(.*?)\\]" , blockVariable, field)).matcher(contents);
-
143 1 if (matcher.find()) {
-
144 1 final String value = matcher.group(1).replaceAll("['\"]" , " " ).trim();
-
145 1 evidences.addEvidence(GEMSPEC, field, value, confidence);
-
146
- }
-
147 1 }
-
148
-
-
149
- private String addStringEvidence(EvidenceCollection evidences, String contents,
-
150
- String blockVariable, String field, Confidence confidence) {
-
151 6 final Matcher matcher = Pattern.compile(
-
152
- String.format("\\s+?%s\\.%s\\s*?=\\s*?(['\"])(.*?)\\1" , blockVariable, field)).matcher(contents);
-
153 6 String value = "" ;
-
154 6 if (matcher.find()) {
-
155 5 value = matcher.group(2);
-
156 5 evidences.addEvidence(GEMSPEC, field, value, confidence);
-
157
- }
-
158 6 return value;
-
159
+ 98
+ protected String getAnalyzerEnabledSettingKey() {
+
99 7 return Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED;
+
100
}
+
101
+
+
102
+
+
103
+
+
104
+
+
105 1 private static final Pattern GEMSPEC_BLOCK_INIT =
+
106
+ Pattern.compile("Gem::Specification\\.new\\s+?do\\s+?\\|(.+?)\\|" );
+
107
+
+
108
+ @Override
+
109
+ protected void analyzeFileType(Dependency dependency, Engine engine)
+
110
+ throws AnalysisException {
+
111
+ String contents;
+
112
+ try {
+
113 1 contents = FileUtils.readFileToString(dependency.getActualFile());
+
114 0 } catch (IOException e) {
+
115 0 throw new AnalysisException(
+
116
+ "Problem occurred while reading dependency file." , e);
+
117 1 }
+
118 1 final Matcher matcher = GEMSPEC_BLOCK_INIT.matcher(contents);
+
119 1 if (matcher.find()) {
+
120 1 contents = contents.substring(matcher.end());
+
121 1 final String blockVariable = matcher.group(1);
+
122 1 final EvidenceCollection vendor = dependency.getVendorEvidence();
+
123 1 addStringEvidence(vendor, contents, blockVariable, "author" , Confidence.HIGHEST);
+
124 1 addListEvidence(vendor, contents, blockVariable, "authors" , Confidence.HIGHEST);
+
125 1 final String email = addStringEvidence(vendor, contents, blockVariable, EMAIL, Confidence.MEDIUM);
+
126 1 if (email.isEmpty()) {
+
127 0 addListEvidence(vendor, contents, blockVariable, EMAIL, Confidence.MEDIUM);
+
128
+ }
+
129 1 addStringEvidence(vendor, contents, blockVariable, "homepage" , Confidence.MEDIUM);
+
130 1 final EvidenceCollection product = dependency.getProductEvidence();
+
131 1 final String name = addStringEvidence(product, contents, blockVariable, "name" , Confidence.HIGHEST);
+
132 1 if (!name.isEmpty()) {
+
133 1 vendor.addEvidence(GEMSPEC, "name_project" , name + "_project" , Confidence.LOW);
+
134
+ }
+
135 1 addStringEvidence(product, contents, blockVariable, "summary" , Confidence.LOW);
+
136 1 addStringEvidence(dependency.getVersionEvidence(), contents, blockVariable, "version" , Confidence.HIGHEST);
+
137
+ }
+
138 1 }
+
139
+
+
140
+ private void addListEvidence(EvidenceCollection evidences, String contents,
+
141
+ String blockVariable, String field, Confidence confidence) {
+
142 1 final Matcher matcher = Pattern.compile(
+
143
+ String.format("\\s+?%s\\.%s\\s*?=\\s*?\\[(.*?)\\]" , blockVariable, field)).matcher(contents);
+
144 1 if (matcher.find()) {
+
145 1 final String value = matcher.group(1).replaceAll("['\"]" , " " ).trim();
+
146 1 evidences.addEvidence(GEMSPEC, field, value, confidence);
+
147
+ }
+
148 1 }
+
149
+
+
150
+ private String addStringEvidence(EvidenceCollection evidences, String contents,
+
151
+ String blockVariable, String field, Confidence confidence) {
+
152 6 final Matcher matcher = Pattern.compile(
+
153
+ String.format("\\s+?%s\\.%s\\s*?=\\s*?(['\"])(.*?)\\1" , blockVariable, field)).matcher(contents);
+
154 6 String value = "" ;
+
155 6 if (matcher.find()) {
+
156 5 value = matcher.group(2);
+
157 5 evidences.addEvidence(GEMSPEC, field, value, confidence);
+
158
+ }
+
159 6 return value;
160
+ }
+
161
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
index ee1b5c24d..2278b9b81 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
@@ -152,13 +152,13 @@
70
71 2 for (final SuppressionRule rule : getRules()) {
-
72 40 rule.process(dependency);
-
73 40 }
+
72 48 rule.process(dependency);
+
73 48 }
74 2 }
75
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
index 55229fbf0..c37558ca8 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
@@ -12,7 +12,7 @@
@@ -137,12 +137,12 @@
63
public AnalysisException(String msg, Throwable ex) {
-
64 0 super (msg, ex);
-
65 0 }
+
64 3 super (msg, ex);
+
65 3 }
66
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html
index f27ea4c38..740f578f9 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html
@@ -143,6 +143,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.central.CentralSearch.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.central.CentralSearch.html
index 0d2445237..8a0e5eea2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.central.CentralSearch.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.central.CentralSearch.html
@@ -189,7 +189,7 @@
91 3 final URL url = new URL(rootURL + String.format("?q=1:\"%s\"&wt=xml" , sha1));
92
-
93 3 LOGGER.debug("Searching Central url {}" , url.toString());
+
93 3 LOGGER.debug("Searching Central url {}" , url);
94
95
@@ -301,6 +301,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerDependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerDependency.html
index 8b5cc18c4..5ff68d27e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerDependency.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerDependency.html
@@ -217,6 +217,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerException.html
index c0c01042a..326010315 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerException.html
@@ -72,51 +72,61 @@
27
28
-
+
29
30
- public ComposerException() {
-
31 0 super ();
-
32 0 }
+
private static final long serialVersionUID = 1L;
+
31
+
+
32
+
33
-
+
34
-
+
35
-
-
36
-
-
37
-
+
public ComposerException() {
+
36 0 super ();
+
37 0 }
38
-
-
39
- public ComposerException(String message) {
-
40 0 super (message);
-
41 0 }
-
42
-
43
+ 39
-
44
-
-
45
+ 40
+
+
41
-
46
-
-
47
-
-
48
+ 42
+
+
43
+
44
+ public ComposerException(String message) {
+
45 0 super (message);
+
46 0 }
+
47
+
+
48
+
49
- public ComposerException(String message, Throwable cause) {
-
50 3 super (message, cause);
-
51 3 }
+
+
50
+
+
51
+
52
+
+
53
+
+
54
+ public ComposerException(String message, Throwable cause) {
+
55 3 super (message, cause);
+
56 3 }
+
57
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerLockParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerLockParser.html
index 06a4c105b..636d67c14 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerLockParser.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.composer.ComposerLockParser.html
@@ -228,6 +228,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html
index 86908ca08..41b33ed40 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html
@@ -12,7 +12,7 @@
@@ -299,288 +299,271 @@
151
152
- @SuppressWarnings("unchecked" )
-
153
private Analyzer createIndexingAnalyzer() {
-
154 1 final Map<String, Analyzer> fieldAnalyzers = new HashMap<String, Analyzer>();
-
155 1 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
-
156 1 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
+
153 1 final Map<String, Analyzer> fieldAnalyzers = new HashMap<String, Analyzer>();
+
154 1 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
+
155 1 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
+
156
+ }
157
- }
+
158
-
+
159
-
-
160
+
160
+
161
-
-
162
+
162
+
163
-
-
164
- @SuppressWarnings("unchecked" )
-
165
private Analyzer createSearchingAnalyzer() {
-
166 1 final Map<String, Analyzer> fieldAnalyzers = new HashMap<String, Analyzer>();
-
167 1 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
-
168 1 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
-
169 1 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
-
170 1 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
-
171 1 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
+
164 1 final Map<String, Analyzer> fieldAnalyzers = new HashMap<String, Analyzer>();
+
165 1 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
+
166 1 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
+
167 1 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
+
168 1 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
+
169 1 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
+
170
+
+
171 1 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
172
-
-
173 1 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
-
174
}
+
173
+
+
174
+
175
-
-
176
-
-
177
-
-
178
-
-
179
-
-
180
-
-
181
-
-
182
-
-
183
-
-
184
-
-
185
- public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException {
-
186 25290 final Document doc = new Document();
-
187 25290 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
-
188 25290 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
-
189 25290 doc.add(v);
-
190 25290 doc.add(p);
-
191 25290 indexWriter.addDocument(doc);
-
192 25290 }
-
193
-
-
194
-
-
195
-
196
+ 176
-
197
+ 177
public void close() {
-
198 1 if (searchingAnalyzer != null ) {
-
199 1 searchingAnalyzer.close();
-
200 1 searchingAnalyzer = null ;
-
201
+ 178 1 if (searchingAnalyzer != null ) {
+
179 1 searchingAnalyzer.close();
+
180 1 searchingAnalyzer = null ;
+
181
}
-
202 1 if (indexReader != null ) {
-
203
+ 182 1 if (indexReader != null ) {
+
183
try {
-
204 1 indexReader.close();
-
205 0 } catch (IOException ex) {
-
206 0 LOGGER.trace("" , ex);
-
207 1 }
-
208 1 indexReader = null ;
-
209
+ 184 1 indexReader.close();
+
185 0 } catch (IOException ex) {
+
186 0 LOGGER.trace("" , ex);
+
187 1 }
+
188 1 indexReader = null ;
+
189
}
-
210 1 queryParser = null ;
-
211 1 indexSearcher = null ;
-
212 1 if (index != null ) {
-
213 1 index.close();
-
214 1 index = null ;
-
215
+ 190 1 queryParser = null ;
+
191 1 indexSearcher = null ;
+
192 1 if (index != null ) {
+
193 1 index.close();
+
194 1 index = null ;
+
195
}
-
216 1 openState = false ;
-
217 1 }
-
218
+ 196 1 openState = false ;
+
197 1 }
+
198
-
219
+ 199
-
220
+ 200
-
221
+ 201
-
222
+ 202
-
223
+ 203
-
224
+ 204
-
225
+ 205
private void buildIndex(CveDB cve) throws IndexException {
-
226 1 Analyzer analyzer = null ;
-
227 1 IndexWriter indexWriter = null ;
-
228
+ 206 1 Analyzer analyzer = null ;
+
207 1 IndexWriter indexWriter = null ;
+
208
try {
-
229 1 analyzer = createIndexingAnalyzer();
-
230 1 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
-
231 1 indexWriter = new IndexWriter(index, conf);
-
232
+ 209 1 analyzer = createIndexingAnalyzer();
+
210 1 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
+
211 1 indexWriter = new IndexWriter(index, conf);
+
212
try {
-
233 1 final Set<Pair<String, String>> data = cve.getVendorProductList();
-
234 1 for (Pair<String, String> pair : data) {
-
235 25290 saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
-
236 25290 }
-
237 0 } catch (DatabaseException ex) {
-
238 0 LOGGER.debug("" , ex);
-
239 0 throw new IndexException("Error reading CPE data" , ex);
-
240 1 }
-
241 0 } catch (CorruptIndexException ex) {
-
242 0 throw new IndexException("Unable to close an in-memory index" , ex);
-
243 0 } catch (IOException ex) {
-
244 0 throw new IndexException("Unable to close an in-memory index" , ex);
-
245
+ 213
+
+
214
+
+
215
+
+
216 1 final Document doc = new Document();
+
217 1 final Field v = new TextField(Fields.VENDOR, Fields.VENDOR, Field.Store.YES);
+
218 1 final Field p = new TextField(Fields.PRODUCT, Fields.PRODUCT, Field.Store.YES);
+
219 1 doc.add(v);
+
220 1 doc.add(p);
+
221
+
+
222 1 final Set<Pair<String, String>> data = cve.getVendorProductList();
+
223 1 for (Pair<String, String> pair : data) {
+
224 22136 v.setStringValue(pair.getLeft());
+
225 22136 p.setStringValue(pair.getRight());
+
226 22136 indexWriter.addDocument(doc);
+
227 22136 }
+
228 0 } catch (DatabaseException ex) {
+
229 0 LOGGER.debug("" , ex);
+
230 0 throw new IndexException("Error reading CPE data" , ex);
+
231 1 }
+
232 0 } catch (CorruptIndexException ex) {
+
233 0 throw new IndexException("Unable to close an in-memory index" , ex);
+
234 0 } catch (IOException ex) {
+
235 0 throw new IndexException("Unable to close an in-memory index" , ex);
+
236
} finally {
-
246 1 if (indexWriter != null ) {
-
247
+ 237 1 if (indexWriter != null ) {
+
238
try {
-
248
+ 239
try {
-
249 1 indexWriter.commit();
-
250
+ 240 1 indexWriter.commit();
+
241
} finally {
-
251 1 indexWriter.close(true );
-
252 1 }
-
253 0 } catch (CorruptIndexException ex) {
-
254 0 throw new IndexException("Unable to close an in-memory index" , ex);
-
255 0 } catch (IOException ex) {
-
256 0 throw new IndexException("Unable to close an in-memory index" , ex);
-
257 1 }
-
258 1 if (analyzer != null ) {
-
259 1 analyzer.close();
-
260
+ 242 1 indexWriter.close(true );
+
243 1 }
+
244 0 } catch (CorruptIndexException ex) {
+
245 0 throw new IndexException("Unable to close an in-memory index" , ex);
+
246 0 } catch (IOException ex) {
+
247 0 throw new IndexException("Unable to close an in-memory index" , ex);
+
248 1 }
+
249 1 if (analyzer != null ) {
+
250 1 analyzer.close();
+
251
}
-
261
+ 252
}
+
253
+ }
+
254 1 }
+
255
+
+
256
+
+
257
+
+
258
+
+
259
+ private void resetSearchingAnalyzer() {
+
260 6 if (productSearchFieldAnalyzer != null ) {
+
261 6 productSearchFieldAnalyzer.clear();
262
}
-
263 1 }
-
264
-
+
263 6 if (vendorSearchFieldAnalyzer != null ) {
+
264 6 vendorSearchFieldAnalyzer.clear();
265
-
-
266
-
+
}
+
266 6 }
267
-
+
268
- private void resetSearchingAnalyzer() {
-
269 0 if (productSearchFieldAnalyzer != null ) {
-
270 0 productSearchFieldAnalyzer.clear();
-
271
- }
-
272 0 if (vendorSearchFieldAnalyzer != null ) {
-
273 0 vendorSearchFieldAnalyzer.clear();
-
274
- }
-
275 0 }
-
276
-
-
277
-
278
+ 269
-
279
+ 270
-
280
+ 271
-
281
+ 272
-
282
+ 273
-
283
+ 274
-
284
+ 275
-
285
+ 276
-
286
+ 277
public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException {
-
287 6 if (searchString == null || searchString.trim().isEmpty()) {
-
288 0 throw new ParseException("Query is null or empty" );
-
289
+ 278 6 if (searchString == null || searchString.trim().isEmpty()) {
+
279 0 throw new ParseException("Query is null or empty" );
+
280
}
-
290 6 final Query query = queryParser.parse(searchString);
-
291 6 return indexSearcher.search(query, maxQueryResults);
-
292
+ 281 6 LOGGER.debug(searchString);
+
282 6 final Query query = queryParser.parse(searchString);
+
283 6 return search(query, maxQueryResults);
+
284
}
-
293
+ 285
-
294
+ 286
-
295
+ 287
-
296
+ 288
-
297
+ 289
-
298
+ 290
-
299
+ 291
-
300
+ 292
-
301
+ 293
-
302
+ 294
-
303
+ 295
public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException {
-
304 0 resetSearchingAnalyzer();
-
305 0 return indexSearcher.search(query, maxQueryResults);
-
306
+ 296 6 resetSearchingAnalyzer();
+
297 6 return indexSearcher.search(query, maxQueryResults);
+
298
}
-
307
+ 299
-
308
+ 300
-
309
+ 301
-
310
+ 302
-
311
+ 303
-
312
+ 304
-
313
+ 305
-
314
+ 306
-
315
+ 307
public Document getDocument(int documentId) throws IOException {
-
316 43 return indexSearcher.doc(documentId);
-
317
+ 308 23 return indexSearcher.doc(documentId);
+
309
}
-
318
+ 310
-
319
+ 311
-
320
+ 312
-
321
+ 313
-
322
+ 314
-
323
+ 315
-
324
+ 316
public int numDocs() {
-
325 0 if (indexReader == null ) {
-
326 0 return -1;
-
327
+ 317 0 if (indexReader == null ) {
+
318 0 return -1;
+
319
}
-
328 0 return indexReader.numDocs();
-
329
+ 320 0 return indexReader.numDocs();
+
321
}
-
330
+ 322
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
index cf8b5ceaf..cb4c96c0f 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
@@ -107,6 +107,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html
index 7421450ea..930cee50b 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html
@@ -73,7 +73,7 @@
28
-
