diff --git a/SampleReport.html b/SampleReport.html index a4748fdfc..ff507e3da 100644 --- a/SampleReport.html +++ b/SampleReport.html @@ -14,8 +14,8 @@ diff --git a/dependency-check-ant/apidocs/deprecated-list.html b/dependency-check-ant/apidocs/deprecated-list.html index d1bcbced0..c10206c9e 100644 --- a/dependency-check-ant/apidocs/deprecated-list.html +++ b/dependency-check-ant/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Ant Task 1.2.4 API) - +Deprecated List (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/help-doc.html b/dependency-check-ant/apidocs/help-doc.html index 787dedcac..cd287cb31 100644 --- a/dependency-check-ant/apidocs/help-doc.html +++ b/dependency-check-ant/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Ant Task 1.2.4 API) - +API Help (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/index-all.html b/dependency-check-ant/apidocs/index-all.html index d9d87d969..c0d471465 100644 --- a/dependency-check-ant/apidocs/index-all.html +++ b/dependency-check-ant/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Ant Task 1.2.4 API) - +Index (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/index.html b/dependency-check-ant/apidocs/index.html index 9eb5c0c0a..2230f6272 100644 --- a/dependency-check-ant/apidocs/index.html +++ b/dependency-check-ant/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Ant Task 1.2.4 API +Dependency-Check Ant Task 1.2.5 API diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html index 7b8dac79c..d7a9872f5 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html @@ -2,16 +2,16 @@ - + -DependencyCheckTask (Dependency-Check Ant Task 1.2.4 API) - +DependencyCheckTask (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html index 811172d2a..e64ffa796 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats (Dependency-Check Ant Task 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html index 5764ad863..99132a56f 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask (Dependency-Check Ant Task 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html index c1127d943..baaf286c7 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.4 API) - +org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html index 83d71ddf9..8caf22ce1 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.4 API) - +org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html index 61789b72e..66fc9c6de 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.taskdefs Class Hierarchy (Dependency-Check Ant Task 1.2.4 API) - +org.owasp.dependencycheck.taskdefs Class Hierarchy (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html index 265f36b00..3f641de56 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/apidocs/overview-tree.html b/dependency-check-ant/apidocs/overview-tree.html index 83fadbd63..0328b9001 100644 --- a/dependency-check-ant/apidocs/overview-tree.html +++ b/dependency-check-ant/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Ant Task 1.2.4 API) - +Class Hierarchy (Dependency-Check Ant Task 1.2.5 API) + diff --git a/dependency-check-ant/checkstyle.html b/dependency-check-ant/checkstyle.html index 171dc8aa4..a99ade9dd 100644 --- a/dependency-check-ant/checkstyle.html +++ b/dependency-check-ant/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Checkstyle Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html index a3fef7e58..b730975ba 100644 --- a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html +++ b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html @@ -38,6 +38,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-ant/cobertura/frame-summary.html b/dependency-check-ant/cobertura/frame-summary.html index a95887b2e..4669a7aac 100644 --- a/dependency-check-ant/cobertura/frame-summary.html +++ b/dependency-check-ant/cobertura/frame-summary.html @@ -25,6 +25,6 @@ var packageTable = new SortableTable(document.getElementById("packageResults"), ["String", "Number", "Percentage", "Percentage", "FormattedNumber"]); packageTable.sort(0); - + diff --git a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html index 9f7976f53..934f1a323 100644 --- a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html +++ b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html @@ -144,14 +144,14 @@
          * System specific new line character.
     63  
          */
    -  64  4
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
    +  64  1
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
     65  
         /**
     66  
          * The logger.
     67  
          */
    -  68  4
         private static final Logger LOGGER = Logger.getLogger(DependencyCheckTask.class.getName());
    +  68  1
         private static final Logger LOGGER = Logger.getLogger(DependencyCheckTask.class.getName());
     69  
     
     70   @@ -162,8 +162,8 @@
          */
     73  
         public DependencyCheckTask() {
    -  74  16
             super();
    -  75  16
         }
    +  74  4
             super();
    +  75  4
         }
     76  
         //The following code was copied Apache Ant PathConvert
     77   @@ -174,14 +174,14 @@
          * Path to be converted
     80  
          */
    -  81  16
         private Resources path = null;
    +  81  4
         private Resources path = null;
     82  
         /**
     83  
          * Reference to path/fileset to convert
     84  
          */
    -  85  16
         private Reference refid = null;
    +  85  4
         private Reference refid = null;
     86  
     
     87   @@ -198,12 +198,12 @@
          */
     93  
         public void add(ResourceCollection rc) {
    -  94  16
             if (isReference()) {
    +  94  4
             if (isReference()) {
     95  0
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
     96  
             }
    -  97  16
             getPath().add(rc);
    -  98  16
         }
    +  97  4
             getPath().add(rc);
    +  98  4
         }
     99  
     
     100   @@ -220,12 +220,12 @@
          */
     106  
         private synchronized Resources getPath() {
    -  107  16
             if (path == null) {
    -  108  12
                 path = new Resources(getProject());
    -  109  12
                 path.setCache(true);
    +  107  4
             if (path == null) {
    +  108  3
                 path = new Resources(getProject());
    +  109  3
                 path.setCache(true);
     110  
             }
    -  111  16
             return path;
    +  111  4
             return path;
     112  
         }
     113   @@ -242,7 +242,7 @@
          */
     119  
         public boolean isReference() {
    -  120  32
             return refid != null;
    +  120  8
             return refid != null;
     121  
         }
     122   @@ -279,7 +279,7 @@
          */
     140  
         private void dealWithReferences() throws BuildException {
    -  141  16
             if (isReference()) {
    +  141  4
             if (isReference()) {
     142  0
                 final Object o = refid.getReferencedObject(getProject());
     143  0
                 if (!(o instanceof ResourceCollection)) {
     144  0
                     throw new BuildException("refid '" + refid.getRefId()
    @@ -290,7 +290,7 @@  147  0
                 getPath().add((ResourceCollection) o);
     148  
             }
    -  149  16
         }
    +  149  4
         }
     150  
         // END COPY from org.apache.tools.ant.taskdefs
     151   @@ -299,7 +299,7 @@
          * The application name for the report.
     153  
          */
    -  154  16
         private String applicationName = "Dependency-Check";
    +  154  4
         private String applicationName = "Dependency-Check";
     155  
     
     156   @@ -342,7 +342,7 @@
          * The location of the data directory that contains
     175  
          */
    -  176  16
         private String dataDirectory = null;
    +  176  4
         private String dataDirectory = null;
     177  
     
     178   @@ -385,7 +385,7 @@
          * Specifies the destination directory for the generated Dependency-Check report.
     197  
          */
    -  198  16
         private String reportOutputDirectory = ".";
    +  198  4
         private String reportOutputDirectory = ".";
     199  
     
     200   @@ -432,7 +432,7 @@
          * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail.
     221  
          */
    -  222  16
         private float failBuildOnCVSS = 11;
    +  222  4
         private float failBuildOnCVSS = 11;
     223  
     
     224   @@ -477,7 +477,7 @@
          * false. Default is true.
     244  
          */
    -  245  16
         private boolean autoUpdate = true;
    +  245  4
         private boolean autoUpdate = true;
     246  
     
     247   @@ -522,7 +522,7 @@
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
     267  
          */
    -  268  16
         private String reportFormat = "HTML";
    +  268  4
         private String reportFormat = "HTML";
     269  
     
     270   @@ -555,8 +555,8 @@
          */
     284  
         public void setReportFormat(ReportFormats reportFormat) {
    -  285  16
             this.reportFormat = reportFormat.getValue();
    -  286  16
         }
    +  285  4
             this.reportFormat = reportFormat.getValue();
    +  286  4
         }
     287  
         /**
     288   @@ -828,7 +828,7 @@
          * The file path used for verbose logging.
     423  
          */
    -  424  16
         private String logFile = null;
    +  424  4
         private String logFile = null;
     425  
     
     426   @@ -915,7 +915,7 @@
          * flag indicating whether or not to show a summary of findings.
     467  
          */
    -  468  16
         private boolean showSummary = true;
    +  468  4
         private boolean showSummary = true;
     469  
     
     470   @@ -976,7 +976,7 @@
          * Whether or not the Archive Analyzer is enabled.
     498  
          */
    -  499  16
         private boolean archiveAnalyzerEnabled = true;
    +  499  4
         private boolean archiveAnalyzerEnabled = true;
     500  
     
     501   @@ -1001,7 +1001,7 @@
          * Whether or not the .NET Assembly Analyzer is enabled.
     511  
          */
    -  512  16
         private boolean assemblyAnalyzerEnabled = true;
    +  512  4
         private boolean assemblyAnalyzerEnabled = true;
     513  
     
     514   @@ -1062,7 +1062,7 @@
          * Whether or not the .NET Nuspec Analyzer is enabled.
     542  
          */
    -  543  16
         private boolean nuspecAnalyzerEnabled = true;
    +  543  4
         private boolean nuspecAnalyzerEnabled = true;
     544  
     
     545   @@ -1107,7 +1107,7 @@
          * Whether or not the nexus analyzer is enabled.
     565  
          */
    -  566  16
         private boolean nexusAnalyzerEnabled = true;
    +  566  4
         private boolean nexusAnalyzerEnabled = true;
     567  
     
     568   @@ -1196,7 +1196,7 @@
          * Whether or not the defined proxy should be used when connecting to Nexus.
     610  
          */
    -  611  16
         private boolean nexusUsesProxy = true;
    +  611  4
         private boolean nexusUsesProxy = true;
     612  
     
     613   @@ -1741,62 +1741,62 @@
         @Override
     883  
         public void execute() throws BuildException {
    -  884  16
             final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  885  16
             LogUtils.prepareLogger(in, logFile);
    +  884  4
             final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  885  4
             LogUtils.prepareLogger(in, logFile);
     886  
     
    -  887  16
             dealWithReferences();
    -  888  16
             validateConfiguration();
    -  889  12
             populateSettings();
    +  887  4
             dealWithReferences();
    +  888  4
             validateConfiguration();
    +  889  3
             populateSettings();
     890  
     
    -  891  12
             Engine engine = null;
    +  891  3
             Engine engine = null;
     892  
             try {
    -  893  12
                 engine = new Engine(DependencyCheckTask.class.getClassLoader());
    +  893  3
                 engine = new Engine(DependencyCheckTask.class.getClassLoader());
     894  
     
    -  895  12
                 for (Resource resource : path) {
    -  896  20
                     final FileProvider provider = resource.as(FileProvider.class);
    -  897  20
                     if (provider != null) {
    -  898  20
                         final File file = provider.getFile();
    -  899  20
                         if (file != null && file.exists()) {
    -  900  16
                             engine.scan(file);
    +  895  3
                 for (Resource resource : path) {
    +  896  5
                     final FileProvider provider = resource.as(FileProvider.class);
    +  897  5
                     if (provider != null) {
    +  898  5
                         final File file = provider.getFile();
    +  899  5
                         if (file != null && file.exists()) {
    +  900  4
                             engine.scan(file);
     901  
                         }
     902  
                     }
    -  903  20
                 }
    +  903  5
                 }
     904  
                 try {
    -  905  12
                     engine.analyzeDependencies();
    -  906  12
                     DatabaseProperties prop = null;
    -  907  12
                     CveDB cve = null;
    +  905  3
                     engine.analyzeDependencies();
    +  906  3
                     DatabaseProperties prop = null;
    +  907  3
                     CveDB cve = null;
     908  
                     try {
    -  909  12
                         cve = new CveDB();
    -  910  12
                         cve.open();
    -  911  12
                         prop = cve.getDatabaseProperties();
    +  909  3
                         cve = new CveDB();
    +  910  3
                         cve.open();
    +  911  3
                         prop = cve.getDatabaseProperties();
     912  0
                     } catch (DatabaseException ex) {
     913  0
                         LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
     914  
                     } finally {
    -  915  12
                         if (cve != null) {
    -  916  12
                             cve.close();
    +  915  3
                         if (cve != null) {
    +  916  3
                             cve.close();
     917  
                         }
     918  
                     }
    -  919  12
                     final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
    -  920  12
                     reporter.generateReports(reportOutputDirectory, reportFormat);
    +  919  3
                     final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
    +  920  3
                     reporter.generateReports(reportOutputDirectory, reportFormat);
     921  
     
    -  922  12
                     if (this.failBuildOnCVSS <= 10) {
    +  922  3
                     if (this.failBuildOnCVSS <= 10) {
     923  0
                         checkForFailure(engine.getDependencies());
     924  
                     }
    -  925  12
                     if (this.showSummary) {
    -  926  12
                         showSummary(engine.getDependencies());
    +  925  3
                     if (this.showSummary) {
    +  926  3
                         showSummary(engine.getDependencies());
     927  
                     }
     928  0
                 } catch (IOException ex) {
    @@ -1805,20 +1805,20 @@  931  0
                 } catch (Exception ex) {
     932  0
                     LOGGER.log(Level.FINE, "An exception occurred; unable to continue task", ex);
     933  0
                     throw new BuildException("An exception occurred; unable to continue task", ex);
    -  934  12
                 }
    +  934  3
                 }
     935  0
             } catch (DatabaseException ex) {
     936  0
                 LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
     937  0
                 LOGGER.log(Level.FINE, "", ex);
     938  
             } finally {
    -  939  12
                 Settings.cleanup(true);
    -  940  12
                 if (engine != null) {
    -  941  12
                     engine.cleanup();
    +  939  3
                 Settings.cleanup(true);
    +  940  3
                 if (engine != null) {
    +  941  3
                     engine.cleanup();
     942  
                 }
     943  
             }
    -  944  12
         }
    +  944  3
         }
     945  
     
     946   @@ -1833,15 +1833,15 @@
          */
     951  
         private void validateConfiguration() throws BuildException {
    -  952  16
             if (path == null) {
    -  953  4
                 throw new BuildException("No project dependencies have been defined to analyze.");
    +  952  4
             if (path == null) {
    +  953  1
                 throw new BuildException("No project dependencies have been defined to analyze.");
     954  
             }
    -  955  12
             if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
    +  955  3
             if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
     956  0
                 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");
     957  
             }
    -  958  12
         }
    +  958  3
         }
     959  
     
     960   @@ -1854,65 +1854,65 @@
          */
     964  
         private void populateSettings() {
    -  965  12
             Settings.initialize();
    -  966  12
             InputStream taskProperties = null;
    +  965  3
             Settings.initialize();
    +  966  3
             InputStream taskProperties = null;
     967  
             try {
    -  968  12
                 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  969  12
                 Settings.mergeProperties(taskProperties);
    +  968  3
                 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  969  3
                 Settings.mergeProperties(taskProperties);
     970  0
             } catch (IOException ex) {
     971  0
                 LOGGER.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
     972  0
                 LOGGER.log(Level.FINE, null, ex);
     973  
             } finally {
    -  974  12
                 if (taskProperties != null) {
    +  974  3
                 if (taskProperties != null) {
     975  
                     try {
    -  976  12
                         taskProperties.close();
    +  976  3
                         taskProperties.close();
     977  0
                     } catch (IOException ex) {
     978  0
                         LOGGER.log(Level.FINEST, null, ex);
    -  979  12
                     }
    +  979  3
                     }
     980  
                 }
     981  
             }
    -  982  12
             if (dataDirectory != null) {
    +  982  3
             if (dataDirectory != null) {
     983  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
     984  
             } else {
    -  985  12
                 final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    -  986  12
                 final File base = jarPath.getParentFile();
    -  987  12
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    -  988  12
                 final File dataDir = new File(base, sub);
    -  989  12
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    +  985  3
                 final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    +  986  3
                 final File base = jarPath.getParentFile();
    +  987  3
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    +  988  3
                 final File dataDir = new File(base, sub);
    +  989  3
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
     990  
             }
     991  
     
    -  992  12
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  992  3
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
     993  
     
    -  994  12
             if (proxyServer != null && !proxyServer.isEmpty()) {
    +  994  3
             if (proxyServer != null && !proxyServer.isEmpty()) {
     995  0
                 Settings.setString(Settings.KEYS.PROXY_SERVER, proxyServer);
     996  
             }
    -  997  12
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  997  3
             if (proxyPort != null && !proxyPort.isEmpty()) {
     998  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
     999  
             }
    -  1000  12
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    +  1000  3
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
     1001  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
     1002  
             }
    -  1003  12
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    +  1003  3
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
     1004  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
     1005  
             }
    -  1006  12
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  1006  3
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
     1007  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
     1008  
             }
    -  1009  12
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  1009  3
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
     1010  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
     1011  
             }
    @@ -1922,71 +1922,71 @@
             //File Type Analyzer Settings
     1014  
             //JAR ANALYZER
    -  1015  12
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
    +  1015  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
     1016  
             //NUSPEC ANALYZER
    -  1017  12
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    +  1017  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
     1018  
             //NEXUS ANALYZER
    -  1019  12
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    -  1020  12
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  1019  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    +  1020  3
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
     1021  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
     1022  
             }
    -  1023  12
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    +  1023  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
     1024  
             //ARCHIVE ANALYZER
    -  1025  12
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    -  1026  12
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    +  1025  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    +  1026  3
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
     1027  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
     1028  
             }
     1029  
             //ASSEMBLY ANALYZER
    -  1030  12
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    -  1031  12
             if (pathToMono != null && !pathToMono.isEmpty()) {
    +  1030  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    +  1031  3
             if (pathToMono != null && !pathToMono.isEmpty()) {
     1032  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
     1033  
             }
     1034  
     
    -  1035  12
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  1035  3
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
     1036  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
     1037  
             }
    -  1038  12
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  1038  3
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
     1039  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
     1040  
             }
    -  1041  12
             if (connectionString != null && !connectionString.isEmpty()) {
    +  1041  3
             if (connectionString != null && !connectionString.isEmpty()) {
     1042  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
     1043  
             }
    -  1044  12
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  1044  3
             if (databaseUser != null && !databaseUser.isEmpty()) {
     1045  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
     1046  
             }
    -  1047  12
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  1047  3
             if (databasePassword != null && !databasePassword.isEmpty()) {
     1048  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
     1049  
             }
    -  1050  12
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    +  1050  3
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
     1051  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
     1052  
             }
    -  1053  12
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    +  1053  3
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
     1054  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
     1055  
             }
    -  1056  12
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    +  1056  3
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
     1057  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
     1058  
             }
    -  1059  12
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    +  1059  3
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
     1060  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
     1061  
             }
    -  1062  12
         }
    +  1062  3
         }
     1063  
     
     1064   @@ -2044,47 +2044,47 @@
          */
     1097  
         private void showSummary(List<Dependency> dependencies) {
    -  1098  12
             final StringBuilder summary = new StringBuilder();
    -  1099  12
             for (Dependency d : dependencies) {
    -  1100  20
                 boolean firstEntry = true;
    -  1101  20
                 final StringBuilder ids = new StringBuilder();
    -  1102  20
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1103  88
                     if (firstEntry) {
    -  1104  16
                         firstEntry = false;
    +  1098  3
             final StringBuilder summary = new StringBuilder();
    +  1099  3
             for (Dependency d : dependencies) {
    +  1100  5
                 boolean firstEntry = true;
    +  1101  5
                 final StringBuilder ids = new StringBuilder();
    +  1102  5
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  1103  22
                     if (firstEntry) {
    +  1104  4
                         firstEntry = false;
     1105  
                     } else {
    -  1106  72
                         ids.append(", ");
    +  1106  18
                         ids.append(", ");
     1107  
                     }
    -  1108  88
                     ids.append(v.getName());
    -  1109  88
                 }
    -  1110  20
                 if (ids.length() > 0) {
    -  1111  16
                     summary.append(d.getFileName()).append(" (");
    -  1112  16
                     firstEntry = true;
    -  1113  16
                     for (Identifier id : d.getIdentifiers()) {
    -  1114  44
                         if (firstEntry) {
    -  1115  16
                             firstEntry = false;
    +  1108  22
                     ids.append(v.getName());
    +  1109  22
                 }
    +  1110  5
                 if (ids.length() > 0) {
    +  1111  4
                     summary.append(d.getFileName()).append(" (");
    +  1112  4
                     firstEntry = true;
    +  1113  4
                     for (Identifier id : d.getIdentifiers()) {
    +  1114  11
                         if (firstEntry) {
    +  1115  4
                             firstEntry = false;
     1116  
                         } else {
    -  1117  28
                             summary.append(", ");
    +  1117  7
                             summary.append(", ");
     1118  
                         }
    -  1119  44
                         summary.append(id.getValue());
    -  1120  44
                     }
    -  1121  16
                     summary.append(") : ").append(ids).append(NEW_LINE);
    +  1119  11
                         summary.append(id.getValue());
    +  1120  11
                     }
    +  1121  4
                     summary.append(") : ").append(ids).append(NEW_LINE);
     1122  
                 }
    -  1123  20
             }
    -  1124  12
             if (summary.length() > 0) {
    -  1125  12
                 final String msg = String.format("%n%n"
    +  1123  5
             }
    +  1124  3
             if (summary.length() > 0) {
    +  1125  3
                 final String msg = String.format("%n%n"
     1126  
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
     1127  
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    -  1128  12
                 LOGGER.log(Level.WARNING, msg);
    +  1128  3
                 LOGGER.log(Level.WARNING, msg);
     1129  
             }
    -  1130  12
         }
    +  1130  3
         }
     1131  
     
     1132   @@ -2111,14 +2111,14 @@
             @Override
     1143  
             public String[] getValues() {
    -  1144  16
                 int i = 0;
    -  1145  16
                 final Format[] formats = Format.values();
    -  1146  16
                 final String[] values = new String[formats.length];
    -  1147  80
                 for (Format format : formats) {
    -  1148  64
                     values[i++] = format.name();
    +  1144  4
                 int i = 0;
    +  1145  4
                 final Format[] formats = Format.values();
    +  1146  4
                 final String[] values = new String[formats.length];
    +  1147  20
                 for (Format format : formats) {
    +  1148  16
                     values[i++] = format.name();
     1149  
                 }
    -  1150  16
                 return values;
    +  1150  4
                 return values;
     1151  
             }
     1152   @@ -2131,7 +2131,7 @@
          * Whether or not the Jar Analyzer is enabled.
     1156  
          */
    -  1157  16
         private boolean jarAnalyzerEnabled = true;
    +  1157  4
         private boolean jarAnalyzerEnabled = true;
     1158  
     
     1159   @@ -2154,6 +2154,6 @@
     }
    - + diff --git a/dependency-check-ant/configuration.html b/dependency-check-ant/configuration.html index d0cbec2d3..7c2e7bce0 100644 --- a/dependency-check-ant/configuration.html +++ b/dependency-check-ant/configuration.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Configuration @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/cpd.html b/dependency-check-ant/cpd.html index 2e4cdff59..2799443f4 100644 --- a/dependency-check-ant/cpd.html +++ b/dependency-check-ant/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - CPD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/dependency-updates-report.html b/dependency-check-ant/dependency-updates-report.html index b7a949605..79acd24f5 100644 --- a/dependency-check-ant/dependency-updates-report.html +++ b/dependency-check-ant/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -327,7 +327,7 @@ org.owasp dependency-check-core -1.2.4 +1.2.5 compile jar @@ -339,7 +339,7 @@ org.owasp dependency-check-utils -1.2.4 +1.2.5 compile jar @@ -457,7 +457,7 @@ dependency-check-core Current Version -1.2.4 +1.2.5 Scope compile @@ -481,7 +481,7 @@ dependency-check-utils Current Version -1.2.4 +1.2.5 Scope compile diff --git a/dependency-check-ant/findbugs.html b/dependency-check-ant/findbugs.html index 96f8ceef9..1aed036a4 100644 --- a/dependency-check-ant/findbugs.html +++ b/dependency-check-ant/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-ant - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/index.html b/dependency-check-ant/index.html index 6a5d44a83..e9f02ff6a 100644 --- a/dependency-check-ant/index.html +++ b/dependency-check-ant/index.html @@ -1,13 +1,13 @@ - + dependency-check-ant - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/installation.html b/dependency-check-ant/installation.html index 63dd031db..78c1d4144 100644 --- a/dependency-check-ant/installation.html +++ b/dependency-check-ant/installation.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Installation @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -160,7 +160,7 @@

    Installation

    -

    Download dependency-check-ant from bintray here. To install dependency-check-ant place the dependency-check-ant-1.2.4.jar into the lib directory of your Ant instalation directory. Once installed you can add the taskdef to you build.xml and add the task to a new or existing target:

    +

    Download dependency-check-ant from bintray here. To install dependency-check-ant place the dependency-check-ant-1.2.5.jar into the lib directory of your Ant instalation directory. Once installed you can add the taskdef to you build.xml and add the task to a new or existing target:

    <taskdef name="dependency-check" classname="org.owasp.dependencycheck.taskdefs.DependencyCheckTask"/>
    @@ -169,7 +169,7 @@
     
     
    <taskdef name="dependency-check" classname="org.owasp.dependencycheck.taskdefs.DependencyCheckTask">
    -    <classpath path="[path]/[to]/dependency-check-ant-1.2.4.jar"/>
    +    <classpath path="[path]/[to]/dependency-check-ant-1.2.5.jar"/>
     </taskdef>
     

    It is important to understand that the first time this task is executed it may take 20 minutes or more as it downloads and processes the data from the National Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov

    diff --git a/dependency-check-ant/license.html b/dependency-check-ant/license.html index cc3ddbb24..d8a26bbec 100644 --- a/dependency-check-ant/license.html +++ b/dependency-check-ant/license.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/plugin-updates-report.html b/dependency-check-ant/plugin-updates-report.html index 30cfe81f0..286364ab9 100644 --- a/dependency-check-ant/plugin-updates-report.html +++ b/dependency-check-ant/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/pmd.html b/dependency-check-ant/pmd.html index 5e208bf68..9e5fd77f1 100644 --- a/dependency-check-ant/pmd.html +++ b/dependency-check-ant/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/project-info.html b/dependency-check-ant/project-info.html index 91ae3d942..f350529a0 100644 --- a/dependency-check-ant/project-info.html +++ b/dependency-check-ant/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/project-reports.html b/dependency-check-ant/project-reports.html index 58f899214..493317185 100644 --- a/dependency-check-ant/project-reports.html +++ b/dependency-check-ant/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/project-summary.html b/dependency-check-ant/project-summary.html index 2d1f9822b..cb868e7e7 100644 --- a/dependency-check-ant/project-summary.html +++ b/dependency-check-ant/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -225,7 +225,7 @@ dependency-check-ant Version -1.2.4 +1.2.5 Type jar diff --git a/dependency-check-ant/surefire-report.html b/dependency-check-ant/surefire-report.html index f90fa27c0..ca29a71ab 100644 --- a/dependency-check-ant/surefire-report.html +++ b/dependency-check-ant/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -281,7 +281,7 @@ function toggleDisplay(elementId) { 0 0 100% -43.468
    +64.47

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -302,7 +302,7 @@ function toggleDisplay(elementId) { 0 0 100% -43.468
    +64.47

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.taskdefs

    @@ -324,7 +324,7 @@ function toggleDisplay(elementId) { 0 0 100% -43.468

    +64.47

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -334,19 +334,19 @@ function toggleDisplay(elementId) { testGetFailBuildOnCVSS -0.668 +0.833 testAddDirSet -18.086 +30.55 testAddFileSet -12.001 +17.502 testAddFileList -12.713

    +15.585
    diff --git a/dependency-check-ant/taglist.html b/dependency-check-ant/taglist.html index 86d864d46..bfb88281b 100644 --- a/dependency-check-ant/taglist.html +++ b/dependency-check-ant/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-ant/usage.html b/dependency-check-ant/usage.html index eefb78b80..02db78353 100644 --- a/dependency-check-ant/usage.html +++ b/dependency-check-ant/usage.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Usage @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -169,7 +169,7 @@
    <taskdef name="dependency-check" classname="org.owasp.dependencycheck.taskdefs.DependencyCheckTask">
    -    <classpath path="[path]/[to]/dependency-check-ant-1.2.4.jar"/>
    +    <classpath path="[path]/[to]/dependency-check-ant-1.2.5.jar"/>
     </taskdef>
     

    Next, add the task to a target of your choosing:

    diff --git a/dependency-check-ant/xref-test/index.html b/dependency-check-ant/xref-test/index.html index f7f8846e4..ac066043b 100644 --- a/dependency-check-ant/xref-test/index.html +++ b/dependency-check-ant/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Ant Task 1.2.4 Reference + Dependency-Check Ant Task 1.2.5 Reference diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html index 7dad75bdf..6f49ff0f3 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.5 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html index fbf7a3a45..5411e49e2 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.5 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref-test/overview-frame.html b/dependency-check-ant/xref-test/overview-frame.html index f033c04ba..f8824867d 100644 --- a/dependency-check-ant/xref-test/overview-frame.html +++ b/dependency-check-ant/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference + Dependency-Check Ant Task 1.2.5 Reference diff --git a/dependency-check-ant/xref-test/overview-summary.html b/dependency-check-ant/xref-test/overview-summary.html index d1c736474..8bc76ebab 100644 --- a/dependency-check-ant/xref-test/overview-summary.html +++ b/dependency-check-ant/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference + Dependency-Check Ant Task 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Ant Task 1.2.4 Reference

    +

    Dependency-Check Ant Task 1.2.5 Reference

    diff --git a/dependency-check-ant/xref/index.html b/dependency-check-ant/xref/index.html index f7f8846e4..ac066043b 100644 --- a/dependency-check-ant/xref/index.html +++ b/dependency-check-ant/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Ant Task 1.2.4 Reference + Dependency-Check Ant Task 1.2.5 Reference diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html index 228ed94c4..78b962306 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.5 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html index f2618333b..5d37f4f61 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.5 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref/overview-frame.html b/dependency-check-ant/xref/overview-frame.html index f033c04ba..f8824867d 100644 --- a/dependency-check-ant/xref/overview-frame.html +++ b/dependency-check-ant/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference + Dependency-Check Ant Task 1.2.5 Reference diff --git a/dependency-check-ant/xref/overview-summary.html b/dependency-check-ant/xref/overview-summary.html index d1c736474..8bc76ebab 100644 --- a/dependency-check-ant/xref/overview-summary.html +++ b/dependency-check-ant/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.2.4 Reference + Dependency-Check Ant Task 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Ant Task 1.2.4 Reference

    +

    Dependency-Check Ant Task 1.2.5 Reference

    diff --git a/dependency-check-cli/apidocs/allclasses-frame.html b/dependency-check-cli/apidocs/allclasses-frame.html index fe8240755..12232ef5b 100644 --- a/dependency-check-cli/apidocs/allclasses-frame.html +++ b/dependency-check-cli/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Command Line 1.2.4 API) - +All Classes (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/allclasses-noframe.html b/dependency-check-cli/apidocs/allclasses-noframe.html index fbc4ec416..ed6533361 100644 --- a/dependency-check-cli/apidocs/allclasses-noframe.html +++ b/dependency-check-cli/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Command Line 1.2.4 API) - +All Classes (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/constant-values.html b/dependency-check-cli/apidocs/constant-values.html index 7eb2d1593..60a5bf912 100644 --- a/dependency-check-cli/apidocs/constant-values.html +++ b/dependency-check-cli/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Command Line 1.2.4 API) - +Constant Field Values (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/deprecated-list.html b/dependency-check-cli/apidocs/deprecated-list.html index f36595841..c1557c73e 100644 --- a/dependency-check-cli/apidocs/deprecated-list.html +++ b/dependency-check-cli/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Command Line 1.2.4 API) - +Deprecated List (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/help-doc.html b/dependency-check-cli/apidocs/help-doc.html index 524a5d027..c6065d6fd 100644 --- a/dependency-check-cli/apidocs/help-doc.html +++ b/dependency-check-cli/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Command Line 1.2.4 API) - +API Help (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/index-all.html b/dependency-check-cli/apidocs/index-all.html index 2bb40bee1..0443555bd 100644 --- a/dependency-check-cli/apidocs/index-all.html +++ b/dependency-check-cli/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Command Line 1.2.4 API) - +Index (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/index.html b/dependency-check-cli/apidocs/index.html index 00b4b3cff..d9b37c0be 100644 --- a/dependency-check-cli/apidocs/index.html +++ b/dependency-check-cli/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Command Line 1.2.4 API +Dependency-Check Command Line 1.2.5 API diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html index cb439f469..b9e85de77 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.App (Dependency-Check Command Line 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.App (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ARGUMENT.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ARGUMENT.html index 311aa9656..13290df09 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ARGUMENT.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ARGUMENT.html @@ -2,16 +2,16 @@ - + -CliParser.ARGUMENT (Dependency-Check Command Line 1.2.4 API) - +CliParser.ARGUMENT (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html index 4e85dae01..35323de27 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html @@ -2,16 +2,16 @@ - + -CliParser (Dependency-Check Command Line 1.2.4 API) - +CliParser (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ARGUMENT.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ARGUMENT.html index 716966552..9321d6400 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ARGUMENT.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ARGUMENT.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.cli.CliParser.ARGUMENT (Dependency-Check Command Line 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.cli.CliParser.ARGUMENT (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html index a8cdf1212..de4a35436 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.cli.CliParser (Dependency-Check Command Line 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.cli.CliParser (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html index 402d6a1b5..6817a0c26 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.4 API) - +org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html index 4580e9c25..98b2a59cd 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.4 API) - +org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html index 1b21a2657..add340826 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.cli Class Hierarchy (Dependency-Check Command Line 1.2.4 API) - +org.owasp.dependencycheck.cli Class Hierarchy (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html index d7a55f1f0..951855d46 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html index c681dfe32..40bdd6d38 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck (Dependency-Check Command Line 1.2.4 API) - +org.owasp.dependencycheck (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html index 102e7418b..aa217e49b 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck (Dependency-Check Command Line 1.2.4 API) - +org.owasp.dependencycheck (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html index 1cd6cdcd5..4d571737b 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck Class Hierarchy (Dependency-Check Command Line 1.2.4 API) - +org.owasp.dependencycheck Class Hierarchy (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html index b4350d4a7..f383c7a11 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck (Dependency-Check Command Line 1.2.4 API) - +Uses of Package org.owasp.dependencycheck (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/overview-frame.html b/dependency-check-cli/apidocs/overview-frame.html index 3dc41018a..8f00f514a 100644 --- a/dependency-check-cli/apidocs/overview-frame.html +++ b/dependency-check-cli/apidocs/overview-frame.html @@ -2,10 +2,10 @@ - + -Overview List (Dependency-Check Command Line 1.2.4 API) - +Overview List (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/apidocs/overview-summary.html b/dependency-check-cli/apidocs/overview-summary.html index 26cb71357..7c0aa4cc2 100644 --- a/dependency-check-cli/apidocs/overview-summary.html +++ b/dependency-check-cli/apidocs/overview-summary.html @@ -2,16 +2,16 @@ - + -Overview (Dependency-Check Command Line 1.2.4 API) - +Overview (Dependency-Check Command Line 1.2.5 API) + @@ -64,7 +64,7 @@
    -

    Dependency-Check Command Line 1.2.4 API

    +

    Dependency-Check Command Line 1.2.5 API

    diff --git a/dependency-check-cli/apidocs/overview-tree.html b/dependency-check-cli/apidocs/overview-tree.html index dfc0f3315..5e3bc1fe8 100644 --- a/dependency-check-cli/apidocs/overview-tree.html +++ b/dependency-check-cli/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Command Line 1.2.4 API) - +Class Hierarchy (Dependency-Check Command Line 1.2.5 API) + diff --git a/dependency-check-cli/arguments.html b/dependency-check-cli/arguments.html index 4a2393ce6..562b88d9d 100644 --- a/dependency-check-cli/arguments.html +++ b/dependency-check-cli/arguments.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Command Line Arguments @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/checkstyle.html b/dependency-check-cli/checkstyle.html index 4769d6076..63de963fb 100644 --- a/dependency-check-cli/checkstyle.html +++ b/dependency-check-cli/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Checkstyle Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html index 86e6e198c..f11192862 100644 --- a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html +++ b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html @@ -38,6 +38,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html index 58557330a..7058c4a46 100644 --- a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html +++ b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html @@ -38,6 +38,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-cli/cobertura/frame-summary.html b/dependency-check-cli/cobertura/frame-summary.html index aa021e851..39aa0222e 100644 --- a/dependency-check-cli/cobertura/frame-summary.html +++ b/dependency-check-cli/cobertura/frame-summary.html @@ -26,6 +26,6 @@ var packageTable = new SortableTable(document.getElementById("packageResults"), ["String", "Number", "Percentage", "Percentage", "FormattedNumber"]); packageTable.sort(0); - + diff --git a/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html b/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html index d19d19374..a73e7e9ae 100644 --- a/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html +++ b/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html @@ -415,6 +415,6 @@
     }
    - + diff --git a/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html b/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html index 880e6d853..636a05c25 100644 --- a/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html +++ b/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html @@ -108,7 +108,7 @@
          * The logger.
     45  
          */
    -  46  4
         private static final Logger LOGGER = Logger.getLogger(CliParser.class.getName());
    +  46  1
         private static final Logger LOGGER = Logger.getLogger(CliParser.class.getName());
     47  
         /**
     48   @@ -143,14 +143,14 @@
          */
     63  
         public void parse(String[] args) throws FileNotFoundException, ParseException {
    -  64  36
             line = parseArgs(args);
    +  64  9
             line = parseArgs(args);
     65  
     
    -  66  28
             if (line != null) {
    -  67  28
                 validateArgs();
    +  66  7
             if (line != null) {
    +  67  7
                 validateArgs();
     68  
             }
    -  69  24
         }
    +  69  6
         }
     70  
     
     71   @@ -169,9 +169,9 @@
          */
     78  
         private CommandLine parseArgs(String[] args) throws ParseException {
    -  79  36
             final CommandLineParser parser = new PosixParser();
    -  80  36
             final Options options = createCommandLineOptions();
    -  81  36
             return parser.parse(options, args);
    +  79  9
             final CommandLineParser parser = new PosixParser();
    +  80  9
             final Options options = createCommandLineOptions();
    +  81  9
             return parser.parse(options, args);
     82  
         }
     83   @@ -192,18 +192,18 @@
          */
     91  
         private void validateArgs() throws FileNotFoundException, ParseException {
    -  92  28
             if (isRunScan()) {
    -  93  8
                 validatePathExists(getScanFiles(), ARGUMENT.SCAN);
    -  94  4
                 validatePathExists(getReportDirectory(), ARGUMENT.OUT);
    -  95  4
                 if (getPathToMono() != null) {
    +  92  7
             if (isRunScan()) {
    +  93  2
                 validatePathExists(getScanFiles(), ARGUMENT.SCAN);
    +  94  1
                 validatePathExists(getReportDirectory(), ARGUMENT.OUT);
    +  95  1
                 if (getPathToMono() != null) {
     96  0
                     validatePathExists(getPathToMono(), ARGUMENT.PATH_TO_MONO);
     97  
                 }
    -  98  4
                 if (!line.hasOption(ARGUMENT.APP_NAME)) {
    +  98  1
                 if (!line.hasOption(ARGUMENT.APP_NAME)) {
     99  0
                     throw new ParseException("Missing 'app' argument; the scan cannot be run without the an application name.");
     100  
                 }
    -  101  4
                 if (line.hasOption(ARGUMENT.OUTPUT_FORMAT)) {
    +  101  1
                 if (line.hasOption(ARGUMENT.OUTPUT_FORMAT)) {
     102  0
                     final String format = line.getOptionValue(ARGUMENT.OUTPUT_FORMAT);
     103  
                     try {
    @@ -218,7 +218,7 @@
                 }
     111  
             }
    -  112  24
         }
    +  112  6
         }
     113  
     
     114   @@ -239,11 +239,11 @@
          */
     122  
         private void validatePathExists(String[] paths, String optType) throws FileNotFoundException {
    -  123  12
             for (String path : paths) {
    -  124  8
                 validatePathExists(path, optType);
    +  123  3
             for (String path : paths) {
    +  124  2
                 validatePathExists(path, optType);
     125  
             }
    -  126  4
         }
    +  126  1
         }
     127  
     
     128   @@ -264,17 +264,17 @@
          */
     136  
         private void validatePathExists(String path, String argumentName) throws FileNotFoundException {
    -  137  12
             if (!path.contains("*.")) {
    -  138  12
                 final File f = new File(path);
    -  139  12
                 if (!f.exists()) {
    -  140  4
                     isValid = false;
    -  141  4
                     final String msg = String.format("Invalid '%s' argument: '%s'", argumentName, path);
    -  142  4
                     throw new FileNotFoundException(msg);
    +  137  3
             if (!path.contains("*.")) {
    +  138  3
                 final File f = new File(path);
    +  139  3
                 if (!f.exists()) {
    +  140  1
                     isValid = false;
    +  141  1
                     final String msg = String.format("Invalid '%s' argument: '%s'", argumentName, path);
    +  142  1
                     throw new FileNotFoundException(msg);
     143  
                 }
     144  
             } // else { // TODO add a validation for *.zip extensions rather then relying on the engine to validate it.
    -  145  8
         }
    +  145  2
         }
     146  
     
     147   @@ -293,11 +293,11 @@
         private Options createCommandLineOptions() {
     154  
     
    -  155  36
             final Options options = new Options();
    -  156  36
             addStandardOptions(options);
    -  157  36
             addAdvancedOptions(options);
    -  158  36
             addDeprecatedOptions(options);
    -  159  36
             return options;
    +  155  9
             final Options options = new Options();
    +  156  9
             addStandardOptions(options);
    +  157  9
             addAdvancedOptions(options);
    +  158  9
             addDeprecatedOptions(options);
    +  159  9
             return options;
     160  
         }
     161   @@ -318,34 +318,34 @@
         @SuppressWarnings("static-access")
     169  
         private void addStandardOptions(final Options options) throws IllegalArgumentException {
    -  170  44
             final Option help = new Option(ARGUMENT.HELP_SHORT, ARGUMENT.HELP, false,
    +  170  11
             final Option help = new Option(ARGUMENT.HELP_SHORT, ARGUMENT.HELP, false,
     171  
                     "Print this message.");
     172  
     
    -  173  44
             final Option advancedHelp = OptionBuilder.withLongOpt(ARGUMENT.ADVANCED_HELP)
    +  173  11
             final Option advancedHelp = OptionBuilder.withLongOpt(ARGUMENT.ADVANCED_HELP)
     174  
                     .withDescription("Print the advanced help message.").create();
     175  
     
    -  176  44
             final Option version = new Option(ARGUMENT.VERSION_SHORT, ARGUMENT.VERSION,
    +  176  11
             final Option version = new Option(ARGUMENT.VERSION_SHORT, ARGUMENT.VERSION,
     177  
                     false, "Print the version information.");
     178  
     
    -  179  44
             final Option noUpdate = new Option(ARGUMENT.DISABLE_AUTO_UPDATE_SHORT, ARGUMENT.DISABLE_AUTO_UPDATE,
    +  179  11
             final Option noUpdate = new Option(ARGUMENT.DISABLE_AUTO_UPDATE_SHORT, ARGUMENT.DISABLE_AUTO_UPDATE,
     180  
                     false, "Disables the automatic updating of the CPE data.");
     181  
     
    -  182  44
             final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ARGUMENT.APP_NAME)
    +  182  11
             final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ARGUMENT.APP_NAME)
     183  
                     .withDescription("The name of the application being scanned. This is a required argument.")
     184  
                     .create(ARGUMENT.APP_NAME_SHORT);
     185  
     
    -  186  44
             final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.SCAN)
    +  186  11
             final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.SCAN)
     187  
                     .withDescription("The path to scan - this option can be specified multiple times. To limit the scan"
     188   @@ -354,35 +354,35 @@
                     .create(ARGUMENT.SCAN_SHORT);
     190  
     
    -  191  44
             final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ARGUMENT.PROP)
    +  191  11
             final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ARGUMENT.PROP)
     192  
                     .withDescription("A property file to load.")
     193  
                     .create(ARGUMENT.PROP_SHORT);
     194  
     
    -  195  44
             final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ARGUMENT.OUT)
    +  195  11
             final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ARGUMENT.OUT)
     196  
                     .withDescription("The folder to write reports to. This defaults to the current directory.")
     197  
                     .create(ARGUMENT.OUT_SHORT);
     198  
     
    -  199  44
             final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ARGUMENT.OUTPUT_FORMAT)
    +  199  11
             final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ARGUMENT.OUTPUT_FORMAT)
     200  
                     .withDescription("The output format to write to (XML, HTML, VULN, ALL). The default is HTML.")
     201  
                     .create(ARGUMENT.OUTPUT_FORMAT_SHORT);
     202  
     
    -  203  44
             final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ARGUMENT.VERBOSE_LOG)
    +  203  11
             final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ARGUMENT.VERBOSE_LOG)
     204  
                     .withDescription("The file path to write verbose logging information.")
     205  
                     .create(ARGUMENT.VERBOSE_LOG_SHORT);
     206  
     
    -  207  44
             final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ARGUMENT.SUPPRESSION_FILE)
    +  207  11
             final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ARGUMENT.SUPPRESSION_FILE)
     208  
                     .withDescription("The file path to the suppression XML file.")
     209   @@ -391,11 +391,11 @@
     
     211  
             //This is an option group because it can be specified more then once.
    -  212  44
             final OptionGroup og = new OptionGroup();
    -  213  44
             og.addOption(path);
    +  212  11
             final OptionGroup og = new OptionGroup();
    +  213  11
             og.addOption(path);
     214  
     
    -  215  44
             options.addOptionGroup(og)
    +  215  11
             options.addOptionGroup(og)
     216  
                     .addOption(out)
     217   @@ -416,7 +416,7 @@
                     .addOption(verboseLog)
     225  
                     .addOption(suppressionFile);
    -  226  44
         }
    +  226  11
         }
     227  
     
     228   @@ -439,127 +439,127 @@
         private void addAdvancedOptions(final Options options) throws IllegalArgumentException {
     237  
     
    -  238  36
             final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.DATA_DIRECTORY)
    +  238  9
             final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.DATA_DIRECTORY)
     239  
                     .withDescription("The location of the H2 Database file. This option should generally not be set.")
     240  
                     .create(ARGUMENT.DATA_DIRECTORY_SHORT);
     241  
     
    -  242  36
             final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ARGUMENT.CONNECTION_TIMEOUT)
    +  242  9
             final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ARGUMENT.CONNECTION_TIMEOUT)
     243  
                     .withDescription("The connection timeout (in milliseconds) to use when downloading resources.")
     244  
                     .create(ARGUMENT.CONNECTION_TIMEOUT_SHORT);
     245  
     
    -  246  36
             final Option proxyServer = OptionBuilder.withArgName("server").hasArg().withLongOpt(ARGUMENT.PROXY_SERVER)
    +  246  9
             final Option proxyServer = OptionBuilder.withArgName("server").hasArg().withLongOpt(ARGUMENT.PROXY_SERVER)
     247  
                     .withDescription("The proxy server to use when downloading resources.")
     248  
                     .create();
     249  
     
    -  250  36
             final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ARGUMENT.PROXY_PORT)
    +  250  9
             final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ARGUMENT.PROXY_PORT)
     251  
                     .withDescription("The proxy port to use when downloading resources.")
     252  
                     .create();
     253  
     
    -  254  36
             final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ARGUMENT.PROXY_USERNAME)
    +  254  9
             final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ARGUMENT.PROXY_USERNAME)
     255  
                     .withDescription("The proxy username to use when downloading resources.")
     256  
                     .create();
     257  
     
    -  258  36
             final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ARGUMENT.PROXY_PASSWORD)
    +  258  9
             final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ARGUMENT.PROXY_PASSWORD)
     259  
                     .withDescription("The proxy password to use when downloading resources.")
     260  
                     .create();
     261  
     
    -  262  36
             final Option connectionString = OptionBuilder.withArgName("connStr").hasArg().withLongOpt(ARGUMENT.CONNECTION_STRING)
    +  262  9
             final Option connectionString = OptionBuilder.withArgName("connStr").hasArg().withLongOpt(ARGUMENT.CONNECTION_STRING)
     263  
                     .withDescription("The connection string to the database.")
     264  
                     .create();
     265  
     
    -  266  36
             final Option dbUser = OptionBuilder.withArgName("user").hasArg().withLongOpt(ARGUMENT.DB_NAME)
    +  266  9
             final Option dbUser = OptionBuilder.withArgName("user").hasArg().withLongOpt(ARGUMENT.DB_NAME)
     267  
                     .withDescription("The username used to connect to the database.")
     268  
                     .create();
     269  
     
    -  270  36
             final Option dbPassword = OptionBuilder.withArgName("password").hasArg().withLongOpt(ARGUMENT.DB_PASSWORD)
    +  270  9
             final Option dbPassword = OptionBuilder.withArgName("password").hasArg().withLongOpt(ARGUMENT.DB_PASSWORD)
     271  
                     .withDescription("The password for connecting to the database.")
     272  
                     .create();
     273  
     
    -  274  36
             final Option dbDriver = OptionBuilder.withArgName("driver").hasArg().withLongOpt(ARGUMENT.DB_DRIVER)
    +  274  9
             final Option dbDriver = OptionBuilder.withArgName("driver").hasArg().withLongOpt(ARGUMENT.DB_DRIVER)
     275  
                     .withDescription("The database driver name.")
     276  
                     .create();
     277  
     
    -  278  36
             final Option dbDriverPath = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.DB_DRIVER_PATH)
    +  278  9
             final Option dbDriverPath = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.DB_DRIVER_PATH)
     279  
                     .withDescription("The path to the database driver; note, this does not need to be set unless the JAR is outside of the classpath.")
     280  
                     .create();
     281  
     
    -  282  36
             final Option disableJarAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_JAR)
    +  282  9
             final Option disableJarAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_JAR)
     283  
                     .withDescription("Disable the Jar Analyzer.")
     284  
                     .create();
    -  285  36
             final Option disableArchiveAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_ARCHIVE)
    +  285  9
             final Option disableArchiveAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_ARCHIVE)
     286  
                     .withDescription("Disable the Archive Analyzer.")
     287  
                     .create();
    -  288  36
             final Option disableNuspecAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_NUSPEC)
    +  288  9
             final Option disableNuspecAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_NUSPEC)
     289  
                     .withDescription("Disable the Nuspec Analyzer.")
     290  
                     .create();
    -  291  36
             final Option disableAssemblyAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_ASSEMBLY)
    +  291  9
             final Option disableAssemblyAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_ASSEMBLY)
     292  
                     .withDescription("Disable the .NET Assembly Analyzer.")
     293  
                     .create();
     294  
     
    -  295  36
             final Option disableNexusAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_NEXUS)
    +  295  9
             final Option disableNexusAnalyzer = OptionBuilder.withLongOpt(ARGUMENT.DISABLE_NEXUS)
     296  
                     .withDescription("Disable the Nexus Analyzer.")
     297  
                     .create();
     298  
     
    -  299  36
             final Option nexusUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ARGUMENT.NEXUS_URL)
    +  299  9
             final Option nexusUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ARGUMENT.NEXUS_URL)
     300  
                     .withDescription("The url to the Nexus Server.")
     301  
                     .create();
     302  
     
    -  303  36
             final Option nexusUsesProxy = OptionBuilder.withArgName("true/false").hasArg().withLongOpt(ARGUMENT.NEXUS_USES_PROXY)
    +  303  9
             final Option nexusUsesProxy = OptionBuilder.withArgName("true/false").hasArg().withLongOpt(ARGUMENT.NEXUS_USES_PROXY)
     304  
                     .withDescription("Whether or not the configured proxy should be used when connecting to Nexus.")
     305  
                     .create();
     306  
     
    -  307  36
             final Option additionalZipExtensions = OptionBuilder.withArgName("extensions").hasArg()
    +  307  9
             final Option additionalZipExtensions = OptionBuilder.withArgName("extensions").hasArg()
     308  
                     .withLongOpt(ARGUMENT.ADDITIONAL_ZIP_EXTENSIONS)
     309   @@ -570,14 +570,14 @@
                     .create();
     312  
     
    -  313  36
             final Option pathToMono = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.PATH_TO_MONO)
    +  313  9
             final Option pathToMono = OptionBuilder.withArgName("path").hasArg().withLongOpt(ARGUMENT.PATH_TO_MONO)
     314  
                     .withDescription("The path to Mono for .NET Assembly analysis on non-windows systems.")
     315  
                     .create();
     316  
     
    -  317  36
             options.addOption(proxyPort)
    +  317  9
             options.addOption(proxyPort)
     318  
                     .addOption(proxyServer)
     319   @@ -616,7 +616,7 @@
                     .addOption(additionalZipExtensions)
     336  
                     .addOption(pathToMono);
    -  337  36
         }
    +  337  9
         }
     338  
     
     339   @@ -639,15 +639,15 @@
         private void addDeprecatedOptions(final Options options) throws IllegalArgumentException {
     348  
     
    -  349  36
             final Option proxyServer = OptionBuilder.withArgName("url").hasArg().withLongOpt(ARGUMENT.PROXY_URL)
    +  349  9
             final Option proxyServer = OptionBuilder.withArgName("url").hasArg().withLongOpt(ARGUMENT.PROXY_URL)
     350  
                     .withDescription("The proxy url argument is deprecated, use proxyserver instead.")
     351  
                     .create();
     352  
     
    -  353  36
             options.addOption(proxyServer);
    -  354  36
         }
    +  353  9
             options.addOption(proxyServer);
    +  354  9
         }
     355  
     
     356   @@ -662,7 +662,7 @@
          */
     361  
         public boolean isGetVersion() {
    -  362  28
             return (line != null) && line.hasOption(ARGUMENT.VERSION);
    +  362  7
             return (line != null) && line.hasOption(ARGUMENT.VERSION);
     363  
         }
     364   @@ -679,7 +679,7 @@
          */
     370  
         public boolean isGetHelp() {
    -  371  28
             return (line != null) && line.hasOption(ARGUMENT.HELP);
    +  371  7
             return (line != null) && line.hasOption(ARGUMENT.HELP);
     372  
         }
     373   @@ -696,7 +696,7 @@
          */
     379  
         public boolean isRunScan() {
    -  380  56
             return (line != null) && isValid && line.hasOption(ARGUMENT.SCAN);
    +  380  14
             return (line != null) && isValid && line.hasOption(ARGUMENT.SCAN);
     381  
         }
     382   @@ -852,14 +852,14 @@
          */
     464  
         public void printHelp() {
    -  465  8
             final HelpFormatter formatter = new HelpFormatter();
    -  466  8
             final Options options = new Options();
    -  467  8
             addStandardOptions(options);
    -  468  8
             if (line != null && line.hasOption(ARGUMENT.ADVANCED_HELP)) {
    +  465  2
             final HelpFormatter formatter = new HelpFormatter();
    +  466  2
             final Options options = new Options();
    +  467  2
             addStandardOptions(options);
    +  468  2
             if (line != null && line.hasOption(ARGUMENT.ADVANCED_HELP)) {
     469  0
                 addAdvancedOptions(options);
     470  
             }
    -  471  8
             final String helpMsg = String.format("%n%s"
    +  471  2
             final String helpMsg = String.format("%n%s"
     472  
                     + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. "
     473   @@ -870,7 +870,7 @@
                     Settings.getString("application.name", "DependencyCheck"));
     476  
     
    -  477  8
             formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
    +  477  2
             formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
     478  
                     helpMsg,
     479   @@ -881,7 +881,7 @@
                     true);
     482  
     
    -  483  8
         }
    +  483  2
         }
     484  
     
     485   @@ -896,7 +896,7 @@
          */
     490  
         public String[] getScanFiles() {
    -  491  12
             return line.getOptionValues(ARGUMENT.SCAN);
    +  491  3
             return line.getOptionValues(ARGUMENT.SCAN);
     492  
         }
     493   @@ -913,7 +913,7 @@
          */
     499  
         public String getReportDirectory() {
    -  500  4
             return line.getOptionValue(ARGUMENT.OUT, ".");
    +  500  1
             return line.getOptionValue(ARGUMENT.OUT, ".");
     501  
         }
     502   @@ -930,7 +930,7 @@
          */
     508  
         public String getPathToMono() {
    -  509  4
             return line.getOptionValue(ARGUMENT.PATH_TO_MONO);
    +  509  1
             return line.getOptionValue(ARGUMENT.PATH_TO_MONO);
     510  
         }
     511   @@ -1152,13 +1152,13 @@
          */
     629  
         public void printVersionInfo() {
    -  630  4
             final String version = String.format("%s version %s",
    +  630  1
             final String version = String.format("%s version %s",
     631  
                     Settings.getString("application.name", "DependencyCheck"),
     632  
                     Settings.getString("application.version", "Unknown"));
    -  633  4
             System.out.println(version);
    -  634  4
         }
    +  633  1
             System.out.println(version);
    +  634  1
         }
     635  
     
     636   @@ -1648,6 +1648,6 @@
     }
    - + diff --git a/dependency-check-cli/dependency-updates-report.html b/dependency-check-cli/dependency-updates-report.html index 7645f6928..99446370f 100644 --- a/dependency-check-cli/dependency-updates-report.html +++ b/dependency-check-cli/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -301,7 +301,7 @@ org.owasp dependency-check-core -1.2.4 +1.2.5 compile jar @@ -313,7 +313,7 @@ org.owasp dependency-check-utils -1.2.4 +1.2.5 compile jar @@ -401,7 +401,7 @@ dependency-check-core Current Version -1.2.4 +1.2.5 Scope compile @@ -425,7 +425,7 @@ dependency-check-utils Current Version -1.2.4 +1.2.5 Scope compile diff --git a/dependency-check-cli/findbugs.html b/dependency-check-cli/findbugs.html index 2b4ab1a22..18d806311 100644 --- a/dependency-check-cli/findbugs.html +++ b/dependency-check-cli/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-cli - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/index.html b/dependency-check-cli/index.html index 9a43e7864..71db634c5 100644 --- a/dependency-check-cli/index.html +++ b/dependency-check-cli/index.html @@ -1,13 +1,13 @@ - + dependency-check-cli - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/installation.html b/dependency-check-cli/installation.html index 61df9abd2..61835d3de 100644 --- a/dependency-check-cli/installation.html +++ b/dependency-check-cli/installation.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Installation & Usage @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -153,7 +153,7 @@

    Installation & Usage

    -

    Download the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:

    +

    Download the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:

    $ chmod +777 dependency-check.sh
    diff --git a/dependency-check-cli/license.html b/dependency-check-cli/license.html
    index 5819af968..f630f70db 100644
    --- a/dependency-check-cli/license.html
    +++ b/dependency-check-cli/license.html
    @@ -1,13 +1,13 @@
     
     
     
       
         
         
    -    
    +    
         
         dependency-check-cli - Project License
         
    @@ -54,7 +54,7 @@
                     
                         
                                   
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/plugin-updates-report.html b/dependency-check-cli/plugin-updates-report.html index a78ae13f0..f2b76ddc9 100644 --- a/dependency-check-cli/plugin-updates-report.html +++ b/dependency-check-cli/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/pmd.html b/dependency-check-cli/pmd.html index 48b70106d..f4a786dd6 100644 --- a/dependency-check-cli/pmd.html +++ b/dependency-check-cli/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-cli - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -244,31 +244,31 @@ Line Useless parentheses. -362 +362 Useless parentheses. -371 +371 Useless parentheses. -380 +380 Useless parentheses. -389 +389 Useless parentheses. -398 +398 Useless parentheses. -407 +407 Useless parentheses. -416 +416 Useless parentheses. -425 +425 Useless parentheses. -643
    +643 diff --git a/dependency-check-cli/project-info.html b/dependency-check-cli/project-info.html index 6767f2170..ba45121ee 100644 --- a/dependency-check-cli/project-info.html +++ b/dependency-check-cli/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/project-reports.html b/dependency-check-cli/project-reports.html index f63ce0c1a..b8ebbf00e 100644 --- a/dependency-check-cli/project-reports.html +++ b/dependency-check-cli/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/project-summary.html b/dependency-check-cli/project-summary.html index 1f6f01aec..4504685fa 100644 --- a/dependency-check-cli/project-summary.html +++ b/dependency-check-cli/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -218,7 +218,7 @@ dependency-check-cli Version -1.2.4 +1.2.5 Type jar diff --git a/dependency-check-cli/surefire-report.html b/dependency-check-cli/surefire-report.html index ead851bdd..97d93e5bd 100644 --- a/dependency-check-cli/surefire-report.html +++ b/dependency-check-cli/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -267,7 +267,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.025
    +0.039

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -288,7 +288,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.025
    +0.039

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.cli

    @@ -310,7 +310,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.025

    +0.039

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -320,11 +320,11 @@ function toggleDisplay(elementId) { testParse_printHelp -0.021 +0.035 testParse_printVersionInfo -0 +0.001 testParse_help @@ -332,7 +332,7 @@ function toggleDisplay(elementId) { testParse_scan -0.001 +0 testParse diff --git a/dependency-check-cli/taglist.html b/dependency-check-cli/taglist.html index a8d8a8f2e..4481408e0 100644 --- a/dependency-check-cli/taglist.html +++ b/dependency-check-cli/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-cli/xref-test/index.html b/dependency-check-cli/xref-test/index.html index 08e00b03e..feef62db6 100644 --- a/dependency-check-cli/xref-test/index.html +++ b/dependency-check-cli/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Command Line 1.2.4 Reference + Dependency-Check Command Line 1.2.5 Reference diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html index 63e23fbb3..978333267 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.5 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html index 15b9f7490..cfb7988e6 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.5 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref-test/overview-frame.html b/dependency-check-cli/xref-test/overview-frame.html index 5ff69a4af..f8a689db2 100644 --- a/dependency-check-cli/xref-test/overview-frame.html +++ b/dependency-check-cli/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference + Dependency-Check Command Line 1.2.5 Reference diff --git a/dependency-check-cli/xref-test/overview-summary.html b/dependency-check-cli/xref-test/overview-summary.html index d6431bf56..2e8ffe6b8 100644 --- a/dependency-check-cli/xref-test/overview-summary.html +++ b/dependency-check-cli/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference + Dependency-Check Command Line 1.2.5 Reference @@ -24,7 +24,7 @@
    -

    Dependency-Check Command Line 1.2.4 Reference

    +

    Dependency-Check Command Line 1.2.5 Reference

    diff --git a/dependency-check-cli/xref/index.html b/dependency-check-cli/xref/index.html index 08e00b03e..feef62db6 100644 --- a/dependency-check-cli/xref/index.html +++ b/dependency-check-cli/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Command Line 1.2.4 Reference + Dependency-Check Command Line 1.2.5 Reference diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html index 988902919..0ee9c1a0b 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.5 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html index 8615597c5..f7c867882 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.5 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html b/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html index 829e0eec1..76311c3c0 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference Package org.owasp.dependencycheck + Dependency-Check Command Line 1.2.5 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html b/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html index 3dee0d1f7..385084ac6 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference Package org.owasp.dependencycheck + Dependency-Check Command Line 1.2.5 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-cli/xref/overview-frame.html b/dependency-check-cli/xref/overview-frame.html index 3885005a9..a544002d5 100644 --- a/dependency-check-cli/xref/overview-frame.html +++ b/dependency-check-cli/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference + Dependency-Check Command Line 1.2.5 Reference diff --git a/dependency-check-cli/xref/overview-summary.html b/dependency-check-cli/xref/overview-summary.html index 07009fdea..6d21377af 100644 --- a/dependency-check-cli/xref/overview-summary.html +++ b/dependency-check-cli/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.2.4 Reference + Dependency-Check Command Line 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Command Line 1.2.4 Reference

