From b05bb8a1ee78af42618624452ed1702072f579c4 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 10 Sep 2017 08:40:01 -0400 Subject: [PATCH] updated to support changes for threadsafety --- .../dependencycheck/reporting/EscapeTool.java | 14 +++++++ .../reporting/ReportGenerator.java | 6 +++ .../main/resources/templates/htmlReport.vsl | 42 ++++++++++++------- .../main/resources/templates/jsonReport.vsl | 6 +-- 4 files changed, 49 insertions(+), 19 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java index adf89bfcb..c5fd7ce06 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java @@ -99,6 +99,20 @@ public class EscapeTool { return StringEscapeUtils.escapeJson(text); } + /** + * JavaScript encodes the provided text. + * + * @param text the text to encode + * @return the JavaScript encoded text + */ + public String javascript(String text) { + if (text == null || text.isEmpty()) { + return text; + } + //until lang3 has escapeJavaScript we use this... + return org.apache.commons.lang.StringEscapeUtils.escapeJavaScript(text); + } + /** * Formats text for CSV format. This includes trimming whitespace, replace * line breaks with spaces, and if necessary quotes the text and/or escapes diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java index 70208794e..ee99e6f12 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java @@ -35,6 +35,7 @@ import java.io.UnsupportedEncodingException; import java.math.BigDecimal; import java.nio.charset.StandardCharsets; import javax.annotation.concurrent.NotThreadSafe; +import org.apache.commons.lang3.text.WordUtils; import org.apache.velocity.VelocityContext; import org.apache.velocity.app.VelocityEngine; import org.apache.velocity.context.Context; @@ -45,6 +46,7 @@ import org.joda.time.format.DateTimeFormatter; import org.owasp.dependencycheck.analyzer.Analyzer; import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.EvidenceType; import org.owasp.dependencycheck.exception.ReportException; import org.owasp.dependencycheck.utils.FileUtils; import org.owasp.dependencycheck.utils.Settings; @@ -195,6 +197,10 @@ public class ReportGenerator { ctxt.put("scanDate", scanDate); ctxt.put("scanDateXML", scanDateXML); ctxt.put("enc", new EscapeTool()); + ctxt.put("WordUtils", new WordUtils()); + ctxt.put("VENDOR", EvidenceType.VENDOR); + ctxt.put("PRODUCT", EvidenceType.PRODUCT); + ctxt.put("VERSION", EvidenceType.VERSION); ctxt.put("version", settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown")); return ctxt; } diff --git a/dependency-check-core/src/main/resources/templates/htmlReport.vsl b/dependency-check-core/src/main/resources/templates/htmlReport.vsl index 025211943..ceb7922d9 100644 --- a/dependency-check-core/src/main/resources/templates/htmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/htmlReport.vsl @@ -699,8 +699,8 @@ Getting Help: $dependency.getVulnerabilities().size() - $cpeIdConf - $dependency.getEvidenceForDisplay().size() + $WordUtils.capitalizeFully($cpeIdConf.toString()) + $dependency.size() #end @@ -744,9 +744,15 @@ Getting Help: $enc.html($id.type): $enc.html($id.value) #end #if ($id.confidence) -   Confidence:$id.confidence +   Confidence:$WordUtils.capitalizeFully($id.confidence.toString()) #end #if ($id.type=="cpe") - ##yes, we are HTML Encoding into JavaScript... the escape utils don't have a JS Encode and I haven't written one yet -    +    #end #if ($id.description || $id.notes)