29 1524 public class IndexEntry implements Serializable {
+
29 1357 public class IndexEntry implements Serializable {
30
31
@@ -115,7 +115,7 @@
49
public String getDocumentId() {
50 0 if (documentId == null && vendor != null && product != null ) {
-
51 0 documentId = vendor + ":" + product;
+
51 0 documentId = vendor + ':' + product;
52
}
53 0 return documentId;
@@ -151,7 +151,7 @@
70
public String getVendor() {
-
71 30 return vendor;
+
71 19 return vendor;
72
}
73
@@ -168,8 +168,8 @@
79
public void setVendor(String vendor) {
-
80 1523 this .vendor = vendor;
-
81 1523 }
+
80 1356 this .vendor = vendor;
+
81 1356 }
82
83
@@ -192,7 +192,7 @@
92
public String getProduct() {
-
93 63 return product;
+
93 38 return product;
94
}
95
@@ -209,8 +209,8 @@
101
public void setProduct(String product) {
-
102 1523 this .product = product;
-
103 1523 }
+
102 1356 this .product = product;
+
103 1356 }
104
105
@@ -250,8 +250,8 @@
123
public void setSearchScore(float searchScore) {
-
124 43 this .searchScore = searchScore;
-
125 43 }
+
124 23 this .searchScore = searchScore;
+
125 23 }
126
127
@@ -320,17 +320,17 @@
@Override
164
public boolean equals(Object obj) {
-
165 153 if (obj == null ) {
+
165 39 if (obj == null ) {
166 0 return false ;
167
}
-
168 153 if (getClass() != obj.getClass()) {
+
168 39 if (getClass() != obj.getClass()) {
169 0 return false ;
170
}
-
171 153 final IndexEntry other = (IndexEntry) obj;
-
172 153 if ((this .vendor == null ) ? (other.vendor != null ) : !this .vendor.equals(other.vendor)) {
-
173 148 return false ;
+
171 39 final IndexEntry other = (IndexEntry) obj;
+
172 39 if ((this .vendor == null ) ? (other.vendor != null ) : !this .vendor.equals(other.vendor)) {
+
173 34 return false ;
174
}
175 5 if ((this .product == null ) ? (other.product != null ) : !this .product.equals(other.product)) {
@@ -363,6 +363,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html
index 22f9168a3..470821d2d 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html
@@ -143,6 +143,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html
index 5853e2227..8ab19ac3e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html
@@ -186,6 +186,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html
index 5236350d9..6897f02e2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html
@@ -121,6 +121,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html
index 4f3f34ef4..630620cea 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html
@@ -85,7 +85,7 @@
34
-
35 11 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
+
35 9 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
36
37
@@ -100,7 +100,7 @@
42
protected CharTermAttribute getTermAtt() {
-
43 32273 return termAtt;
+
43 19488 return termAtt;
44
}
45
@@ -125,7 +125,7 @@
55
protected LinkedList<String> getTokens() {
-
56 32245 return tokens;
+
56 19463 return tokens;
57
}
58
@@ -142,9 +142,9 @@
64
public AbstractTokenizingFilter(TokenStream stream) {
-
65 11 super (stream);
-
66 11 tokens = new LinkedList<String>();
-
67 11 }
+
65 9 super (stream);
+
66 9 tokens = new LinkedList<String>();
+
67 9 }
68
69
@@ -159,20 +159,20 @@
74
protected boolean addTerm() {
-
75 32163 final boolean termAdded = !tokens.isEmpty();
-
76 32162 if (termAdded) {
-
77 21597 final String term = tokens.pop();
-
78 21571 clearAttributes();
-
79 21585 termAtt.append(term);
+
75 19418 final boolean termAdded = !tokens.isEmpty();
+
76 19403 if (termAdded) {
+
77 12834 final String term = tokens.pop();
+
78 12826 clearAttributes();
+
79 12839 termAtt.append(term);
80
}
-
81 32161 return termAdded;
+
81 19408 return termAdded;
82
}
83
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
index e5a285055..c2b357f11 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
@@ -131,13 +131,13 @@
@Override 59
protected boolean isTokenChar(int c) {
-
60 605810 return Character.isLetter(c) || Character.isDigit(c);
+
60 517377 return Character.isLetter(c) || Character.isDigit(c);
61
}
62
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
index f2f4b579c..47724714e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
@@ -111,6 +111,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html
index acf2ad12f..d8e45c6bf 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html
@@ -170,6 +170,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
index f330278b0..6e9239722 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
@@ -12,7 +12,7 @@
@@ -168,48 +168,50 @@
79
case ':' :
80
+ case '/' :
+
81
case '\\' :
-
81 58 buf.append('\\' );
-
82
+ 82 58 buf.append('\\' );
+
83
default :
-
83 1119 buf.append(c);
-
84
- break ;
+
84 1119 buf.append(c);
85
- }
+
break ; 86
+ }
+
87
}
-
87 144 }
-
88
-
+
88 144 }
89
-
+
90
-
+
91
-
+
92
-
+
93
-
+
94
-
+
95
+
+
96
public static String escapeLuceneQuery(final CharSequence text) {
-
96 144 if (text == null ) {
-
97 1 return null ;
-
98
+ 97 2 if (text == null ) {
+
98 1 return null ;
+
99
}
-
99 143 final int size = text.length() << 1;
-
100 143 final StringBuilder buf = new StringBuilder(size);
-
101 143 appendEscapedLuceneQuery(buf, text);
-
102 143 return buf.toString();
-
103
- }
+
100 1 final int size = text.length() << 1;
+
101 1 final StringBuilder buf = new StringBuilder(size);
+
102 1 appendEscapedLuceneQuery(buf, text);
+
103 1 return buf.toString();
104
+ }
+
105
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
index 56995df46..d359b3a53 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
@@ -187,15 +187,15 @@
91
public void clear() {
-
92 2 if (concatenatingFilter != null ) {
-
93 2 concatenatingFilter.clear();
+
92 14 if (concatenatingFilter != null ) {
+
93 14 concatenatingFilter.clear();
94
}
-
95 2 }
+
95 14 }
96
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html
index 51a57cbc5..4bfaed9d6 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html
@@ -185,7 +185,7 @@
87
-
88 822 while (input.incrementToken()) {
+
88 812 while (input.incrementToken()) {
89 227 final String word = new String(termAtt.buffer(), 0, termAtt.length());
90 227 words.add(word);
91 227 }
@@ -195,12 +195,12 @@
94
-
95 595 if (previousWord != null && !words.isEmpty()) {
-
96 219 final String word = words.getFirst();
-
97 219 clearAttributes();
-
98 219 termAtt.append(previousWord).append(word);
-
99 219 previousWord = null ;
-
100 219 return true ;
+
95 585 if (previousWord != null && !words.isEmpty()) {
+
96 209 final String word = words.getFirst();
+
97 209 clearAttributes();
+
98 209 termAtt.append(previousWord).append(word);
+
99 209 previousWord = null ;
+
100 209 return true ;
101
}
102
@@ -232,9 +232,9 @@
119
public void clear() {
-
120 3 previousWord = null ;
-
121 3 words.clear();
-
122 3 }
+
120 15 previousWord = null ;
+
121 15 words.clear();
+
122 15 }
123
124
@@ -306,6 +306,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
index 326d063d4..dd9ac6b5f 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
@@ -112,8 +112,8 @@
48
public UrlTokenizingFilter(TokenStream stream) {
-
49 11 super (stream);
-
50 11 }
+
49 9 super (stream);
+
50 9 }
51
52
@@ -134,11 +134,11 @@
@Override
60
public boolean incrementToken() throws IOException {
-
61 32183 final LinkedList<String> tokens = getTokens();
-
62 32244 final CharTermAttribute termAtt = getTermAtt();
-
63 32266 if (tokens.isEmpty() && input.incrementToken()) {
-
64 21620 final String text = new String(termAtt.buffer(), 0, termAtt.length());
-
65 21622 if (UrlStringUtils.containsUrl(text)) {
+
61 19357 final LinkedList<String> tokens = getTokens();
+
62 19425 final CharTermAttribute termAtt = getTermAtt();
+
63 19436 if (tokens.isEmpty() && input.incrementToken()) {
+
64 12857 final String text = new String(termAtt.buffer(), 0, termAtt.length());
+
65 12845 if (UrlStringUtils.containsUrl(text)) {
66 6 final String[] parts = text.split("\\s" );
67 12 for (String part : parts) {
68 6 if (UrlStringUtils.isUrl(part)) {
@@ -158,18 +158,18 @@
79
}
80 6 } else {
-
81 21621 tokens.add(text);
+
81 12840 tokens.add(text);
82
}
83
}
-
84 32163 return addTerm();
+
84 19382 return addTerm();
85
}
86
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html
index c183cbc82..f3c9d3cad 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html
@@ -194,17 +194,17 @@
95 3 if (jarAvailable) {
96
-
97 3 this .artifactUrl = base + groupId.replace('.' , '/' ) + "/" + artifactId + "/"
+
97 3 this .artifactUrl = base + groupId.replace('.' , '/' ) + '/' + artifactId + '/'
98
- + version + "/" + artifactId + "-" + version + ".jar" ;
+
+ version + '/' + artifactId + '-' + version + ".jar" ; 99
}
100 3 if (pomAvailable) {
101
-
102 3 this .pomUrl = base + groupId.replace('.' , '/' ) + "/" + artifactId + "/"
+
102 3 this .pomUrl = base + groupId.replace('.' , '/' ) + '/' + artifactId + '/'
103
- + version + "/" + artifactId + "-" + version + ".pom" ;
+
+ version + '/' + artifactId + '-' + version + ".pom" ; 104
}
105 3 }
@@ -248,7 +248,7 @@
@Override 128
public String toString() {
-
129 2 return String.format("%s:%s:%s" , groupId, artifactId, version);
+
129 1 return String.format("%s:%s:%s" , groupId, artifactId, version);
130
}
131
@@ -426,6 +426,6 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
index 0a89003d1..247d69c18 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
@@ -144,7 +144,7 @@
try { 65 0 if (null != Settings.getString(Settings.KEYS.PROXY_SERVER)
66
- && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) {
+
&& Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY)) { 67 0 useProxy = true ;
68 0 LOGGER.debug("Using proxy" );
69
@@ -334,6 +334,6 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
index 5c6240aa7..badcf94c6 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
@@ -357,6 +357,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html
index 3bb4e3e9f..21625e8a3 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html
@@ -147,6 +147,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html
index 56143e90c..0cefdeafa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html
@@ -93,6 +93,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html
index 6498f578b..e10f4cd91 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html
@@ -163,6 +163,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
index 80eec16ae..d921785d2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
@@ -12,7 +12,7 @@
@@ -56,529 +56,533 @@
19
20
- import java.io.BufferedReader;
-
21
import java.io.File;
-
22
+ 21
import java.io.IOException;
-
23
+ 22
import java.io.InputStream;
-
24
- import java.io.InputStreamReader;
-
25
+ 23
import java.sql.CallableStatement;
-
26
+ 24
import java.sql.Connection;
-
27
+ 25
import java.sql.Driver;
-
28
+ 26
import java.sql.DriverManager;
-
29
+ 27
import java.sql.ResultSet;
-
30
+ 28
import java.sql.SQLException;
-
31
+ 29
import java.sql.Statement;
-
32
+ 30
+ import org.apache.commons.io.IOUtils;
+
31
import org.owasp.dependencycheck.utils.DBUtils;
+
32
+ import org.owasp.dependencycheck.utils.DependencyVersion;
33
- import org.owasp.dependencycheck.utils.Settings;
+
import org.owasp.dependencycheck.utils.DependencyVersionUtil; 34
- import org.slf4j.Logger;
+
import org.owasp.dependencycheck.utils.Settings; 35
- import org.slf4j.LoggerFactory;
+
import org.slf4j.Logger; 36
-
+
import org.slf4j.LoggerFactory; 37
-
+
38
-
+
39
-
+
40
-
+
41
-
+
42
-
+
43
- public final class ConnectionFactory {
+
44
-
+
public final class ConnectionFactory { 45
-
-
46
-
-
47
-
-
48 1 private static final Logger LOGGER = LoggerFactory.getLogger(ConnectionFactory.class );
-
49
-
-
50
-
-
51
-
-
52 1 public static final String DB_SCHEMA_VERSION = Settings.getString(Settings.KEYS.DB_VERSION);
-
53
-
-
54
-
-
55
-
-
56
- public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql" ;
-
57
-
-
58
-
-
59
-
-
60
- public static final String DB_STRUCTURE_UPDATE_RESOURCE = "data/upgrade_%s.sql" ;
-
61
-
-
62
-
-
63
-
-
64 1 private static Driver driver = null ;
-
65
-
-
66
-
-
67
-
-
68 1 private static String connectionString = null ;
-
69
-
-
70
-
-
71
-
-
72 1 private static String userName = null ;
-
73
-
-
74
-
-
75
-
-
76 1 private static String password = null ;
-
77
+
46
+
+
47
+
+
48
+
+
49 1 private static final Logger LOGGER = LoggerFactory.getLogger(ConnectionFactory.class );
+
50
+
+
51
+
+
52
+
+
53 1 public static final String DB_SCHEMA_VERSION = Settings.getString(Settings.KEYS.DB_VERSION);
+
54
+
+
55
+
+
56
+
+
57
+ public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql" ;
+
58
+
+
59
+
+
60
+
+
61
+ public static final String DB_STRUCTURE_UPDATE_RESOURCE = "data/upgrade_%s.sql" ;
+
62
+
+
63
+
+
64
+
+
65
+ public static final String UPGRADE_HELP_URL = "http://jeremylong.github.io/DependencyCheck/data/upgrade.html" ;
+
66
+
+
67
+
+
68
+
+
69 1 private static Driver driver = null ;
+
70
+
+
71
+
+
72
+
+
73 1 private static String connectionString = null ;
+
74
+
+
75
+
+
76
+
+
77 1 private static String userName = null ;
78
79
-
+
80
-
81 0 private ConnectionFactory() {
-
82 0 }
+
81 1 private static String password = null ;
+
82
+
83
-
+
84
-
+
85
-
-
86
-
-
87
-
+
+
86 0 private ConnectionFactory() {
+
87 0 }
88
-
+
89
-
+
90
- public static synchronized void initialize() throws DatabaseException {
+
91
-
-
92 9 if (connectionString != null ) {
-
93 8 return ;
+
+
92
+
+
93
+
94
- }
-
95 1 Connection conn = null ;
+
+
95
+ public static synchronized void initialize() throws DatabaseException {
96
+
+
97 11 if (connectionString != null ) {
+
98 9 return ;
+
99
+ }
+
100 2 Connection conn = null ;
+
101
try {
-
97
-
-
98 1 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "" );
-
99 1 if (!driverName.isEmpty()) {
-
100 1 LOGGER.debug("Loading driver: {}" , driverName);
-
101 1 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "" );
102
+
+
103 2 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "" );
+
104 2 if (!driverName.isEmpty()) {
+
105 2 LOGGER.debug("Loading driver: {}" , driverName);
+
106 2 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "" );
+
107
try {
-
103 1 if (!driverPath.isEmpty()) {
-
104 0 LOGGER.debug("Loading driver from: {}" , driverPath);
-
105 0 driver = DriverLoader.load(driverName, driverPath);
-
106
+ 108 2 if (!driverPath.isEmpty()) {
+
109 0 LOGGER.debug("Loading driver from: {}" , driverPath);
+
110 0 driver = DriverLoader.load(driverName, driverPath);
+
111
} else {
-
107 1 driver = DriverLoader.load(driverName);
-
108
- }
-
109 0 } catch (DriverLoadException ex) {
-
110 0 LOGGER.debug("Unable to load database driver" , ex);
-
111 0 throw new DatabaseException("Unable to load database driver" );
-
112 1 }
+
112 2 driver = DriverLoader.load(driverName);
113
+ }
+
114 0 } catch (DriverLoadException ex) {
+
115 0 LOGGER.debug("Unable to load database driver" , ex);
+
116 0 throw new DatabaseException("Unable to load database driver" );
+
117 2 }
+
118
}
-
114 1 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser" );
-
115
-
-
116 1 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!" );
-
117
- try {
-
118 1 connectionString = Settings.getConnectionString(
-
119
- Settings.KEYS.DB_CONNECTION_STRING,
+
119 2 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser" );
120
+
+
121 2 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!" );
+
122
+ try {
+
123 2 connectionString = Settings.getConnectionString(
+
124
+ Settings.KEYS.DB_CONNECTION_STRING,
+
125
Settings.KEYS.DB_FILE_NAME);
-
121 0 } catch (IOException ex) {
-
122 0 LOGGER.debug(
-
123
+ 126 0 } catch (IOException ex) {
+
127 0 LOGGER.debug(
+
128
"Unable to retrieve the database connection string" , ex);
-
124 0 throw new DatabaseException("Unable to retrieve the database connection string" );
-
125 1 }
-
126 1 boolean shouldCreateSchema = false ;
-
127
+ 129 0 throw new DatabaseException("Unable to retrieve the database connection string" );
+
130 2 }
+
131 2 boolean shouldCreateSchema = false ;
+
132
try {
-
128 1 if (connectionString.startsWith("jdbc:h2:file:" )) {