    +

    Dependency-Check Command Line 1.2.5 Reference

    diff --git a/dependency-check-core/apidocs/allclasses-frame.html b/dependency-check-core/apidocs/allclasses-frame.html index fccba44fc..276b8e0dc 100644 --- a/dependency-check-core/apidocs/allclasses-frame.html +++ b/dependency-check-core/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Core 1.2.4 API) - +All Classes (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/allclasses-noframe.html b/dependency-check-core/apidocs/allclasses-noframe.html index 68586ffa6..e5659028f 100644 --- a/dependency-check-core/apidocs/allclasses-noframe.html +++ b/dependency-check-core/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Core 1.2.4 API) - +All Classes (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/constant-values.html b/dependency-check-core/apidocs/constant-values.html index 7692d1376..8bededd12 100644 --- a/dependency-check-core/apidocs/constant-values.html +++ b/dependency-check-core/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Core 1.2.4 API) - +Constant Field Values (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/deprecated-list.html b/dependency-check-core/apidocs/deprecated-list.html index ad881368a..97644d71a 100644 --- a/dependency-check-core/apidocs/deprecated-list.html +++ b/dependency-check-core/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Core 1.2.4 API) - +Deprecated List (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/help-doc.html b/dependency-check-core/apidocs/help-doc.html index e98612ed9..f0207665a 100644 --- a/dependency-check-core/apidocs/help-doc.html +++ b/dependency-check-core/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Core 1.2.4 API) - +API Help (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/index-all.html b/dependency-check-core/apidocs/index-all.html index 9a4a3842e..02f0cdd41 100644 --- a/dependency-check-core/apidocs/index-all.html +++ b/dependency-check-core/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Core 1.2.4 API) - +Index (Dependency-Check Core 1.2.5 API) + @@ -3711,6 +3711,10 @@
    Get the value of autoUpdate.
    +
    isBase() - Method in class org.owasp.dependencycheck.suppression.SuppressionRule
    +
    +
    Get the value of base
    +
    isCaseSensitive() - Method in class org.owasp.dependencycheck.suppression.PropertyType
    Gets the value of the caseSensitive property.
    @@ -5235,6 +5239,10 @@
    Set the value of autoUpdate.
    +
    setBase(boolean) - Method in class org.owasp.dependencycheck.suppression.SuppressionRule
    +
    +
    Set the value of base
    +
    setBuild(Build) - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Model
    Sets the value of the build property.
    diff --git a/dependency-check-core/apidocs/index.html b/dependency-check-core/apidocs/index.html index 302f55d4c..862e97dbe 100644 --- a/dependency-check-core/apidocs/index.html +++ b/dependency-check-core/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Core 1.2.4 API +Dependency-Check Core 1.2.5 API @@ -95,15 +95,21 @@
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html index e200ba7f1..0ff0d1ce1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html @@ -2,16 +2,16 @@ - + -DependencyCheckScanAgent (Dependency-Check Core 1.2.4 API) - +DependencyCheckScanAgent (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html index 7080bf5d0..d2661e662 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.agent.DependencyCheckScanAgent (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.agent.DependencyCheckScanAgent (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html index 9e7533640..cbcde3586 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html index c85eded60..ad596d20a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html index 062725279..93ec2398b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.agent Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.agent Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html index 0134c9963..9ab16fb17 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html index 67dccd898..500338bbd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractAnalyzer (Dependency-Check Core 1.2.4 API) - +AbstractAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html index 93c2241f9..545983e73 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractFileTypeAnalyzer (Dependency-Check Core 1.2.4 API) - +AbstractFileTypeAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html index 0ef8c6f8e..343009a84 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractSuppressionAnalyzer (Dependency-Check Core 1.2.4 API) - +AbstractSuppressionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html index 971fc466e..55048a9c4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html @@ -2,16 +2,16 @@ - + -AnalysisPhase (Dependency-Check Core 1.2.4 API) - +AnalysisPhase (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html index 4f6c22b90..69b0937cc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html @@ -2,16 +2,16 @@ - + -Analyzer (Dependency-Check Core 1.2.4 API) - +Analyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html index b9e725368..681be199b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html @@ -2,16 +2,16 @@ - + -AnalyzerService (Dependency-Check Core 1.2.4 API) - +AnalyzerService (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html index f07f65a34..adf38fe04 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html @@ -2,16 +2,16 @@ - + -ArchiveAnalyzer (Dependency-Check Core 1.2.4 API) - +ArchiveAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html index 7f0ddf805..6f97f21fc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html @@ -2,16 +2,16 @@ - + -AssemblyAnalyzer (Dependency-Check Core 1.2.4 API) - +AssemblyAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html index 40e510d4c..6ff678dba 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html @@ -2,16 +2,16 @@ - + -CPEAnalyzer (Dependency-Check Core 1.2.4 API) - +CPEAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html index d5dcb5af5..b1182d3cf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -CpeSuppressionAnalyzer (Dependency-Check Core 1.2.4 API) - +CpeSuppressionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html index 1090f3a02..7053da506 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html @@ -2,16 +2,16 @@ - + -DependencyBundlingAnalyzer (Dependency-Check Core 1.2.4 API) - +DependencyBundlingAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html index 93fa2a565..faaeb2f55 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html @@ -2,16 +2,16 @@ - + -FalsePositiveAnalyzer (Dependency-Check Core 1.2.4 API) - +FalsePositiveAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html index 13b612302..9b5e0e390 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html @@ -2,16 +2,16 @@ - + -FileNameAnalyzer (Dependency-Check Core 1.2.4 API) - +FileNameAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.html index 59ac85568..8b41b460e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.html @@ -2,16 +2,16 @@ - + -FileTypeAnalyzer (Dependency-Check Core 1.2.4 API) - +FileTypeAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html index 67b19f6ef..f7a4db27f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html @@ -2,16 +2,16 @@ - + -HintAnalyzer (Dependency-Check Core 1.2.4 API) - +HintAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html index 8289589d9..23281d98b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html @@ -2,16 +2,16 @@ - + -JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.2.4 API) - +JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html index 3ce7a3d7a..2500e5c16 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html @@ -2,16 +2,16 @@ - + -JarAnalyzer (Dependency-Check Core 1.2.4 API) - +JarAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html index ecbb981ef..ae688a3e8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html @@ -2,16 +2,16 @@ - + -JavaScriptAnalyzer (Dependency-Check Core 1.2.4 API) - +JavaScriptAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html index c803b6658..95a600a4d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html @@ -2,16 +2,16 @@ - + -NexusAnalyzer (Dependency-Check Core 1.2.4 API) - +NexusAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.html index 4a0b6bf7e..19a56cede 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.html @@ -2,16 +2,16 @@ - + -NuspecAnalyzer (Dependency-Check Core 1.2.4 API) - +NuspecAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html index a54eb2ec9..dc75b0311 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html @@ -2,16 +2,16 @@ - + -NvdCveAnalyzer (Dependency-Check Core 1.2.4 API) - +NvdCveAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html index c66387912..40d9c690d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.2.4 API) - +VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html index 577090eb3..355b6aa41 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AbstractAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AbstractAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractFileTypeAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractFileTypeAnalyzer.html index 39dfd1745..eec40b488 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractFileTypeAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractFileTypeAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html index 74873abc1..821f196cd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html index c103f574e..8479498ff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AnalysisPhase (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AnalysisPhase (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html index 8e8e9b837..fa25ac1c1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html @@ -2,16 +2,16 @@ - + -Uses of Interface org.owasp.dependencycheck.analyzer.Analyzer (Dependency-Check Core 1.2.4 API) - +Uses of Interface org.owasp.dependencycheck.analyzer.Analyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html index e6d148bd6..184faba72 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AnalyzerService (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AnalyzerService (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html index 6aff80706..10e9a4741 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AssemblyAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AssemblyAnalyzer.html index ffc84b9f9..f53d7c103 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AssemblyAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AssemblyAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AssemblyAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AssemblyAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html index 12d99e16e..2636f48dc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.CPEAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.CPEAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html index 49da1a78a..d14ed22b0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html index c8512e40e..3d123a1c0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html index ecf7ac234..b7e9481b2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html index 0dd510d7c..09a03730b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.FileNameAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.FileNameAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileTypeAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileTypeAnalyzer.html index 7c6c711f8..15e37ed98 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileTypeAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileTypeAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Interface org.owasp.dependencycheck.analyzer.FileTypeAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Interface org.owasp.dependencycheck.analyzer.FileTypeAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html index 51ba472d7..5fc20c004 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.HintAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.HintAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html index 78eb3e6da..7869ff48c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html index 7ca5287d8..c97fd32da 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html index 167944589..f81f1fea8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html index 3826224df..05055168f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.NexusAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.NexusAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NuspecAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NuspecAnalyzer.html index 7c7a89b1c..b4b11c0c7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NuspecAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NuspecAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.NuspecAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.NuspecAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html index cdc3b48c4..ca97a8247 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.NvdCveAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.NvdCveAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html index 207248ef4..275e6f22a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/AnalysisException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/AnalysisException.html index 95f768f64..18c11930b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/AnalysisException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/AnalysisException.html @@ -2,16 +2,16 @@ - + -AnalysisException (Dependency-Check Core 1.2.4 API) - +AnalysisException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.html index 3e8f54fbc..7625d5d1a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.html @@ -2,16 +2,16 @@ - + -ArchiveExtractionException (Dependency-Check Core 1.2.4 API) - +ArchiveExtractionException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/AnalysisException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/AnalysisException.html index 000631986..e1c942347 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/AnalysisException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/AnalysisException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.exception.AnalysisException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.exception.AnalysisException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/ArchiveExtractionException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/ArchiveExtractionException.html index 98455a789..73bfd8e75 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/ArchiveExtractionException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/class-use/ArchiveExtractionException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-frame.html index d48f5dc82..81479b08d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.analyzer.exception (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.analyzer.exception (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-summary.html index d89efb383..19707f0da 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.analyzer.exception (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.analyzer.exception (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-tree.html index f248ccdb3..3611f006d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.analyzer.exception Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.analyzer.exception Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-use.html index a17815958..e7f8b65a0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/exception/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.analyzer.exception (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.analyzer.exception (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html index 9fdf07a4a..ad5780677 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html index 3eba1bbe7..a1cafa18b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html index 807a28da8..90a0f33ff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.analyzer Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.analyzer Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html index 35f57b348..32606be41 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html index c84d5b970..fa0130b1c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.Engine (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.Engine (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html index 2358f59fd..abed0ba30 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html @@ -2,16 +2,16 @@ - + -CpeMemoryIndex (Dependency-Check Core 1.2.4 API) - +CpeMemoryIndex (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html index 6a3083521..e70457489 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html @@ -2,16 +2,16 @@ - + -Fields (Dependency-Check Core 1.2.4 API) - +Fields (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html index 92ee9f6da..511f60d8d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html @@ -2,16 +2,16 @@ - + -IndexEntry (Dependency-Check Core 1.2.4 API) - +IndexEntry (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html index 654560519..cba1cb554 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html @@ -2,16 +2,16 @@ - + -IndexException (Dependency-Check Core 1.2.4 API) - +IndexException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html index de1be2ff2..04a3d4890 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html index 99e1846f1..21e4decde 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.Fields (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.Fields (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html index c4f2eddbf..55ef4d3fc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.IndexEntry (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.IndexEntry (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html index ee8f40edc..caf267842 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.IndexException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.IndexException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html index 44ebe5f75..e0ccecc72 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html index c5eac7fe0..9a3770881 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html index 09fb0aad0..4dd9a05b8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cpe Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.cpe Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html index 25f438691..af2c4caa4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html index 073c34b1d..4c0332396 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html @@ -2,16 +2,16 @@ - + -CweDB (Dependency-Check Core 1.2.4 API) - +CweDB (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html index 49b0235e5..38dac8229 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html @@ -2,16 +2,16 @@ - + -CweHandler (Dependency-Check Core 1.2.4 API) - +CweHandler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html index 7d2769e94..b1321b96c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cwe.CweDB (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.cwe.CweDB (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html index c3c8c83f5..e569ef700 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cwe.CweHandler (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.cwe.CweHandler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html index 60234bf05..29d9b9fb6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html index cd4968161..66e82edc5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html index f1c2d4fb3..8afe31b5f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cwe Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.cwe Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html index 7607f8226..313a4c0f5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html index a6d18a1a4..22447ed86 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html @@ -2,16 +2,16 @@ - + -AbstractTokenizingFilter (Dependency-Check Core 1.2.4 API) - +AbstractTokenizingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html index 30c786fc5..0e270894c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html @@ -2,16 +2,16 @@ - + -AlphaNumericTokenizer (Dependency-Check Core 1.2.4 API) - +AlphaNumericTokenizer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html index 04f45949c..b01efb854 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html @@ -2,16 +2,16 @@ - + -DependencySimilarity (Dependency-Check Core 1.2.4 API) - +DependencySimilarity (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html index da67f9cf5..c83047df5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html @@ -2,16 +2,16 @@ - + -FieldAnalyzer (Dependency-Check Core 1.2.4 API) - +FieldAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html index 81b191bd9..6421a7085 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html @@ -2,16 +2,16 @@ - + -LuceneUtils (Dependency-Check Core 1.2.4 API) - +LuceneUtils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html index e4e6dd258..888b14472 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html @@ -2,16 +2,16 @@ - + -SearchFieldAnalyzer (Dependency-Check Core 1.2.4 API) - +SearchFieldAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html index 05d6ab724..233722c94 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html @@ -2,16 +2,16 @@ - + -SearchVersionAnalyzer (Dependency-Check Core 1.2.4 API) - +SearchVersionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html index 1e179a550..4d563fa65 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html @@ -2,16 +2,16 @@ - + -TokenPairConcatenatingFilter (Dependency-Check Core 1.2.4 API) - +TokenPairConcatenatingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html index c8c5d2334..474af4e55 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html @@ -2,16 +2,16 @@ - + -UrlTokenizingFilter (Dependency-Check Core 1.2.4 API) - +UrlTokenizingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html index aae6ee212..54d07d3cf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html @@ -2,16 +2,16 @@ - + -VersionAnalyzer (Dependency-Check Core 1.2.4 API) - +VersionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html index a39f7d5a2..0a0d55f1a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html @@ -2,16 +2,16 @@ - + -VersionTokenizingFilter (Dependency-Check Core 1.2.4 API) - +VersionTokenizingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html index 09f73d7cd..117225cf2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html index f0b026fd9..b19000f62 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html index 6c69a7777..8eae7c916 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.DependencySimilarity (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.DependencySimilarity (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html index eb4714c03..71cd399eb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.FieldAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.FieldAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html index b9808a03c..e7f129c41 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.LuceneUtils (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.LuceneUtils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html index f641de808..281f819ff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html index 5830a171b..43e703056 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html index ce7750f2a..9726a9d1f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html index d8cc025f4..dc2f9d83a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html index 84c0eee5e..3eca3a0d6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.VersionAnalyzer (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.VersionAnalyzer (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html index d4528487a..a30f6e5bc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html index 8da2394a4..ccb32917a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html index 61545bbd1..57cb2ecff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html index b8f89350b..c062e02e2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.lucene Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.lucene Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html index a2e255cbc..df65fa161 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html index 11508297d..7b84e76e6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html @@ -2,16 +2,16 @@ - + -MavenArtifact (Dependency-Check Core 1.2.4 API) - +MavenArtifact (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html index 7a78fecdf..35dc77cde 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html @@ -2,16 +2,16 @@ - + -NexusSearch (Dependency-Check Core 1.2.4 API) - +NexusSearch (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html index 287201249..7fe9e66bd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nexus.MavenArtifact (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nexus.MavenArtifact (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html index d5fe15ce3..504581f74 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nexus.NexusSearch (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nexus.NexusSearch (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html index 5f2f477e0..3f30a3246 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html index 3c7c1a55a..7a7e1cf7f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html index 23a3288b1..d8e4d47e1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nexus Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nexus Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html index 49054637c..9c765f94d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NugetPackage.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NugetPackage.html index 6c5bc5daf..0895d1f4a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NugetPackage.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NugetPackage.html @@ -2,16 +2,16 @@ - + -NugetPackage (Dependency-Check Core 1.2.4 API) - +NugetPackage (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParseException.html index 4f125789f..c47323541 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParseException.html @@ -2,16 +2,16 @@ - + -NuspecParseException (Dependency-Check Core 1.2.4 API) - +NuspecParseException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParser.html index 20625c58b..986a1cd85 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/NuspecParser.html @@ -2,16 +2,16 @@ - + -NuspecParser (Dependency-Check Core 1.2.4 API) - +NuspecParser (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.html index 117444160..b86d4a114 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.html @@ -2,16 +2,16 @@ - + -XPathNuspecParser (Dependency-Check Core 1.2.4 API) - +XPathNuspecParser (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NugetPackage.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NugetPackage.html index 52966919a..c76f6e74c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NugetPackage.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NugetPackage.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nuget.NugetPackage (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nuget.NugetPackage (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParseException.html index 578b1f88e..db8c24109 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParseException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nuget.NuspecParseException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nuget.NuspecParseException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParser.html index 49b067689..c1811ed5f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/NuspecParser.html @@ -2,16 +2,16 @@ - + -Uses of Interface org.owasp.dependencycheck.data.nuget.NuspecParser (Dependency-Check Core 1.2.4 API) - +Uses of Interface org.owasp.dependencycheck.data.nuget.NuspecParser (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/XPathNuspecParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/XPathNuspecParser.html index 86a5da3d2..eca059034 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/XPathNuspecParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/class-use/XPathNuspecParser.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nuget.XPathNuspecParser (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nuget.XPathNuspecParser (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-frame.html index 8a28d6098..cf93d26d8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.nuget (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nuget (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-summary.html index 2bd486d5f..8897784d0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nuget (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nuget (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-tree.html index f518f861c..a5dc003be 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nuget Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nuget Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-use.html index c16f06889..e04c2fa2c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nuget/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.nuget (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.nuget (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html index 56de88c04..2a094d647 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html @@ -2,16 +2,16 @@ - + -ConnectionFactory (Dependency-Check Core 1.2.4 API) - +ConnectionFactory (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html index cc8bd58a8..b805325b4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html @@ -2,16 +2,16 @@ - + -CveDB (Dependency-Check Core 1.2.4 API) - +CveDB (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html index b317985ec..e8918a6cb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html @@ -2,16 +2,16 @@ - + -DatabaseException (Dependency-Check Core 1.2.4 API) - +DatabaseException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html index 3942e83c0..ab0ee3179 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html @@ -2,16 +2,16 @@ - + -DatabaseProperties (Dependency-Check Core 1.2.4 API) - +DatabaseProperties (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html index 703913c38..842ab79bc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html @@ -2,16 +2,16 @@ - + -DriverLoadException (Dependency-Check Core 1.2.4 API) - +DriverLoadException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html index 5a2ca3a9b..d3c7f14ad 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html @@ -2,16 +2,16 @@ - + -DriverLoader (Dependency-Check Core 1.2.4 API) - +DriverLoader (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html index 900fdfa9d..c64b4cdb7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.ConnectionFactory (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.ConnectionFactory (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html index 58fc55101..a80ef57df 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.CveDB (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.CveDB (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html index 5d9f91aa9..02a00e0e0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html index f1bdeb280..c238af4d0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html index 2a8dc7d39..1301c0a95 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoadException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoadException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html index b18628d87..33eea532b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoader (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoader (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html index a91d8a8fe..0ecc7445b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html index ec2b006b7..78a70aedf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html index 6424a9eaf..56cd39f52 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nvdcve Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.nvdcve Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html index 735ac4cbb..abc2885ad 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html index 26aab5f4e..598306fbf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html @@ -2,16 +2,16 @@ - + -CachedWebDataSource (Dependency-Check Core 1.2.4 API) - +CachedWebDataSource (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html index 26aaac27d..ac1de7568 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html @@ -2,16 +2,16 @@ - + -NvdCveInfo (Dependency-Check Core 1.2.4 API) - +NvdCveInfo (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html index c7c6b7fdd..fee07aa3f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html @@ -2,16 +2,16 @@ - + -NvdCveUpdater (Dependency-Check Core 1.2.4 API) - +NvdCveUpdater (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html index 5622d20bf..7225c5b69 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html @@ -2,16 +2,16 @@ - + -StandardUpdate (Dependency-Check Core 1.2.4 API) - +StandardUpdate (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html index 7580e8a8a..6ea67accc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html @@ -2,16 +2,16 @@ - + -UpdateService (Dependency-Check Core 1.2.4 API) - +UpdateService (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html index cd3a52559..5135da63e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html @@ -2,16 +2,16 @@ - + -UpdateableNvdCve (Dependency-Check Core 1.2.4 API) - +UpdateableNvdCve (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html index 690ff2123..e8eb3816e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html @@ -2,16 +2,16 @@ - + -Uses of Interface org.owasp.dependencycheck.data.update.CachedWebDataSource (Dependency-Check Core 1.2.4 API) - +Uses of Interface org.owasp.dependencycheck.data.update.CachedWebDataSource (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html index 8fa5b2cda..887e11a94 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.NvdCveInfo (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.NvdCveInfo (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html index c0ae5e3a8..6ad604fa3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.NvdCveUpdater (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.NvdCveUpdater (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html index 4b464005f..381a3e971 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.StandardUpdate (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.StandardUpdate (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html index e4338109d..e820021e5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.UpdateService (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.UpdateService (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html index 8c65b671e..75940ae1d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.UpdateableNvdCve (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.UpdateableNvdCve (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html index 2021fd952..cc74eff90 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html @@ -2,16 +2,16 @@ - + -InvalidDataException (Dependency-Check Core 1.2.4 API) - +InvalidDataException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html index fe6acdfd8..065d1a2fc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html @@ -2,16 +2,16 @@ - + -UpdateException (Dependency-Check Core 1.2.4 API) - +UpdateException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html index 70c49540c..eefeded53 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.exception.InvalidDataException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.exception.InvalidDataException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html index 45c503cd2..d1c40b56c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.exception.UpdateException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.exception.UpdateException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html index e2508541e..3ccaf22d3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html index e518ed08b..df0b7159b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html index f13fec073..9ce22a803 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.exception Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.exception Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html index 37d322772..cae7d3b8b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html index 03edb88a9..3fc3db167 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html index f0d3aa7d0..8c4d6ffef 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html index 9ffefcf16..28dfa2f95 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html index 77b3626eb..00177b3be 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.update (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/DownloadTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/DownloadTask.html index 187ec942b..21973053d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/DownloadTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/DownloadTask.html @@ -2,16 +2,16 @@ - + -DownloadTask (Dependency-Check Core 1.2.4 API) - +DownloadTask (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html index 51f0f4827..86144d08e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html @@ -2,16 +2,16 @@ - + -ProcessTask (Dependency-Check Core 1.2.4 API) - +ProcessTask (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/DownloadTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/DownloadTask.html index c3286ad2d..ff824c11f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/DownloadTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/DownloadTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.task.DownloadTask (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.task.DownloadTask (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html index c9a911b13..8dbdceeac 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.task.ProcessTask (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.task.ProcessTask (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html index f1a201fda..8819c32e7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html index 61afe7635..ea977b813 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html index 9521375de..214fd1673 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.task Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.task Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html index 62e6550cf..d1caef36b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html index 1c281e130..a9be50d1b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html @@ -2,16 +2,16 @@ - + -NvdCve12Handler.Element (Dependency-Check Core 1.2.4 API) - +NvdCve12Handler.Element (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html index 545b87a6a..4f9e50824 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html @@ -2,16 +2,16 @@ - + -NvdCve12Handler (Dependency-Check Core 1.2.4 API) - +NvdCve12Handler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html index f554c0dd1..8bc1d57cd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html @@ -2,16 +2,16 @@ - + -NvdCve20Handler.Element (Dependency-Check Core 1.2.4 API) - +NvdCve20Handler.Element (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html index f3d3ff601..9d28c0039 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html @@ -2,16 +2,16 @@ - + -NvdCve20Handler (Dependency-Check Core 1.2.4 API) - +NvdCve20Handler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html index 7f6ab2c4e..81300d027 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html index f280302d4..6a97070ec 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html index a04d50828..9392347d0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html index 391e84273..a8ae30f38 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html index a0e1582a3..af027848e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html index 93705fbae..275ab5ca8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html index 517852cca..419a17d68 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.xml Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.data.update.xml Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html index c09eb8562..86ba45001 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html index bcb538d24..fadd1c2f2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html @@ -2,16 +2,16 @@ - + -Confidence (Dependency-Check Core 1.2.4 API) - +Confidence (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html index 611b6c5cc..539d18635 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html @@ -2,16 +2,16 @@ - + -Dependency (Dependency-Check Core 1.2.4 API) - +Dependency (Dependency-Check Core 1.2.5 API) + @@ -97,18 +97,19 @@
  • All Implemented Interfaces:
    -
    Comparable<Dependency>
    +
    Serializable, Comparable<Dependency>


    public class Dependency
     extends Object
    -implements Comparable<Dependency>
    +implements Serializable, Comparable<Dependency>
    A program dependency. This object is one of the core components within DependencyCheck. It is used to collect information about the dependency in the form of evidence. The Evidence is then used to determine if there are any known, published, vulnerabilities associated with the program dependency.
    Author:
    -
    Jeremy Long
    +
    Jeremy Long
    +
    See Also:
    Serialized Form
  • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html index 68f56d9d7..ca0008879 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html @@ -2,16 +2,16 @@ - + -Evidence (Dependency-Check Core 1.2.4 API) - +Evidence (Dependency-Check Core 1.2.5 API) + @@ -97,16 +97,17 @@
  • All Implemented Interfaces:
    -
    Comparable<Evidence>
    +
    Serializable, Comparable<Evidence>


    public class Evidence
     extends Object
    -implements Comparable<Evidence>
    +implements Serializable, Comparable<Evidence>
    Evidence is a piece of information about a Dependency.
    Author:
    -
    Jeremy Long
    +
    Jeremy Long
    +
    See Also:
    Serialized Form
  • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html index 9be17227b..b7a39876a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html @@ -2,16 +2,16 @@ - + -EvidenceCollection (Dependency-Check Core 1.2.4 API) - +EvidenceCollection (Dependency-Check Core 1.2.5 API) + @@ -97,16 +97,17 @@
  • All Implemented Interfaces:
    -
    Iterable<Evidence>
    +
    Serializable, Iterable<Evidence>


    public class EvidenceCollection
     extends Object
    -implements Iterable<Evidence>
    +implements Serializable, Iterable<Evidence>
    Used to maintain a collection of Evidence.
    Author:
    -
    Jeremy Long
    +
    Jeremy Long
    +
    See Also:
    Serialized Form
  • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html index ec7caa0a2..5f7e70daf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html @@ -2,16 +2,16 @@ - + -Identifier (Dependency-Check Core 1.2.4 API) - +Identifier (Dependency-Check Core 1.2.5 API) + @@ -97,15 +97,16 @@
  • All Implemented Interfaces:
    -
    Comparable<Identifier>
    +
    Serializable, Comparable<Identifier>


    public class Identifier
     extends Object
    -implements Comparable<Identifier>
    +implements Serializable, Comparable<Identifier>
    Author:
    -
    Jeremy Long
    +
    Jeremy Long
    +
    See Also:
    Serialized Form
  • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html index 9a0534be9..a1a33492f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html @@ -2,16 +2,16 @@ - + -Reference (Dependency-Check Core 1.2.4 API) - +Reference (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html index 73b32bdaa..4aaad2ce6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html @@ -2,16 +2,16 @@ - + -Vulnerability (Dependency-Check Core 1.2.4 API) - +Vulnerability (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html index a77b760a8..8589784d7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html @@ -2,16 +2,16 @@ - + -VulnerabilityComparator (Dependency-Check Core 1.2.4 API) - +VulnerabilityComparator (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html index a9f2499d1..6b727049a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html @@ -2,16 +2,16 @@ - + -VulnerableSoftware (Dependency-Check Core 1.2.4 API) - +VulnerableSoftware (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html index 6ddd0d50f..7fa40ffc8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Confidence (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.Confidence (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html index f2eb9f484..23d7721a5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Dependency (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.Dependency (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html index 8c1974522..2ab6e01cb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Evidence (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.Evidence (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html index 2a2458761..abf25c838 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.EvidenceCollection (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.EvidenceCollection (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html index 2aa1a3ff0..08c7cd84c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Identifier (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.Identifier (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html index 77f3e85c3..9d64d8d8a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Reference (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.Reference (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html index 870eb1678..7bd189ffc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Vulnerability (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.Vulnerability (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html index dedda0d88..19839c0bf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.VulnerabilityComparator (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.VulnerabilityComparator (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html index 8574e241e..1d0889a7e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.VulnerableSoftware (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.dependency.VulnerableSoftware (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html index 50f34f874..47a803174 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.dependency (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.dependency (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html index 5301ea7ce..fbca7e24d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.dependency (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.dependency (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html index 2131b0d3d..fe8625ca6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.dependency Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.dependency Class Hierarchy (Dependency-Check Core 1.2.5 API) + @@ -75,10 +75,10 @@
    + + + + + + +
    booleanisBase() +
    Get the value of base
    +
    void process(Dependency dependency)
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed.
    voidsetBase(boolean base) +
    Set the value of base
    +
    void setCpe(List<PropertyType> cpe) @@ -578,6 +590,28 @@ extends Returns:
    whether or not this suppression rule as GAV entries
    +
    + + +
      +
    • +

      isBase

      +
      public boolean isBase()
      +
      Get the value of base
      +
      Returns:
      the value of base
      +
    • +
    + + + +
      +
    • +

      setBase

      +
      public void setBase(boolean base)
      +
      Set the value of base
      +
      Parameters:
      base - new value of base
      +
    • +
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html index ff15aa8b2..b55362949 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.PropertyType (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.suppression.PropertyType (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html index 9a986f219..59ef973d7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionErrorHandler (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionErrorHandler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html index 2ab593adb..6f1a017aa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionHandler (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionHandler (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html index 6168295d9..c281538fc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionParseException (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionParseException (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html index 13e13413b..2713dc630 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionParser (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionParser (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html index e7a70c5a8..d68d604b0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionRule (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionRule (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html index d77a453ea..8c6631234 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.suppression (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.suppression (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html index 56af0b439..bf8d2ef10 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.suppression (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.suppression (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html index 380a2d9d5..c5f98e6c9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.suppression Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.suppression Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html index 7c161c6bd..f4cdc2f32 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.suppression (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.suppression (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html index 8eddc93a2..b70007e99 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html @@ -2,16 +2,16 @@ - + -DBUtils (Dependency-Check Core 1.2.4 API) - +DBUtils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html index 22bcb0ed0..59ea6de24 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html @@ -2,16 +2,16 @@ - + -DependencyVersion (Dependency-Check Core 1.2.4 API) - +DependencyVersion (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html index 6e1164807..2e00cff0d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html @@ -2,16 +2,16 @@ - + -DependencyVersionUtil (Dependency-Check Core 1.2.4 API) - +DependencyVersionUtil (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionUtil.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionUtil.html index 07a16e3fb..a9b699def 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionUtil.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionUtil.html @@ -2,16 +2,16 @@ - + -ExtractionUtil (Dependency-Check Core 1.2.4 API) - +ExtractionUtil (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html index 67f8c609c..45b248a42 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html @@ -2,16 +2,16 @@ - + -Filter (Dependency-Check Core 1.2.4 API) - +Filter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html index 128cd5502..2d587dcfd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html @@ -2,16 +2,16 @@ - + -NonClosingStream (Dependency-Check Core 1.2.4 API) - +NonClosingStream (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Pair.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Pair.html index 8a25d52d8..9412ffcdb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Pair.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Pair.html @@ -2,16 +2,16 @@ - + -Pair (Dependency-Check Core 1.2.4 API) - +Pair (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html index cb6f83f0d..77d87f8f7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html @@ -2,16 +2,16 @@ - + -UrlStringUtils (Dependency-Check Core 1.2.4 API) - +UrlStringUtils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html index 4e2b1917f..33755d7aa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DBUtils (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.DBUtils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html index 1b840a8f1..41bdda5b2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DependencyVersion (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.DependencyVersion (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html index 551a85734..1bf20e2cb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DependencyVersionUtil (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.DependencyVersionUtil (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionUtil.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionUtil.html index b366f3307..e2ee800b5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionUtil.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionUtil.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.ExtractionUtil (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.ExtractionUtil (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html index d92ab97fb..bf7fa90de 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Filter (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.Filter (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html index d806d3edc..9872c15f1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.NonClosingStream (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.NonClosingStream (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Pair.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Pair.html index bca4e2d42..9500205e8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Pair.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Pair.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Pair (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.Pair (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html index 5264a7705..d1731544d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.UrlStringUtils (Dependency-Check Core 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.UrlStringUtils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html index 3abfd8d0c..a4e15420e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.utils (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.utils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html index ba1951332..d43ed6ea8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.utils (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.utils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html index e8e32d182..cd525f6be 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.utils Class Hierarchy (Dependency-Check Core 1.2.4 API) - +org.owasp.dependencycheck.utils Class Hierarchy (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html index 250e9ee2d..32e8338f2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.utils (Dependency-Check Core 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.utils (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/overview-frame.html b/dependency-check-core/apidocs/overview-frame.html index 4e093e5f6..f720b0a4e 100644 --- a/dependency-check-core/apidocs/overview-frame.html +++ b/dependency-check-core/apidocs/overview-frame.html @@ -2,10 +2,10 @@ - + -Overview List (Dependency-Check Core 1.2.4 API) - +Overview List (Dependency-Check Core 1.2.5 API) + diff --git a/dependency-check-core/apidocs/overview-summary.html b/dependency-check-core/apidocs/overview-summary.html index b302b4ea3..46ec61e36 100644 --- a/dependency-check-core/apidocs/overview-summary.html +++ b/dependency-check-core/apidocs/overview-summary.html @@ -2,16 +2,16 @@ - + -Overview (Dependency-Check Core 1.2.4 API) - +Overview (Dependency-Check Core 1.2.5 API) + @@ -64,7 +64,7 @@
    -

    Dependency-Check Core 1.2.4 API

    +

    Dependency-Check Core 1.2.5 API

    diff --git a/dependency-check-core/apidocs/overview-tree.html b/dependency-check-core/apidocs/overview-tree.html index ea610e4a0..85461b5bf 100644 --- a/dependency-check-core/apidocs/overview-tree.html +++ b/dependency-check-core/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Core 1.2.4 API) - +Class Hierarchy (Dependency-Check Core 1.2.5 API) + @@ -191,7 +191,7 @@
  • org.owasp.dependencycheck.suppression.SuppressionHandler
  • -
  • org.owasp.dependencycheck.dependency.Dependency (implements java.lang.Comparable<T>)
  • +
  • org.owasp.dependencycheck.dependency.Dependency (implements java.lang.Comparable<T>, java.io.Serializable)
  • org.owasp.dependencycheck.jaxb.pom.generated.Dependency
  • org.owasp.dependencycheck.jaxb.pom.generated.Dependency.Exclusions
  • org.owasp.dependencycheck.agent.DependencyCheckScanAgent
  • @@ -206,16 +206,16 @@
  • org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement
  • org.owasp.dependencycheck.data.update.task.DownloadTask (implements java.util.concurrent.Callable<V>)
  • org.owasp.dependencycheck.data.nvdcve.DriverLoader
  • -
  • org.owasp.dependencycheck.Engine
  • +
  • org.owasp.dependencycheck.Engine (implements java.io.Serializable)
  • org.owasp.dependencycheck.reporting.EscapeTool
  • -
  • org.owasp.dependencycheck.dependency.Evidence (implements java.lang.Comparable<T>)
  • -
  • org.owasp.dependencycheck.dependency.EvidenceCollection (implements java.lang.Iterable<T>)
  • +
  • org.owasp.dependencycheck.dependency.Evidence (implements java.lang.Comparable<T>, java.io.Serializable)
  • +
  • org.owasp.dependencycheck.dependency.EvidenceCollection (implements java.lang.Iterable<T>, java.io.Serializable)
  • org.owasp.dependencycheck.jaxb.pom.generated.Exclusion
  • org.owasp.dependencycheck.jaxb.pom.generated.Extension
  • org.owasp.dependencycheck.utils.ExtractionUtil
  • org.owasp.dependencycheck.data.cpe.Fields
  • org.owasp.dependencycheck.utils.Filter<T>
  • -
  • org.owasp.dependencycheck.dependency.Identifier (implements java.lang.Comparable<T>)
  • +
  • org.owasp.dependencycheck.dependency.Identifier (implements java.lang.Comparable<T>, java.io.Serializable)
  • org.owasp.dependencycheck.data.cpe.IndexEntry (implements java.io.Serializable)
    • org.owasp.dependencycheck.dependency.VulnerableSoftware (implements java.lang.Comparable<T>, java.io.Serializable)
    • diff --git a/dependency-check-core/apidocs/serialized-form.html b/dependency-check-core/apidocs/serialized-form.html index 0c42b3d55..61ed0a2c6 100644 --- a/dependency-check-core/apidocs/serialized-form.html +++ b/dependency-check-core/apidocs/serialized-form.html @@ -2,16 +2,16 @@ - + -Serialized Form (Dependency-Check Core 1.2.4 API) - +Serialized Form (Dependency-Check Core 1.2.5 API) + @@ -69,6 +69,30 @@
      • +

        Package org.owasp.dependencycheck

        + +
      • +
      • Package org.owasp.dependencycheck.analyzer.exception

        • @@ -206,6 +230,207 @@
        • Package org.owasp.dependencycheck.dependency

            +
          • + + +

            Class org.owasp.dependencycheck.dependency.Dependency extends Object implements Serializable

            +
              +
            • + + +

              Serialized Fields

              +
                +
              • +

                actualFilePath

                +
                String actualFilePath
                +
                The actual file path of the dependency on disk.
                +
              • +
              • +

                filePath

                +
                String filePath
                +
                The file path to display.
                +
              • +
              • +

                fileName

                +
                String fileName
                +
                The file name of the dependency.
                +
              • +
              • +

                fileExtension

                +
                String fileExtension
                +
                The file extension of the dependency.
                +
              • +
              • +

                md5sum

                +
                String md5sum
                +
                The md5 hash of the dependency.
                +
              • +
              • +

                sha1sum

                +
                String sha1sum
                +
                The SHA1 hash of the dependency.
                +
              • +
              • +

                identifiers

                +
                Set<E> identifiers
                +
                A list of Identifiers.
                +
              • +
              • +

                vendorEvidence

                +
                EvidenceCollection vendorEvidence
                +
                A collection of vendor evidence.
                +
              • +
              • +

                productEvidence

                +
                EvidenceCollection productEvidence
                +
                A collection of product evidence.
                +
              • +
              • +

                versionEvidence

                +
                EvidenceCollection versionEvidence
                +
                A collection of version evidence.
                +
              • +
              • +

                displayName

                +
                String displayName
                +
                The file name to display in reports.
                +
              • +
              • +

                suppressedIdentifiers

                +
                Set<E> suppressedIdentifiers
                +
                A set of identifiers that have been suppressed.
                +
              • +
              • +

                suppressedVulnerabilities

                +
                SortedSet<E> suppressedVulnerabilities
                +
                A set of vulnerabilities that have been suppressed.
                +
              • +
              • +

                description

                +
                String description
                +
                The description of the JAR file.
                +
              • +
              • +

                license

                +
                String license
                +
                The license that this dependency uses.
                +
              • +
              • +

                vulnerabilities

                +
                SortedSet<E> vulnerabilities
                +
                A list of vulnerabilities for this dependency.
                +
              • +
              • +

                relatedDependencies

                +
                Set<E> relatedDependencies
                +
                A collection of related dependencies.
                +
              • +
              +
            • +
            +
          • +
          • + + +

            Class org.owasp.dependencycheck.dependency.Evidence extends Object implements Serializable

            +
              +
            • + + +

              Serialized Fields

              +
                +
              • +

                name

                +
                String name
                +
                The name of the evidence.
                +
              • +
              • +

                source

                +
                String source
                +
                The source of the evidence.
                +
              • +
              • +

                value

                +
                String value
                +
                The value of the evidence.
                +
              • +
              • +

                used

                +
                boolean used
                +
                A value indicating if the Evidence has been "used" (aka read).
                +
              • +
              • +

                confidence

                +
                Confidence confidence
                +
                The confidence level for the evidence.
                +
              • +
              +
            • +
            +
          • +
          • + + +

            Class org.owasp.dependencycheck.dependency.EvidenceCollection extends Object implements Serializable

            +
              +
            • + + +

              Serialized Fields

              +
                +
              • +

                list

                +
                Set<E> list
                +
                A collection of evidence.
                +
              • +
              • +

                weightedStrings

                +
                Set<E> weightedStrings
                +
                A collection of strings used to adjust Lucene's term weighting.
                +
              • +
              +
            • +
            +
          • +
          • + + +

            Class org.owasp.dependencycheck.dependency.Identifier extends Object implements Serializable

            +
              +
            • + + +

              Serialized Fields

              +
                +
              • +

                confidence

                +
                Confidence confidence
                +
                The confidence that this is the correct identifier.
                +
              • +
              • +

                value

                +
                String value
                +
                The value of the identifier
                +
              • +
              • +

                url

                +
                String url
                +
                The url for the identifier.
                +
              • +
              • +

                type

                +
                String type
                +
                The type of the identifier.
                +
              • +
              • +

                description

                +
                String description
                +
                A description of the identifier.
                +
              • +
              +
            • +
            +
          • diff --git a/dependency-check-core/checkstyle.html b/dependency-check-core/checkstyle.html index 49e70b362..7087d757e 100644 --- a/dependency-check-core/checkstyle.html +++ b/dependency-check-core/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-core - Checkstyle Results @@ -54,7 +54,7 @@
          • - + /
          • @@ -67,9 +67,9 @@ -
          • | Last Published: 2014-08-05
          • +
          • | Last Published: 2014-09-16
          • - Version: 1.2.4 + Version: 1.2.5
          @@ -249,10 +249,10 @@
  • - + -
    Warnings Warnings Errors Errors
    202183 0 06
    +
    20

    Files

    @@ -262,55 +262,114 @@ + + + + + - + + + + + + + + + + + - + -
    Warnings Errors
    org/owasp/dependencycheck/Engine.java003
    org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java 0 0 1
    org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java 0 0 2
    org/owasp/dependencycheck/analyzer/CPEAnalyzer.java002
    org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java004
    org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java 0 0 2
    org/owasp/dependencycheck/dependency/Dependency.java 0 01
    +1 + +org/owasp/dependencycheck/suppression/SuppressionRule.java +0 +0 +3 + +org/owasp/dependencycheck/utils/DependencyVersion.java +0 +0 +2

    Details

    -

    org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java

    +

    org/owasp/dependencycheck/Engine.java

    - + + + + + + + + + + +
    Violation Message Line
    Errors'final' modifier out of order with the JLS suggestions.65
    Errors'final' modifier out of order with the JLS suggestions.69
    Errors'static' modifier out of order with the JLS suggestions.77
    +
    +

    org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java

    + + + + + + +
    ViolationMessageLine
    Errors Total number of methods is 66 (max allowed is 40). 60

    org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

    + + + + + + + + + + + +
    ViolationMessageLine
    ErrorsInner assignments should be avoided.123
    ErrorsMust have at least one statement.236
    +
    +

    org/owasp/dependencycheck/analyzer/CPEAnalyzer.java

    + - - + + - -
    Violation Message Line
    ErrorsInner assignments should be avoided.123
    Line is longer than 150 characters (found 162).495
    ErrorsMust have at least one statement.236
    +Expected @param tag for 'currentConfidence'. +495
    -

    org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

    +

    org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java

    @@ -318,23 +377,80 @@ + + + + + + + + + + + + + +
    ViolationLine
    ErrorsMissing a Javadoc comment.96
    ErrorsVariable 'endPoint' should be declared final.101
    ErrorsVariable 'itr' should be declared final.110
    ErrorsVariable 'i' should be declared final.112
    +
    +

    org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

    + + + + + + + - +
    ViolationMessageLine
    Errors Variable 'file' should be declared final. 114
    Errors Variable 'sb' should be declared final. 116

    org/owasp/dependencycheck/dependency/Dependency.java

    - + - + -
    Violation Message Line
    Errors Total number of methods is 48 (max allowed is 40).38
    +39 +
    +

    org/owasp/dependencycheck/suppression/SuppressionRule.java

    + + + + + + + + + + + + + + + + +
    ViolationMessageLine
    ErrorsMissing a Javadoc comment.269
    ErrorsFirst sentence should end with a period.271
    ErrorsFirst sentence should end with a period.280
    +
    +

    org/owasp/dependencycheck/utils/DependencyVersion.java

    + + + + + + + + + + + + +
    ViolationMessageLine
    ErrorsVariable 'thisVersion' should be declared final.201
    ErrorsVariable 'otherVersion' should be declared final.202
    diff --git a/dependency-check-core/checkstyle.rss b/dependency-check-core/checkstyle.rss index c0c737444..f15750753 100644 --- a/dependency-check-core/checkstyle.rss +++ b/dependency-check-core/checkstyle.rss @@ -25,8 +25,8 @@ under the License. en-us ©2012 - 2014 OWASP - File: 202, - Errors: 6, + <title>File: 183, + Errors: 20, Warnings: 0, Infos: 0 @@ -46,7 +46,7 @@ under the License. - org/owasp/dependencycheck/data/update/StandardUpdate.java + org/owasp/dependencycheck/data/lucene/package-info.java 0 @@ -71,1434 +71,6 @@ under the License. 0 - - - - org/owasp/dependencycheck/data/nexus/NexusSearch.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/HintAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/exception/ScanAgentException.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/CachedWebDataSource.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-ant/target/generated-classes/cobertura/cobertura.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/utils/DependencyVersion.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Dependency.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/Dependency.java - - - 0 - - - 0 - - - 1 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-ant/target/generated-classes/cobertura/task.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/utils/Pair.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nexus/MavenArtifact.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/exception/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/EvidenceCollection.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Parent.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-ant/target/classes/task.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-maven/target/generated-classes/cobertura/log.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/utils/NonClosingStream.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/cwe/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Build.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/utils/DBUtils.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-ant/target/generated-classes/cobertura/taskdefs.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Developer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/VulnerableSoftware.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/lucene/DependencySimilarity.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/suppression/PropertyType.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/cpe/Fields.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/suppression/package-info.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-cli/target/maven-archiver/pom.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/VulnerabilityComparator.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/exception/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/Identifier.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-core/src/main/resources/dependencycheck.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-ant/target/classes/log.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/NexusAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/task/DownloadTask.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nvdcve/DriverLoader.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-utils/src/test/resources/dependencycheck.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-cli/target/generated-classes/cobertura/log.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-core/src/test/resources/dependencycheck.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-core/target/generated-classes/cobertura/dependencycheck-resources.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/Confidence.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java - - - 0 - - - 0 - - - 2 - - - - - org/owasp/dependencycheck/dependency/Evidence.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-core/target/test-classes/log.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/Reference.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-cli/src/main/resources/log.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nvdcve/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/exception/UpdateException.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/package-info.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-utils/src/test/resources/test.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-maven/target/generated-classes/cobertura/cobertura.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/cwe/CweHandler.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/lucene/LuceneUtils.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/utils/Filter.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/cwe/CweDB.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/utils/ExtractionUtil.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nvdcve/CveDB.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Profile.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/Organization.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-cli/target/generated-classes/cobertura/cobertura.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-ant/target/generated-classes/cobertura/log.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nuget/NuspecParseException.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/cpe/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/suppression/SuppressionParseException.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-core/target/generated-classes/cobertura/dependencycheck.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/exception/NoDataException.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/task/ProcessTask.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nvdcve/DriverShim.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/dependency/Vulnerability.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/jaxb/pom/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java - - - 0 - - - 0 - - - 2 - - - - - dependency-check-maven/src/main/resources/log.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/xml/package-info.java - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/nuget/NugetPackage.java - - - 0 - - - 0 - - - 0 - - - - - dependency-check-core/target/classes/dependencycheck.properties - - - 0 - - - 0 - - - 0 - - - - - org/owasp/dependencycheck/data/update/NvdCveUpdater.java - - - 0 - - - 0 - - - 0 - @@ -1516,7 +88,7 @@ under the License. - org/owasp/dependencycheck/data/lucene/package-info.java + org/owasp/dependencycheck/data/update/StandardUpdate.java 0 @@ -1530,21 +102,7 @@ under the License. - dependency-check-maven/target/classes/log.properties - - - 0 - - - 0 - - - 0 - - - - - dependency-check-maven/target/generated-classes/cobertura/mojo.properties + org/owasp/dependencycheck/data/nexus/NexusSearch.java 0 @@ -1569,6 +127,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/analyzer/HintAnalyzer.java + + + 0 + + + 0 + + + 0 + @@ -1583,6 +155,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/exception/ScanAgentException.java + + + 0 + + + 0 + + + 0 + @@ -1614,7 +200,7 @@ under the License. - org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java + org/owasp/dependencycheck/data/update/CachedWebDataSource.java 0 @@ -1625,6 +211,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/utils/DependencyVersion.java + + + 0 + + + 0 + + + 2 + @@ -1639,6 +239,34 @@ under the License. 0 + + + + org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Dependency.java + + + 0 + + + 0 + + + 0 + @@ -1653,6 +281,34 @@ under the License. 0 + + + + org/owasp/dependencycheck/dependency/Dependency.java + + + 0 + + + 0 + + + 1 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.java + + + 0 + + + 0 + + + 0 + @@ -1679,12 +335,12 @@ under the License. 0 - 0 + 2 - dependency-check-maven/target/maven-archiver/pom.properties + org/owasp/dependencycheck/utils/Pair.java 0 @@ -1709,6 +365,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java + + + 0 + + + 0 + + + 0 + @@ -1740,7 +410,7 @@ under the License. - dependency-check-maven/target/maven-plugin-help.properties + org/owasp/dependencycheck/data/nexus/MavenArtifact.java 0 @@ -1768,7 +438,21 @@ under the License. - org/owasp/dependencycheck/jaxb/pom/generated/Model.java + org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/analyzer/exception/package-info.java 0 @@ -1793,6 +477,48 @@ under the License. 0 + + + + org/owasp/dependencycheck/jaxb/pom/generated/Parent.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Model.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/dependency/EvidenceCollection.java + + + 0 + + + 0 + + + 0 + @@ -1821,6 +547,76 @@ under the License. 0 + + + + org/owasp/dependencycheck/utils/NonClosingStream.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/cwe/package-info.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java + + + 0 + + + 0 + + + 0 + @@ -1863,6 +659,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/jaxb/pom/generated/Build.java + + + 0 + + + 0 + + + 0 + @@ -1891,6 +701,76 @@ under the License. 0 + + + + org/owasp/dependencycheck/utils/DBUtils.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Developer.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/dependency/VulnerableSoftware.java + + + 0 + + + 0 + + + 0 + @@ -1905,6 +785,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java + + + 0 + + + 0 + + + 0 + @@ -1947,6 +841,34 @@ under the License. 0 + + + + org/owasp/dependencycheck/suppression/PropertyType.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/lucene/DependencySimilarity.java + + + 0 + + + 0 + + + 0 + @@ -1978,7 +900,7 @@ under the License. - dependency-check-ant/target/maven-archiver/pom.properties + org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.java 0 @@ -2003,6 +925,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/cpe/Fields.java + + + 0 + + + 0 + + + 0 + @@ -2076,7 +1012,7 @@ under the License. - org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java + org/owasp/dependencycheck/suppression/package-info.java 0 @@ -2090,7 +1026,7 @@ under the License. - org/owasp/dependencycheck/data/nuget/package-info.java + org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java 0 @@ -2115,6 +1051,48 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/nuget/package-info.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/dependency/VulnerabilityComparator.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java + + + 0 + + + 0 + + + 0 + @@ -2129,6 +1107,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/update/exception/package-info.java + + + 0 + + + 0 + + + 0 + @@ -2143,6 +1135,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/dependency/Identifier.java + + + 0 + + + 0 + + + 0 + @@ -2154,6 +1160,20 @@ under the License. 0 + + 4 + + + + + dependency-check-core/src/main/resources/dependencycheck.properties + + + 0 + + + 0 + 0 @@ -2185,6 +1205,34 @@ under the License. 0 + + + + org/owasp/dependencycheck/analyzer/NexusAnalyzer.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/update/task/DownloadTask.java + + + 0 + + + 0 + + + 0 + @@ -2199,6 +1247,90 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/nvdcve/DriverLoader.java + + + 0 + + + 0 + + + 0 + + + + + dependency-check-utils/src/test/resources/dependencycheck.properties + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java + + + 0 + + + 0 + + + 0 + + + + + dependency-check-core/src/test/resources/dependencycheck.properties + + + 0 + + + 0 + + + 0 + + + + + dependency-check-core/target/generated-classes/cobertura/dependencycheck-resources.properties + + + 0 + + + 0 + + + 0 + @@ -2213,6 +1345,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java + + + 0 + + + 0 + + + 0 + @@ -2227,6 +1373,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/dependency/Confidence.java + + + 0 + + + 0 + + + 0 + @@ -2244,7 +1404,7 @@ under the License. - dependency-check-ant/target/classes/taskdefs.properties + org/owasp/dependencycheck/jaxb/pom/generated/Scm.java 0 @@ -2258,7 +1418,7 @@ under the License. - org/owasp/dependencycheck/jaxb/pom/generated/Scm.java + org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java 0 @@ -2267,7 +1427,7 @@ under the License. 0 - 0 + 2 @@ -2325,6 +1485,76 @@ under the License. 0 + + + + org/owasp/dependencycheck/dependency/Evidence.java + + + 0 + + + 0 + + + 0 + + + + + dependency-check-core/target/test-classes/log.properties + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/analyzer/package-info.java + + + 0 + + + 0 + + + 0 + + + + + dependency-check-cli/src/main/resources/log.properties + + + 0 + + + 0 + + + 0 + @@ -2339,6 +1569,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/dependency/Reference.java + + + 0 + + + 0 + + + 0 + @@ -2353,6 +1597,62 @@ under the License. 0 + + + + org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/nvdcve/package-info.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/update/exception/UpdateException.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/package-info.java + + + 0 + + + 0 + + + 0 + @@ -2367,6 +1667,20 @@ under the License. 0 + + + + dependency-check-utils/src/test/resources/test.properties + + + 0 + + + 0 + + + 0 + @@ -2379,7 +1693,7 @@ under the License. 0 - 0 + 3 @@ -2409,6 +1723,34 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/lucene/LuceneUtils.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/cwe/CweHandler.java + + + 0 + + + 0 + + + 0 + @@ -2435,7 +1777,7 @@ under the License. 0 - 0 + 3 @@ -2451,6 +1793,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/utils/Filter.java + + + 0 + + + 0 + + + 0 + @@ -2465,6 +1821,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/cwe/CweDB.java + + + 0 + + + 0 + + + 0 + @@ -2479,6 +1849,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java + + + 0 + + + 0 + + + 0 + @@ -2493,6 +1877,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/utils/ExtractionUtil.java + + + 0 + + + 0 + + + 0 + @@ -2510,7 +1908,7 @@ under the License. - org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java + org/owasp/dependencycheck/jaxb/pom/generated/Extension.java 0 @@ -2524,7 +1922,7 @@ under the License. - org/owasp/dependencycheck/jaxb/pom/generated/Extension.java + org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java 0 @@ -2577,6 +1975,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/nvdcve/CveDB.java + + + 0 + + + 0 + + + 0 + @@ -2591,6 +2003,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/jaxb/pom/generated/Profile.java + + + 0 + + + 0 + + + 0 + @@ -2605,6 +2031,48 @@ under the License. 0 + + + + org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/Organization.java + + + 0 + + + 0 + + + 0 + @@ -2619,6 +2087,62 @@ under the License. 0 + + + + dependency-check-core/target/generated-classes/cobertura/dependencycheck.properties + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/suppression/SuppressionParseException.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/cpe/package-info.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/nuget/NuspecParseException.java + + + 0 + + + 0 + + + 0 + @@ -2650,7 +2174,35 @@ under the License. - dependency-check-cli/target/classes/log.properties + org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/analyzer/exception/ArchiveExtractionException.java 0 @@ -2675,6 +2227,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java + + + 0 + + + 0 + + + 0 + @@ -2703,6 +2269,20 @@ under the License. 1 + + + + org/owasp/dependencycheck/exception/NoDataException.java + + + 0 + + + 0 + + + 0 + @@ -2745,6 +2325,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/update/task/ProcessTask.java + + + 0 + + + 0 + + + 0 + @@ -2762,7 +2356,21 @@ under the License. - dependency-check-maven/target/classes/mojo.properties + org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/nvdcve/DriverShim.java 0 @@ -2787,6 +2395,20 @@ under the License. 0 + + + + dependency-check-core/target/test-classes/test.properties + + + 0 + + + 0 + + + 0 + @@ -2804,7 +2426,35 @@ under the License. - dependency-check-core/target/test-classes/test.properties + org/owasp/dependencycheck/dependency/Vulnerability.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/package-info.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java 0 @@ -2829,6 +2479,20 @@ under the License. 0 + + + + dependency-check-maven/src/main/resources/log.properties + + + 0 + + + 0 + + + 0 + @@ -2843,6 +2507,62 @@ under the License. 0 + + + + org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java + + + 0 + + + 0 + + + 2 + + + + + org/owasp/dependencycheck/data/nuget/NugetPackage.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/data/update/xml/package-info.java + + + 0 + + + 0 + + + 0 + + + + + dependency-check-core/target/classes/dependencycheck.properties + + + 0 + + + 0 + + + 0 + @@ -2857,6 +2577,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/data/update/NvdCveUpdater.java + + + 0 + + + 0 + + + 0 + diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html index 5b0072870..cf200ff8d 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html @@ -39,7 +39,7 @@ org.owasp.dependencycheck.analyzer AssemblyAnalyzer (66%) -CPEAnalyzer (80%) +CPEAnalyzer (77%) CpeSuppressionAnalyzer (88%) @@ -48,7 +48,7 @@ org.owasp.dependencycheck.analyzer DependencyBundlingAnalyzer (34%) -FalsePositiveAnalyzer (50%) +FalsePositiveAnalyzer (49%) FileNameAnalyzer (85%) diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.suppression.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.suppression.html index 16e427e64..80041ce8a 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.suppression.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.suppression.html @@ -21,7 +21,7 @@ org.owasp.dependencycheck.suppression SuppressionErrorHandler (6%) -SuppressionHandler (97%) +SuppressionHandler (95%) SuppressionParseException (N/A) @@ -30,7 +30,7 @@ org.owasp.dependencycheck.suppression SuppressionParser (64%) -SuppressionRule (70%) +SuppressionRule (71%) diff --git a/dependency-check-core/cobertura/frame-sourcefiles.html b/dependency-check-core/cobertura/frame-sourcefiles.html index 3c6f149a6..a71e3f6cc 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles.html +++ b/dependency-check-core/cobertura/frame-sourcefiles.html @@ -69,7 +69,7 @@ All Packages BuildBase (0%) -CPEAnalyzer (80%) +CPEAnalyzer (77%) CachedWebDataSource (N/A) @@ -177,7 +177,7 @@ All Packages ExtractionUtil (0%) -FalsePositiveAnalyzer (50%) +FalsePositiveAnalyzer (49%) FieldAnalyzer (100%) @@ -360,7 +360,7 @@ All Packages SuppressionErrorHandler (6%) -SuppressionHandler (97%) +SuppressionHandler (95%) SuppressionParseException (N/A) @@ -369,7 +369,7 @@ All Packages SuppressionParser (64%) -SuppressionRule (70%) +SuppressionRule (71%) TokenPairConcatenatingFilter (100%) diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.agent.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.agent.html index 4c3efe33f..9d2d0e514 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.agent.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.agent.html @@ -37,6 +37,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html index 197c2cb8a..e420823ff 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.exception.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html index a96a379d5..5099403a3 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.analyzer24
    56%
    990/1751
    41%
    466/1126
    5.145
    org.owasp.dependencycheck.analyzer24
    56%
    994/1773
    40%
    466/1146
    5.192
    org.owasp.dependencycheck.analyzer.exception2
    N/A
    N/A
    1
    @@ -45,15 +45,15 @@ packageTable.sort(0); AssemblyAnalyzer
    66%
    82/123
    41%
    26/62
    6.875 - CPEAnalyzer
    86%
    168/194
    74%
    94/126
    4.429 - CPEAnalyzer$IdentifierConfidence
    100%
    3/3
    N/A
    4.429 - CPEAnalyzer$IdentifierMatch
    40%
    12/30
    16%
    4/24
    4.429 + CPEAnalyzer
    83%
    164/197
    72%
    90/124
    4.444 + CPEAnalyzer$IdentifierConfidence
    100%
    4/4
    N/A
    4.444 + CPEAnalyzer$IdentifierMatch
    40%
    12/30
    16%
    4/24
    4.444 CpeSuppressionAnalyzer
    88%
    8/9
    66%
    4/6
    2.333 DependencyBundlingAnalyzer
    34%
    48/141
    28%
    43/150
    9.091 - FalsePositiveAnalyzer
    50%
    79/157
    28%
    54/190
    9.5 + FalsePositiveAnalyzer
    49%
    86/175
    27%
    58/212
    9.692 FileNameAnalyzer
    85%
    17/20
    50%
    5/10
    2.667 @@ -81,6 +81,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html index f695794bf..aeb7d7443 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html @@ -43,6 +43,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html index 65a5ba90d..19bea5141 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html index 8b3cd7a9c..c4377deb2 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html @@ -57,6 +57,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html index efdb40c49..608707a0e 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html index 80a5cac20..7c5283b42 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nuget.html @@ -43,6 +43,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html index 3c8fe5b1c..608975787 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html @@ -50,6 +50,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html index 1867b043e..4db3b1007 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html index 6c707e11c..f84567de5 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html @@ -50,6 +50,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html index 22b06cc0b..4e6dec3b1 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html index 4fff7a9d0..d77bec16e 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html @@ -41,6 +41,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html index e53423137..5a88ead8b 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html @@ -58,6 +58,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html index 2008fe076..006954f79 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html index 210860204..42cf42e2d 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html @@ -18,7 +18,7 @@ org.owasp.dependencycheck1
    53%
    105/196
    60%
    36/60
    3.182 org.owasp.dependencycheck.agent1
    0%
    0/140
    0%
    0/114
    1.879 - org.owasp.dependencycheck.analyzer24
    56%
    990/1751
    41%
    466/1126
    5.145 + org.owasp.dependencycheck.analyzer24
    56%
    994/1773
    40%
    466/1146
    5.192 org.owasp.dependencycheck.analyzer.exception2
    N/A
    N/A
    1 org.owasp.dependencycheck.data.cpe4
    70%
    82/116
    38%
    23/60
    2.452 org.owasp.dependencycheck.data.cwe2
    41%
    12/29
    14%
    2/14
    2.8 @@ -35,8 +35,8 @@ org.owasp.dependencycheck.jaxb.pom1
    0%
    0/11
    0%
    0/2
    1.25 org.owasp.dependencycheck.jaxb.pom.generated87
    0%
    0/234
    0%
    0/98
    1.091 org.owasp.dependencycheck.reporting4
    0%
    0/113
    0%
    0/44
    3.714 - org.owasp.dependencycheck.suppression6
    68%
    174/254
    62%
    108/174
    3.094 - org.owasp.dependencycheck.utils10
    60%
    145/238
    54%
    79/144
    3.581 + org.owasp.dependencycheck.suppression6
    68%
    179/260
    62%
    112/180
    3.073 + org.owasp.dependencycheck.utils10
    61%
    151/244
    56%
    82/146
    3.628 - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html index 2e1be7240..d8b64411d 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html @@ -160,6 +160,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html index b7c9ca628..48fb4fd95 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html @@ -38,6 +38,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html index fbca1aebe..4694a646c 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html @@ -42,6 +42,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html index c0650945b..9098c771f 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.suppression6
    68%
    174/254
    62%
    108/174
    3.094
    org.owasp.dependencycheck.suppression6
    68%
    179/260
    62%
    112/180
    3.073
    - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html index c953edb47..735f9e6da 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.utils10
    60%
    145/238
    54%
    79/144
    3.581
    org.owasp.dependencycheck.utils10
    61%
    151/244
    56%
    82/146
    3.628
    - + diff --git a/dependency-check-core/cobertura/frame-summary.html b/dependency-check-core/cobertura/frame-summary.html index e5957221e..452423c2a 100644 --- a/dependency-check-core/cobertura/frame-summary.html +++ b/dependency-check-core/cobertura/frame-summary.html @@ -16,10 +16,10 @@ - + - + @@ -36,8 +36,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages197
    49%
    2239/4483
    39%
    1042/2632
    2.315
    All Packages197
    49%
    2254/4517
    39%
    1049/2660
    2.323
    org.owasp.dependencycheck1
    53%
    105/196
    60%
    36/60
    3.182
    org.owasp.dependencycheck.agent1
    0%
    0/140
    0%
    0/114
    1.879
    org.owasp.dependencycheck.analyzer24
    56%
    990/1751
    41%
    466/1126
    5.145
    org.owasp.dependencycheck.analyzer24
    56%
    994/1773
    40%
    466/1146
    5.192
    org.owasp.dependencycheck.analyzer.exception2
    N/A
    N/A
    1
    org.owasp.dependencycheck.data.cpe4
    70%
    82/116
    38%
    23/60
    2.452
    org.owasp.dependencycheck.data.cwe2
    41%
    12/29
    14%
    2/14
    2.8
    org.owasp.dependencycheck.jaxb.pom1
    0%
    0/11
    0%
    0/2
    1.25
    org.owasp.dependencycheck.jaxb.pom.generated87
    0%
    0/234
    0%
    0/98
    1.091
    org.owasp.dependencycheck.reporting4
    0%
    0/113
    0%
    0/44
    3.714
    org.owasp.dependencycheck.suppression6
    68%
    174/254
    62%
    108/174
    3.094
    org.owasp.dependencycheck.utils10
    60%
    145/238
    54%
    79/144
    3.581
    org.owasp.dependencycheck.suppression6
    68%
    179/260
    62%
    112/180
    3.073
    org.owasp.dependencycheck.utils10
    61%
    151/244
    56%
    82/146
    3.628
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html index f59974417..bdc810e6c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html @@ -58,781 +58,783 @@  20  
     import java.io.File;
     21   -
     import java.util.ArrayList;
    +
     import java.io.Serializable;
     22   -
     import java.util.EnumMap;
    +
     import java.util.ArrayList;
     23   -
     import java.util.HashSet;
    +
     import java.util.EnumMap;
     24   -
     import java.util.Iterator;
    +
     import java.util.HashSet;
     25   -
     import java.util.List;
    +
     import java.util.Iterator;
     26   -
     import java.util.Set;
    +
     import java.util.List;
     27   -
     import java.util.logging.Level;
    +
     import java.util.Set;
     28   -
     import java.util.logging.Logger;
    +
     import java.util.logging.Level;
     29   -
     import org.owasp.dependencycheck.analyzer.AnalysisPhase;
    +
     import java.util.logging.Logger;
     30   -
     import org.owasp.dependencycheck.analyzer.Analyzer;
    +
     import org.owasp.dependencycheck.analyzer.AnalysisPhase;
     31   -
     import org.owasp.dependencycheck.analyzer.AnalyzerService;
    +
     import org.owasp.dependencycheck.analyzer.Analyzer;
     32   -
     import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer;
    +
     import org.owasp.dependencycheck.analyzer.AnalyzerService;
     33   -
     import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
    +
     import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer;
     34   -
     import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
    +
     import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
     35   -
     import org.owasp.dependencycheck.data.cpe.IndexException;
    +
     import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
     36   -
     import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory;
    +
     import org.owasp.dependencycheck.data.cpe.IndexException;
     37   -
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    +
     import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory;
     38   -
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    +
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
     39   -
     import org.owasp.dependencycheck.data.update.CachedWebDataSource;
    +
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
     40   -
     import org.owasp.dependencycheck.data.update.UpdateService;
    +
     import org.owasp.dependencycheck.data.update.CachedWebDataSource;
     41   -
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    +
     import org.owasp.dependencycheck.data.update.UpdateService;
     42   -
     import org.owasp.dependencycheck.dependency.Dependency;
    +
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
     43   -
     import org.owasp.dependencycheck.exception.NoDataException;
    +
     import org.owasp.dependencycheck.dependency.Dependency;
     44   -
     import org.owasp.dependencycheck.utils.FileUtils;
    +
     import org.owasp.dependencycheck.exception.NoDataException;
     45   -
     import org.owasp.dependencycheck.utils.InvalidSettingException;
    +
     import org.owasp.dependencycheck.utils.FileUtils;
     46   -
     import org.owasp.dependencycheck.utils.Settings;
    +
     import org.owasp.dependencycheck.utils.InvalidSettingException;
     47   -
     
    +
     import org.owasp.dependencycheck.utils.Settings;
     48   -
     /**
    +
     
