From b05bb8a1ee78af42618624452ed1702072f579c4 Mon Sep 17 00:00:00 2001
From: Jeremy Long
Date: Sun, 10 Sep 2017 08:40:01 -0400
Subject: [PATCH] updated to support changes for threadsafety
---
.../dependencycheck/reporting/EscapeTool.java | 14 +++++++
.../reporting/ReportGenerator.java | 6 +++
.../main/resources/templates/htmlReport.vsl | 42 ++++++++++++-------
.../main/resources/templates/jsonReport.vsl | 6 +--
4 files changed, 49 insertions(+), 19 deletions(-)
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java
index adf89bfcb..c5fd7ce06 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/EscapeTool.java
@@ -99,6 +99,20 @@ public class EscapeTool {
return StringEscapeUtils.escapeJson(text);
}
+ /**
+ * JavaScript encodes the provided text.
+ *
+ * @param text the text to encode
+ * @return the JavaScript encoded text
+ */
+ public String javascript(String text) {
+ if (text == null || text.isEmpty()) {
+ return text;
+ }
+ //until lang3 has escapeJavaScript we use this...
+ return org.apache.commons.lang.StringEscapeUtils.escapeJavaScript(text);
+ }
+
/**
* Formats text for CSV format. This includes trimming whitespace, replace
* line breaks with spaces, and if necessary quotes the text and/or escapes
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
index 70208794e..ee99e6f12 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
@@ -35,6 +35,7 @@ import java.io.UnsupportedEncodingException;
import java.math.BigDecimal;
import java.nio.charset.StandardCharsets;
import javax.annotation.concurrent.NotThreadSafe;
+import org.apache.commons.lang3.text.WordUtils;
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.VelocityEngine;
import org.apache.velocity.context.Context;
@@ -45,6 +46,7 @@ import org.joda.time.format.DateTimeFormatter;
import org.owasp.dependencycheck.analyzer.Analyzer;
import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.exception.ReportException;
import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.utils.Settings;
@@ -195,6 +197,10 @@ public class ReportGenerator {
ctxt.put("scanDate", scanDate);
ctxt.put("scanDateXML", scanDateXML);
ctxt.put("enc", new EscapeTool());
+ ctxt.put("WordUtils", new WordUtils());
+ ctxt.put("VENDOR", EvidenceType.VENDOR);
+ ctxt.put("PRODUCT", EvidenceType.PRODUCT);
+ ctxt.put("VERSION", EvidenceType.VERSION);
ctxt.put("version", settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown"));
return ctxt;
}
diff --git a/dependency-check-core/src/main/resources/templates/htmlReport.vsl b/dependency-check-core/src/main/resources/templates/htmlReport.vsl
index 025211943..ceb7922d9 100644
--- a/dependency-check-core/src/main/resources/templates/htmlReport.vsl
+++ b/dependency-check-core/src/main/resources/templates/htmlReport.vsl
@@ -699,8 +699,8 @@ Getting Help:
| $dependency.getVulnerabilities().size() |
- $cpeIdConf |
- $dependency.getEvidenceForDisplay().size() |
+ $WordUtils.capitalizeFully($cpeIdConf.toString()) |
+ $dependency.size() |
#end
@@ -744,9 +744,15 @@ Getting Help: Evidence
- | Source | Name | Value |
- #foreach($evidence in $dependency.getEvidenceForDisplay())
- | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) |
+ | Type | Source | Name | Value | Confidence |
+ #foreach($evidence in $dependency.getEvidence($VENDOR))
+ | Vendor | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) | $WordUtils.capitalizeFully($evidence.getConfidence().toString()) |
+ #end
+ #foreach($evidence in $dependency.getEvidence($PRODUCT))