-
129 1 shouldCreateSchema = !h2DataFileExists();
-
130 1 LOGGER.debug("Need to create DB Structure: {}" , shouldCreateSchema);
-
131
+ 133 2 if (connectionString.startsWith("jdbc:h2:file:" )) {
+
134 2 shouldCreateSchema = !h2DataFileExists();
+
135 2 LOGGER.debug("Need to create DB Structure: {}" , shouldCreateSchema);
+
136
}
-
132 0 } catch (IOException ioex) {
-
133 0 LOGGER.debug("Unable to verify database exists" , ioex);
-
134 0 throw new DatabaseException("Unable to verify database exists" );
-
135 1 }
-
136 1 LOGGER.debug("Loading database connection" );
-
137 1 LOGGER.debug("Connection String: {}" , connectionString);
-
138 1 LOGGER.debug("Database User: {}" , userName);
-
139
+ 137 0 } catch (IOException ioex) {
+
138 0 LOGGER.debug("Unable to verify database exists" , ioex);
+
139 0 throw new DatabaseException("Unable to verify database exists" );
+
140 2 }
+
141 2 LOGGER.debug("Loading database connection" );
+
142 2 LOGGER.debug("Connection String: {}" , connectionString);
+
143 2 LOGGER.debug("Database User: {}" , userName);
+
144
-
140
- try {
-
141 1 conn = DriverManager.getConnection(connectionString, userName, password);
-
142 0 } catch (SQLException ex) {
-
143 0 if (ex.getMessage().contains("java.net.UnknownHostException" ) && connectionString.contains("AUTO_SERVER=TRUE;" )) {
-
144 0 connectionString = connectionString.replace("AUTO_SERVER=TRUE;" , "" );
145
+ try {
+
146 2 conn = DriverManager.getConnection(connectionString, userName, password);
+
147 0 } catch (SQLException ex) {
+
148 0 if (ex.getMessage().contains("java.net.UnknownHostException" ) && connectionString.contains("AUTO_SERVER=TRUE;" )) {
+
149 0 connectionString = connectionString.replace("AUTO_SERVER=TRUE;" , "" );
+
150
try {
-
146 0 conn = DriverManager.getConnection(connectionString, userName, password);
-
147 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
-
148 0 LOGGER.debug(
-
149
- "Unable to start the database in server mode; reverting to single user mode" );
-
150 0 } catch (SQLException sqlex) {
-
151 0 LOGGER.debug("Unable to connect to the database" , ex);
-
152 0 throw new DatabaseException("Unable to connect to the database" );
-
153 0 }
+
151 0 conn = DriverManager.getConnection(connectionString, userName, password);
+
152 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+
153 0 LOGGER.debug(
154
- } else {
-
155 0 LOGGER.debug("Unable to connect to the database" , ex);
-
156 0 throw new DatabaseException("Unable to connect to the database" );
-
157
- }
-
158 1 }
+
"Unable to start the database in server mode; reverting to single user mode" );
+
155 0 } catch (SQLException sqlex) {
+
156 0 LOGGER.debug("Unable to connect to the database" , ex);
+
157 0 throw new DatabaseException("Unable to connect to the database" );
+
158 0 }
159
+ } else {
+
160 0 LOGGER.debug("Unable to connect to the database" , ex);
+
161 0 throw new DatabaseException("Unable to connect to the database" );
+
162
+ }
+
163 2 }
+
164
-
160 1 if (shouldCreateSchema) {
-
161
+ 165 2 if (shouldCreateSchema) {
+
166
try {
-
162 0 createTables(conn);
-
163 0 } catch (DatabaseException dex) {
-
164 0 LOGGER.debug("" , dex);
-
165 0 throw new DatabaseException("Unable to create the database structure" );
-
166 0 }
-
167
+ 167 0 createTables(conn);
+
168 0 } catch (DatabaseException dex) {
+
169 0 LOGGER.debug("" , dex);
+
170 0 throw new DatabaseException("Unable to create the database structure" );
+
171 0 }
+
172
}
-
168
+ 173
try {
-
169 1 ensureSchemaVersion(conn);
-
170 0 } catch (DatabaseException dex) {
-
171 0 LOGGER.debug("" , dex);
-
172 0 throw new DatabaseException("Database schema does not match this version of dependency-check" , dex);
-
173 1 }
-
174
+ 174 2 ensureSchemaVersion(conn);
+
175 0 } catch (DatabaseException dex) {
+
176 0 LOGGER.debug("" , dex);
+
177 0 throw new DatabaseException("Database schema does not match this version of dependency-check" , dex);
+
178 2 }
+
179
} finally {
-
175 1 if (conn != null ) {
-
176
- try {
-
177 1 conn.close();
-
178 0 } catch (SQLException ex) {
-
179 0 LOGGER.debug("An error occurred closing the connection" , ex);
-
180 1 }
+
180 2 if (conn != null ) {
181
- }
-
182
- }
-
183 1 }
-
184
-
-
185
-
+
try {
+
182 2 conn.close();
+
183 0 } catch (SQLException ex) {
+
184 0 LOGGER.debug("An error occurred closing the connection" , ex);
+
185 2 }
186
-
+
} 187
-
-
188
-
+
}
+
188 2 }
189
-
+
190
- public static synchronized void cleanup() {
-
191 0 if (driver != null ) {
+
+
191
+
192
+
+
193
+
+
194
+
+
195
+ public static synchronized void cleanup() {
+
196 1 if (driver != null ) {
+
197
try {
-
193 0 DriverManager.deregisterDriver(driver);
-
194 0 } catch (SQLException ex) {
-
195 0 LOGGER.debug("An error occurred unloading the database driver" , ex);
-
196 0 } catch (Throwable unexpected) {
-
197 0 LOGGER.debug(
-
198
+ 198 1 DriverManager.deregisterDriver(driver);
+
199 0 } catch (SQLException ex) {
+
200 0 LOGGER.debug("An error occurred unloading the database driver" , ex);
+
201 0 } catch (Throwable unexpected) {
+
202 0 LOGGER.debug(
+
203
"An unexpected throwable occurred unloading the database driver" , unexpected);
-
199 0 }
-
200 0 driver = null ;
-
201
- }
-
202 0 connectionString = null ;
-
203 0 userName = null ;
-
204 0 password = null ;
-
205 0 }
+
204 1 }
+
205 1 driver = null ;
206
-
-
207
-
-
208
-
-
209
-
-
210
-
+
}
+
207 1 connectionString = null ;
+
208 1 userName = null ;
+
209 1 password = null ;
+
210 1 }
211
-
+
212
-
+
213
- public static Connection getConnection() throws DatabaseException {
-
214 6 initialize();
-
215 6 Connection conn = null ;
+
+
214
+
+
215
+
216
+
+
217
+
+
218
+ public static Connection getConnection() throws DatabaseException {
+
219 7 initialize();
+
220 7 Connection conn = null ;
+
221
try {
-
217 6 conn = DriverManager.getConnection(connectionString, userName, password);
-
218 0 } catch (SQLException ex) {
-
219 0 LOGGER.debug("" , ex);
-
220 0 throw new DatabaseException("Unable to connect to the database" );
-
221 6 }
-
222 6 return conn;
-
223
- }
-
224
-
-
225
-
-
226
-
-
227
-
+
222 7 conn = DriverManager.getConnection(connectionString, userName, password);
+
223 0 } catch (SQLException ex) {
+
224 0 LOGGER.debug("" , ex);
+
225 0 throw new DatabaseException("Unable to connect to the database" );
+
226 7 }
+
227 7 return conn;
228
-
-
229
-
-
230
-
-
231
- private static boolean h2DataFileExists() throws IOException {
-
232 1 final File dir = Settings.getDataDirectory();
-
233 1 final String fileName = Settings.getString(Settings.KEYS.DB_FILE_NAME);
-
234 1 final File file = new File(dir, fileName);
-
235 1 return file.exists();
-
236
}
-
237
+ 229
-
238
+ 230
-
239
-
-
240
+ 231
+
+
232
+
233
+
+
234
+
+
235
+
+
236
+ private static boolean h2DataFileExists() throws IOException {
+
237 2 final File dir = Settings.getDataDirectory();
+
238 2 final String fileName = Settings.getString(Settings.KEYS.DB_FILE_NAME);
+
239 2 final File file = new File(dir, fileName);
+
240 2 return file.exists();
241
-
+
} 242
-
+
243
-
+
244
- private static void createTables(Connection conn) throws DatabaseException {
-
245 0 LOGGER.debug("Creating database structure" );
+
+
245
+
246
- InputStream is;
+
247
- InputStreamReader reader;
-
248 0 BufferedReader in = null ;
+
+
248
+
249
+ private static void createTables(Connection conn) throws DatabaseException {
+
250 0 LOGGER.debug("Creating database structure" );
+
251 0 InputStream is = null ;
+
252
try {
-
250 0 is = ConnectionFactory.class .getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE);
-
251 0 reader = new InputStreamReader(is, "UTF-8" );
-
252 0 in = new BufferedReader(reader);
-
253 0 final StringBuilder sb = new StringBuilder(2110);
-
254
- String tmp;
-
255 0 while ((tmp = in.readLine()) != null ) {
-
256 0 sb.append(tmp);
+
253 0 is = ConnectionFactory.class .getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE);
+
254 0 final String dbStructure = IOUtils.toString(is, "UTF-8" );
+
255
+
+
256 0 Statement statement = null ;
257
- }
-
258 0 Statement statement = null ;
-
259
try {
-
260 0 statement = conn.createStatement();
-
261 0 statement.execute(sb.toString());
-
262 0 } catch (SQLException ex) {
-
263 0 LOGGER.debug("" , ex);
-
264 0 throw new DatabaseException("Unable to create database statement" , ex);
-
265
+ 258 0 statement = conn.createStatement();
+
259 0 statement.execute(dbStructure);
+
260 0 } catch (SQLException ex) {
+
261 0 LOGGER.debug("" , ex);
+
262 0 throw new DatabaseException("Unable to create database statement" , ex);
+
263
} finally {
-
266 0 DBUtils.closeStatement(statement);
-
267 0 }
-
268 0 } catch (IOException ex) {
-
269 0 throw new DatabaseException("Unable to create database schema" , ex);
-
270
+ 264 0 DBUtils.closeStatement(statement);
+
265 0 }
+
266 0 } catch (IOException ex) {
+
267 0 throw new DatabaseException("Unable to create database schema" , ex);
+
268
} finally {
-
271 0 if (in != null ) {
+
269 0 IOUtils.closeQuietly(is);
+
270 0 }
+
271 0 }
272
- try {
-
273 0 in.close();
-
274 0 } catch (IOException ex) {
-
275 0 LOGGER.trace("" , ex);
-
276 0 }
-
277
- }
-
278
- }
-
279 0 }
-
280
-
281
+ 273
-
282
+ 274
-
283
+ 275
-
284
+ 276
-
285
+ 277
-
286
+ 278
-
287
+ 279
-
288
+ 280
-
289
+ 281
-
290
+ 282
private static void updateSchema(Connection conn, String schema) throws DatabaseException {
-
291 0 LOGGER.debug("Updating database structure" );
-
292
- InputStream is;
+
283
+ final String databaseProductName;
+
284
+ try {
+
285 0 databaseProductName = conn.getMetaData().getDatabaseProductName();
+
286 0 } catch (SQLException ex) {
+
287 0 throw new DatabaseException("Unable to get the database product name" );
+
288 0 }
+
289 0 if ("h2" .equalsIgnoreCase(databaseProductName)) {
+
290 0 LOGGER.debug("Updating database structure" );
+
291 0 InputStream is = null ;
+
292 0 String updateFile = null ;
293
- InputStreamReader reader;
-
294 0 BufferedReader in = null ;
-
295 0 String updateFile = null ;
-
296
- try {
-
297 0 updateFile = String.format(DB_STRUCTURE_UPDATE_RESOURCE, schema);
-
298 0 is = ConnectionFactory.class .getClassLoader().getResourceAsStream(updateFile);
-
299 0 if (is == null ) {
-
300 0 throw new DatabaseException(String.format("Unable to load update file '%s'" , updateFile));
-
301
- }
-
302 0 reader = new InputStreamReader(is, "UTF-8" );
-
303 0 in = new BufferedReader(reader);
-
304 0 final StringBuilder sb = new StringBuilder(2110);
-
305
- String tmp;
-
306 0 while ((tmp = in.readLine()) != null ) {
-
307 0 sb.append(tmp);
-
308
- }
-
309 0 Statement statement = null ;
-
310
try {
-
311 0 statement = conn.createStatement();
-
312 0 statement.execute(sb.toString());
-
313 0 } catch (SQLException ex) {
-
314 0 LOGGER.debug("" , ex);
-
315 0 throw new DatabaseException("Unable to update database schema" , ex);
-
316
- } finally {
-
317 0 DBUtils.closeStatement(statement);
-
318 0 }
-
319 0 } catch (IOException ex) {
-
320 0 final String msg = String.format("Upgrade SQL file does not exist: %s" , updateFile);
-
321 0 throw new DatabaseException(msg, ex);
-
322
- } finally {
-
323 0 if (in != null ) {
-
324
- try {
-
325 0 in.close();
-
326 0 } catch (IOException ex) {
-
327 0 LOGGER.trace("" , ex);
-
328 0 }
-
329
- }
-
330
- }
-
331 0 }
-
332
+ 294 0 updateFile = String.format(DB_STRUCTURE_UPDATE_RESOURCE, schema);
+
295 0 is = ConnectionFactory.class .getClassLoader().getResourceAsStream(updateFile);
+
296 0 if (is == null ) {
+
297 0 throw new DatabaseException(String.format("Unable to load update file '%s'" , updateFile));
+
298
+ }
+
299 0 final String dbStructureUpdate = IOUtils.toString(is, "UTF-8" );
+
300
-
333
+ 301 0 Statement statement = null ;
+
302
+ try {
+
303 0 statement = conn.createStatement();
+
304 0 final boolean success = statement.execute(dbStructureUpdate);
+
305 0 if (!success && statement.getUpdateCount() <= 0) {
+
306 0 throw new DatabaseException(String.format("Unable to upgrade the database schema to %s" , schema));
+
307
+ }
+
308 0 } catch (SQLException ex) {
+
309 0 LOGGER.debug("" , ex);
+
310 0 throw new DatabaseException("Unable to update database schema" , ex);
+
311
+ } finally {
+
312 0 DBUtils.closeStatement(statement);
+
313 0 }
+
314 0 } catch (IOException ex) {
+
315 0 final String msg = String.format("Upgrade SQL file does not exist: %s" , updateFile);
+
316 0 throw new DatabaseException(msg, ex);
+
317
+ } finally {
+
318 0 IOUtils.closeQuietly(is);
+
319 0 }
+
320 0 } else {
+
321 0 LOGGER.error("The database schema must be upgraded to use this version of dependency-check. Please see {} for more information." , UPGRADE_HELP_URL);
+
322 0 throw new DatabaseException("Database schema is out of date" );
+
323
+ }
+
324 0 }
+
325
+
+
326
-
334
-
-
335
-
-
336
-
-
337
-
-
338
+ 327
+
+
328
-
339
+ 329 1 private static int callDepth = 0;
+
330
+
+
331
+
+
332
+
+
333
+
+
334
+
+
335
+
+
336
+
+
337
private static void ensureSchemaVersion(Connection conn) throws DatabaseException {
-
340 1 ResultSet rs = null ;
-
341 1 CallableStatement cs = null ;
-
342
+ 338 2 ResultSet rs = null ;
+
339 2 CallableStatement cs = null ;
+
340
try {
-
343
+ 341
-
344 1 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'" );
-
345 1 rs = cs.executeQuery();
-
346 1 if (rs.next()) {
-
347 1 if (!DB_SCHEMA_VERSION.equals(rs.getString(1))) {
+
342 2 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'" );
+
343 2 rs = cs.executeQuery();
+
344 2 if (rs.next()) {
+
345 2 final DependencyVersion current = DependencyVersionUtil.parseVersion(DB_SCHEMA_VERSION);
+
346 2 final DependencyVersion db = DependencyVersionUtil.parseVersion(rs.getString(1));
+
347 2 if (current.compareTo(db) > 0) {
348 0 LOGGER.debug("Current Schema: " + DB_SCHEMA_VERSION);
349 0 LOGGER.debug("DB Schema: " + rs.getString(1));
350 0 updateSchema(conn, rs.getString(1));
-
351
- }
-
352
- } else {
-
353 0 throw new DatabaseException("Database schema is missing" );
+
351 0 if (++callDepth < 10) {
+
352 0 ensureSchemaVersion(conn);
+
353
+ }
354
+ }
+
355 2 } else {
+
356 0 throw new DatabaseException("Database schema is missing" );
+
357
}
-
355 0 } catch (SQLException ex) {
-
356 0 LOGGER.debug("" , ex);
-
357 0 throw new DatabaseException("Unable to check the database schema version" );
-
358
+ 358 0 } catch (SQLException ex) {
+
359 0 LOGGER.debug("" , ex);
+
360 0 throw new DatabaseException("Unable to check the database schema version" );
+
361
} finally {
-
359 1 DBUtils.closeResultSet(rs);
-
360 1 DBUtils.closeStatement(cs);
-
361 1 }
-
362 1 }
-
363
+ 362 2 DBUtils.closeResultSet(rs);
+
363 2 DBUtils.closeStatement(cs);
+
364 2 }
+
365 2 }
+
366
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
index e5fa97792..7fd7590eb 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
@@ -58,65 +58,63 @@
20
21
-
+
22
-
-
23
-
24
+ 23
-
25
+ 24
+
25
+ public class CorruptDatabaseException extends DatabaseException {
26
- class CorruptDatabaseException extends DatabaseException {
+
27
-
+
28
-
-
29
+
29
+
30
-
-
31
private static final long serialVersionUID = 1L;
+
31
+
32
-
+
33
-
+
34
-
+
35
-
+
36
-
+
37
-
-
38
public CorruptDatabaseException(String msg) {
-
39 0 super (msg);
-
40 0 }
-
41
+ 38 0 super (msg);
+
39 0 }
+
40
-
42
+ 41
+
42
+
43
-
-
44
-
45
+ 44
-
46
+ 45
-
47
+ 46
-
48
+ 47
public CorruptDatabaseException(String msg, Exception ex) {
-
49 0 super (msg, ex);
-
50 0 }
-
51
+ 48 0 super (msg, ex);
+
49 0 }
+
50
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html
index d2ca8c388..8f6f8cc50 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html
@@ -12,7 +12,7 @@
@@ -80,1156 +80,1118 @@
31
import java.util.List;
32
- import java.util.Map;
+
import java.util.Locale; 33
- import java.util.Map.Entry;
+
import java.util.Map; 34
- import java.util.Properties;
+
import java.util.Map.Entry; 35
- import java.util.ResourceBundle;
+