     49   -
      * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the
    +
     /**
     50   -
      * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a
    +
      * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the
     51   -
      * dependency.
    +
      * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a
     52   -
      *
    +
      * dependency.
     53   -
      * @author Jeremy Long <jeremy.long@owasp.org>
    +
      *
     54   -
      */
    +
      * @author Jeremy Long <jeremy.long@owasp.org>
     55   -
     public class Engine {
    +
      */
     56   -
     
    +
     public class Engine implements Serializable {
     57   -
         /**
    +
     
     58   -
          * The list of dependencies.
    +
         /**
     59   -
          */
    +
          * The list of dependencies.
     60   -
         private List<Dependency> dependencies;
    +
          */
     61   -
         /**
    +
         private List<Dependency> dependencies;
     62   -
          * A Map of analyzers grouped by Analysis phase.
    +
         /**
     63   -
          */
    -  64   -
         private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
    -  65   -
         /**
    -  66  
          * A Map of analyzers grouped by Analysis phase.
    +  64   +
          */
    +  65   +
         private transient final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
    +  66   +
         /**
     67   -
          */
    +
          * A Map of analyzers grouped by Analysis phase.
     68   -
         private final Set<FileTypeAnalyzer> fileTypeAnalyzers;
    +
          */
     69   -
         /**
    +
         private transient final Set<FileTypeAnalyzer> fileTypeAnalyzers;
     70   -
          * The ClassLoader to use when dynamically loading Analyzer and Update services.
    +
         /**
     71   -
          */
    +
          * The ClassLoader to use when dynamically loading Analyzer and Update services.
     72   -
         private ClassLoader serviceClassLoader;
    +
          */
     73   -
         /**
    +
         private transient ClassLoader serviceClassLoader;
     74   -
          * The Logger for use throughout the class.
    +
         /**
     75   +
          * The Logger for use throughout the class.
    +  76  
          */
    -  76  4
         private static final Logger LOGGER = Logger.getLogger(Engine.class.getName());
    -  77   -
     
    +  77  1
         private transient static final Logger LOGGER = Logger.getLogger(Engine.class.getName());
     78   -
         /**
    +
     
     79   -
          * Creates a new Engine.
    +
         /**
     80   -
          *
    +
          * Creates a new Engine.
     81   -
          * @throws DatabaseException thrown if there is an error connecting to the database
    +
          *
     82   -
          */
    -  83   -
         public Engine() throws DatabaseException {
    -  84  4
             this(Thread.currentThread().getContextClassLoader());
    -  85  4
         }
    -  86   -
     
    -  87   -
         /**
    -  88   -
          * Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services.
    -  89   -
          *
    -  90   -
          * @param serviceClassLoader the ClassLoader to use when dynamically loading Analyzer and Update services
    -  91  
          * @throws DatabaseException thrown if there is an error connecting to the database
    +  83   +
          */
    +  84   +
         public Engine() throws DatabaseException {
    +  85  1
             this(Thread.currentThread().getContextClassLoader());
    +  86  1
         }
    +  87   +
     
    +  88   +
         /**
    +  89   +
          * Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services.
    +  90   +
          *
    +  91   +
          * @param serviceClassLoader the ClassLoader to use when dynamically loading Analyzer and Update services
     92   +
          * @throws DatabaseException thrown if there is an error connecting to the database
    +  93  
          */
    -  93  4
         public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
    -  94  4
             this.dependencies = new ArrayList<Dependency>();
    -  95  4
             this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
    -  96  4
             this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
    -  97  4
             this.serviceClassLoader = serviceClassLoader;
    -  98   +  94  1
         public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
    +  95  1
             this.dependencies = new ArrayList<Dependency>();
    +  96  1
             this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
    +  97  1
             this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
    +  98  1
             this.serviceClassLoader = serviceClassLoader;
    +  99  
     
    -  99  4
             ConnectionFactory.initialize();
    -  100   +  100  1
             ConnectionFactory.initialize();
    +  101  
     
    -  101  4
             boolean autoUpdate = true;
    -  102   +  102  1
             boolean autoUpdate = true;
    +  103  
             try {
    -  103  4
                 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
    -  104  0
             } catch (InvalidSettingException ex) {
    -  105  0
                 LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true.");
    -  106  4
             }
    -  107  4
             if (autoUpdate) {
    -  108  0
                 doUpdates();
    -  109   +  104  1
                 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
    +  105  0
             } catch (InvalidSettingException ex) {
    +  106  0
                 LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true.");
    +  107  1
             }
    +  108  1
             if (autoUpdate) {
    +  109  0
                 doUpdates();
    +  110  
             }
    -  110  4
             loadAnalyzers();
    -  111  4
         }
    -  112   -
     
    +  111  1
             loadAnalyzers();
    +  112  1
         }
     113   -
         /**
    +
     
     114   -
          * Properly cleans up resources allocated during analysis.
    +
         /**
     115   -
          */
    +
          * Properly cleans up resources allocated during analysis.
     116   +
          */
    +  117  
         public void cleanup() {
    -  117  0
             ConnectionFactory.cleanup();
    -  118  0
         }
    -  119   -
     
    +  118  0
             ConnectionFactory.cleanup();
    +  119  0
         }
     120   -
         /**
    +
     
     121   -
          * Loads the analyzers specified in the configuration file (or system properties).
    +
         /**
     122   -
          */
    +
          * Loads the analyzers specified in the configuration file (or system properties).
     123   -
         private void loadAnalyzers() {
    +
          */
     124   +
         private void loadAnalyzers() {
    +  125  
     
    -  125  40
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  126  36
                 analyzers.put(phase, new ArrayList<Analyzer>());
    -  127   -
             }
    +  126  10
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  127  9
                 analyzers.put(phase, new ArrayList<Analyzer>());
     128   +
             }
    +  129  
     
    -  129  4
             final AnalyzerService service = new AnalyzerService(serviceClassLoader);
    -  130  4
             final Iterator<Analyzer> iterator = service.getAnalyzers();
    -  131  56
             while (iterator.hasNext()) {
    -  132  52
                 final Analyzer a = iterator.next();
    -  133  52
                 analyzers.get(a.getAnalysisPhase()).add(a);
    -  134  52
                 if (a instanceof FileTypeAnalyzer) {
    -  135  20
                     this.fileTypeAnalyzers.add((FileTypeAnalyzer) a);
    -  136   +  130  1
             final AnalyzerService service = new AnalyzerService(serviceClassLoader);
    +  131  1
             final Iterator<Analyzer> iterator = service.getAnalyzers();
    +  132  14
             while (iterator.hasNext()) {
    +  133  13
                 final Analyzer a = iterator.next();
    +  134  13
                 analyzers.get(a.getAnalysisPhase()).add(a);
    +  135  13
                 if (a instanceof FileTypeAnalyzer) {
    +  136  5
                     this.fileTypeAnalyzers.add((FileTypeAnalyzer) a);
    +  137  
                 }
    -  137  52
             }
    -  138  4
         }
    -  139   -
     
    +  138  13
             }
    +  139  1
         }
     140   -
         /**
    +
     
     141   -
          * Get the List of the analyzers for a specific phase of analysis.
    +
         /**
     142   -
          *
    +
          * Get the List of the analyzers for a specific phase of analysis.
     143   -
          * @param phase the phase to get the configured analyzers.
    +
          *
     144   -
          * @return the analyzers loaded
    +
          * @param phase the phase to get the configured analyzers.
     145   -
          */
    +
          * @return the analyzers loaded
     146   +
          */
    +  147  
         public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
    -  147  0
             return analyzers.get(phase);
    -  148   -
         }
    +  148  0
             return analyzers.get(phase);
     149   -
     
    +
         }
     150   -
         /**
    +
     
     151   -
          * Get the dependencies identified.
    +
         /**
     152   -
          *
    +
          * Get the dependencies identified.
     153   -
          * @return the dependencies identified
    +
          *
     154   -
          */
    +
          * @return the dependencies identified
     155   -
         public List<Dependency> getDependencies() {
    +
          */
     156   -
             return dependencies;
    +
         public List<Dependency> getDependencies() {
     157   -
         }
    +
             return dependencies;
     158   -
     
    +
         }
     159   -
         public void setDependencies(List<Dependency> dependencies) {
    +
     
     160   -
             this.dependencies = dependencies;
    +
         public void setDependencies(List<Dependency> dependencies) {
     161   -
             //for (Dependency dependency: dependencies) {
    +
             this.dependencies = dependencies;
     162   -
             //    dependencies.add(dependency);
    +
             //for (Dependency dependency: dependencies) {
     163   -
             //}
    +
             //    dependencies.add(dependency);
     164   -
         }
    +
             //}
     165   -
     
    +
         }
     166   -
         /**
    +
     
     167   -
          * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any
    +
         /**
     168   -
          * dependencies identified are added to the dependency collection.
    -  169   -
          *
    -  170   -
          * @since v0.3.2.5
    -  171   -
          *
    -  172   -
          * @param paths an array of paths to files or directories to be analyzed.
    -  173   -
          */
    -  174   -
         public void scan(String[] paths) {
    -  175  0
             for (String path : paths) {
    -  176  0
                 final File file = new File(path);
    -  177  0
                 scan(file);
    -  178   -
             }
    -  179  0
         }
    -  180   -
     
    -  181   -
         /**
    -  182   -
          * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies
    -  183   -
          * identified are added to the dependency collection.
    -  184   -
          *
    -  185   -
          * @param path the path to a file or directory to be analyzed.
    -  186   -
          */
    -  187   -
         public void scan(String path) {
    -  188  0
             if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$")) {
    -  189  0
                 final String[] parts = path.split("\\*\\.");
    -  190  0
                 final String[] ext = new String[]{parts[parts.length - 1]};
    -  191  0
                 final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2));
    -  192  0
                 if (dir.isDirectory()) {
    -  193  0
                     final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true);
    -  194  0
                     scan(files);
    -  195  0
                 } else {
    -  196  0
                     final String msg = String.format("Invalid file path provided to scan '%s'", path);
    -  197  0
                     LOGGER.log(Level.SEVERE, msg);
    -  198   -
                 }
    -  199  0
             } else {
    -  200  0
                 final File file = new File(path);
    -  201  0
                 scan(file);
    -  202   -
             }
    -  203  0
         }
    -  204   -
     
    -  205   -
         /**
    -  206  
          * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  207   +  169  
          * dependencies identified are added to the dependency collection.
    -  208   +  170  
          *
    -  209   +  171  
          * @since v0.3.2.5
    -  210   +  172  
          *
    -  211   -
          * @param files an array of paths to files or directories to be analyzed.
    -  212   +  173   +
          * @param paths an array of paths to files or directories to be analyzed.
    +  174  
          */
    -  213   -
         public void scan(File[] files) {
    -  214  0
             for (File file : files) {
    -  215  0
                 scan(file);
    -  216   +  175   +
         public void scan(String[] paths) {
    +  176  0
             for (String path : paths) {
    +  177  0
                 final File file = new File(path);
    +  178  0
                 scan(file);
    +  179  
             }
    -  217  0
         }
    -  218   +  180  0
         }
    +  181  
     
    -  219   +  182  
         /**
    -  220   -
          * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  221   -
          * dependencies identified are added to the dependency collection.
    -  222   -
          *
    -  223   -
          * @since v0.3.2.5
    -  224   -
          *
    -  225   -
          * @param files a set of paths to files or directories to be analyzed.
    -  226   -
          */
    -  227   -
         public void scan(Set<File> files) {
    -  228  0
             for (File file : files) {
    -  229  0
                 scan(file);
    -  230  0
             }
    -  231  0
         }
    -  232   -
     
    -  233   -
         /**
    -  234   -
          * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  235   -
          * dependencies identified are added to the dependency collection.
    -  236   -
          *
    -  237   -
          * @since v0.3.2.5
    -  238   -
          *
    -  239   -
          * @param files a set of paths to files or directories to be analyzed.
    -  240   -
          */
    -  241   -
         public void scan(List<File> files) {
    -  242  0
             for (File file : files) {
    -  243  0
                 scan(file);
    -  244  0
             }
    -  245  0
         }
    -  246   -
     
    -  247   -
         /**
    -  248   +  183  
          * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies
    -  249   +  184  
          * identified are added to the dependency collection.
    +  185   +
          *
    +  186   +
          * @param path the path to a file or directory to be analyzed.
    +  187   +
          */
    +  188   +
         public void scan(String path) {
    +  189  0
             if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$")) {
    +  190  0
                 final String[] parts = path.split("\\*\\.");
    +  191  0
                 final String[] ext = new String[]{parts[parts.length - 1]};
    +  192  0
                 final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2));
    +  193  0
                 if (dir.isDirectory()) {
    +  194  0
                     final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true);
    +  195  0
                     scan(files);
    +  196  0
                 } else {
    +  197  0
                     final String msg = String.format("Invalid file path provided to scan '%s'", path);
    +  198  0
                     LOGGER.log(Level.SEVERE, msg);
    +  199   +
                 }
    +  200  0
             } else {
    +  201  0
                 final File file = new File(path);
    +  202  0
                 scan(file);
    +  203   +
             }
    +  204  0
         }
    +  205   +
     
    +  206   +
         /**
    +  207   +
          * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any
    +  208   +
          * dependencies identified are added to the dependency collection.
    +  209   +
          *
    +  210   +
          * @since v0.3.2.5
    +  211   +
          *
    +  212   +
          * @param files an array of paths to files or directories to be analyzed.
    +  213   +
          */
    +  214   +
         public void scan(File[] files) {
    +  215  0
             for (File file : files) {
    +  216  0
                 scan(file);
    +  217   +
             }
    +  218  0
         }
    +  219   +
     
    +  220   +
         /**
    +  221   +
          * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any
    +  222   +
          * dependencies identified are added to the dependency collection.
    +  223   +
          *
    +  224   +
          * @since v0.3.2.5
    +  225   +
          *
    +  226   +
          * @param files a set of paths to files or directories to be analyzed.
    +  227   +
          */
    +  228   +
         public void scan(Set<File> files) {
    +  229  0
             for (File file : files) {
    +  230  0
                 scan(file);
    +  231  0
             }
    +  232  0
         }
    +  233   +
     
    +  234   +
         /**
    +  235   +
          * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any
    +  236   +
          * dependencies identified are added to the dependency collection.
    +  237   +
          *
    +  238   +
          * @since v0.3.2.5
    +  239   +
          *
    +  240   +
          * @param files a set of paths to files or directories to be analyzed.
    +  241   +
          */
    +  242   +
         public void scan(List<File> files) {
    +  243  0
             for (File file : files) {
    +  244  0
                 scan(file);
    +  245  0
             }
    +  246  0
         }
    +  247   +
     
    +  248   +
         /**
    +  249   +
          * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies
     250   -
          *
    +
          * identified are added to the dependency collection.
     251   -
          * @since v0.3.2.4
    +
          *
     252   -
          *
    +
          * @since v0.3.2.4
     253   -
          * @param file the path to a file or directory to be analyzed.
    +
          *
     254   -
          */
    +
          * @param file the path to a file or directory to be analyzed.
     255   +
          */
    +  256  
         public void scan(File file) {
    -  256  16
             if (file.exists()) {
    -  257  16
                 if (file.isDirectory()) {
    -  258  8
                     scanDirectory(file);
    -  259   +  257  4
             if (file.exists()) {
    +  258  4
                 if (file.isDirectory()) {
    +  259  2
                     scanDirectory(file);
    +  260  
                 } else {
    -  260  8
                     scanFile(file);
    -  261   -
                 }
    +  261  2
                     scanFile(file);
     262   -
             }
    -  263  16
         }
    -  264   -
     
    -  265   -
         /**
    -  266   -
          * Recursively scans files and directories. Any dependencies identified are added to the dependency collection.
    -  267   -
          *
    -  268   -
          * @param dir the directory to scan.
    -  269   -
          */
    -  270   -
         protected void scanDirectory(File dir) {
    -  271  152
             final File[] files = dir.listFiles();
    -  272  152
             if (files != null) {
    -  273  296
                 for (File f : files) {
    -  274  144
                     if (f.isDirectory()) {
    -  275  144
                         scanDirectory(f);
    -  276   -
                     } else {
    -  277  0
                         scanFile(f);
    -  278   -
                     }
    -  279  
                 }
    +  263   +
             }
    +  264  4
         }
    +  265   +
     
    +  266   +
         /**
    +  267   +
          * Recursively scans files and directories. Any dependencies identified are added to the dependency collection.
    +  268   +
          *
    +  269   +
          * @param dir the directory to scan.
    +  270   +
          */
    +  271   +
         protected void scanDirectory(File dir) {
    +  272  38
             final File[] files = dir.listFiles();
    +  273  38
             if (files != null) {
    +  274  74
                 for (File f : files) {
    +  275  36
                     if (f.isDirectory()) {
    +  276  36
                         scanDirectory(f);
    +  277   +
                     } else {
    +  278  0
                         scanFile(f);
    +  279   +
                     }
     280   +
                 }
    +  281  
             }
    -  281  152
         }
    -  282   -
     
    +  282  38
         }
     283   -
         /**
    +
     
     284   -
          * Scans a specified file. If a dependency is identified it is added to the dependency collection.
    +
         /**
     285   -
          *
    +
          * Scans a specified file. If a dependency is identified it is added to the dependency collection.
     286   -
          * @param file The file to scan.
    +
          *
     287   -
          */
    +
          * @param file The file to scan.
     288   +
          */
    +  289  
         protected void scanFile(File file) {
    -  289  8
             if (!file.isFile()) {
    -  290  0
                 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString());
    -  291  0
                 LOGGER.log(Level.FINE, msg);
    -  292  0
                 return;
    -  293   +  290  2
             if (!file.isFile()) {
    +  291  0
                 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString());
    +  292  0
                 LOGGER.log(Level.FINE, msg);
    +  293  0
                 return;
    +  294  
             }
    -  294  8
             final String fileName = file.getName();
    -  295  8
             final String extension = FileUtils.getFileExtension(fileName);
    -  296  8
             if (extension != null) {
    -  297  8
                 if (supportsExtension(extension)) {
    -  298  8
                     final Dependency dependency = new Dependency(file);
    -  299  8
                     dependencies.add(dependency);
    -  300  8
                 }
    -  301   +  295  2
             final String fileName = file.getName();
    +  296  2
             final String extension = FileUtils.getFileExtension(fileName);
    +  297  2
             if (extension != null) {
    +  298  2
                 if (supportsExtension(extension)) {
    +  299  2
                     final Dependency dependency = new Dependency(file);
    +  300  2
                     dependencies.add(dependency);
    +  301  2
                 }
    +  302  
             } else {
    -  302  0
                 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.",
    -  303   +  303  0
                 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.",
    +  304  
                         file.toString());
    -  304  0
                 LOGGER.log(Level.FINEST, msg);
    -  305   +  305  0
                 LOGGER.log(Level.FINEST, msg);
    +  306  
             }
    -  306  8
         }
    -  307   -
     
    +  307  2
         }
     308   -
         /**
    +
     
     309   -
          * Runs the analyzers against all of the dependencies.
    +
         /**
     310   -
          */
    +
          * Runs the analyzers against all of the dependencies.
     311   -
         public void analyzeDependencies() {
    +
          */
     312   -
             //need to ensure that data exists
    +
         public void analyzeDependencies() {
     313   +
             //need to ensure that data exists
    +  314  
             try {
    -  314  4
                 ensureDataExists();
    -  315  0
             } catch (NoDataException ex) {
    -  316  0
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    -  317  0
                 LOGGER.log(Level.SEVERE, msg);
    -  318  0
                 LOGGER.log(Level.FINE, null, ex);
    -  319  0
                 return;
    -  320  0
             } catch (DatabaseException ex) {
    -  321  0
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    -  322  0
                 LOGGER.log(Level.SEVERE, msg);
    -  323  0
                 LOGGER.log(Level.FINE, null, ex);
    -  324  0
                 return;
    -  325   +  315  1
                 ensureDataExists();
    +  316  0
             } catch (NoDataException ex) {
    +  317  0
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    +  318  0
                 LOGGER.log(Level.SEVERE, msg);
    +  319  0
                 LOGGER.log(Level.FINE, null, ex);
    +  320  0
                 return;
    +  321  0
             } catch (DatabaseException ex) {
    +  322  0
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    +  323  0
                 LOGGER.log(Level.SEVERE, msg);
    +  324  0
                 LOGGER.log(Level.FINE, null, ex);
    +  325  0
                 return;
    +  326  
     
    -  326  4
             }
    -  327   +  327  1
             }
    +  328  
     
    -  328  4
             final String logHeader = String.format("%n"
    -  329   -
                     + "----------------------------------------------------%n"
    +  329  1
             final String logHeader = String.format("%n"
     330   -
                     + "BEGIN ANALYSIS%n"
    -  331   -
                     + "----------------------------------------------------");
    -  332  4
             LOGGER.log(Level.FINE, logHeader);
    -  333  4
             LOGGER.log(Level.INFO, "Analysis Starting");
    -  334   -
     
    -  335   -
             // analysis phases
    -  336  40
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  337  36
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  338   -
     
    -  339  36
                 for (Analyzer a : analyzerList) {
    -  340  52
                     initializeAnalyzer(a);
    -  341   -
     
    -  342   -
                     /* need to create a copy of the collection because some of the
    -  343   -
                      * analyzers may modify it. This prevents ConcurrentModificationExceptions.
    -  344   -
                      * This is okay for adds/deletes because it happens per analyzer.
    -  345   -
                      */
    -  346  52
                     final String msg = String.format("Begin Analyzer '%s'", a.getName());
    -  347  52
                     LOGGER.log(Level.FINE, msg);
    -  348  52
                     final Set<Dependency> dependencySet = new HashSet<Dependency>();
    -  349  52
                     dependencySet.addAll(dependencies);
    -  350  52
                     for (Dependency d : dependencySet) {
    -  351  104
                         boolean shouldAnalyze = true;
    -  352  104
                         if (a instanceof FileTypeAnalyzer) {
    -  353  40
                             final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
    -  354  40
                             shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension());
    -  355   -
                         }
    -  356  104
                         if (shouldAnalyze) {
    -  357  80
                             final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath());
    -  358  80
                             LOGGER.log(Level.FINE, msgFile);
    -  359   -
                             try {
    -  360  80
                                 a.analyze(d, this);
    -  361  0
                             } catch (AnalysisException ex) {
    -  362  0
                                 final String exMsg = String.format("An error occurred while analyzing '%s'.", d.getActualFilePath());
    -  363  0
                                 LOGGER.log(Level.WARNING, exMsg);
    -  364  0
                                 LOGGER.log(Level.FINE, "", ex);
    -  365  0
                             } catch (Throwable ex) {
    -  366  0
                                 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath());
    -  367   -
                                 //final AnalysisException ax = new AnalysisException(axMsg, ex);
    -  368  0
                                 LOGGER.log(Level.WARNING, axMsg);
    -  369  0
                                 LOGGER.log(Level.FINE, "", ex);
    -  370  80
                             }
    -  371   -
                         }
    -  372  104
                     }
    -  373  52
                 }
    -  374   -
             }
    -  375  40
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  376  36
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  377   -
     
    -  378  36
                 for (Analyzer a : analyzerList) {
    -  379  52
                     closeAnalyzer(a);
    -  380  52
                 }
    -  381   -
             }
    -  382   -
     
    -  383  4
             final String logFooter = String.format("%n"
    -  384  
                     + "----------------------------------------------------%n"
    -  385   -
                     + "END ANALYSIS%n"
    -  386   +  331   +
                     + "BEGIN ANALYSIS%n"
    +  332  
                     + "----------------------------------------------------");
    -  387  4
             LOGGER.log(Level.FINE, logFooter);
    -  388  4
             LOGGER.log(Level.INFO, "Analysis Complete");
    -  389  4
         }
    -  390   +  333  1
             LOGGER.log(Level.FINE, logHeader);
    +  334  1
             LOGGER.log(Level.INFO, "Analysis Starting");
    +  335  
     
    +  336   +
             // analysis phases
    +  337  10
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  338  9
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  339   +
     
    +  340  9
                 for (Analyzer a : analyzerList) {
    +  341  13
                     initializeAnalyzer(a);
    +  342   +
     
    +  343   +
                     /* need to create a copy of the collection because some of the
    +  344   +
                      * analyzers may modify it. This prevents ConcurrentModificationExceptions.
    +  345   +
                      * This is okay for adds/deletes because it happens per analyzer.
    +  346   +
                      */
    +  347  13
                     final String msg = String.format("Begin Analyzer '%s'", a.getName());
    +  348  13
                     LOGGER.log(Level.FINE, msg);
    +  349  13
                     final Set<Dependency> dependencySet = new HashSet<Dependency>();
    +  350  13
                     dependencySet.addAll(dependencies);
    +  351  13
                     for (Dependency d : dependencySet) {
    +  352  26
                         boolean shouldAnalyze = true;
    +  353  26
                         if (a instanceof FileTypeAnalyzer) {
    +  354  10
                             final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
    +  355  10
                             shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension());
    +  356   +
                         }
    +  357  26
                         if (shouldAnalyze) {
    +  358  20
                             final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath());
    +  359  20
                             LOGGER.log(Level.FINE, msgFile);
    +  360   +
                             try {
    +  361  20
                                 a.analyze(d, this);
    +  362  0
                             } catch (AnalysisException ex) {
    +  363  0
                                 final String exMsg = String.format("An error occurred while analyzing '%s'.", d.getActualFilePath());
    +  364  0
                                 LOGGER.log(Level.WARNING, exMsg);
    +  365  0
                                 LOGGER.log(Level.FINE, "", ex);
    +  366  0
                             } catch (Throwable ex) {
    +  367  0
                                 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath());
    +  368   +
                                 //final AnalysisException ax = new AnalysisException(axMsg, ex);
    +  369  0
                                 LOGGER.log(Level.WARNING, axMsg);
    +  370  0
                                 LOGGER.log(Level.FINE, "", ex);
    +  371  20
                             }
    +  372   +
                         }
    +  373  26
                     }
    +  374  13
                 }
    +  375   +
             }
    +  376  10
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  377  9
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  378   +
     
    +  379  9
                 for (Analyzer a : analyzerList) {
    +  380  13
                     closeAnalyzer(a);
    +  381  13
                 }
    +  382   +
             }
    +  383   +
     
    +  384  1
             final String logFooter = String.format("%n"
    +  385   +
                     + "----------------------------------------------------%n"
    +  386   +
                     + "END ANALYSIS%n"
    +  387   +
                     + "----------------------------------------------------");
    +  388  1
             LOGGER.log(Level.FINE, logFooter);
    +  389  1
             LOGGER.log(Level.INFO, "Analysis Complete");
    +  390  1
         }
     391   -
         /**
    +
     
     392   -
          * Initializes the given analyzer.
    +
         /**
     393   -
          *
    +
          * Initializes the given analyzer.
     394   -
          * @param analyzer the analyzer to initialize
    +
          *
     395   -
          */
    +
          * @param analyzer the analyzer to initialize
     396   -
         private void initializeAnalyzer(Analyzer analyzer) {
    +
          */
     397   +
         private void initializeAnalyzer(Analyzer analyzer) {
    +  398  
             try {
    -  398  52
                 final String msg = String.format("Initializing %s", analyzer.getName());
    -  399  52
                 LOGGER.log(Level.FINE, msg);
    -  400  52
                 analyzer.initialize();
    -  401  0
             } catch (Throwable ex) {
    -  402  0
                 final String msg = String.format("Exception occurred initializing %s.", analyzer.getName());
    -  403  0
                 LOGGER.log(Level.SEVERE, msg);
    -  404  0
                 LOGGER.log(Level.FINE, null, ex);
    -  405   +  399  13
                 final String msg = String.format("Initializing %s", analyzer.getName());
    +  400  13
                 LOGGER.log(Level.FINE, msg);
    +  401  13
                 analyzer.initialize();
    +  402  0
             } catch (Throwable ex) {
    +  403  0
                 final String msg = String.format("Exception occurred initializing %s.", analyzer.getName());
    +  404  0
                 LOGGER.log(Level.SEVERE, msg);
    +  405  0
                 LOGGER.log(Level.FINE, null, ex);
    +  406  
                 try {
    -  406  0
                     analyzer.close();
    -  407  0
                 } catch (Throwable ex1) {
    -  408  0
                     LOGGER.log(Level.FINEST, null, ex1);
    -  409  0
                 }
    -  410  52
             }
    -  411  52
         }
    -  412   -
     
    +  407  0
                     analyzer.close();
    +  408  0
                 } catch (Throwable ex1) {
    +  409  0
                     LOGGER.log(Level.FINEST, null, ex1);
    +  410  0
                 }
    +  411  13
             }
    +  412  13
         }
     413   -
         /**
    +
     
     414   -
          * Closes the given analyzer.
    +
         /**
     415   -
          *
    +
          * Closes the given analyzer.
     416   -
          * @param analyzer the analyzer to close
    +
          *
     417   -
          */
    +
          * @param analyzer the analyzer to close
     418   +
          */
    +  419  
         private void closeAnalyzer(Analyzer analyzer) {
    -  419  52
             final String msg = String.format("Closing Analyzer '%s'", analyzer.getName());
    -  420  52
             LOGGER.log(Level.FINE, msg);
    -  421   +  420  13
             final String msg = String.format("Closing Analyzer '%s'", analyzer.getName());
    +  421  13
             LOGGER.log(Level.FINE, msg);
    +  422  
             try {
    -  422  52
                 analyzer.close();
    -  423  0
             } catch (Throwable ex) {
    -  424  0
                 LOGGER.log(Level.FINEST, null, ex);
    -  425  52
             }
    -  426  52
         }
    -  427   -
     
    +  423  13
                 analyzer.close();
    +  424  0
             } catch (Throwable ex) {
    +  425  0
                 LOGGER.log(Level.FINEST, null, ex);
    +  426  13
             }
    +  427  13
         }
     428   -
         /**
    +
     
     429   -
          * Cycles through the cached web data sources and calls update on all of them.
    +
         /**
     430   -
          */
    +
          * Cycles through the cached web data sources and calls update on all of them.
     431   +
          */
    +  432  
         private void doUpdates() {
    -  432  0
             final UpdateService service = new UpdateService(serviceClassLoader);
    -  433  0
             final Iterator<CachedWebDataSource> iterator = service.getDataSources();
    -  434  0
             while (iterator.hasNext()) {
    -  435  0
                 final CachedWebDataSource source = iterator.next();
    -  436   +  433  0
             final UpdateService service = new UpdateService(serviceClassLoader);
    +  434  0
             final Iterator<CachedWebDataSource> iterator = service.getDataSources();
    +  435  0
             while (iterator.hasNext()) {
    +  436  0
                 final CachedWebDataSource source = iterator.next();
    +  437  
                 try {
    -  437  0
                     source.update();
    -  438  0
                 } catch (UpdateException ex) {
    -  439  0
                     LOGGER.log(Level.WARNING,
    -  440   +  438  0
                     source.update();
    +  439  0
                 } catch (UpdateException ex) {
    +  440  0
                     LOGGER.log(Level.WARNING,
    +  441  
                             "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.");
    -  441  0
                     LOGGER.log(Level.FINE,
    -  442   +  442  0
                     LOGGER.log(Level.FINE,
    +  443  
                             String.format("Unable to update details for %s", source.getClass().getName()), ex);
    -  443  0
                 }
    -  444  0
             }
    -  445  0
         }
    -  446   -
     
    +  444  0
                 }
    +  445  0
             }
    +  446  0
         }
     447   -
         /**
    +
     
     448   -
          * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used.
    +
         /**
     449   -
          *
    +
          * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used.
     450   -
          * @return a list of Analyzers
    +
          *
     451   -
          */
    +
          * @return a list of Analyzers
     452   +
          */
    +  453  
         public List<Analyzer> getAnalyzers() {
    -  453  0
             final List<Analyzer> ret = new ArrayList<Analyzer>();
    -  454  0
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  455  0
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  456  0
                 ret.addAll(analyzerList);
    -  457   +  454  0
             final List<Analyzer> ret = new ArrayList<Analyzer>();
    +  455  0
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  456  0
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  457  0
                 ret.addAll(analyzerList);
    +  458  
             }
    -  458  0
             return ret;
    -  459   -
         }
    +  459  0
             return ret;
     460   -
     
    -  461   -
         /**
    -  462   -
          * Checks all analyzers to see if an extension is supported.
    -  463   -
          *
    -  464   -
          * @param ext a file extension
    -  465   -
          * @return true or false depending on whether or not the file extension is supported
    -  466   -
          */
    -  467   -
         public boolean supportsExtension(String ext) {
    -  468  3404
             if (ext == null) {
    -  469  12
                 return false;
    -  470   -
             }
    -  471  3392
             boolean scan = false;
    -  472  3392
             for (FileTypeAnalyzer a : this.fileTypeAnalyzers) {
    -  473   -
                 /* note, we can't break early on this loop as the analyzers need to know if
    -  474   -
                  they have files to work on prior to initialization */
    -  475  16960
                 scan |= a.supportsExtension(ext);
    -  476  16960
             }
    -  477  3392
             return scan;
    -  478  
         }
    -  479   +  461  
     
    -  480   +  462  
         /**
    -  481   -
          * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown.
    -  482   +  463   +
          * Checks all analyzers to see if an extension is supported.
    +  464  
          *
    -  483   -
          * @throws NoDataException thrown if no data exists in the CPE Index
    -  484   -
          * @throws DatabaseException thrown if there is an exception opening the database
    -  485   +  465   +
          * @param ext a file extension
    +  466   +
          * @return true or false depending on whether or not the file extension is supported
    +  467  
          */
    -  486   -
         private void ensureDataExists() throws NoDataException, DatabaseException {
    -  487  4
             final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
    -  488  4
             final CveDB cve = new CveDB();
    -  489   -
     
    -  490   -
             try {
    -  491  4
                 cve.open();
    -  492  4
                 cpe.open(cve);
    -  493  0
             } catch (IndexException ex) {
    -  494  0
                 throw new NoDataException(ex.getMessage(), ex);
    -  495  0
             } catch (DatabaseException ex) {
    -  496  0
                 throw new NoDataException(ex.getMessage(), ex);
    -  497   -
             } finally {
    -  498  4
                 cve.close();
    -  499  4
             }
    -  500  4
             if (cpe.numDocs() <= 0) {
    -  501  0
                 cpe.close();
    -  502  0
                 throw new NoDataException("No documents exist");
    -  503   +  468   +
         public boolean supportsExtension(String ext) {
    +  469  851
             if (ext == null) {
    +  470  3
                 return false;
    +  471  
             }
    -  504  4
         }
    -  505   +  472  848
             boolean scan = false;
    +  473  848
             for (FileTypeAnalyzer a : this.fileTypeAnalyzers) {
    +  474   +
                 /* note, we can't break early on this loop as the analyzers need to know if
    +  475   +
                  they have files to work on prior to initialization */
    +  476  4240
                 scan |= a.supportsExtension(ext);
    +  477  4240
             }
    +  478  848
             return scan;
    +  479   +
         }
    +  480   +
     
    +  481   +
         /**
    +  482   +
          * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown.
    +  483   +
          *
    +  484   +
          * @throws NoDataException thrown if no data exists in the CPE Index
    +  485   +
          * @throws DatabaseException thrown if there is an exception opening the database
    +  486   +
          */
    +  487   +
         private void ensureDataExists() throws NoDataException, DatabaseException {
    +  488  1
             final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
    +  489  1
             final CveDB cve = new CveDB();
    +  490   +
     
    +  491   +
             try {
    +  492  1
                 cve.open();
    +  493  1
                 cpe.open(cve);
    +  494  0
             } catch (IndexException ex) {
    +  495  0
                 throw new NoDataException(ex.getMessage(), ex);
    +  496  0
             } catch (DatabaseException ex) {
    +  497  0
                 throw new NoDataException(ex.getMessage(), ex);
    +  498   +
             } finally {
    +  499  1
                 cve.close();
    +  500  1
             }
    +  501  1
             if (cpe.numDocs() <= 0) {
    +  502  0
                 cpe.close();
    +  503  0
                 throw new NoDataException("No documents exist");
    +  504   +
             }
    +  505  1
         }
    +  506  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html index fcab2f605..1a2ea361d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html @@ -1867,6 +1867,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html index 9960059cb..e64632f4f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html @@ -83,7 +83,7 @@
         public void initialize() throws Exception {
     33  
             //do nothing
    -  34  40
         }
    +  34  10
         }
     35  
     
     36   @@ -102,11 +102,11 @@
         public void close() throws Exception {
     43  
             //do nothing
    -  44  60
         }
    +  44  15
         }
     45  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html index 8966899b7..b78c0cb9e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html @@ -101,19 +101,19 @@
          * enabled.
     42  
          */
    -  43  116
         public AbstractFileTypeAnalyzer() {
    -  44  116
             final String key = getAnalyzerEnabledSettingKey();
    +  43  29
         public AbstractFileTypeAnalyzer() {
    +  44  29
             final String key = getAnalyzerEnabledSettingKey();
     45  
             try {
    -  46  116
                 enabled = Settings.getBoolean(key, true);
    +  46  29
                 enabled = Settings.getBoolean(key, true);
     47  0
             } catch (InvalidSettingException ex) {
     48  0
                 String msg = String.format("Invalid setting for property '%s'", key);
     49  0
                 LOGGER.log(Level.WARNING, msg);
     50  0
                 LOGGER.log(Level.FINE, "", ex);
     51  0
                 msg = String.format("%s has been disabled", getName());
     52  0
                 LOGGER.log(Level.WARNING, msg);
    -  53  116
             }
    -  54  116
         }
    +  53  29
             }
    +  54  29
         }
     55  
     //</editor-fold>
     56   @@ -126,14 +126,14 @@
          * The logger.
     60  
          */
    -  61  4
         private static final Logger LOGGER = Logger.getLogger(AbstractFileTypeAnalyzer.class.getName());
    +  61  1
         private static final Logger LOGGER = Logger.getLogger(AbstractFileTypeAnalyzer.class.getName());
     62  
         /**
     63  
          * Whether the file type analyzer detected any files it needs to analyze.
     64  
          */
    -  65  116
         private boolean filesMatched = false;
    +  65  29
         private boolean filesMatched = false;
     66  
     
     67   @@ -178,7 +178,7 @@
          * A flag indicating whether or not the analyzer is enabled.
     87  
          */
    -  88  116
         private boolean enabled = true;
    +  88  29
         private boolean enabled = true;
     89  
     
     90   @@ -321,14 +321,14 @@
         @Override
     159  
         public final void initialize() throws Exception {
    -  160  40
             if (filesMatched) {
    -  161  28
                 initializeFileTypeAnalyzer();
    +  160  10
             if (filesMatched) {
    +  161  7
                 initializeFileTypeAnalyzer();
     162  
             } else {
    -  163  12
                 enabled = false;
    +  163  3
                 enabled = false;
     164  
             }
    -  165  40
         }
    +  165  10
         }
     166  
     
     167   @@ -351,11 +351,11 @@
         @Override
     176  
         public final void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  177  40
             if (enabled) {
    -  178  40
                 analyzeFileType(dependency, engine);
    +  177  10
             if (enabled) {
    +  178  10
                 analyzeFileType(dependency, engine);
     179  
             }
    -  180  36
         }
    +  180  9
         }
     181  
     
     182   @@ -374,12 +374,12 @@
         @Override
     189  
         public final boolean supportsExtension(String extension) {
    -  190  17036
             if (!enabled) {
    -  191  3416
                 return false;
    +  190  4259
             if (!enabled) {
    +  191  854
                 return false;
     192  
             }
    -  193  13620
             final Set<String> ext = getSupportedExtensions();
    -  194  13620
             if (ext == null) {
    +  193  3405
             final Set<String> ext = getSupportedExtensions();
    +  194  3405
             if (ext == null) {
     195  0
                 final String msg = String.format("The '%s' analyzer is misconfigured and does not have any file extensions;"
     196  
                         + " it will be disabled", getName());
    @@ -387,12 +387,12 @@  198  0
                 return false;
     199  
             } else {
    -  200  13620
                 final boolean match = ext.contains(extension);
    -  201  13620
                 if (match) {
    -  202  64
                     filesMatched = match;
    +  200  3405
                 final boolean match = ext.contains(extension);
    +  201  3405
                 if (match) {
    +  202  16
                     filesMatched = match;
     203  
                 }
    -  204  13620
                 return match;
    +  204  3405
                 return match;
     205  
             }
     206   @@ -429,11 +429,11 @@
          */
     222  
         protected static Set<String> newHashSet(String... strings) {
    -  223  44
             final Set<String> set = new HashSet<String>();
    +  223  11
             final Set<String> set = new HashSet<String>();
     224  
     
    -  225  44
             Collections.addAll(set, strings);
    -  226  44
             return set;
    +  225  11
             Collections.addAll(set, strings);
    +  226  11
             return set;
     227  
         }
     228   @@ -442,6 +442,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html index 3c1d40a28..75b8720d0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html @@ -111,7 +111,7 @@
          * The Logger for use throughout the class
     47  
          */
    -  48  4
         private static final Logger LOGGER = Logger.getLogger(AbstractSuppressionAnalyzer.class.getName());
    +  48  1
         private static final Logger LOGGER = Logger.getLogger(AbstractSuppressionAnalyzer.class.getName());
     49  
     
     50   @@ -150,9 +150,9 @@
         @Override
     67  
         public void initialize() throws Exception {
    -  68  20
             super.initialize();
    -  69  20
             loadSuppressionData();
    -  70  16
         }
    +  68  5
             super.initialize();
    +  69  5
             loadSuppressionData();
    +  70  4
         }
     71  
     
     72   @@ -213,46 +213,46 @@
          */
     100  
         private void loadSuppressionData() throws SuppressionParseException {
    -  101  20
             final SuppressionParser parser = new SuppressionParser();
    -  102  20
             File file = null;
    +  101  5
             final SuppressionParser parser = new SuppressionParser();
    +  102  5
             File file = null;
     103  
             try {
    -  104  20
                 rules = parser.parseSuppressionRules(this.getClass().getClassLoader().getResourceAsStream("dependencycheck-base-suppression.xml"));
    +  104  5
                 rules = parser.parseSuppressionRules(this.getClass().getClassLoader().getResourceAsStream("dependencycheck-base-suppression.xml"));
     105  0
             } catch (SuppressionParseException ex) {
     106  0
                 LOGGER.log(Level.FINE, "Unable to parse the base suppression data file", ex);
    -  107  20
             }
    -  108  20
             final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
    -  109  20
             if (suppressionFilePath == null) {
    -  110  8
                 return;
    +  107  5
             }
    +  108  5
             final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
    +  109  5
             if (suppressionFilePath == null) {
    +  110  2
                 return;
     111  
             }
    -  112  12
             boolean deleteTempFile = false;
    +  112  3
             boolean deleteTempFile = false;
     113  
             try {
    -  114  12
                 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*", Pattern.CASE_INSENSITIVE);
    -  115  12
                 if (uriRx.matcher(suppressionFilePath).matches()) {
    -  116  4
                     deleteTempFile = true;
    -  117  4
                     file = FileUtils.getTempFile("suppression", "xml");
    -  118  4
                     final URL url = new URL(suppressionFilePath);
    +  114  3
                 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*", Pattern.CASE_INSENSITIVE);
    +  115  3
                 if (uriRx.matcher(suppressionFilePath).matches()) {
    +  116  1
                     deleteTempFile = true;
    +  117  1
                     file = FileUtils.getTempFile("suppression", "xml");
    +  118  1
                     final URL url = new URL(suppressionFilePath);
     119  
                     try {
    -  120  4
                         Downloader.fetchFile(url, file, false);
    +  120  1
                         Downloader.fetchFile(url, file, false);
     121  0
                     } catch (DownloadFailedException ex) {
     122  0
                         Downloader.fetchFile(url, file, true);
    -  123  4
                     }
    -  124  4
                 } else {
    -  125  8
                     file = new File(suppressionFilePath);
    -  126  8
                     if (!file.exists()) {
    -  127  8
                         final InputStream suppressionsFromClasspath = this.getClass().getClassLoader().getResourceAsStream(suppressionFilePath);
    -  128  8
                         if (suppressionsFromClasspath != null) {
    -  129  4
                             deleteTempFile = true;
    -  130  4
                             file = FileUtils.getTempFile("suppression", "xml");
    +  123  1
                     }
    +  124  1
                 } else {
    +  125  2
                     file = new File(suppressionFilePath);
    +  126  2
                     if (!file.exists()) {
    +  127  2
                         final InputStream suppressionsFromClasspath = this.getClass().getClassLoader().getResourceAsStream(suppressionFilePath);
    +  128  2
                         if (suppressionsFromClasspath != null) {
    +  129  1
                             deleteTempFile = true;
    +  130  1
                             file = FileUtils.getTempFile("suppression", "xml");
     131  
                             try {
    -  132  4
                                 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file);
    +  132  1
                                 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file);
     133  0
                             } catch (IOException ex) {
     134  0
                                 throwSuppressionParseException("Unable to locate suppressions file in classpath", ex);
    -  135  4
                             }
    +  135  1
                             }
     136  
                         }
     137   @@ -261,37 +261,37 @@
                 }
     139  
     
    -  140  12
                 if (file != null) {
    +  140  3
                 if (file != null) {
     141  
                     try {
     142  
                         //rules = parser.parseSuppressionRules(file);
    -  143  12
                         rules.addAll(parser.parseSuppressionRules(file));
    -  144  8
                         LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded.");
    -  145  4
                     } catch (SuppressionParseException ex) {
    -  146  4
                         final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath());
    -  147  4
                         LOGGER.log(Level.WARNING, msg);
    -  148  4
                         LOGGER.log(Level.WARNING, ex.getMessage());
    -  149  4
                         LOGGER.log(Level.FINE, "", ex);
    -  150  4
                         throw ex;
    -  151  8
                     }
    +  143  3
                         rules.addAll(parser.parseSuppressionRules(file));
    +  144  2
                         LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded.");
    +  145  1
                     } catch (SuppressionParseException ex) {
    +  146  1
                         final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath());
    +  147  1
                         LOGGER.log(Level.WARNING, msg);
    +  148  1
                         LOGGER.log(Level.WARNING, ex.getMessage());
    +  149  1
                         LOGGER.log(Level.FINE, "", ex);
    +  150  1
                         throw ex;
    +  151  2
                     }
     152  
                 }
     153  0
             } catch (DownloadFailedException ex) {
     154  0
                 throwSuppressionParseException("Unable to fetch the configured suppression file", ex);
     155  0
             } catch (MalformedURLException ex) {
     156  0
                 throwSuppressionParseException("Configured suppression file has an invalid URL", ex);
    -  157  4
             } catch (IOException ex) {
    -  158  4
                 throwSuppressionParseException("Unable to create temp file for suppressions", ex);
    +  157  1
             } catch (IOException ex) {
    +  158  1
                 throwSuppressionParseException("Unable to create temp file for suppressions", ex);
     159  
             } finally {
    -  160  12
                 if (deleteTempFile && file != null) {
    -  161  8
                     FileUtils.delete(file);
    +  160  3
                 if (deleteTempFile && file != null) {
    +  161  2
                     FileUtils.delete(file);
     162  
                 }
     163  
             }
    -  164  8
         }
    +  164  2
         }
     165  
     
     166   @@ -310,15 +310,15 @@
          */
     173  
         private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException {
    -  174  4
             LOGGER.log(Level.WARNING, message);
    -  175  4
             LOGGER.log(Level.FINE, "", exception);
    -  176  4
             throw new SuppressionParseException(message, exception);
    +  174  1
             LOGGER.log(Level.WARNING, message);
    +  175  1
             LOGGER.log(Level.FINE, "", exception);
    +  176  1
             throw new SuppressionParseException(message, exception);
     177  
         }
     178  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html index a80249bea..09ec25094 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html @@ -65,7 +65,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     24  
      */
    -  25  20
     public enum AnalysisPhase {
    +  25  5
     public enum AnalysisPhase {
     26  
     
     27   @@ -74,67 +74,67 @@
          * Initialization phase.
     29  
          */
    -  30  4
         INITIAL,
    +  30  1
         INITIAL,
     31  
         /**
     32  
          * Information collection phase.
     33  
          */
    -  34  4
         INFORMATION_COLLECTION,
    +  34  1
         INFORMATION_COLLECTION,
     35  
         /**
     36  
          * Pre identifier analysis phase.
     37  
          */
    -  38  4
         PRE_IDENTIFIER_ANALYSIS,
    +  38  1
         PRE_IDENTIFIER_ANALYSIS,
     39  
         /**
     40  
          * Identifier analysis phase.
     41  
          */
    -  42  4
         IDENTIFIER_ANALYSIS,
    +  42  1
         IDENTIFIER_ANALYSIS,
     43  
         /**
     44  
          * Post identifier analysis phase.
     45  
          */
    -  46  4
         POST_IDENTIFIER_ANALYSIS,
    +  46  1
         POST_IDENTIFIER_ANALYSIS,
     47  
         /**
     48  
          * Pre finding analysis phase.
     49  
          */
    -  50  4
         PRE_FINDING_ANALYSIS,
    +  50  1
         PRE_FINDING_ANALYSIS,
     51  
         /**
     52  
          * Finding analysis phase.
     53  
          */
    -  54  4
         FINDING_ANALYSIS,
    +  54  1
         FINDING_ANALYSIS,
     55  
         /**
     56  
          * Post analysis phase.
     57  
          */
    -  58  4
         POST_FINDING_ANALYSIS,
    +  58  1
         POST_FINDING_ANALYSIS,
     59  
         /**
     60  
          * The final analysis phase.
     61  
          */
    -  62  4
         FINAL
    +  62  1
         FINAL
     63  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html index 81828e277..69b3164e0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html @@ -161,6 +161,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html index 4c4acf08c..0010080a1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html @@ -97,9 +97,9 @@
          * @param classLoader the ClassLoader to use when dynamically loading Analyzer and Update services
     40  
          */
    -  41  8
         public AnalyzerService(ClassLoader classLoader) {
    -  42  8
             loader = ServiceLoader.load(Analyzer.class, classLoader);
    -  43  8
         }
    +  41  2
         public AnalyzerService(ClassLoader classLoader) {
    +  42  2
             loader = ServiceLoader.load(Analyzer.class, classLoader);
    +  43  2
         }
     44  
     
     45   @@ -114,13 +114,13 @@
          */
     50  
         public Iterator<Analyzer> getAnalyzers() {
    -  51  8
             return loader.iterator();
    +  51  2
             return loader.iterator();
     52  
         }
     53  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html index b0be520fd..0ac42c1d0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html @@ -143,7 +143,7 @@
          * The logger.
     63  
          */
    -  64  4
         private static final Logger LOGGER = Logger.getLogger(ArchiveAnalyzer.class.getName());
    +  64  1
         private static final Logger LOGGER = Logger.getLogger(ArchiveAnalyzer.class.getName());
     65  
         /**
     66   @@ -158,7 +158,7 @@
          * The count of directories created during analysis. This is used for creating temporary directories.
     71  
          */
    -  72  4
         private static int dirCount = 0;
    +  72  1
         private static int dirCount = 0;
     73  
         /**
     74   @@ -173,7 +173,7 @@
          * The max scan depth that the analyzer will recursively extract nested archives.
     79  
          */
    -  80  4
         private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3);
    +  80  1
         private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3);
     81  
         /**
     82   @@ -200,14 +200,14 @@
          * The phase that this analyzer is intended to run in.
     93  
          */
    -  94  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
    +  94  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
     95  
         /**
     96  
          * The set of things we can handle with Zip methods
     97  
          */
    -  98  4
         private static final Set<String> ZIPPABLES = newHashSet("zip", "ear", "war", "jar", "sar", "apk", "nupkg");
    +  98  1
         private static final Set<String> ZIPPABLES = newHashSet("zip", "ear", "war", "jar", "sar", "apk", "nupkg");
     99  
         /**
     100   @@ -216,7 +216,7 @@
          * to be explicitly handled in extractFiles().
     102  
          */
    -  103  4
         private static final Set<String> EXTENSIONS = newHashSet("tar", "gz", "tgz");
    +  103  1
         private static final Set<String> EXTENSIONS = newHashSet("tar", "gz", "tgz");
     104  
     
     105   @@ -225,19 +225,19 @@
          * The set of file extensions to remove from the engine's collection of dependencies.
     107  
          */
    -  108  4
         private static final Set<String> REMOVE_FROM_ANALYSIS = newHashSet("zip", "tar", "gz", "tgz"); //TODO add nupkg, apk, sar?
    +  108  1
         private static final Set<String> REMOVE_FROM_ANALYSIS = newHashSet("zip", "tar", "gz", "tgz"); //TODO add nupkg, apk, sar?
     109  
     
     110  
         static {
    -  111  4
             final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
    -  112  4
             if (additionalZipExt != null) {
    +  111  1
             final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
    +  112  1
             if (additionalZipExt != null) {
     113  0
                 final HashSet ext = new HashSet<String>(Arrays.asList(additionalZipExt));
     114  0
                 ZIPPABLES.addAll(ext);
     115  
             }
    -  116  4
             EXTENSIONS.addAll(ZIPPABLES);
    -  117  4
         }
    +  116  1
             EXTENSIONS.addAll(ZIPPABLES);
    +  117  1
         }
     118  
     
     119   @@ -254,7 +254,7 @@
         @Override
     125  
         public Set<String> getSupportedExtensions() {
    -  126  3400
             return EXTENSIONS;
    +  126  850
             return EXTENSIONS;
     127  
         }
     128   @@ -273,7 +273,7 @@
         @Override
     135  
         public String getName() {
    -  136  16
             return ANALYZER_NAME;
    +  136  4
             return ANALYZER_NAME;
     137  
         }
     138   @@ -292,7 +292,7 @@
         @Override
     145  
         public AnalysisPhase getAnalysisPhase() {
    -  146  4
             return ANALYSIS_PHASE;
    +  146  1
             return ANALYSIS_PHASE;
     147  
         }
     148   @@ -313,7 +313,7 @@
         @Override
     156  
         protected String getAnalyzerEnabledSettingKey() {
    -  157  8
             return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
    +  157  2
             return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
     158  
         }
     159   @@ -332,19 +332,19 @@
         @Override
     166  
         public void initializeFileTypeAnalyzer() throws Exception {
    -  167  4
             final File baseDir = Settings.getTempDirectory();
    -  168  4
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    -  169  4
             if (!tempFileLocation.delete()) {
    +  167  1
             final File baseDir = Settings.getTempDirectory();
    +  168  1
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    +  169  1
             if (!tempFileLocation.delete()) {
     170  0
                 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
     171  0
                 throw new AnalysisException(msg);
     172  
             }
    -  173  4
             if (!tempFileLocation.mkdirs()) {
    +  173  1
             if (!tempFileLocation.mkdirs()) {
     174  0
                 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
     175  0
                 throw new AnalysisException(msg);
     176  
             }
    -  177  4
         }
    +  177  1
         }
     178  
     
     179   @@ -361,16 +361,16 @@
         @Override
     185  
         public void close() throws Exception {
    -  186  4
             if (tempFileLocation != null && tempFileLocation.exists()) {
    -  187  4
                 LOGGER.log(Level.FINE, "Attempting to delete temporary files");
    -  188  4
                 final boolean success = FileUtils.delete(tempFileLocation);
    -  189  4
                 if (!success && tempFileLocation != null & tempFileLocation.exists()) {
    +  186  1
             if (tempFileLocation != null && tempFileLocation.exists()) {
    +  187  1
                 LOGGER.log(Level.FINE, "Attempting to delete temporary files");
    +  188  1
                 final boolean success = FileUtils.delete(tempFileLocation);
    +  189  1
                 if (!success && tempFileLocation != null & tempFileLocation.exists()) {
     190  0
                     LOGGER.log(Level.WARNING, "Failed to delete some temporary files, see the log for more details");
     191  
                 }
     192  
             }
    -  193  4
         }
    +  193  1
         }
     194  
     
     195   @@ -393,17 +393,17 @@
         @Override
     204  
         public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
    -  205  8
             final File f = new File(dependency.getActualFilePath());
    -  206  8
             final File tmpDir = getNextTempDirectory();
    -  207  8
             extractFiles(f, tmpDir, engine);
    +  205  2
             final File f = new File(dependency.getActualFilePath());
    +  206  2
             final File tmpDir = getNextTempDirectory();
    +  207  2
             extractFiles(f, tmpDir, engine);
     208  
     
     209  
             //make a copy
    -  210  8
             List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
    -  211  8
             engine.scan(tmpDir);
    -  212  8
             List<Dependency> newDependencies = engine.getDependencies();
    -  213  8
             if (dependencies.size() != newDependencies.size()) {
    +  210  2
             List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
    +  211  2
             engine.scan(tmpDir);
    +  212  2
             List<Dependency> newDependencies = engine.getDependencies();
    +  213  2
             if (dependencies.size() != newDependencies.size()) {
     214  
                 //get the new dependencies
     215  0
                 final Set<Dependency> dependencySet = new HashSet<Dependency>();
    @@ -443,7 +443,7 @@  238  0
                 }
     239  
             }
    -  240  8
             if (this.REMOVE_FROM_ANALYSIS.contains(dependency.getFileExtension())) {
    +  240  2
             if (this.REMOVE_FROM_ANALYSIS.contains(dependency.getFileExtension())) {
     241  0
                 if ("zip".equals(dependency.getFileExtension()) && isZipFileActuallyJarFile(dependency)) {
     242  0
                     final File tdir = getNextTempDirectory();
     243  0
                     final String fileName = dependency.getFileName();
    @@ -486,8 +486,8 @@  272  0
                 engine.getDependencies().remove(dependency);
     273  
             }
    -  274  8
             Collections.sort(engine.getDependencies());
    -  275  8
         }
    +  274  2
             Collections.sort(engine.getDependencies());
    +  275  2
         }
     276  
     
     277   @@ -504,20 +504,20 @@
          */
     283  
         private File getNextTempDirectory() throws AnalysisException {
    -  284  8
             dirCount += 1;
    -  285  8
             final File directory = new File(tempFileLocation, String.valueOf(dirCount));
    +  284  2
             dirCount += 1;
    +  285  2
             final File directory = new File(tempFileLocation, String.valueOf(dirCount));
     286  
             //getting an exception for some directories not being able to be created; might be because the directory already exists?
    -  287  8
             if (directory.exists()) {
    +  287  2
             if (directory.exists()) {
     288  0
                 return getNextTempDirectory();
     289  
             }
    -  290  8
             if (!directory.mkdirs()) {
    +  290  2
             if (!directory.mkdirs()) {
     291  0
                 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath());
     292  0
                 throw new AnalysisException(msg);
     293  
             }
    -  294  8
             return directory;
    +  294  2
             return directory;
     295  
         }
     296   @@ -540,25 +540,25 @@
          */
     305  
         private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
    -  306  8
             if (archive == null || destination == null) {
    +  306  2
             if (archive == null || destination == null) {
     307  0
                 return;
     308  
             }
     309  
     
    -  310  8
             FileInputStream fis = null;
    +  310  2
             FileInputStream fis = null;
     311  
             try {
    -  312  8
                 fis = new FileInputStream(archive);
    +  312  2
                 fis = new FileInputStream(archive);
     313  0
             } catch (FileNotFoundException ex) {
     314  0
                 LOGGER.log(Level.FINE, null, ex);
     315  0
                 throw new AnalysisException("Archive file was not found.", ex);
    -  316  8
             }
    -  317  8
             final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
    +  316  2
             }
    +  317  2
             final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
     318  
             try {
    -  319  8
                 if (ZIPPABLES.contains(archiveExt)) {
    -  320  8
                     extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
    +  319  2
                 if (ZIPPABLES.contains(archiveExt)) {
    +  320  2
                     extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
     321  0
                 } else if ("tar".equals(archiveExt)) {
     322  0
                     extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
     323  0
                 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) {
    @@ -581,12 +581,12 @@  338  
             } finally {
     339  0
                 try {
    -  340  8
                     fis.close();
    +  340  2
                     fis.close();
     341  0
                 } catch (IOException ex) {
     342  0
                     LOGGER.log(Level.FINEST, null, ex);
    -  343  8
                 }
    +  343  2
                 }
     344  0
             }
    -  345  8
         }
    +  345  2
         }
     346  
     
     347   @@ -611,21 +611,21 @@
             ArchiveEntry entry;
     357  
             try {
    -  358  3548
                 while ((entry = input.getNextEntry()) != null) {
    -  359  3540
                     if (entry.isDirectory()) {
    -  360  144
                         final File d = new File(destination, entry.getName());
    -  361  144
                         if (!d.exists()) {
    -  362  144
                             if (!d.mkdirs()) {
    +  358  887
                 while ((entry = input.getNextEntry()) != null) {
    +  359  885
                     if (entry.isDirectory()) {
    +  360  36
                         final File d = new File(destination, entry.getName());
    +  361  36
                         if (!d.exists()) {
    +  362  36
                             if (!d.mkdirs()) {
     363  0
                                 final String msg = String.format("Unable to create directory '%s'.", d.getAbsolutePath());
     364  0
                                 throw new AnalysisException(msg);
     365  
                             }
     366  
                         }
    -  367  144
                     } else {
    -  368  3396
                         final File file = new File(destination, entry.getName());
    -  369  3396
                         final String ext = FileUtils.getFileExtension(file.getName());
    -  370  3396
                         if (engine.supportsExtension(ext)) {
    +  367  36
                     } else {
    +  368  849
                         final File file = new File(destination, entry.getName());
    +  369  849
                         final String ext = FileUtils.getFileExtension(file.getName());
    +  370  849
                         if (engine.supportsExtension(ext)) {
     371  0
                             BufferedOutputStream bos = null;
     372  
                             FileOutputStream fos;
    @@ -673,7 +673,7 @@
                             }
     406  
                         }
    -  407  3396
                     }
    +  407  849
                     }
     408  
                 }
     409  0
             } catch (IOException ex) {
    @@ -682,18 +682,18 @@  412  0
                 throw new ArchiveExtractionException(ex);
     413  
             } finally {
    -  414  8
                 if (input != null) {
    +  414  2
                 if (input != null) {
     415  
                     try {
    -  416  8
                         input.close();
    +  416  2
                         input.close();
     417  0
                     } catch (IOException ex) {
     418  0
                         LOGGER.log(Level.FINEST, null, ex);
    -  419  8
                     }
    +  419  2
                     }
     420  
                 }
     421  
             }
    -  422  8
         }
    +  422  2
         }
     423  
     
     424   @@ -796,6 +796,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html index 160332252..098d9f500 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html @@ -135,14 +135,14 @@
          * The analysis phase
     59  
          */
    -  60  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  60  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     61  
         /**
     62  
          * The list of supported extensions
     63  
          */
    -  64  4
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("dll", "exe");
    +  64  1
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("dll", "exe");
     65  
         /**
     66   @@ -165,7 +165,7 @@
          * Logger
     75  
          */
    -  76  4
         private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzer.class.getName(), "dependencycheck-resources");
    +  76  1
         private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzer.class.getName(), "dependencycheck-resources");
     77  
     
     78   @@ -182,8 +182,8 @@
         private List<String> buildArgumentList() {
     84  
             // Use file.separator as a wild guess as to whether this is Windows
    -  85  32
             final List<String> args = new ArrayList<String>();
    -  86  32
             if (!"\\".equals(System.getProperty("file.separator"))) {
    +  85  8
             final List<String> args = new ArrayList<String>();
    +  86  8
             if (!"\\".equals(System.getProperty("file.separator"))) {
     87  0
                 if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null) {
     88  0
                     args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
     89   @@ -193,10 +193,10 @@
                 }
     92  
             }
    -  93  32
             args.add(grokAssemblyExe.getPath());
    +  93  8
             args.add(grokAssemblyExe.getPath());
     94  
     
    -  95  32
             return args;
    +  95  8
             return args;
     96  
         }
     97   @@ -221,83 +221,83 @@
         public void analyzeFileType(Dependency dependency, Engine engine)
     107  
                 throws AnalysisException {
    -  108  12
             if (grokAssemblyExe == null) {
    +  108  3
             if (grokAssemblyExe == null) {
     109  0
                 LOGGER.warning("analyzer.AssemblyAnalyzer.notdeployed");
     110  0
                 return;
     111  
             }
     112  
     
    -  113  12
             final List<String> args = buildArgumentList();
    -  114  12
             args.add(dependency.getActualFilePath());
    -  115  12
             final ProcessBuilder pb = new ProcessBuilder(args);
    -  116  12
             BufferedReader rdr = null;
    -  117  12
             Document doc = null;
    +  113  3
             final List<String> args = buildArgumentList();
    +  114  3
             args.add(dependency.getActualFilePath());
    +  115  3
             final ProcessBuilder pb = new ProcessBuilder(args);
    +  116  3
             BufferedReader rdr = null;
    +  117  3
             Document doc = null;
     118  
             try {
    -  119  12
                 final Process proc = pb.start();
    +  119  3
                 final Process proc = pb.start();
     120  
                 // Try evacuating the error stream
    -  121  12
                 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8"));
    -  122  12
                 String line = null;
    -  123  12
                 while (rdr.ready() && (line = rdr.readLine()) != null) {
    +  121  3
                 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8"));
    +  122  3
                 String line = null;
    +  123  3
                 while (rdr.ready() && (line = rdr.readLine()) != null) {
     124  0
                     LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.stderr", line);
     125  
                 }
    -  126  12
                 int rc = 0;
    -  127  12
                 doc = builder.parse(proc.getInputStream());
    +  126  3
                 int rc = 0;
    +  127  3
                 doc = builder.parse(proc.getInputStream());
     128  
     
     129  
                 try {
    -  130  12
                     rc = proc.waitFor();
    +  130  3
                     rc = proc.waitFor();
     131  0
                 } catch (InterruptedException ie) {
     132  
                     return;
    -  133  12
                 }
    -  134  12
                 if (rc == 3) {
    +  133  3
                 }
    +  134  3
                 if (rc == 3) {
     135  0
                     LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.notassembly", dependency.getActualFilePath());
     136  
                     return;
    -  137  12
                 } else if (rc != 0) {
    -  138  4
                     LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.rc", rc);
    +  137  3
                 } else if (rc != 0) {
    +  138  1
                     LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.rc", rc);
     139  
                 }
     140  
     
