github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-20 00:04:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

improved manifest parsing to exclude additional entries per issue #88

Browse Source 
Former-commit-id: b4cad8c8d0182c17770be2163e0565378de3ae9a
This commit is contained in:
Jeremy Long
2014-03-16 04:49:09 -04:00
parent 79fd23d51b
commit acb9c01776
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
View File

@@ -111,9 +111,15 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
"buildjdk", "buildjdk",
"ant-version", "ant-version",
"antversion", "antversion",
"dynamicimportpackage",
"dynamicimport-package",
"dynamic-importpackage",
"dynamic-import-package",
"import-package", "import-package",
"ignore-package",
"export-package", "export-package",
"importpackage", "importpackage",
"ignorepackage",
"exportpackage", "exportpackage",
"sealed", "sealed",
"manifest-version", "manifest-version",
@@ -125,7 +131,10 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
"tool", "tool",
"bundle-manifestversion", "bundle-manifestversion",
"bundlemanifestversion", "bundlemanifestversion",
"include-resource"); "include-resource",
"embed-dependency",
"ipojo-components",
"ipojo-extension");
/** /**
* item in some manifest, should be considered medium confidence. * item in some manifest, should be considered medium confidence.
*/ */
@@ -1003,11 +1012,9 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
* @return true or false depending on if it is believed the entry is an "import" entry * @return true or false depending on if it is believed the entry is an "import" entry
*/ */
private boolean isImportPackage(String key, String value) { private boolean isImportPackage(String key, String value) {
final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$"); final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$");
if (packageRx.matcher(value).matches()) { boolean matches = packageRx.matcher(value).matches();
return (key.contains("import") || key.contains("include")); return matches && (key.contains("import") || key.contains("include") || value.length() > 10);
}
return false;
} }
/** /**