import java.util.MissingResourceException; 36
- import java.util.Set;
+
import java.util.Properties; 37
- import org.owasp.dependencycheck.data.cwe.CweDB;
+
import java.util.ResourceBundle; 38
- import org.owasp.dependencycheck.dependency.Reference;
+
import java.util.Set; 39
- import org.owasp.dependencycheck.dependency.Vulnerability;
+
import org.owasp.dependencycheck.data.cwe.CweDB; 40
- import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+
import org.owasp.dependencycheck.dependency.Reference; 41
- import org.owasp.dependencycheck.utils.DBUtils;
+
import org.owasp.dependencycheck.dependency.Vulnerability; 42
- import org.owasp.dependencycheck.utils.DependencyVersion;
+
import org.owasp.dependencycheck.dependency.VulnerableSoftware; 43
- import org.owasp.dependencycheck.utils.DependencyVersionUtil;
+
import org.owasp.dependencycheck.utils.DBUtils; 44
- import org.owasp.dependencycheck.utils.Pair;
+
import org.owasp.dependencycheck.utils.DependencyVersion; 45
- import org.owasp.dependencycheck.utils.Settings;
+
import org.owasp.dependencycheck.utils.DependencyVersionUtil; 46
- import org.slf4j.Logger;
+
import org.owasp.dependencycheck.utils.Pair; 47
- import org.slf4j.LoggerFactory;
+
import org.owasp.dependencycheck.utils.Settings; 48
-
+
import org.slf4j.Logger; 49
-
+
import org.slf4j.LoggerFactory; 50
-
+
51
-
+
52
-
+
53
-
+
54
- public class CveDB {
+
55
-
+
56
-
+
public class CveDB { 57
-
+
58
-
-
59 1 private static final Logger LOGGER = LoggerFactory.getLogger(CveDB.class );
+
+
59
+
60
-
-
61
-
+
+
61 1 private static final Logger LOGGER = LoggerFactory.getLogger(CveDB.class );
62
-
+
63
- private Connection conn;
+
64
-
+
65
-
+
private Connection conn; 66
-
-
67 6 private ResourceBundle statementBundle = null ;
+
+
67
+
68
-
-
69
-
+
+
69 6 private ResourceBundle statementBundle = null ;
70
-
+
71
-
+
72
-
+
73
-
+
74
-
+
75
+
+
76
+
+
77
public CveDB() throws DatabaseException {
-
76 6 super ();
-
77 6 statementBundle = ResourceBundle.getBundle("data/dbStatements" );
-
78
+ 78 6 super ();
+
79
try {
-
79 6 open();
-
80 6 databaseProperties = new DatabaseProperties(this );
-
81 0 } catch (DatabaseException ex) {
-
82 0 throw ex;
-
83 6 }
-
84 6 }
-
85
-
-
86
-
-
87
-
-
88
-
-
89
-
-
90
-
-
91
- protected Connection getConnection() {
-
92 37 return conn;
-
93
- }
-
94
-
-
95
-
-
96
-
-
97
-
-
98
-
-
99
-
-
100
- public final void open() throws DatabaseException {
-
101 12 if (!isOpen()) {
-
102 6 conn = ConnectionFactory.getConnection();
-
103
- }
-
104 12 }
-
105
-
-
106
-
-
107
-
-
108
-
-
109
- public void close() {
-
110 8 if (conn != null ) {
-
111
+ 80 6 open();
+
81
try {
-
112 6 conn.close();
-
113 0 } catch (SQLException ex) {
-
114 0 LOGGER.error("There was an error attempting to close the CveDB, see the log for more details." );
-
115 0 LOGGER.debug("" , ex);
-
116 0 } catch (Throwable ex) {
-
117 0 LOGGER.error("There was an exception attempting to close the CveDB, see the log for more details." );
-
118 0 LOGGER.debug("" , ex);
-
119 6 }
-
120 6 conn = null ;
-
121
- }
-
122 8 }
-
123
+ 82 6 final String databaseProductName = conn.getMetaData().getDatabaseProductName();
+
83 6 LOGGER.debug("Database dialect: {}" , databaseProductName);
+
84 6 final Locale dbDialect = new Locale(databaseProductName);
+
85 6 statementBundle = ResourceBundle.getBundle("data/dbStatements" , dbDialect);
+
86 0 } catch (SQLException se) {
+
87 0 LOGGER.warn("Problem loading database specific dialect!" , se);
+
88 0 statementBundle = ResourceBundle.getBundle("data/dbStatements" );
+
89 6 }
+
90 6 databaseProperties = new DatabaseProperties(this );
+
91 0 } catch (DatabaseException ex) {
+
92 0 throw ex;
+
93 6 }
+
94 6 }
+
95
-
124
+ 96
-
125
-
-
126
+ 97
+
+
98
-
127
-
-
128
+ 99
+
+
100
-
129
- public boolean isOpen() {
-
130 12 return conn != null ;
-
131
+ 101
+ protected Connection getConnection() {
+
102 35 return conn;
+
103
}
-
132
+ 104
+
105
+
+
106
+
+
107
+
+
108
+
+
109
+
+
110
+ public final void open() throws DatabaseException {
+
111 12 if (!isOpen()) {
+
112 6 conn = ConnectionFactory.getConnection();
+
113
+ }
+
114 12 }
+
115
+
+
116
+
+
117
+
+
118
+
+
119
+ public void close() {
+
120 11 if (conn != null ) {
+
121
+ try {
+
122 6 conn.close();
+
123 0 } catch (SQLException ex) {
+
124 0 LOGGER.error("There was an error attempting to close the CveDB, see the log for more details." );
+
125 0 LOGGER.debug("" , ex);
+
126 0 } catch (Throwable ex) {
+
127 0 LOGGER.error("There was an exception attempting to close the CveDB, see the log for more details." );
+
128 0 LOGGER.debug("" , ex);
+
129 6 }
+
130 6 conn = null ;
+
131
+ }
+
132 11 }
133
-
-
134
-
-
135
-
-
136
-
-
137
-
-
138
- public void commit() throws SQLException {
-
139
-
-
140
-
-
141
-
-
142
-
-
143 0 }
-
144
-
145
+ 134
-
146
-
-
147
+ 135
+
+
136
-
148
-
-
149
+ 137
+
+
138
-
150
- @Override
-
151
- @SuppressWarnings("FinalizeDeclaration" )
-
152
- protected void finalize() throws Throwable {
-
153 2 LOGGER.debug("Entering finalize" );
-
154 2 close();
-
155 2 super .finalize();
-
156 2 }
-
157
+ 139
+ public boolean isOpen() {
+
140 12 return conn != null ;
+
141
+ }
+
142
+
+
143
+
144
+
+
145
+
+
146
+
+
147
+
+
148
+ public void commit() throws SQLException {
+
149
+
+
150
+
+
151
+
+
152
+
+
153 0 }
+
154
+
+
155
+
+
156
+
+
157
+
158
-
+
159
160
- private DatabaseProperties databaseProperties;
+
@Override 161
-
+
@SuppressWarnings("FinalizeDeclaration" ) 162
-
-
163
-
-
164
-
-
165
-
-
166
-
+
protected void finalize() throws Throwable {
+
163 5 LOGGER.debug("Entering finalize" );
+
164 5 close();
+
165 5 super .finalize();
+
166 5 }
167
- public DatabaseProperties getDatabaseProperties() {
-
168 3 return databaseProperties;
-
169
- }
-
170
-
-
171
+
168
+
+
169
+
+
170
+ private DatabaseProperties databaseProperties;
+
171
+
172
-
+
173
-
+
174
175
-
+
176
-
+
177
-
-
178
-
+
public DatabaseProperties getDatabaseProperties() {
+
178 3 return databaseProperties;
179
- public Set<VulnerableSoftware> getCPEs(String vendor, String product) {
-
180 3 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>();
-
181 3 ResultSet rs = null ;
-
182 3 PreparedStatement ps = null ;
+
}
+
180
+
+
181
+
+
182
+
183
- try {
-
184 3 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_CPE_ENTRIES" ));
-
185 3 ps.setString(1, vendor);
-
186 3 ps.setString(2, product);
-
187 3 rs = ps.executeQuery();
+
+
184
+
+
185
+
+
186
+
+
187
+
188
+
+
189
+ public Set<VulnerableSoftware> getCPEs(String vendor, String product) {
+
190 2 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>();
+
191 2 ResultSet rs = null ;
+
192 2 PreparedStatement ps = null ;
+
193
+ try {
+
194 2 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_CPE_ENTRIES" ));
+
195 2 ps.setString(1, vendor);
+
196 2 ps.setString(2, product);
+
197 2 rs = ps.executeQuery();
+
198
-
189 112 while (rs.next()) {
-
190 109 final VulnerableSoftware vs = new VulnerableSoftware();
-
191 109 vs.setCpe(rs.getString(1));
-
192 109 cpe.add(vs);
-
193 109 }
-
194 0 } catch (SQLException ex) {
-
195 0 LOGGER.error("An unexpected SQL Exception occurred; please see the verbose log for more details." );
-
196 0 LOGGER.debug("" , ex);
-
197
- } finally {
-
198 3 DBUtils.closeResultSet(rs);
-
199 3 DBUtils.closeStatement(ps);
-
200 3 }
-
201 3 return cpe;
-
202
- }
-
203
-
-
204
-
-
205
-
-
206
-
+
199 80 while (rs.next()) {
+
200 78 final VulnerableSoftware vs = new VulnerableSoftware();
+
201 78 vs.setCpe(rs.getString(1));
+
202 78 cpe.add(vs);
+
203 78 }
+
204 0 } catch (SQLException ex) {
+
205 0 LOGGER.error("An unexpected SQL Exception occurred; please see the verbose log for more details." );
+
206 0 LOGGER.debug("" , ex);
207
-
-
208
-
-
209
-
-
210
- public Set<Pair<String, String>> getVendorProductList() throws DatabaseException {
-
211 1 final Set<Pair<String, String>> data = new HashSet<Pair<String, String>>();
-
212 1 ResultSet rs = null ;
-
213 1 PreparedStatement ps = null ;
+
} finally {
+
208 2 DBUtils.closeResultSet(rs);
+
209 2 DBUtils.closeStatement(ps);
+
210 2 }
+
211 2 return cpe;
+
212
+ }
+
213
+
214
- try {
-
215 1 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_VENDOR_PRODUCT_LIST" ));
-
216 1 rs = ps.executeQuery();
-
217 25291 while (rs.next()) {
-
218 25290 data.add(new Pair<String, String>(rs.getString(1), rs.getString(2)));
+
+
215
+
+
216
+
+
217
+
+
218
+
219
- }
-
220 0 } catch (SQLException ex) {
-
221 0 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
-
222 0 throw new DatabaseException(msg, ex);
-
223
- } finally {
-
224 1 DBUtils.closeResultSet(rs);
-
225 1 DBUtils.closeStatement(ps);
-
226 1 }
-
227 1 return data;
-
228
- }
+
+
220
+ public Set<Pair<String, String>> getVendorProductList() throws DatabaseException {
+
221 1 final Set<Pair<String, String>> data = new HashSet<Pair<String, String>>();
+
222 1 ResultSet rs = null ;
+
223 1 PreparedStatement ps = null ;
+
224
+ try {
+
225 1 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_VENDOR_PRODUCT_LIST" ));
+
226 1 rs = ps.executeQuery();
+
227 22137 while (rs.next()) {
+
228 22136 data.add(new Pair<String, String>(rs.getString(1), rs.getString(2)));
229
-
-
230
-
-
231
-
-
232
-
-
233
-
-
234
-
-
235
- Properties getProperties() {
-
236 6 final Properties prop = new Properties();
-
237 6 PreparedStatement ps = null ;
-
238 6 ResultSet rs = null ;
-
239
- try {
-
240 6 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_PROPERTIES" ));
-
241 6 rs = ps.executeQuery();
-
242 120 while (rs.next()) {
-
243 114 prop.setProperty(rs.getString(1), rs.getString(2));
-
244
}
-
245 0 } catch (SQLException ex) {
-
246 0 LOGGER.error("An unexpected SQL Exception occurred; please see the verbose log for more details." );
-
247 0 LOGGER.debug("" , ex);
-
248
+ 230 0 } catch (SQLException ex) {
+
231 0 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
+
232 0 throw new DatabaseException(msg, ex);
+
233
} finally {
-
249 6 DBUtils.closeStatement(ps);
-
250 6 DBUtils.closeResultSet(rs);
-
251 6 }
-
252 6 return prop;
-
253
+ 234 1 DBUtils.closeResultSet(rs);
+
235 1 DBUtils.closeStatement(ps);
+
236 1 }
+
237 1 return data;
+
238
}
-
254
+ 239
-
255
+ 240
-
256
-
-
257
+ 241
+
+
242
-
258
-
-
259
+ 243
+
+
244
-
260
- void saveProperties(Properties props) {
-
261 0 PreparedStatement updateProperty = null ;
-
262 0 PreparedStatement insertProperty = null ;
-
263
+ 245
+ Properties getProperties() {
+
246 6 final Properties prop = new Properties();
+
247 6 PreparedStatement ps = null ;
+
248 6 ResultSet rs = null ;
+
249
try {
+
250 6 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_PROPERTIES" ));
+
251 6 rs = ps.executeQuery();
+
252 96 while (rs.next()) {
+
253 90 prop.setProperty(rs.getString(1), rs.getString(2));
+
254
+ }
+
255 0 } catch (SQLException ex) {
+
256 0 LOGGER.error("An unexpected SQL Exception occurred; please see the verbose log for more details." );
+
257 0 LOGGER.debug("" , ex);
+
258
+ } finally {
+
259 6 DBUtils.closeStatement(ps);
+
260 6 DBUtils.closeResultSet(rs);
+
261 6 }
+
262 6 return prop;
+
263
+ }
264
- try {
-
265 0 updateProperty = getConnection().prepareStatement(statementBundle.getString("UPDATE_PROPERTY" ));
-
266 0 insertProperty = getConnection().prepareStatement(statementBundle.getString("INSERT_PROPERTY" ));
-
267 0 } catch (SQLException ex) {
-
268 0 LOGGER.warn("Unable to save properties to the database" );
-
269 0 LOGGER.debug("Unable to save properties to the database" , ex);
+
+
265
+
+
266
+
+
267
+
+
268
+
+
269
+
270
- return ;
-
271 0 }
-
272 0 for (Entry<Object, Object> entry : props.entrySet()) {
-
273 0 final String key = entry.getKey().toString();
-
274 0 final String value = entry.getValue().toString();
+
+
271
+ void saveProperty(String key, String value) {
+
272
+ try {
+
273
+ try {
+
274 0 final PreparedStatement mergeProperty = getConnection().prepareStatement(statementBundle.getString("MERGE_PROPERTY" ));
275
try {
-
276 0 updateProperty.setString(1, value);
-
277 0 updateProperty.setString(2, key);
-
278 0 if (updateProperty.executeUpdate() == 0) {
-
279 0 insertProperty.setString(1, key);
-
280 0 insertProperty.setString(2, value);
-
281
- }
-
282 0 } catch (SQLException ex) {
-
283 0 LOGGER.warn("Unable to save property '{}' with a value of '{}' to the database" , key, value);
-
284 0 LOGGER.debug("" , ex);
-
285 0 }
-
286 0 }
-
287
- } finally {
-
288 0 DBUtils.closeStatement(updateProperty);
-
289 0 DBUtils.closeStatement(insertProperty);
-
290 0 }
-
291 0 }
-
292
-
-
293
-
-
294
-
+
276 0 mergeProperty.setString(1, key);
+
277 0 mergeProperty.setString(2, value);
+
278 0 mergeProperty.executeUpdate();
+
279
+ } finally {
+
280 0 DBUtils.closeStatement(mergeProperty);
+
281 0 }
+
282 0 } catch (MissingResourceException mre) {
+
283
+
+
284 0 PreparedStatement updateProperty = null ;
+
285 0 PreparedStatement insertProperty = null ;
+
286
+ try {
+
287 0 updateProperty = getConnection().prepareStatement(statementBundle.getString("UPDATE_PROPERTY" ));
+
288 0 updateProperty.setString(1, value);
+
289 0 updateProperty.setString(2, key);
+
290 0 if (updateProperty.executeUpdate() == 0) {
+
291 0 insertProperty = getConnection().prepareStatement(statementBundle.getString("INSERT_PROPERTY" ));
+
292 0 insertProperty.setString(1, key);
+
293 0 insertProperty.setString(2, value);
+
294 0 insertProperty.executeUpdate();
295
-
-
296
-
-
297
-
-
298
-
-
299
- void saveProperty(String key, String value) {
-
300 0 PreparedStatement updateProperty = null ;
-
301 0 PreparedStatement insertProperty = null ;
-
302
- try {
-
303
- try {
-
304 0 updateProperty = getConnection().prepareStatement(statementBundle.getString("UPDATE_PROPERTY" ));
-
305 0 } catch (SQLException ex) {
-
306 0 LOGGER.warn("Unable to save properties to the database" );
-
307 0 LOGGER.debug("Unable to save properties to the database" , ex);
-
308
- return ;
-
309 0 }
-
310
- try {
-
311 0 updateProperty.setString(1, value);
-
312 0 updateProperty.setString(2, key);
-
313 0 if (updateProperty.executeUpdate() == 0) {
-
314
- try {
-
315 0 insertProperty = getConnection().prepareStatement(statementBundle.getString("INSERT_PROPERTY" ));
-
316 0 } catch (SQLException ex) {
-
317 0 LOGGER.warn("Unable to save properties to the database" );
-
318 0 LOGGER.debug("Unable to save properties to the database" , ex);
-
319
- return ;
-
320 0 }
-
321 0 insertProperty.setString(1, key);
-
322 0 insertProperty.setString(2, value);
-
323 0 insertProperty.execute();
-
324
- }
-
325 0 } catch (SQLException ex) {
-
326 0 LOGGER.warn("Unable to save property '{}' with a value of '{}' to the database" , key, value);
-
327 0 LOGGER.debug("" , ex);
-
328 0 }
-
329
- } finally {
-
330 0 DBUtils.closeStatement(updateProperty);
-
331 0 DBUtils.closeStatement(insertProperty);
-
332 0 }
-
333 0 }
-
334
-
-
335
-
-
336
-
-
337
-
-
338
-
-
339
-
-
340
-
-
341
-
-
342
- public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException {
-
343 3 final VulnerableSoftware cpe = new VulnerableSoftware();
-
344
- try {
-
345 3 cpe.parseName(cpeStr);
-
346 0 } catch (UnsupportedEncodingException ex) {
-
347 0 LOGGER.trace("" , ex);
-
348 3 }
-
349 3 final DependencyVersion detectedVersion = parseDependencyVersion(cpe);
-
350 3 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
-
351
-
-
352 3 PreparedStatement ps = null ;
-
353 3 ResultSet rs = null ;
-
354
- try {
-
355 3 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_CVE_FROM_SOFTWARE" ));
-
356 3 ps.setString(1, cpe.getVendor());
-
357 3 ps.setString(2, cpe.getProduct());
-
358 3 rs = ps.executeQuery();
-
359 3 String currentCVE = "" ;
-
360
-
-
361 3 final Map<String, Boolean> vulnSoftware = new HashMap<String, Boolean>();
-
362 282 while (rs.next()) {
-
363 279 final String cveId = rs.getString(1);
-
364 279 if (!currentCVE.equals(cveId)) {
-
365 10 final Entry<String, Boolean> matchedCPE = getMatchingSoftware(vulnSoftware, cpe.getVendor(), cpe.getProduct(), detectedVersion);