    -  141  12
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    +  141  3
                 final XPath xpath = XPathFactory.newInstance().newXPath();
     142  
     
     143  
                 // First, see if there was an error
    -  144  12
                 final String error = xpath.evaluate("/assembly/error", doc);
    -  145  12
                 if (error != null && !"".equals(error)) {
    -  146  4
                     throw new AnalysisException(error);
    +  144  3
                 final String error = xpath.evaluate("/assembly/error", doc);
    +  145  3
                 if (error != null && !"".equals(error)) {
    +  146  1
                     throw new AnalysisException(error);
     147  
                 }
     148  
     
    -  149  8
                 final String version = xpath.evaluate("/assembly/version", doc);
    -  150  8
                 if (version != null) {
    -  151  8
                     dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly", "version",
    +  149  2
                 final String version = xpath.evaluate("/assembly/version", doc);
    +  150  2
                 if (version != null) {
    +  151  2
                     dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly", "version",
     152  
                             version, Confidence.HIGHEST));
     153  
                 }
     154  
     
    -  155  8
                 final String vendor = xpath.evaluate("/assembly/company", doc);
    -  156  8
                 if (vendor != null) {
    -  157  8
                     dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly", "vendor",
    +  155  2
                 final String vendor = xpath.evaluate("/assembly/company", doc);
    +  156  2
                 if (vendor != null) {
    +  157  2
                     dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly", "vendor",
     158  
                             vendor, Confidence.HIGH));
     159  
                 }
     160  
     
    -  161  8
                 final String product = xpath.evaluate("/assembly/product", doc);
    -  162  8
                 if (product != null) {
    -  163  8
                     dependency.getProductEvidence().addEvidence(new Evidence("grokassembly", "product",
    +  161  2
                 final String product = xpath.evaluate("/assembly/product", doc);
    +  162  2
                 if (product != null) {
    +  163  2
                     dependency.getProductEvidence().addEvidence(new Evidence("grokassembly", "product",
     164  
                             product, Confidence.HIGH));
     165   @@ -314,18 +314,18 @@  173  0
                 throw new AnalysisException(xpe);
     174  
             } finally {
    -  175  12
                 if (rdr != null) {
    +  175  3
                 if (rdr != null) {
     176  
                     try {
    -  177  12
                         rdr.close();
    +  177  3
                         rdr.close();
     178  0
                     } catch (IOException ex) {
     179  0
                         LOGGER.log(Level.FINEST, "ignore", ex);
    -  180  16
                     }
    +  180  4
                     }
     181  
                 }
     182  
             }
    -  183  8
         }
    +  183  2
         }
     184  
     
     185   @@ -342,46 +342,46 @@
         @Override
     191  
         public void initializeFileTypeAnalyzer() throws Exception {
    -  192  20
             final File tempFile = File.createTempFile("GKA", ".exe", Settings.getTempDirectory());
    -  193  20
             FileOutputStream fos = null;
    -  194  20
             InputStream is = null;
    +  192  5
             final File tempFile = File.createTempFile("GKA", ".exe", Settings.getTempDirectory());
    +  193  5
             FileOutputStream fos = null;
    +  194  5
             InputStream is = null;
     195  
             try {
    -  196  20
                 fos = new FileOutputStream(tempFile);
    -  197  20
                 is = AssemblyAnalyzer.class.getClassLoader().getResourceAsStream("GrokAssembly.exe");
    -  198  20
                 final byte[] buff = new byte[4096];
    -  199  20
                 int bread = -1;
    -  200  60
                 while ((bread = is.read(buff)) >= 0) {
    -  201  40
                     fos.write(buff, 0, bread);
    +  196  5
                 fos = new FileOutputStream(tempFile);
    +  197  5
                 is = AssemblyAnalyzer.class.getClassLoader().getResourceAsStream("GrokAssembly.exe");
    +  198  5
                 final byte[] buff = new byte[4096];
    +  199  5
                 int bread = -1;
    +  200  15
                 while ((bread = is.read(buff)) >= 0) {
    +  201  10
                     fos.write(buff, 0, bread);
     202  
                 }
    -  203  20
                 grokAssemblyExe = tempFile;
    +  203  5
                 grokAssemblyExe = tempFile;
     204  
                 // Set the temp file to get deleted when we're done
    -  205  20
                 grokAssemblyExe.deleteOnExit();
    -  206  20
                 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.deployed", grokAssemblyExe.getPath());
    +  205  5
                 grokAssemblyExe.deleteOnExit();
    +  206  5
                 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.deployed", grokAssemblyExe.getPath());
     207  0
             } catch (IOException ioe) {
     208  0
                 this.setEnabled(false);
     209  0
                 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.notdeployed", ioe.getMessage());
     210  0
                 throw new AnalysisException("Could not extract GrokAssembly.exe", ioe);
     211  
             } finally {
    -  212  20
                 if (fos != null) {
    +  212  5
                 if (fos != null) {
     213  
                     try {
    -  214  20
                         fos.close();
    +  214  5
                         fos.close();
     215  0
                     } catch (Throwable e) {
     216  0
                         LOGGER.fine("Error closing output stream");
    -  217  20
                     }
    +  217  5
                     }
     218  
                 }
    -  219  20
                 if (is != null) {
    +  219  5
                 if (is != null) {
     220  
                     try {
    -  221  20
                         is.close();
    +  221  5
                         is.close();
     222  0
                     } catch (Throwable e) {
     223  0
                         LOGGER.fine("Error closing input stream");
    -  224  20
                     }
    +  224  5
                     }
     225  
                 }
     226   @@ -390,24 +390,24 @@
     
     228  
             // Now, need to see if GrokAssembly actually runs from this location.
    -  229  20
             final List<String> args = buildArgumentList();
    -  230  20
             BufferedReader rdr = null;
    +  229  5
             final List<String> args = buildArgumentList();
    +  230  5
             BufferedReader rdr = null;
     231  
             try {
    -  232  20
                 final ProcessBuilder pb = new ProcessBuilder(args);
    -  233  20
                 final Process p = pb.start();
    +  232  5
                 final ProcessBuilder pb = new ProcessBuilder(args);
    +  233  5
                 final Process p = pb.start();
     234  
                 // Try evacuating the error stream
    -  235  20
                 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8"));
    -  236  20
                 while (rdr.ready() && rdr.readLine() != null) {
    +  235  5
                 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8"));
    +  236  5
                 while (rdr.ready() && rdr.readLine() != null) {
     237  
                     // We expect this to complain
     238  
                 }
    -  239  20
                 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
    -  240  20
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    -  241  20
                 final String error = xpath.evaluate("/assembly/error", doc);
    -  242  20
                 if (p.waitFor() != 1 || error == null || "".equals(error)) {
    +  239  5
                 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
    +  240  5
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    +  241  5
                 final String error = xpath.evaluate("/assembly/error", doc);
    +  242  5
                 if (p.waitFor() != 1 || error == null || "".equals(error)) {
     243  0
                     LOGGER.warning("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details.");
     244  0
                     LOGGER.fine("GrokAssembly.exe is not working properly");
     245  0
                     grokAssemblyExe = null;
    @@ -428,36 +428,36 @@
                 }
     258  
             } finally {
    -  259  20
                 if (rdr != null) {
    +  259  5
                 if (rdr != null) {
     260  
                     try {
    -  261  20
                         rdr.close();
    +  261  5
                         rdr.close();
     262  0
                     } catch (IOException ex) {
     263  0
                         LOGGER.log(Level.FINEST, "ignore", ex);
    -  264  20
                     }
    +  264  5
                     }
     265  
                 }
     266  
             }
    -  267  20
             builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
    -  268  20
         }
    +  267  5
             builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
    +  268  5
         }
     269  
     
     270  
         @Override
     271  
         public void close() throws Exception {
    -  272  24
             super.close();
    +  272  6
             super.close();
     273  
             try {
    -  274  24
                 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
    +  274  6
                 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
     275  0
                     grokAssemblyExe.deleteOnExit();
     276  
                 }
     277  0
             } catch (SecurityException se) {
     278  0
                 LOGGER.fine("analyzer.AssemblyAnalyzer.grokassembly.notdeleted");
    -  279  24
             }
    -  280  24
         }
    +  279  6
             }
    +  280  6
         }
     281  
     
     282   @@ -474,7 +474,7 @@
         @Override
     288  
         public Set<String> getSupportedExtensions() {
    -  289  3412
             return SUPPORTED_EXTENSIONS;
    +  289  853
             return SUPPORTED_EXTENSIONS;
     290  
         }
     291   @@ -493,7 +493,7 @@
         @Override
     298  
         public String getName() {
    -  299  20
             return ANALYZER_NAME;
    +  299  5
             return ANALYZER_NAME;
     300  
         }
     301   @@ -512,7 +512,7 @@
         @Override
     308  
         public AnalysisPhase getAnalysisPhase() {
    -  309  4
             return ANALYSIS_PHASE;
    +  309  1
             return ANALYSIS_PHASE;
     310  
         }
     311   @@ -531,13 +531,13 @@
         @Override
     318  
         protected String getAnalyzerEnabledSettingKey() {
    -  319  28
             return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
    +  319  7
             return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
     320  
         }
     321  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html index be1d574b7..8a9b7fc3f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html @@ -12,9 +12,9 @@
     
    - - - + + +
    Classes in this File Line Coverage Branch Coverage Complexity
    CPEAnalyzer
    86%
    168/194
    74%
    94/126
    4.429
    CPEAnalyzer$IdentifierConfidence
    100%
    3/3
    N/A
    4.429
    CPEAnalyzer$IdentifierMatch
    40%
    12/30
    16%
    4/24
    4.429
    CPEAnalyzer
    83%
    164/197
    72%
    90/124
    4.444
    CPEAnalyzer$IdentifierConfidence
    100%
    4/4
    N/A
    4.444
    CPEAnalyzer$IdentifierMatch
    40%
    12/30
    16%
    4/24
    4.444
     
    @@ -145,7 +145,7 @@
          * The Logger.
     63  
          */
    -  64  4
         private static final Logger LOGGER = Logger.getLogger(CPEAnalyzer.class.getName());
    +  64  1
         private static final Logger LOGGER = Logger.getLogger(CPEAnalyzer.class.getName());
     65  
         /**
     66   @@ -228,7 +228,7 @@
         @Override
     105  
         public String getName() {
    -  106  16
             return "CPE Analyzer";
    +  106  4
             return "CPE Analyzer";
     107  
         }
     108   @@ -247,7 +247,7 @@
         @Override
     115  
         public AnalysisPhase getAnalysisPhase() {
    -  116  4
             return AnalysisPhase.IDENTIFIER_ANALYSIS;
    +  116  1
             return AnalysisPhase.IDENTIFIER_ANALYSIS;
     117  
         }
     118   @@ -266,8 +266,8 @@
         @Override
     125  
         public void initialize() throws Exception {
    -  126  4
             this.open();
    -  127  4
         }
    +  126  1
             this.open();
    +  127  1
         }
     128  
     
     129   @@ -286,19 +286,19 @@
          */
     136  
         public void open() throws IOException, DatabaseException {
    -  137  4
             LOGGER.log(Level.FINE, "Opening the CVE Database");
    -  138  4
             cve = new CveDB();
    -  139  4
             cve.open();
    -  140  4
             LOGGER.log(Level.FINE, "Creating the Lucene CPE Index");
    -  141  4
             cpe = CpeMemoryIndex.getInstance();
    +  137  1
             LOGGER.log(Level.FINE, "Opening the CVE Database");
    +  138  1
             cve = new CveDB();
    +  139  1
             cve.open();
    +  140  1
             LOGGER.log(Level.FINE, "Creating the Lucene CPE Index");
    +  141  1
             cpe = CpeMemoryIndex.getInstance();
     142  
             try {
    -  143  4
                 cpe.open(cve);
    +  143  1
                 cpe.open(cve);
     144  0
             } catch (IndexException ex) {
     145  0
                 LOGGER.log(Level.FINE, "IndexException", ex);
     146  0
                 throw new DatabaseException(ex);
    -  147  4
             }
    -  148  4
         }
    +  147  1
             }
    +  148  1
         }
     149  
     
     150   @@ -311,15 +311,15 @@
         @Override
     154  
         public void close() {
    -  155  4
             if (cpe != null) {
    -  156  4
                 cpe.close();
    +  155  1
             if (cpe != null) {
    +  156  1
                 cpe.close();
     157  
             }
    -  158  4
             if (cve != null) {
    -  159  4
                 cve.close();
    +  158  1
             if (cve != null) {
    +  159  1
                 cve.close();
     160  
             }
    -  161  4
         }
    +  161  1
         }
     162  
     
     163   @@ -342,389 +342,393 @@
          */
     172  
         protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
    -  173  8
             Confidence confidence = Confidence.HIGHEST;
    -  174   -
     
    -  175  8
             String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence);
    -  176  8
             String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence);
    -  177   -
             /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no
    -  178   -
              * CPE identified. As such, we are "using" the evidence and ignoring the results. */
    -  179  8
             addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    -  180   -
     
    -  181  8
             int ctr = 0;
    +  173   +
             //TODO test dojo-war against this. we shold get dojo-toolkit:dojo-toolkit AND dojo-toolkit:toolkit
    +  174  2
             String vendors = "";
    +  175  2
             String products = "";
    +  176  7
             for (Confidence confidence : Confidence.values()) {
    +  177  6
                 if (dependency.getVendorEvidence().contains(confidence)) {
    +  178  6
                     vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
    +  179   +
                 }
    +  180  6
                 if (dependency.getProductEvidence().contains(confidence)) {
    +  181  5
                     products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
     182   -
             do {
    -  183  32
                 if (!vendors.isEmpty() && !products.isEmpty()) {
    -  184  32
                     final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
    -  185   -
                             dependency.getVendorEvidence().getWeighting());
    -  186   -
     
    -  187  32
                     for (IndexEntry e : entries) {
    -  188  216
                         if (verifyEntry(e, dependency)) {
    -  189  16
                             final String vendor = e.getVendor();
    -  190  16
                             final String product = e.getProduct();
    -  191  16
                             determineIdentifiers(dependency, vendor, product);
    -  192   -
                         }
    -  193  216
                     }
    -  194  
                 }
    -  195  32
                 confidence = reduceConfidence(confidence);
    -  196  32
                 if (dependency.getVendorEvidence().contains(confidence)) {
    -  197  32
                     vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
    -  198   -
                 }
    -  199  32
                 if (dependency.getProductEvidence().contains(confidence)) {
    -  200  28
                     products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
    -  201   -
                 }
    -  202   +  183  
                 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no
    -  203   +  184  
                  * CPE identified. As such, we are "using" the evidence and ignoring the results. */
    -  204  32
                 if (dependency.getVersionEvidence().contains(confidence)) {
    -  205  24
                     addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    -  206   +  185   +
     //            if (dependency.getVersionEvidence().contains(confidence)) {
    +  186   +
     //                addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    +  187   +
     //            }
    +  188  6
                 if (!vendors.isEmpty() && !products.isEmpty()) {
    +  189  6
                     final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
    +  190   +
                             dependency.getVendorEvidence().getWeighting());
    +  191   +
     
    +  192  6
                     boolean identifierAdded = false;
    +  193  6
                     for (IndexEntry e : entries) {
    +  194  23
                         if (verifyEntry(e, dependency)) {
    +  195  2
                             final String vendor = e.getVendor();
    +  196  2
                             final String product = e.getProduct();
    +  197  2
                             identifierAdded |= determineIdentifiers(dependency, vendor, product, confidence);
    +  198   +
                         }
    +  199  23
                     }
    +  200  6
                     if (identifierAdded) {
    +  201  1
                         break;
    +  202   +
                     }
    +  203  
                 }
    -  207  32
             } while ((++ctr) < 4);
    -  208  8
         }
    -  209   +  204   +
             }
    +  205  2
         }
    +  206  
     
    -  210   +  207  
         /**
    -  211   +  208  
          * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a
    -  212   +  209  
          * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence
    -  213   +  210  
          * is longer then 200 characters it will be truncated.
    -  214   +  211  
          *
    -  215   +  212  
          * @param text the base text.
    -  216   +  213  
          * @param ec an EvidenceCollection
    -  217   +  214  
          * @param confidenceFilter a Confidence level to filter the evidence by.
    -  218   +  215  
          * @return the new evidence text
    -  219   +  216  
          */
    -  220   +  217  
         private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
    -  221  108
             final String txt = (text == null) ? "" : text;
    -  222  108
             final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
    -  223  108
             sb.append(' ').append(txt).append(' ');
    -  224  108
             for (Evidence e : ec.iterator(confidenceFilter)) {
    -  225  304
                 String value = e.getValue();
    -  226   +  218  11
             final String txt = (text == null) ? "" : text;
    +  219  11
             final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
    +  220  11
             sb.append(' ').append(txt).append(' ');
    +  221  11
             for (Evidence e : ec.iterator(confidenceFilter)) {
    +  222  39
                 String value = e.getValue();
    +  223  
     
    -  227   +  224  
                 //hack to get around the fact that lucene does a really good job of recognizing domains and not
    -  228   +  225  
                 // splitting them. TODO - put together a better lucene analyzer specific to the domain.
    -  229  304
                 if (value.startsWith("http://")) {
    -  230  16
                     value = value.substring(7).replaceAll("\\.", " ");
    +  226  39
                 if (value.startsWith("http://")) {
    +  227  2
                     value = value.substring(7).replaceAll("\\.", " ");
    +  228   +
                 }
    +  229  39
                 if (value.startsWith("https://")) {
    +  230  0
                     value = value.substring(8).replaceAll("\\.", " ");
     231  
                 }
    -  232  304
                 if (value.startsWith("https://")) {
    -  233  0
                     value = value.substring(8).replaceAll("\\.", " ");
    +  232  39
                 if (sb.indexOf(" " + value + " ") < 0) {
    +  233  34
                     sb.append(value).append(' ');
     234  
                 }
    -  235  304
                 if (sb.indexOf(" " + value + " ") < 0) {
    -  236  192
                     sb.append(value).append(' ');
    +  235  39
             }
    +  236  11
             return sb.toString().trim();
     237   -
                 }
    -  238  304
             }
    -  239  108
             return sb.toString().trim();
    +
         }
    +  238   +
     
    +  239   +
         /**
     240   -
         }
    +
          * <p>
     241   -
     
    -  242   -
         /**
    -  243   -
          * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH.
    -  244   -
          *
    -  245   -
          * @param c the confidence to reduce.
    -  246   -
          * @return One less then the confidence passed in.
    -  247   -
          */
    -  248   -
         private Confidence reduceConfidence(final Confidence c) {
    -  249  32
             if (c == Confidence.HIGHEST) {
    -  250  8
                 return Confidence.HIGH;
    -  251  24
             } else if (c == Confidence.HIGH) {
    -  252  8
                 return Confidence.MEDIUM;
    -  253   -
             } else {
    -  254  16
                 return Confidence.LOW;
    -  255   -
             }
    -  256   -
         }
    -  257   -
     
    -  258   -
         /**
    -  259   -
          * <p>
    -  260  
          * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and
    -  261   +  242  
          * version.</p>
    -  262   +  243  
          *
    -  263   +  244  
          * <p>
    -  264   +  245  
          * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting
    -  265   +  246  
          * factors to the search.</p>
    -  266   +  247  
          *
    -  267   +  248  
          * @param vendor the text used to search the vendor field
    -  268   +  249  
          * @param product the text used to search the product field
    -  269   +  250  
          * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field
    -  270   +  251  
          * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search
    -  271   +  252  
          * @return a list of possible CPE values
    -  272   +  253  
          * @throws CorruptIndexException when the Lucene index is corrupt
    -  273   +  254  
          * @throws IOException when the Lucene index is not found
    -  274   +  255  
          * @throws ParseException when the generated query is not valid
    -  275   +  256  
          */
    -  276   +  257  
         protected List<IndexEntry> searchCPE(String vendor, String product,
    -  277   +  258  
                 Set<String> vendorWeightings, Set<String> productWeightings)
    -  278   +  259  
                 throws CorruptIndexException, IOException, ParseException {
    -  279  32
             final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
    -  280   +  260  6
             final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
    +  261  
     
    -  281  32
             final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
    -  282  32
             if (searchString == null) {
    -  283  0
                 return ret;
    -  284   +  262  6
             final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
    +  263  6
             if (searchString == null) {
    +  264  0
                 return ret;
    +  265  
             }
    -  285   +  266  
     
    -  286  32
             final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
    -  287  832
             for (ScoreDoc d : docs.scoreDocs) {
    -  288  800
                 if (d.score >= 0.08) {
    -  289  216
                     final Document doc = cpe.getDocument(d.doc);
    -  290  216
                     final IndexEntry entry = new IndexEntry();
    -  291  216
                     entry.setVendor(doc.get(Fields.VENDOR));
    -  292  216
                     entry.setProduct(doc.get(Fields.PRODUCT));
    -  293   +  267  6
             final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
    +  268  156
             for (ScoreDoc d : docs.scoreDocs) {
    +  269  150
                 if (d.score >= 0.08) {
    +  270  23
                     final Document doc = cpe.getDocument(d.doc);
    +  271  23
                     final IndexEntry entry = new IndexEntry();
    +  272  23
                     entry.setVendor(doc.get(Fields.VENDOR));
    +  273  23
                     entry.setProduct(doc.get(Fields.PRODUCT));
    +  274  
     //                if (d.score < 0.08) {
    -  294   +  275  
     //                    System.out.print(entry.getVendor());
    -  295   +  276  
     //                    System.out.print(":");
    -  296   +  277  
     //                    System.out.print(entry.getProduct());
    -  297   +  278  
     //                    System.out.print(":");
    -  298   +  279  
     //                    System.out.println(d.score);
    -  299   +  280  
     //                }
    -  300  216
                     entry.setSearchScore(d.score);
    -  301  216
                     if (!ret.contains(entry)) {
    -  302  216
                         ret.add(entry);
    -  303   +  281  23
                     entry.setSearchScore(d.score);
    +  282  23
                     if (!ret.contains(entry)) {
    +  283  23
                         ret.add(entry);
    +  284  
                     }
    -  304   +  285  
                 }
    -  305   +  286  
             }
    -  306  32
             return ret;
    -  307   +  287  6
             return ret;
    +  288  
         }
    -  308   +  289  
     
    -  309   +  290  
         /**
    -  310   +  291  
          * <p>
    -  311   +  292  
          * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p>
    -  312   +  293  
          *
    -  313   +  294  
          * <p>
    -  314   +  295  
          * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting
    -  315   +  296  
          * factors to the search string generated.</p>
    -  316   +  297  
          *
    -  317   +  298  
          * @param vendor text to search the vendor field
    -  318   +  299  
          * @param product text to search the product field
    -  319   +  300  
          * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight
    -  320   +  301  
          * @param productWeightings a list of strings to apply to the product to boost the terms weight
    -  321   +  302  
          * @return the Lucene query
    -  322   +  303  
          */
    -  323   +  304  
         protected String buildSearch(String vendor, String product,
    -  324   +  305  
                 Set<String> vendorWeighting, Set<String> productWeightings) {
    -  325  32
             final String v = vendor; //.replaceAll("[^\\w\\d]", " ");
    -  326  32
             final String p = product; //.replaceAll("[^\\w\\d]", " ");
    -  327  32
             final StringBuilder sb = new StringBuilder(v.length() + p.length()
    -  328   +  306  6
             final String v = vendor; //.replaceAll("[^\\w\\d]", " ");
    +  307  6
             final String p = product; //.replaceAll("[^\\w\\d]", " ");
    +  308  6
             final StringBuilder sb = new StringBuilder(v.length() + p.length()
    +  309  
                     + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
    -  329   +  310  
     
    -  330  32
             if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
    -  331  0
                 return null;
    -  332   +  311  6
             if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
    +  312  0
                 return null;
    +  313  
             }
    -  333  32
             sb.append(" AND ");
    -  334  32
             if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
    -  335  0
                 return null;
    -  336   +  314  6
             sb.append(" AND ");
    +  315  6
             if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
    +  316  0
                 return null;
    +  317  
             }
    -  337  32
             return sb.toString();
    -  338   +  318  6
             return sb.toString();
    +  319  
         }
    -  339   +  320  
     
    -  340   +  321  
         /**
    -  341   +  322  
          * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the
    -  342   +  323  
          * word is within the list of weighted words then an additional weighting is applied to the term as it is appended
    -  343   +  324  
          * into the query.
    -  344   +  325  
          *
    -  345   +  326  
          * @param sb a StringBuilder that the query text will be appended to.
    -  346   +  327  
          * @param field the field within the Lucene index that the query is searching.
    -  347   +  328  
          * @param searchText text used to construct the query.
    -  348   +  329  
          * @param weightedText a list of terms that will be considered higher importance when searching.
    -  349   +  330  
          * @return if the append was successful.
    -  350   +  331  
          */
    -  351   +  332  
         private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
    -  352  64
             sb.append(" ").append(field).append(":( ");
    -  353   +  333  12
             sb.append(" ").append(field).append(":( ");
    +  334  
     
    -  354  64
             final String cleanText = cleanseText(searchText);
    -  355   +  335  12
             final String cleanText = cleanseText(searchText);
    +  336  
     
    -  356  64
             if ("".equals(cleanText)) {
    -  357  0
                 return false;
    -  358   +  337  12
             if ("".equals(cleanText)) {
    +  338  0
                 return false;
    +  339  
             }
    -  359   +  340  
     
    -  360  64
             if (weightedText == null || weightedText.isEmpty()) {
    -  361  0
                 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
    -  362   +  341  12
             if (weightedText == null || weightedText.isEmpty()) {
    +  342  0
                 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
    +  343  
             } else {
    -  363  64
                 final StringTokenizer tokens = new StringTokenizer(cleanText);
    -  364  960
                 while (tokens.hasMoreElements()) {
    -  365  896
                     final String word = tokens.nextToken();
    -  366  896
                     String temp = null;
    -  367  896
                     for (String weighted : weightedText) {
    -  368  1632
                         final String weightedStr = cleanseText(weighted);
    -  369  1632
                         if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
    -  370  120
                             temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
    -  371  120
                             if (!word.equalsIgnoreCase(weightedStr)) {
    -  372  0
                                 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
    -  373   +  344  12
                 final StringTokenizer tokens = new StringTokenizer(cleanText);
    +  345  108
                 while (tokens.hasMoreElements()) {
    +  346  96
                     final String word = tokens.nextToken();
    +  347  96
                     String temp = null;
    +  348  96
                     for (String weighted : weightedText) {
    +  349  215
                         final String weightedStr = cleanseText(weighted);
    +  350  215
                         if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
    +  351  22
                             temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
    +  352  22
                             if (!word.equalsIgnoreCase(weightedStr)) {
    +  353  0
                                 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
    +  354  
                             }
    -  374   +  355  
                         }
    -  375  1632
                     }
    -  376  896
                     if (temp == null) {
    -  377  776
                         temp = LuceneUtils.escapeLuceneQuery(word);
    -  378   +  356  215
                     }
    +  357  96
                     if (temp == null) {
    +  358  74
                         temp = LuceneUtils.escapeLuceneQuery(word);
    +  359  
                     }
    -  379  896
                     sb.append(" ").append(temp);
    -  380  896
                 }
    -  381   +  360  96
                     sb.append(" ").append(temp);
    +  361  96
                 }
    +  362  
             }
    -  382  64
             sb.append(" ) ");
    -  383  64
             return true;
    -  384   +  363  12
             sb.append(" ) ");
    +  364  12
             return true;
    +  365  
         }
    -  385   +  366  
     
    -  386   +  367  
         /**
    -  387   +  368  
          * Removes characters from the input text that are not used within the CPE index.
    -  388   +  369  
          *
    -  389   +  370  
          * @param text is the text to remove the characters from.
    -  390   +  371  
          * @return the text having removed some characters.
    -  391   +  372  
          */
    -  392   +  373  
         private String cleanseText(String text) {
    -  393  1696
             return text.replaceAll(CLEANSE_CHARACTER_RX, " ");
    -  394   +  374  227
             return text.replaceAll(CLEANSE_CHARACTER_RX, " ");
    +  375  
         }
    -  395   +  376  
     
    -  396   +  377  
         /**
    -  397   +  378  
          * Compares two strings after lower casing them and removing the non-alpha characters.
    -  398   +  379  
          *
    -  399   +  380  
          * @param l string one to compare.
    -  400   +  381  
          * @param r string two to compare.
    -  401   +  382  
          * @return whether or not the two strings are similar.
    -  402   +  383  
          */
    -  403   +  384  
         private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
    -  404  1632
             if (l == null || r == null) {
    -  405  0
                 return false;
    -  406   +  385  215
             if (l == null || r == null) {
    +  386  0
                 return false;
    +  387  
             }
    -  407   +  388  
     
    -  408  1632
             final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "");
    -  409  1632
             final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "");
    -  410  1632
             return left.equalsIgnoreCase(right);
    +  389  215
             final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "");
    +  390  215
             final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "");
    +  391  215
             return left.equalsIgnoreCase(right);
    +  392   +
         }
    +  393   +
     
    +  394   +
         /**
    +  395   +
          * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version
    +  396   +
          * information for the CPE are contained within the dependencies evidence.
    +  397   +
          *
    +  398   +
          * @param entry a CPE entry.
    +  399   +
          * @param dependency the dependency that the CPE entries could be for.
    +  400   +
          * @return whether or not the entry is valid.
    +  401   +
          */
    +  402   +
         private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
    +  403  23
             boolean isValid = false;
    +  404   +
     
    +  405  23
             if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
    +  406   +
                     && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
    +  407   +
                 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion())
    +  408  2
                 isValid = true;
    +  409   +
             }
    +  410  23
             return isValid;
     411  
         }
     412   @@ -732,586 +736,580 @@  413  
         /**
     414   -
          * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version
    -  415   -
          * information for the CPE are contained within the dependencies evidence.
    -  416   -
          *
    -  417   -
          * @param entry a CPE entry.
    -  418   -
          * @param dependency the dependency that the CPE entries could be for.
    -  419   -
          * @return whether or not the entry is valid.
    -  420   -
          */
    -  421   -
         private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
    -  422  216
             boolean isValid = false;
    -  423   -
     
    -  424  216
             if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
    -  425   -
                     && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
    -  426   -
                 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion())
    -  427  16
                 isValid = true;
    -  428   -
             }
    -  429  216
             return isValid;
    -  430   -
         }
    -  431   -
     
    -  432   -
         /**
    -  433  
          * Used to determine if the EvidenceCollection contains a specific string.
    -  434   +  415  
          *
    -  435   +  416  
          * @param ec an EvidenceCollection
    -  436   +  417  
          * @param text the text to search for
    -  437   +  418  
          * @return whether or not the EvidenceCollection contains the string
    -  438   +  419  
          */
    -  439   +  420  
         private boolean collectionContainsString(EvidenceCollection ec, String text) {
    -  440   +  421  
     
    -  441   +  422  
             //<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done">
    -  442   +  423  
             //        String[] splitText = text.split("[\\s_-]");
    -  443   +  424  
             //
    -  444   +  425  
             //        for (String search : splitText) {
    -  445   +  426  
             //            //final String search = text.replaceAll("[\\s_-]", "").toLowerCase();
    -  446   +  427  
             //            if (ec.containsUsedString(search)) {
    -  447   +  428  
             //                return true;
    -  448   +  429  
             //            }
    -  449   +  430  
             //        }
    -  450   +  431  
             //</editor-fold>
    -  451   +  432  
             //TODO - likely need to change the split... not sure if this will work for CPE with special chars
    -  452  236
             if (text == null) {
    -  453  0
                 return false;
    -  454   +  433  25
             if (text == null) {
    +  434  0
                 return false;
    +  435  
             }
    -  455  236
             final String[] words = text.split("[\\s_-]");
    -  456  236
             final List<String> list = new ArrayList<String>();
    -  457  236
             String tempWord = null;
    -  458  696
             for (String word : words) {
    -  459   +  436  25
             final String[] words = text.split("[\\s_-]");
    +  437  25
             final List<String> list = new ArrayList<String>();
    +  438  25
             String tempWord = null;
    +  439  83
             for (String word : words) {
    +  440  
                 /*
    -  460   +  441  
                  single letter words should be concatenated with the next word.
    -  461   +  442  
                  so { "m", "core", "sample" } -> { "mcore", "sample" }
    -  462   +  443  
                  */
    -  463  460
                 if (tempWord != null) {
    -  464  16
                     list.add(tempWord + word);
    -  465  16
                     tempWord = null;
    -  466  444
                 } else if (word.length() <= 2) {
    -  467  16
                     tempWord = word;
    -  468   +  444  58
                 if (tempWord != null) {
    +  445  2
                     list.add(tempWord + word);
    +  446  2
                     tempWord = null;
    +  447  56
                 } else if (word.length() <= 2) {
    +  448  2
                     tempWord = word;
    +  449  
                 } else {
    -  469  428
                     list.add(word);
    -  470   +  450  54
                     list.add(word);
    +  451  
                 }
    -  471   +  452  
             }
    -  472  236
             if (tempWord != null && !list.isEmpty()) {
    -  473  0
                 final String tmp = list.get(list.size() - 1) + tempWord;
    -  474  0
                 list.add(tmp);
    -  475   +  453  25
             if (tempWord != null && !list.isEmpty()) {
    +  454  0
                 final String tmp = list.get(list.size() - 1) + tempWord;
    +  455  0
                 list.add(tmp);
    +  456  
             }
    -  476  236
             boolean contains = true;
    -  477  236
             for (String word : list) {
    -  478  444
                 contains &= ec.containsUsedString(word);
    -  479  444
             }
    -  480  236
             return contains;
    -  481   +  457  25
             boolean contains = true;
    +  458  25
             for (String word : list) {
    +  459  56
                 contains &= ec.containsUsedString(word);
    +  460  56
             }
    +  461  25
             return contains;
    +  462  
         }
    -  482   +  463  
     
    -  483   +  464  
         /**
    -  484   +  465  
          * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    -  485   +  466  
          *
    -  486   +  467  
          * @param dependency The Dependency to analyze.
    -  487   +  468  
          * @param engine The analysis engine
    -  488   +  469  
          * @throws AnalysisException is thrown if there is an issue analyzing the dependency.
    -  489   +  470  
          */
    -  490   +  471  
         @Override
    -  491   +  472  
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  492   +  473  
             try {
    -  493  8
                 determineCPE(dependency);
    -  494  0
             } catch (CorruptIndexException ex) {
    -  495  0
                 throw new AnalysisException("CPE Index is corrupt.", ex);
    -  496  0
             } catch (IOException ex) {
    -  497  0
                 throw new AnalysisException("Failure opening the CPE Index.", ex);
    -  498  0
             } catch (ParseException ex) {
    -  499  0
                 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex);
    -  500  8
             }
    -  501  8
         }
    -  502   +  474  2
                 determineCPE(dependency);
    +  475  0
             } catch (CorruptIndexException ex) {
    +  476  0
                 throw new AnalysisException("CPE Index is corrupt.", ex);
    +  477  0
             } catch (IOException ex) {
    +  478  0
                 throw new AnalysisException("Failure opening the CPE Index.", ex);
    +  479  0
             } catch (ParseException ex) {
    +  480  0
                 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex);
    +  481  2
             }
    +  482  2
         }
    +  483  
     
    -  503   +  484  
         /**
    -  504   +  485  
          * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then
    -  505   +  486  
          * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a
    -  506   +  487  
          * best effort "guess" based on the vendor, product, and version information.
    -  507   +  488  
          *
    -  508   +  489  
          * @param dependency the Dependency being analyzed
    -  509   +  490  
          * @param vendor the vendor for the CPE being analyzed
    -  510   +  491  
          * @param product the product for the CPE being analyzed
    -  511   +  492   +
          * @return <code>true</code> if an identifier was added to the dependency; otherwise <code>false</code>
    +  493  
          * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported
    -  512   +  494  
          */
    -  513   -
         private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException {
    -  514  16
             final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
    -  515  16
             DependencyVersion bestGuess = new DependencyVersion("-");
    -  516  16
             Confidence bestGuessConf = null;
    -  517  16
             final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
    -  518  80
             for (Confidence conf : Confidence.values()) {
    -  519  64
                 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
    -  520  64
                     final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
    -  521  64
                     if (evVer == null) {
    -  522  0
                         continue;
    -  523   +  495   +
         private boolean determineIdentifiers(Dependency dependency, String vendor, String product, Confidence currentConfidence) throws UnsupportedEncodingException {
    +  496  2
             final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
    +  497  2
             DependencyVersion bestGuess = new DependencyVersion("-");
    +  498  2
             Confidence bestGuessConf = null;
    +  499  2
             boolean hasBroadMatch = false;
    +  500  2
             final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
    +  501  10
             for (Confidence conf : Confidence.values()) {
    +  502   +
     //            if (conf.compareTo(currentConfidence) > 0) {
    +  503   +
     //                break;
    +  504   +
     //            }
    +  505  8
                 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
    +  506  8
                     final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
    +  507  8
                     if (evVer == null) {
    +  508  0
                         continue;
    +  509  
                     }
    -  524  64
                     for (VulnerableSoftware vs : cpes) {
    -  525   +  510  8
                     for (VulnerableSoftware vs : cpes) {
    +  511  
                         DependencyVersion dbVer;
    -  526  2496
                         if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
    -  527  1024
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
    -  528   +  512  312
                         if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
    +  513  128
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
    +  514  
                         } else {
    -  529  1472
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
    -  530   +  515  184
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
    +  516  
                         }
    -  531  2496
                         if (dbVer == null //special case, no version specified - everything is vulnerable
    -  532   -
                                 || evVer.equals(dbVer)) { //yeah! exact match
    -  533   -
     
    -  534  64
                             final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8"));
    -  535  64
                             final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
    -  536  64
                             collected.add(match);
    -  537  64
                         } else {
    -  538   +  517  312
                         if (dbVer == null) { //special case, no version specified - everything is vulnerable
    +  518  0
                             hasBroadMatch = true;
    +  519  0
                             final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8"));
    +  520  0
                             final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.BROAD_MATCH, conf);
    +  521  0
                             collected.add(match);
    +  522  0
                         } else if (evVer.equals(dbVer)) { //yeah! exact match
    +  523  8
                             final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8"));
    +  524  8
                             final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
    +  525  8
                             collected.add(match);
    +  526  8
                         } else {
    +  527  
                             //TODO the following isn't quite right is it? need to think about this guessing game a bit more.
    -  539  2432
                             if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
    -  540   +  528  304
                             if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
    +  529  
                                     && evVer.matchesAtLeastThreeLevels(dbVer)) {
    -  541  512
                                 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    -  542  16
                                     if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
    -  543  16
                                         bestGuess = dbVer;
    -  544  16
                                         bestGuessConf = conf;
    -  545   +  530  64
                                 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    +  531  2
                                     if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
    +  532  2
                                         bestGuess = dbVer;
    +  533  2
                                         bestGuessConf = conf;
    +  534  
                                     }
    -  546   +  535  
                                 }
    -  547   +  536  
                             }
    -  548   +  537  
                         }
    -  549  2496
                     }
    -  550  64
                     if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    -  551  0
                         if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
    -  552  0
                             bestGuess = evVer;
    -  553  0
                             bestGuessConf = conf;
    -  554   +  538  312
                     }
    +  539  8
                     if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    +  540  0
                         if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
    +  541  0
                             bestGuess = evVer;
    +  542  0
                             bestGuessConf = conf;
    +  543  
                         }
    +  544   +
                     }
    +  545  8
                 }
    +  546   +
             }
    +  547  2
             final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString());
    +  548  2
             String url = null;
    +  549  2
             if (hasBroadMatch) { //if we have a broad match we can add the URL to the best guess.
    +  550  0
                 final String cpeUrlName = String.format("cpe:/a:%s:%s", vendor, product);
    +  551  0
                 url = String.format(NVD_SEARCH_URL, URLEncoder.encode(cpeUrlName, "UTF-8"));
    +  552   +
             }
    +  553  2
             if (bestGuessConf == null) {
    +  554  0
                 bestGuessConf = Confidence.LOW;
     555   -
                     }
    -  556  64
                 }
    -  557  
             }
    -  558  16
             final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString());
    -  559  16
             final String url = null;
    -  560  16
             if (bestGuessConf == null) {
    -  561  0
                 bestGuessConf = Confidence.LOW;
    -  562   -
             }
    -  563  16
             final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
    -  564  16
             collected.add(match);
    +  556  2
             final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
    +  557  2
             collected.add(match);
    +  558   +
     
    +  559  2
             Collections.sort(collected);
    +  560  2
             final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
    +  561  2
             final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
    +  562  2
             boolean identifierAdded = false;
    +  563  2
             for (IdentifierMatch m : collected) {
    +  564  10
                 if (bestIdentifierQuality.equals(m.getConfidence())
     565   -
     
    -  566  16
             Collections.sort(collected);
    -  567  16
             final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
    -  568  16
             final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
    -  569  16
             for (IdentifierMatch m : collected) {
    -  570  80
                 if (bestIdentifierQuality.equals(m.getConfidence())
    -  571  
                         && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
    -  572  16
                     final Identifier i = m.getIdentifier();
    -  573  16
                     if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
    -  574  0
                         i.setConfidence(Confidence.LOW);
    -  575   +  566  2
                     final Identifier i = m.getIdentifier();
    +  567  2
                     if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
    +  568  0
                         i.setConfidence(Confidence.LOW);
    +  569  
                     } else {
    -  576  16
                         i.setConfidence(bestEvidenceQuality);
    -  577   +  570  2
                         i.setConfidence(bestEvidenceQuality);
    +  571  
                     }
    -  578  16
                     dependency.addIdentifier(i);
    -  579   +  572  2
                     dependency.addIdentifier(i);
    +  573  2
                     identifierAdded = true;
    +  574  
                 }
    -  580  80
             }
    -  581  16
         }
    -  582   +  575  10
             }
    +  576  2
             return identifierAdded;
    +  577   +
         }
    +  578  
     
    -  583   +  579  
         /**
    -  584   +  580  
          * The confidence whether the identifier is an exact match, or a best guess.
    -  585   +  581  
          */
    -  586  4
         private enum IdentifierConfidence {
    -  587   +  582  1
         private enum IdentifierConfidence {
    +  583  
     
    +  584   +
             /**
    +  585   +
              * An exact match for the CPE.
    +  586   +
              */
    +  587  1
             EXACT_MATCH,
     588  
             /**
     589   -
              * An exact match for the CPE.
    +
              * A best guess for the CPE.
     590  
              */
    -  591  4
             EXACT_MATCH,
    +  591  1
             BEST_GUESS,
     592  
             /**
     593   -
              * A best guess for the CPE.
    +
              * The entire vendor/product group must be added (without a guess at version) because there is a CVE with a VS
     594   +
              * that only specifies vendor/product.
    +  595  
              */
    -  595  4
             BEST_GUESS
    -  596   -
         }
    +  596  1
             BROAD_MATCH
     597   -
     
    -  598   -
         /**
    -  599   -
          * A simple object to hold an identifier and carry information about the confidence in the identifier.
    -  600   -
          */
    -  601  64
         private static class IdentifierMatch implements Comparable<IdentifierMatch> {
    -  602   -
     
    -  603   -
             /**
    -  604   -
              * Constructs an IdentifierMatch.
    -  605   -
              *
    -  606   -
              * @param type the type of identifier (such as CPE)
    -  607   -
              * @param value the value of the identifier
    -  608   -
              * @param url the URL of the identifier
    -  609   -
              * @param identifierConfidence the confidence in the identifier: best guess or exact match
    -  610   -
              * @param evidenceConfidence the confidence of the evidence used to find the identifier
    -  611   -
              */
    -  612  80
             IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
    -  613  80
                 this.identifier = new Identifier(type, value, url);
    -  614  80
                 this.confidence = identifierConfidence;
    -  615  80
                 this.evidenceConfidence = evidenceConfidence;
    -  616  80
             }
    -  617   -
             //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier">
    -  618   -
             /**
    -  619   -
              * The confidence in the evidence used to identify this match.
    -  620   -
              */
    -  621   -
             private Confidence evidenceConfidence;
    -  622   -
     
    -  623   -
             /**
    -  624   -
              * Get the value of evidenceConfidence
    -  625   -
              *
    -  626   -
              * @return the value of evidenceConfidence
    -  627   -
              */
    -  628   -
             public Confidence getEvidenceConfidence() {
    -  629   -
                 return evidenceConfidence;
    -  630   -
             }
    -  631   -
     
    -  632   -
             /**
    -  633   -
              * Set the value of evidenceConfidence
    -  634   -
              *
    -  635   -
              * @param evidenceConfidence new value of evidenceConfidence
    -  636   -
              */
    -  637   -
             public void setEvidenceConfidence(Confidence evidenceConfidence) {
    -  638   -
                 this.evidenceConfidence = evidenceConfidence;
    -  639   -
             }
    -  640   -
             /**
    -  641   -
              * The confidence whether this is an exact match, or a best guess.
    -  642   -
              */
    -  643   -
             private IdentifierConfidence confidence;
    -  644   -
     
    -  645   -
             /**
    -  646   -
              * Get the value of confidence.
    -  647   -
              *
    -  648   -
              * @return the value of confidence
    -  649   -
              */
    -  650   -
             public IdentifierConfidence getConfidence() {
    -  651   -
                 return confidence;
    -  652   -
             }
    -  653   -
     
    -  654   -
             /**
    -  655   -
              * Set the value of confidence.
    -  656   -
              *
    -  657   -
              * @param confidence new value of confidence
    -  658   -
              */
    -  659   -
             public void setConfidence(IdentifierConfidence confidence) {
    -  660   -
                 this.confidence = confidence;
    -  661   -
             }
    -  662   -
             /**
    -  663   -
              * The CPE identifier.
    -  664   -
              */
    -  665   -
             private Identifier identifier;
    -  666   -
     
    -  667   -
             /**
    -  668   -
              * Get the value of identifier.
    -  669   -
              *
    -  670   -
              * @return the value of identifier
    -  671   -
              */
    -  672   -
             public Identifier getIdentifier() {
    -  673   -
                 return identifier;
    -  674   -
             }
    -  675   -
     
    -  676   -
             /**
    -  677   -
              * Set the value of identifier.
    -  678   -
              *
    -  679   -
              * @param identifier new value of identifier
    -  680   -
              */
    -  681   -
             public void setIdentifier(Identifier identifier) {
    -  682   -
                 this.identifier = identifier;
    -  683   -
             }
    -  684   -
             //</editor-fold>
    -  685   -
             //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals">
    -  686   -
     
    -  687   -
             /**
    -  688   -
              * Standard toString() implementation.
    -  689   -
              *
    -  690   -
              * @return the string representation of the object
    -  691   -
              */
    -  692   -
             @Override
    -  693   -
             public String toString() {
    -  694  0
                 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
    -  695   -
                         + ", confidence=" + confidence + ", identifier=" + identifier + '}';
    -  696   -
             }
    -  697   -
     
    -  698   -
             /**
    -  699   -
              * Standard hashCode() implementation.
    -  700   -
              *
    -  701   -
              * @return the hashCode
    -  702   -
              */
    -  703   -
             @Override
    -  704   -
             public int hashCode() {
    -  705  0
                 int hash = 5;
    -  706  0
                 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0);
    -  707  0
                 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    -  708  0
                 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0);
    -  709  0
                 return hash;
    -  710   -
             }
    -  711   -
     
    -  712   -
             /**
    -  713   -
              * Standard equals implementation.
    -  714   -
              *
    -  715   -
              * @param obj the object to compare
    -  716   -
              * @return true if the objects are equal, otherwise false
    -  717   -
              */
    -  718   -
             @Override
    -  719   -
             public boolean equals(Object obj) {
    -  720  0
                 if (obj == null) {
    -  721  0
                     return false;
    -  722   -
                 }
    -  723  0
                 if (getClass() != obj.getClass()) {
    -  724  0
                     return false;
    -  725   -
                 }
    -  726  0
                 final IdentifierMatch other = (IdentifierMatch) obj;
    -  727  0
                 if (this.evidenceConfidence != other.evidenceConfidence) {
    -  728  0
                     return false;
    -  729   -
                 }
    -  730  0
                 if (this.confidence != other.confidence) {
    -  731  0
                     return false;
    -  732   -
                 }
    -  733  0
                 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) {
    -  734  0
                     return false;
    -  735   -
                 }
    -  736  0
                 return true;
    -  737   -
             }
    -  738   -
             //</editor-fold>
    -  739   -
     
    -  740   -
             /**
    -  741   -
              * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the
    -  742   -
              * identifier.
    -  743   -
              *
    -  744   -
              * @param o the IdentifierMatch to compare to
    -  745   -
              * @return the natural ordering of IdentifierMatch
    -  746   -
              */
    -  747   -
             @Override
    -  748   -
             public int compareTo(IdentifierMatch o) {
    -  749  64
                 int conf = this.confidence.compareTo(o.confidence);
    -  750  64
                 if (conf == 0) {
    -  751  48
                     conf = this.evidenceConfidence.compareTo(o.evidenceConfidence);
    -  752  48
                     if (conf == 0) {
    -  753  16
                         conf = identifier.compareTo(o.identifier);
    -  754   -
                     }
    -  755   -
                 }
    -  756  64
                 return conf;
    -  757   -
             }
    -  758  
         }
    +  598   +
     
    +  599   +
         /**
    +  600   +
          * A simple object to hold an identifier and carry information about the confidence in the identifier.
    +  601   +
          */
    +  602  8
         private static class IdentifierMatch implements Comparable<IdentifierMatch> {
    +  603   +
     
    +  604   +
             /**
    +  605   +
              * Constructs an IdentifierMatch.
    +  606   +
              *
    +  607   +
              * @param type the type of identifier (such as CPE)
    +  608   +
              * @param value the value of the identifier
    +  609   +
              * @param url the URL of the identifier
    +  610   +
              * @param identifierConfidence the confidence in the identifier: best guess or exact match
    +  611   +
              * @param evidenceConfidence the confidence of the evidence used to find the identifier
    +  612   +
              */
    +  613  10
             IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
    +  614  10
                 this.identifier = new Identifier(type, value, url);
    +  615  10
                 this.confidence = identifierConfidence;
    +  616  10
                 this.evidenceConfidence = evidenceConfidence;
    +  617  10
             }
    +  618   +
             //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier">
    +  619   +
             /**
    +  620   +
              * The confidence in the evidence used to identify this match.
    +  621   +
              */
    +  622   +
             private Confidence evidenceConfidence;
    +  623   +
     
    +  624   +
             /**
    +  625   +
              * Get the value of evidenceConfidence
    +  626   +
              *
    +  627   +
              * @return the value of evidenceConfidence
    +  628   +
              */
    +  629   +
             public Confidence getEvidenceConfidence() {
    +  630   +
                 return evidenceConfidence;
    +  631   +
             }
    +  632   +
     
    +  633   +
             /**
    +  634   +
              * Set the value of evidenceConfidence
    +  635   +
              *
    +  636   +
              * @param evidenceConfidence new value of evidenceConfidence
    +  637   +
              */
    +  638   +
             public void setEvidenceConfidence(Confidence evidenceConfidence) {
    +  639   +
                 this.evidenceConfidence = evidenceConfidence;
    +  640   +
             }
    +  641   +
             /**
    +  642   +
              * The confidence whether this is an exact match, or a best guess.
    +  643   +
              */
    +  644   +
             private IdentifierConfidence confidence;
    +  645   +
     
    +  646   +
             /**
    +  647   +
              * Get the value of confidence.
    +  648   +
              *
    +  649   +
              * @return the value of confidence
    +  650   +
              */
    +  651   +
             public IdentifierConfidence getConfidence() {
    +  652   +
                 return confidence;
    +  653   +
             }
    +  654   +
     
    +  655   +
             /**
    +  656   +
              * Set the value of confidence.
    +  657   +
              *
    +  658   +
              * @param confidence new value of confidence
    +  659   +
              */
    +  660   +
             public void setConfidence(IdentifierConfidence confidence) {
    +  661   +
                 this.confidence = confidence;
    +  662   +
             }
    +  663   +
             /**
    +  664   +
              * The CPE identifier.
    +  665   +
              */
    +  666   +
             private Identifier identifier;
    +  667   +
     
    +  668   +
             /**
    +  669   +
              * Get the value of identifier.
    +  670   +
              *
    +  671   +
              * @return the value of identifier
    +  672   +
              */
    +  673   +
             public Identifier getIdentifier() {
    +  674   +
                 return identifier;
    +  675   +
             }
    +  676   +
     
    +  677   +
             /**
    +  678   +
              * Set the value of identifier.
    +  679   +
              *
    +  680   +
              * @param identifier new value of identifier
    +  681   +
              */
    +  682   +
             public void setIdentifier(Identifier identifier) {
    +  683   +
                 this.identifier = identifier;
    +  684   +
             }
    +  685   +
             //</editor-fold>
    +  686   +
             //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals">
    +  687   +
     
    +  688   +
             /**
    +  689   +
              * Standard toString() implementation.
    +  690   +
              *
    +  691   +
              * @return the string representation of the object
    +  692   +
              */
    +  693   +
             @Override
    +  694   +
             public String toString() {
    +  695  0
                 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
    +  696   +
                         + ", confidence=" + confidence + ", identifier=" + identifier + '}';
    +  697   +
             }
    +  698   +
     
    +  699   +
             /**
    +  700   +
              * Standard hashCode() implementation.
    +  701   +
              *
    +  702   +
              * @return the hashCode
    +  703   +
              */
    +  704   +
             @Override
    +  705   +
             public int hashCode() {
    +  706  0
                 int hash = 5;
    +  707  0
                 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0);
    +  708  0
                 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    +  709  0
                 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0);
    +  710  0
                 return hash;
    +  711   +
             }
    +  712   +
     
    +  713   +
             /**
    +  714   +
              * Standard equals implementation.
    +  715   +
              *
    +  716   +
              * @param obj the object to compare
    +  717   +
              * @return true if the objects are equal, otherwise false
    +  718   +
              */
    +  719   +
             @Override
    +  720   +
             public boolean equals(Object obj) {
    +  721  0
                 if (obj == null) {
    +  722  0
                     return false;
    +  723   +
                 }
    +  724  0
                 if (getClass() != obj.getClass()) {
    +  725  0
                     return false;
    +  726   +
                 }
    +  727  0
                 final IdentifierMatch other = (IdentifierMatch) obj;
    +  728  0
                 if (this.evidenceConfidence != other.evidenceConfidence) {
    +  729  0
                     return false;
    +  730   +
                 }
    +  731  0
                 if (this.confidence != other.confidence) {
    +  732  0
                     return false;
    +  733   +
                 }
    +  734  0
                 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) {
    +  735  0
                     return false;
    +  736   +
                 }
    +  737  0
                 return true;
    +  738   +
             }
    +  739   +
             //</editor-fold>
    +  740   +
     
    +  741   +
             /**
    +  742   +
              * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the
    +  743   +
              * identifier.
    +  744   +
              *
    +  745   +
              * @param o the IdentifierMatch to compare to
    +  746   +
              * @return the natural ordering of IdentifierMatch
    +  747   +
              */
    +  748   +
             @Override
    +  749   +
             public int compareTo(IdentifierMatch o) {
    +  750  8
                 int conf = this.confidence.compareTo(o.confidence);
    +  751  8
                 if (conf == 0) {
    +  752  6
                     conf = this.evidenceConfidence.compareTo(o.evidenceConfidence);
    +  753  6
                     if (conf == 0) {
    +  754  2
                         conf = identifier.compareTo(o.identifier);
    +  755   +
                     }
    +  756   +
                 }
    +  757  8
                 return conf;
    +  758   +
             }
     759   +
         }
    +  760  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html index 89ed1ae36..dfb58a235 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html @@ -97,7 +97,7 @@
          * The phase that this analyzer is intended to run in.
     40  
          */
    -  41  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
    +  41  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
     42  
     
     43   @@ -114,7 +114,7 @@
         @Override
     49  
         public String getName() {
    -  50  16
             return ANALYZER_NAME;
    +  50  4
             return ANALYZER_NAME;
     51  
         }
     52   @@ -133,7 +133,7 @@
         @Override
     59  
         public AnalysisPhase getAnalysisPhase() {
    -  60  4
             return ANALYSIS_PHASE;
    +  60  1
             return ANALYSIS_PHASE;
     61  
         }
     62   @@ -146,20 +146,20 @@
         public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
     66  
     
    -  67  8
             if (getRules() == null || getRules().size() <= 0) {
    +  67  2
             if (getRules() == null || getRules().size() <= 0) {
     68  0
                 return;
     69  
             }
     70  
     
    -  71  8
             for (final SuppressionRule rule : getRules()) {
    -  72  16
                 rule.process(dependency);
    -  73  16
             }
    -  74  8
         }
    +  71  2
             for (final SuppressionRule rule : getRules()) {
    +  72  10
                 rule.process(dependency);
    +  73  10
             }
    +  74  2
         }
     75  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html index 6c07903a6..be7714e7d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html @@ -119,7 +119,7 @@
          * The Logger.
     51  
          */
    -  52  4
         private static final Logger LOGGER = Logger.getLogger(DependencyBundlingAnalyzer.class.getName());
    +  52  1
         private static final Logger LOGGER = Logger.getLogger(DependencyBundlingAnalyzer.class.getName());
     53  
     
     54   @@ -130,7 +130,7 @@
          * A pattern for obtaining the first part of a filename.
     57  
          */
    -  58  4
         private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*");
    +  58  1
         private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*");
     59  
         /**
     60   @@ -157,7 +157,7 @@
          * The phase that this analyzer is intended to run in.
     71  
          */
    -  72  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
    +  72  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
     73  
     
     74   @@ -172,7 +172,7 @@
          */
     79  
         public String getName() {
    -  80  20
             return ANALYZER_NAME;
    +  80  5
             return ANALYZER_NAME;
     81  
         }
     82   @@ -189,7 +189,7 @@
          */
     88  
         public AnalysisPhase getAnalysisPhase() {
    -  89  8
             return ANALYSIS_PHASE;
    +  89  2
             return ANALYSIS_PHASE;
     90  
         }
     91   @@ -216,19 +216,19 @@
         @Override
     102  
         public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
    -  103  8
             if (!analyzed) {
    -  104  4
                 analyzed = true;
    -  105  4
                 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
    -  106  4
                 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
    +  103  2
             if (!analyzed) {
    +  104  1
                 analyzed = true;
    +  105  1
                 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
    +  106  1
                 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
     107  
                 //for (Dependency nextDependency : engine.getDependencies()) {
    -  108  12
                 while (mainIterator.hasNext()) {
    -  109  8
                     final Dependency dependency = mainIterator.next();
    -  110  8
                     if (mainIterator.hasNext()) {
    -  111  4
                         final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
    -  112  8
                         while (subIterator.hasNext()) {
    -  113  4
                             final Dependency nextDependency = subIterator.next();
    -  114  4
                             if (hashesMatch(dependency, nextDependency)) {
    +  108  3
                 while (mainIterator.hasNext()) {
    +  109  2
                     final Dependency dependency = mainIterator.next();
    +  110  2
                     if (mainIterator.hasNext()) {
    +  111  1
                         final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
    +  112  2
                         while (subIterator.hasNext()) {
    +  113  1
                             final Dependency nextDependency = subIterator.next();
    +  114  1
                             if (hashesMatch(dependency, nextDependency)) {
     115  0
                                 if (isCore(dependency, nextDependency)) {
     116  0
                                     mergeDependencies(dependency, nextDependency, dependenciesToRemove);
     117   @@ -236,7 +236,7 @@  118  0
                                     mergeDependencies(nextDependency, dependency, dependenciesToRemove);
     119  
                                 }
    -  120  4
                             } else if (isShadedJar(dependency, nextDependency)) {
    +  120  1
                             } else if (isShadedJar(dependency, nextDependency)) {
     121  0
                                 if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {
     122  0
                                     dependenciesToRemove.add(dependency);
     123   @@ -244,7 +244,7 @@  124  0
                                     dependenciesToRemove.add(nextDependency);
     125  
                                 }
    -  126  4
                             } else if (cpeIdentifiersMatch(dependency, nextDependency)
    +  126  1
                             } else if (cpeIdentifiersMatch(dependency, nextDependency)
     127  
                                     && hasSameBasePath(dependency, nextDependency)
     128   @@ -260,20 +260,20 @@
                                 }
     135  
                             }
    -  136  4
                         }
    +  136  1
                         }
     137  
                     }
    -  138  8
                 }
    +  138  2
                 }
     139  
                 //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions
     140  
                 // was difficult because of the inner iterator.
    -  141  4
                 for (Dependency d : dependenciesToRemove) {
    +  141  1
                 for (Dependency d : dependenciesToRemove) {
     142  0
                     engine.getDependencies().remove(d);
     143  0
                 }
     144  
             }
    -  145  8
         }
    +  145  2
         }
     146  
     
     147   @@ -440,28 +440,28 @@
          */
     250  
         private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
    -  251  4
             if (dependency1 == null || dependency1.getIdentifiers() == null
    +  251  1
             if (dependency1 == null || dependency1.getIdentifiers() == null
     252  
                     || dependency2 == null || dependency2.getIdentifiers() == null) {
     253  0
                 return false;
     254  
             }
    -  255  4
             boolean matches = false;
    -  256  4
             int cpeCount1 = 0;
    -  257  4
             int cpeCount2 = 0;
    -  258  4
             for (Identifier i : dependency1.getIdentifiers()) {
    +  255  1
             boolean matches = false;
    +  256  1
             int cpeCount1 = 0;
    +  257  1
             int cpeCount2 = 0;
    +  258  1
             for (Identifier i : dependency1.getIdentifiers()) {
     259  0
                 if ("cpe".equals(i.getType())) {
     260  0
                     cpeCount1 += 1;
     261  
                 }
     262  0
             }
    -  263  4
             for (Identifier i : dependency2.getIdentifiers()) {
    -  264  8
                 if ("cpe".equals(i.getType())) {
    -  265  8
                     cpeCount2 += 1;
    +  263  1
             for (Identifier i : dependency2.getIdentifiers()) {
    +  264  2
                 if ("cpe".equals(i.getType())) {
    +  265  2
                     cpeCount2 += 1;
     266  
                 }
    -  267  8
             }
    -  268  4
             if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
    +  267  2
             }
    +  268  1
             if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
     269  0
                 for (Identifier i : dependency1.getIdentifiers()) {
     270  0
                     matches |= dependency2.getIdentifiers().contains(i);
     271  0
                     if (!matches) {
    @@ -471,12 +471,12 @@  274  0
                 }
     275  
             }
    -  276  4
             if (LogUtils.isVerboseLoggingEnabled()) {
    +  276  1
             if (LogUtils.isVerboseLoggingEnabled()) {
     277  0
                 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName());
     278  0
                 LOGGER.log(Level.FINE, msg);
     279  
             }
    -  280  4
             return matches;
    +  280  1
             return matches;
     281  
         }
     282   @@ -553,24 +553,24 @@
          */
     328  
         boolean isCore(Dependency left, Dependency right) {
    -  329  8
             final String leftName = left.getFileName().toLowerCase();
    -  330  8
             final String rightName = right.getFileName().toLowerCase();
    +  329  2
             final String leftName = left.getFileName().toLowerCase();
    +  330  2
             final String rightName = right.getFileName().toLowerCase();
     331  
     
     332  
             final boolean returnVal;
    -  333  8
             if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
    +  333  2
             if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
     334  
                     || rightName.contains("core") && !leftName.contains("core")
     335  
                     || rightName.contains("kernel") && !leftName.contains("kernel")) {
     336  0
                 returnVal = false;
    -  337  8
             } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
    +  337  2
             } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
     338  
                     || !rightName.contains("core") && leftName.contains("core")
     339  
                     || !rightName.contains("kernel") && leftName.contains("kernel")) {
    -  340  8
                 returnVal = true;
    +  340  2
                 returnVal = true;
     341  
             } else {
     342   @@ -594,12 +594,12 @@  351  0
                 returnVal = leftName.length() <= rightName.length();
     352  
             }
    -  353  8
             if (LogUtils.isVerboseLoggingEnabled()) {
    +  353  2
             if (LogUtils.isVerboseLoggingEnabled()) {
     354  0
                 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName());
     355  0
                 LOGGER.log(Level.FINE, msg);
     356  
             }
    -  357  8
             return returnVal;
    +  357  2
             return returnVal;
     358  
         }
     359   @@ -620,11 +620,11 @@
          */
     367  
         private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
    -  368  4
             if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) {
    +  368  1
             if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) {
     369  0
                 return false;
     370  
             }
    -  371  4
             return dependency1.getSha1sum().equals(dependency2.getSha1sum());
    +  371  1
             return dependency1.getSha1sum().equals(dependency2.getSha1sum());
     372  
         }
     373   @@ -649,21 +649,21 @@
          */
     383  
         private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
    -  384  4
             final String mainName = dependency.getFileName().toLowerCase();
    -  385  4
             final String nextName = nextDependency.getFileName().toLowerCase();
    -  386  4
             if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) {
    +  384  1
             final String mainName = dependency.getFileName().toLowerCase();
    +  385  1
             final String nextName = nextDependency.getFileName().toLowerCase();
    +  386  1
             if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) {
     387  0
                 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
    -  388  4
             } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) {
    +  388  1
             } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) {
     389  0
                 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
     390  
             }
    -  391  4
             return false;
    +  391  1
             return false;
     392  
         }
     393  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html index 65fa9d187..eba8da819 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    FalsePositiveAnalyzer
    50%
    79/157
    28%
    54/190
    9.5
    FalsePositiveAnalyzer
    49%
    86/175
    27%
    58/212
    9.692
     
    @@ -111,7 +111,7 @@
          * The Logger.
     47  
          */
    -  48  4
         private static final Logger LOGGER = Logger.getLogger(FalsePositiveAnalyzer.class.getName());
    +  48  1
         private static final Logger LOGGER = Logger.getLogger(FalsePositiveAnalyzer.class.getName());
     49  
         //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
     50   @@ -128,7 +128,7 @@
          * The phase that this analyzer is intended to run in.
     56  
          */
    -  57  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
    +  57  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
     58  
     
