diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index 851ed70ba..5f99e0415 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -223,23 +223,19 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { */ @Override public void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException { - try { - final List classNames = collectClassNames(dependency); - final String fileName = dependency.getFileName().toLowerCase(); - if (classNames.isEmpty() - && (fileName.endsWith("-sources.jar") - || fileName.endsWith("-javadoc.jar") - || fileName.endsWith("-src.jar") - || fileName.endsWith("-doc.jar"))) { - engine.getDependencies().remove(dependency); - } - final boolean hasManifest = parseManifest(dependency, classNames); - final boolean hasPOM = analyzePOM(dependency, classNames, engine); - final boolean addPackagesAsEvidence = !(hasManifest && hasPOM); - analyzePackageNames(classNames, dependency, addPackagesAsEvidence); - } catch (IOException ex) { - throw new AnalysisException("Exception occurred reading the JAR file (" + dependency.getFileName() + ").", ex); + final List classNames = collectClassNames(dependency); + final String fileName = dependency.getFileName().toLowerCase(); + if (classNames.isEmpty() + && (fileName.endsWith("-sources.jar") + || fileName.endsWith("-javadoc.jar") + || fileName.endsWith("-src.jar") + || fileName.endsWith("-doc.jar"))) { + engine.getDependencies().remove(dependency); } + final boolean hasManifest = parseManifest(dependency, classNames); + final boolean hasPOM = analyzePOM(dependency, classNames, engine); + final boolean addPackagesAsEvidence = !(hasManifest && hasPOM); + analyzePackageNames(classNames, dependency, addPackagesAsEvidence); } /** @@ -587,10 +583,8 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { * @param dependency A reference to the dependency * @param classInformation a collection of class information * @return whether evidence was identified parsing the manifest - * @throws IOException if there is an issue reading the JAR file */ - protected boolean parseManifest(Dependency dependency, List classInformation) - throws IOException { + protected boolean parseManifest(Dependency dependency, List classInformation) { boolean foundSomething = false; try (JarFile jar = new JarFile(dependency.getActualFilePath())) { final Manifest manifest = jar.getManifest(); @@ -747,6 +741,9 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { foundSomething = true; versionEvidence.addEvidence(source, "specification-version", specificationVersion, Confidence.HIGH); } + } catch (IOException ex) { + LOGGER.warn("Unable to read JarFile '{}'.", dependency.getActualFilePath()); + LOGGER.trace("", ex); } return foundSomething; } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java index df9931548..948df73c4 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java @@ -17,24 +17,22 @@ */ package org.owasp.dependencycheck.analyzer; -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertTrue; - import java.io.File; import java.util.ArrayList; import java.util.Arrays; import java.util.List; -import org.junit.After; -import org.junit.AfterClass; -import org.junit.Before; -import org.junit.BeforeClass; import org.junit.Test; import org.owasp.dependencycheck.BaseTest; +import org.owasp.dependencycheck.analyzer.JarAnalyzer.ClassNameInformation; import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.dependency.Evidence; import org.owasp.dependencycheck.utils.Settings; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + /** * @author Jeremy Long */ @@ -176,4 +174,11 @@ public class JarAnalyzerTest extends BaseTest { List results = instance.getPackageStructure(); assertEquals(expected, results); } + + @Test + public void testParseManifest_CatchesIOException() { + Dependency dependency = new Dependency(); + dependency.setActualFilePath("doesNotExist"); + assertFalse(new JarAnalyzer().parseManifest(dependency, new ArrayList())); + } }