-
366 10 if (matchedCPE != null ) {
-
367 6 final Vulnerability v = getVulnerability(currentCVE);
-
368 6 v.setMatchedCPE(matchedCPE.getKey(), matchedCPE.getValue() ? "Y" : null );
-
369 6 vulnerabilities.add(v);
-
370
}
-
371 10 vulnSoftware.clear();
-
372 10 currentCVE = cveId;
-
373
- }
-
374
+ 296
+ } finally {
+
297 0 DBUtils.closeStatement(updateProperty);
+
298 0 DBUtils.closeStatement(insertProperty);
+
299 0 }
+
300 0 }
+
301 0 } catch (SQLException ex) {
+
302 0 LOGGER.warn("Unable to save property '{}' with a value of '{}' to the database" , key, value);
+
303 0 LOGGER.debug("" , ex);
+
304 0 }
+
305 0 }
+
306
-
375 279 final String cpeId = rs.getString(2);
-
376 279 final String previous = rs.getString(3);
-
377 279 final Boolean p = previous != null && !previous.isEmpty();
-
378 279 vulnSoftware.put(cpeId, p);
-
379 279 }
-
380
-
-
381 3 final Entry<String, Boolean> matchedCPE = getMatchingSoftware(vulnSoftware, cpe.getVendor(), cpe.getProduct(), detectedVersion);
-
382 3 if (matchedCPE != null ) {
-
383 2 final Vulnerability v = getVulnerability(currentCVE);
-
384 2 v.setMatchedCPE(matchedCPE.getKey(), matchedCPE.getValue() ? "Y" : null );
-
385 2 vulnerabilities.add(v);
-
386
- }
-
387 0 } catch (SQLException ex) {
-
388 0 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex);
-
389
- } finally {
-
390 3 DBUtils.closeResultSet(rs);
-
391 3 DBUtils.closeStatement(ps);
-
392 3 }
-
393 3 return vulnerabilities;
-
394
- }
-
395
-
-
396
+ 307
-
397
-
-
398
+ 308
+
+
309
-
399
-
-
400
-
-
401
-
-
402
+ 310
+
+
311
+
+
312
+
+
313
-
403
- private Vulnerability getVulnerability(String cve) throws DatabaseException {
-
404 8 PreparedStatement psV = null ;
-
405 8 PreparedStatement psR = null ;
-
406 8 PreparedStatement psS = null ;
-
407 8 ResultSet rsV = null ;
-
408 8 ResultSet rsR = null ;
-
409 8 ResultSet rsS = null ;
-
410 8 Vulnerability vuln = null ;
-
411
+ 314
+ public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException {
+
315 2 final VulnerableSoftware cpe = new VulnerableSoftware();
+
316
try {
-
412 8 psV = getConnection().prepareStatement(statementBundle.getString("SELECT_VULNERABILITY" ));
-
413 8 psV.setString(1, cve);
-
414 8 rsV = psV.executeQuery();
-
415 8 if (rsV.next()) {
-
416 8 vuln = new Vulnerability();
-
417 8 vuln.setName(cve);
-
418 8 vuln.setDescription(rsV.getString(2));
-
419 8 String cwe = rsV.getString(3);
-
420 8 if (cwe != null ) {
-
421 8 final String name = CweDB.getCweName(cwe);
-
422 8 if (name != null ) {
-
423 7 cwe += " " + name;
+
317 2 cpe.parseName(cpeStr);
+
318 0 } catch (UnsupportedEncodingException ex) {
+
319 0 LOGGER.trace("" , ex);
+
320 2 }
+
321 2 final DependencyVersion detectedVersion = parseDependencyVersion(cpe);
+
322 2 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
+
323
+
+
324 2 PreparedStatement ps = null ;
+
325 2 ResultSet rs = null ;
+
326
+ try {
+
327 2 ps = getConnection().prepareStatement(statementBundle.getString("SELECT_CVE_FROM_SOFTWARE" ));
+
328 2 ps.setString(1, cpe.getVendor());
+
329 2 ps.setString(2, cpe.getProduct());
+
330 2 rs = ps.executeQuery();
+
331 2 String currentCVE = "" ;
+
332
+
+
333 2 final Map<String, Boolean> vulnSoftware = new HashMap<String, Boolean>();
+
334 225 while (rs.next()) {
+
335 223 final String cveId = rs.getString(1);
+
336 223 if (!currentCVE.equals(cveId)) {
+
337 8 final Entry<String, Boolean> matchedCPE = getMatchingSoftware(vulnSoftware, cpe.getVendor(), cpe.getProduct(), detectedVersion);
+
338 8 if (matchedCPE != null ) {
+
339 6 final Vulnerability v = getVulnerability(currentCVE);
+
340 6 v.setMatchedCPE(matchedCPE.getKey(), matchedCPE.getValue() ? "Y" : null );
+
341 6 vulnerabilities.add(v);
+
342
+ }
+
343 8 vulnSoftware.clear();
+
344 8 currentCVE = cveId;
+
345
+ }
+
346
+
+
347 223 final String cpeId = rs.getString(2);
+
348 223 final String previous = rs.getString(3);
+
349 223 final Boolean p = previous != null && !previous.isEmpty();
+
350 223 vulnSoftware.put(cpeId, p);
+
351 223 }
+
352
+
+
353 2 final Entry<String, Boolean> matchedCPE = getMatchingSoftware(vulnSoftware, cpe.getVendor(), cpe.getProduct(), detectedVersion);
+
354 2 if (matchedCPE != null ) {
+
355 2 final Vulnerability v = getVulnerability(currentCVE);
+
356 2 v.setMatchedCPE(matchedCPE.getKey(), matchedCPE.getValue() ? "Y" : null );
+
357 2 vulnerabilities.add(v);
+
358
+ }
+
359 0 } catch (SQLException ex) {
+
360 0 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex);
+
361
+ } finally {
+
362 2 DBUtils.closeResultSet(rs);
+
363 2 DBUtils.closeStatement(ps);
+
364 2 }
+
365 2 return vulnerabilities;
+
366
+ }
+
367
+
+
368
+
+
369
+
+
370
+
+
371
+
+
372
+
+
373
+
+
374
+
+
375
+ private Vulnerability getVulnerability(String cve) throws DatabaseException {
+
376 8 PreparedStatement psV = null ;
+
377 8 PreparedStatement psR = null ;
+
378 8 PreparedStatement psS = null ;
+
379 8 ResultSet rsV = null ;
+
380 8 ResultSet rsR = null ;
+
381 8 ResultSet rsS = null ;
+
382 8 Vulnerability vuln = null ;
+
383
+ try {
+
384 8 psV = getConnection().prepareStatement(statementBundle.getString("SELECT_VULNERABILITY" ));
+
385 8 psV.setString(1, cve);
+
386 8 rsV = psV.executeQuery();
+
387 8 if (rsV.next()) {
+
388 8 vuln = new Vulnerability();
+
389 8 vuln.setName(cve);
+
390 8 vuln.setDescription(rsV.getString(2));
+
391 8 String cwe = rsV.getString(3);
+
392 8 if (cwe != null ) {
+
393 8 final String name = CweDB.getCweName(cwe);
+
394 8 if (name != null ) {
+
395 7 cwe += ' ' + name;
+
396
+ }
+
397
+ }
+
398 8 final int cveId = rsV.getInt(1);
+
399 8 vuln.setCwe(cwe);
+
400 8 vuln.setCvssScore(rsV.getFloat(4));
+
401 8 vuln.setCvssAccessVector(rsV.getString(5));
+
402 8 vuln.setCvssAccessComplexity(rsV.getString(6));
+
403 8 vuln.setCvssAuthentication(rsV.getString(7));
+
404 8 vuln.setCvssConfidentialityImpact(rsV.getString(8));
+
405 8 vuln.setCvssIntegrityImpact(rsV.getString(9));
+
406 8 vuln.setCvssAvailabilityImpact(rsV.getString(10));
+
407
+
+
408 8 psR = getConnection().prepareStatement(statementBundle.getString("SELECT_REFERENCES" ));
+
409 8 psR.setInt(1, cveId);
+
410 8 rsR = psR.executeQuery();
+
411 76 while (rsR.next()) {
+
412 68 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
+
413
+ }
+
414 8 psS = getConnection().prepareStatement(statementBundle.getString("SELECT_SOFTWARE" ));
+
415 8 psS.setInt(1, cveId);
+
416 8 rsS = psS.executeQuery();
+
417 244 while (rsS.next()) {
+
418 236 final String cpe = rsS.getString(1);
+
419 236 final String prevVersion = rsS.getString(2);
+
420 236 if (prevVersion == null ) {
+
421 228 vuln.addVulnerableSoftware(cpe);
+
422
+ } else {
+
423 8 vuln.addVulnerableSoftware(cpe, prevVersion);
424
}
-
425
- }
-
426 8 final int cveId = rsV.getInt(1);
-
427 8 vuln.setCwe(cwe);
-
428 8 vuln.setCvssScore(rsV.getFloat(4));
-
429 8 vuln.setCvssAccessVector(rsV.getString(5));
-
430 8 vuln.setCvssAccessComplexity(rsV.getString(6));
-
431 8 vuln.setCvssAuthentication(rsV.getString(7));
-
432 8 vuln.setCvssConfidentialityImpact(rsV.getString(8));
-
433 8 vuln.setCvssIntegrityImpact(rsV.getString(9));
-
434 8 vuln.setCvssAvailabilityImpact(rsV.getString(10));
-
435
-
-
436 8 psR = getConnection().prepareStatement(statementBundle.getString("SELECT_REFERENCES" ));
-
437 8 psR.setInt(1, cveId);
-
438 8 rsR = psR.executeQuery();
-
439 76 while (rsR.next()) {
-
440 68 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
-
441
- }
-
442 8 psS = getConnection().prepareStatement(statementBundle.getString("SELECT_SOFTWARE" ));
-
443 8 psS.setInt(1, cveId);
-
444 8 rsS = psS.executeQuery();
-
445 244 while (rsS.next()) {
-
446 236 final String cpe = rsS.getString(1);
-
447 236 final String prevVersion = rsS.getString(2);
-
448 236 if (prevVersion == null ) {
-
449 228 vuln.addVulnerableSoftware(cpe);
-
450
- } else {
-
451 8 vuln.addVulnerableSoftware(cpe, prevVersion);
-
452
- }
-
453 236 }
-
454
+ 425 236 }
+
426
}
-
455 0 } catch (SQLException ex) {
-
456 0 throw new DatabaseException("Error retrieving " + cve, ex);
-
457
+ 427 0 } catch (SQLException ex) {
+
428 0 throw new DatabaseException("Error retrieving " + cve, ex);
+
429
} finally {
-
458 8 DBUtils.closeResultSet(rsV);
-
459 8 DBUtils.closeResultSet(rsR);
-
460 8 DBUtils.closeResultSet(rsS);
-
461 8 DBUtils.closeStatement(psV);
-
462 8 DBUtils.closeStatement(psR);
-
463 8 DBUtils.closeStatement(psS);
-
464 8 }
-
465 8 return vuln;
-
466
+ 430 8 DBUtils.closeResultSet(rsV);
+
431 8 DBUtils.closeResultSet(rsR);
+
432 8 DBUtils.closeResultSet(rsS);
+
433 8 DBUtils.closeStatement(psV);
+
434 8 DBUtils.closeStatement(psR);
+
435 8 DBUtils.closeStatement(psS);
+
436 8 }
+
437 8 return vuln;
+
438
}
-
467
+ 439
-
468
+ 440
-
469
+ 441
-
470
+ 442
-
471
+ 443
-
472
+ 444
-
473
+ 445
-
474
+ 446
public void updateVulnerability(Vulnerability vuln) throws DatabaseException {
-
475 0 PreparedStatement selectVulnerabilityId = null ;
-
476 0 PreparedStatement deleteVulnerability = null ;
-
477 0 PreparedStatement deleteReferences = null ;
-
478 0 PreparedStatement deleteSoftware = null ;
-
479 0 PreparedStatement updateVulnerability = null ;
-
480 0 PreparedStatement insertVulnerability = null ;
-
481 0 PreparedStatement insertReference = null ;
-
482 0 PreparedStatement selectCpeId = null ;
-
483 0 PreparedStatement insertCpe = null ;
-
484 0 PreparedStatement insertSoftware = null ;
-
485
+ 447 0 PreparedStatement selectVulnerabilityId = null ;
+
448 0 PreparedStatement deleteVulnerability = null ;
+
449 0 PreparedStatement deleteReferences = null ;
+
450 0 PreparedStatement deleteSoftware = null ;
+
451 0 PreparedStatement updateVulnerability = null ;
+
452 0 PreparedStatement insertVulnerability = null ;
+
453 0 PreparedStatement insertReference = null ;
+
454 0 PreparedStatement selectCpeId = null ;
+
455 0 PreparedStatement insertCpe = null ;
+
456 0 PreparedStatement insertSoftware = null ;
+
457
-
486
+ 458
try {
-
487 0 selectVulnerabilityId = getConnection().prepareStatement(statementBundle.getString("SELECT_VULNERABILITY_ID" ));
-
488 0 deleteVulnerability = getConnection().prepareStatement(statementBundle.getString("DELETE_VULNERABILITY" ));
-
489 0 deleteReferences = getConnection().prepareStatement(statementBundle.getString("DELETE_REFERENCE" ));
-
490 0 deleteSoftware = getConnection().prepareStatement(statementBundle.getString("DELETE_SOFTWARE" ));
-
491 0 updateVulnerability = getConnection().prepareStatement(statementBundle.getString("UPDATE_VULNERABILITY" ));
-
492 0 final String[] ids = {"id" };
-
493 0 insertVulnerability = getConnection().prepareStatement(statementBundle.getString("INSERT_VULNERABILITY" ),
-
494
+ 459 0 selectVulnerabilityId = getConnection().prepareStatement(statementBundle.getString("SELECT_VULNERABILITY_ID" ));
+
460 0 deleteVulnerability = getConnection().prepareStatement(statementBundle.getString("DELETE_VULNERABILITY" ));
+
461 0 deleteReferences = getConnection().prepareStatement(statementBundle.getString("DELETE_REFERENCE" ));
+
462 0 deleteSoftware = getConnection().prepareStatement(statementBundle.getString("DELETE_SOFTWARE" ));
+
463 0 updateVulnerability = getConnection().prepareStatement(statementBundle.getString("UPDATE_VULNERABILITY" ));
+
464 0 final String[] ids = {"id" };
+
465 0 insertVulnerability = getConnection().prepareStatement(statementBundle.getString("INSERT_VULNERABILITY" ),
+
466
-
495
+ 467
ids);
-
496 0 insertReference = getConnection().prepareStatement(statementBundle.getString("INSERT_REFERENCE" ));
-
497 0 selectCpeId = getConnection().prepareStatement(statementBundle.getString("SELECT_CPE_ID" ));
-
498 0 insertCpe = getConnection().prepareStatement(statementBundle.getString("INSERT_CPE" ),
-
499
+ 468 0 insertReference = getConnection().prepareStatement(statementBundle.getString("INSERT_REFERENCE" ));
+
469 0 selectCpeId = getConnection().prepareStatement(statementBundle.getString("SELECT_CPE_ID" ));
+
470 0 insertCpe = getConnection().prepareStatement(statementBundle.getString("INSERT_CPE" ),
+
471
-
500
+ 472
ids);
-
501 0 insertSoftware = getConnection().prepareStatement(statementBundle.getString("INSERT_SOFTWARE" ));
-
502 0 int vulnerabilityId = 0;
-
503 0 selectVulnerabilityId.setString(1, vuln.getName());
-
504 0 ResultSet rs = selectVulnerabilityId.executeQuery();
-
505 0 if (rs.next()) {
-
506 0 vulnerabilityId = rs.getInt(1);
-
507
+ 473 0 insertSoftware = getConnection().prepareStatement(statementBundle.getString("INSERT_SOFTWARE" ));
+
474 0 int vulnerabilityId = 0;
+
475 0 selectVulnerabilityId.setString(1, vuln.getName());
+
476 0 ResultSet rs = selectVulnerabilityId.executeQuery();
+
477 0 if (rs.next()) {
+
478 0 vulnerabilityId = rs.getInt(1);
+
479
-
508 0 deleteReferences.setInt(1, vulnerabilityId);
-
509 0 deleteReferences.execute();
-
510 0 deleteSoftware.setInt(1, vulnerabilityId);
-
511 0 deleteSoftware.execute();
-
512
+ 480 0 deleteReferences.setInt(1, vulnerabilityId);
+
481 0 deleteReferences.execute();
+
482 0 deleteSoftware.setInt(1, vulnerabilityId);
+
483 0 deleteSoftware.execute();
+
484
}
-
513 0 DBUtils.closeResultSet(rs);
-
514 0 rs = null ;
-
515 0 if (vulnerabilityId != 0) {
-
516 0 if (vuln.getDescription().contains("** REJECT **" )) {
-
517 0 deleteVulnerability.setInt(1, vulnerabilityId);
-
518 0 deleteVulnerability.executeUpdate();
-
519
+ 485 0 DBUtils.closeResultSet(rs);
+
486 0 rs = null ;
+
487 0 if (vulnerabilityId != 0) {
+
488 0 if (vuln.getDescription().contains("** REJECT **" )) {
+
489 0 deleteVulnerability.setInt(1, vulnerabilityId);
+
490 0 deleteVulnerability.executeUpdate();
+
491
} else {
-
520 0 updateVulnerability.setString(1, vuln.getDescription());
-
521 0 updateVulnerability.setString(2, vuln.getCwe());
-
522 0 updateVulnerability.setFloat(3, vuln.getCvssScore());
-
523 0 updateVulnerability.setString(4, vuln.getCvssAccessVector());
-
524 0 updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
-
525 0 updateVulnerability.setString(6, vuln.getCvssAuthentication());
-
526 0 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
-
527 0 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
-
528 0 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
-
529 0 updateVulnerability.setInt(10, vulnerabilityId);
-
530 0 updateVulnerability.executeUpdate();
-
531
+ 492 0 updateVulnerability.setString(1, vuln.getDescription());
+
493 0 updateVulnerability.setString(2, vuln.getCwe());
+
494 0 updateVulnerability.setFloat(3, vuln.getCvssScore());
+
495 0 updateVulnerability.setString(4, vuln.getCvssAccessVector());
+
496 0 updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
+
497 0 updateVulnerability.setString(6, vuln.getCvssAuthentication());
+
498 0 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
+
499 0 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
+
500 0 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
+
501 0 updateVulnerability.setInt(10, vulnerabilityId);
+
502 0 updateVulnerability.executeUpdate();
+
503
}
-
532
+ 504
} else {
-
533 0 insertVulnerability.setString(1, vuln.getName());
-
534 0 insertVulnerability.setString(2, vuln.getDescription());
-
535 0 insertVulnerability.setString(3, vuln.getCwe());
-
536 0 insertVulnerability.setFloat(4, vuln.getCvssScore());
-
537 0 insertVulnerability.setString(5, vuln.getCvssAccessVector());
-
538 0 insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
-
539 0 insertVulnerability.setString(7, vuln.getCvssAuthentication());
-
540 0 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
-
541 0 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
-
542 0 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
-
543 0 insertVulnerability.execute();
-
544
+ 505 0 insertVulnerability.setString(1, vuln.getName());
+
506 0 insertVulnerability.setString(2, vuln.getDescription());
+
507 0 insertVulnerability.setString(3, vuln.getCwe());