     59   @@ -143,7 +143,7 @@
          */
     64  
         public String getName() {
    -  65  20
             return ANALYZER_NAME;
    +  65  5
             return ANALYZER_NAME;
     66  
         }
     67   @@ -160,7 +160,7 @@
          */
     73  
         public AnalysisPhase getAnalysisPhase() {
    -  74  8
             return ANALYSIS_PHASE;
    +  74  2
             return ANALYSIS_PHASE;
     75  
         }
     76   @@ -185,551 +185,593 @@
         @Override
     86  
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  87  12
             removeJreEntries(dependency);
    -  88  12
             removeBadMatches(dependency);
    -  89  12
             removeWrongVersionMatches(dependency);
    -  90  12
             removeSpuriousCPE(dependency);
    -  91  12
             removeDuplicativeEntriesFromJar(dependency, engine);
    -  92  12
             addFalseNegativeCPEs(dependency);
    -  93  12
         }
    -  94   -
     
    +  87  3
             removeJreEntries(dependency);
    +  88  3
             removeBadMatches(dependency);
    +  89  3
             removeBadSpringMatches(dependency);
    +  90  3
             removeWrongVersionMatches(dependency);
    +  91  3
             removeSpuriousCPE(dependency);
    +  92  3
             removeDuplicativeEntriesFromJar(dependency, engine);
    +  93  3
             addFalseNegativeCPEs(dependency);
    +  94  3
         }
     95   -
         /**
    +
     
     96   -
          * <p>
    -  97   -
          * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p>
    -  98   -
          * <p>
    -  99   -
          * Example:</p>
    -  100   -
          * <code>
    -  101   -
          * cpe:/a:some-vendor:some-product
    -  102   -
          * cpe:/a:some-vendor:some-product:1.5
    -  103   -
          * cpe:/a:some-vendor:some-product:1.5.2
    -  104   -
          * </code>
    +
         private void removeBadSpringMatches(Dependency dependency) {
    +  97  3
             String mustContain = null;
    +  98  3
             for (Identifier i : dependency.getIdentifiers()) {
    +  99  2
                 if ("maven".contains(i.getType())) {
    +  100  0
                     if (i.getValue() != null && i.getValue().startsWith("org.springframework.")) {
    +  101  0
                         int endPoint = i.getValue().indexOf(":", 19);
    +  102  0
                         if (endPoint >= 0) {
    +  103  0
                             mustContain = i.getValue().substring(19, endPoint).toLowerCase();
    +  104  0
                             break;
     105   -
          * <p>
    +
                         }
     106   -
          * Should be trimmed to:</p>
    +
                     }
     107   -
          * <code>
    -  108   -
          * cpe:/a:some-vendor:some-product:1.5.2
    -  109   -
          * </code>
    -  110   -
          *
    -  111   -
          * @param dependency the dependency being analyzed
    -  112   -
          */
    -  113   -
         @SuppressWarnings("null")
    +
                 }
    +  108  2
             }
    +  109  3
             if (mustContain != null) {
    +  110  0
                 Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    +  111  0
                 while (itr.hasNext()) {
    +  112  0
                     Identifier i = itr.next();
    +  113  0
                     if ("cpe".contains(i.getType())
     114   -
         private void removeSpuriousCPE(Dependency dependency) {
    -  115  12
             final List<Identifier> ids = new ArrayList<Identifier>();
    -  116  12
             ids.addAll(dependency.getIdentifiers());
    -  117  12
             Collections.sort(ids);
    -  118  12
             final ListIterator<Identifier> mainItr = ids.listIterator();
    -  119  20
             while (mainItr.hasNext()) {
    -  120  8
                 final Identifier currentId = mainItr.next();
    -  121  8
                 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
    -  122  8
                 if (currentCpe == null) {
    -  123  0
                     continue;
    +
                             && i.getValue() != null
    +  115   +
                             && i.getValue().startsWith("cpe:/a:springsource:")
    +  116   +
                             && !i.getValue().toLowerCase().contains(mustContain)) {
    +  117  0
                         itr.remove();
    +  118   +
                         //dependency.getIdentifiers().remove(i);
    +  119   +
                     }
    +  120   +
     
    +  121  0
                 }
    +  122   +
             }
    +  123  3
         }
     124   -
                 }
    -  125  8
                 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
    -  126  12
                 while (subItr.hasNext()) {
    -  127  4
                     final Identifier nextId = subItr.next();
    -  128  4
                     final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
    -  129  4
                     if (nextCpe == null) {
    -  130  0
                         continue;
    +
     
    +  125   +
         /**
    +  126   +
          * <p>
    +  127   +
          * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p>
    +  128   +
          * <p>
    +  129   +
          * Example:</p>
    +  130   +
          * <code>
     131   -
                     }
    +
          * cpe:/a:some-vendor:some-product
     132   -
                     //TODO fix the version problem below
    -  133  4
                     if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
    -  134  0
                         if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
    +
          * cpe:/a:some-vendor:some-product:1.5
    +  133   +
          * cpe:/a:some-vendor:some-product:1.5.2
    +  134   +
          * </code>
     135   -
                             // see if one is contained in the other.. remove the contained one from dependency.getIdentifier
    -  136  0
                             final String currentVersion = currentCpe.getVersion();
    -  137  0
                             final String nextVersion = nextCpe.getVersion();
    -  138  0
                             if (currentVersion == null && nextVersion == null) {
    +
          * <p>
    +  136   +
          * Should be trimmed to:</p>
    +  137   +
          * <code>
    +  138   +
          * cpe:/a:some-vendor:some-product:1.5.2
     139   -
                                 //how did we get here?
    -  140  0
                                 LOGGER.log(Level.FINE, "currentVersion and nextVersion are both null?");
    -  141  0
                             } else if (currentVersion == null && nextVersion != null) {
    -  142  0
                                 dependency.getIdentifiers().remove(currentId);
    -  143  0
                             } else if (nextVersion == null && currentVersion != null) {
    -  144  0
                                 dependency.getIdentifiers().remove(nextId);
    -  145  0
                             } else if (currentVersion.length() < nextVersion.length()) {
    -  146  0
                                 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) {
    -  147  0
                                     dependency.getIdentifiers().remove(currentId);
    -  148   -
                                 }
    -  149   -
                             } else {
    -  150  0
                                 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) {
    -  151  0
                                     dependency.getIdentifiers().remove(nextId);
    -  152   -
                                 }
    -  153   -
                             }
    -  154   -
                         }
    -  155   -
                     }
    -  156  4
                 }
    -  157  8
             }
    -  158  12
         }
    -  159   -
         /**
    -  160   -
          * Regex to identify core java libraries and a few other commonly misidentified ones.
    -  161   -
          */
    -  162  4
         public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
    -  163   -
                 + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
    -  164   -
                 + "jdk|jre|jsse)($|:.*)");
    -  165   -
     
    -  166   -
         /**
    -  167   -
          * Regex to identify core jsf libraries.
    -  168   -
          */
    -  169  4
         public static final Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)");
    -  170   -
         /**
    -  171   -
          * Regex to identify core java library files. This is currently incomplete.
    -  172   -
          */
    -  173  4
         public static final Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$");
    -  174   -
         /**
    -  175   -
          * Regex to identify core jsf java library files. This is currently incomplete.
    -  176   -
          */
    -  177  4
         public static final Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$");
    -  178   -
     
    -  179   -
         /**
    -  180   -
          * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar
    -  181   +
          * </code>
    +  140  
          *
    -  182   -
          * @param dependency the dependency to remove JRE CPEs from
    -  183   -
          */
    -  184   -
         private void removeJreEntries(Dependency dependency) {
    -  185  12
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    -  186  12
             final Iterator<Identifier> itr = identifiers.iterator();
    -  187  24
             while (itr.hasNext()) {
    -  188  12
                 final Identifier i = itr.next();
    -  189  12
                 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
    -  190  12
                 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
    -  191  12
                 if (coreCPE.matches() && !coreFiles.matches()) {
    -  192  0
                     itr.remove();
    -  193   -
                 }
    -  194  12
                 final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue());
    -  195  12
                 final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName());
    -  196  12
                 if (coreJsfCPE.matches() && !coreJsfFiles.matches()) {
    -  197  0
                     itr.remove();
    -  198   -
                 }
    -  199  12
             }
    -  200  12
         }
    -  201   -
     
    -  202   -
         /**
    -  203   -
          * Parses a CPE string into an IndexEntry.
    -  204   -
          *
    -  205   -
          * @param type the type of identifier
    -  206   -
          * @param value the cpe identifier to parse
    -  207   -
          * @return an VulnerableSoftware object constructed from the identifier
    -  208   -
          */
    -  209   -
         private VulnerableSoftware parseCpe(String type, String value) {
    -  210  12
             if (!"cpe".equals(type)) {
    -  211  0
                 return null;
    -  212   -
             }
    -  213  12
             final VulnerableSoftware cpe = new VulnerableSoftware();
    -  214   -
             try {
    -  215  12
                 cpe.parseName(value);
    -  216  0
             } catch (UnsupportedEncodingException ex) {
    -  217  0
                 LOGGER.log(Level.FINEST, null, ex);
    -  218  0
                 return null;
    -  219  12
             }
    -  220  12
             return cpe;
    -  221   -
         }
    -  222   -
     
    -  223   -
         /**
    -  224   -
          * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific
    -  225   -
          * problems identified when testing this on a LARGE volume of jar files.
    -  226   -
          *
    -  227   -
          * @param dependency the dependency to analyze
    -  228   -
          */
    -  229   -
         private void removeBadMatches(Dependency dependency) {
    -  230  12
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    -  231  12
             final Iterator<Identifier> itr = identifiers.iterator();
    -  232   -
     
    -  233   -
             /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of
    -  234   -
              * these are due to low quality data.  Other idea would be to say any CPE
    -  235   -
              * found based on LOW confidence evidence should have a different CPE type? (this
    -  236   -
              * might be a better solution then just removing the URL for "best-guess" matches).
    -  237   -
              */
    -  238   -
             //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid");
    -  239   -
             //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid");
    -  240  24
             while (itr.hasNext()) {
    -  241  12
                 final Identifier i = itr.next();
    -  242   -
                 //TODO move this startsWith expression to a configuration file?
    -  243  12
                 if ("cpe".equals(i.getType())) {
    -  244  12
                     if ((i.getValue().matches(".*c\\+\\+.*")
    -  245   -
                             || i.getValue().startsWith("cpe:/a:file:file")
    -  246   -
                             || i.getValue().startsWith("cpe:/a:mozilla:mozilla")
    -  247   -
                             || i.getValue().startsWith("cpe:/a:cvs:cvs")
    -  248   -
                             || i.getValue().startsWith("cpe:/a:ftp:ftp")
    -  249   -
                             || i.getValue().startsWith("cpe:/a:tcp:tcp")
    -  250   -
                             || i.getValue().startsWith("cpe:/a:ssh:ssh")
    -  251   -
                             || i.getValue().startsWith("cpe:/a:lookup:lookup"))
    -  252   -
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    -  253   -
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml")
    -  254   -
                             || dependency.getFileName().toLowerCase().endsWith(".dll")
    -  255   -
                             || dependency.getFileName().toLowerCase().endsWith(".exe")
    -  256   -
                             || dependency.getFileName().toLowerCase().endsWith(".nuspec")
    -  257   -
                             || dependency.getFileName().toLowerCase().endsWith(".nupkg"))) {
    -  258  4
                         itr.remove();
    -  259  8
                     } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery")
    -  260   -
                             || i.getValue().startsWith("cpe:/a:prototypejs:prototype")
    -  261   -
                             || i.getValue().startsWith("cpe:/a:yahoo:yui"))
    -  262   -
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    -  263   -
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml")
    -  264   -
                             || dependency.getFileName().toLowerCase().endsWith(".dll")
    -  265   -
                             || dependency.getFileName().toLowerCase().endsWith(".exe"))) {
    -  266  0
                         itr.remove();
    -  267  8
                     } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel")
    -  268   -
                             || i.getValue().startsWith("cpe:/a:microsoft:word")
    -  269   -
                             || i.getValue().startsWith("cpe:/a:microsoft:visio")
    -  270   -
                             || i.getValue().startsWith("cpe:/a:microsoft:powerpoint")
    -  271   -
                             || i.getValue().startsWith("cpe:/a:microsoft:office"))
    -  272   -
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    -  273   -
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) {
    -  274  0
                         itr.remove();
    -  275  8
                     } else if (i.getValue().startsWith("cpe:/a:apache:maven")
    -  276   -
                             && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) {
    -  277  0
                         itr.remove();
    -  278  8
                     } else if (i.getValue().startsWith("cpe:/a:m-core:m-core")
    -  279   -
                             && !dependency.getEvidenceUsed().containsUsedString("m-core")) {
    -  280  0
                         itr.remove();
    -  281  8
                     } else if (i.getValue().startsWith("cpe:/a:jboss:jboss")
    -  282   -
                             && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar")) {
    -  283  0
                         itr.remove();
    -  284   -
                     }
    -  285   -
                 }
    -  286  12
             }
    -  287  12
         }
    -  288   -
     
    -  289   -
         /**
    -  290   -
          * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2.
    -  291   -
          *
    -  292   -
          * @param dependency the dependency to analyze
    -  293   -
          */
    -  294   -
         private void removeWrongVersionMatches(Dependency dependency) {
    -  295  12
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    -  296  12
             final Iterator<Identifier> itr = identifiers.iterator();
    -  297   -
     
    -  298  12
             final String fileName = dependency.getFileName();
    -  299  12
             if (fileName != null && fileName.contains("axis2")) {
    -  300  0
                 while (itr.hasNext()) {
    -  301  0
                     final Identifier i = itr.next();
    -  302  0
                     if ("cpe".equals(i.getType())) {
    -  303  0
                         final String cpe = i.getValue();
    -  304  0
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) {
    -  305  0
                             itr.remove();
    -  306   -
                         }
    -  307   -
                     }
    -  308  0
                 }
    -  309  12
             } else if (fileName != null && fileName.contains("axis")) {
    -  310  0
                 while (itr.hasNext()) {
    -  311  0
                     final Identifier i = itr.next();
    -  312  0
                     if ("cpe".equals(i.getType())) {
    -  313  0
                         final String cpe = i.getValue();
    -  314  0
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) {
    -  315  0
                             itr.remove();
    -  316   -
                         }
    -  317   -
                     }
    -  318  0
                 }
    -  319   -
             }
    -  320  12
         }
    -  321   -
     
    -  322   -
         /**
    -  323   -
          * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and
    -  324   -
          * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete
    -  325   -
          * list of CVE entries.
    -  326   -
          *
    -  327   +  141  
          * @param dependency the dependency being analyzed
    -  328   +  142  
          */
    -  329   -
         private void addFalseNegativeCPEs(Dependency dependency) {
    -  330   -
             //TODO move this to the hint analyzer
    -  331  12
             final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    -  332  20
             while (itr.hasNext()) {
    -  333  8
                 final Identifier i = itr.next();
    -  334  8
                 if ("cpe".equals(i.getType()) && i.getValue() != null
    -  335   -
                         && (i.getValue().startsWith("cpe:/a:oracle:opensso:")
    -  336   -
                         || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:")
    -  337   -
                         || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:")
    -  338   -
                         || i.getValue().startsWith("cpe:/a:sun:opensso:"))) {
    -  339  0
                     final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22));
    -  340  0
                     final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22));
    -  341  0
                     final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22));
    -  342  0
                     final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22));
    -  343   -
                     try {
    -  344  0
                         dependency.addIdentifier("cpe",
    -  345   -
                                 newCpe,
    -  346   -
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8")));
    -  347  0
                         dependency.addIdentifier("cpe",
    -  348   -
                                 newCpe2,
    -  349   -
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8")));
    -  350  0
                         dependency.addIdentifier("cpe",
    -  351   -
                                 newCpe3,
    -  352   -
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8")));
    -  353  0
                         dependency.addIdentifier("cpe",
    -  354   -
                                 newCpe4,
    -  355   -
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8")));
    -  356  0
                     } catch (UnsupportedEncodingException ex) {
    -  357  0
                         LOGGER.log(Level.FINE, null, ex);
    -  358  0
                     }
    -  359   +  143   +
         @SuppressWarnings("null")
    +  144   +
         private void removeSpuriousCPE(Dependency dependency) {
    +  145  3
             final List<Identifier> ids = new ArrayList<Identifier>();
    +  146  3
             ids.addAll(dependency.getIdentifiers());
    +  147  3
             Collections.sort(ids);
    +  148  3
             final ListIterator<Identifier> mainItr = ids.listIterator();
    +  149  5
             while (mainItr.hasNext()) {
    +  150  2
                 final Identifier currentId = mainItr.next();
    +  151  2
                 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
    +  152  2
                 if (currentCpe == null) {
    +  153  0
                     continue;
    +  154  
                 }
    -  360  8
             }
    -  361  12
         }
    -  362   -
     
    -  363   -
         /**
    -  364   -
          * Removes duplicate entries identified that are contained within JAR files. These occasionally crop up due to POM
    -  365   -
          * entries or other types of files (such as DLLs and EXEs) being contained within the JAR.
    -  366   -
          *
    -  367   -
          * @param dependency the dependency that might be a duplicate
    -  368   -
          * @param engine the engine used to scan all dependencies
    -  369   -
          */
    -  370   -
         private void removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) {
    -  371  12
             if (dependency.getFileName().toLowerCase().endsWith("pom.xml")
    -  372   -
                     || "dll".equals(dependency.getFileExtension())
    -  373   -
                     || "exe".equals(dependency.getFileExtension())) {
    -  374  4
                 String parentPath = dependency.getFilePath().toLowerCase();
    -  375  4
                 if (parentPath.contains(".jar")) {
    -  376  0
                     parentPath = parentPath.substring(0, parentPath.indexOf(".jar") + 4);
    -  377  0
                     final Dependency parent = findDependency(parentPath, engine.getDependencies());
    -  378  0
                     if (parent != null) {
    -  379  0
                         boolean remove = false;
    -  380  0
                         for (Identifier i : dependency.getIdentifiers()) {
    -  381  0
                             if ("cpe".equals(i.getType())) {
    -  382  0
                                 final String trimmedCPE = trimCpeToVendor(i.getValue());
    -  383  0
                                 for (Identifier parentId : parent.getIdentifiers()) {
    -  384  0
                                     if ("cpe".equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) {
    -  385  0
                                         remove |= true;
    -  386   -
                                     }
    -  387  0
                                 }
    -  388   -
                             }
    -  389  0
                             if (!remove) { //we can escape early
    -  390  0
                                 return;
    -  391   -
                             }
    -  392  0
                         }
    -  393  0
                         if (remove) {
    -  394  0
                             engine.getDependencies().remove(dependency);
    -  395   -
                         }
    -  396   +  155  2
                 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
    +  156  3
                 while (subItr.hasNext()) {
    +  157  1
                     final Identifier nextId = subItr.next();
    +  158  1
                     final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
    +  159  1
                     if (nextCpe == null) {
    +  160  0
                         continue;
    +  161  
                     }
    +  162   +
                     //TODO fix the version problem below
    +  163  1
                     if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
    +  164  0
                         if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
    +  165   +
                             // see if one is contained in the other.. remove the contained one from dependency.getIdentifier
    +  166  0
                             final String currentVersion = currentCpe.getVersion();
    +  167  0
                             final String nextVersion = nextCpe.getVersion();
    +  168  0
                             if (currentVersion == null && nextVersion == null) {
    +  169   +
                                 //how did we get here?
    +  170  0
                                 LOGGER.log(Level.FINE, "currentVersion and nextVersion are both null?");
    +  171  0
                             } else if (currentVersion == null && nextVersion != null) {
    +  172  0
                                 dependency.getIdentifiers().remove(currentId);
    +  173  0
                             } else if (nextVersion == null && currentVersion != null) {
    +  174  0
                                 dependency.getIdentifiers().remove(nextId);
    +  175  0
                             } else if (currentVersion.length() < nextVersion.length()) {
    +  176  0
                                 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) {
    +  177  0
                                     dependency.getIdentifiers().remove(currentId);
    +  178   +
                                 }
    +  179   +
                             } else {
    +  180  0
                                 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) {
    +  181  0
                                     dependency.getIdentifiers().remove(nextId);
    +  182   +
                                 }
    +  183   +
                             }
    +  184   +
                         }
    +  185   +
                     }
    +  186  1
                 }
    +  187  2
             }
    +  188  3
         }
    +  189   +
         /**
    +  190   +
          * Regex to identify core java libraries and a few other commonly misidentified ones.
    +  191   +
          */
    +  192  1
         public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
    +  193   +
                 + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
    +  194   +
                 + "jdk|jre|jsse)($|:.*)");
    +  195   +
     
    +  196   +
         /**
    +  197   +
          * Regex to identify core jsf libraries.
    +  198   +
          */
    +  199  1
         public static final Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)");
    +  200   +
         /**
    +  201   +
          * Regex to identify core java library files. This is currently incomplete.
    +  202   +
          */
    +  203  1
         public static final Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$");
    +  204   +
         /**
    +  205   +
          * Regex to identify core jsf java library files. This is currently incomplete.
    +  206   +
          */
    +  207  1
         public static final Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$");
    +  208   +
     
    +  209   +
         /**
    +  210   +
          * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar
    +  211   +
          *
    +  212   +
          * @param dependency the dependency to remove JRE CPEs from
    +  213   +
          */
    +  214   +
         private void removeJreEntries(Dependency dependency) {
    +  215  3
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    +  216  3
             final Iterator<Identifier> itr = identifiers.iterator();
    +  217  6
             while (itr.hasNext()) {
    +  218  3
                 final Identifier i = itr.next();
    +  219  3
                 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
    +  220  3
                 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
    +  221  3
                 if (coreCPE.matches() && !coreFiles.matches()) {
    +  222  0
                     itr.remove();
    +  223   +
                 }
    +  224  3
                 final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue());
    +  225  3
                 final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName());
    +  226  3
                 if (coreJsfCPE.matches() && !coreJsfFiles.matches()) {
    +  227  0
                     itr.remove();
    +  228   +
                 }
    +  229  3
             }
    +  230  3
         }
    +  231   +
     
    +  232   +
         /**
    +  233   +
          * Parses a CPE string into an IndexEntry.
    +  234   +
          *
    +  235   +
          * @param type the type of identifier
    +  236   +
          * @param value the cpe identifier to parse
    +  237   +
          * @return an VulnerableSoftware object constructed from the identifier
    +  238   +
          */
    +  239   +
         private VulnerableSoftware parseCpe(String type, String value) {
    +  240  3
             if (!"cpe".equals(type)) {
    +  241  0
                 return null;
    +  242   +
             }
    +  243  3
             final VulnerableSoftware cpe = new VulnerableSoftware();
    +  244   +
             try {
    +  245  3
                 cpe.parseName(value);
    +  246  0
             } catch (UnsupportedEncodingException ex) {
    +  247  0
                 LOGGER.log(Level.FINEST, null, ex);
    +  248  0
                 return null;
    +  249  3
             }
    +  250  3
             return cpe;
    +  251   +
         }
    +  252   +
     
    +  253   +
         /**
    +  254   +
          * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific
    +  255   +
          * problems identified when testing this on a LARGE volume of jar files.
    +  256   +
          *
    +  257   +
          * @param dependency the dependency to analyze
    +  258   +
          */
    +  259   +
         private void removeBadMatches(Dependency dependency) {
    +  260  3
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    +  261  3
             final Iterator<Identifier> itr = identifiers.iterator();
    +  262   +
     
    +  263   +
             /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of
    +  264   +
              * these are due to low quality data.  Other idea would be to say any CPE
    +  265   +
              * found based on LOW confidence evidence should have a different CPE type? (this
    +  266   +
              * might be a better solution then just removing the URL for "best-guess" matches).
    +  267   +
              */
    +  268   +
             //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid");
    +  269   +
             //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid");
    +  270  6
             while (itr.hasNext()) {
    +  271  3
                 final Identifier i = itr.next();
    +  272   +
                 //TODO move this startsWith expression to a configuration file?
    +  273  3
                 if ("cpe".equals(i.getType())) {
    +  274  3
                     if ((i.getValue().matches(".*c\\+\\+.*")
    +  275   +
                             || i.getValue().startsWith("cpe:/a:file:file")
    +  276   +
                             || i.getValue().startsWith("cpe:/a:mozilla:mozilla")
    +  277   +
                             || i.getValue().startsWith("cpe:/a:cvs:cvs")
    +  278   +
                             || i.getValue().startsWith("cpe:/a:ftp:ftp")
    +  279   +
                             || i.getValue().startsWith("cpe:/a:tcp:tcp")
    +  280   +
                             || i.getValue().startsWith("cpe:/a:ssh:ssh")
    +  281   +
                             || i.getValue().startsWith("cpe:/a:lookup:lookup"))
    +  282   +
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    +  283   +
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml")
    +  284   +
                             || dependency.getFileName().toLowerCase().endsWith(".dll")
    +  285   +
                             || dependency.getFileName().toLowerCase().endsWith(".exe")
    +  286   +
                             || dependency.getFileName().toLowerCase().endsWith(".nuspec")
    +  287   +
                             || dependency.getFileName().toLowerCase().endsWith(".nupkg"))) {
    +  288  1
                         itr.remove();
    +  289  2
                     } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery")
    +  290   +
                             || i.getValue().startsWith("cpe:/a:prototypejs:prototype")
    +  291   +
                             || i.getValue().startsWith("cpe:/a:yahoo:yui"))
    +  292   +
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    +  293   +
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml")
    +  294   +
                             || dependency.getFileName().toLowerCase().endsWith(".dll")
    +  295   +
                             || dependency.getFileName().toLowerCase().endsWith(".exe"))) {
    +  296  0
                         itr.remove();
    +  297  2
                     } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel")
    +  298   +
                             || i.getValue().startsWith("cpe:/a:microsoft:word")
    +  299   +
                             || i.getValue().startsWith("cpe:/a:microsoft:visio")
    +  300   +
                             || i.getValue().startsWith("cpe:/a:microsoft:powerpoint")
    +  301   +
                             || i.getValue().startsWith("cpe:/a:microsoft:office"))
    +  302   +
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    +  303   +
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) {
    +  304  0
                         itr.remove();
    +  305  2
                     } else if (i.getValue().startsWith("cpe:/a:apache:maven")
    +  306   +
                             && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) {
    +  307  0
                         itr.remove();
    +  308  2
                     } else if (i.getValue().startsWith("cpe:/a:m-core:m-core")
    +  309   +
                             && !dependency.getEvidenceUsed().containsUsedString("m-core")) {
    +  310  0
                         itr.remove();
    +  311  2
                     } else if (i.getValue().startsWith("cpe:/a:jboss:jboss")
    +  312   +
                             && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar")) {
    +  313  0
                         itr.remove();
    +  314   +
                     }
    +  315   +
                 }
    +  316  3
             }
    +  317  3
         }
    +  318   +
     
    +  319   +
         /**
    +  320   +
          * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2.
    +  321   +
          *
    +  322   +
          * @param dependency the dependency to analyze
    +  323   +
          */
    +  324   +
         private void removeWrongVersionMatches(Dependency dependency) {
    +  325  3
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    +  326  3
             final Iterator<Identifier> itr = identifiers.iterator();
    +  327   +
     
    +  328  3
             final String fileName = dependency.getFileName();
    +  329  3
             if (fileName != null && fileName.contains("axis2")) {
    +  330  0
                 while (itr.hasNext()) {
    +  331  0
                     final Identifier i = itr.next();
    +  332  0
                     if ("cpe".equals(i.getType())) {
    +  333  0
                         final String cpe = i.getValue();
    +  334  0
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) {
    +  335  0
                             itr.remove();
    +  336   +
                         }
    +  337   +
                     }
    +  338  0
                 }
    +  339  3
             } else if (fileName != null && fileName.contains("axis")) {
    +  340  0
                 while (itr.hasNext()) {
    +  341  0
                     final Identifier i = itr.next();
    +  342  0
                     if ("cpe".equals(i.getType())) {
    +  343  0
                         final String cpe = i.getValue();
    +  344  0
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) {
    +  345  0
                             itr.remove();
    +  346   +
                         }
    +  347   +
                     }
    +  348  0
                 }
    +  349   +
             }
    +  350  3
         }
    +  351   +
     
    +  352   +
         /**
    +  353   +
          * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and
    +  354   +
          * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete
    +  355   +
          * list of CVE entries.
    +  356   +
          *
    +  357   +
          * @param dependency the dependency being analyzed
    +  358   +
          */
    +  359   +
         private void addFalseNegativeCPEs(Dependency dependency) {
    +  360   +
             //TODO move this to the hint analyzer
    +  361  3
             final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    +  362  5
             while (itr.hasNext()) {
    +  363  2
                 final Identifier i = itr.next();
    +  364  2
                 if ("cpe".equals(i.getType()) && i.getValue() != null
    +  365   +
                         && (i.getValue().startsWith("cpe:/a:oracle:opensso:")
    +  366   +
                         || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:")
    +  367   +
                         || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:")
    +  368   +
                         || i.getValue().startsWith("cpe:/a:sun:opensso:"))) {
    +  369  0
                     final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22));
    +  370  0
                     final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22));
    +  371  0
                     final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22));
    +  372  0
                     final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22));
    +  373   +
                     try {
    +  374  0
                         dependency.addIdentifier("cpe",
    +  375   +
                                 newCpe,
    +  376   +
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8")));
    +  377  0
                         dependency.addIdentifier("cpe",
    +  378   +
                                 newCpe2,
    +  379   +
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8")));
    +  380  0
                         dependency.addIdentifier("cpe",
    +  381   +
                                 newCpe3,
    +  382   +
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8")));
    +  383  0
                         dependency.addIdentifier("cpe",
    +  384   +
                                 newCpe4,
    +  385   +
                                 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8")));
    +  386  0
                     } catch (UnsupportedEncodingException ex) {
    +  387  0
                         LOGGER.log(Level.FINE, null, ex);
    +  388  0
                     }
    +  389   +
                 }
    +  390  2
             }
    +  391  3
         }
    +  392   +
     
    +  393   +
         /**
    +  394   +
          * Removes duplicate entries identified that are contained within JAR files. These occasionally crop up due to POM
    +  395   +
          * entries or other types of files (such as DLLs and EXEs) being contained within the JAR.
    +  396   +
          *
     397   -
                 }
    +
          * @param dependency the dependency that might be a duplicate
     398   -
     
    +
          * @param engine the engine used to scan all dependencies
     399   -
             }
    -  400  12
         }
    -  401   -
     
    +
          */
    +  400   +
         private void removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) {
    +  401  3
             if (dependency.getFileName().toLowerCase().endsWith("pom.xml")
     402   -
         /**
    +
                     || "dll".equals(dependency.getFileExtension())
     403   -
          * Retrieves a given dependency, based on a given path, from a list of dependencies.
    -  404   -
          *
    -  405   -
          * @param dependencyPath the path of the dependency to return
    -  406   -
          * @param dependencies the collection of dependencies to search
    -  407   -
          * @return the dependency object for the given path, otherwise null
    -  408   -
          */
    -  409   -
         private Dependency findDependency(String dependencyPath, List<Dependency> dependencies) {
    -  410  0
             for (Dependency d : dependencies) {
    -  411  0
                 if (d.getFilePath().equalsIgnoreCase(dependencyPath)) {
    -  412  0
                     return d;
    -  413   -
                 }
    -  414  0
             }
    -  415  0
             return null;
    +
                     || "exe".equals(dependency.getFileExtension())) {
    +  404  1
                 String parentPath = dependency.getFilePath().toLowerCase();
    +  405  1
                 if (parentPath.contains(".jar")) {
    +  406  0
                     parentPath = parentPath.substring(0, parentPath.indexOf(".jar") + 4);
    +  407  0
                     final Dependency parent = findDependency(parentPath, engine.getDependencies());
    +  408  0
                     if (parent != null) {
    +  409  0
                         boolean remove = false;
    +  410  0
                         for (Identifier i : dependency.getIdentifiers()) {
    +  411  0
                             if ("cpe".equals(i.getType())) {
    +  412  0
                                 final String trimmedCPE = trimCpeToVendor(i.getValue());
    +  413  0
                                 for (Identifier parentId : parent.getIdentifiers()) {
    +  414  0
                                     if ("cpe".equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) {
    +  415  0
                                         remove |= true;
     416   -
         }
    -  417   -
     
    +
                                     }
    +  417  0
                                 }
     418   -
         /**
    -  419   -
          * Takes a full CPE and returns the CPE trimmed to include only vendor and product.
    -  420   -
          *
    +
                             }
    +  419  0
                             if (!remove) { //we can escape early
    +  420  0
                                 return;
     421   -
          * @param value the CPE value to trim
    -  422   -
          * @return a CPE value that only includes the vendor and product
    -  423   -
          */
    -  424   -
         private String trimCpeToVendor(String value) {
    +
                             }
    +  422  0
                         }
    +  423  0
                         if (remove) {
    +  424  0
                             engine.getDependencies().remove(dependency);
     425   -
             //cpe:/a:jruby:jruby:1.0.8
    -  426  0
             final int pos1 = value.indexOf(":", 7); //right of vendor
    -  427  0
             final int pos2 = value.indexOf(":", pos1 + 1); //right of product
    -  428  0
             if (pos2 < 0) {
    -  429  0
                 return value;
    -  430   -
             } else {
    -  431  0
                 return value.substring(0, pos2);
    -  432   +
                         }
    +  426   +
                     }
    +  427   +
                 }
    +  428   +
     
    +  429  
             }
    +  430  3
         }
    +  431   +
     
    +  432   +
         /**
     433   -
         }
    +
          * Retrieves a given dependency, based on a given path, from a list of dependencies.
     434   +
          *
    +  435   +
          * @param dependencyPath the path of the dependency to return
    +  436   +
          * @param dependencies the collection of dependencies to search
    +  437   +
          * @return the dependency object for the given path, otherwise null
    +  438   +
          */
    +  439   +
         private Dependency findDependency(String dependencyPath, List<Dependency> dependencies) {
    +  440  0
             for (Dependency d : dependencies) {
    +  441  0
                 if (d.getFilePath().equalsIgnoreCase(dependencyPath)) {
    +  442  0
                     return d;
    +  443   +
                 }
    +  444  0
             }
    +  445  0
             return null;
    +  446   +
         }
    +  447   +
     
    +  448   +
         /**
    +  449   +
          * Takes a full CPE and returns the CPE trimmed to include only vendor and product.
    +  450   +
          *
    +  451   +
          * @param value the CPE value to trim
    +  452   +
          * @return a CPE value that only includes the vendor and product
    +  453   +
          */
    +  454   +
         private String trimCpeToVendor(String value) {
    +  455   +
             //cpe:/a:jruby:jruby:1.0.8
    +  456  0
             final int pos1 = value.indexOf(":", 7); //right of vendor
    +  457  0
             final int pos2 = value.indexOf(":", pos1 + 1); //right of product
    +  458  0
             if (pos2 < 0) {
    +  459  0
                 return value;
    +  460   +
             } else {
    +  461  0
                 return value.substring(0, pos2);
    +  462   +
             }
    +  463   +
         }
    +  464  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html index a3474c103..b6a078400 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html @@ -103,7 +103,7 @@
          * The phase that this analyzer is intended to run in.
     43  
          */
    -  44  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  44  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     45  
     
     46   @@ -118,7 +118,7 @@
          */
     51  
         public String getName() {
    -  52  20
             return ANALYZER_NAME;
    +  52  5
             return ANALYZER_NAME;
     53  
         }
     54   @@ -135,7 +135,7 @@
          */
     60  
         public AnalysisPhase getAnalysisPhase() {
    -  61  8
             return ANALYSIS_PHASE;
    +  61  2
             return ANALYSIS_PHASE;
     62  
         }
     63   @@ -164,41 +164,41 @@
     
     75  
             //strip any path information that may get added by ArchiveAnalyzer, etc.
    -  76  16
             final File f = new File(dependency.getFileName());
    -  77  16
             String fileName = f.getName();
    +  76  4
             final File f = new File(dependency.getFileName());
    +  77  4
             String fileName = f.getName();
     78  
     
     79  
             //remove file extension
    -  80  16
             final int pos = fileName.lastIndexOf(".");
    -  81  16
             if (pos > 0) {
    -  82  16
                 fileName = fileName.substring(0, pos);
    +  80  4
             final int pos = fileName.lastIndexOf(".");
    +  81  4
             if (pos > 0) {
    +  82  4
                 fileName = fileName.substring(0, pos);
     83  
             }
     84  
     
     85  
             //add version evidence
    -  86  16
             final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
    -  87  16
             if (version != null) {
    +  86  4
             final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
    +  87  4
             if (version != null) {
     88  
                 // If the version number is just a number like 2 or 23, reduce the confidence
     89  
                 // a shade. This should hopefully correct for cases like log4j.jar or
     90  
                 // struts2-core.jar
    -  91  16
                 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
    +  91  4
                 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
     92  0
                     dependency.getVersionEvidence().addEvidence("file", "name",
     93  
                             version.toString(), Confidence.MEDIUM);
     94  
                 } else {
    -  95  16
                     dependency.getVersionEvidence().addEvidence("file", "name",
    +  95  4
                     dependency.getVersionEvidence().addEvidence("file", "name",
     96  
                             version.toString(), Confidence.HIGHEST);
     97  
                 }
    -  98  16
                 dependency.getVersionEvidence().addEvidence("file", "name",
    +  98  4
                 dependency.getVersionEvidence().addEvidence("file", "name",
     99  
                         fileName, Confidence.MEDIUM);
     100   @@ -207,11 +207,11 @@
     
     102  
             //add as vendor and product evidence
    -  103  16
             if (fileName.contains("-")) {
    -  104  16
                 dependency.getProductEvidence().addEvidence("file", "name",
    +  103  4
             if (fileName.contains("-")) {
    +  104  4
                 dependency.getProductEvidence().addEvidence("file", "name",
     105  
                         fileName, Confidence.HIGHEST);
    -  106  16
                 dependency.getVendorEvidence().addEvidence("file", "name",
    +  106  4
                 dependency.getVendorEvidence().addEvidence("file", "name",
     107  
                         fileName, Confidence.HIGHEST);
     108   @@ -224,11 +224,11 @@
                         fileName, Confidence.HIGH);
     113  
             }
    -  114  16
         }
    +  114  4
         }
     115  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html index 47ea44d30..4c76a4635 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html @@ -87,6 +87,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html index 8ee8d8308..f8e4a49c2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html @@ -101,7 +101,7 @@
          * The phase that this analyzer is intended to run in.
     42  
          */
    -  43  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
    +  43  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
     44  
     
     45   @@ -118,7 +118,7 @@
         @Override
     51  
         public String getName() {
    -  52  20
             return ANALYZER_NAME;
    +  52  5
             return ANALYZER_NAME;
     53  
         }
     54   @@ -137,7 +137,7 @@
         @Override
     61  
         public AnalysisPhase getAnalysisPhase() {
    -  62  8
             return ANALYSIS_PHASE;
    +  62  2
             return ANALYSIS_PHASE;
     63  
         }
     64   @@ -164,7 +164,7 @@
         @Override
     75  
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  76  8
             final Evidence springTest1 = new Evidence("Manifest",
    +  76  2
             final Evidence springTest1 = new Evidence("Manifest",
     77  
                     "Implementation-Title",
     78   @@ -173,7 +173,7 @@
                     Confidence.HIGH);
     80  
     
    -  81  8
             final Evidence springTest2 = new Evidence("Manifest",
    +  81  2
             final Evidence springTest2 = new Evidence("Manifest",
     82  
                     "Implementation-Title",
     83   @@ -182,7 +182,7 @@
                     Confidence.HIGH);
     85  
     
    -  86  8
             final Evidence springTest3 = new Evidence("Manifest",
    +  86  2
             final Evidence springTest3 = new Evidence("Manifest",
     87  
                     "Bundle-Vendor",
     88   @@ -191,26 +191,26 @@
                     Confidence.HIGH);
     90  
     
    -  91  8
             Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
    -  92  8
             if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
    -  93  4
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
    -  94  4
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGH);
    -  95  4
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
    +  91  2
             Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
    +  92  2
             if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
    +  93  1
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
    +  94  1
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGH);
    +  95  1
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
     96  
             }
     97  
     
    -  98  8
             evidence = dependency.getVendorEvidence().getEvidence();
    -  99  8
             if (evidence.contains(springTest3)) {
    -  100  4
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
    -  101  4
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
    +  98  2
             evidence = dependency.getVendorEvidence().getEvidence();
    +  99  2
             if (evidence.contains(springTest3)) {
    +  100  1
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
    +  101  1
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
     102  
             }
    -  103  8
             final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
    -  104  8
             final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
    -  105  108
             while (itr.hasNext()) {
    -  106  100
                 final Evidence e = itr.next();
    -  107  100
                 if ("sun".equalsIgnoreCase(e.getValue(false))) {
    +  103  2
             final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
    +  104  2
             final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
    +  105  27
             while (itr.hasNext()) {
    +  106  25
                 final Evidence e = itr.next();
    +  107  25
                 if ("sun".equalsIgnoreCase(e.getValue(false))) {
     108  0
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence());
     109  0
                     newEntries.add(newEvidence);
     110  0
                 } else if ("oracle".equalsIgnoreCase(e.getValue(false))) {
    @@ -218,17 +218,17 @@  112  0
                     newEntries.add(newEvidence);
     113  
                 }
    -  114  100
             }
    -  115  8
             for (Evidence e : newEntries) {
    +  114  25
             }
    +  115  2
             for (Evidence e : newEntries) {
     116  0
                 dependency.getVendorEvidence().addEvidence(e);
     117  0
             }
     118  
     
    -  119  8
         }
    +  119  2
         }
     120  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html index 69d4edf2b..7d7f8ffcc 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html @@ -188,7 +188,7 @@
          * The logger.
     85  
          */
    -  86  4
         private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class.getName());
    +  86  1
         private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class.getName());
     87  
         /**
     88   @@ -203,21 +203,21 @@
          * The count of directories created during analysis. This is used for creating temporary directories.
     93  
          */
    -  94  4
         private static int dirCount = 0;
    +  94  1
         private static int dirCount = 0;
     95  
         /**
     96  
          * The system independent newline character.
     97  
          */
    -  98  4
         private static final String NEWLINE = System.getProperty("line.separator");
    +  98  1
         private static final String NEWLINE = System.getProperty("line.separator");
     99  
         /**
     100  
          * A list of values in the manifest to ignore as they only result in false positives.
     101  
          */
    -  102  4
         private static final Set<String> IGNORE_VALUES = newHashSet(
    +  102  1
         private static final Set<String> IGNORE_VALUES = newHashSet(
     103  
                 "Sun Java System Application Server");
     104   @@ -226,7 +226,7 @@
          * A list of elements in the manifest to ignore.
     106  
          */
    -  107  4
         private static final Set<String> IGNORE_KEYS = newHashSet(
    +  107  1
         private static final Set<String> IGNORE_KEYS = newHashSet(
     108  
                 "built-by",
     109   @@ -331,7 +331,7 @@
          * A pattern to detect HTML within text.
     159  
          */
    -  160  4
         private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE);
    +  160  1
         private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE);
     161  
         /**
     162   @@ -350,18 +350,18 @@
          * Constructs a new JarAnalyzer.
     169  
          */
    -  170  28
         public JarAnalyzer() {
    +  170  7
         public JarAnalyzer() {
     171  
             try {
     172  
                 //final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated");
    -  173  28
                 final JAXBContext jaxbContext = JAXBContext.newInstance(Model.class);
    -  174  28
                 pomUnmarshaller = jaxbContext.createUnmarshaller();
    +  173  7
                 final JAXBContext jaxbContext = JAXBContext.newInstance(Model.class);
    +  174  7
                 pomUnmarshaller = jaxbContext.createUnmarshaller();
     175  0
             } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
     176  0
                 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details.");
     177  0
                 LOGGER.log(Level.FINE, null, ex);
    -  178  28
             }
    -  179  28
         }
    +  178  7
             }
    +  179  7
         }
     180  
     
     181   @@ -380,14 +380,14 @@
          * The phase that this analyzer is intended to run in.
     188  
          */
    -  189  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  189  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     190  
         /**
     191  
          * The set of file extensions supported by this analyzer.
     192  
          */
    -  193  4
         private static final Set<String> EXTENSIONS = newHashSet("jar", "war");
    +  193  1
         private static final Set<String> EXTENSIONS = newHashSet("jar", "war");
     194  
     
     195   @@ -404,7 +404,7 @@
         @Override
     201  
         public Set<String> getSupportedExtensions() {
    -  202  3408
             return EXTENSIONS;
    +  202  852
             return EXTENSIONS;
     203  
         }
     204   @@ -423,7 +423,7 @@
         @Override
     211  
         public String getName() {
    -  212  20
             return ANALYZER_NAME;
    +  212  5
             return ANALYZER_NAME;
     213  
         }
     214   @@ -440,7 +440,7 @@
          */
     220  
         public AnalysisPhase getAnalysisPhase() {
    -  221  4
             return ANALYSIS_PHASE;
    +  221  1
             return ANALYSIS_PHASE;
     222  
         }
     223   @@ -461,7 +461,7 @@
         @Override
     231  
         protected String getAnalyzerEnabledSettingKey() {
    -  232  28
             return Settings.KEYS.ANALYZER_JAR_ENABLED;
    +  232  7
             return Settings.KEYS.ANALYZER_JAR_ENABLED;
     233  
         }
     234   @@ -488,9 +488,9 @@
         public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
     245  
             try {
    -  246  20
                 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
    -  247  20
                 final String fileName = dependency.getFileName().toLowerCase();
    -  248  20
                 if (classNames.isEmpty()
    +  246  5
                 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
    +  247  5
                 final String fileName = dependency.getFileName().toLowerCase();
    +  248  5
                 if (classNames.isEmpty()
     249  
                         && (fileName.endsWith("-sources.jar")
     250   @@ -502,14 +502,14 @@  253  0
                     engine.getDependencies().remove(dependency);
     254  
                 }
    -  255  20
                 final boolean hasManifest = parseManifest(dependency, classNames);
    -  256  20
                 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
    -  257  20
                 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
    -  258  20
                 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
    +  255  5
                 final boolean hasManifest = parseManifest(dependency, classNames);
    +  256  5
                 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
    +  257  5
                 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
    +  258  5
                 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
     259  0
             } catch (IOException ex) {
     260  0
                 throw new AnalysisException("Exception occurred reading the JAR file.", ex);
    -  261  20
             }
    -  262  20
         }
    +  261  5
             }
    +  262  5
         }
     263  
     
     264   @@ -534,12 +534,12 @@
          */
     274  
         protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
    -  275  20
             boolean foundSomething = false;
    +  275  5
             boolean foundSomething = false;
     276  
             final JarFile jar;
     277  
             try {
    -  278  20
                 jar = new JarFile(dependency.getActualFilePath());
    +  278  5
                 jar = new JarFile(dependency.getActualFilePath());
     279  0
             } catch (IOException ex) {
     280  0
                 final String msg = String.format("Unable to read JarFile '%s'.", dependency.getActualFilePath());
     281   @@ -547,12 +547,12 @@  282  0
                 LOGGER.log(Level.WARNING, msg);
     283  0
                 LOGGER.log(Level.FINE, "", ex);
     284  0
                 return false;
    -  285  20
             }
    +  285  5
             }
     286  
             List<String> pomEntries;
     287  
             try {
    -  288  20
                 pomEntries = retrievePomListing(jar);
    +  288  5
                 pomEntries = retrievePomListing(jar);
     289  0
             } catch (IOException ex) {
     290  0
                 final String msg = String.format("Unable to read Jar file entries in '%s'.", dependency.getActualFilePath());
     291   @@ -560,23 +560,23 @@  292  0
                 LOGGER.log(Level.WARNING, msg);
     293  0
                 LOGGER.log(Level.FINE, msg, ex);
     294  0
                 return false;
    -  295  20
             }
    -  296  20
             if (pomEntries.isEmpty()) {
    -  297  16
                 return false;
    +  295  5
             }
    +  296  5
             if (pomEntries.isEmpty()) {
    +  297  4
                 return false;
     298  
             }
    -  299  4
             for (String path : pomEntries) {
    -  300  4
                 Properties pomProperties = null;
    +  299  1
             for (String path : pomEntries) {
    +  300  1
                 Properties pomProperties = null;
     301  
                 try {
    -  302  4
                     pomProperties = retrievePomProperties(path, jar);
    +  302  1
                     pomProperties = retrievePomProperties(path, jar);
     303  0
                 } catch (IOException ex) {
     304  0
                     LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex);
    -  305  4
                 }
    -  306  4
                 Model pom = null;
    +  305  1
                 }
    +  306  1
                 Model pom = null;
     307  
                 try {
    -  308  4
                     if (pomEntries.size() > 1) {
    +  308  1
                     if (pomEntries.size() > 1) {
     309  
                         //extract POM to its own directory and add it as its own dependency
     310  0
                         final Dependency newDependency = new Dependency();
    @@ -605,17 +605,17 @@  325  0
                         engine.getDependencies().add(newDependency);
     326  0
                         Collections.sort(engine.getDependencies());
     327  0
                     } else {
    -  328  4
                         pom = retrievePom(path, jar);
    -  329  4
                         foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
    +  328  1
                         pom = retrievePom(path, jar);
    +  329  1
                         foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
     330  
                     }
     331  0
                 } catch (AnalysisException ex) {
     332  0
                     final String msg = String.format("An error occured while analyzing '%s'.", dependency.getActualFilePath());
     333  0
                     LOGGER.log(Level.WARNING, msg);
     334  0
                     LOGGER.log(Level.FINE, "", ex);
    -  335  4
                 }
    -  336  4
             }
    -  337  4
             return foundSomething;
    +  335  1
                 }
    +  336  1
             }
    +  337  1
             return foundSomething;
     338  
         }
     339   @@ -638,10 +638,10 @@
          */
     348  
         private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
    -  349  4
             Properties pomProperties = null;
    -  350  4
             final String propPath = path.substring(0, path.length() - 7) + "pom.properies";
    -  351  4
             final ZipEntry propEntry = jar.getEntry(propPath);
    -  352  4
             if (propEntry != null) {
    +  349  1
             Properties pomProperties = null;
    +  350  1
             final String propPath = path.substring(0, path.length() - 7) + "pom.properies";
    +  351  1
             final ZipEntry propEntry = jar.getEntry(propPath);
    +  352  1
             if (propEntry != null) {
     353  0
                 Reader reader = null;
     354  
                 try {
    @@ -663,7 +663,7 @@
                 }
     367  
             }
    -  368  4
             return pomProperties;
    +  368  1
             return pomProperties;
     369  
         }
     370   @@ -684,17 +684,17 @@
          */
     378  
         private List<String> retrievePomListing(final JarFile jar) throws IOException {
    -  379  20
             final List<String> pomEntries = new ArrayList<String>();
    -  380  20
             final Enumeration<JarEntry> entries = jar.entries();
    -  381  7392
             while (entries.hasMoreElements()) {
    -  382  7372
                 final JarEntry entry = entries.nextElement();
    -  383  7372
                 final String entryName = (new File(entry.getName())).getName().toLowerCase();
    -  384  7372
                 if (!entry.isDirectory() && "pom.xml".equals(entryName)) {
    -  385  4
                     pomEntries.add(entry.getName());
    +  379  5
             final List<String> pomEntries = new ArrayList<String>();
    +  380  5
             final Enumeration<JarEntry> entries = jar.entries();
    +  381  1848
             while (entries.hasMoreElements()) {
    +  382  1843
                 final JarEntry entry = entries.nextElement();
    +  383  1843
                 final String entryName = (new File(entry.getName())).getName().toLowerCase();
    +  384  1843
                 if (!entry.isDirectory() && "pom.xml".equals(entryName)) {
    +  385  1
                     pomEntries.add(entry.getName());
     386  
                 }
    -  387  7372
             }
    -  388  20
             return pomEntries;
    +  387  1843
             }
    +  388  5
             return pomEntries;
     389  
         }
     390   @@ -852,16 +852,16 @@
          */
     496  
         private Model retrievePom(String path, JarFile jar) throws AnalysisException {
    -  497  4
             final ZipEntry entry = jar.getEntry(path);
    -  498  4
             Model model = null;
    -  499  4
             if (entry != null) { //should never be null
    +  497  1
             final ZipEntry entry = jar.getEntry(path);
    +  498  1
             Model model = null;
    +  499  1
             if (entry != null) { //should never be null
     500  
                 try {
    -  501  4
                     final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
    -  502  4
                     final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
    -  503  4
                     final InputSource xml = new InputSource(reader);
    -  504  4
                     final SAXSource source = new SAXSource(xml);
    -  505  4
                     model = readPom(source);
    +  501  1
                     final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
    +  502  1
                     final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
    +  503  1
                     final InputSource xml = new InputSource(reader);
    +  504  1
                     final SAXSource source = new SAXSource(xml);
    +  505  1
                     model = readPom(source);
     506  0
                 } catch (SecurityException ex) {
     507  0
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName());
     508  0
                     LOGGER.log(Level.WARNING, msg);
    @@ -877,10 +877,10 @@  518  0
                     LOGGER.log(Level.WARNING, msg);
     519  0
                     LOGGER.log(Level.FINE, "", ex);
     520  0
                     throw new AnalysisException(ex);
    -  521  4
                 }
    +  521  1
                 }
     522  
             }
    -  523  4
             return model;
    +  523  1
             return model;
     524  
         }
     525   @@ -903,16 +903,16 @@
          */
     534  
         private Model readPom(SAXSource source) throws AnalysisException {
    -  535  4
             Model model = null;
    +  535  1
             Model model = null;
     536  
             try {
    -  537  4
                 final XMLFilter filter = new MavenNamespaceFilter();
    -  538  4
                 final SAXParserFactory spf = SAXParserFactory.newInstance();
    -  539  4
                 final SAXParser sp = spf.newSAXParser();
    -  540  4
                 final XMLReader xr = sp.getXMLReader();
    -  541  4
                 filter.setParent(xr);
    -  542  4
                 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class);
    -  543  4
                 model = el.getValue();
    +  537  1
                 final XMLFilter filter = new MavenNamespaceFilter();
    +  538  1
                 final SAXParserFactory spf = SAXParserFactory.newInstance();
    +  539  1
                 final SAXParser sp = spf.newSAXParser();
    +  540  1
                 final XMLReader xr = sp.getXMLReader();
    +  541  1
                 filter.setParent(xr);
    +  542  1
                 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class);
    +  543  1
                 model = el.getValue();
     544  0
             } catch (SecurityException ex) {
     545  0
                 throw new AnalysisException(ex);
     546  0
             } catch (ParserConfigurationException ex) {
    @@ -923,8 +923,8 @@  551  0
                 throw new AnalysisException(ex);
     552  0
             } catch (Throwable ex) {
     553  0
                 throw new AnalysisException(ex);
    -  554  4
             }
    -  555  4
             return model;
    +  554  1
             }
    +  555  1
             return model;
     556  
         }
     557   @@ -951,42 +951,42 @@
          */
     568  
         private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
    -  569  4
             boolean foundSomething = false;
    -  570  4
             boolean addAsIdentifier = true;
    -  571  4
             if (pom == null) {
    +  569  1
             boolean foundSomething = false;
    +  570  1
             boolean addAsIdentifier = true;
    +  571  1
             if (pom == null) {
     572  0
                 return foundSomething;
     573  
             }
    -  574  4
             String groupid = interpolateString(pom.getGroupId(), pomProperties);
    -  575  4
             String parentGroupId = null;
    +  574  1
             String groupid = interpolateString(pom.getGroupId(), pomProperties);
    +  575  1
             String parentGroupId = null;
     576  
     
    -  577  4
             if (pom.getParent() != null) {
    -  578  4
                 parentGroupId = interpolateString(pom.getParent().getGroupId(), pomProperties);
    -  579  4
                 if ((groupid == null || groupid.isEmpty()) && parentGroupId != null && !parentGroupId.isEmpty()) {
    +  577  1
             if (pom.getParent() != null) {
    +  578  1
                 parentGroupId = interpolateString(pom.getParent().getGroupId(), pomProperties);
    +  579  1
                 if ((groupid == null || groupid.isEmpty()) && parentGroupId != null && !parentGroupId.isEmpty()) {
     580  0
                     groupid = parentGroupId;
     581  
                 }
     582  
             }
    -  583  4
             final String originalGroupID = groupid;
    +  583  1
             final String originalGroupID = groupid;
     584  
     
    -  585  4
             if (groupid != null && !groupid.isEmpty()) {
    -  586  4
                 if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
    -  587  4
                     groupid = groupid.substring(4);
    +  585  1
             if (groupid != null && !groupid.isEmpty()) {
    +  586  1
                 if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
    +  587  1
                     groupid = groupid.substring(4);
     588  
                 }
    -  589  4
                 foundSomething = true;
    -  590  4
                 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH);
    -  591  4
                 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW);
    -  592  4
                 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
    -  593  4
                 addMatchingValues(classes, groupid, dependency.getProductEvidence());
    -  594  4
                 if (parentGroupId != null && !parentGroupId.isEmpty() && !parentGroupId.equals(groupid)) {
    -  595  4
                     dependency.getVendorEvidence().addEvidence("pom", "parent-groupid", parentGroupId, Confidence.MEDIUM);
    -  596  4
                     dependency.getProductEvidence().addEvidence("pom", "parent-groupid", parentGroupId, Confidence.LOW);
    -  597  4
                     addMatchingValues(classes, parentGroupId, dependency.getVendorEvidence());
    -  598  4
                     addMatchingValues(classes, parentGroupId, dependency.getProductEvidence());
    +  589  1
                 foundSomething = true;
    +  590  1
                 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGHEST);
    +  591  1
                 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW);
    +  592  1
                 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
    +  593  1
                 addMatchingValues(classes, groupid, dependency.getProductEvidence());
    +  594  1
                 if (parentGroupId != null && !parentGroupId.isEmpty() && !parentGroupId.equals(groupid)) {
    +  595  1
                     dependency.getVendorEvidence().addEvidence("pom", "parent-groupid", parentGroupId, Confidence.MEDIUM);
    +  596  1
                     dependency.getProductEvidence().addEvidence("pom", "parent-groupid", parentGroupId, Confidence.LOW);
    +  597  1
                     addMatchingValues(classes, parentGroupId, dependency.getVendorEvidence());
    +  598  1
                     addMatchingValues(classes, parentGroupId, dependency.getProductEvidence());
     599  
                 }
     600   @@ -996,34 +996,34 @@
             }
     603  
     
    -  604  4
             String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
    -  605  4
             String parentArtifactId = null;
    +  604  1
             String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
    +  605  1
             String parentArtifactId = null;
     606  
     
    -  607  4
             if (pom.getParent() != null) {
    -  608  4
                 parentArtifactId = interpolateString(pom.getParent().getArtifactId(), pomProperties);
    -  609  4
                 if ((artifactid == null || artifactid.isEmpty()) && parentArtifactId != null && !parentArtifactId.isEmpty()) {
    +  607  1
             if (pom.getParent() != null) {
    +  608  1
                 parentArtifactId = interpolateString(pom.getParent().getArtifactId(), pomProperties);
    +  609  1
                 if ((artifactid == null || artifactid.isEmpty()) && parentArtifactId != null && !parentArtifactId.isEmpty()) {
     610  0
                     artifactid = parentArtifactId;
     611  
                 }
     612  
             }
    -  613  4
             final String originalArtifactID = artifactid;
    -  614  4
             if (artifactid != null && !artifactid.isEmpty()) {
    -  615  4
                 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
    +  613  1
             final String originalArtifactID = artifactid;
    +  614  1
             if (artifactid != null && !artifactid.isEmpty()) {
    +  615  1
                 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
     616  0
                     artifactid = artifactid.substring(4);
     617  
                 }
    -  618  4
                 foundSomething = true;
    -  619  4
                 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH);
    -  620  4
                 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW);
    -  621  4
                 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
    -  622  4
                 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
    -  623  4
                 if (parentArtifactId != null && !parentArtifactId.isEmpty() && !parentArtifactId.equals(artifactid)) {
    -  624  4
                     dependency.getProductEvidence().addEvidence("pom", "parent-artifactid", parentArtifactId, Confidence.MEDIUM);
    -  625  4
                     dependency.getVendorEvidence().addEvidence("pom", "parent-artifactid", parentArtifactId, Confidence.LOW);
    -  626  4
                     addMatchingValues(classes, parentArtifactId, dependency.getVendorEvidence());
    -  627  4
                     addMatchingValues(classes, parentArtifactId, dependency.getProductEvidence());
    +  618  1
                 foundSomething = true;
    +  619  1
                 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGHEST);
    +  620  1
                 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW);
    +  621  1
                 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
    +  622  1
                 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
    +  623  1
                 if (parentArtifactId != null && !parentArtifactId.isEmpty() && !parentArtifactId.equals(artifactid)) {
    +  624  1
                     dependency.getProductEvidence().addEvidence("pom", "parent-artifactid", parentArtifactId, Confidence.MEDIUM);
    +  625  1
                     dependency.getVendorEvidence().addEvidence("pom", "parent-artifactid", parentArtifactId, Confidence.LOW);
    +  626  1
                     addMatchingValues(classes, parentArtifactId, dependency.getVendorEvidence());
    +  627  1
                     addMatchingValues(classes, parentArtifactId, dependency.getProductEvidence());
     628  
                 }
     629   @@ -1033,24 +1033,24 @@
             }
     632  
             //version
    -  633  4
             String version = interpolateString(pom.getVersion(), pomProperties);
    -  634  4
             String parentVersion = null;
    +  633  1
             String version = interpolateString(pom.getVersion(), pomProperties);
    +  634  1
             String parentVersion = null;
     635  
     
    -  636  4
             if (pom.getParent() != null) {
    -  637  4
                 parentVersion = interpolateString(pom.getParent().getVersion(), pomProperties);
    -  638  4
                 if ((version == null || version.isEmpty()) && parentVersion != null && !parentVersion.isEmpty()) {
    -  639  4
                     version = parentVersion;
    +  636  1
             if (pom.getParent() != null) {
    +  637  1
                 parentVersion = interpolateString(pom.getParent().getVersion(), pomProperties);
    +  638  1
                 if ((version == null || version.isEmpty()) && parentVersion != null && !parentVersion.isEmpty()) {
    +  639  1
                     version = parentVersion;
     640  
                 }
     641  
             }
     642  
     
    -  643  4
             if (version != null && !version.isEmpty()) {
    -  644  4
                 foundSomething = true;
    -  645  4
                 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST);
    -  646  4
                 if (parentVersion != null && !parentVersion.isEmpty() && !parentVersion.equals(version)) {
    +  643  1
             if (version != null && !version.isEmpty()) {
    +  644  1
                 foundSomething = true;
    +  645  1
                 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST);
    +  646  1
                 if (parentVersion != null && !parentVersion.isEmpty() && !parentVersion.equals(version)) {
     647  0
                     dependency.getVersionEvidence().addEvidence("pom", "parent-version", version, Confidence.LOW);
     648  
                 }
    @@ -1061,16 +1061,16 @@
             }
     652  
     
    -  653  4
             if (addAsIdentifier) {
    -  654  4
                 dependency.addIdentifier("maven", String.format("%s:%s:%s", originalGroupID, originalArtifactID, version), null, Confidence.LOW);
    +  653  1
             if (addAsIdentifier) {
    +  654  1
                 dependency.addIdentifier("maven", String.format("%s:%s:%s", originalGroupID, originalArtifactID, version), null, Confidence.LOW);
     655  
             }
     656  
     
     657  
             // org name
    -  658  4
             final Organization org = pom.getOrganization();
    -  659  4
             if (org != null && org.getName() != null) {
    +  658  1
             final Organization org = pom.getOrganization();
    +  659  1
             if (org != null && org.getName() != null) {
     660  0
                 foundSomething = true;
     661  0
                 final String orgName = interpolateString(org.getName(), pomProperties);
     662  0
                 if (orgName != null && !orgName.isEmpty()) {
    @@ -1082,20 +1082,20 @@
             }
     667  
             //pom name
    -  668  4
             final String pomName = interpolateString(pom.getName(), pomProperties);
    -  669  4
             if (pomName != null && !pomName.isEmpty()) {
    -  670  4
                 foundSomething = true;
    -  671  4
                 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    -  672  4
                 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    -  673  4
                 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
    -  674  4
                 addMatchingValues(classes, pomName, dependency.getProductEvidence());
    +  668  1
             final String pomName = interpolateString(pom.getName(), pomProperties);
    +  669  1
             if (pomName != null && !pomName.isEmpty()) {
    +  670  1
                 foundSomething = true;
    +  671  1
                 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    +  672  1
                 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    +  673  1
                 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
    +  674  1
                 addMatchingValues(classes, pomName, dependency.getProductEvidence());
     675  
             }
     676  
     
     677  
             //Description
    -  678  4
             if (pom.getDescription() != null) {
    +  678  1
             if (pom.getDescription() != null) {
     679  0
                 foundSomething = true;
     680  0
                 final String description = interpolateString(pom.getDescription(), pomProperties);
     681  0
                 if (description != null && !description.isEmpty()) {
    @@ -1106,8 +1106,8 @@
                 }
     686  
             }
    -  687  4
             extractLicense(pom, pomProperties, dependency);
    -  688  4
             return foundSomething;
    +  687  1
             extractLicense(pom, pomProperties, dependency);
    +  688  1
             return foundSomething;
     689  
         }
     690   @@ -1132,41 +1132,41 @@
         protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
     700  
                 Dependency dependency, boolean addPackagesAsEvidence) {
    -  701  20
             final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
    -  702  20
             final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
    -  703  20
             analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
    +  701  5
             final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
    +  702  5
             final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
    +  703  5
             analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
     704  
     
    -  705  20
             final int classCount = classNames.size();
    -  706  20
             final EvidenceCollection vendor = dependency.getVendorEvidence();
    -  707  20
             final EvidenceCollection product = dependency.getProductEvidence();
    +  705  5
             final int classCount = classNames.size();
    +  706  5
             final EvidenceCollection vendor = dependency.getVendorEvidence();
    +  707  5
             final EvidenceCollection product = dependency.getProductEvidence();
     708  
     