+ | Product | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) | $WordUtils.capitalizeFully($evidence.getConfidence().toString()) |
+ #end
+ #foreach($evidence in $dependency.getEvidence($VERSION))
+ | Version | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) | $WordUtils.capitalizeFully($evidence.getConfidence().toString()) |
#end
@@ -813,11 +819,10 @@ Getting Help: $enc.html($id.type): $enc.html($id.value)
#end
#if ($id.confidence)
- Confidence:$id.confidence
+ Confidence:$WordUtils.capitalizeFully($id.confidence.toString())
#end
#if ($id.type=="cpe")
- ##yes, we are HTML Encoding into JavaScript... the escape utils don't have a JS Encode and I haven't written one yet
-
+
#end
#if ($id.description || $id.notes)
+ $enc.html($vuln.name)
#elseif($vuln.getSource().name().equals("NSP"))
NSP-$enc.html($vuln.name)
#end
@@ -862,7 +867,7 @@ Getting Help: CWE: $vuln.cwe
#end
#if ($vuln.notes)
-
Notes: $enc.xml($vuln.notes)
+
Notes: $enc.html($vuln.notes)
#end
$enc.html($vuln.description)
#if ($vuln.getReferences().size()>0)
@@ -935,9 +940,15 @@ Getting Help: Evidence
- | Source | Name | Value |
- #foreach($evidence in $dependency.getEvidenceForDisplay())
- | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) |
+ | Type | Source | Name | Value | Confidence |
+ #foreach($evidence in $dependency.getEvidence($VENDOR))
+ | Vendor | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) | $WordUtils.capitalizeFully($evidence.getConfidence().toString()) |
+ #end
+ #foreach($evidence in $dependency.getEvidence($PRODUCT))
+ | Product | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) | $WordUtils.capitalizeFully($evidence.getConfidence().toString()) |
+ #end
+ #foreach($evidence in $dependency.getEvidence($VERSION))
+ | Version | $enc.html($evidence.getSource()) | $enc.html($evidence.getName()) | $enc.html($evidence.getValue()) | $WordUtils.capitalizeFully($evidence.getConfidence().toString()) |
#end
@@ -975,7 +986,6 @@ Getting Help: $enc.html($id.type): $enc.html($id.value) ✓ suppressed
#else
$enc.html($id.type): $enc.html($id.value) suppressed
@@ -984,7 +994,7 @@ Getting Help: $enc.html($id.type): $enc.html($id.value) suppressed
#end
#if ($id.confidence)
- Confidence:$id.confidence
+ Confidence:$WordUtils.capitalizeFully($id.confidence.toString())
#end
#if ($id.description || $id.notes)
#end
#if ($id.notes)
- Notes: $enc.xml($id.notes)
+ Notes: $enc.html($id.notes)
#end
#end
diff --git a/dependency-check-core/src/main/resources/templates/jsonReport.vsl b/dependency-check-core/src/main/resources/templates/jsonReport.vsl
index ef69987dc..df072f15c 100644
--- a/dependency-check-core/src/main/resources/templates/jsonReport.vsl
+++ b/dependency-check-core/src/main/resources/templates/jsonReport.vsl
@@ -67,7 +67,7 @@
#end
,"evidenceCollected": {
"vendorEvidence": [
- #foreach($evidence in $dependency.getVendorEvidence())
+ #foreach($evidence in $dependency.getEvidence($VENDOR))
#if($foreach.count > 1),#end{
"type": "vendor",
"confidence": "$enc.json($evidence.getConfidence().toString())",
@@ -78,7 +78,7 @@
#end
],
"productEvidence": [
- #foreach($evidence in $dependency.getProductEvidence())
+ #foreach($evidence in $dependency.getEvidence($PRODUCT))
#if($foreach.count > 1),#end{
"type": "product",
"confidence": "$enc.json($evidence.getConfidence().toString())",
@@ -89,7 +89,7 @@
#end
],
"versionEvidence": [
- #foreach($evidence in $dependency.getVersionEvidence())
+ #foreach($evidence in $dependency.getEvidence($VERSION))
#if($foreach.count > 1),#end
{
"type": "version",