+
508 0 insertVulnerability.setFloat(4, vuln.getCvssScore());
+
509 0 insertVulnerability.setString(5, vuln.getCvssAccessVector());
+
510 0 insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
+
511 0 insertVulnerability.setString(7, vuln.getCvssAuthentication());
+
512 0 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
+
513 0 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
+
514 0 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
+
515 0 insertVulnerability.execute();
+
516
try {
-
545 0 rs = insertVulnerability.getGeneratedKeys();
-
546 0 rs.next();
-
547 0 vulnerabilityId = rs.getInt(1);
-
548 0 } catch (SQLException ex) {
-
549 0 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'" , vuln.getName());
-
550 0 throw new DatabaseException(msg, ex);
-
551
+ 517 0 rs = insertVulnerability.getGeneratedKeys();
+
518 0 rs.next();
+
519 0 vulnerabilityId = rs.getInt(1);
+
520 0 } catch (SQLException ex) {
+
521 0 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'" , vuln.getName());
+
522 0 throw new DatabaseException(msg, ex);
+
523
} finally {
-
552 0 DBUtils.closeResultSet(rs);
-
553 0 rs = null ;
-
554 0 }
-
555
+ 524 0 DBUtils.closeResultSet(rs);
+
525 0 rs = null ;
+
526 0 }
+
527
}
-
556 0 insertReference.setInt(1, vulnerabilityId);
-
557 0 for (Reference r : vuln.getReferences()) {
-
558 0 insertReference.setString(2, r.getName());
-
559 0 insertReference.setString(3, r.getUrl());
-
560 0 insertReference.setString(4, r.getSource());
-
561 0 insertReference.execute();
-
562 0 }
-
563 0 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
-
564 0 int cpeProductId = 0;
-
565 0 selectCpeId.setString(1, s.getName());
-
566
+ 528 0 insertReference.setInt(1, vulnerabilityId);
+
529 0 for (Reference r : vuln.getReferences()) {
+
530 0 insertReference.setString(2, r.getName());
+
531 0 insertReference.setString(3, r.getUrl());
+
532 0 insertReference.setString(4, r.getSource());
+
533 0 insertReference.execute();
+
534 0 }
+
535 0 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
+
536 0 int cpeProductId = 0;
+
537 0 selectCpeId.setString(1, s.getName());
+
538
try {
-
567 0 rs = selectCpeId.executeQuery();
-
568 0 if (rs.next()) {
-
569 0 cpeProductId = rs.getInt(1);
-
570
+ 539 0 rs = selectCpeId.executeQuery();
+
540 0 if (rs.next()) {
+
541 0 cpeProductId = rs.getInt(1);
+
542
}
-
571 0 } catch (SQLException ex) {
-
572 0 throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex);
-
573
+ 543 0 } catch (SQLException ex) {
+
544 0 throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex);
+
545
} finally {
-
574 0 DBUtils.closeResultSet(rs);
-
575 0 rs = null ;
-
576 0 }
-
577
+ 546 0 DBUtils.closeResultSet(rs);
+
547 0 rs = null ;
+
548 0 }
+
549
-
578 0 if (cpeProductId == 0) {
-
579 0 insertCpe.setString(1, s.getName());
-
580 0 insertCpe.setString(2, s.getVendor());
-
581 0 insertCpe.setString(3, s.getProduct());
-
582 0 insertCpe.executeUpdate();
-
583 0 cpeProductId = DBUtils.getGeneratedKey(insertCpe);
-
584
+ 550 0 if (cpeProductId == 0) {
+
551 0 insertCpe.setString(1, s.getName());
+
552 0 insertCpe.setString(2, s.getVendor());
+
553 0 insertCpe.setString(3, s.getProduct());
+
554 0 insertCpe.executeUpdate();
+
555 0 cpeProductId = DBUtils.getGeneratedKey(insertCpe);
+
556
}
-
585 0 if (cpeProductId == 0) {
-
586 0 throw new DatabaseException("Unable to retrieve cpeProductId - no data returned" );
-
587
+ 557 0 if (cpeProductId == 0) {
+
558 0 throw new DatabaseException("Unable to retrieve cpeProductId - no data returned" );
+
559
}
+
560
+
+
561 0 insertSoftware.setInt(1, vulnerabilityId);
+
562 0 insertSoftware.setInt(2, cpeProductId);
+
563 0 if (s.getPreviousVersion() == null ) {
+
564 0 insertSoftware.setNull(3, java.sql.Types.VARCHAR);
+
565
+ } else {
+
566 0 insertSoftware.setString(3, s.getPreviousVersion());
+
567
+ }
+
568 0 insertSoftware.execute();
+
569 0 }
+
570
+
+
571 0 } catch (SQLException ex) {
+
572 0 final String msg = String.format("Error updating '%s'" , vuln.getName());
+
573 0 LOGGER.debug("" , ex);
+
574 0 throw new DatabaseException(msg, ex);
+
575
+ } finally {
+
576 0 DBUtils.closeStatement(selectVulnerabilityId);
+
577 0 DBUtils.closeStatement(deleteReferences);
+
578 0 DBUtils.closeStatement(deleteSoftware);
+
579 0 DBUtils.closeStatement(updateVulnerability);
+
580 0 DBUtils.closeStatement(deleteVulnerability);
+
581 0 DBUtils.closeStatement(insertVulnerability);
+
582 0 DBUtils.closeStatement(insertReference);
+
583 0 DBUtils.closeStatement(selectCpeId);
+
584 0 DBUtils.closeStatement(insertCpe);
+
585 0 DBUtils.closeStatement(insertSoftware);
+
586 0 }
+
587 0 }
588
-
589 0 insertSoftware.setInt(1, vulnerabilityId);
-
590 0 insertSoftware.setInt(2, cpeProductId);
-
591 0 if (s.getPreviousVersion() == null ) {
-
592 0 insertSoftware.setNull(3, java.sql.Types.VARCHAR);
-
593
- } else {
-
594 0 insertSoftware.setString(3, s.getPreviousVersion());
-
595
- }
-
596 0 insertSoftware.execute();
-
597 0 }
-
598
-
-
599 0 } catch (SQLException ex) {
-
600 0 final String msg = String.format("Error updating '%s'" , vuln.getName());
-
601 0 LOGGER.debug("" , ex);
-
602 0 throw new DatabaseException(msg, ex);
-
603
- } finally {
-
604 0 DBUtils.closeStatement(selectVulnerabilityId);
-
605 0 DBUtils.closeStatement(deleteReferences);
-
606 0 DBUtils.closeStatement(deleteSoftware);
-
607 0 DBUtils.closeStatement(updateVulnerability);
-
608 0 DBUtils.closeStatement(deleteVulnerability);
-
609 0 DBUtils.closeStatement(insertVulnerability);
-
610 0 DBUtils.closeStatement(insertReference);
-
611 0 DBUtils.closeStatement(selectCpeId);
-
612 0 DBUtils.closeStatement(insertCpe);
-
613 0 DBUtils.closeStatement(insertSoftware);
-
614 0 }
-
615 0 }
-
616
-
-
617
+ 589
-
618
+ 590
-
619
+ 591
-
620
+ 592
-
621
+ 593
-
622
+ 594
public boolean dataExists() {
-
623 1 Statement cs = null ;
-
624 1 ResultSet rs = null ;
-
625
+ 595 1 Statement cs = null ;
+
596 1 ResultSet rs = null ;
+
597
try {
-
626 1 cs = conn.createStatement();
-
627 1 rs = cs.executeQuery("SELECT COUNT(*) records FROM cpeEntry" );
-
628 1 if (rs.next()) {
-
629 1 if (rs.getInt(1) > 0) {
-
630 1 return true ;
-
631
+ 598 1 cs = conn.createStatement();
+
599 1 rs = cs.executeQuery("SELECT COUNT(*) records FROM cpeEntry" );
+
600 1 if (rs.next()) {
+
601 1 if (rs.getInt(1) > 0) {
+
602 1 return true ;
+
603
}
-
632
+ 604
}
-
633 0 } catch (SQLException ex) {
-
634
+ 605 0 } catch (SQLException ex) {
+
606
String dd;
-
635
+ 607
try {
-
636 0 dd = Settings.getDataDirectory().getAbsolutePath();
-
637 0 } catch (IOException ex1) {
-
638 0 dd = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
-
639 0 }
-
640 0 LOGGER.error("Unable to access the local database.\n\nEnsure that '{}' is a writable directory. "
-
641
+ 608 0 dd = Settings.getDataDirectory().getAbsolutePath();
+
609 0 } catch (IOException ex1) {
+
610 0 dd = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+
611 0 }
+
612 0 LOGGER.error("Unable to access the local database.\n\nEnsure that '{}' is a writable directory. "
+
613
+ "If the problem persist try deleting the files in '{}' and running {} again. If the problem continues, please "
-
642
+ 614
+ "create a log file (see documentation at http://jeremylong.github.io/DependencyCheck/) and open a ticket at "
-
643
+ 615
+ "https://github.com/jeremylong/DependencyCheck/issues and include the log file.\n\n" ,
-
644
+ 616
dd, dd, Settings.getString(Settings.KEYS.APPLICATION_VAME));
-
645 0 LOGGER.debug("" , ex);
-
646
+ 617 0 LOGGER.debug("" , ex);
+
618
} finally {
-
647 1 DBUtils.closeResultSet(rs);
-
648 1 DBUtils.closeStatement(cs);
-
649 0 }
-
650 0 return false ;
-
651
+ 619 1 DBUtils.closeResultSet(rs);
+
620 1 DBUtils.closeStatement(cs);
+
621 0 }
+
622 0 return false ;
+
623
}
-
652
+ 624
-
653
+ 625
-
654
+ 626
-
655
+ 627
-
656
+ 628
-
657
+ 629
public void cleanupDatabase() {
-
658 0 PreparedStatement ps = null ;
-
659
+ 630 0 PreparedStatement ps = null ;
+
631
try {
-
660 0 ps = getConnection().prepareStatement(statementBundle.getString("CLEANUP_ORPHANS" ));
-
661 0 if (ps != null ) {
-
662 0 ps.executeUpdate();
-
663
+ 632 0 ps = getConnection().prepareStatement(statementBundle.getString("CLEANUP_ORPHANS" ));
+
633 0 if (ps != null ) {
+
634 0 ps.executeUpdate();
+
635
}
-
664 0 } catch (SQLException ex) {
-
665 0 LOGGER.error("An unexpected SQL Exception occurred; please see the verbose log for more details." );
-
666 0 LOGGER.debug("" , ex);
-
667
+ 636 0 } catch (SQLException ex) {
+
637 0 LOGGER.error("An unexpected SQL Exception occurred; please see the verbose log for more details." );
+
638 0 LOGGER.debug("" , ex);
+
639
} finally {
-
668 0 DBUtils.closeStatement(ps);
-
669 0 }
-
670 0 }
-
671
+ 640 0 DBUtils.closeStatement(ps);
+
641 0 }
+
642 0 }
+
643
-
672
+ 644
-
673
+ 645
-
674
+ 646
-
675
+ 647
-
676
+ 648
-
677
+ 649
-
678
+ 650
-
679
+ 651
-
680
+ 652
-
681
+ 653
-
682
+ 654
Entry<String, Boolean> getMatchingSoftware(Map<String, Boolean> vulnerableSoftware, String vendor, String product,
-
683
+ 655
DependencyVersion identifiedVersion) {
-
684
+ 656
-
685 13 final boolean isVersionTwoADifferentProduct = "apache" .equals(vendor) && "struts" .equals(product);
-
686
+ 657 10 final boolean isVersionTwoADifferentProduct = "apache" .equals(vendor) && "struts" .equals(product);
+
658
-
687 13 final Set<String> majorVersionsAffectingAllPrevious = new HashSet<String>();
-
688 13 final boolean matchesAnyPrevious = identifiedVersion == null || "-" .equals(identifiedVersion.toString());
-
689 13 String majorVersionMatch = null ;
-
690 13 for (Entry<String, Boolean> entry : vulnerableSoftware.entrySet()) {
-
691 279 final DependencyVersion v = parseDependencyVersion(entry.getKey());
-
692 279 if (v == null || "-" .equals(v.toString())) {
-
693 0 return entry;
-
694
+ 659 10 final Set<String> majorVersionsAffectingAllPrevious = new HashSet<String>();
+
660 10 final boolean matchesAnyPrevious = identifiedVersion == null || "-" .equals(identifiedVersion.toString());
+
661 10 String majorVersionMatch = null ;
+
662 10 for (Entry<String, Boolean> entry : vulnerableSoftware.entrySet()) {
+
663 223 final DependencyVersion v = parseDependencyVersion(entry.getKey());
+
664 223 if (v == null || "-" .equals(v.toString())) {
+
665 0 return entry;
+
666
}
-
695 279 if (entry.getValue()) {
-
696 8 if (matchesAnyPrevious) {
-
697 0 return entry;
-
698
+ 667 223 if (entry.getValue()) {
+
668 8 if (matchesAnyPrevious) {
+
669 0 return entry;
+
670
}
-
699 8 if (identifiedVersion != null && identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
-
700 6 majorVersionMatch = v.getVersionParts().get(0);
-
701
+ 671 8 if (identifiedVersion != null && identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
+
672 6 majorVersionMatch = v.getVersionParts().get(0);
+
673
}
-
702 8 majorVersionsAffectingAllPrevious.add(v.getVersionParts().get(0));
-
703
+ 674 8 majorVersionsAffectingAllPrevious.add(v.getVersionParts().get(0));
+
675
}
-
704 279 }
-
705 13 if (matchesAnyPrevious) {
-
706 0 return null ;
-
707
+ 676 223 }
+
677 10 if (matchesAnyPrevious) {
+
678 0 return null ;
+
679
}
-
708
+ 680
-
709 13 final boolean canSkipVersions = majorVersionMatch != null && majorVersionsAffectingAllPrevious.size() > 1;
-
710
+ 681 10 final boolean canSkipVersions = majorVersionMatch != null && majorVersionsAffectingAllPrevious.size() > 1;
+
682
-
711
+ 683
-
712 13 for (Entry<String, Boolean> entry : vulnerableSoftware.entrySet()) {
-
713 232 if (!entry.getValue()) {
-
714 225 final DependencyVersion v = parseDependencyVersion(entry.getKey());
-
715
+ 684 10 for (Entry<String, Boolean> entry : vulnerableSoftware.entrySet()) {
+
685 176 if (!entry.getValue()) {
+
686 169 final DependencyVersion v = parseDependencyVersion(entry.getKey());
+
687
-
716 225 if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
-
717 10 continue ;
-
718
+ 688 169 if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
+
689 10 continue ;
+
690
}
-
719
+ 691
-
720
+ 692
-
721 215 if (identifiedVersion.equals(v)) {
-
722 8 return entry;
-
723
+ 693 159 if (identifiedVersion.equals(v)) {
+
694 8 return entry;
+
695
}
-
724
+ 696
}
-
725 214 }
-
726 5 for (Entry<String, Boolean> entry : vulnerableSoftware.entrySet()) {
-
727 56 if (entry.getValue()) {
-
728 0 final DependencyVersion v = parseDependencyVersion(entry.getKey());
-
729
+ 697 158 }
+
698 2 for (Entry<String, Boolean> entry : vulnerableSoftware.entrySet()) {
+
699 0 if (entry.getValue()) {
+
700 0 final DependencyVersion v = parseDependencyVersion(entry.getKey());
+
701
-
730 0 if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
-
731 0 continue ;
-
732
+ 702 0 if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
+
703 0 continue ;
+
704
}
-
733
+ 705
-
734
+ 706
-
735 0 if (entry.getValue() && identifiedVersion.compareTo(v) <= 0) {
-
736 0 if (!(isVersionTwoADifferentProduct && !identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0)))) {
-
737 0 return entry;
-
738
+ 707 0 if (entry.getValue() && identifiedVersion.compareTo(v) <= 0) {
+
708 0 if (!(isVersionTwoADifferentProduct && !identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0)))) {
+
709 0 return entry;
+
710
}
-
739
+ 711
}
-
740
+ 712
}
-
741 56 }
-
742 5 return null ;
-
743
+ 713 0 }
+
714 2 return null ;
+
715
}
-
744
+ 716
-
745
+ 717
-
746
+ 718
-
747
+ 719
-
748
+ 720
-
749
+ 721
-
750
+ 722
-
751
+ 723
private DependencyVersion parseDependencyVersion(String cpeStr) {
-
752 504 final VulnerableSoftware cpe = new VulnerableSoftware();
-
753
+ 724 392 final VulnerableSoftware cpe = new VulnerableSoftware();
+
725
try {
-
754 504 cpe.parseName(cpeStr);
-
755 0 } catch (UnsupportedEncodingException ex) {
-
756
+ 726 392 cpe.parseName(cpeStr);
+
727 0 } catch (UnsupportedEncodingException ex) {
+
728
-
757 0 LOGGER.trace("" , ex);
-
758 504 }
-
759 504 return parseDependencyVersion(cpe);
-
760
+ 729 0 LOGGER.trace("" , ex);
+
730 392 }
+
731 392 return parseDependencyVersion(cpe);
+
732
}
-
761
+ 733
-
762
+ 734
-
763
+ 735
-
764
+ 736
-
765
+ 737
-
766
+ 738
-
767
+ 739
-
768
+ 740
private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) {
-
769
+ 741
final DependencyVersion cpeVersion;
-
770 507 if (cpe.getVersion() != null && !cpe.getVersion().isEmpty()) {
-
771
+ 742 394 if (cpe.getVersion() != null && !cpe.getVersion().isEmpty()) {
+
743
final String versionText;
-
772 507 if (cpe.getUpdate() != null && !cpe.getUpdate().isEmpty()) {
-
773 130 versionText = String.format("%s.%s" , cpe.getVersion(), cpe.getUpdate());
-
774
+ 744 394 if (cpe.getUpdate() != null && !cpe.getUpdate().isEmpty()) {
+
745 130 versionText = String.format("%s.%s" , cpe.getVersion(), cpe.getUpdate());
+
746
} else {
-
775 377 versionText = cpe.getVersion();
-
776
+ 747 264 versionText = cpe.getVersion();
+
748
}
-
777 507 cpeVersion = DependencyVersionUtil.parseVersion(versionText);
-
778 507 } else {
-
779 0 cpeVersion = new DependencyVersion("-" );
-
780
+ 749 394 cpeVersion = DependencyVersionUtil.parseVersion(versionText);
+
750 394 } else {
+
751 0 cpeVersion = new DependencyVersion("-" );
+
752
}
-
781 507 return cpeVersion;
-
782
+ 753 394 return cpeVersion;
+
754
}
-
783
+ 755
-
784
+ 756
-
785
+ 757
-
786
+ 758
-
787
+ 759
-
788
+ 760
-
789
+ 761
public void deleteUnusedCpe() {
-
790 0 CallableStatement cs = null ;
-
791
+ 762 0 CallableStatement cs = null ;
+
763
try {
-
792 0 cs = getConnection().prepareCall(statementBundle.getString("DELETE_UNUSED_DICT_CPE" ));
-
793 0 cs.executeUpdate();
-
794 0 } catch (SQLException ex) {
-
795 0 LOGGER.error("Unable to delete CPE dictionary entries" , ex);
-
796
+ 764 0 cs = getConnection().prepareCall(statementBundle.getString("DELETE_UNUSED_DICT_CPE" ));
+
765 0 cs.executeUpdate();
+
766 0 } catch (SQLException ex) {
+
767 0 LOGGER.error("Unable to delete CPE dictionary entries" , ex);
+
768
} finally {