    -  709  20
             for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
    -  710  192
                 final float ratio = entry.getValue() / (float) classCount;
    -  711  192
                 if (ratio > 0.5) {
    +  709  5
             for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
    +  710  48
                 final float ratio = entry.getValue() / (float) classCount;
    +  711  48
                 if (ratio > 0.5) {
     712  
                     //TODO remove weighting
    -  713  40
                     vendor.addWeighting(entry.getKey());
    -  714  40
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    -  715  32
                         vendor.addEvidence("jar", "package name", entry.getKey(), Confidence.LOW);
    +  713  10
                     vendor.addWeighting(entry.getKey());
    +  714  10
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    +  715  8
                         vendor.addEvidence("jar", "package name", entry.getKey(), Confidence.LOW);
     716  
                     }
     717  
                 }
    -  718  192
             }
    -  719  20
             for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
    -  720  3940
                 final float ratio = entry.getValue() / (float) classCount;
    -  721  3940
                 if (ratio > 0.5) {
    -  722  20
                     product.addWeighting(entry.getKey());
    -  723  20
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    -  724  16
                         product.addEvidence("jar", "package name", entry.getKey(), Confidence.LOW);
    +  718  48
             }
    +  719  5
             for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
    +  720  985
                 final float ratio = entry.getValue() / (float) classCount;
    +  721  985
                 if (ratio > 0.5) {
    +  722  5
                     product.addWeighting(entry.getKey());
    +  723  5
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    +  724  4
                         product.addEvidence("jar", "package name", entry.getKey(), Confidence.LOW);
     725  
                     }
     726  
                 }
    -  727  3940
             }
    -  728  20
         }
    +  727  985
             }
    +  728  5
         }
     729  
     
     730   @@ -1199,17 +1199,17 @@
          */
     744  
         protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
    -  745  20
             boolean foundSomething = false;
    -  746  20
             JarFile jar = null;
    +  745  5
             boolean foundSomething = false;
    +  746  5
             JarFile jar = null;
     747  
             try {
    -  748  20
                 jar = new JarFile(dependency.getActualFilePath());
    +  748  5
                 jar = new JarFile(dependency.getActualFilePath());
     749  
     
    -  750  20
                 final Manifest manifest = jar.getManifest();
    +  750  5
                 final Manifest manifest = jar.getManifest();
     751  
     
    -  752  20
                 if (manifest == null) {
    +  752  5
                 if (manifest == null) {
     753  
                     //don't log this for javadoc or sources jar files
     754  0
                     if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar")
    @@ -1229,60 +1229,60 @@  762  0
                     return false;
     763  
                 }
    -  764  20
                 final Attributes atts = manifest.getMainAttributes();
    +  764  5
                 final Attributes atts = manifest.getMainAttributes();
     765  
     
    -  766  20
                 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
    -  767  20
                 final EvidenceCollection productEvidence = dependency.getProductEvidence();
    -  768  20
                 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
    +  766  5
                 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
    +  767  5
                 final EvidenceCollection productEvidence = dependency.getProductEvidence();
    +  768  5
                 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
     769  
     
    -  770  20
                 final String source = "Manifest";
    +  770  5
                 final String source = "Manifest";
     771  
     
    -  772  20
                 for (Entry<Object, Object> entry : atts.entrySet()) {
    -  773  260
                     String key = entry.getKey().toString();
    -  774  260
                     String value = atts.getValue(key);
    -  775  260
                     if (HTML_DETECTION_PATTERN.matcher(value).find()) {
    +  772  5
                 for (Entry<Object, Object> entry : atts.entrySet()) {
    +  773  65
                     String key = entry.getKey().toString();
    +  774  65
                     String value = atts.getValue(key);
    +  775  65
                     if (HTML_DETECTION_PATTERN.matcher(value).find()) {
     776  0
                         value = Jsoup.parse(value).text();
     777  
                     }
    -  778  260
                     if (IGNORE_VALUES.contains(value)) {
    +  778  65
                     if (IGNORE_VALUES.contains(value)) {
     779  0
                         continue;
    -  780  260
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
    -  781  4
                         foundSomething = true;
    -  782  4
                         productEvidence.addEvidence(source, key, value, Confidence.HIGH);
    -  783  4
                         addMatchingValues(classInformation, value, productEvidence);
    -  784  256
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
    -  785  8
                         foundSomething = true;
    -  786  8
                         versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
    -  787  248
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
    -  788  4
                         foundSomething = true;
    -  789  4
                         vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
    -  790  4
                         addMatchingValues(classInformation, value, vendorEvidence);
    -  791  244
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
    +  780  65
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
    +  781  1
                         foundSomething = true;
    +  782  1
                         productEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  783  1
                         addMatchingValues(classInformation, value, productEvidence);
    +  784  64
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
    +  785  2
                         foundSomething = true;
    +  786  2
                         versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  787  62
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
    +  788  1
                         foundSomething = true;
    +  789  1
                         vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  790  1
                         addMatchingValues(classInformation, value, vendorEvidence);
    +  791  61
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
     792  0
                         foundSomething = true;
     793  0
                         vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
     794  0
                         addMatchingValues(classInformation, value, vendorEvidence);
    -  795  244
                     } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
    -  796  8
                         foundSomething = true;
    -  797  8
                         addDescription(dependency, value, "manifest", key);
    +  795  61
                     } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
    +  796  2
                         foundSomething = true;
    +  797  2
                         addDescription(dependency, value, "manifest", key);
     798  
                         //productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    -  799  8
                         addMatchingValues(classInformation, value, productEvidence);
    -  800  236
                     } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
    -  801  12
                         foundSomething = true;
    -  802  12
                         productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    -  803  12
                         addMatchingValues(classInformation, value, productEvidence);
    -  804  224
                     } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
    -  805  12
                         foundSomething = true;
    -  806  12
                         vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
    -  807  12
                         addMatchingValues(classInformation, value, vendorEvidence);
    -  808  212
                     } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
    -  809  12
                         foundSomething = true;
    -  810  12
                         versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
    -  811  200
                     } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
    -  812  8
                         continue;
    +  799  2
                         addMatchingValues(classInformation, value, productEvidence);
    +  800  59
                     } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
    +  801  3
                         foundSomething = true;
    +  802  3
                         productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  803  3
                         addMatchingValues(classInformation, value, productEvidence);
    +  804  56
                     } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
    +  805  3
                         foundSomething = true;
    +  806  3
                         vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  807  3
                         addMatchingValues(classInformation, value, vendorEvidence);
    +  808  53
                     } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
    +  809  3
                         foundSomething = true;
    +  810  3
                         versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  811  50
                     } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
    +  812  2
                         continue;
     813  
                         //skipping main class as if this has important information to add
     814   @@ -1301,10 +1301,10 @@
     //                    addMatchingValues(classInformation, value, productEvidence);
     821  
                     } else {
    -  822  192
                         key = key.toLowerCase();
    +  822  48
                         key = key.toLowerCase();
     823  
     
    -  824  192
                         if (!IGNORE_KEYS.contains(key)
    +  824  48
                         if (!IGNORE_KEYS.contains(key)
     825  
                                 && !key.endsWith("jdk")
     826   @@ -1327,16 +1327,16 @@
                                 && !isPackage(key, value)) {
     835  
     
    -  836  56
                             foundSomething = true;
    -  837  56
                             if (key.contains("version")) {
    -  838  4
                                 if (key.contains("specification")) {
    -  839  4
                                     versionEvidence.addEvidence(source, key, value, Confidence.LOW);
    +  836  14
                             foundSomething = true;
    +  837  14
                             if (key.contains("version")) {
    +  838  1
                                 if (key.contains("specification")) {
    +  839  1
                                     versionEvidence.addEvidence(source, key, value, Confidence.LOW);
     840  
                                 } else {
     841  0
                                     versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
     842  
                                 }
    -  843  52
                             } else if ("build-id".equals(key)) {
    +  843  13
                             } else if ("build-id".equals(key)) {
     844  0
                                 int pos = value.indexOf('(');
     845  0
                                 if (pos >= 0) {
     846  0
                                     value = value.substring(0, pos - 1);
    @@ -1349,9 +1349,9 @@
                                 }
     852  0
                                 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
     853  0
                             } else if (key.contains("title")) {
    -  854  4
                                 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    -  855  4
                                 addMatchingValues(classInformation, value, productEvidence);
    -  856  48
                             } else if (key.contains("vendor")) {
    +  854  1
                                 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  855  1
                                 addMatchingValues(classInformation, value, productEvidence);
    +  856  12
                             } else if (key.contains("vendor")) {
     857  0
                                 if (key.contains("specification")) {
     858  0
                                     vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
     859   @@ -1360,32 +1360,32 @@  861  0
                                     addMatchingValues(classInformation, value, vendorEvidence);
     862  
                                 }
    -  863  48
                             } else if (key.contains("name")) {
    -  864  12
                                 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    -  865  12
                                 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    -  866  12
                                 addMatchingValues(classInformation, value, vendorEvidence);
    -  867  12
                                 addMatchingValues(classInformation, value, productEvidence);
    -  868  36
                             } else if (key.contains("license")) {
    -  869  8
                                 addLicense(dependency, value);
    +  863  12
                             } else if (key.contains("name")) {
    +  864  3
                                 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  865  3
                                 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  866  3
                                 addMatchingValues(classInformation, value, vendorEvidence);
    +  867  3
                                 addMatchingValues(classInformation, value, productEvidence);
    +  868  9
                             } else if (key.contains("license")) {
    +  869  2
                                 addLicense(dependency, value);
     870  
                             } else {
    -  871  28
                                 if (key.contains("description")) {
    +  871  7
                                 if (key.contains("description")) {
     872  0
                                     addDescription(dependency, value, "manifest", key);
     873  
                                 } else {
    -  874  28
                                     productEvidence.addEvidence(source, key, value, Confidence.LOW);
    -  875  28
                                     vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
    -  876  28
                                     addMatchingValues(classInformation, value, vendorEvidence);
    -  877  28
                                     addMatchingValues(classInformation, value, productEvidence);
    -  878  28
                                     if (value.matches(".*\\d.*")) {
    -  879  12
                                         final StringTokenizer tokenizer = new StringTokenizer(value, " ");
    -  880  60
                                         while (tokenizer.hasMoreElements()) {
    -  881  48
                                             final String s = tokenizer.nextToken();
    -  882  48
                                             if (s.matches("^[0-9.]+$")) {
    -  883  4
                                                 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
    +  874  7
                                     productEvidence.addEvidence(source, key, value, Confidence.LOW);
    +  875  7
                                     vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
    +  876  7
                                     addMatchingValues(classInformation, value, vendorEvidence);
    +  877  7
                                     addMatchingValues(classInformation, value, productEvidence);
    +  878  7
                                     if (value.matches(".*\\d.*")) {
    +  879  3
                                         final StringTokenizer tokenizer = new StringTokenizer(value, " ");
    +  880  15
                                         while (tokenizer.hasMoreElements()) {
    +  881  12
                                             final String s = tokenizer.nextToken();
    +  882  12
                                             if (s.matches("^[0-9.]+$")) {
    +  883  1
                                                 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
     884  
                                             }
    -  885  48
                                         }
    +  885  12
                                         }
     886  
                                     }
     887   @@ -1396,16 +1396,16 @@
                         }
     890  
                     }
    -  891  252
                 }
    +  891  63
                 }
     892  
             } finally {
    -  893  20
                 if (jar != null) {
    -  894  20
                     jar.close();
    +  893  5
                 if (jar != null) {
    +  894  5
                     jar.close();
     895  
                 }
     896  
             }
    -  897  20
             return foundSomething;
    +  897  5
             return foundSomething;
     898  
         }
     899   @@ -1436,21 +1436,21 @@
          */
     912  
         private String addDescription(Dependency dependency, String description, String source, String key) {
    -  913  8
             if (dependency.getDescription() == null) {
    -  914  8
                 dependency.setDescription(description);
    +  913  2
             if (dependency.getDescription() == null) {
    +  914  2
                 dependency.setDescription(description);
     915  
             }
     916  
             String desc;
    -  917  8
             if (HTML_DETECTION_PATTERN.matcher(description).find()) {
    +  917  2
             if (HTML_DETECTION_PATTERN.matcher(description).find()) {
     918  0
                 desc = Jsoup.parse(description).text();
     919  
             } else {
    -  920  8
                 desc = description;
    +  920  2
                 desc = description;
     921  
             }
    -  922  8
             dependency.setDescription(desc);
    -  923  8
             if (desc.length() > 100) {
    +  922  2
             dependency.setDescription(desc);
    +  923  2
             if (desc.length() > 100) {
     924  0
                 desc = desc.replaceAll("\\s\\s+", " ");
     925  0
                 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100);
     926  0
                 final int posLike = desc.toLowerCase().indexOf("like ", 100);
    @@ -1491,11 +1491,11 @@  953  0
                 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
     954  0
                 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
     955  0
             } else {
    -  956  8
                 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
    -  957  8
                 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
    +  956  2
                 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
    +  957  2
                 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
     958  
             }
    -  959  8
             return desc;
    +  959  2
             return desc;
     960  
         }
     961   @@ -1514,13 +1514,13 @@
          */
     968  
         private void addLicense(Dependency d, String license) {
    -  969  8
             if (d.getLicense() == null) {
    -  970  8
                 d.setLicense(license);
    +  969  2
             if (d.getLicense() == null) {
    +  970  2
                 d.setLicense(license);
     971  0
             } else if (!d.getLicense().contains(license)) {
     972  0
                 d.setLicense(d.getLicense() + NEWLINE + license);
     973  
             }
    -  974  8
         }
    +  974  2
         }
     975  
     
     976   @@ -1529,7 +1529,7 @@
          * The parent directory for the individual directories per archive.
     978  
          */
    -  979  28
         private File tempFileLocation = null;
    +  979  7
         private File tempFileLocation = null;
     980  
     
     981   @@ -1546,19 +1546,19 @@
         @Override
     987  
         public void initializeFileTypeAnalyzer() throws Exception {
    -  988  4
             final File baseDir = Settings.getTempDirectory();
    -  989  4
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    -  990  4
             if (!tempFileLocation.delete()) {
    +  988  1
             final File baseDir = Settings.getTempDirectory();
    +  989  1
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    +  990  1
             if (!tempFileLocation.delete()) {
     991  0
                 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
     992  0
                 throw new AnalysisException(msg);
     993  
             }
    -  994  4
             if (!tempFileLocation.mkdirs()) {
    +  994  1
             if (!tempFileLocation.mkdirs()) {
     995  0
                 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
     996  0
                 throw new AnalysisException(msg);
     997  
             }
    -  998  4
         }
    +  998  1
         }
     999  
     
     1000   @@ -1571,10 +1571,10 @@
         @Override
     1004  
         public void close() {
    -  1005  4
             if (tempFileLocation != null && tempFileLocation.exists()) {
    -  1006  4
                 LOGGER.log(Level.FINE, "Attempting to delete temporary files");
    -  1007  4
                 final boolean success = FileUtils.delete(tempFileLocation);
    -  1008  4
                 if (!success) {
    +  1005  1
             if (tempFileLocation != null && tempFileLocation.exists()) {
    +  1006  1
                 LOGGER.log(Level.FINE, "Attempting to delete temporary files");
    +  1007  1
                 final boolean success = FileUtils.delete(tempFileLocation);
    +  1008  1
                 if (!success) {
     1009  0
                     LOGGER.log(Level.WARNING,
     1010  
                             "Failed to delete some temporary files, see the log for more details");
    @@ -1582,7 +1582,7 @@
                 }
     1012  
             }
    -  1013  4
         }
    +  1013  1
         }
     1014  
     
     1015   @@ -1641,40 +1641,40 @@
          */
     1042  
         protected String interpolateString(String text, Properties properties) {
    -  1043  56
             Properties props = properties;
    -  1044  56
             if (text == null) {
    -  1045  4
                 return text;
    +  1043  14
             Properties props = properties;
    +  1044  14
             if (text == null) {
    +  1045  1
                 return text;
     1046  
             }
    -  1047  52
             if (props == null) {
    -  1048  24
                 props = new Properties();
    +  1047  13
             if (props == null) {
    +  1048  6
                 props = new Properties();
     1049  
             }
     1050  
     
    -  1051  52
             final int pos = text.indexOf("${");
    -  1052  52
             if (pos < 0) {
    -  1053  40
                 return text;
    +  1051  13
             final int pos = text.indexOf("${");
    +  1052  13
             if (pos < 0) {
    +  1053  10
                 return text;
     1054  
             }
    -  1055  12
             final int end = text.indexOf("}");
    -  1056  12
             if (end < pos) {
    +  1055  3
             final int end = text.indexOf("}");
    +  1056  3
             if (end < pos) {
     1057  0
                 return text;
     1058  
             }
     1059  
     
    -  1060  12
             final String propName = text.substring(pos + 2, end);
    -  1061  12
             String propValue = interpolateString(props.getProperty(propName), props);
    -  1062  12
             if (propValue == null) {
    +  1060  3
             final String propName = text.substring(pos + 2, end);
    +  1061  3
             String propValue = interpolateString(props.getProperty(propName), props);
    +  1062  3
             if (propValue == null) {
     1063  0
                 propValue = "";
     1064  
             }
    -  1065  12
             final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
    -  1066  12
             sb.append(text.subSequence(0, pos));
    -  1067  12
             sb.append(propValue);
    -  1068  12
             sb.append(text.substring(end + 1));
    -  1069  12
             return interpolateString(sb.toString(), props); //yes yes, this should be a loop...
    +  1065  3
             final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
    +  1066  3
             sb.append(text.subSequence(0, pos));
    +  1067  3
             sb.append(propValue);
    +  1068  3
             sb.append(text.substring(end + 1));
    +  1069  3
             return interpolateString(sb.toString(), props); //yes yes, this should be a loop...
     1070  
         }
     1071   @@ -1695,9 +1695,9 @@
          */
     1079  
         private boolean isImportPackage(String key, String value) {
    -  1080  60
             final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$");
    -  1081  60
             final boolean matches = packageRx.matcher(value).matches();
    -  1082  60
             return matches && (key.contains("import") || key.contains("include") || value.length() > 10);
    +  1080  15
             final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$");
    +  1081  15
             final boolean matches = packageRx.matcher(value).matches();
    +  1082  15
             return matches && (key.contains("import") || key.contains("include") || value.length() > 10);
     1083  
         }
     1084   @@ -1718,41 +1718,41 @@
          */
     1092  
         private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
    -  1093  20
             final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
    -  1094  20
             JarFile jar = null;
    +  1093  5
             final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
    +  1094  5
             JarFile jar = null;
     1095  
             try {
    -  1096  20
                 jar = new JarFile(dependency.getActualFilePath());
    -  1097  20
                 final Enumeration entries = jar.entries();
    -  1098  7392
                 while (entries.hasMoreElements()) {
    -  1099  7372
                     final JarEntry entry = (JarEntry) entries.nextElement();
    -  1100  7372
                     final String name = entry.getName().toLowerCase();
    +  1096  5
                 jar = new JarFile(dependency.getActualFilePath());
    +  1097  5
                 final Enumeration entries = jar.entries();
    +  1098  1848
                 while (entries.hasMoreElements()) {
    +  1099  1843
                     final JarEntry entry = (JarEntry) entries.nextElement();
    +  1100  1843
                     final String name = entry.getName().toLowerCase();
     1101  
                     //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs.
    -  1102  7372
                     if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) {
    -  1103  6140
                         final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
    -  1104  6140
                         classNames.add(className);
    +  1102  1843
                     if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) {
    +  1103  1535
                         final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
    +  1104  1535
                         classNames.add(className);
     1105  
                     }
    -  1106  7372
                 }
    +  1106  1843
                 }
     1107  0
             } catch (IOException ex) {
     1108  0
                 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName());
     1109  0
                 LOGGER.log(Level.WARNING, msg);
     1110  0
                 LOGGER.log(Level.FINE, null, ex);
     1111  
             } finally {
    -  1112  20
                 if (jar != null) {
    +  1112  5
                 if (jar != null) {
     1113  
                     try {
    -  1114  20
                         jar.close();
    +  1114  5
                         jar.close();
     1115  0
                     } catch (IOException ex) {
     1116  0
                         LOGGER.log(Level.FINEST, null, ex);
    -  1117  20
                     }
    +  1117  5
                     }
     1118  
                 }
     1119  
             }
    -  1120  20
             return classNames;
    +  1120  5
             return classNames;
     1121  
         }
     1122   @@ -1777,31 +1777,31 @@
         private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
     1132  
                 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
    -  1133  20
             for (ClassNameInformation entry : classNames) {
    -  1134  6140
                 final ArrayList<String> list = entry.getPackageStructure();
    -  1135  6140
                 addEntry(vendor, list.get(0));
    +  1133  5
             for (ClassNameInformation entry : classNames) {
    +  1134  1535
                 final ArrayList<String> list = entry.getPackageStructure();
    +  1135  1535
                 addEntry(vendor, list.get(0));
     1136  
     
    -  1137  6140
                 if (list.size() == 2) {
    +  1137  1535
                 if (list.size() == 2) {
     1138  0
                     addEntry(product, list.get(1));
     1139  
                 }
    -  1140  6140
                 if (list.size() == 3) {
    -  1141  1380
                     addEntry(vendor, list.get(1));
    -  1142  1380
                     addEntry(product, list.get(1));
    -  1143  1380
                     addEntry(product, list.get(2));
    +  1140  1535
                 if (list.size() == 3) {
    +  1141  345
                     addEntry(vendor, list.get(1));
    +  1142  345
                     addEntry(product, list.get(1));
    +  1143  345
                     addEntry(product, list.get(2));
     1144  
                 }
    -  1145  6140
                 if (list.size() >= 4) {
    -  1146  4760
                     addEntry(vendor, list.get(1));
    -  1147  4760
                     addEntry(vendor, list.get(2));
    -  1148  4760
                     addEntry(product, list.get(1));
    -  1149  4760
                     addEntry(product, list.get(2));
    -  1150  4760
                     addEntry(product, list.get(3));
    +  1145  1535
                 if (list.size() >= 4) {
    +  1146  1190
                     addEntry(vendor, list.get(1));
    +  1147  1190
                     addEntry(vendor, list.get(2));
    +  1148  1190
                     addEntry(product, list.get(1));
    +  1149  1190
                     addEntry(product, list.get(2));
    +  1150  1190
                     addEntry(product, list.get(3));
     1151  
                 }
    -  1152  6140
             }
    -  1153  20
         }
    +  1152  1535
             }
    +  1153  5
         }
     1154  
     
     1155   @@ -1820,14 +1820,14 @@
          */
     1162  
         private void addEntry(HashMap<String, Integer> collection, String key) {
    -  1163  34080
             if (collection.containsKey(key)) {
    -  1164  29948
                 collection.put(key, collection.get(key) + 1);
    +  1163  8520
             if (collection.containsKey(key)) {
    +  1164  7487
                 collection.put(key, collection.get(key) + 1);
     1165  
             } else {
    -  1166  4132
                 collection.put(key, 1);
    +  1166  1033
                 collection.put(key, 1);
     1167  
             }
    -  1168  34080
         }
    +  1168  8520
         }
     1169  
     
     1170   @@ -1850,20 +1850,20 @@
          */
     1179  
         private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
    -  1180  164
             if (value == null || value.isEmpty() || classes == null || classes.isEmpty()) {
    +  1180  41
             if (value == null || value.isEmpty() || classes == null || classes.isEmpty()) {
     1181  0
                 return;
     1182  
             }
    -  1183  164
             final String text = value.toLowerCase();
    -  1184  164
             for (ClassNameInformation cni : classes) {
    -  1185  66000
                 for (String key : cni.getPackageStructure()) {
    -  1186  255280
                     if (text.contains(key)) { //note, package structure elements are already lowercase.
    -  1187  61600
                         evidence.addEvidence("jar", "package name", key, Confidence.HIGHEST);
    +  1183  41
             final String text = value.toLowerCase();
    +  1184  41
             for (ClassNameInformation cni : classes) {
    +  1185  16500
                 for (String key : cni.getPackageStructure()) {
    +  1186  63820
                     if (text.contains(key)) { //note, package structure elements are already lowercase.
    +  1187  15400
                         evidence.addEvidence("jar", "package name", key, Confidence.HIGHEST);
     1188  
                     }
    -  1189  255280
                 }
    -  1190  66000
             }
    -  1191  164
         }
    +  1189  63820
                 }
    +  1190  16500
             }
    +  1191  41
         }
     1192  
     
     1193   @@ -1884,7 +1884,7 @@
         private boolean isPackage(String key, String value) {
     1201  
     
    -  1202  60
             return !key.matches(".*(version|title|vendor|name|license|description).*")
    +  1202  15
             return !key.matches(".*(version|title|vendor|name|license|description).*")
     1203  
                     && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$");
     1204   @@ -1911,7 +1911,7 @@
         private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
     1215  
             //license
    -  1216  4
             if (pom.getLicenses() != null) {
    +  1216  1
             if (pom.getLicenses() != null) {
     1217  0
                 String license = null;
     1218  0
                 for (License lic : pom.getLicenses().getLicense()) {
     1219  0
                     String tmp = null;
    @@ -1951,7 +1951,7 @@
                 }
     1245  
             }
    -  1246  4
         }
    +  1246  1
         }
     1247  
     
     1248   @@ -2004,30 +2004,30 @@
              * @param className a fully qualified class name
     1272  
              */
    -  1273  6140
             ClassNameInformation(String className) {
    -  1274  6140
                 name = className;
    -  1275  6140
                 if (name.contains("/")) {
    -  1276  6140
                     final String[] tmp = className.toLowerCase().split("/");
    -  1277  6140
                     int start = 0;
    -  1278  6140
                     int end = 3;
    -  1279  6140
                     if ("com".equals(tmp[0]) || "org".equals(tmp[0])) {
    -  1280  6140
                         start = 1;
    -  1281  6140
                         end = 4;
    +  1273  1535
             ClassNameInformation(String className) {
    +  1274  1535
                 name = className;
    +  1275  1535
                 if (name.contains("/")) {
    +  1276  1535
                     final String[] tmp = className.toLowerCase().split("/");
    +  1277  1535
                     int start = 0;
    +  1278  1535
                     int end = 3;
    +  1279  1535
                     if ("com".equals(tmp[0]) || "org".equals(tmp[0])) {
    +  1280  1535
                         start = 1;
    +  1281  1535
                         end = 4;
     1282  
                     }
    -  1283  6140
                     if (tmp.length <= end) {
    -  1284  1380
                         end = tmp.length - 1;
    +  1283  1535
                     if (tmp.length <= end) {
    +  1284  345
                         end = tmp.length - 1;
     1285  
                     }
    -  1286  29320
                     for (int i = start; i <= end; i++) {
    -  1287  23180
                         packageStructure.add(tmp[i]);
    +  1286  7330
                     for (int i = start; i <= end; i++) {
    +  1287  5795
                         packageStructure.add(tmp[i]);
     1288  
                     }
    -  1289  6140
                 } else {
    +  1289  1535
                 } else {
     1290  0
                     packageStructure.add(name);
     1291  
                 }
    -  1292  6140
             }
    +  1292  1535
             }
     1293  
             /**
     1294   @@ -2078,7 +2078,7 @@
              * Up to the first four levels of the package structure, excluding a leading "org" or "com".
     1317  
              */
    -  1318  6140
             private final ArrayList<String> packageStructure = new ArrayList<String>();
    +  1318  1535
             private final ArrayList<String> packageStructure = new ArrayList<String>();
     1319  
     
     1320   @@ -2135,6 +2135,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html index 6354be115..28df59f0b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html @@ -105,7 +105,7 @@
          * The logger.
     44  
          */
    -  45  4
         private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class.getName());
    +  45  1
         private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class.getName());
     46  
     
     47   @@ -124,14 +124,14 @@
          * The phase that this analyzer is intended to run in.
     54  
          */
    -  55  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  55  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     56  
         /**
     57  
          * The set of file extensions supported by this analyzer.
     58  
          */
    -  59  4
         private static final Set<String> EXTENSIONS = newHashSet("js");
    +  59  1
         private static final Set<String> EXTENSIONS = newHashSet("js");
     60  
     
     61   @@ -148,7 +148,7 @@
         @Override
     67  
         public Set<String> getSupportedExtensions() {
    -  68  8
             return EXTENSIONS;
    +  68  2
             return EXTENSIONS;
     69  
         }
     70   @@ -167,7 +167,7 @@
         @Override
     77  
         public String getName() {
    -  78  4
             return ANALYZER_NAME;
    +  78  1
             return ANALYZER_NAME;
     79  
         }
     80   @@ -186,7 +186,7 @@
         @Override
     87  
         public AnalysisPhase getAnalysisPhase() {
    -  88  4
             return ANALYSIS_PHASE;
    +  88  1
             return ANALYSIS_PHASE;
     89  
         }
     90   @@ -205,7 +205,7 @@
         @Override
     97  
         protected String getAnalyzerEnabledSettingKey() {
    -  98  20
             return Settings.KEYS.ANALYZER_JAVASCRIPT_ENABLED;
    +  98  5
             return Settings.KEYS.ANALYZER_JAVASCRIPT_ENABLED;
     99  
         }
     100   @@ -275,6 +275,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html index cc385d177..4a6ead028 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html @@ -125,7 +125,7 @@
          * The logger.
     54  
          */
    -  55  4
         private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class.getName());
    +  55  1
         private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class.getName());
     56  
     
     57   @@ -144,7 +144,7 @@
          * The phase in which the analyzer runs.
     64  
          */
    -  65  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  65  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     66  
     
     67   @@ -153,7 +153,7 @@
          * The types of files on which this will work.
     69  
          */
    -  70  4
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar");
    +  70  1
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar");
     71  
     
     72   @@ -220,7 +220,7 @@
         @Override
     110  
         public String getName() {
    -  111  16
             return ANALYZER_NAME;
    +  111  4
             return ANALYZER_NAME;
     112  
         }
     113   @@ -239,7 +239,7 @@
         @Override
     120  
         protected String getAnalyzerEnabledSettingKey() {
    -  121  8
             return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
    +  121  2
             return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
     122  
         }
     123   @@ -258,7 +258,7 @@
         @Override
     130  
         public AnalysisPhase getAnalysisPhase() {
    -  131  4
             return ANALYSIS_PHASE;
    +  131  1
             return ANALYSIS_PHASE;
     132  
         }
     133   @@ -351,6 +351,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html index c941998a7..c350378f6 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html @@ -107,7 +107,7 @@
          * The logger.
     45  
          */
    -  46  4
         private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class.getName());
    +  46  1
         private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class.getName());
     47  
     
     48   @@ -126,7 +126,7 @@
          * The phase in which the analyzer runs.
     55  
          */
    -  56  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  56  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     57  
     
     58   @@ -135,7 +135,7 @@
          * The types of files on which this will work.
     60  
          */
    -  61  4
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec");
    +  61  1
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec");
     62  
     
     63   @@ -169,7 +169,7 @@
         @Override
     78  
         public String getName() {
    -  79  20
             return ANALYZER_NAME;
    +  79  5
             return ANALYZER_NAME;
     80  
         }
     81   @@ -188,7 +188,7 @@
         @Override
     88  
         protected String getAnalyzerEnabledSettingKey() {
    -  89  24
             return Settings.KEYS.ANALYZER_NUSPEC_ENABLED;
    +  89  6
             return Settings.KEYS.ANALYZER_NUSPEC_ENABLED;
     90  
         }
     91   @@ -207,7 +207,7 @@
         @Override
     98  
         public AnalysisPhase getAnalysisPhase() {
    -  99  8
             return ANALYSIS_PHASE;
    +  99  2
             return ANALYSIS_PHASE;
     100  
         }
     101   @@ -226,7 +226,7 @@
         @Override
     108  
         public Set<String> getSupportedExtensions() {
    -  109  3408
             return SUPPORTED_EXTENSIONS;
    +  109  852
             return SUPPORTED_EXTENSIONS;
     110  
         }
     111   @@ -297,6 +297,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html index 970540f63..64ab5b0a9 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html @@ -129,9 +129,9 @@
          */
     56  
         public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException {
    -  57  4
             cveDB = new CveDB();
    -  58  4
             cveDB.open();
    -  59  4
         }
    +  57  1
             cveDB = new CveDB();
    +  58  1
             cveDB.open();
    +  59  1
         }
     60  
     
     61   @@ -144,9 +144,9 @@
         @Override
     65  
         public void close() {
    -  66  4
             cveDB.close();
    -  67  4
             cveDB = null;
    -  68  4
         }
    +  66  1
             cveDB.close();
    +  67  1
             cveDB = null;
    +  68  1
         }
     69  
     
     70   @@ -161,7 +161,7 @@
          */
     75  
         public boolean isOpen() {
    -  76  4
             return (cveDB != null);
    +  76  1
             return (cveDB != null);
     77  
         }
     78   @@ -180,12 +180,12 @@
         @Override
     85  
         protected void finalize() throws Throwable {
    -  86  4
             super.finalize();
    -  87  4
             if (isOpen()) {
    +  86  1
             super.finalize();
    +  87  1
             if (isOpen()) {
     88  0
                 close();
     89  
             }
    -  90  4
         }
    +  90  1
         }
     91  
     
     92   @@ -206,20 +206,20 @@
         @Override
     100  
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  101  8
             for (Identifier id : dependency.getIdentifiers()) {
    -  102  8
                 if ("cpe".equals(id.getType())) {
    +  101  2
             for (Identifier id : dependency.getIdentifiers()) {
    +  102  2
                 if ("cpe".equals(id.getType())) {
     103  
                     try {
    -  104  8
                         final String value = id.getValue();
    -  105  8
                         final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
    -  106  8
                         dependency.getVulnerabilities().addAll(vulns);
    +  104  2
                         final String value = id.getValue();
    +  105  2
                         final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
    +  106  2
                         dependency.getVulnerabilities().addAll(vulns);
     107  0
                     } catch (DatabaseException ex) {
     108  0
                         throw new AnalysisException(ex);
    -  109  8
                     }
    +  109  2
                     }
     110  
                 }
    -  111  8
             }
    -  112  8
             for (Identifier id : dependency.getSuppressedIdentifiers()) {
    +  111  2
             }
    +  112  2
             for (Identifier id : dependency.getSuppressedIdentifiers()) {
     113  0
                 if ("cpe".equals(id.getType())) {
     114  
                     try {
    @@ -232,7 +232,7 @@  121  
                 }
     122  0
             }
    -  123  8
         }
    +  123  2
         }
     124  
     
     125   @@ -249,7 +249,7 @@
         @Override
     131  
         public String getName() {
    -  132  16
             return "NVD CVE Analyzer";
    +  132  4
             return "NVD CVE Analyzer";
     133  
         }
     134   @@ -268,7 +268,7 @@
         @Override
     141  
         public AnalysisPhase getAnalysisPhase() {
    -  142  4
             return AnalysisPhase.FINDING_ANALYSIS;
    +  142  1
             return AnalysisPhase.FINDING_ANALYSIS;
     143  
         }
     144   @@ -287,12 +287,12 @@
         @Override
     151  
         public void initialize() throws Exception {
    -  152  4
             this.open();
    -  153  4
         }
    +  152  1
             this.open();
    +  153  1
         }
     154  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html index bfe0a16c1..649836cf4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html @@ -97,7 +97,7 @@
          * The phase that this analyzer is intended to run in.
     40  
          */
    -  41  4
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
    +  41  1
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
     42  
     
     43   @@ -114,7 +114,7 @@
         @Override
     49  
         public String getName() {
    -  50  16
             return ANALYZER_NAME;
    +  50  4
             return ANALYZER_NAME;
     51  
         }
     52   @@ -133,7 +133,7 @@
         @Override
     59  
         public AnalysisPhase getAnalysisPhase() {
    -  60  4
             return ANALYSIS_PHASE;
    +  60  1
             return ANALYSIS_PHASE;
     61  
         }
     62   @@ -146,20 +146,20 @@
         public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
     66  
     
    -  67  8
             if (getRules() == null || getRules().size() <= 0) {
    +  67  2
             if (getRules() == null || getRules().size() <= 0) {
     68  0
                 return;
     69  
             }
     70  
     
    -  71  8
             for (final SuppressionRule rule : getRules()) {
    -  72  16
                 rule.process(dependency);
    -  73  16
             }
    -  74  8
         }
    +  71  2
             for (final SuppressionRule rule : getRules()) {
    +  72  10
                 rule.process(dependency);
    +  73  10
             }
    +  74  2
         }
     75  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html index 17611dad0..8bb0d6f42 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html @@ -151,6 +151,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html index 0ae40d864..dc65720cd 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException.html @@ -151,6 +151,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html index da643cef7..a89946113 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html @@ -135,14 +135,14 @@
          * The logger.
     59  
          */
    -  60  4
         private static final Logger LOGGER = Logger.getLogger(CpeMemoryIndex.class.getName());
    +  60  1
         private static final Logger LOGGER = Logger.getLogger(CpeMemoryIndex.class.getName());
     61  
         /**
     62  
          * singleton instance.
     63  
          */
    -  64  4
         private static CpeMemoryIndex instance = new CpeMemoryIndex();
    +  64  1
         private static CpeMemoryIndex instance = new CpeMemoryIndex();
     65  
     
     66   @@ -169,7 +169,7 @@
          */
     77  
         public static CpeMemoryIndex getInstance() {
    -  78  8
             return instance;
    +  78  2
             return instance;
     79  
         }
     80   @@ -244,22 +244,22 @@
          */
     115  
         public void open(CveDB cve) throws IndexException {
    -  116  8
             if (!openState) {
    -  117  4
                 index = new RAMDirectory();
    -  118  4
                 buildIndex(cve);
    +  116  2
             if (!openState) {
    +  117  1
                 index = new RAMDirectory();
    +  118  1
                 buildIndex(cve);
     119  
                 try {
    -  120  4
                     indexReader = DirectoryReader.open(index);
    +  120  1
                     indexReader = DirectoryReader.open(index);
     121  0
                 } catch (IOException ex) {
     122  0
                     throw new IndexException(ex);
    -  123  4
                 }
    -  124  4
                 indexSearcher = new IndexSearcher(indexReader);
    -  125  4
                 searchingAnalyzer = createSearchingAnalyzer();
    -  126  4
                 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
    -  127  4
                 openState = true;
    +  123  1
                 }
    +  124  1
                 indexSearcher = new IndexSearcher(indexReader);
    +  125  1
                 searchingAnalyzer = createSearchingAnalyzer();
    +  126  1
                 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
    +  127  1
                 openState = true;
     128  
             }
    -  129  8
         }
    +  129  2
         }
     130  
         /**
     131   @@ -302,9 +302,9 @@
         @SuppressWarnings("unchecked")
     150  
         private Analyzer createIndexingAnalyzer() {
    -  151  4
             final Map fieldAnalyzers = new HashMap();
    -  152  4
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    -  153  4
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
    +  151  1
             final Map fieldAnalyzers = new HashMap();
    +  152  1
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    +  153  1
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
     154  
         }
     155   @@ -323,15 +323,15 @@
         @SuppressWarnings("unchecked")
     162  
         private Analyzer createSearchingAnalyzer() {
    -  163  4
             final Map fieldAnalyzers = new HashMap();
    -  164  4
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    -  165  4
             productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    -  166  4
             vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    -  167  4
             fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
    -  168  4
             fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
    +  163  1
             final Map fieldAnalyzers = new HashMap();
    +  164  1
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    +  165  1
             productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    +  166  1
             vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    +  167  1
             fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
    +  168  1
             fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
     169  
     
    -  170  4
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
    +  170  1
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
     171  
         }
     172   @@ -356,13 +356,13 @@
          */
     182  
         public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException {
    -  183  88708
             final Document doc = new Document();
    -  184  88708
             final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
    -  185  88708
             final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
    -  186  88708
             doc.add(v);
    -  187  88708
             doc.add(p);
    -  188  88708
             indexWriter.addDocument(doc);
    -  189  88708
         }
    +  183  22135
             final Document doc = new Document();
    +  184  22135
             final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
    +  185  22135
             final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
    +  186  22135
             doc.add(v);
    +  187  22135
             doc.add(p);
    +  188  22135
             indexWriter.addDocument(doc);
    +  189  22135
         }
     190  
     
     191   @@ -373,30 +373,30 @@
          */
     194  
         public void close() {
    -  195  4
             if (searchingAnalyzer != null) {
    -  196  4
                 searchingAnalyzer.close();
    -  197  4
                 searchingAnalyzer = null;
    +  195  1
             if (searchingAnalyzer != null) {
    +  196  1
                 searchingAnalyzer.close();
    +  197  1
                 searchingAnalyzer = null;
     198  
             }
    -  199  4
             if (indexReader != null) {
    +  199  1
             if (indexReader != null) {
     200  
                 try {
    -  201  4
                     indexReader.close();
    +  201  1
                     indexReader.close();
     202  0
                 } catch (IOException ex) {
     203  0
                     LOGGER.log(Level.FINEST, null, ex);
    -  204  4
                 }
    -  205  4
                 indexReader = null;
    +  204  1
                 }
    +  205  1
                 indexReader = null;
     206  
             }
    -  207  4
             queryParser = null;
    -  208  4
             indexSearcher = null;
    -  209  4
             if (index != null) {
    -  210  4
                 index.close();
    -  211  4
                 index = null;
    +  207  1
             queryParser = null;
    +  208  1
             indexSearcher = null;
    +  209  1
             if (index != null) {
    +  210  1
                 index.close();
    +  211  1
                 index = null;
     212  
             }
    -  213  4
             openState = false;
    -  214  4
         }
    +  213  1
             openState = false;
    +  214  1
         }
     215  
     
     216   @@ -413,53 +413,53 @@
          */
     222  
         private void buildIndex(CveDB cve) throws IndexException {
    -  223  4
             Analyzer analyzer = null;
    -  224  4
             IndexWriter indexWriter = null;
    +  223  1
             Analyzer analyzer = null;
    +  224  1
             IndexWriter indexWriter = null;
     225  
             try {
    -  226  4
                 analyzer = createIndexingAnalyzer();
    -  227  4
                 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
    -  228  4
                 indexWriter = new IndexWriter(index, conf);
    +  226  1
                 analyzer = createIndexingAnalyzer();
    +  227  1
                 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
    +  228  1
                 indexWriter = new IndexWriter(index, conf);
     229  
                 try {
    -  230  4
                     final Set<Pair<String, String>> data = cve.getVendorProductList();
    -  231  4
                     for (Pair<String, String> pair : data) {
    -  232  88708
                         saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
    -  233  88708
                     }
    +  230  1
                     final Set<Pair<String, String>> data = cve.getVendorProductList();
    +  231  1
                     for (Pair<String, String> pair : data) {
    +  232  22135
                         saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
    +  233  22135
                     }
     234  0
                 } catch (DatabaseException ex) {
     235  0
                     LOGGER.log(Level.FINE, null, ex);
     236  0
                     throw new IndexException("Error reading CPE data", ex);
    -  237  4
                 }
    +  237  1
                 }
     238  0
             } catch (CorruptIndexException ex) {
     239  0
                 throw new IndexException("Unable to close an in-memory index", ex);
     240  0
             } catch (IOException ex) {
     241  0
                 throw new IndexException("Unable to close an in-memory index", ex);
     242  
             } finally {
    -  243  4
                 if (indexWriter != null) {
    +  243  1
                 if (indexWriter != null) {
     244  
                     try {
     245  
                         try {
    -  246  4
                             indexWriter.commit();
    +  246  1
                             indexWriter.commit();
     247  
                         } finally {
    -  248  4
                             indexWriter.close(true);
    -  249  4
                         }
    +  248  1
                             indexWriter.close(true);
    +  249  1
                         }
     250  0
                     } catch (CorruptIndexException ex) {
     251  0
                         throw new IndexException("Unable to close an in-memory index", ex);
     252  0
                     } catch (IOException ex) {
     253  0
                         throw new IndexException("Unable to close an in-memory index", ex);
    -  254  4
                     }
    -  255  4
                     if (analyzer != null) {
    -  256  4
                         analyzer.close();
    +  254  1
                     }
    +  255  1
                     if (analyzer != null) {
    +  256  1
                         analyzer.close();
     257  
                     }
     258  
                 }
     259  
             }
    -  260  4
         }
    +  260  1
         }
     261  
     
     262   @@ -501,12 +501,12 @@
          */
     283  
         public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException {
    -  284  32
             if (searchString == null || searchString.trim().isEmpty()) {
    +  284  6
             if (searchString == null || searchString.trim().isEmpty()) {
     285  0
                 throw new ParseException("Query is null or empty");
     286  
             }
    -  287  32
             final Query query = queryParser.parse(searchString);
    -  288  32
             return indexSearcher.search(query, maxQueryResults);
    +  287  6
             final Query query = queryParser.parse(searchString);
    +  288  6
             return indexSearcher.search(query, maxQueryResults);
     289  
         }
     290   @@ -553,7 +553,7 @@
          */
     312  
         public Document getDocument(int documentId) throws IOException {
    -  313  216
             return indexSearcher.doc(documentId);
    +  313  23
             return indexSearcher.doc(documentId);
     314  
         }
     315   @@ -570,17 +570,17 @@
          */
     321  
         public int numDocs() {
    -  322  4
             if (indexReader == null) {
    +  322  1
             if (indexReader == null) {
     323  0
                 return -1;
     324  
             }
    -  325  4
             return indexReader.numDocs();
    +  325  1
             return indexReader.numDocs();
     326  
         }
     327  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html index 45755d509..6a1987157 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html @@ -109,6 +109,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html index 91ed846d1..8f4ff35fd 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html @@ -302,19 +302,19 @@
          */
     144  
         public void parseName(String cpeName) throws UnsupportedEncodingException {
    -  145  4
             if (cpeName != null && cpeName.length() > 7) {
    -  146  4
                 final String[] data = cpeName.substring(7).split(":");
    -  147  4
                 if (data.length >= 1) {
    -  148  4
                     vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8");
    -  149  4
                     if (data.length >= 2) {
    -  150  4
                         product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8");
    +  145  1
             if (cpeName != null && cpeName.length() > 7) {
    +  146  1
                 final String[] data = cpeName.substring(7).split(":");
    +  147  1
                 if (data.length >= 1) {
    +  148  1
                     vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8");
    +  149  1
                     if (data.length >= 2) {
    +  150  1
                         product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8");
     151  
                     }
     152  
                 }
     153  
             }
    -  154  4
         }
    +  154  1
         }
     155  
     
     156   @@ -332,21 +332,21 @@
         @Override
     164  
         public boolean equals(Object obj) {
    -  165  1344
             if (obj == null) {
    +  165  39
             if (obj == null) {
     166  0
                 return false;
     167  
             }
    -  168  1344
             if (getClass() != obj.getClass()) {
    +  168  39
             if (getClass() != obj.getClass()) {
     169  0
                 return false;
     170  
             }
    -  171  1344
             final IndexEntry other = (IndexEntry) obj;
    -  172  1344
             if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) {
    -  173  1116
                 return false;
    +  171  39
             final IndexEntry other = (IndexEntry) obj;
    +  172  39
             if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) {
    +  173  34
                 return false;
     174  
             }
    -  175  228
             if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) {
    -  176  228
                 return false;
    +  175  5
             if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) {
    +  176  5
                 return false;
     177  
             }
     178  0
             return true;
    @@ -375,6 +375,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html index 04d2fdbc0..1218b573e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html @@ -151,6 +151,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html index 635894d05..ff179a078 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html @@ -85,7 +85,7 @@
          * The Logger.
     34  
          */
    -  35  4
         private static final Logger LOGGER = Logger.getLogger(CweDB.class.getName());
    +  35  1
         private static final Logger LOGGER = Logger.getLogger(CweDB.class.getName());
     36  
         /**
     37   @@ -104,7 +104,7 @@
          * A HashMap of the CWE data.
     44  
          */
    -  45  4
         private static final HashMap<String, String> CWE = loadData();
    +  45  1
         private static final HashMap<String, String> CWE = loadData();
     46  
     
     47   @@ -119,13 +119,13 @@
          */
     52  
         private static HashMap<String, String> loadData() {
    -  53  4
             ObjectInputStream oin = null;
    +  53  1
             ObjectInputStream oin = null;
     54  
             try {
    -  55  4
                 final String filePath = "data/cwe.hashmap.serialized";
    -  56  4
                 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
    -  57  4
                 oin = new ObjectInputStream(input);
    -  58  4
                 return (HashMap<String, String>) oin.readObject();
    +  55  1
                 final String filePath = "data/cwe.hashmap.serialized";
    +  56  1
                 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
    +  57  1
                 oin = new ObjectInputStream(input);
    +  58  1
                 return (HashMap<String, String>) oin.readObject();
     59  0
             } catch (ClassNotFoundException ex) {
     60  0
                 LOGGER.log(Level.WARNING, "Unable to load CWE data. This should not be an issue.");
     61  0
                 LOGGER.log(Level.FINE, null, ex);
    @@ -134,13 +134,13 @@  64  0
                 LOGGER.log(Level.FINE, null, ex);
     65  
             } finally {
    -  66  4
                 if (oin != null) {
    +  66  1
                 if (oin != null) {
     67  
                     try {
    -  68  4
                         oin.close();
    +  68  1
                         oin.close();
     69  0
                     } catch (IOException ex) {
     70  0
                         LOGGER.log(Level.FINEST, null, ex);
    -  71  8
                     }
    +  71  2
                     }
     72  
                 }
     73   @@ -166,8 +166,8 @@
          */
     84  
         public static String getCweName(String cweId) {
    -  85  36
             if (cweId != null) {
    -  86  36
                 return CWE.get(cweId);
    +  85  9
             if (cweId != null) {
    +  86  9
                 return CWE.get(cweId);
     87  
             }
     88  0
             return null;
    @@ -177,6 +177,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html index 45173562c..30e34d11f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html @@ -122,6 +122,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html index 76becf042..4e4b2ffb4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html @@ -85,7 +85,7 @@
          * The char term attribute.
     34  
          */
    -  35  39
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
    +  35  11
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
     36  
     
     37   @@ -144,9 +144,9 @@
          */
     64  
         public AbstractTokenizingFilter(TokenStream stream) {
    -  65  39
             super(stream);
    -  66  39
             tokens = new LinkedList<String>();
    -  67  39
         }
    +  65  11
             super(stream);
    +  66  11
             tokens = new LinkedList<String>();
    +  67  11
         }
     68  
     
     69   @@ -161,20 +161,20 @@
          */
     74  
         protected boolean addTerm() {
    -  75  100347
             final boolean termAdded = tokens.size() > 0;
    -  76  100327
             if (termAdded) {
    -  77  66018
                 final String term = tokens.pop();
    -  78  66017
                 clearAttributes();
    -  79  66020
                 termAtt.append(term);
    +  75  32107
             final boolean termAdded = tokens.size() > 0;
    +  76  32105
             if (termAdded) {
    +  77  21685
                 final String term = tokens.pop();
    +  78  21679
                 clearAttributes();
    +  79  21672
                 termAtt.append(term);
     80  
             }
    -  81  100312
             return termAdded;
    +  81  32084
             return termAdded;
     82  
         }
     83  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html index 4cd993b59..30996a298 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html @@ -135,13 +135,13 @@
         @Override
     59  
         protected boolean isTokenChar(int c) {
    -  60  2077740
             return Character.isLetter(c) || Character.isDigit(c);
    +  60  517068
             return Character.isLetter(c) || Character.isDigit(c);
     61  
         }
     62  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html index bb0d52b1c..02a515890 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html @@ -112,6 +112,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html index 7035c8199..ca897ee9c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html @@ -139,13 +139,13 @@
         @Override
     61  
         protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
    -  62  12
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
    +  62  3
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
     63  
     
    -  64  12
             TokenStream stream = source;
    +  64  3
             TokenStream stream = source;
     65  
     
    -  66  12
             stream = new WordDelimiterFilter(stream,
    +  66  3
             stream = new WordDelimiterFilter(stream,
     67  
                     WordDelimiterFilter.CATENATE_WORDS
     68   @@ -162,17 +162,17 @@
                     | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null);
     74  
     
    -  75  12
             stream = new LowerCaseFilter(version, stream);
    -  76  12
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
    +  75  3
             stream = new LowerCaseFilter(version, stream);
    +  76  3
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
     77  
     
    -  78  12
             return new TokenStreamComponents(source, stream);
    +  78  3
             return new TokenStreamComponents(source, stream);
     79  
         }
     80  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html index 79b75c722..45eb5729c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html @@ -83,7 +83,7 @@
          * the code base.
     33  
          */
    -  34  4
         public static final Version CURRENT_VERSION = Version.LUCENE_45;
    +  34  1
         public static final Version CURRENT_VERSION = Version.LUCENE_45;
     35  
     
     36   @@ -124,15 +124,15 @@
                 final CharSequence text) {
     54  
     
    -  55  908
             if (text == null || buf == null) {
    -  56  4
                 return;
    +  55  99
             if (text == null || buf == null) {
    +  56  1
                 return;
     57  
             }
     58  
     
    -  59  9332
             for (int i = 0; i < text.length(); i++) {
    -  60  8428
                 final char c = text.charAt(i);
    -  61  8428
                 switch (c) {
    +  59  961
             for (int i = 0; i < text.length(); i++) {
    +  60  863
                 final char c = text.charAt(i);
    +  61  863
                 switch (c) {
     62  
                     case '+':
     63   @@ -169,17 +169,17 @@
                     case ':':
     79  
                     case '\\': //it is supposed to fall through here
    -  80  288
                         buf.append('\\');
    +  80  58
                         buf.append('\\');
     81  
                     default:
    -  82  8428
                         buf.append(c);
    +  82  863
                         buf.append(c);
     83  
                         break;
     84  
                 }
     85  
             }
    -  86  904
         }
    +  86  98
         }
     87  
     
     88   @@ -198,27 +198,27 @@
         public static String escapeLuceneQuery(final CharSequence text) {
     95  
     
    -  96  904
             if (text == null) {
    -  97  4
                 return null;
    +  96  98
             if (text == null) {
    +  97  1
                 return null;
     98  
             }
     99  
     
    -  100  900
             int size = text.length();
    -  101  900
             size = size >> 1;
    -  102  900
             final StringBuilder buf = new StringBuilder(size);
    +  100  97
             int size = text.length();
    +  101  97
             size = size >> 1;
    +  102  97
             final StringBuilder buf = new StringBuilder(size);
     103  
     
    -  104  900
             appendEscapedLuceneQuery(buf, text);
    +  104  97
             appendEscapedLuceneQuery(buf, text);
     105  
     
    -  106  900
             return buf.toString();
    +  106  97
             return buf.toString();
     107  
         }
     108  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html index 738eda092..bf38ad60c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html @@ -145,13 +145,13 @@
         @Override
     64  
         protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
    -  65  16
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
    +  65  4
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
     66  
     
    -  67  16
             TokenStream stream = source;
    +  67  4
             TokenStream stream = source;
     68  
     
    -  69  16
             stream = new WordDelimiterFilter(stream,
    +  69  4
             stream = new WordDelimiterFilter(stream,
     70  
                     WordDelimiterFilter.GENERATE_WORD_PARTS
     71   @@ -166,14 +166,14 @@
                     | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null);
     76  
     
    -  77  16
             stream = new LowerCaseFilter(version, stream);
    -  78  16
             stream = new UrlTokenizingFilter(stream);
    -  79  16
             concatenatingFilter = new TokenPairConcatenatingFilter(stream);
    -  80  16
             stream = concatenatingFilter;
    -  81  16
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
    +  77  4
             stream = new LowerCaseFilter(version, stream);
    +  78  4
             stream = new UrlTokenizingFilter(stream);
    +  79  4
             concatenatingFilter = new TokenPairConcatenatingFilter(stream);
    +  80  4
             stream = concatenatingFilter;
    +  81  4
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
     82  
     
    -  83  16
             return new TokenStreamComponents(source, stream);
    +  83  4
             return new TokenStreamComponents(source, stream);
     84  
         }
     85   @@ -194,15 +194,15 @@
          */
     93  
         public void clear() {
    -  94  8
             if (concatenatingFilter != null) {
    -  95  8
                 concatenatingFilter.clear();
    +  94  2
             if (concatenatingFilter != null) {
    +  95  2
                 concatenatingFilter.clear();
     96  
             }
    -  97  8
         }
    +  97  2
         }
     98  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html index 63da9cf98..69f5a96f0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html @@ -158,6 +158,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html index bb44d56e5..d35b00238 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html @@ -93,7 +93,7 @@
          * The char term attribute.
     38  
          */
    -  39  24
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
    +  39  6
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
     40  
         /**
     41   @@ -160,9 +160,9 @@
          */
     72  
         public TokenPairConcatenatingFilter(TokenStream stream) {
    -  73  24
             super(stream);
    -  74  24
             words = new LinkedList<String>();
    -  75  24
         }
    +  73  6
             super(stream);
    +  74  6
             words = new LinkedList<String>();
    +  75  6
         }
     76  
     
     77   @@ -187,35 +187,35 @@
     
     87  
             //collect all the terms into the words collection
    -  88  6160
             while (input.incrementToken()) {
    -  89  1756
                 final String word = new String(termAtt.buffer(), 0, termAtt.length());
    -  90  1756
                 words.add(word);
    -  91  1756
             }
    +  88  638
             while (input.incrementToken()) {
    +  89  181
                 final String word = new String(termAtt.buffer(), 0, termAtt.length());
    +  90  181
                 words.add(word);
    +  91  181
             }
     92  
     
     93  
             //if we have a previousTerm - write it out as its own token concatenated
     94  
             // with the current word (if one is available).
    -  95  4404
             if (previousWord != null && words.size() > 0) {
    -  96  1724
                 final String word = words.getFirst();
    -  97  1724
                 clearAttributes();
    -  98  1724
                 termAtt.append(previousWord).append(word);
    -  99  1724
                 previousWord = null;
    -  100  1724
                 return true;
    +  95  457
             if (previousWord != null && words.size() > 0) {
    +  96  173
                 final String word = words.getFirst();
    +  97  173
                 clearAttributes();
    +  98  173
                 termAtt.append(previousWord).append(word);
    +  99  173
                 previousWord = null;
    +  100  173
                 return true;
     101  
             }
     102  
             //if we have words, write it out as a single token
    -  103  2680
             if (words.size() > 0) {
    -  104  1756
                 final String word = words.removeFirst();
    -  105  1756
                 clearAttributes();
    -  106  1756
                 termAtt.append(word);
    -  107  1756
                 previousWord = word;
    -  108  1756
                 return true;
    +  103  284
             if (words.size() > 0) {
    +  104  181
                 final String word = words.removeFirst();
    +  105  181
                 clearAttributes();
    +  106  181
                 termAtt.append(word);
    +  107  181
                 previousWord = word;
    +  108  181
                 return true;
     109  
             }
    -  110  924
             return false;
    +  110  103
             return false;
     111  
         }
     112   @@ -236,13 +236,13 @@
          */
     120  
         public void clear() {
    -  121  12
             previousWord = null;
    -  122  12
             words.clear();
    -  123  12
         }
    +  121  3
             previousWord = null;
    +  122  3
             words.clear();
    +  123  3
         }
     124  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html index d82f4c8fe..b86c3f9b2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html @@ -99,7 +99,7 @@
          * The logger.
     41  
          */
    -  42  4
         private static final Logger LOGGER = Logger.getLogger(UrlTokenizingFilter.class.getName());
    +  42  1
         private static final Logger LOGGER = Logger.getLogger(UrlTokenizingFilter.class.getName());
     43  
         /**
     44   @@ -136,22 +136,22 @@
         @Override
     60  
         public boolean incrementToken() throws IOException {
    -  61  100507
             final LinkedList<String> tokens = getTokens();
    -  62  100573
             final CharTermAttribute termAtt = getTermAtt();
    -  63  100648
             if (tokens.size() == 0 && input.incrementToken()) {
    -  64  66061
                 final String text = new String(termAtt.buffer(), 0, termAtt.length());
    -  65  66050
                 if (UrlStringUtils.containsUrl(text)) {
    -  66  8
                     final String[] parts = text.split("\\s");
    -  67  16
                     for (String part : parts) {
    -  68  8
                         if (UrlStringUtils.isUrl(part)) {
    +  61  32140
             final LinkedList<String> tokens = getTokens();
    +  62  32189
             final CharTermAttribute termAtt = getTermAtt();
    +  63  32220
             if (tokens.size() == 0 && input.incrementToken()) {
    +  64  21664
                 final String text = new String(termAtt.buffer(), 0, termAtt.length());
    +  65  21704
                 if (UrlStringUtils.containsUrl(text)) {
    +  66  2
                     final String[] parts = text.split("\\s");
    +  67  4
                     for (String part : parts) {
    +  68  2
                         if (UrlStringUtils.isUrl(part)) {
     69  
                             try {
    -  70  8
                                 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    -  71  8
                                 tokens.addAll(data);
    +  70  2
                                 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    +  71  2
                                 tokens.addAll(data);
     72  0
                             } catch (MalformedURLException ex) {
     73  0
                                 LOGGER.log(Level.FINE, "error parsing " + part, ex);
     74  0
                                 tokens.add(part);
    -  75  8
                             }
    +  75  2
                             }
     76  
                         } else {
     77  0
                             tokens.add(part);
    @@ -159,19 +159,19 @@
                         }
     79  
                     }
    -  80  8
                 } else {
    -  81  66028
                     tokens.add(text);
    +  80  2
                 } else {
    +  81  21700
                     tokens.add(text);
     82  
                 }
     83  
             }
    -  84  100330
             return addTerm();
    +  84  21715
             return addTerm();
     85  
         }
     86  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html index 11dfe1f79..2adf99e07 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html @@ -157,6 +157,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html index 9e6068e08..e4d36657b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html @@ -195,6 +195,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html index 749f6d55b..cc902c218 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html @@ -158,12 +158,12 @@
          * @param url the artifactLink url
     73  
          */
    -  74  4
         public MavenArtifact(String groupId, String artifactId, String version, String url) {
    -  75  4
             setGroupId(groupId);
    -  76  4
             setArtifactId(artifactId);
    -  77  4
             setVersion(version);
    -  78  4
             setArtifactUrl(url);
    -  79  4
         }
    +  74  1
         public MavenArtifact(String groupId, String artifactId, String version, String url) {
    +  75  1
             setGroupId(groupId);
    +  76  1
             setArtifactId(artifactId);
    +  77  1
             setVersion(version);
    +  78  1
             setArtifactUrl(url);
    +  79  1
         }
     80  
     
     81   @@ -335,6 +335,6 @@
     // vim: cc=120:sw=4:ts=4:sts=4
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html index 246228cbb..616f04732 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html @@ -125,7 +125,7 @@
          * Used for logging.
     54  
          */
    -  55  4
         private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
    +  55  1
         private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
     56  
                 .getName());
     57   @@ -142,25 +142,25 @@
          * relative to this URL, so it should end with a /
     63  
          */
    -  64  16
         public NexusSearch(URL rootURL) {
    -  65  16
             this.rootURL = rootURL;
    +  64  4
         public NexusSearch(URL rootURL) {
    +  65  4
             this.rootURL = rootURL;
     66  
             try {
    -  67  16
                 if (null != Settings.getString(Settings.KEYS.PROXY_SERVER)
    +  67  4
                 if (null != Settings.getString(Settings.KEYS.PROXY_SERVER)
     68  
                         && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) {
     69  0
                     useProxy = true;
     70  0
                     LOGGER.fine("Using proxy");
     71  
                 } else {
    -  72  16
                     useProxy = false;
    -  73  16
                     LOGGER.fine("Not using proxy");
    +  72  4
                     useProxy = false;
    +  73  4
                     LOGGER.fine("Not using proxy");
     74  
                 }
     75  0
             } catch (InvalidSettingException ise) {
     76  0
                 useProxy = false;
    -  77  16
             }
    -  78  16
         }
    +  77  4
             }
    +  78  4
         }
     79  
     
     80   @@ -183,18 +183,18 @@
          */
     89  
         public MavenArtifact searchSha1(String sha1) throws IOException {
    -  90  16
             if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
    -  91  8
                 throw new IllegalArgumentException("Invalid SHA1 format");
    +  90  4
             if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
    +  91  2
                 throw new IllegalArgumentException("Invalid SHA1 format");
     92  
             }
     93  
     
    -  94  8
             final URL url = new URL(rootURL, String.format("identify/sha1/%s",
    +  94  2
             final URL url = new URL(rootURL, String.format("identify/sha1/%s",
     95  
                     sha1.toLowerCase()));
     96  
     
    -  97  8
             LOGGER.fine(String.format("Searching Nexus url %s", url.toString()));
    +  97  2
             LOGGER.fine(String.format("Searching Nexus url %s", url.toString()));
     98  
     
     99   @@ -207,55 +207,55 @@
             // or proxy is specifically
     103  
             // set to false
    -  104  8
             final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
    +  104  2
             final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
     105  
     
    -  106  8
             conn.setDoOutput(true);
    +  106  2
             conn.setDoOutput(true);
     107  
     
     108  
             // JSON would be more elegant, but there's not currently a dependency
     109  
             // on JSON, so don't want to add one just for this
    -  110  8
             conn.addRequestProperty("Accept", "application/xml");
    -  111  8
             conn.connect();
    +  110  2
             conn.addRequestProperty("Accept", "application/xml");
    +  111  2
             conn.connect();
     112  
     