-
797 0 DBUtils.closeStatement(cs);
-
798 0 }
-
799 0 }
-
800
+ 769 0 DBUtils.closeStatement(cs);
+
770 0 }
+
771 0 }
+
772
-
801
+ 773
-
802
+ 774
-
803
+ 775
-
804
+ 776
-
805
+ 777
-
806
+ 778
-
807
+ 779
-
808
+ 780
-
809
+ 781
-
810
+ 782
public void addCpe(String cpe, String vendor, String product) {
-
811 0 PreparedStatement ps = null ;
-
812
+ 783 0 PreparedStatement ps = null ;
+
784
try {
-
813 0 ps = getConnection().prepareCall(statementBundle.getString("ADD_DICT_CPE" ));
-
814 0 ps.setString(1, cpe);
-
815 0 ps.setString(2, vendor);
-
816 0 ps.setString(3, product);
-
817 0 ps.executeUpdate();
-
818 0 } catch (SQLException ex) {
-
819 0 LOGGER.error("Unable to add CPE dictionary entry" , ex);
-
820
+ 785 0 ps = getConnection().prepareCall(statementBundle.getString("ADD_DICT_CPE" ));
+
786 0 ps.setString(1, cpe);
+
787 0 ps.setString(2, vendor);
+
788 0 ps.setString(3, product);
+
789 0 ps.executeUpdate();
+
790 0 } catch (SQLException ex) {
+
791 0 LOGGER.error("Unable to add CPE dictionary entry" , ex);
+
792
} finally {
-
821 0 DBUtils.closeStatement(ps);
-
822 0 }
-
823 0 }
-
824
+ 793 0 DBUtils.closeStatement(ps);
+
794 0 }
+
795 0 }
+
796
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html
index 1ee43bc68..6518443c7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html
@@ -131,6 +131,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html
index 46d1a5ac8..c33849bfa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html
@@ -113,249 +113,257 @@
48
49
-
+
50
51
- public static final String LAST_UPDATED = "NVD CVE Modified" ;
+
public static final String LAST_CHECKED = "NVD CVE Checked" ; 52
53
-
+
54
-
-
55
+
55
+ public static final String LAST_UPDATED = "NVD CVE Modified" ;
56
- public static final String LAST_UPDATED_BASE = "NVD CVE " ;
-
57
+
57
+
58
-
+
59
60
- public static final String LAST_CPE_UPDATE = "LAST_CPE_UPDATE" ;
+
public static final String LAST_UPDATED_BASE = "NVD CVE " ; 61
62
-
+
63
64
- public static final String VERSION = "version" ;
+
public static final String LAST_CPE_UPDATE = "LAST_CPE_UPDATE" ; 65
-
-
66
+
66
+
67
-
-
68
+
68
+ public static final String VERSION = "version" ;
69
- private Properties properties;
+
70
71
-
+
72
73
- private CveDB cveDB;
+
private Properties properties; 74
-
+
75
-
+
76
-
+
77
-
+
private CveDB cveDB; 78
-
+
79
-
-
80 6 DatabaseProperties(CveDB cveDB) {
-
81 6 this .cveDB = cveDB;
-
82 6 loadProperties();
-
83 6 }
-
84
-
-
85
-
86
-
-
87
+ 80
+
+
81
+
+
82
+
+
83
+
84 6 DatabaseProperties(CveDB cveDB) {
+
85 6 this .cveDB = cveDB;
+
86 6 loadProperties();
+
87 6 }
88
- private void loadProperties() {
-
89 6 this .properties = cveDB.getProperties();
-
90 6 }
+
+
89
+
+
90
+
91
-
+
92
-
-
93
-
-
94
-
+
private void loadProperties() {
+
93 6 this .properties = cveDB.getProperties();
+
94 6 }
95
-
+
96
-
+
97
- public boolean isEmpty() {
-
98 0 return properties == null || properties.isEmpty();
+
+
98
+
99
- }
+
100
-
+
101
-
-
102
-
+
public boolean isEmpty() {
+
102 0 return properties == null || properties.isEmpty();
103
-
+
} 104
-
+
105
-
+
106
-
+
107
- public void save(NvdCveInfo updatedValue) throws UpdateException {
-
108 0 if (updatedValue == null ) {
-
109 0 return ;
-
110
- }
-
111 0 save(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
-
112 0 }
-
113
-
-
114
-
-
115
-
-
116
-
117
-
-
118
-
-
119
+ 108
+
+
109
+
110
+
+
111
+ public void save(NvdCveInfo updatedValue) throws UpdateException {
+
112 0 if (updatedValue == null ) {
+
113 0 return ;
+
114
+ }
+
115 0 save(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+
116 0 }
+
117
+
+
118
+
+
119
+
120
-
+
121
- public void save(String key, String value) throws UpdateException {
-
122 0 properties.put(key, value);
-
123 0 cveDB.saveProperty(key, value);
-
124 0 }
+
+
122
+
+
123
+
+
124
+
125
-
-
126
-
-
127
-
-
128
-
+
public void save(String key, String value) throws UpdateException {
+
126 0 properties.put(key, value);
+
127 0 cveDB.saveProperty(key, value);
+
128 0 }
129
-
+
130
-
+
131
-
+
132
- public String getProperty(String key) {
-
133 0 return properties.getProperty(key);
-
134
- }
-
135
-
-
136
-
-
137
-
-
138
-
-
139
-
140
+ 133
-
141
-
-
142
+ 134
+
135
+
+
136
+ public String getProperty(String key) {
+
137 0 return properties.getProperty(key);
+
138
+ }
+
139
+
+
140
+
+
141
+
+
142
+
143
-
+
144
- public String getProperty(String key, String defaultValue) {
-
145 0 return properties.getProperty(key, defaultValue);
+
+
145
+
146
- }
+
147
-
+
148
-
-
149
-
+
public String getProperty(String key, String defaultValue) {
+
149 0 return properties.getProperty(key, defaultValue);
150
-
+
} 151
-
-
152
-
-
153
- public Properties getProperties() {
-
154 1 return properties;
-
155
- }
-
156
-
157
+ 152
-
158
-
-
159
-
-
160
+ 153
+
+
154
-
161
-
-
162
+ 155
+
+
156
-
163
- public Map<String, String> getMetaData() {
-
164 0 final Map<String, String> map = new TreeMap<String, String>();
-
165 0 for (Entry<Object, Object> entry : properties.entrySet()) {
-
166 0 final String key = (String) entry.getKey();
-
167 0 if (!"version" .equals(key)) {
-
168 0 if (key.startsWith("NVD CVE " )) {
-
169
- try {
-
170 0 final long epoch = Long.parseLong((String) entry.getValue());
-
171 0 final Date date = new Date(epoch);
-
172 0 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss" );
-
173 0 final String formatted = format.format(date);
-
174 0 map.put(key, formatted);
-
175 0 } catch (Throwable ex) {
-
176 0 LOGGER.debug("Unable to parse timestamp from DB" , ex);
-
177 0 map.put(key, (String) entry.getValue());
-
178 0 }
-
179
- } else {
-
180 0 map.put(key, (String) entry.getValue());
-
181
- }
-
182
- }
-
183 0 }
-
184 0 return map;
-
185
+ 157
+ public Properties getProperties() {
+
158 1 return properties;
+
159
}
+
160
+
+
161
+
+
162
+
+
163
+
+
164
+
+
165
+
+
166
+
+
167
+ public Map<String, String> getMetaData() {
+
168 0 final Map<String, String> map = new TreeMap<String, String>();
+
169 0 for (Entry<Object, Object> entry : properties.entrySet()) {
+
170 0 final String key = (String) entry.getKey();
+
171 0 if (!"version" .equals(key)) {
+
172 0 if (key.startsWith("NVD CVE " )) {
+
173
+ try {
+
174 0 final long epoch = Long.parseLong((String) entry.getValue());
+
175 0 final Date date = new Date(epoch);
+
176 0 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss" );
+
177 0 final String formatted = format.format(date);
+
178 0 map.put(key, formatted);
+
179 0 } catch (Throwable ex) {
+
180 0 LOGGER.debug("Unable to parse timestamp from DB" , ex);
+
181 0 map.put(key, (String) entry.getValue());
+
182 0 }
+
183
+ } else {
+
184 0 map.put(key, (String) entry.getValue());
+
185
+ }
186
+ }
+
187 0 }
+
188 0 return map;
+
189
+ }
+
190
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
index da84181b3..b756d8163 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
@@ -131,6 +131,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html
index 062de7a79..71b71ae64 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html
@@ -12,8 +12,8 @@
@@ -135,8 +135,8 @@
60
public static Driver load(String className) throws DriverLoadException {
-
61 3 final ClassLoader loader = DriverLoader.class .getClassLoader();
-
62 3 return load(className, loader);
+
61 4 final ClassLoader loader = DriverLoader.class .getClassLoader();
+
62 4 return load(className, loader);
63
}
64
@@ -144,136 +144,133 @@
65
66
-
+
67
-
+
68
-
+
69
-
+
70
-
+
71
-
+
72
-
+
73
-
+
74
-
+
75
-
+
76
-
-
77
-
-
78
public static Driver load(String className, String pathToDriver) throws DriverLoadException {
-
79 4 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
-
80 4 final List<URL> urls = new ArrayList<URL>();
-
81 4 final String[] paths = pathToDriver.split(File.pathSeparator);
-
82 9 for (String path : paths) {
-
83 5 final File file = new File(path);
-
84 5 if (file.isDirectory()) {
-
85 2 final File[] files = file.listFiles();
+
77 4 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
+
78 4 final List<URL> urls = new ArrayList<URL>();
+
79 4 final String[] paths = pathToDriver.split(File.pathSeparator);
+
80 9 for (String path : paths) {
+
81 5 final File file = new File(path);
+
82 5 if (file.isDirectory()) {
+
83 2 final File[] files = file.listFiles();
+
84 2 if (files != null ) {
+
85 38 for (File f : files) {
86
-
-
87 37 for (File f : files) {
-
88
- try {
-
89 35 urls.add(f.toURI().toURL());
-
90 0 } catch (MalformedURLException ex) {
-
91 0 LOGGER.debug("Unable to load database driver '{}'; invalid path provided '{}'" ,
-
92
- className, f.getAbsoluteFile(), ex);
-
93 0 throw new DriverLoadException("Unable to load database driver. Invalid path provided" , ex);
-
94 35 }
-
95
+ try {
+
87 36 urls.add(f.toURI().toURL());
+
88 0 } catch (MalformedURLException ex) {
+
89 0 LOGGER.debug("Unable to load database driver '{}'; invalid path provided '{}'" ,
+
90
+ className, f.getAbsoluteFile(), ex);
+
91 0 throw new DriverLoadException("Unable to load database driver. Invalid path provided" , ex);
+
92 36 }
+
93
+ }
+
94
}
-
96 2 } else if (file.exists()) {
-
97
+ 95 2 } else if (file.exists()) {
+
96
try {
-
98 2 urls.add(file.toURI().toURL());
-
99 0 } catch (MalformedURLException ex) {
-
100 0 LOGGER.debug("Unable to load database driver '{}'; invalid path provided '{}'" ,
-
101
- className, file.getAbsoluteFile(), ex);
-
102 0 throw new DriverLoadException("Unable to load database driver. Invalid path provided" , ex);
-
103 2 }
+
97 2 urls.add(file.toURI().toURL());
+
98 0 } catch (MalformedURLException ex) {
+
99 0 LOGGER.debug("Unable to load database driver '{}'; invalid path provided '{}'" ,
+
100
+ className, file.getAbsoluteFile(), ex);
+
101 0 throw new DriverLoadException("Unable to load database driver. Invalid path provided" , ex);
+
102 2 }
+
103
+ }
104
- }
-
105
}
-
106 8 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
-
107
+ 105 8 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
+
106
@Override
-
108
+ 107
public URLClassLoader run() {
-
109 4 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
-
110
+ 108 4 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
+
109
}
-
111
+ 110
});
-
112
+ 111
-
113 4 return load(className, loader);
+
112 4 return load(className, loader);
+
113
+ }
114
- }
-
115
-
116
+ 115
-
117
+ 116
-
118
+ 117
-
119
+ 118
-
120
+ 119
-
121
+ 120
-
122
+ 121
-
123
+ 122
-
124
+ 123
private static Driver load(String className, ClassLoader loader) throws DriverLoadException {
-
125
+ 124
try {
-
126 7 final Class c = Class.forName(className, true , loader);
-
127
+ 125 8 final Class c = Class.forName(className, true , loader);
+
126
-
128 4 final Driver driver = (Driver) c.newInstance();
-
129 4 final Driver shim = new DriverShim(driver);
-
130
+ 127 5 final Driver driver = (Driver) c.newInstance();
+
128 5 final Driver shim = new DriverShim(driver);
+
129
-
131 4 DriverManager.registerDriver(shim);
-
132 4 return shim;
-
133 3 } catch (ClassNotFoundException ex) {
-
134 3 final String msg = String.format("Unable to load database driver '%s'" , className);
-
135 3 LOGGER.debug(msg, ex);
-
136 3 throw new DriverLoadException(msg, ex);
-
137 0 } catch (InstantiationException ex) {
-
138 0 final String msg = String.format("Unable to load database driver '%s'" , className);
-
139 0 LOGGER.debug(msg, ex);
-
140 0 throw new DriverLoadException(msg, ex);
-
141 0 } catch (IllegalAccessException ex) {
-
142 0 final String msg = String.format("Unable to load database driver '%s'" , className);
-
143 0 LOGGER.debug(msg, ex);
-
144 0 throw new DriverLoadException(msg, ex);
-
145 0 } catch (SQLException ex) {
-
146 0 final String msg = String.format("Unable to load database driver '%s'" , className);
-
147 0 LOGGER.debug(msg, ex);
-
148 0 throw new DriverLoadException(msg, ex);
-
149
+ 130 5 DriverManager.registerDriver(shim);
+
131 5 return shim;
+
132 3 } catch (ClassNotFoundException ex) {
+
133 3 final String msg = String.format("Unable to load database driver '%s'" , className);
+
134 3 LOGGER.debug(msg, ex);
+
135 3 throw new DriverLoadException(msg, ex);
+
136 0 } catch (InstantiationException ex) {
+
137 0 final String msg = String.format("Unable to load database driver '%s'" , className);
+
138 0 LOGGER.debug(msg, ex);
+
139 0 throw new DriverLoadException(msg, ex);
+
140 0 } catch (IllegalAccessException ex) {
+
141 0 final String msg = String.format("Unable to load database driver '%s'" , className);
+
142 0 LOGGER.debug(msg, ex);
+
143 0 throw new DriverLoadException(msg, ex);
+
144 0 } catch (SQLException ex) {
+
145 0 final String msg = String.format("Unable to load database driver '%s'" , className);
+
146 0 LOGGER.debug(msg, ex);
+
147 0 throw new DriverLoadException(msg, ex);
+
148
}
-
150
+ 149
}
-
151
+ 150
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html
index 286ea7494..f5ed7bbe8 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html
@@ -128,9 +128,9 @@
56
-
57 4 DriverShim(Driver driver) {
-
58 4 this .driver = driver;
-
59 4 }
+
57 5 DriverShim(Driver driver) {
+
58 5 this .driver = driver;
+
59 5 }
60
61
@@ -155,7 +155,7 @@
@Override
71
public boolean acceptsURL(String url) throws SQLException {
-
72 2 return this .driver.acceptsURL(url);
+
72 1 return this .driver.acceptsURL(url);
73
}
74
@@ -387,13 +387,13 @@
@Override
202
public String toString() {
-
203 7 return "DriverShim{" + "driver=" + driver + '}' ;
+
203 9 return "DriverShim{" + "driver=" + driver + '}' ;
204
}
205
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.BaseUpdater.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.BaseUpdater.html
index 916b02d55..9c665903b 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.BaseUpdater.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.BaseUpdater.html
@@ -171,6 +171,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
index 000b013a5..a51adfe26 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
@@ -93,6 +93,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CpeUpdater.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CpeUpdater.html
index 896740146..4b941f3fa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CpeUpdater.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CpeUpdater.html
@@ -253,7 +253,7 @@
138
private boolean updateNeeded() {
139 0 final long now = System.currentTimeMillis();
-
140 0 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 30);
+
140 0 final int days = Settings.getInt(Settings.KEYS.CPE_MODIFIED_VALID_FOR_DAYS, 30);
141 0 long timestamp = 0;
142 0 final String ts = getProperties().getProperty(LAST_CPE_UPDATE);
143 0 if (ts != null && ts.matches("^[0-9]+$" )) {
@@ -344,6 +344,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.EngineVersionCheck.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.EngineVersionCheck.html
index 88efc58f4..74947d8ef 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.EngineVersionCheck.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.EngineVersionCheck.html
@@ -367,6 +367,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html
index c0c2bd6e5..db6ac9f5c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html
@@ -12,7 +12,7 @@
@@ -149,312 +149,361 @@
67
try {
68 0 openDataStores();
-
69 0 final UpdateableNvdCve updateable = getUpdatesNeeded();
-
70 0 if (updateable.isUpdateNeeded()) {
-
71 0 performUpdate(updateable);
-
72
+ 69 0 if (checkUpdate()) {
+
70 0 final UpdateableNvdCve updateable = getUpdatesNeeded();
+
71 0 if (updateable.isUpdateNeeded()) {
+
72 0 performUpdate(updateable);
+
73
+ }
+
74
}
-
73 0 } catch (MalformedURLException ex) {
-
74 0 LOGGER.warn(
-
75
+ 75 0 } catch (MalformedURLException ex) {
+
76 0 LOGGER.warn(
+
77
"NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data." );
-
76 0 LOGGER.debug("" , ex);
-
77 0 } catch (DownloadFailedException ex) {
-
78 0 LOGGER.warn(
-
79
+ 78 0 LOGGER.debug("" , ex);
+
79 0 } catch (DownloadFailedException ex) {
+
80 0 LOGGER.warn(
+
81
"Unable to download the NVD CVE data; the results may not include the most recent CPE/CVEs from the NVD." );
-
80 0 if (Settings.getString(Settings.KEYS.PROXY_SERVER) == null ) {
-
81 0 LOGGER.info(
-
82
+ 82 0 if (Settings.getString(Settings.KEYS.PROXY_SERVER) == null ) {
+
83 0 LOGGER.info(
+
84
"If you are behind a proxy you may need to configure dependency-check to use the proxy." );
-
83
- }
-
84 0 LOGGER.debug("" , ex);
85
+ }
+
86 0 LOGGER.debug("" , ex);
+
87
} finally {
-
86 0 closeDataStores();
-
87 0 }
-
88 0 }
-
89
-
-
90
-
+
88 0 closeDataStores();
+
89 0 }
+
90 0 }
91
-
+
92
-
+
93
-
+
94
-
+
95
-
+
96
-
+
97
- public void performUpdate(UpdateableNvdCve updateable) throws UpdateException {
-
98 0 int maxUpdates = 0;
+
+
98
+
99
- try {
-
100 0 for (NvdCveInfo cve : updateable) {
-
101 0 if (cve.getNeedsUpdate()) {
-
102 0 maxUpdates += 1;
-
103
- }
-
104 0 }
-
105 0 if (maxUpdates <= 0) {
-
106
- return ;
-
107
- }
-
108 0 if (maxUpdates > 3) {
-
109 0 LOGGER.info(
-
110
- "NVD CVE requires several updates; this could take a couple of minutes." );
-
111
- }
-
112 0 if (maxUpdates > 0) {
-
113 0 openDataStores();
-
114
- }
+
+
100
+ private boolean checkUpdate() throws UpdateException {
+
101 0 boolean proceed = true ;
+
102
+
+
103 0 final int validForHours = Settings.getInt(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, 0);
+
104 0 if (0 < validForHours) {
+
105
+
+
106 0 final long msValid = validForHours * 60L * 60L * 1000L;
+
107 0 final long lastChecked = Long.parseLong(getProperties().getProperty(DatabaseProperties.LAST_CHECKED, "0" ));
+
108 0 final long now = System.currentTimeMillis();
+
109 0 proceed = (now - lastChecked) > msValid;
+
110 0 if (proceed) {
+
111 0 getProperties().save(DatabaseProperties.LAST_CHECKED, Long.toString(now));
+
112
+ } else {
+
113 0 LOGGER.info("Skipping NVD check since last check was within {} hours." , validForHours);
+
114 0 LOGGER.debug("Last NVD was at {}, and now {} is within {} ms." ,
115
-
-
116 0 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates;
-
117
-
-
118 0 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize);
-
119 0 final ExecutorService processExecutor = Executors.newSingleThreadExecutor();
-
120 0 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
-
121 0 for (NvdCveInfo cve : updateable) {
-
122 0 if (cve.getNeedsUpdate()) {
-
123 0 final DownloadTask call = new DownloadTask(cve, processExecutor, getCveDB(), Settings.getInstance());
-
124 0 downloadFutures.add(downloadExecutors.submit(call));
-
125
- }
-
126 0 }
-
127 0 downloadExecutors.shutdown();
-
128
-
-
129
-
-
130 0 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates);
-
131 0 for (Future<Future<ProcessTask>> future : downloadFutures) {
-
132 0 Future<ProcessTask> task = null ;
-
133
- try {
-
134 0 task = future.get();
-
135 0 } catch (InterruptedException ex) {
-
136 0 downloadExecutors.shutdownNow();
-
137 0 processExecutor.shutdownNow();
-
138
-
-
139 0 LOGGER.debug("Thread was interrupted during download" , ex);
-
140 0 throw new UpdateException("The download was interrupted" , ex);
-
141 0 } catch (ExecutionException ex) {
-
142 0 downloadExecutors.shutdownNow();
-
143 0 processExecutor.shutdownNow();
-
144
-
-
145 0 LOGGER.debug("Thread was interrupted during download execution" , ex);
-
146 0 throw new UpdateException("The execution of the download was interrupted" , ex);
-
147 0 }
-
148 0 if (task == null ) {
-
149 0 downloadExecutors.shutdownNow();
-
150 0 processExecutor.shutdownNow();
-
151 0 LOGGER.debug("Thread was interrupted during download" );
-
152 0 throw new UpdateException("The download was interrupted; unable to complete the update" );
-
153
- } else {
-
154 0 processFutures.add(task);
-
155
- }
-
156 0 }
-
157
-
-
158 0 for (Future<ProcessTask> future : processFutures) {
-
159
- try {
-
160 0 final ProcessTask task = future.get();
-
161 0 if (task.getException() != null ) {
-
162 0 throw task.getException();
-
163
- }
-
164 0 } catch (InterruptedException ex) {
-
165 0 processExecutor.shutdownNow();
-
166 0 LOGGER.debug("Thread was interrupted during processing" , ex);
-
167 0 throw new UpdateException(ex);
-
168 0 } catch (ExecutionException ex) {
-
169 0 processExecutor.shutdownNow();
-
170 0 LOGGER.debug("Execution Exception during process" , ex);
-
171 0 throw new UpdateException(ex);
-
172
- } finally {
-
173 0 processExecutor.shutdown();
-
174 0 }
-
175 0 }
-
176
-
-
177 0 if (maxUpdates >= 1) {
-
178 0 getProperties().save(updateable.get(MODIFIED));
-
179 0 LOGGER.info("Begin database maintenance." );
-
180 0 getCveDB().cleanupDatabase();
-
181 0 LOGGER.info("End database maintenance." );
-
182
+ lastChecked, now, msValid);
+
116
}
-
183
- } finally {
-
184 0 closeDataStores();
-
185 0 }
-
186 0 }
-
187
+ 117
+ }
+
118 0 return proceed;
+
119
+ }
+
120
-
188
+ 121
-
189
-
-
190
-
-
191
+ 122
+
+
123
-
192
-
-
193
-
-
194
-
-
195
-
-
196
+ 124
+
+
125
+
+
126
+
+
127
-
197
- protected final UpdateableNvdCve getUpdatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException {
-
198 0 UpdateableNvdCve updates = null ;
-
199
+ 128
+ public void performUpdate(UpdateableNvdCve updateable) throws UpdateException {
+
129 0 int maxUpdates = 0;
+
130
try {
-
200 0 updates = retrieveCurrentTimestampsFromWeb();
-
201 0 } catch (InvalidDataException ex) {
-
202 0 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page" ;
-
203 0 LOGGER.debug(msg, ex);
-
204 0 throw new DownloadFailedException(msg, ex);
-
205 0 } catch (InvalidSettingException ex) {
-
206 0 LOGGER.debug("Invalid setting found when retrieving timestamps" , ex);
-
207 0 throw new DownloadFailedException("Invalid settings" , ex);
-
208 0 }
-
209
-
-
210 0 if (updates == null ) {
-
211 0 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data" );
-
212
- }
-
213 0 if (!getProperties().isEmpty()) {
-
214
- try {
-
215 0 final long lastUpdated = Long.parseLong(getProperties().getProperty(DatabaseProperties.LAST_UPDATED, "0" ));
-
216 0 final long now = System.currentTimeMillis();
-
217 0 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
-
218 0 if (lastUpdated == updates.getTimeStamp(MODIFIED)) {
-
219 0 updates.clear();
-
220 0 } else if (DateUtil.withinDateRange(lastUpdated, now, days)) {
-
221 0 for (NvdCveInfo entry : updates) {
-
222 0 if (MODIFIED.equals(entry.getId())) {
-
223 0 entry.setNeedsUpdate(true );
-
224
- } else {
-
225 0 entry.setNeedsUpdate(false );
-
226
- }
-
227 0 }
-
228
- } else {
-
229 0 for (NvdCveInfo entry : updates) {
-
230 0 if (MODIFIED.equals(entry.getId())) {
-
231 0 entry.setNeedsUpdate(true );
-
232
- } else {
-
233 0 long currentTimestamp = 0;
-
234
- try {
-
235 0 currentTimestamp = Long.parseLong(getProperties().getProperty(DatabaseProperties.LAST_UPDATED_BASE
-
236
- + entry.getId(), "0" ));
-
237 0 } catch (NumberFormatException ex) {
-
238 0 LOGGER.debug("Error parsing '{}' '{}' from nvdcve.lastupdated" ,
-
239
- DatabaseProperties.LAST_UPDATED_BASE, entry.getId(), ex);
-
240 0 }
-
241 0 if (currentTimestamp == entry.getTimestamp()) {
-
242 0 entry.setNeedsUpdate(false );
-
243
- }
-
244
- }
-
245 0 }
-
246
+ 131 0 for (NvdCveInfo cve : updateable) {
+
132 0 if (cve.getNeedsUpdate()) {
+
133 0 maxUpdates += 1;
+
134
}
-
247 0 } catch (NumberFormatException ex) {
-
248 0 LOGGER.warn("An invalid schema version or timestamp exists in the data.properties file." );
-
249 0 LOGGER.debug("" , ex);
-
250 0 }
-
251
- }
-
252 0 return updates;
-
253
- }
-
254
+ 135 0 }
+
136 0 if (maxUpdates <= 0) {
+
137
+ return ;
+
138
+ }
+
139 0 if (maxUpdates > 3) {
+
140 0 LOGGER.info(
+
141
+ "NVD CVE requires several updates; this could take a couple of minutes." );
+
142
+ }
+
143 0 if (maxUpdates > 0) {
+
144 0 openDataStores();
+
145
+ }
+
146
-
255
+ 147 0 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates;
+
148
+
+
149 0 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize);
+
150 0 final ExecutorService processExecutor = Executors.newSingleThreadExecutor();
+
151 0 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
+
152 0 for (NvdCveInfo cve : updateable) {
+
153 0 if (cve.getNeedsUpdate()) {
+
154 0 final DownloadTask call = new DownloadTask(cve, processExecutor, getCveDB(), Settings.getInstance());
+
155 0 downloadFutures.add(downloadExecutors.submit(call));
+
156
+ }
+
157 0 }
+
158 0 downloadExecutors.shutdown();
+
159
+
+
160
+
+
161 0 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates);
+
162 0 for (Future<Future<ProcessTask>> future : downloadFutures) {
+
163 0 Future<ProcessTask> task = null ;
+
164
+ try {
+
165 0 task = future.get();
+
166 0 } catch (InterruptedException ex) {
+
167 0 downloadExecutors.shutdownNow();
+
168 0 processExecutor.shutdownNow();
+
169
+
+
170 0 LOGGER.debug("Thread was interrupted during download" , ex);
+
171 0 throw new UpdateException("The download was interrupted" , ex);
+
172 0 } catch (ExecutionException ex) {
+
173 0 downloadExecutors.shutdownNow();
+
174 0 processExecutor.shutdownNow();
+
175
+
+
176 0 LOGGER.debug("Thread was interrupted during download execution" , ex);
+
177 0 throw new UpdateException("The execution of the download was interrupted" , ex);
+
178 0 }
+
179 0 if (task == null ) {
+
180 0 downloadExecutors.shutdownNow();
+
181 0 processExecutor.shutdownNow();
+
182 0 LOGGER.debug("Thread was interrupted during download" );
+
183 0 throw new UpdateException("The download was interrupted; unable to complete the update" );
+
184
+ } else {
+
185 0 processFutures.add(task);
+
186
+ }
+
187 0 }
+
188
+
+
189 0 for (Future<ProcessTask> future : processFutures) {
+
190
+ try {
+
191 0 final ProcessTask task = future.get();
+
192 0 if (task.getException() != null ) {
+
193 0 throw task.getException();
+
194
+ }
+
195 0 } catch (InterruptedException ex) {
+
196 0 processExecutor.shutdownNow();
+
197 0 LOGGER.debug("Thread was interrupted during processing" , ex);
+
198 0 throw new UpdateException(ex);
+
199 0 } catch (ExecutionException ex) {
+
200 0 processExecutor.shutdownNow();
+
201 0 LOGGER.debug("Execution Exception during process" , ex);
+
202 0 throw new UpdateException(ex);
+
203
+ } finally {
+
204 0 processExecutor.shutdown();
+
205 0 }
+
206 0 }
+
207
+
+
208 0 if (maxUpdates >= 1) {
+
209 0 getProperties().save(updateable.get(MODIFIED));
+
210 0 LOGGER.info("Begin database maintenance." );
+
211 0 getCveDB().cleanupDatabase();
+
212 0 LOGGER.info("End database maintenance." );
+
213
+ }
+
214
+ } finally {
+
215 0 closeDataStores();
+
216 0 }
+
217 0 }
+
218
+
+
219
-
256
-
-
257
+ 220
+
+
221
+
+
222
-
258
-
-
259
-
-
260
-
-
261
-
-
262
-
-
263
+ 223
+
+
224
+
+
225
+
+
226
+
+
227
-
264
- private UpdateableNvdCve retrieveCurrentTimestampsFromWeb()
-
265
- throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException {
-
266
+ 228
+ protected final UpdateableNvdCve getUpdatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException {
+
229 0 UpdateableNvdCve updates = null ;
+
230
+ try {
+
231 0 updates = retrieveCurrentTimestampsFromWeb();
+
232 0 } catch (InvalidDataException ex) {
+
233 0 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page" ;
+
234 0 LOGGER.debug(msg, ex);
+
235 0 throw new DownloadFailedException(msg, ex);
+
236 0 } catch (InvalidSettingException ex) {
+
237 0 LOGGER.debug("Invalid setting found when retrieving timestamps" , ex);
+
238 0 throw new DownloadFailedException("Invalid settings" , ex);
+
239 0 }
+
240
-
267 0 final UpdateableNvdCve updates = new UpdateableNvdCve();
-
268 0 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL),
-
269
- Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL),
-
270
- false );
-
271
-
-
272 0 final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR);
-
273 0 final int end = Calendar.getInstance().get(Calendar.YEAR);
-
274 0 final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0);
-
275 0 final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2);
-
276 0 for (int i = start; i <= end; i++) {
-
277 0 updates.add(Integer.toString(i), String.format(baseUrl20, i),
-
278
- String.format(baseUrl12, i),
-
279
- true );
-
280
+ 241 0 if (updates == null ) {
+
242 0 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data" );
+
243
}
-
281 0 return updates;
+
244 0 if (!getProperties().isEmpty()) {
+
245
+ try {
+
246 0 final long lastUpdated = Long.parseLong(getProperties().getProperty(DatabaseProperties.LAST_UPDATED, "0" ));
+
247 0 final long now = System.currentTimeMillis();
+
248 0 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
+
249 0 if (lastUpdated == updates.getTimeStamp(MODIFIED)) {
+
250 0 updates.clear();
+
251 0 } else if (DateUtil.withinDateRange(lastUpdated, now, days)) {
+
252 0 for (NvdCveInfo entry : updates) {
+
253 0 if (MODIFIED.equals(entry.getId())) {
+
254 0 entry.setNeedsUpdate(true );
+
255
+ } else {
+
256 0 entry.setNeedsUpdate(false );
+
257
+ }
+
258 0 }
+
259
+ } else {
+
260 0 for (NvdCveInfo entry : updates) {
+
261 0 if (MODIFIED.equals(entry.getId())) {
+
262 0 entry.setNeedsUpdate(true );
+
263
+ } else {
+
264 0 long currentTimestamp = 0;
+
265
+ try {
+
266 0 currentTimestamp = Long.parseLong(getProperties().getProperty(DatabaseProperties.LAST_UPDATED_BASE
+
267
+ + entry.getId(), "0" ));
+
268 0 } catch (NumberFormatException ex) {
+
269 0 LOGGER.debug("Error parsing '{}' '{}' from nvdcve.lastupdated" ,
+
270
+ DatabaseProperties.LAST_UPDATED_BASE, entry.getId(), ex);
+
271 0 }
+
272 0 if (currentTimestamp == entry.getTimestamp()) {
+
273 0 entry.setNeedsUpdate(false );
+
274
+ }
+
275
+ }
+
276 0 }
+
277
+ }
+
278 0 } catch (NumberFormatException ex) {
+
279 0 LOGGER.warn("An invalid schema version or timestamp exists in the data.properties file." );
+
280 0 LOGGER.debug("" , ex);
+
281 0 }
282
- }
-
283
-
+
}
+
283 0 return updates;
284
+ }
+
285
+
+
286
+
+
287
+
+
288
+
+
289
+
+
290
+
+
291
+
+
292
+
+
293
+
+
294
+
+
295
+ private UpdateableNvdCve retrieveCurrentTimestampsFromWeb()
+
296
+ throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException {
+
297
+
+
298 0 final UpdateableNvdCve updates = new UpdateableNvdCve();
+
299 0 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL),
+
300
+ Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL),
+
301
+ false );
+
302
+
+
303 0 final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR);
+
304 0 final int end = Calendar.getInstance().get(Calendar.YEAR);
+
305 0 final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0);
+
306 0 final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2);
+
307 0 for (int i = start; i <= end; i++) {
+
308 0 updates.add(Integer.toString(i), String.format(baseUrl20, i),
+
309
+ String.format(baseUrl12, i),
+
310
+ true );
+
311
+ }
+
312 0 return updates;
+
313
+ }
+
314
+
+
315
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html
index 772c99241..d73d28cb3 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html
@@ -121,6 +121,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.CPEHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.CPEHandler.html
index ad240f531..e4284e72d 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.CPEHandler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.CPEHandler.html
@@ -701,6 +701,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.Cpe.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.Cpe.html
index 0d64e6759..137e1e703 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.Cpe.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.cpe.Cpe.html
@@ -251,6 +251,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
index efcf2f877..31dd647ab 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
@@ -115,6 +115,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html
index bf8d15d55..809c2719c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html
@@ -147,6 +147,6 @@
}
-
+
+
+
+
+
+
+ 
+ 
+ 
+ 
+ 