    -  113  8
             if (conn.getResponseCode() == 200) {
    +  113  2
             if (conn.getResponseCode() == 200) {
     114  
                 try {
    -  115  4
                     final DocumentBuilder builder = DocumentBuilderFactory
    +  115  1
                     final DocumentBuilder builder = DocumentBuilderFactory
     116  
                             .newInstance().newDocumentBuilder();
    -  117  4
                     final Document doc = builder.parse(conn.getInputStream());
    -  118  4
                     final XPath xpath = XPathFactory.newInstance().newXPath();
    -  119  4
                     final String groupId = xpath
    +  117  1
                     final Document doc = builder.parse(conn.getInputStream());
    +  118  1
                     final XPath xpath = XPathFactory.newInstance().newXPath();
    +  119  1
                     final String groupId = xpath
     120  
                             .evaluate(
     121  
                                     "/org.sonatype.nexus.rest.model.NexusArtifact/groupId",
     122  
                                     doc);
    -  123  4
                     final String artifactId = xpath.evaluate(
    +  123  1
                     final String artifactId = xpath.evaluate(
     124  
                             "/org.sonatype.nexus.rest.model.NexusArtifact/artifactId",
     125  
                             doc);
    -  126  4
                     final String version = xpath
    +  126  1
                     final String version = xpath
     127  
                             .evaluate(
     128  
                                     "/org.sonatype.nexus.rest.model.NexusArtifact/version",
     129  
                                     doc);
    -  130  4
                     final String link = xpath
    +  130  1
                     final String link = xpath
     131  
                             .evaluate(
     132  
                                     "/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink",
     133  
                                     doc);
    -  134  4
                     return new MavenArtifact(groupId, artifactId, version, link);
    +  134  1
                     return new MavenArtifact(groupId, artifactId, version, link);
     135  0
                 } catch (Throwable e) {
     136  
                     // Anything else is jacked-up XML stuff that we really can't recover
    @@ -264,8 +264,8 @@  138  0
                     throw new IOException(e.getMessage(), e);
     139  
                 }
    -  140  4
             } else if (conn.getResponseCode() == 404) {
    -  141  4
                 throw new FileNotFoundException("Artifact not found in Nexus");
    +  140  1
             } else if (conn.getResponseCode() == 404) {
    +  141  1
                 throw new FileNotFoundException("Artifact not found in Nexus");
     142  
             } else {
     143  0
                 final String msg = String.format("Could not connect to Nexus received response code: %d %s",
    @@ -293,27 +293,27 @@
         public boolean preflightRequest() {
     156  
             try {
    -  157  16
                 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status"), useProxy);
    -  158  16
                 conn.addRequestProperty("Accept", "application/xml");
    -  159  16
                 conn.connect();
    -  160  16
                 if (conn.getResponseCode() != 200) {
    +  157  4
                 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status"), useProxy);
    +  158  4
                 conn.addRequestProperty("Accept", "application/xml");
    +  159  4
                 conn.connect();
    +  160  4
                 if (conn.getResponseCode() != 200) {
     161  0
                     LOGGER.log(Level.WARNING, "Expected 200 result from Nexus, got {0}", conn.getResponseCode());
     162  0
                     return false;
     163  
                 }
    -  164  16
                 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
    -  165  16
                 final Document doc = builder.parse(conn.getInputStream());
    -  166  16
                 if (!"status".equals(doc.getDocumentElement().getNodeName())) {
    +  164  4
                 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
    +  165  4
                 final Document doc = builder.parse(conn.getInputStream());
    +  166  4
                 if (!"status".equals(doc.getDocumentElement().getNodeName())) {
     167  0
                     LOGGER.log(Level.WARNING, "Expected root node name of status, got {0}", doc.getDocumentElement().getNodeName());
     168  0
                     return false;
     169  
                 }
     170  0
             } catch (Throwable e) {
     171  0
                 return false;
    -  172  16
             }
    +  172  4
             }
     173  
     
    -  174  16
             return true;
    +  174  4
             return true;
     175  
         }
     176   @@ -324,6 +324,6 @@
     // vim: cc=120:sw=4:ts=4:sts=4
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html index 5c2f6fa54..d76c61072 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html @@ -377,6 +377,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html index d6fcfd978..03417d83c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParseException.html @@ -153,6 +153,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html index c412d29a3..310023f47 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NuspecParser.html @@ -93,6 +93,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html index c90a01ac1..cb3365aa5 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.XPathNuspecParser.html @@ -99,8 +99,8 @@
          */
     41  
         private String getOrNull(Node n) {
    -  42  12
             if (n != null) {
    -  43  12
                 return n.getTextContent();
    +  42  3
             if (n != null) {
    +  43  3
                 return n.getTextContent();
     44  
             } else {
     45  0
                 return null;
    @@ -130,32 +130,32 @@
         public NugetPackage parse(InputStream stream) throws NuspecParseException {
     58  
             try {
    -  59  12
                 final Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream);
    -  60  8
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    -  61  8
                 final NugetPackage nuspec = new NugetPackage();
    +  59  3
                 final Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream);
    +  60  2
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    +  61  2
                 final NugetPackage nuspec = new NugetPackage();
     62  
     
    -  63  8
                 if (xpath.evaluate("/package/metadata/id", d, XPathConstants.NODE) == null
    +  63  2
                 if (xpath.evaluate("/package/metadata/id", d, XPathConstants.NODE) == null
     64  
                         || xpath.evaluate("/package/metadata/version", d, XPathConstants.NODE) == null
     65  
                         || xpath.evaluate("/package/metadata/authors", d, XPathConstants.NODE) == null
     66  
                         || xpath.evaluate("/package/metadata/description", d, XPathConstants.NODE) == null) {
    -  67  4
                     throw new NuspecParseException("Invalid Nuspec format");
    +  67  1
                     throw new NuspecParseException("Invalid Nuspec format");
     68  
                 }
     69  
     
    -  70  4
                 nuspec.setId(xpath.evaluate("/package/metadata/id", d));
    -  71  4
                 nuspec.setVersion(xpath.evaluate("/package/metadata/version", d));
    -  72  4
                 nuspec.setAuthors(xpath.evaluate("/package/metadata/authors", d));
    -  73  4
                 nuspec.setOwners(getOrNull((Node) xpath.evaluate("/package/metadata/owners", d, XPathConstants.NODE)));
    -  74  4
                 nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl", d, XPathConstants.NODE)));
    -  75  4
                 nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title", d, XPathConstants.NODE)));
    -  76  4
                 return nuspec;
    -  77  8
             } catch (Throwable e) {
    -  78  8
                 throw new NuspecParseException("Unable to parse nuspec", e);
    +  70  1
                 nuspec.setId(xpath.evaluate("/package/metadata/id", d));
    +  71  1
                 nuspec.setVersion(xpath.evaluate("/package/metadata/version", d));
    +  72  1
                 nuspec.setAuthors(xpath.evaluate("/package/metadata/authors", d));
    +  73  1
                 nuspec.setOwners(getOrNull((Node) xpath.evaluate("/package/metadata/owners", d, XPathConstants.NODE)));
    +  74  1
                 nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl", d, XPathConstants.NODE)));
    +  75  1
                 nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title", d, XPathConstants.NODE)));
    +  76  1
                 return nuspec;
    +  77  2
             } catch (Throwable e) {
    +  78  2
                 throw new NuspecParseException("Unable to parse nuspec", e);
     79  
             }
     80   @@ -164,6 +164,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html index 9a69ad91b..c9aa561bb 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html @@ -113,14 +113,14 @@
          * The Logger.
     48  
          */
    -  49  4
         private static final Logger LOGGER = Logger.getLogger(ConnectionFactory.class.getName());
    +  49  1
         private static final Logger LOGGER = Logger.getLogger(ConnectionFactory.class.getName());
     50  
         /**
     51  
          * The version of the current DB Schema.
     52  
          */
    -  53  4
         public static final String DB_SCHEMA_VERSION = Settings.getString(Settings.KEYS.DB_VERSION);
    +  53  1
         public static final String DB_SCHEMA_VERSION = Settings.getString(Settings.KEYS.DB_VERSION);
     54  
         /**
     55   @@ -135,28 +135,28 @@
          * The database driver used to connect to the database.
     60  
          */
    -  61  4
         private static Driver driver = null;
    +  61  1
         private static Driver driver = null;
     62  
         /**
     63  
          * The database connection string.
     64  
          */
    -  65  4
         private static String connectionString = null;
    +  65  1
         private static String connectionString = null;
     66  
         /**
     67  
          * The username to connect to the database.
     68  
          */
    -  69  4
         private static String userName = null;
    +  69  1
         private static String userName = null;
     70  
         /**
     71  
          * The password for the database.
     72  
          */
    -  73  4
         private static String password = null;
    +  73  1
         private static String password = null;
     74  
     
     75   @@ -187,42 +187,42 @@
         public static synchronized void initialize() throws DatabaseException {
     88  
             //this only needs to be called once.
    -  89  28
             if (connectionString != null) {
    -  90  24
                 return;
    +  89  7
             if (connectionString != null) {
    +  90  6
                 return;
     91  
             }
    -  92  4
             Connection conn = null;
    +  92  1
             Connection conn = null;
     93  
             try {
     94  
                 //load the driver if necessary
    -  95  4
                 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "");
    -  96  4
                 if (!driverName.isEmpty()) { //likely need to load the correct driver
    -  97  4
                     LOGGER.log(Level.FINE, "Loading driver: {0}", driverName);
    -  98  4
                     final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "");
    +  95  1
                 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "");
    +  96  1
                 if (!driverName.isEmpty()) { //likely need to load the correct driver
    +  97  1
                     LOGGER.log(Level.FINE, "Loading driver: {0}", driverName);
    +  98  1
                     final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "");
     99  
                     try {
    -  100  4
                         if (!driverPath.isEmpty()) {
    +  100  1
                         if (!driverPath.isEmpty()) {
     101  0
                             LOGGER.log(Level.FINE, "Loading driver from: {0}", driverPath);
     102  0
                             driver = DriverLoader.load(driverName, driverPath);
     103  
                         } else {
    -  104  4
                             driver = DriverLoader.load(driverName);
    +  104  1
                             driver = DriverLoader.load(driverName);
     105  
                         }
     106  0
                     } catch (DriverLoadException ex) {
     107  0
                         LOGGER.log(Level.FINE, "Unable to load database driver", ex);
     108  0
                         throw new DatabaseException("Unable to load database driver");
    -  109  4
                     }
    +  109  1
                     }
     110  
                 }
    -  111  4
                 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser");
    +  111  1
                 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser");
     112  
                 //yes, yes - hard-coded password - only if there isn't one in the properties file.
    -  113  4
                 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!");
    +  113  1
                 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!");
     114  
                 try {
    -  115  4
                     connectionString = Settings.getConnectionString(
    +  115  1
                     connectionString = Settings.getConnectionString(
     116  
                             Settings.KEYS.DB_CONNECTION_STRING,
     117   @@ -234,27 +234,27 @@  121  
                             "Unable to retrieve the database connection string", ex);
     122  0
                     throw new DatabaseException("Unable to retrieve the database connection string");
    -  123  4
                 }
    -  124  4
                 boolean shouldCreateSchema = false;
    +  123  1
                 }
    +  124  1
                 boolean shouldCreateSchema = false;
     125  
                 try {
    -  126  4
                     if (connectionString.startsWith("jdbc:h2:file:")) { //H2
    -  127  4
                         shouldCreateSchema = !h2DataFileExists();
    -  128  4
                         LOGGER.log(Level.FINE, "Need to create DB Structure: {0}", shouldCreateSchema);
    +  126  1
                     if (connectionString.startsWith("jdbc:h2:file:")) { //H2
    +  127  1
                         shouldCreateSchema = !h2DataFileExists();
    +  128  1
                         LOGGER.log(Level.FINE, "Need to create DB Structure: {0}", shouldCreateSchema);
     129  
                     }
     130  0
                 } catch (IOException ioex) {
     131  0
                     LOGGER.log(Level.FINE, "Unable to verify database exists", ioex);
     132  0
                     throw new DatabaseException("Unable to verify database exists");
    -  133  4
                 }
    -  134  4
                 LOGGER.log(Level.FINE, "Loading database connection");
    -  135  4
                 LOGGER.log(Level.FINE, "Connection String: {0}", connectionString);
    -  136  4
                 LOGGER.log(Level.FINE, "Database User: {0}", userName);
    +  133  1
                 }
    +  134  1
                 LOGGER.log(Level.FINE, "Loading database connection");
    +  135  1
                 LOGGER.log(Level.FINE, "Connection String: {0}", connectionString);
    +  136  1
                 LOGGER.log(Level.FINE, "Database User: {0}", userName);
     137  
     
     138  
                 try {
    -  139  4
                     conn = DriverManager.getConnection(connectionString, userName, password);
    +  139  1
                     conn = DriverManager.getConnection(connectionString, userName, password);
     140  0
                 } catch (SQLException ex) {
     141  0
                     if (ex.getMessage().contains("java.net.UnknownHostException") && connectionString.contains("AUTO_SERVER=TRUE;")) {
     142  0
                         connectionString = connectionString.replace("AUTO_SERVER=TRUE;", "");
    @@ -275,10 +275,10 @@  154  0
                         throw new DatabaseException("Unable to connect to the database");
     155  
                     }
    -  156  4
                 }
    +  156  1
                 }
     157  
     
    -  158  4
                 if (shouldCreateSchema) {
    +  158  1
                 if (shouldCreateSchema) {
     159  
                     try {
     160  0
                         createTables(conn);
    @@ -290,27 +290,27 @@
                 } else {
     166  
                     try {
    -  167  4
                         ensureSchemaVersion(conn);
    +  167  1
                         ensureSchemaVersion(conn);
     168  0
                     } catch (DatabaseException dex) {
     169  0
                         LOGGER.log(Level.FINE, null, dex);
     170  0
                         throw new DatabaseException("Database schema does not match this version of dependency-check");
    -  171  4
                     }
    +  171  1
                     }
     172  
                 }
     173  
             } finally {
    -  174  4
                 if (conn != null) {
    +  174  1
                 if (conn != null) {
     175  
                     try {
    -  176  4
                         conn.close();
    +  176  1
                         conn.close();
     177  0
                     } catch (SQLException ex) {
     178  0
                         LOGGER.log(Level.FINE, "An error occurred closing the connection", ex);
    -  179  4
                     }
    +  179  1
                     }
     180  
                 }
     181  
             }
    -  182  4
         }
    +  182  1
         }
     183  
     
     184   @@ -359,16 +359,16 @@
          */
     212  
         public static Connection getConnection() throws DatabaseException {
    -  213  24
             initialize();
    -  214  24
             Connection conn = null;
    +  213  6
             initialize();
    +  214  6
             Connection conn = null;
     215  
             try {
    -  216  24
                 conn = DriverManager.getConnection(connectionString, userName, password);
    +  216  6
                 conn = DriverManager.getConnection(connectionString, userName, password);
     217  0
             } catch (SQLException ex) {
     218  0
                 LOGGER.log(Level.FINE, null, ex);
     219  0
                 throw new DatabaseException("Unable to connect to the database");
    -  220  24
             }
    -  221  24
             return conn;
    +  220  6
             }
    +  221  6
             return conn;
     222  
         }
     223   @@ -387,11 +387,11 @@
          */
     230  
         private static boolean h2DataFileExists() throws IOException {
    -  231  4
             final File dir = Settings.getDataDirectory();
    -  232  4
             final String name = Settings.getString(Settings.KEYS.DB_FILE_NAME);
    -  233  4
             final String fileName = String.format(name, DB_SCHEMA_VERSION);
    -  234  4
             final File file = new File(dir, fileName);
    -  235  4
             return file.exists();
    +  231  1
             final File dir = Settings.getDataDirectory();
    +  232  1
             final String name = Settings.getString(Settings.KEYS.DB_FILE_NAME);
    +  233  1
             final String fileName = String.format(name, DB_SCHEMA_VERSION);
    +  234  1
             final File file = new File(dir, fileName);
    +  235  1
             return file.exists();
     236  
         }
     237   @@ -472,19 +472,19 @@
          */
     287  
         private static void ensureSchemaVersion(Connection conn) throws DatabaseException {
    -  288  4
             ResultSet rs = null;
    -  289  4
             CallableStatement cs = null;
    +  288  1
             ResultSet rs = null;
    +  289  1
             CallableStatement cs = null;
     290  
             try {
    -  291  4
                 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'");
    -  292  4
                 rs = cs.executeQuery();
    -  293  4
                 if (rs.next()) {
    -  294  4
                     final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
    -  295  4
                     if (isWrongSchema) {
    +  291  1
                 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'");
    +  292  1
                 rs = cs.executeQuery();
    +  293  1
                 if (rs.next()) {
    +  294  1
                     final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
    +  295  1
                     if (isWrongSchema) {
     296  0
                         throw new DatabaseException("Incorrect database schema; unable to continue");
     297  
                     }
    -  298  4
                 } else {
    +  298  1
                 } else {
     299  0
                     throw new DatabaseException("Database schema is missing");
     300  
                 }
    @@ -493,14 +493,14 @@  303  0
                 throw new DatabaseException("Unable to check the database schema version");
     304  
             } finally {
    -  305  4
                 DBUtils.closeResultSet(rs);
    -  306  4
                 DBUtils.closeStatement(cs);
    -  307  4
             }
    -  308  4
         }
    +  305  1
                 DBUtils.closeResultSet(rs);
    +  306  1
                 DBUtils.closeStatement(cs);
    +  307  1
             }
    +  308  1
         }
     309  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html index 47196a1f4..d76d04ac4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html @@ -121,6 +121,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html index 0e16974ab..652cd12e7 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html @@ -137,6 +137,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html index e969b9955..c1eb5db48 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html @@ -99,7 +99,7 @@
          * The Logger.
     41  
          */
    -  42  4
         private static final Logger LOGGER = Logger.getLogger(DatabaseProperties.class.getName());
    +  42  1
         private static final Logger LOGGER = Logger.getLogger(DatabaseProperties.class.getName());
     43  
         /**
     44   @@ -158,10 +158,10 @@
          * @param cveDB the database object holding the properties
     71  
          */
    -  72  12
         DatabaseProperties(CveDB cveDB) {
    -  73  12
             this.cveDB = cveDB;
    -  74  12
             loadProperties();
    -  75  12
         }
    +  72  3
         DatabaseProperties(CveDB cveDB) {
    +  73  3
             this.cveDB = cveDB;
    +  74  3
             loadProperties();
    +  75  3
         }
     76  
     
     77   @@ -172,8 +172,8 @@
          */
     80  
         private void loadProperties() {
    -  81  12
             this.properties = cveDB.getProperties();
    -  82  12
         }
    +  81  3
             this.properties = cveDB.getProperties();
    +  82  3
         }
     83  
     
     84   @@ -323,6 +323,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html index dd1fe3a9b..c0095c439 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html @@ -137,6 +137,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html index cedf90405..54e1ce5ad 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html @@ -102,7 +102,7 @@
          * The logger.
     42  
          */
    -  43  4
         private static final Logger LOGGER = Logger.getLogger(DriverLoader.class.getName());
    +  43  1
         private static final Logger LOGGER = Logger.getLogger(DriverLoader.class.getName());
     44  
     
     45   @@ -133,8 +133,8 @@
          */
     58  
         public static Driver load(String className) throws DriverLoadException {
    -  59  12
             final ClassLoader loader = DriverLoader.class.getClassLoader(); //ClassLoader.getSystemClassLoader();
    -  60  12
             return load(className, loader);
    +  59  3
             final ClassLoader loader = DriverLoader.class.getClassLoader(); //ClassLoader.getSystemClassLoader();
    +  60  3
             return load(className, loader);
     61  
         }
     62   @@ -167,56 +167,56 @@
          */
     76  
         public static Driver load(String className, String pathToDriver) throws DriverLoadException {
    -  77  16
             final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
    -  78  16
             final ArrayList<URL> urls = new ArrayList<URL>();
    -  79  16
             final String[] paths = pathToDriver.split(File.pathSeparator);
    -  80  36
             for (String path : paths) {
    -  81  20
                 final File file = new File(path);
    -  82  20
                 if (file.isDirectory()) {
    -  83  8
                     final File[] files = file.listFiles();
    +  77  4
             final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
    +  78  4
             final ArrayList<URL> urls = new ArrayList<URL>();
    +  79  4
             final String[] paths = pathToDriver.split(File.pathSeparator);
    +  80  9
             for (String path : paths) {
    +  81  5
                 final File file = new File(path);
    +  82  5
                 if (file.isDirectory()) {
    +  83  2
                     final File[] files = file.listFiles();
     84  
     
    -  85  132
                     for (File f : files) {
    +  85  33
                     for (File f : files) {
     86  
                         try {
    -  87  124
                             urls.add(f.toURI().toURL());
    +  87  31
                             urls.add(f.toURI().toURL());
     88  0
                         } catch (MalformedURLException ex) {
     89  0
                             final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'",
     90  
                                     className, f.getAbsoluteFile());
     91  0
                             LOGGER.log(Level.FINE, msg, ex);
     92  0
                             throw new DriverLoadException(msg, ex);
    -  93  124
                         }
    +  93  31
                         }
     94  
                     }
    -  95  8
                 } else if (file.exists()) {
    +  95  2
                 } else if (file.exists()) {
     96  
                     try {
    -  97  8
                         urls.add(file.toURI().toURL());
    +  97  2
                         urls.add(file.toURI().toURL());
     98  0
                     } catch (MalformedURLException ex) {
     99  0
                         final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'",
     100  
                                 className, file.getAbsoluteFile());
     101  0
                         LOGGER.log(Level.FINE, msg, ex);
     102  0
                         throw new DriverLoadException(msg, ex);
    -  103  8
                     }
    +  103  2
                     }
     104  
                 }
     105  
             }
    -  106  16
             final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
    +  106  4
             final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
     107  
                 @Override
     108  
                 public URLClassLoader run() {
    -  109  16
                     return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
    +  109  4
                     return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
     110  
                 }
     111  
             });
     112  
     
    -  113  16
             return load(className, loader);
    +  113  4
             return load(className, loader);
     114  
         }
     115   @@ -241,19 +241,19 @@
         private static Driver load(String className, ClassLoader loader) throws DriverLoadException {
     125  
             try {
    -  126  28
                 final Class c = Class.forName(className, true, loader);
    +  126  7
                 final Class c = Class.forName(className, true, loader);
     127  
                 //final Class c = loader.loadClass(className);
    -  128  16
                 final Driver driver = (Driver) c.newInstance();
    -  129  16
                 final Driver shim = new DriverShim(driver);
    +  128  4
                 final Driver driver = (Driver) c.newInstance();
    +  129  4
                 final Driver shim = new DriverShim(driver);
     130  
                 //using the DriverShim to get around the fact that the DriverManager won't register a driver not in the base class path
    -  131  16
                 DriverManager.registerDriver(shim);
    -  132  16
                 return shim;
    -  133  12
             } catch (ClassNotFoundException ex) {
    -  134  12
                 final String msg = String.format("Unable to load database driver '%s'", className);
    -  135  12
                 LOGGER.log(Level.FINE, msg, ex);
    -  136  12
                 throw new DriverLoadException(msg, ex);
    +  131  4
                 DriverManager.registerDriver(shim);
    +  132  4
                 return shim;
    +  133  3
             } catch (ClassNotFoundException ex) {
    +  134  3
                 final String msg = String.format("Unable to load database driver '%s'", className);
    +  135  3
                 LOGGER.log(Level.FINE, msg, ex);
    +  136  3
                 throw new DriverLoadException(msg, ex);
     137  0
             } catch (InstantiationException ex) {
     138  0
                 final String msg = String.format("Unable to load database driver '%s'", className);
     139  0
                 LOGGER.log(Level.FINE, msg, ex);
    @@ -274,6 +274,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html index 3c3f94fb5..0b0e80660 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html @@ -105,7 +105,7 @@
          * The logger.
     44  
          */
    -  45  4
         private static final Logger LOGGER = Logger.getLogger(DriverShim.class.getName());
    +  45  1
         private static final Logger LOGGER = Logger.getLogger(DriverShim.class.getName());
     46  
         /**
     47   @@ -156,7 +156,7 @@
         @Override
     70  
         public boolean acceptsURL(String url) throws SQLException {
    -  71  8
             return this.driver.acceptsURL(url);
    +  71  2
             return this.driver.acceptsURL(url);
     72  
         }
     73   @@ -388,13 +388,13 @@
         @Override
     201  
         public String toString() {
    -  202  28
             return "DriverShim{" + "driver=" + driver + '}';
    +  202  7
             return "DriverShim{" + "driver=" + driver + '}';
     203  
         }
     204  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html index 9346280ed..a953b95c5 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html @@ -93,6 +93,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html index d4f1bd8fa..4e450b4ce 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html @@ -293,6 +293,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html index da7590539..d34bf8901 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html @@ -137,6 +137,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html index b98e33ef3..d584cfc8d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html @@ -546,6 +546,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html index 45123822b..ad76b6693 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html @@ -121,6 +121,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html index 73b4fc604..b4dc61f55 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html @@ -85,7 +85,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     34  
      */
    -  35  48
     public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
    +  35  12
     public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
     36  
     
     37   @@ -94,7 +94,7 @@
          * A collection of sources of data.
     39  
          */
    -  40  20
         private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
    +  40  5
         private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
     41  
     
     42   @@ -127,13 +127,13 @@
          */
     56  
         public boolean isUpdateNeeded() {
    -  57  12
             for (NvdCveInfo item : this) {
    -  58  16
                 if (item.getNeedsUpdate()) {
    -  59  4
                     return true;
    +  57  3
             for (NvdCveInfo item : this) {
    +  58  4
                 if (item.getNeedsUpdate()) {
    +  59  1
                     return true;
     60  
                 }
    -  61  12
             }
    -  62  8
             return false;
    +  61  3
             }
    +  62  2
             return false;
     63  
         }
     64   @@ -160,8 +160,8 @@
          */
     75  
         public void add(String id, String url, String oldUrl) throws MalformedURLException, DownloadFailedException {
    -  76  4
             add(id, url, oldUrl, false);
    -  77  4
         }
    +  76  1
             add(id, url, oldUrl, false);
    +  77  1
         }
     78  
     
     79   @@ -188,14 +188,14 @@
          */
     90  
         public void add(String id, String url, String oldUrl, boolean needsUpdate) throws MalformedURLException, DownloadFailedException {
    -  91  36
             final NvdCveInfo item = new NvdCveInfo();
    -  92  36
             item.setNeedsUpdate(needsUpdate); //the others default to true, to make life easier later this should default to false.
    -  93  36
             item.setId(id);
    -  94  36
             item.setUrl(url);
    -  95  36
             item.setOldSchemaVersionUrl(oldUrl);
    -  96  36
             item.setTimestamp(Downloader.getLastModified(new URL(url)));
    -  97  36
             collection.put(id, item);
    -  98  36
         }
    +  91  9
             final NvdCveInfo item = new NvdCveInfo();
    +  92  9
             item.setNeedsUpdate(needsUpdate); //the others default to true, to make life easier later this should default to false.
    +  93  9
             item.setId(id);
    +  94  9
             item.setUrl(url);
    +  95  9
             item.setOldSchemaVersionUrl(oldUrl);
    +  96  9
             item.setTimestamp(Downloader.getLastModified(new URL(url)));
    +  97  9
             collection.put(id, item);
    +  98  9
         }
     99  
     
     100   @@ -206,8 +206,8 @@
          */
     103  
         public void clear() {
    -  104  4
             collection.clear();
    -  105  4
         }
    +  104  1
             collection.clear();
    +  105  1
         }
     106  
     
     107   @@ -233,7 +233,7 @@
          * An internal iterator used to implement iterable.
     118  
          */
    -  119  20
         private Iterator<Entry<String, NvdCveInfo>> iterableContent = null;
    +  119  5
         private Iterator<Entry<String, NvdCveInfo>> iterableContent = null;
     120  
     
     121   @@ -256,8 +256,8 @@
         @Override
     130  
         public Iterator<NvdCveInfo> iterator() {
    -  131  16
             iterableContent = collection.entrySet().iterator();
    -  132  16
             return this;
    +  131  4
             iterableContent = collection.entrySet().iterator();
    +  132  4
             return this;
     133  
         }
     134   @@ -282,7 +282,7 @@
         @Override
     144  
         public boolean hasNext() {
    -  145  40
             return iterableContent.hasNext();
    +  145  10
             return iterableContent.hasNext();
     146  
         }
     147   @@ -307,7 +307,7 @@
         @Override
     157  
         public NvdCveInfo next() {
    -  158  28
             return iterableContent.next().getValue();
    +  158  7
             return iterableContent.next().getValue();
     159  
         }
     160   @@ -328,8 +328,8 @@
         @Override
     168  
         public void remove() {
    -  169  4
             iterableContent.remove();
    -  170  4
         }
    +  169  1
             iterableContent.remove();
    +  170  1
         }
     171  
     
     172   @@ -346,7 +346,7 @@
          */
     178  
         NvdCveInfo get(String key) {
    -  179  8
             return collection.get(key);
    +  179  2
             return collection.get(key);
     180  
         }
     181   @@ -362,6 +362,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html index f842bff26..142eea17c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html @@ -119,6 +119,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html index 7b33ecb63..272f630a4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.DownloadTask.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.DownloadTask.html index 3d7ce653b..6440622d1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.DownloadTask.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.DownloadTask.html @@ -445,6 +445,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html index 8bad2a3e0..0f808749a 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html @@ -343,6 +343,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html index 89b05370e..167cf3e83 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html @@ -90,7 +90,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     36  
      */
    -  37  4
     public class NvdCve12Handler extends DefaultHandler {
    +  37  1
     public class NvdCve12Handler extends DefaultHandler {
     38  
     
     39   @@ -139,21 +139,21 @@
          * if the nvd cve should be skipped because it was rejected.
     61  
          */
    -  62  4
         private boolean skip = false;
    +  62  1
         private boolean skip = false;
     63  
         /**
     64  
          * flag indicating if there is a previous version.
     65  
          */
    -  66  4
         private boolean hasPreviousVersion = false;
    +  66  1
         private boolean hasPreviousVersion = false;
     67  
         /**
     68  
          * The current element.
     69  
          */
    -  70  4
         private final Element current = new Element();
    +  70  1
         private final Element current = new Element();
     71  
         /**
     72   @@ -186,33 +186,33 @@
         @Override
     86  
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  87  4888
             current.setNode(qName);
    -  88  4888
             if (current.isEntryNode()) {
    -  89  108
                 vendor = null;
    -  90  108
                 product = null;
    -  91  108
                 hasPreviousVersion = false;
    -  92  108
                 final String reject = attributes.getValue("reject");
    -  93  108
                 skip = "1".equals(reject);
    -  94  108
                 if (!skip) {
    -  95  104
                     vulnerability = attributes.getValue("name");
    -  96  104
                     software = new ArrayList<VulnerableSoftware>();
    +  87  1222
             current.setNode(qName);
    +  88  1222
             if (current.isEntryNode()) {
    +  89  27
                 vendor = null;
    +  90  27
                 product = null;
    +  91  27
                 hasPreviousVersion = false;
    +  92  27
                 final String reject = attributes.getValue("reject");
    +  93  27
                 skip = "1".equals(reject);
    +  94  27
                 if (!skip) {
    +  95  26
                     vulnerability = attributes.getValue("name");
    +  96  26
                     software = new ArrayList<VulnerableSoftware>();
     97  
                 } else {
    -  98  4
                     vulnerability = null;
    -  99  4
                     software = null;
    +  98  1
                     vulnerability = null;
    +  99  1
                     software = null;
     100  
                 }
    -  101  108
             } else if (!skip && current.isProdNode()) {
    +  101  27
             } else if (!skip && current.isProdNode()) {
     102  
     
    -  103  208
                 vendor = attributes.getValue("vendor");
    -  104  208
                 product = attributes.getValue("name");
    -  105  4572
             } else if (!skip && current.isVersNode()) {
    -  106  3044
                 final String prev = attributes.getValue("prev");
    -  107  3044
                 if (prev != null && "1".equals(prev)) {
    -  108  4
                     hasPreviousVersion = true;
    -  109  4
                     final String edition = attributes.getValue("edition");
    -  110  4
                     final String num = attributes.getValue("num");
    +  103  52
                 vendor = attributes.getValue("vendor");
    +  104  52
                 product = attributes.getValue("name");
    +  105  1143
             } else if (!skip && current.isVersNode()) {
    +  106  761
                 final String prev = attributes.getValue("prev");
    +  107  761
                 if (prev != null && "1".equals(prev)) {
    +  108  1
                     hasPreviousVersion = true;
    +  109  1
                     final String edition = attributes.getValue("edition");
    +  110  1
                     final String num = attributes.getValue("num");
     111  
     
     112   @@ -221,48 +221,48 @@
                      purposes this is good enough as we won't use this if we don't find a corresponding "a"
     114  
                      in the nvd cve 2.0. */
    -  115  4
                     String cpe = "cpe:/a:" + vendor + ":" + product;
    -  116  4
                     if (num != null) {
    -  117  4
                         cpe += ":" + num;
    +  115  1
                     String cpe = "cpe:/a:" + vendor + ":" + product;
    +  116  1
                     if (num != null) {
    +  117  1
                         cpe += ":" + num;
     118  
                     }
    -  119  4
                     if (edition != null) {
    +  119  1
                     if (edition != null) {
     120  0
                         cpe += ":" + edition;
     121  
                     }
    -  122  4
                     final VulnerableSoftware vs = new VulnerableSoftware();
    -  123  4
                     vs.setCpe(cpe);
    -  124  4
                     vs.setPreviousVersion(prev);
    -  125  4
                     software.add(vs);
    +  122  1
                     final VulnerableSoftware vs = new VulnerableSoftware();
    +  123  1
                     vs.setCpe(cpe);
    +  124  1
                     vs.setPreviousVersion(prev);
    +  125  1
                     software.add(vs);
     126  
                 }
    -  127  3044
             } else if (current.isNVDNode()) {
    -  128  4
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    -  129  4
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
    +  127  761
             } else if (current.isNVDNode()) {
    +  128  1
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    +  129  1
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
     130  0
                     throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
     131  
                 }
    -  132  4
                 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
    +  132  1
                 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
     133  
             }
    -  134  4888
         }
    +  134  1222
         }
     135  
     
     136  
         @Override
     137  
         public void endElement(String uri, String localName, String qName) throws SAXException {
    -  138  4888
             current.setNode(qName);
    -  139  4888
             if (current.isEntryNode()) {
    -  140  108
                 if (!skip && hasPreviousVersion) {
    -  141  4
                     vulnerabilities.put(vulnerability, software);
    +  138  1222
             current.setNode(qName);
    +  139  1222
             if (current.isEntryNode()) {
    +  140  27
                 if (!skip && hasPreviousVersion) {
    +  141  1
                     vulnerabilities.put(vulnerability, software);
     142  
                 }
    -  143  108
                 vulnerability = null;
    -  144  108
                 software = null;
    +  143  27
                 vulnerability = null;
    +  144  27
                 software = null;
     145  
             }
    -  146  4888
         }
    +  146  1222
         }
     147  
     
     148   @@ -273,7 +273,7 @@
          * A simple class to maintain information about the current element while parsing the NVD CVE XML.
     151  
          */
    -  152  4
         protected static class Element {
    +  152  1
         protected static class Element {
     153  
     
     154   @@ -374,7 +374,7 @@
              */
     202  
             public boolean isNVDNode() {
    -  203  1528
                 return NVD.equals(node);
    +  203  382
                 return NVD.equals(node);
     204  
             }
     205   @@ -391,7 +391,7 @@
              */
     211  
             public boolean isEntryNode() {
    -  212  9776
                 return ENTRY.equals(node);
    +  212  2444
                 return ENTRY.equals(node);
     213  
             }
     214   @@ -425,7 +425,7 @@
              */
     229  
             public boolean isProdNode() {
    -  230  4768
                 return PROD.equals(node);
    +  230  1192
                 return PROD.equals(node);
     231  
             }
     232   @@ -442,7 +442,7 @@
              */
     238  
             public boolean isVersNode() {
    -  239  4560
                 return VERS.equals(node);
    +  239  1140
                 return VERS.equals(node);
     240  
             }
     241   @@ -453,6 +453,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html index 9367ce759..71221c237 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html @@ -98,7 +98,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     40  
      */
    -  41  4
     public class NvdCve20Handler extends DefaultHandler {
    +  41  1
     public class NvdCve20Handler extends DefaultHandler {
     42  
     
     43   @@ -107,7 +107,7 @@
          * The logger.
     45  
          */
    -  46  4
         private static final Logger LOGGER = Logger.getLogger(NvdCve20Handler.class.getName());
    +  46  1
         private static final Logger LOGGER = Logger.getLogger(NvdCve20Handler.class.getName());
     47  
         /**
     48   @@ -122,7 +122,7 @@
          * the current element.
     53  
          */
    -  54  4
         private final Element current = new Element();
    +  54  1
         private final Element current = new Element();
     55  
         /**
     56   @@ -153,7 +153,7 @@
          * flag indicating whether the application has a cpe.
     69  
          */
    -  70  4
         private boolean hasApplicationCpe = false;
    +  70  1
         private boolean hasApplicationCpe = false;
     71  
         /**
     72   @@ -212,144 +212,144 @@
         @Override
     99  
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  100  9648
             current.setNode(qName);
    -  101  9648
             if (current.isEntryNode()) {
    -  102  108
                 hasApplicationCpe = false;
    -  103  108
                 vulnerability = new Vulnerability();
    -  104  108
                 vulnerability.setName(attributes.getValue("id"));
    -  105  9540
             } else if (current.isVulnProductNode()) {
    -  106  2908
                 nodeText = new StringBuilder(100);
    -  107  6632
             } else if (current.isVulnReferencesNode()) {
    -  108  360
                 final String lang = attributes.getValue("xml:lang");
    -  109  360
                 if ("en".equals(lang)) {
    -  110  360
                     reference = new Reference();
    +  100  2412
             current.setNode(qName);
    +  101  2412
             if (current.isEntryNode()) {
    +  102  27
                 hasApplicationCpe = false;
    +  103  27
                 vulnerability = new Vulnerability();
    +  104  27
                 vulnerability.setName(attributes.getValue("id"));
    +  105  2385
             } else if (current.isVulnProductNode()) {
    +  106  727
                 nodeText = new StringBuilder(100);
    +  107  1658
             } else if (current.isVulnReferencesNode()) {
    +  108  90
                 final String lang = attributes.getValue("xml:lang");
    +  109  90
                 if ("en".equals(lang)) {
    +  110  90
                     reference = new Reference();
     111  
                 } else {
     112  0
                     reference = null;
     113  
                 }
    -  114  360
             } else if (reference != null && current.isVulnReferenceNode()) {
    -  115  360
                 reference.setUrl(attributes.getValue("href"));
    -  116  360
                 nodeText = new StringBuilder(130);
    -  117  5912
             } else if (reference != null && current.isVulnSourceNode()) {
    -  118  360
                 nodeText = new StringBuilder(30);
    -  119  5552
             } else if (current.isVulnSummaryNode()) {
    -  120  108
                 nodeText = new StringBuilder(500);
    -  121  5444
             } else if (current.isNVDNode()) {
    -  122  4
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    -  123  4
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
    +  114  90
             } else if (reference != null && current.isVulnReferenceNode()) {
    +  115  90
                 reference.setUrl(attributes.getValue("href"));
    +  116  90
                 nodeText = new StringBuilder(130);
    +  117  1478
             } else if (reference != null && current.isVulnSourceNode()) {
    +  118  90
                 nodeText = new StringBuilder(30);
    +  119  1388
             } else if (current.isVulnSummaryNode()) {
    +  120  27
                 nodeText = new StringBuilder(500);
    +  121  1361
             } else if (current.isNVDNode()) {
    +  122  1
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    +  123  1
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
     124  0
                     throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
     125  
                 }
    -  126  4
             } else if (current.isVulnCWENode()) {
    -  127  76
                 vulnerability.setCwe(attributes.getValue("id"));
    -  128  5364
             } else if (current.isCVSSScoreNode()) {
    -  129  104
                 nodeText = new StringBuilder(5);
    -  130  5260
             } else if (current.isCVSSAccessVectorNode()) {
    -  131  104
                 nodeText = new StringBuilder(20);
    -  132  5156
             } else if (current.isCVSSAccessComplexityNode()) {
    -  133  104
                 nodeText = new StringBuilder(20);
    -  134  5052
             } else if (current.isCVSSAuthenticationNode()) {
    -  135  104
                 nodeText = new StringBuilder(20);
    -  136  4948
             } else if (current.isCVSSAvailabilityImpactNode()) {
    -  137  104
                 nodeText = new StringBuilder(20);
    -  138  4844
             } else if (current.isCVSSConfidentialityImpactNode()) {
    -  139  104
                 nodeText = new StringBuilder(20);
    -  140  4740
             } else if (current.isCVSSIntegrityImpactNode()) {
    -  141  104
                 nodeText = new StringBuilder(20);
    +  126  1
             } else if (current.isVulnCWENode()) {
    +  127  19
                 vulnerability.setCwe(attributes.getValue("id"));
    +  128  1341
             } else if (current.isCVSSScoreNode()) {
    +  129  26
                 nodeText = new StringBuilder(5);
    +  130  1315
             } else if (current.isCVSSAccessVectorNode()) {
    +  131  26
                 nodeText = new StringBuilder(20);
    +  132  1289
             } else if (current.isCVSSAccessComplexityNode()) {
    +  133  26
                 nodeText = new StringBuilder(20);
    +  134  1263
             } else if (current.isCVSSAuthenticationNode()) {
    +  135  26
                 nodeText = new StringBuilder(20);
    +  136  1237
             } else if (current.isCVSSAvailabilityImpactNode()) {
    +  137  26
                 nodeText = new StringBuilder(20);
    +  138  1211
             } else if (current.isCVSSConfidentialityImpactNode()) {
    +  139  26
                 nodeText = new StringBuilder(20);
    +  140  1185
             } else if (current.isCVSSIntegrityImpactNode()) {
    +  141  26
                 nodeText = new StringBuilder(20);
     142  
             }
    -  143  9648
         }
    +  143  2412
         }
     144  
     
     145  
         @Override
     146  
         public void characters(char[] ch, int start, int length) throws SAXException {
    -  147  15948
             if (nodeText != null) {
    -  148  4568
                 nodeText.append(ch, start, length);
    +  147  3987
             if (nodeText != null) {
    +  148  1142
                 nodeText.append(ch, start, length);
     149  
             }
    -  150  15948
         }
    +  150  3987
         }
     151  
     
     152  
         @Override
     153  
         public void endElement(String uri, String localName, String qName) throws SAXException {
    -  154  9648
             current.setNode(qName);
    -  155  9648
             if (current.isEntryNode()) {
    -  156  108
                 totalNumberOfEntries += 1;
    -  157  108
                 if (hasApplicationCpe) {
    -  158  76
                     totalNumberOfApplicationEntries += 1;
    +  154  2412
             current.setNode(qName);
    +  155  2412
             if (current.isEntryNode()) {
    +  156  27
                 totalNumberOfEntries += 1;
    +  157  27
                 if (hasApplicationCpe) {
    +  158  19
                     totalNumberOfApplicationEntries += 1;
     159  
                     try {
    -  160  76
                         saveEntry(vulnerability);
    +  160  19
                         saveEntry(vulnerability);
     161  0
                     } catch (DatabaseException ex) {
     162  0
                         throw new SAXException(ex);
     163  0
                     } catch (CorruptIndexException ex) {
     164  0
                         throw new SAXException(ex);
     165  0
                     } catch (IOException ex) {
     166  0
                         throw new SAXException(ex);
    -  167  76
                     }
    +  167  19
                     }
     168  
                 }
    -  169  108
                 vulnerability = null;
    -  170  9540
             } else if (current.isCVSSScoreNode()) {
    +  169  27
                 vulnerability = null;
    +  170  2385
             } else if (current.isCVSSScoreNode()) {
     171  
                 try {
    -  172  104
                     final float score = Float.parseFloat(nodeText.toString());
    -  173  104
                     vulnerability.setCvssScore(score);
    +  172  26
                     final float score = Float.parseFloat(nodeText.toString());
    +  173  26
                     vulnerability.setCvssScore(score);
     174  0
                 } catch (NumberFormatException ex) {
     175  0
                     LOGGER.log(Level.SEVERE, "Error parsing CVSS Score.");
     176  0
                     LOGGER.log(Level.FINE, null, ex);
    -  177  104
                 }
    -  178  104
                 nodeText = null;
    -  179  9436
             } else if (current.isCVSSAccessVectorNode()) {
    -  180  104
                 vulnerability.setCvssAccessVector(nodeText.toString());
    -  181  104
                 nodeText = null;
    -  182  9332
             } else if (current.isCVSSAccessComplexityNode()) {
    -  183  104
                 vulnerability.setCvssAccessComplexity(nodeText.toString());
    -  184  104
                 nodeText = null;
    -  185  9228
             } else if (current.isCVSSAuthenticationNode()) {
    -  186  104
                 vulnerability.setCvssAuthentication(nodeText.toString());
    -  187  104
                 nodeText = null;
    -  188  9124
             } else if (current.isCVSSAvailabilityImpactNode()) {
    -  189  104
                 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
    -  190  104
                 nodeText = null;
    -  191  9020
             } else if (current.isCVSSConfidentialityImpactNode()) {
    -  192  104
                 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
    -  193  104
                 nodeText = null;
    -  194  8916
             } else if (current.isCVSSIntegrityImpactNode()) {
    -  195  104
                 vulnerability.setCvssIntegrityImpact(nodeText.toString());
    -  196  104
                 nodeText = null;
    -  197  8812
             } else if (current.isVulnProductNode()) {
    -  198  2908
                 final String cpe = nodeText.toString();
    -  199  2908
                 if (cpe.startsWith("cpe:/a:")) {
    -  200  2456
                     hasApplicationCpe = true;
    -  201  2456
                     vulnerability.addVulnerableSoftware(cpe);
    +  177  26
                 }
    +  178  26
                 nodeText = null;
    +  179  2359
             } else if (current.isCVSSAccessVectorNode()) {
    +  180  26
                 vulnerability.setCvssAccessVector(nodeText.toString());
    +  181  26
                 nodeText = null;
    +  182  2333
             } else if (current.isCVSSAccessComplexityNode()) {
    +  183  26
                 vulnerability.setCvssAccessComplexity(nodeText.toString());
    +  184  26
                 nodeText = null;
    +  185  2307
             } else if (current.isCVSSAuthenticationNode()) {
    +  186  26
                 vulnerability.setCvssAuthentication(nodeText.toString());
    +  187  26
                 nodeText = null;
    +  188  2281
             } else if (current.isCVSSAvailabilityImpactNode()) {
    +  189  26
                 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
    +  190  26
                 nodeText = null;
    +  191  2255
             } else if (current.isCVSSConfidentialityImpactNode()) {
    +  192  26
                 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
    +  193  26
                 nodeText = null;
    +  194  2229
             } else if (current.isCVSSIntegrityImpactNode()) {
    +  195  26
                 vulnerability.setCvssIntegrityImpact(nodeText.toString());
    +  196  26
                 nodeText = null;
    +  197  2203
             } else if (current.isVulnProductNode()) {
    +  198  727
                 final String cpe = nodeText.toString();
    +  199  727
                 if (cpe.startsWith("cpe:/a:")) {
    +  200  614
                     hasApplicationCpe = true;
    +  201  614
                     vulnerability.addVulnerableSoftware(cpe);
     202  
                 }
    -  203  2908
                 nodeText = null;
    -  204  2908
             } else if (reference != null && current.isVulnReferencesNode()) {
    -  205  360
                 vulnerability.addReference(reference);
    -  206  360
                 reference = null;
    -  207  5544
             } else if (reference != null && current.isVulnReferenceNode()) {
    -  208  360
                 reference.setName(nodeText.toString());
    -  209  360
                 nodeText = null;
    -  210  5184
             } else if (reference != null && current.isVulnSourceNode()) {
    -  211  360
                 reference.setSource(nodeText.toString());
    -  212  360
                 nodeText = null;
    -  213  4824
             } else if (current.isVulnSummaryNode()) {
    -  214  108
                 vulnerability.setDescription(nodeText.toString());
    -  215  108
                 if (nodeText.indexOf("** REJECT **") >= 0) {
    -  216  4
                     hasApplicationCpe = true; //ensure we process this to delete the vuln
    +  203  727
                 nodeText = null;
    +  204  727
             } else if (reference != null && current.isVulnReferencesNode()) {
    +  205  90
                 vulnerability.addReference(reference);
    +  206  90
                 reference = null;
    +  207  1386
             } else if (reference != null && current.isVulnReferenceNode()) {
    +  208  90
                 reference.setName(nodeText.toString());
    +  209  90
                 nodeText = null;
    +  210  1296
             } else if (reference != null && current.isVulnSourceNode()) {
    +  211  90
                 reference.setSource(nodeText.toString());
    +  212  90
                 nodeText = null;
    +  213  1206
             } else if (current.isVulnSummaryNode()) {
    +  214  27
                 vulnerability.setDescription(nodeText.toString());
    +  215  27
                 if (nodeText.indexOf("** REJECT **") >= 0) {
    +  216  1
                     hasApplicationCpe = true; //ensure we process this to delete the vuln
     217  
                 }
    -  218  108
                 nodeText = null;
    +  218  27
                 nodeText = null;
     219  
             }
    -  220  9648
         }
    +  220  2412
         }
     221  
         /**
     222   @@ -422,8 +422,8 @@
          */
     256  
         private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException {
    -  257  76
             if (cveDB == null) {
    -  258  76
                 return;
    +  257  19
             if (cveDB == null) {
    +  258  19
                 return;
     259  
             }
     260  0
             final String cveName = vuln.getName();
    @@ -446,7 +446,7 @@
          * A simple class to maintain information about the current element while parsing the NVD CVE XML.
     273  
          */
    -  274  4
         protected static class Element {
    +  274  1
         protected static class Element {
     275  
     
     276   @@ -627,7 +627,7 @@
              */
     364  
             public boolean isNVDNode() {
    -  365  5444
                 return NVD.equals(node);
    +  365  1361
                 return NVD.equals(node);
     366  
             }
     367   @@ -644,7 +644,7 @@
              */
     373  
             public boolean isEntryNode() {
    -  374  19296
                 return ENTRY.equals(node);
    +  374  4824
                 return ENTRY.equals(node);
     375  
             }
     376   @@ -661,7 +661,7 @@
              */
     382  
             public boolean isVulnProductNode() {
    -  383  18352
                 return VULN_PRODUCT.equals(node);
    +  383  4588
                 return VULN_PRODUCT.equals(node);
     384  
             }
     385   @@ -678,7 +678,7 @@
              */
     391  
             public boolean isVulnReferencesNode() {
    -  392  7712
                 return VULN_REFERENCES.equals(node);
    +  392  1928
                 return VULN_REFERENCES.equals(node);
     393  
             }
     394   @@ -695,7 +695,7 @@
              */
     400  
             public boolean isVulnReferenceNode() {
    -  401  1440
                 return VULN_REFERENCE.equals(node);
    +  401  360
                 return VULN_REFERENCE.equals(node);
     402  
             }
     403   @@ -712,7 +712,7 @@
              */
     409  
             public boolean isVulnSourceNode() {
    -  410  720
                 return VULN_SOURCE.equals(node);
    +  410  180
                 return VULN_SOURCE.equals(node);
     411  
             }
     412   @@ -729,7 +729,7 @@
              */
     418  
             public boolean isVulnSummaryNode() {
    -  419  10376
                 return VULN_SUMMARY.equals(node);
    +  419  2594
                 return VULN_SUMMARY.equals(node);
     420  
             }
     421   @@ -746,7 +746,7 @@
              */
     427  
             public boolean isVulnCWENode() {
    -  428  5440
                 return VULN_CWE.equals(node);
    +  428  1360
                 return VULN_CWE.equals(node);
     429  
             }
     430   @@ -763,7 +763,7 @@
              */
     436  
             public boolean isCVSSScoreNode() {
    -  437  14904
                 return CVSS_SCORE.equals(node);
    +  437  3726
                 return CVSS_SCORE.equals(node);
     438  
             }
     439   @@ -780,7 +780,7 @@
              */
     445  
             public boolean isCVSSAccessVectorNode() {
    -  446  14696
                 return CVSS_ACCESS_VECTOR.equals(node);
    +  446  3674
                 return CVSS_ACCESS_VECTOR.equals(node);
     447  
             }
     448   @@ -797,7 +797,7 @@
              */
     454  
             public boolean isCVSSAccessComplexityNode() {
    -  455  14488
                 return CVSS_ACCESS_COMPLEXITY.equals(node);
    +  455  3622
                 return CVSS_ACCESS_COMPLEXITY.equals(node);
     456  
             }
     457   @@ -814,7 +814,7 @@
              */
     463  
             public boolean isCVSSAuthenticationNode() {
    -  464  14280
                 return CVSS_AUTHENTICATION.equals(node);
    +  464  3570
                 return CVSS_AUTHENTICATION.equals(node);
     465  
             }
     466   @@ -831,7 +831,7 @@
              */
     472  
             public boolean isCVSSConfidentialityImpactNode() {
    -  473  13864
                 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
    +  473  3466
                 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
     474  
             }
     475   @@ -848,7 +848,7 @@
              */
     481  
             public boolean isCVSSIntegrityImpactNode() {
    -  482  13656
                 return CVSS_INTEGRITY_IMPACT.equals(node);
    +  482  3414
                 return CVSS_INTEGRITY_IMPACT.equals(node);
     483  
             }
     484   @@ -865,7 +865,7 @@
              */
     490  
             public boolean isCVSSAvailabilityImpactNode() {
    -  491  14072
                 return CVSS_AVAILABILITY_IMPACT.equals(node);
    +  491  3518
                 return CVSS_AVAILABILITY_IMPACT.equals(node);
     492  
             }
     493   @@ -876,6 +876,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html index 929d550c6..a53170930 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html @@ -65,7 +65,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     24  
      */
    -  25  20
     public enum Confidence {
    +  25  5
     public enum Confidence {
     26  
     
     27   @@ -74,32 +74,32 @@
          * High confidence evidence.
     29  
          */
    -  30  4
         HIGHEST,
    +  30  1
         HIGHEST,
     31  
         /**
     32  
          * High confidence evidence.
     33  
          */
    -  34  4
         HIGH,
    +  34  1
         HIGH,
     35  
         /**
     36  
          * Medium confidence evidence.
     37  
          */
    -  38  4
         MEDIUM,
    +  38  1
         MEDIUM,
     39  
         /**
     40  
          * Low confidence evidence.
     41  
          */
    -  42  4
         LOW
    +  42  1
         LOW
     43  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html index bc695475c..f4ed9439c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html @@ -60,1205 +60,1207 @@  21  
     import java.io.IOException;
     22   -
     import java.security.NoSuchAlgorithmException;
    +
     import java.io.Serializable;
     23   -
     import java.util.Set;
    +
     import java.security.NoSuchAlgorithmException;
     24   -
     import java.util.SortedSet;
    +
     import java.util.Set;
     25   -
     import java.util.TreeSet;
    +
     import java.util.SortedSet;
     26   -
     import java.util.logging.Level;
    +
     import java.util.TreeSet;
     27   -
     import java.util.logging.Logger;
    +
     import java.util.logging.Level;
     28   -
     import org.owasp.dependencycheck.utils.Checksum;
    +
     import java.util.logging.Logger;
     29   -
     import org.owasp.dependencycheck.utils.FileUtils;
    +
     import org.owasp.dependencycheck.utils.Checksum;
     30   -
     
    +
     import org.owasp.dependencycheck.utils.FileUtils;
     31   -
     /**
    +
     
     32   -
      * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect
    +
     /**
     33   -
      * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any
    +
      * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect
     34   -
      * known, published, vulnerabilities associated with the program dependency.
    +
      * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any
     35   -
      *
    +
      * known, published, vulnerabilities associated with the program dependency.
     36   -
      * @author Jeremy Long <jeremy.long@owasp.org>
    +
      *
     37   +
      * @author Jeremy Long <jeremy.long@owasp.org>
    +  38  
      */
    -  38  8
     public class Dependency implements Comparable<Dependency> {
    -  39   -
     
    +  39  2
     public class Dependency implements Serializable, Comparable<Dependency> {
     40   -
         /**
    +
     
     41   -
          * The logger.
    +
         /**
     42   +
          * The logger.
    +  43  
          */
    -  43  4
         private static final Logger LOGGER = Logger.getLogger(Dependency.class.getName());
    -  44   -
         /**
    +  44  1
         private static final Logger LOGGER = Logger.getLogger(Dependency.class.getName());
     45   -
          * The actual file path of the dependency on disk.
    +
         /**
     46   -
          */
    +
          * The actual file path of the dependency on disk.
     47   -
         private String actualFilePath;
    +
          */
     48   -
         /**
    +
         private String actualFilePath;
     49   -
          * The file path to display.
    +
         /**
     50   -
          */
    +
          * The file path to display.
     51   -
         private String filePath;
    +
          */
     52   -
         /**
    +
         private String filePath;
     53   -
          * The file name of the dependency.
    +
         /**
     54   -
          */
    +
          * The file name of the dependency.
     55   -
         private String fileName;
    +
          */
     56   -
         /**
    +
         private String fileName;
     57   -
          * The file extension of the dependency.
    +
         /**
     58   -
          */
    +
          * The file extension of the dependency.
     59   -
         private String fileExtension;
    +
          */
     60   -
         /**
    +
         private String fileExtension;
     61   -
          * The md5 hash of the dependency.
    +
         /**
     62   -
          */
    +
          * The md5 hash of the dependency.
     63   -
         private String md5sum;
    +
          */
     64   -
         /**
    +
         private String md5sum;
     65   -
          * The SHA1 hash of the dependency.
    +
         /**
     66   -
          */
    +
          * The SHA1 hash of the dependency.
     67   -
         private String sha1sum;
    +
          */
     68   -
         /**
    +
         private String sha1sum;
     69   -
          * A list of Identifiers.
    +
         /**
     70   -
          */
    +
          * A list of Identifiers.
     71   -
         private Set<Identifier> identifiers;
    +
          */
     72   -
         /**
    +
         private Set<Identifier> identifiers;
     73   -
          * A collection of vendor evidence.
    +
         /**
     74   -
          */
    +
          * A collection of vendor evidence.
     75   -
         private final EvidenceCollection vendorEvidence;
    +
          */
     76   -
         /**
    +
         private final EvidenceCollection vendorEvidence;
     77   -
          * A collection of product evidence.
    +
         /**
     78   -
          */
    +
          * A collection of product evidence.
     79   -
         private final EvidenceCollection productEvidence;
    +
          */
     80   -
         /**
    +
         private final EvidenceCollection productEvidence;
     81   -
          * A collection of version evidence.
    +
         /**
     82   -
          */
    +
          * A collection of version evidence.
     83   -
         private final EvidenceCollection versionEvidence;
    +
          */
     84   -
     
    +
         private final EvidenceCollection versionEvidence;
     85   -
         /**
    +
     
     86   -
          * Constructs a new Dependency object.
    +
         /**
     87   -
          */
    -  88  152
         public Dependency() {
    -  89  152
             vendorEvidence = new EvidenceCollection();
    -  90  152
             productEvidence = new EvidenceCollection();
    -  91  152
             versionEvidence = new EvidenceCollection();
    -  92  152
             identifiers = new TreeSet<Identifier>();
    -  93  152
             vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
    -  94  152
             suppressedIdentifiers = new TreeSet<Identifier>();
    -  95  152
             suppressedVulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
    -  96  152
         }
    -  97   -
     
    -  98   -
         /**
    -  99  
          * Constructs a new Dependency object.
    +  88   +
          */
    +  89  38
         public Dependency() {
    +  90  38
             vendorEvidence = new EvidenceCollection();
    +  91  38
             productEvidence = new EvidenceCollection();
    +  92  38
             versionEvidence = new EvidenceCollection();
    +  93  38
             identifiers = new TreeSet<Identifier>();
    +  94  38
             vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
    +  95  38
             suppressedIdentifiers = new TreeSet<Identifier>();
    +  96  38
             suppressedVulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
    +  97  38
         }
    +  98   +
     
    +  99   +
         /**
     100   -
          *
    +
          * Constructs a new Dependency object.
     101   -
          * @param file the File to create the dependency object from.
    +
          *
     102   -
          */
    +
          * @param file the File to create the dependency object from.
     103   +
          */
    +  104  
         public Dependency(File file) {
    -  104  68
             this();
    -  105  68
             this.actualFilePath = file.getPath();
    -  106  68
             this.filePath = this.actualFilePath;
    -  107  68
             this.fileName = file.getName();
    -  108  68
             this.fileExtension = FileUtils.getFileExtension(fileName);
    -  109  68
             determineHashes(file);
    -  110  68
         }
    -  111   -
     
    +  105  17
             this();
    +  106  17
             this.actualFilePath = file.getPath();
    +  107  17
             this.filePath = this.actualFilePath;
    +  108  17
             this.fileName = file.getName();
    +  109  17
             this.fileExtension = FileUtils.getFileExtension(fileName);
    +  110  17
             determineHashes(file);
    +  111  17
         }
     112   -
         /**
    +
     
     113   -
          * Returns the file name of the dependency.
    +
         /**
     114   -
          *
    +
          * Returns the file name of the dependency.
     115   -
          * @return the file name of the dependency
    +
          *
     116   -
          */
    +
          * @return the file name of the dependency
     117   -
         public String getFileName() {
    +
          */
     118   -
             return this.fileName;
    +
         public String getFileName() {
     119   -
         }
    +
             return this.fileName;
     120   -
     
    +
         }
     121   -
         /**
    +
     
     122   -
          * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack
    +
         /**
     123   -
          * as I could not get the replace to work in the template itself.
    +
          * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack
     124   -
          *
    +
          * as I could not get the replace to work in the template itself.
     125   -
          * @return the file name of the dependency with the backslash escaped for use in JavaScript
    +
          *
     126   -
          */
    +
          * @return the file name of the dependency with the backslash escaped for use in JavaScript
     127   +
          */
    +  128  
         public String getFileNameForJavaScript() {
    -  128  0
             return this.fileName.replace("\\", "\\\\");
    -  129   -
         }
    +  129  0
             return this.fileName.replace("\\", "\\\\");
     130   -
     
    +
         }
     131   -
         /**
    +
     
     132   -
          * Sets the file name of the dependency.
    +
         /**
     133   -
          *
    -  134   -
          * @param fileName the file name of the dependency
    -  135   -
          */
    -  136   -
         public void setFileName(String fileName) {
    -  137   -
             this.fileName = fileName;
    -  138   -
         }
    -  139   -
     
    -  140   -
         /**
    -  141   -
          * Sets the actual file path of the dependency on disk.
    -  142   -
          *
    -  143   -
          * @param actualFilePath the file path of the dependency
    -  144   -
          */
    -  145   -
         public void setActualFilePath(String actualFilePath) {
    -  146  8
             this.actualFilePath = actualFilePath;
    -  147  8
             if (this.sha1sum == null) {
    -  148  8
                 final File file = new File(this.actualFilePath);
    -  149  8
                 determineHashes(file);
    -  150   -
             }
    -  151  8
         }
    -  152   -
     
    -  153   -
         /**
    -  154   -
          * Gets the file path of the dependency.
    -  155   -
          *
    -  156   -
          * @return the file path of the dependency
    -  157   -
          */
    -  158   -
         public String getActualFilePath() {
    -  159   -
             return this.actualFilePath;
    -  160   -
         }
    -  161   -
     
    -  162   -
         /**
    -  163   -
          * Gets a reference to the File object.
    -  164   -
          *
    -  165   -
          * @return the File object
    -  166   -
          */
    -  167   -
         public File getActualFile() {
    -  168  12
             return new File(this.actualFilePath);
    -  169   -
         }
    -  170   -
     
    -  171   -
         /**
    -  172   -
          * Sets the file path of the dependency.
    -  173   -
          *
    -  174   -
          * @param filePath the file path of the dependency
    -  175   -
          */
    -  176   -
         public void setFilePath(String filePath) {
    -  177   -
             this.filePath = filePath;
    -  178   -
         }
    -  179   -
     
    -  180   -
         /**
    -  181   -
          * The file name to display in reports.
    -  182   -
          */
    -  183  152
         private String displayName = null;
    -  184   -
     
    -  185   -
         /**
    -  186   -
          * Sets the file name to display in reports.
    -  187   -
          *
    -  188   -
          * @param displayName the name to display
    -  189   -
          */
    -  190   -
         public void setDisplayFileName(String displayName) {
    -  191   -
             this.displayName = displayName;
    -  192   -
         }
    -  193   -
     
    -  194   -
         /**
    -  195   -
          * Returns the file name to display in reports; if no display file name has been set it will default to the actual
    -  196   -
          * file name.
    -  197   -
          *
    -  198   -
          * @return the file name to display
    -  199   -
          */
    -  200   -
         public String getDisplayFileName() {
    -  201  0
             if (displayName == null) {
    -  202  0
                 return this.fileName;
    -  203   -
             }
    -  204  0
             return this.displayName;
    -  205   -
         }
    -  206   -
     
    -  207   -
         /**
    -  208   -
          * <p>
    -  209   -
          * Gets the file path of the dependency.</p>
    -  210   -
          * <p>
    -  211   -
          * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be
    -  212   -
          * obtained via the getActualFilePath().</p>
    -  213   -
          *
    -  214   -
          * @return the file path of the dependency
    -  215   -
          */
    -  216   -
         public String getFilePath() {
    -  217   -
             return this.filePath;
    -  218   -
         }
    -  219   -
     
    -  220   -
         /**
    -  221  
          * Sets the file name of the dependency.
    +  134   +
          *
    +  135   +
          * @param fileName the file name of the dependency
    +  136   +
          */
    +  137   +
         public void setFileName(String fileName) {
    +  138   +
             this.fileName = fileName;
    +  139   +
         }
    +  140   +
     
    +  141   +
         /**
    +  142   +
          * Sets the actual file path of the dependency on disk.
    +  143   +
          *
    +  144   +
          * @param actualFilePath the file path of the dependency
    +  145   +
          */
    +  146   +
         public void setActualFilePath(String actualFilePath) {
    +  147  2
             this.actualFilePath = actualFilePath;
    +  148  2
             if (this.sha1sum == null) {
    +  149  2
                 final File file = new File(this.actualFilePath);
    +  150  2
                 determineHashes(file);
    +  151   +
             }
    +  152  2
         }
    +  153   +
     
    +  154   +
         /**
    +  155   +
          * Gets the file path of the dependency.
    +  156   +
          *
    +  157   +
          * @return the file path of the dependency
    +  158   +
          */
    +  159   +
         public String getActualFilePath() {
    +  160   +
             return this.actualFilePath;
    +  161   +
         }
    +  162   +
     
    +  163   +
         /**
    +  164   +
          * Gets a reference to the File object.
    +  165   +
          *
    +  166   +
          * @return the File object
    +  167   +
          */
    +  168   +
         public File getActualFile() {
    +  169  3
             return new File(this.actualFilePath);
    +  170   +
         }
    +  171   +
     
    +  172   +
         /**
    +  173   +
          * Sets the file path of the dependency.
    +  174   +
          *
    +  175   +
          * @param filePath the file path of the dependency
    +  176   +
          */
    +  177   +
         public void setFilePath(String filePath) {
    +  178   +
             this.filePath = filePath;
    +  179   +
         }
    +  180   +
     
    +  181   +
         /**
    +  182   +
          * The file name to display in reports.
    +  183   +
          */
    +  184  38
         private String displayName = null;
    +  185   +
     
    +  186   +
         /**
    +  187   +
          * Sets the file name to display in reports.
    +  188   +
          *
    +  189   +
          * @param displayName the name to display
    +  190   +
          */
    +  191   +
         public void setDisplayFileName(String displayName) {
    +  192   +
             this.displayName = displayName;
    +  193   +
         }
    +  194   +
     
    +  195   +
         /**
    +  196   +
          * Returns the file name to display in reports; if no display file name has been set it will default to the actual
    +  197   +
          * file name.
    +  198   +
          *
    +  199   +
          * @return the file name to display
    +  200   +
          */
    +  201   +
         public String getDisplayFileName() {
    +  202  0
             if (displayName == null) {
    +  203  0
                 return this.fileName;
    +  204   +
             }
    +  205  0
             return this.displayName;
    +  206   +
         }
    +  207   +
     
    +  208   +
         /**
    +  209   +
          * <p>
    +  210   +
          * Gets the file path of the dependency.</p>
    +  211   +
          * <p>
    +  212   +
          * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be
    +  213   +
          * obtained via the getActualFilePath().</p>
    +  214   +
          *
    +  215   +
          * @return the file path of the dependency
    +  216   +
          */
    +  217   +
         public String getFilePath() {
    +  218   +
             return this.filePath;
    +  219   +
         }
    +  220   +
     
    +  221   +
         /**
     222   -
          *
    +
          * Sets the file name of the dependency.
     223   -
          * @param fileExtension the file name of the dependency
    +
          *
     224   -
          */
    +
          * @param fileExtension the file name of the dependency
     225   -
         public void setFileExtension(String fileExtension) {
    +
          */
     226   -
             this.fileExtension = fileExtension;
    +
         public void setFileExtension(String fileExtension) {
     227   -
         }
    +
             this.fileExtension = fileExtension;
     228   -
     
    +
         }
     229   -
         /**
    +
     
     230   -
          * Gets the file extension of the dependency.
    +
         /**
     231   -
          *
    +
          * Gets the file extension of the dependency.
     232   -
          * @return the file extension of the dependency
    +
          *
     233   -
          */
    +
          * @return the file extension of the dependency
     234   -
         public String getFileExtension() {
    +
          */
     235   -
             return this.fileExtension;
    +
         public String getFileExtension() {
     236   -
         }
    +
             return this.fileExtension;
     237   -
     
    +
         }
     238   -
         /**
    +
     
     239   -
          * Returns the MD5 Checksum of the dependency file.
    +
         /**
     240   -
          *
    +
          * Returns the MD5 Checksum of the dependency file.
     241   -
          * @return the MD5 Checksum
    +
          *
     242   -
          */
    +
          * @return the MD5 Checksum
     243   -
         public String getMd5sum() {
    +
          */
     244   -
             return this.md5sum;
    +
         public String getMd5sum() {
     245   -
         }
    +
             return this.md5sum;
     246   -
     
    +
         }
     247   -
         /**
    +
     
     248   -
          * Sets the MD5 Checksum of the dependency.
    +
         /**
     249   -
          *
    +
          * Sets the MD5 Checksum of the dependency.
     250   -
          * @param md5sum the MD5 Checksum
    +
          *
     251   -
          */
    +
          * @param md5sum the MD5 Checksum
     252   -
         public void setMd5sum(String md5sum) {
    +
          */
     253   -
             this.md5sum = md5sum;
    +
         public void setMd5sum(String md5sum) {
     254   -
         }
    +
             this.md5sum = md5sum;
     255   -
     
    +
         }
     256   -
         /**
    +
     
     257   -
          * Returns the SHA1 Checksum of the dependency.
    +
         /**
     258   -
          *
    +
          * Returns the SHA1 Checksum of the dependency.
     259   -
          * @return the SHA1 Checksum
    +
          *
     260   -
          */
    +
          * @return the SHA1 Checksum
     261   -
         public String getSha1sum() {
    +
          */
     262   -
             return this.sha1sum;
    +
         public String getSha1sum() {
     263   -
         }
    +
             return this.sha1sum;
     264   -
     
    +
         }
     265   -
         /**
    +
     
     266   -
          * Sets the SHA1 Checksum of the dependency.
    +
         /**
     267   -
          *
    +
          * Sets the SHA1 Checksum of the dependency.
     268   -
          * @param sha1sum the SHA1 Checksum
    +
          *
     269   -
          */
    +
          * @param sha1sum the SHA1 Checksum
     270   -
         public void setSha1sum(String sha1sum) {
    +
          */
     271   -
             this.sha1sum = sha1sum;
    +
         public void setSha1sum(String sha1sum) {
     272   -
         }
    +
             this.sha1sum = sha1sum;
     273   -
     
    +
         }
     274   -
         /**
    +
     
     275   -
          * Returns a List of Identifiers.
    +
         /**
     276   -
          *
    +
          * Returns a List of Identifiers.
     277   -
          * @return an ArrayList of Identifiers
    +
          *
     278   -
          */
    +
          * @return an ArrayList of Identifiers
     279   -
         public Set<Identifier> getIdentifiers() {
    +
          */
     280   -
             return this.identifiers;
    +
         public Set<Identifier> getIdentifiers() {
     281   -
         }
    +
             return this.identifiers;
     282   -
     
    +
         }
     283   -
         /**
    +
     
     284   -
          * Sets a List of Identifiers.
    +
         /**
     285   -
          *
    +
          * Sets a List of Identifiers.
     286   -
          * @param identifiers A list of Identifiers
    +
          *
     287   -
          */
    +
          * @param identifiers A list of Identifiers
     288   -
         public void setIdentifiers(Set<Identifier> identifiers) {
    +
          */
     289   -
             this.identifiers = identifiers;
    +
         public void setIdentifiers(Set<Identifier> identifiers) {
     290   -
         }
    +
             this.identifiers = identifiers;
     291   -
     
    +
         }
     292   -
         /**
    +
     
     293   -
          * Adds an entry to the list of detected Identifiers for the dependency file.
    +
         /**
     294   -
          *
    +
          * Adds an entry to the list of detected Identifiers for the dependency file.
     295   -
          * @param type the type of identifier (such as CPE)
    +
          *
     296   -
          * @param value the value of the identifier
    -  297   -
          * @param url the URL of the identifier
    -  298   -
          */
    -  299   -
         public void addIdentifier(String type, String value, String url) {
    -  300  44
             final Identifier i = new Identifier(type, value, url);
    -  301  44
             this.identifiers.add(i);
    -  302  44
         }
    -  303   -
     
    -  304   -
         /**
    -  305   -
          * Adds an entry to the list of detected Identifiers for the dependency file.
    -  306   -
          *
    -  307  
          * @param type the type of identifier (such as CPE)
    -  308   +  297  
          * @param value the value of the identifier
    -  309   +  298  
          * @param url the URL of the identifier
    -  310   -
          * @param confidence the confidence in the Identifier being accurate
    -  311   +  299  
          */
    -  312   -
         public void addIdentifier(String type, String value, String url, Confidence confidence) {
    -  313  4
             final Identifier i = new Identifier(type, value, url);
    -  314  4
             i.setConfidence(confidence);
    -  315  4
             this.identifiers.add(i);
    -  316  4
         }
    -  317   +  300   +
         public void addIdentifier(String type, String value, String url) {
    +  301  11
             final Identifier i = new Identifier(type, value, url);
    +  302  11
             this.identifiers.add(i);
    +  303  11
         }
    +  304  
     
    -  318   +  305  
         /**
    -  319   +  306  
          * Adds an entry to the list of detected Identifiers for the dependency file.
    +  307   +
          *
    +  308   +
          * @param type the type of identifier (such as CPE)
    +  309   +
          * @param value the value of the identifier
    +  310   +
          * @param url the URL of the identifier
    +  311   +
          * @param confidence the confidence in the Identifier being accurate
    +  312   +
          */
    +  313   +
         public void addIdentifier(String type, String value, String url, Confidence confidence) {
    +  314  1
             final Identifier i = new Identifier(type, value, url);
    +  315  1
             i.setConfidence(confidence);
    +  316  1
             this.identifiers.add(i);
    +  317  1
         }
    +  318   +
     
    +  319   +
         /**
     320   -
          *
    +
          * Adds an entry to the list of detected Identifiers for the dependency file.
     321   -
          * @param identifier the identifier to add
    +
          *
     322   -
          */
    +
          * @param identifier the identifier to add
     323   +
          */
    +  324  
         public void addIdentifier(Identifier identifier) {
    -  324  16
             this.identifiers.add(identifier);
    -  325  16
         }
    -  326   -
         /**
    +  325  2
             this.identifiers.add(identifier);
    +  326  2
         }
     327   -
          * A set of identifiers that have been suppressed.
    +
         /**
     328   -
          */
    +
          * A set of identifiers that have been suppressed.
     329   -
         private Set<Identifier> suppressedIdentifiers;
    +
          */
     330   -
     
    +
         private Set<Identifier> suppressedIdentifiers;
     331   -
         /**
    +
     
     332   -
          * Get the value of suppressedIdentifiers.
    +
         /**
     333   -
          *
    +
          * Get the value of suppressedIdentifiers.
     334   -
          * @return the value of suppressedIdentifiers
    +
          *
     335   -
          */
    +
          * @return the value of suppressedIdentifiers
     336   -
         public Set<Identifier> getSuppressedIdentifiers() {
    +
          */
     337   -
             return suppressedIdentifiers;
    +
         public Set<Identifier> getSuppressedIdentifiers() {
     338   -
         }
    +
             return suppressedIdentifiers;
     339   -
     
    +
         }
     340   -
         /**
    +
     
     341   -
          * Set the value of suppressedIdentifiers.
    +
         /**
     342   -
          *
    +
          * Set the value of suppressedIdentifiers.
     343   -
          * @param suppressedIdentifiers new value of suppressedIdentifiers
    +
          *
     344   -
          */
    +
          * @param suppressedIdentifiers new value of suppressedIdentifiers
     345   -
         public void setSuppressedIdentifiers(Set<Identifier> suppressedIdentifiers) {
    +
          */
     346   -
             this.suppressedIdentifiers = suppressedIdentifiers;
    +
         public void setSuppressedIdentifiers(Set<Identifier> suppressedIdentifiers) {
     347   -
         }
    +
             this.suppressedIdentifiers = suppressedIdentifiers;
     348   -
     
    +
         }
     349   -
         /**
    +
     
     350   -
          * Adds an identifier to the list of suppressed identifiers.
    +
         /**
     351   -
          *
    +
          * Adds an identifier to the list of suppressed identifiers.
     352   -
          * @param identifier an identifier that was suppressed.
    +
          *
     353   -
          */
    +
          * @param identifier an identifier that was suppressed.
     354   +
          */
    +  355  
         public void addSuppressedIdentifier(Identifier identifier) {
    -  355  28
             this.suppressedIdentifiers.add(identifier);
    -  356  28
         }
    -  357   -
     
    +  356  4
             this.suppressedIdentifiers.add(identifier);
    +  357  4
         }
     358   -
         /**
    +
     
     359   -
          * A set of vulnerabilities that have been suppressed.
    +
         /**
     360   -
          */
    +
          * A set of vulnerabilities that have been suppressed.
     361   -
         private SortedSet<Vulnerability> suppressedVulnerabilities;
    +
          */
     362   -
     
    +
         private SortedSet<Vulnerability> suppressedVulnerabilities;
     363   -
         /**
    +
     
     364   -
          * Get the value of suppressedVulnerabilities.
    +
         /**
     365   -
          *
    +
          * Get the value of suppressedVulnerabilities.
     366   -
          * @return the value of suppressedVulnerabilities
    +
          *
     367   -
          */
    +
          * @return the value of suppressedVulnerabilities
     368   -
         public SortedSet<Vulnerability> getSuppressedVulnerabilities() {
    +
          */
     369   -
             return suppressedVulnerabilities;
    +
         public SortedSet<Vulnerability> getSuppressedVulnerabilities() {
     370   -
         }
    +
             return suppressedVulnerabilities;
     371   -
     
    +
         }
     372   -
         /**
    +
     
     373   -
          * Set the value of suppressedVulnerabilities.
    +
         /**
     374   -
          *
    +
          * Set the value of suppressedVulnerabilities.
     375   -
          * @param suppressedVulnerabilities new value of suppressedVulnerabilities
    +
          *
     376   -
          */
    +
          * @param suppressedVulnerabilities new value of suppressedVulnerabilities
     377   -
         public void setSuppressedVulnerabilities(SortedSet<Vulnerability> suppressedVulnerabilities) {
    +
          */
     378   -
             this.suppressedVulnerabilities = suppressedVulnerabilities;
    +
         public void setSuppressedVulnerabilities(SortedSet<Vulnerability> suppressedVulnerabilities) {
     379   -
         }
    +
             this.suppressedVulnerabilities = suppressedVulnerabilities;
     380   -
     
    +
         }
     381   -
         /**
    +
     
     382   -
          * Adds a vulnerability to the set of suppressed vulnerabilities.
    +
         /**
     383   -
          *
    +
          * Adds a vulnerability to the set of suppressed vulnerabilities.
     384   -
          * @param vulnerability the vulnerability that was suppressed
    +
          *
     385   -
          */
    +
          * @param vulnerability the vulnerability that was suppressed
     386   +
          */
    +  387  
         public void addSuppressedVulnerability(Vulnerability vulnerability) {
    -  387  12
             this.suppressedVulnerabilities.add(vulnerability);
    -  388  12
         }
    -  389   -
     
    +  388  3
             this.suppressedVulnerabilities.add(vulnerability);
    +  389  3
         }
     390   -
         /**
    +
     
     391   -
          * Returns the evidence used to identify this dependency.
    +
         /**
     392   -
          *
    +
          * Returns the evidence used to identify this dependency.
     393   -
          * @return an EvidenceCollection.
    +
          *
     394   -
          */
    +
          * @return an EvidenceCollection.
     395   +
          */
    +  396  
         public EvidenceCollection getEvidence() {
    -  396  12
             return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence);
    -  397   -
         }
    +  397  3
             return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence);
     398   -
     
    +
         }
     399   -
         /**
    +
     
     400   -
          * Returns the evidence used to identify this dependency.
    +
         /**
     401   -
          *
    -  402   -
          * @return an EvidenceCollection.
    -  403   -
          */
    -  404   -
         public Set<Evidence> getEvidenceForDisplay() {
    -  405  0
             return EvidenceCollection.mergeForDisplay(this.productEvidence, this.vendorEvidence, this.versionEvidence);
    -  406   -
         }
    -  407   -
     
    -  408   -
         /**
    -  409  
          * Returns the evidence used to identify this dependency.
    +  402   +
          *
    +  403   +
          * @return an EvidenceCollection.
    +  404   +
          */
    +  405   +
         public Set<Evidence> getEvidenceForDisplay() {
    +  406  0
             return EvidenceCollection.mergeForDisplay(this.productEvidence, this.vendorEvidence, this.versionEvidence);
    +  407   +
         }
    +  408   +
     
    +  409   +
         /**
     410   -
          *
    +
          * Returns the evidence used to identify this dependency.
     411   -
          * @return an EvidenceCollection.
    +
          *
     412   -
          */
    +
          * @return an EvidenceCollection.
     413   +
          */
    +  414  
         public EvidenceCollection getEvidenceUsed() {
    -  414  4
             return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence);
    -  415   -
         }
    +  415  1
             return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence);
     416   -
     
    +
         }
     417   -
         /**
    +
     
     418   -
          * Gets the Vendor Evidence.
    +
         /**
     419   -
          *
    +
          * Gets the Vendor Evidence.
     420   -
          * @return an EvidenceCollection.
    +
          *
     421   -
          */
    +
          * @return an EvidenceCollection.
     422   -
         public EvidenceCollection getVendorEvidence() {
    +
          */
     423   -
             return this.vendorEvidence;
    +
         public EvidenceCollection getVendorEvidence() {
     424   -
         }
    +
             return this.vendorEvidence;
     425   -
     
    +
         }
     426   -
         /**
    +
     
     427   -
          * Gets the Product Evidence.
    +
         /**
     428   -
          *
    +
          * Gets the Product Evidence.
     429   -
          * @return an EvidenceCollection.
    +
          *
     430   -
          */
    -  431   -
         public EvidenceCollection getProductEvidence() {
    -  432   -
             return this.productEvidence;
    -  433   -
         }
    -  434   -
     
    -  435   -
         /**
    -  436   -
          * Gets the Version Evidence.
    -  437   -
          *
    -  438  
          * @return an EvidenceCollection.
    +  431   +
          */
    +  432   +
         public EvidenceCollection getProductEvidence() {
    +  433   +
             return this.productEvidence;
    +  434   +
         }
    +  435   +
     
    +  436   +
         /**
    +  437   +
          * Gets the Version Evidence.
    +  438   +
          *
     439   -
          */
    +
          * @return an EvidenceCollection.
     440   -
         public EvidenceCollection getVersionEvidence() {
    +
          */
     441   -
             return this.versionEvidence;
    +
         public EvidenceCollection getVersionEvidence() {
     442   -
         }
    +
             return this.versionEvidence;
     443   -
         /**
    +
         }
     444   -
          * The description of the JAR file.
    +
         /**
     445   -
          */
    +
          * The description of the JAR file.
     446   -
         private String description;
    +
          */
     447   -
     
    +
         private String description;
     448   -
         /**
    +
     
     449   -
          * Get the value of description.
    +
         /**
     450   -
          *
    +
          * Get the value of description.
     451   -
          * @return the value of description
    +
          *
     452   -
          */
    +
          * @return the value of description
     453   -
         public String getDescription() {
    +
          */
     454   -
             return description;
    +
         public String getDescription() {
     455   -
         }
    +
             return description;
     456   -
     
    +
         }
     457   -
         /**
    +
     
     458   -
          * Set the value of description.
    +
         /**
     459   -
          *
    +
          * Set the value of description.
     460   -
          * @param description new value of description
    +
          *
     461   -
          */
    +
          * @param description new value of description
     462   -
         public void setDescription(String description) {
    +
          */
     463   -
             this.description = description;
    +
         public void setDescription(String description) {
     464   -
         }
    +
             this.description = description;
     465   -
         /**
    +
         }
     466   -
          * The license that this dependency uses.
    +
         /**
     467   -
          */
    +
          * The license that this dependency uses.
     468   -
         private String license;
    +
          */
     469   -
     
    +
         private String license;
     470   -
         /**
    +
     
     471   -
          * Get the value of license.
    +
         /**
     472   -
          *
    +
          * Get the value of license.
     473   -
          * @return the value of license
    +
          *
     474   -
          */
    +
          * @return the value of license
     475   -
         public String getLicense() {
    +
          */
     476   -
             return license;
    +
         public String getLicense() {
     477   -
         }
    +
             return license;
     478   -
     
    +
         }
     479   -
         /**
    +
     
     480   -
          * Set the value of license.
    +
         /**
     481   -
          *
    +
          * Set the value of license.
     482   -
          * @param license new value of license
    +
          *
     483   -
          */
    +
          * @param license new value of license
     484   -
         public void setLicense(String license) {
    +
          */
     485   -
             this.license = license;
    +
         public void setLicense(String license) {
     486   -
         }
    +
             this.license = license;
     487   -
         /**
    +
         }
     488   -
          * A list of vulnerabilities for this dependency.
    +
         /**
     489   -
          */
    +
          * A list of vulnerabilities for this dependency.
     490   -
         private SortedSet<Vulnerability> vulnerabilities;
    +
          */
     491   -
     
    +
         private SortedSet<Vulnerability> vulnerabilities;
     492   -
         /**
    +
     
     493   -
          * Get the list of vulnerabilities.
    +
         /**
     494   -
          *
    +
          * Get the list of vulnerabilities.
     495   -
          * @return the list of vulnerabilities
    +
          *
     496   -
          */
    +
          * @return the list of vulnerabilities
     497   -
         public SortedSet<Vulnerability> getVulnerabilities() {
    +
          */
     498   -
             return vulnerabilities;
    +
         public SortedSet<Vulnerability> getVulnerabilities() {
     499   -
         }
    +
             return vulnerabilities;
     500   -
     
    +
         }
     501   -
         /**
    +
     
     502   -
          * Set the value of vulnerabilities.
    +
         /**
     503   -
          *
    +
          * Set the value of vulnerabilities.
     504   -
          * @param vulnerabilities new value of vulnerabilities
    +
          *
     505   -
          */
    +
          * @param vulnerabilities new value of vulnerabilities
     506   -
         public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
    +
          */
     507   -
             this.vulnerabilities = vulnerabilities;
    +
         public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
     508   -
         }
    +
             this.vulnerabilities = vulnerabilities;
     509   -
     
    +
         }
     510   -
         /**
    +
     
     511   -
          * Determines the sha1 and md5 sum for the given file.
    +
         /**
     512   -
          *
    +
          * Determines the sha1 and md5 sum for the given file.
     513   -
          * @param file the file to create checksums for
    +
          *
     514   -
          */
    +
          * @param file the file to create checksums for
     515   +
          */
    +  516  
         private void determineHashes(File file) {
    -  516  76
             String md5 = null;
    -  517  76
             String sha1 = null;
    -  518   +  517  19
             String md5 = null;
    +  518  19
             String sha1 = null;
    +  519  
             try {
    -  519  76
                 md5 = Checksum.getMD5Checksum(file);
    -  520  64
                 sha1 = Checksum.getSHA1Checksum(file);
    -  521  12
             } catch (IOException ex) {
    -  522  12
                 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName());
    -  523  12
                 LOGGER.log(Level.WARNING, msg);
    -  524  12
                 LOGGER.log(Level.FINE, null, ex);
    -  525  0
             } catch (NoSuchAlgorithmException ex) {
    -  526  0
                 final String msg = "Unable to use MD5 of SHA1 checksums.";
    -  527  0
                 LOGGER.log(Level.WARNING, msg);
    -  528  0
                 LOGGER.log(Level.FINE, null, ex);
    -  529  76
             }
    -  530  76
             this.setMd5sum(md5);
    -  531  76
             this.setSha1sum(sha1);
    -  532  76
         }
    -  533   -
     
    +  520  19
                 md5 = Checksum.getMD5Checksum(file);
    +  521  16
                 sha1 = Checksum.getSHA1Checksum(file);
    +  522  3
             } catch (IOException ex) {
    +  523  3
                 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName());
    +  524  3
                 LOGGER.log(Level.WARNING, msg);
    +  525  3
                 LOGGER.log(Level.FINE, null, ex);
    +  526  0
             } catch (NoSuchAlgorithmException ex) {
    +  527  0
                 final String msg = "Unable to use MD5 of SHA1 checksums.";
    +  528  0
                 LOGGER.log(Level.WARNING, msg);
    +  529  0
                 LOGGER.log(Level.FINE, null, ex);
    +  530  19
             }
    +  531  19
             this.setMd5sum(md5);
    +  532  19
             this.setSha1sum(sha1);
    +  533  19
         }
     534   -
         /**
    +
     
     535   -
          * Adds a vulnerability to the dependency.
    +
         /**
     536   -
          *
    +
          * Adds a vulnerability to the dependency.
     537   -
          * @param vulnerability a vulnerability outlining a vulnerability.
    +
          *
     538   -
          */
    +
          * @param vulnerability a vulnerability outlining a vulnerability.
     539   +
          */
    +  540  
         public void addVulnerability(Vulnerability vulnerability) {
    -  540  12
             this.vulnerabilities.add(vulnerability);
    -  541  12
         }
    -  542   -
         /**
    +  541  3
             this.vulnerabilities.add(vulnerability);
    +  542  3
         }
     543   -
          * A collection of related dependencies.
    +
         /**
     544   +
          * A collection of related dependencies.
    +  545  
          */
    -  545  152
         private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
    -  546   -
     
    +  546  38
         private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
     547   -
         /**
    +
     
     548   -
          * Get the value of relatedDependencies.
    +
         /**
     549   -
          *
    +
          * Get the value of relatedDependencies.
     550   -
          * @return the value of relatedDependencies
    +
          *
     551   -
          */
    +
          * @return the value of relatedDependencies
     552   -
         public Set<Dependency> getRelatedDependencies() {
    +
          */
     553   -
             return relatedDependencies;
    +
         public Set<Dependency> getRelatedDependencies() {
     554   -
         }
    +
             return relatedDependencies;
     555   -
     
    +
         }
     556   -
         /**
    +
     
     557   -
          * Set the value of relatedDependencies.
    +
         /**
     558   -
          *
    +
          * Set the value of relatedDependencies.
     559   -
          * @param relatedDependencies new value of relatedDependencies
    +
          *
     560   -
          */
    +
          * @param relatedDependencies new value of relatedDependencies
     561   -
         public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
    +
          */
     562   -
             this.relatedDependencies = relatedDependencies;
    +
         public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
     563   -
         }
    +
             this.relatedDependencies = relatedDependencies;
     564   -
     
    +
         }
     565   -
         /**
    +
     
     566   -
          * Adds a related dependency.
    +
         /**
     567   -
          *
    +
          * Adds a related dependency.
     568   -
          * @param dependency a reference to the related dependency
    +
          *
     569   -
          */
    +
          * @param dependency a reference to the related dependency
     570   +
          */
    +  571  
         public void addRelatedDependency(Dependency dependency) {
    -  571  0
             relatedDependencies.add(dependency);
    -  572  0
         }
    -  573   -
     
    +  572  0
             relatedDependencies.add(dependency);
    +  573  0
         }
     574   -
         /**
    +
     
     575   -
          * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name.
    +
         /**
     576   -
          *
    +
          * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name.
     577   -
          * @param o a dependency to compare
    +
          *
     578   -
          * @return an integer representing the natural ordering
    +
          * @param o a dependency to compare
     579   -
          */
    +
          * @return an integer representing the natural ordering
     580   +
          */
    +  581  
         public int compareTo(Dependency o) {
    -  581  8
             return this.getFileName().compareToIgnoreCase(o.getFileName());
    -  582   -
         }
    +  582  2
             return this.getFileName().compareToIgnoreCase(o.getFileName());
     583   -
     
    +
         }
     584   -
         /**
    +
     
     585   -
          * Implementation of the equals method.
    +
         /**
     586   -
          *
    +
          * Implementation of the equals method.
     587   -
          * @param obj the object to compare
    +
          *
     588   -
          * @return true if the objects are equal, otherwise false
    +
          * @param obj the object to compare
     589   -
          */
    +
          * @return true if the objects are equal, otherwise false
     590   -
         @Override
    +
          */
     591   +
         @Override
    +  592  
         public boolean equals(Object obj) {
    -  592  0
             if (obj == null) {
    -  593  0
                 return false;
    -  594   +  593  0
             if (obj == null) {
    +  594  0
                 return false;
    +  595  
             }
    -  595  0
             if (getClass() != obj.getClass()) {
    -  596  0
                 return false;
    -  597   +  596  0
             if (getClass() != obj.getClass()) {
    +  597  0
                 return false;
    +  598  
             }
    -  598  0
             final Dependency other = (Dependency) obj;
    -  599  0
             if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) {
    -  600  0
                 return false;
    -  601   +  599  0
             final Dependency other = (Dependency) obj;
    +  600  0
             if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) {
    +  601  0
                 return false;
    +  602  
             }
    -  602  0
             if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) {
    -  603  0
                 return false;
    -  604   +  603  0
             if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) {
    +  604  0
                 return false;
    +  605  
             }
    -  605  0
             if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) {
    -  606  0
                 return false;
    -  607   +  606  0
             if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) {
    +  607  0
                 return false;
    +  608  
             }
    -  608  0
             if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) {
    -  609  0
                 return false;
    -  610   +  609  0
             if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) {
    +  610  0
                 return false;
    +  611  
             }
    -  611  0
             if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) {
    -  612  0
                 return false;
    -  613   +  612  0
             if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) {
    +  613  0
                 return false;
    +  614  
             }
    -  614  0
             if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) {
    -  615  0
                 return false;
    -  616   +  615  0
             if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) {
    +  616  0
                 return false;
    +  617  
             }
    -  617  0
             if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) {
    -  618  0
                 return false;
    -  619   +  618  0
             if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) {
    +  619  0
                 return false;
    +  620  
             }
    -  620  0
             if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) {
    -  621  0
                 return false;
    -  622   +  621  0
             if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) {
    +  622  0
                 return false;
    +  623  
             }
    -  623  0
             if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) {
    -  624  0
                 return false;
    -  625   +  624  0
             if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) {
    +  625  0
                 return false;
    +  626  
             }
    -  626  0
             if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) {
    -  627  0
                 return false;
    -  628   +  627  0
             if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) {
    +  628  0
                 return false;
    +  629  
             }
    -  629  0
             if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) {
    -  630  0
                 return false;
    -  631   +  630  0
             if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) {
    +  631  0
                 return false;
    +  632  
             }
    -  632  0
             if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) {
    -  633  0
                 return false;
    -  634   +  633  0
             if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) {
    +  634  0
                 return false;
    +  635  
             }
    -  635  0
             if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) {
    -  636  0
                 return false;
    -  637   +  636  0
             if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) {
    +  637  0
                 return false;
    +  638  
             }
    -  638  0
             if (this.relatedDependencies != other.relatedDependencies
    -  639   +  639  0
             if (this.relatedDependencies != other.relatedDependencies
    +  640  
                     && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) {
    -  640  0
                 return false;
    -  641   +  641  0
                 return false;
    +  642  
             }
    -  642  0
             return true;
    -  643   -
         }
    +  643  0
             return true;
     644   -
     
    +
         }
     645   -
         /**
    -  646   -
          * Generates the HashCode.
    -  647   -
          *
    -  648   -
          * @return the HashCode
    -  649   -
          */
    -  650   -
         @Override
    -  651   -
         public int hashCode() {
    -  652  104
             int hash = 3;
    -  653  104
             hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0);
    -  654  104
             hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0);
    -  655  104
             hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0);
    -  656  104
             hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0);
    -  657  104
             hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0);
    -  658  104
             hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0);
    -  659  104
             hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0);
    -  660  104
             hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0);
    -  661  104
             hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0);
    -  662  104
             hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0);
    -  663  104
             hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0);
    -  664  104
             hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0);
    -  665  104
             hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0);
    -  666  104
             hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0);
    -  667  104
             return hash;
    -  668   -
         }
    -  669  
     
    -  670   +  646  
         /**
    -  671   -
          * Standard toString() implementation showing the filename, actualFilePath, and filePath.
    -  672   +  647   +
          * Generates the HashCode.
    +  648  
          *
    -  673   -
          * @return the string representation of the file
    -  674   +  649   +
          * @return the HashCode
    +  650  
          */
    -  675   +  651  
         @Override
    -  676   -
         public String toString() {
    -  677  0
             return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}";
    -  678   +  652   +
         public int hashCode() {
    +  653  26
             int hash = 3;
    +  654  26
             hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0);
    +  655  26
             hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0);
    +  656  26
             hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0);
    +  657  26
             hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0);
    +  658  26
             hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0);
    +  659  26
             hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0);
    +  660  26
             hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0);
    +  661  26
             hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0);
    +  662  26
             hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0);
    +  663  26
             hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0);
    +  664  26
             hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0);
    +  665  26
             hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0);
    +  666  26
             hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0);
    +  667  26
             hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0);
    +  668  26
             return hash;
    +  669  
         }
    +  670   +
     
    +  671   +
         /**
    +  672   +
          * Standard toString() implementation showing the filename, actualFilePath, and filePath.
    +  673   +
          *
    +  674   +
          * @return the string representation of the file
    +  675   +
          */
    +  676   +
         @Override
    +  677   +
         public String toString() {
    +  678  0
             return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}";
     679   +
         }
    +  680  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html index be54837e2..5b2cd6ec0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html @@ -56,544 +56,548 @@  19  
     
     20   -
     /**
    +
     import java.io.Serializable;
     21   -
      * Evidence is a piece of information about a Dependency.
    +
     
     22   -
      *
    +
     /**
     23   -
      * @author Jeremy Long <jeremy.long@owasp.org>
    +
      * Evidence is a piece of information about a Dependency.
     24   -
      */
    -  25  158856
     public class Evidence implements Comparable<Evidence> {
    +
      *
    +  25   +
      * @author Jeremy Long <jeremy.long@owasp.org>
     26   -
     
    -  27   -
         /**
    +
      */
    +  27  39714
     public class Evidence implements Serializable, Comparable<Evidence> {
     28   -
          * Creates a new Evidence object.
    +
     
     29   -
          */
    +
         /**
     30   -
         public Evidence() {
    +
          * Creates a new Evidence object.
     31   -
         }
    +
          */
     32   -
     
    +
         public Evidence() {
     33   -
         /**
    +
         }
     34   -
          * Creates a new Evidence objects.
    +
     
     35   -
          *
    +
         /**
     36   -
          * @param source the source of the evidence.
    +
          * Creates a new Evidence objects.
     37   -
          * @param name the name of the evidence.
    +
          *
     38   -
          * @param value the value of the evidence.
    +
          * @param source the source of the evidence.
     39   -
          * @param confidence the confidence of the evidence.
    +
          * @param name the name of the evidence.
     40   -
          */
    +
          * @param value the value of the evidence.
     41   -
         public Evidence(String source, String name, String value, Confidence confidence) {
    +
          * @param confidence the confidence of the evidence.
     42   -
             this.source = source;
    +
          */
     43   -
             this.name = name;
    +
         public Evidence(String source, String name, String value, Confidence confidence) {
     44   -
             this.value = value;
    -  45   -
             this.confidence = confidence;
    -  46   -
         }
    -  47   -
         /**
    -  48   -
          * The name of the evidence.
    -  49   -
          */
    -  50   -
         private String name;
    -  51   -
     
    -  52   -
         /**
    -  53   -
          * Get the value of name.
    -  54   -
          *
    -  55   -
          * @return the value of name
    -  56   -
          */
    -  57   -
         public String getName() {
    -  58   -
             return name;
    -  59   -
         }
    -  60   -
     
    -  61   -
         /**
    -  62   -
          * Set the value of name.
    -  63   -
          *
    -  64   -
          * @param name new value of name
    -  65   -
          */
    -  66   -
         public void setName(String name) {
    -  67   -
             this.name = name;
    -  68   -
         }
    -  69   -
         /**
    -  70   -
          * The source of the evidence.
    -  71   -
          */
    -  72   -
         private String source;
    -  73   -
     
    -  74   -
         /**
    -  75   -
          * Get the value of source.
    -  76   -
          *
    -  77   -
          * @return the value of source
    -  78   -
          */
    -  79   -
         public String getSource() {
    -  80   -
             return source;
    -  81   -
         }
    -  82   -
     
    -  83   -
         /**
    -  84   -
          * Set the value of source.
    -  85   -
          *
    -  86   -
          * @param source new value of source
    -  87   -
          */
    -  88   -
         public void setSource(String source) {
    -  89  
             this.source = source;
    -  90   -
         }
    -  91   -
         /**
    -  92   -
          * The value of the evidence.
    -  93   -
          */
    -  94   -
         private String value;
    -  95   -
     
    -  96   -
         /**
    -  97   -
          * Get the value of value.
    -  98   -
          *
    -  99   -
          * @return the value of value
    -  100   -
          */
    -  101   -
         public String getValue() {
    -  102  3436
             used = true;
    -  103  3436
             return value;
    -  104   -
         }
    -  105   -
     
    -  106   -
         /**
    -  107   -
          * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used.
    -  108   -
          *
    -  109   -
          * @param setUsed whether or not this call to getValue should cause the used flag to be updated
    -  110   -
          * @return the value of value
    -  111   -
          */
    -  112   -
         public String getValue(Boolean setUsed) {
    -  113  200
             used = used || setUsed;
    -  114  200
             return value;
    -  115   -
         }
    -  116   -
     
    -  117   -
         /**
    -  118   -
          * Set the value of value.
    -  119   -
          *
    -  120   -
          * @param value new value of value
    -  121   -
          */
    -  122   -
         public void setValue(String value) {
    -  123   +  45   +
             this.name = name;
    +  46  
             this.value = value;
    -  124   -
         }
    -  125   -
         /**
    -  126   -
          * A value indicating if the Evidence has been "used" (aka read).
    -  127   -
          */
    -  128   -
         private boolean used;
    -  129   -
     
    -  130   -
         /**
    -  131   -
          * Get the value of used.
    -  132   -
          *
    -  133   -
          * @return the value of used
    -  134   -
          */
    -  135   -
         public boolean isUsed() {
    -  136   -
             return used;
    -  137   -
         }
    -  138   -
     
    -  139   -
         /**
    -  140   -
          * Set the value of used.
    -  141   -
          *
    -  142   -
          * @param used new value of used
    -  143   -
          */
    -  144   -
         public void setUsed(boolean used) {
    -  145   -
             this.used = used;
    -  146   -
         }
    -  147   -
         /**
    -  148   -
          * The confidence level for the evidence.
    -  149   -
          */
    -  150   -
         private Confidence confidence;
    -  151   -
     
    -  152   -
         /**
    -  153   -
          * Get the value of confidence.
    -  154   -
          *
    -  155   -
          * @return the value of confidence
    -  156   -
          */
    -  157   -
         public Confidence getConfidence() {
    -  158   -
             return confidence;
    -  159   -
         }
    -  160   -
     
    -  161   -
         /**
    -  162   -
          * Set the value of confidence.
    -  163   -
          *
    -  164   -
          * @param confidence new value of confidence
    -  165   -
          */
    -  166   -
         public void setConfidence(Confidence confidence) {
    -  167   +  47  
             this.confidence = confidence;
    +  48   +
         }
    +  49   +
         /**
    +  50   +
          * The name of the evidence.
    +  51   +
          */
    +  52   +
         private String name;
    +  53   +
     
    +  54   +
         /**
    +  55   +
          * Get the value of name.
    +  56   +
          *
    +  57   +
          * @return the value of name
    +  58   +
          */
    +  59   +
         public String getName() {
    +  60   +
             return name;
    +  61   +
         }
    +  62   +
     
    +  63   +
         /**
    +  64   +
          * Set the value of name.
    +  65   +
          *
    +  66   +
          * @param name new value of name
    +  67   +
          */
    +  68   +
         public void setName(String name) {
    +  69   +
             this.name = name;
    +  70   +
         }
    +  71   +
         /**
    +  72   +
          * The source of the evidence.
    +  73   +
          */
    +  74   +
         private String source;
    +  75   +
     
    +  76   +
         /**
    +  77   +
          * Get the value of source.
    +  78   +
          *
    +  79   +
          * @return the value of source
    +  80   +
          */
    +  81   +
         public String getSource() {
    +  82   +
             return source;
    +  83   +
         }
    +  84   +
     
    +  85   +
         /**
    +  86   +
          * Set the value of source.
    +  87   +
          *
    +  88   +
          * @param source new value of source
    +  89   +
          */
    +  90   +
         public void setSource(String source) {
    +  91   +
             this.source = source;
    +  92   +
         }
    +  93   +
         /**
    +  94   +
          * The value of the evidence.
    +  95   +
          */
    +  96   +
         private String value;
    +  97   +
     
    +  98   +
         /**
    +  99   +
          * Get the value of value.
    +  100   +
          *
    +  101   +
          * @return the value of value
    +  102   +
          */
    +  103   +
         public String getValue() {
    +  104  325
             used = true;
    +  105  325
             return value;
    +  106   +
         }
    +  107   +
     
    +  108   +
         /**
    +  109   +
          * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used.
    +  110   +
          *
    +  111   +
          * @param setUsed whether or not this call to getValue should cause the used flag to be updated
    +  112   +
          * @return the value of value
    +  113   +
          */
    +  114   +
         public String getValue(Boolean setUsed) {
    +  115  50
             used = used || setUsed;
    +  116  50
             return value;
    +  117   +
         }
    +  118   +
     
    +  119   +
         /**
    +  120   +
          * Set the value of value.
    +  121   +
          *
    +  122   +
          * @param value new value of value
    +  123   +
          */
    +  124   +
         public void setValue(String value) {
    +  125   +
             this.value = value;
    +  126   +
         }
    +  127   +
         /**
    +  128   +
          * A value indicating if the Evidence has been "used" (aka read).
    +  129   +
          */
    +  130   +
         private boolean used;
    +  131   +
     
    +  132   +
         /**
    +  133   +
          * Get the value of used.
    +  134   +
          *
    +  135   +
          * @return the value of used
    +  136   +
          */
    +  137   +
         public boolean isUsed() {
    +  138   +
             return used;
    +  139   +
         }
    +  140   +
     
    +  141   +
         /**
    +  142   +
          * Set the value of used.
    +  143   +
          *
    +  144   +
          * @param used new value of used
    +  145   +
          */
    +  146   +
         public void setUsed(boolean used) {
    +  147   +
             this.used = used;
    +  148   +
         }
    +  149   +
         /**
    +  150   +
          * The confidence level for the evidence.
    +  151   +
          */
    +  152   +
         private Confidence confidence;
    +  153   +
     
    +  154   +
         /**
    +  155   +
          * Get the value of confidence.
    +  156   +
          *
    +  157   +
          * @return the value of confidence
    +  158   +
          */
    +  159   +
         public Confidence getConfidence() {
    +  160   +
             return confidence;
    +  161   +
         }
    +  162   +
     
    +  163   +
         /**
    +  164   +
          * Set the value of confidence.
    +  165   +
          *
    +  166   +
          * @param confidence new value of confidence
    +  167   +
          */
     168   -
         }
    +
         public void setConfidence(Confidence confidence) {
     169   -
     
    +
             this.confidence = confidence;
     170   -
         /**
    +
         }
     171   -
          * Implements the hashCode for Evidence.
    +
     
     172   -
          *
    +
         /**
     173   -
          * @return hash code.
    +
          * Implements the hashCode for Evidence.
     174   -
          */
    +
          *
     175   -
         @Override
    +
          * @return hash code.
     176   -
         public int hashCode() {
    -  177  8
             int hash = 3;
    -  178  8
             hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
    -  179  8
             hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
    -  180  8
             hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0);
    -  181  8
             hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    -  182  8
             return hash;
    -  183   -
         }
    -  184   -
     
    -  185   -
         /**
    -  186   -
          * Implements equals for Evidence.
    -  187   -
          *
    -  188   -
          * @param that an object to check the equality of.
    -  189   -
          * @return whether the two objects are equal.
    -  190  
          */
    -  191   +  177  
         @Override
    +  178   +
         public int hashCode() {
    +  179  2
             int hash = 3;
    +  180  2
             hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
    +  181  2
             hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
    +  182  2
             hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0);
    +  183  2
             hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    +  184  2
             return hash;
    +  185   +
         }
    +  186   +
     
    +  187   +
         /**
    +  188   +
          * Implements equals for Evidence.
    +  189   +
          *
    +  190   +
          * @param that an object to check the equality of.
    +  191   +
          * @return whether the two objects are equal.
     192   +
          */
    +  193   +
         @Override
    +  194  
         public boolean equals(Object that) {
    -  193  0
             if (this == that) {
    -  194  0
                 return true;
    -  195   +  195  0
             if (this == that) {
    +  196  0
                 return true;
    +  197  
             }
    -  196  0
             if (!(that instanceof Evidence)) {
    -  197  0
                 return false;
    -  198   -
             }
    -  199  0
             final Evidence e = (Evidence) that;
    +  198  0
             if (!(that instanceof Evidence)) {
    +  199  0
                 return false;
     200   -
     
    -  201  0
             return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value)
    +
             }
    +  201  0
             final Evidence e = (Evidence) that;
     202   -
                     && (confidence == null ? e.confidence == null : confidence == e.confidence);
    -  203   -
         }
    +
     
    +  203  0
             return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value)
     204   -
     
    +
                     && (confidence == null ? e.confidence == null : confidence == e.confidence);
     205   -
         /**
    +
         }
     206   -
          * Simple equality test for use within the equals method. This does a case insensitive compare.
    +
     
     207   -
          *
    +
         /**
     208   -
          * @param l a string to compare.
    +
          * Simple equality test for use within the equals method. This does a case insensitive compare.
     209   -
          * @param r another string to compare.
    +
          *
     210   -
          * @return whether the two strings are the same.
    +
          * @param l a string to compare.
     211   -
          */
    +
          * @param r another string to compare.
     212   -
         private boolean testEquality(String l, String r) {
    -  213  0
             return l == null ? r == null : l.equalsIgnoreCase(r);
    +
          * @return whether the two strings are the same.
    +  213   +
          */
     214   -
         }
    -  215   -
     
    +
         private boolean testEquality(String l, String r) {
    +  215  0
             return l == null ? r == null : l.equalsIgnoreCase(r);
     216   -
         /**
    +
         }
     217   -
          * Implementation of the comparable interface.
    +
     
     218   -
          *
    +
         /**
     219   -
          * @param o the evidence being compared
    +
          * Implementation of the comparable interface.
     220   -
          * @return an integer indicating the ordering of the two objects
    +
          *
     221   -
          */
    +
          * @param o the evidence being compared
     222   +
          * @return an integer indicating the ordering of the two objects
    +  223   +
          */
    +  224  
         public int compareTo(Evidence o) {
    -  223  158856
             if (o == null) {
    -  224  0
                 return 1;
    -  225   +  225  39714
             if (o == null) {
    +  226  0
                 return 1;
    +  227  
             }
    -  226  158856
             if (equalsWithNullCheck(source, o.source)) {
    -  227  101004
                 if (equalsWithNullCheck(name, o.name)) {
    -  228  100632
                     if (equalsWithNullCheck(value, o.value)) {
    -  229  61780
                         if (equalsWithNullCheck(confidence, o.confidence)) {
    -  230  61728
                             return 0; //they are equal
    -  231   -
                         } else {
    -  232  52
                             return compareToWithNullCheck(confidence, o.confidence);
    +  228  39714
             if (equalsWithNullCheck(source, o.source)) {
    +  229  25251
                 if (equalsWithNullCheck(name, o.name)) {
    +  230  25158
                     if (equalsWithNullCheck(value, o.value)) {
    +  231  15445
                         if (equalsWithNullCheck(confidence, o.confidence)) {
    +  232  15432
                             return 0; //they are equal
     233   +
                         } else {
    +  234  13
                             return compareToWithNullCheck(confidence, o.confidence);
    +  235  
                         }
    -  234   -
                     } else {
    -  235  38852
                         return compareToIgnoreCaseWithNullCheck(value, o.value);
     236   +
                     } else {
    +  237  9713
                         return compareToIgnoreCaseWithNullCheck(value, o.value);
    +  238  
                     }
    -  237   -
                 } else {
    -  238  372
                     return compareToIgnoreCaseWithNullCheck(name, o.name);
     239   +
                 } else {
    +  240  93
                     return compareToIgnoreCaseWithNullCheck(name, o.name);
    +  241  
                 }
    -  240   -
             } else {
    -  241  57852
                 return compareToIgnoreCaseWithNullCheck(source, o.source);
     242   -
             }
    -  243   -
         }
    +
             } else {
    +  243  14463
                 return compareToIgnoreCaseWithNullCheck(source, o.source);
     244   -
     
    +
             }
     245   -
         /**
    +
         }
     246   -
          * Equality check with an exhaustive, possibly duplicative, check against nulls.
    +
     
     247   -
          *
    +
         /**
     248   -
          * @param me the value to be compared
    -  249   -
          * @param other the other value to be compared
    -  250   -
          * @return true if the values are equal; otherwise false
    -  251   -
          */
    -  252   -
         private boolean equalsWithNullCheck(String me, String other) {
    -  253  360492
             if (me == null && other == null) {
    -  254  0
                 return true;
    -  255  360492
             } else if (me == null || other == null) {
    -  256  0
                 return false;
    -  257   -
             }
    -  258  360492
             return me.equals(other);
    -  259   -
         }
    -  260   -
     
    -  261   -
         /**
    -  262  
          * Equality check with an exhaustive, possibly duplicative, check against nulls.
    +  249   +
          *
    +  250   +
          * @param me the value to be compared
    +  251   +
          * @param other the other value to be compared
    +  252   +
          * @return true if the values are equal; otherwise false
    +  253   +
          */
    +  254   +
         private boolean equalsWithNullCheck(String me, String other) {
    +  255  90123
             if (me == null && other == null) {
    +  256  0
                 return true;
    +  257  90123
             } else if (me == null || other == null) {
    +  258  0
                 return false;
    +  259   +
             }
    +  260  90123
             return me.equals(other);
    +  261   +
         }
    +  262   +
     
     263   -
          *
    +
         /**
     264   -
          * @param me the value to be compared
    +
          * Equality check with an exhaustive, possibly duplicative, check against nulls.
     265   -
          * @param other the other value to be compared
    +
          *
     266   -
          * @return true if the values are equal; otherwise false
    +
          * @param me the value to be compared
     267   -
          */
    +
          * @param other the other value to be compared
     268   +
          * @return true if the values are equal; otherwise false
    +  269   +
          */
    +  270  
         private boolean equalsWithNullCheck(Confidence me, Confidence other) {
    -  269  61780
             if (me == null && other == null) {
    -  270  0
                 return true;
    -  271  61780
             } else if (me == null || other == null) {
    -  272  0
                 return false;
    -  273   -
             }
    -  274  61780
             return me.equals(other);
    +  271  15445
             if (me == null && other == null) {
    +  272  0
                 return true;
    +  273  15445
             } else if (me == null || other == null) {
    +  274  0
                 return false;
     275   -
         }
    -  276   -
     
    +
             }
    +  276  15445
             return me.equals(other);
     277   -
         /**
    +
         }
     278   -
          * Wrapper around {@link java.lang.String#compareToIgnoreCase(java.lang.String) String.compareToIgnoreCase} with an
    -  279   -
          * exhaustive, possibly duplicative, check against nulls.
    -  280   -
          *
    -  281   -
          * @param me the value to be compared
    -  282   -
          * @param other the other value to be compared
    -  283   -
          * @return true if the values are equal; otherwise false
    -  284   -
          */
    -  285   -
         private int compareToIgnoreCaseWithNullCheck(String me, String other) {
    -  286  97076
             if (me == null && other == null) {
    -  287  0
                 return 0;
    -  288  97076
             } else if (me == null) {
    -  289  0
                 return -1; //the other string is greater then me
    -  290  97076
             } else if (other == null) {
    -  291  0
                 return 1; //me is greater then the other string
    -  292   -
             }
    -  293  97076
             return me.compareToIgnoreCase(other);
    -  294   -
         }
    -  295  
     
    -  296   +  279  
         /**
    -  297   -
          * Wrapper around {@link java.lang.Enum#compareTo(java.lang.Enum) Enum.compareTo} with an exhaustive, possibly
    -  298   -
          * duplicative, check against nulls.
    -  299   +  280   +
          * Wrapper around {@link java.lang.String#compareToIgnoreCase(java.lang.String) String.compareToIgnoreCase} with an
    +  281   +
          * exhaustive, possibly duplicative, check against nulls.
    +  282  
          *
    -  300   +  283  
          * @param me the value to be compared
    -  301   +  284  
          * @param other the other value to be compared
    -  302   +  285  
          * @return true if the values are equal; otherwise false
    -  303   +  286  
          */
    -  304   -
         private int compareToWithNullCheck(Confidence me, Confidence other) {
    -  305  52
             if (me == null && other == null) {
    -  306  0
                 return 0;
    -  307  52
             } else if (me == null) {
    -  308  0
                 return -1; //the other string is greater then me
    -  309  52
             } else if (other == null) {
    -  310  0
                 return 1; //me is greater then the other string
    -  311   +  287   +
         private int compareToIgnoreCaseWithNullCheck(String me, String other) {
    +  288  24269
             if (me == null && other == null) {
    +  289  0
                 return 0;
    +  290  24269
             } else if (me == null) {
    +  291  0
                 return -1; //the other string is greater then me
    +  292  24269
             } else if (other == null) {
    +  293  0
                 return 1; //me is greater then the other string
    +  294  
             }
    -  312  52
             return me.compareTo(other);
    -  313   +  295  24269
             return me.compareToIgnoreCase(other);
    +  296  
         }
    -  314   +  297   +
     
    +  298   +
         /**
    +  299   +
          * Wrapper around {@link java.lang.Enum#compareTo(java.lang.Enum) Enum.compareTo} with an exhaustive, possibly
    +  300   +
          * duplicative, check against nulls.
    +  301   +
          *
    +  302   +
          * @param me the value to be compared
    +  303   +
          * @param other the other value to be compared
    +  304   +
          * @return true if the values are equal; otherwise false
    +  305   +
          */
    +  306   +
         private int compareToWithNullCheck(Confidence me, Confidence other) {
    +  307  13
             if (me == null && other == null) {
    +  308  0
                 return 0;
    +  309  13
             } else if (me == null) {
    +  310  0
                 return -1; //the other string is greater then me
    +  311  13
             } else if (other == null) {
    +  312  0
                 return 1; //me is greater then the other string
    +  313   +
             }
    +  314  13
             return me.compareTo(other);
    +  315   +
         }
    +  316  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html index 918dee562..b8b34e8ff 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html @@ -61,652 +61,654 @@  19  
     
     20   -
     import java.net.MalformedURLException;
    +
     import java.io.Serializable;
     21   -
     import java.util.HashSet;
    +
     import java.net.MalformedURLException;
     22   -
     import java.util.Iterator;
    +
     import java.util.HashSet;
     23   -
     import java.util.List;
    +
     import java.util.Iterator;
     24   -
     import java.util.Set;
    +
     import java.util.List;
     25   -
     import java.util.TreeSet;
    +
     import java.util.Set;
     26   -
     import java.util.logging.Level;
    +
     import java.util.TreeSet;
     27   -
     import java.util.logging.Logger;
    +
     import java.util.logging.Level;
     28   -
     import org.apache.commons.lang.StringUtils;
    +
     import java.util.logging.Logger;
     29   -
     import org.owasp.dependencycheck.utils.DependencyVersion;
    +
     import org.apache.commons.lang.StringUtils;
     30   -
     import org.owasp.dependencycheck.utils.DependencyVersionUtil;
    +
     import org.owasp.dependencycheck.utils.DependencyVersion;
     31   -
     import org.owasp.dependencycheck.utils.Filter;
    +
     import org.owasp.dependencycheck.utils.DependencyVersionUtil;
     32   -
     import org.owasp.dependencycheck.utils.UrlStringUtils;
    +
     import org.owasp.dependencycheck.utils.Filter;
     33   -
     
    +
     import org.owasp.dependencycheck.utils.UrlStringUtils;
     34   -
     /**
    +
     
     35   -
      * Used to maintain a collection of Evidence.
    +
     /**
     36   -
      *
    +
      * Used to maintain a collection of Evidence.
     37   -
      * @author Jeremy Long <jeremy.long@owasp.org>
    +
      *
     38   -
      */
    +
      * @author Jeremy Long <jeremy.long@owasp.org>
     39   -
     public class EvidenceCollection implements Iterable<Evidence> {
    +
      */
     40   -
     
    +
     public class EvidenceCollection implements Serializable, Iterable<Evidence> {
     41   -
         /**
    +
     
     42   -
          * The logger.
    +
         /**
     43   +
          * The logger.
    +  44  
          */
    -  44  4
         private static final Logger LOGGER = Logger.getLogger(EvidenceCollection.class.getName());
    -  45   -
         /**
    +  45  1
         private static final Logger LOGGER = Logger.getLogger(EvidenceCollection.class.getName());
     46   -
          * Used to iterate over highest confidence evidence contained in the collection.
    +
         /**
     47   +
          * Used to iterate over highest confidence evidence contained in the collection.
    +  48  
          */
    -  48  292
         private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
    -  49   +  49  57
         private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
    +  50  
             public boolean passes(Evidence evidence) {
    -  50  292
                 return evidence.getConfidence() == Confidence.HIGHEST;
    -  51   -
             }
    +  51  57
                 return evidence.getConfidence() == Confidence.HIGHEST;
     52   -
         };
    +
             }
     53   -
         /**
    +
         };
     54   -
          * Used to iterate over high confidence evidence contained in the collection.
    +
         /**
     55   +
          * Used to iterate over high confidence evidence contained in the collection.
    +  56  
          */
    -  56  252
         private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
    -  57   +  57  47
         private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
    +  58  
             public boolean passes(Evidence evidence) {
    -  58  252
                 return evidence.getConfidence() == Confidence.HIGH;
    -  59   -
             }
    +  59  47
                 return evidence.getConfidence() == Confidence.HIGH;
     60   -
         };
    +
             }
     61   -
         /**
    +
         };
     62   -
          * Used to iterate over medium confidence evidence contained in the collection.
    +
         /**
     63   +
          * Used to iterate over medium confidence evidence contained in the collection.
    +  64  
          */
    -  64  4
         private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
    -  65   +  65  1
         private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
    +  66  
             public boolean passes(Evidence evidence) {
    -  66  292
                 return evidence.getConfidence() == Confidence.MEDIUM;
    -  67   -
             }
    +  67  32
                 return evidence.getConfidence() == Confidence.MEDIUM;
     68   -
         };
    +
             }
     69   -
         /**
    +
         };
     70   -
          * Used to iterate over low confidence evidence contained in the collection.
    +
         /**
     71   +
          * Used to iterate over low confidence evidence contained in the collection.
    +  72  
          */
    -  72  4
         private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
    -  73   +  73  1
         private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
    +  74  
             public boolean passes(Evidence evidence) {
    -  74  488
                 return evidence.getConfidence() == Confidence.LOW;
    -  75   -
             }
    +  75  32
                 return evidence.getConfidence() == Confidence.LOW;
     76   -
         };
    +
             }
     77   -
         /**
    -  78   -
          * Used to iterate over evidence that has was used (aka read) from the collection.
    -  79   -
          */
    -  80  4
         private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
    -  81   -
             public boolean passes(Evidence evidence) {
    -  82  3824
                 return evidence.isUsed();
    -  83   -
             }
    -  84  
         };
    +  78   +
         /**
    +  79   +
          * Used to iterate over evidence that has was used (aka read) from the collection.
    +  80   +
          */
    +  81  1
         private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
    +  82   +
             public boolean passes(Evidence evidence) {
    +  83  437
                 return evidence.isUsed();
    +  84   +
             }
     85   -
     
    +
         };
     86   -
         /**
    +
     
     87   -
          * Used to iterate over evidence of the specified confidence.
    +
         /**
     88   -
          *
    +
          * Used to iterate over evidence of the specified confidence.
     89   -
          * @param confidence the confidence level for the evidence to be iterated over.
    +
          *
     90   -
          * @return Iterable<Evidence> an iterable collection of evidence
    +
          * @param confidence the confidence level for the evidence to be iterated over.
     91   -
          */
    +
          * @return Iterable<Evidence> an iterable collection of evidence
     92   +
          */
    +  93  
         public final Iterable<Evidence> iterator(Confidence confidence) {
    -  93  176
             if (confidence == Confidence.HIGHEST) {
    -  94  40
                 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list);
    -  95  136
             } else if (confidence == Confidence.HIGH) {
    -  96  40
                 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
    -  97  96
             } else if (confidence == Confidence.MEDIUM) {
    -  98  40
                 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
    -  99   +  94  20
             if (confidence == Confidence.HIGHEST) {
    +  95  6
                 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list);
    +  96  14
             } else if (confidence == Confidence.HIGH) {
    +  97  6
                 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
    +  98  8
             } else if (confidence == Confidence.MEDIUM) {
    +  99  4
                 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
    +  100  
             } else {
    -  100  56
                 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
    -  101   -
             }
    +  101  4
                 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
     102   -
         }
    +
             }
     103   -
         /**
    +
         }
     104   -
          * A collection of evidence.
    +
         /**
     105   -
          */
    +
          * A collection of evidence.
     106   -
         private final Set<Evidence> list;
    +
          */
     107   -
         /**
    +
         private final Set<Evidence> list;
     108   -
          * A collection of strings used to adjust Lucene's term weighting.
    +
         /**
     109   -
          */
    +
          * A collection of strings used to adjust Lucene's term weighting.
     110   -
         private final Set<String> weightedStrings;
    +
          */
     111   -
     
    +
         private final Set<String> weightedStrings;
     112   -
         /**
    +
     
     113   -
          * Creates a new EvidenceCollection.
    +
         /**
     114   +
          * Creates a new EvidenceCollection.
    +  115  
          */
    -  115  472
         public EvidenceCollection() {
    -  116  472
             list = new TreeSet<Evidence>();
    -  117  472
             weightedStrings = new HashSet<String>();
    -  118  472
         }
    -  119   -
     
    +  116  118
         public EvidenceCollection() {
    +  117  118
             list = new TreeSet<Evidence>();
    +  118  118
             weightedStrings = new HashSet<String>();
    +  119  118
         }
     120   -
         /**
    +
     
     121   -
          * Adds evidence to the collection.
    +
         /**
     122   -
          *
    +
          * Adds evidence to the collection.
     123   -
          * @param e Evidence.
    +
          *
     124   -
          */
    +
          * @param e Evidence.
     125   +
          */
    +  126  
         public void addEvidence(Evidence e) {
    -  126  61972
             list.add(e);
    -  127  61972
         }
    -  128   -
     
    +  127  15493
             list.add(e);
    +  128  15493
         }
     129   -
         /**
    +
     
     130   -
          * Creates an Evidence object from the parameters and adds the resulting object to the collection.
    +
         /**
     131   -
          *
    +
          * Creates an Evidence object from the parameters and adds the resulting object to the collection.
     132   -
          * @param source the source of the Evidence.
    +
          *
     133   -
          * @param name the name of the Evidence.
    +
          * @param source the source of the Evidence.
     134   -
          * @param value the value of the Evidence.
    +
          * @param name the name of the Evidence.
     135   -
          * @param confidence the confidence of the Evidence.
    +
          * @param value the value of the Evidence.
     136   -
          */
    +
          * @param confidence the confidence of the Evidence.
     137   +
          */
    +  138  
         public void addEvidence(String source, String name, String value, Confidence confidence) {
    -  138  61944
             final Evidence e = new Evidence(source, name, value, confidence);
    -  139  61944
             addEvidence(e);
    -  140  61944
         }
    -  141   -
     
    +  139  15486
             final Evidence e = new Evidence(source, name, value, confidence);
    +  140  15486
             addEvidence(e);
    +  141  15486
         }
     142   -
         /**
    +
     
     143   -
          * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms.
    +
         /**
     144   -
          * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence.
    +
          * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms.
     145   -
          *
    +
          * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence.
     146   -
          * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the
    +
          *
     147   -
          * package names within the JAR file we may add these package names to the "weighted" strings collection to boost
    +
          * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the
     148   -
          * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the
    +
          * package names within the JAR file we may add these package names to the "weighted" strings collection to boost
     149   -
          * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache.
    +
          * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the
     150   -
          *
    +
          * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache.
     151   -
          * @param str to add to the weighting collection.
    +
          *
     152   -
          */
    +
          * @param str to add to the weighting collection.
     153   +
          */
    +  154  
         public void addWeighting(String str) {
    -  154  60
             weightedStrings.add(str);
    -  155  60
         }
    -  156   -
     
    +  155  15
             weightedStrings.add(str);
    +  156  15
         }
     157   -
         /**
    +
     
     158   -
          * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in
    +
         /**
     159   -
          * another location.
    +
          * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in
     160   -
          *
    +
          * another location.
     161   -
          * @return Set<String>
    +
          *
     162   -
          */
    +
          * @return Set<String>
     163   -
         public Set<String> getWeighting() {
    +
          */
     164   -
             return weightedStrings;
    +
         public Set<String> getWeighting() {
     165   -
         }
    +
             return weightedStrings;
     166   -
     
    +
         }
     167   -
         /**
    +
     
     168   -
          * Returns the set of evidence.
    +
         /**
     169   -
          *
    +
          * Returns the set of evidence.
     170   -
          * @return the set of evidence.
    +
          *
     171   -
          */
    +
          * @return the set of evidence.
     172   -
         public Set<Evidence> getEvidence() {
    +
          */
     173   -
             return list;
    +
         public Set<Evidence> getEvidence() {
     174   -
         }
    +
             return list;
     175   -
     
    +
         }
     176   -
         /**
    +
     
     177   -
          * Returns the set of evidence from a given source.
    +
         /**
     178   -
          *
    +
          * Returns the set of evidence from a given source.
     179   -
          * @param source the source of the evidence
    +
          *
     180   -
          * @return the set of evidence.
    -  181   -
          */
    -  182   -
         public Set<Evidence> getEvidence(String source) {
    -  183  0
             if (source == null) {
    -  184  0
                 return null;
    -  185   -
             }
    -  186  0
             final Set<Evidence> ret = new HashSet<Evidence>();
    -  187  0
             for (Evidence e : list) {
    -  188  0
                 if (source.equals(e.getSource())) {
    -  189  0
                     ret.add(e);
    -  190   -
                 }
    -  191  0
             }
    -  192  0
             return ret;
    -  193   -
         }
    -  194   -
     
    -  195   -
         /**
    -  196   -
          * Returns the set of evidence from a given source and name.
    -  197   -
          *
    -  198  
          * @param source the source of the evidence
    -  199   -
          * @param name the name of the evidence to return
    -  200   +  181  
          * @return the set of evidence.
    +  182   +
          */
    +  183   +
         public Set<Evidence> getEvidence(String source) {
    +  184  0
             if (source == null) {
    +  185  0
                 return null;
    +  186   +
             }
    +  187  0
             final Set<Evidence> ret = new HashSet<Evidence>();
    +  188  0
             for (Evidence e : list) {
    +  189  0
                 if (source.equals(e.getSource())) {
    +  190  0
                     ret.add(e);
    +  191   +
                 }
    +  192  0
             }
    +  193  0
             return ret;
    +  194   +
         }
    +  195   +
     
    +  196   +
         /**
    +  197   +
          * Returns the set of evidence from a given source and name.
    +  198   +
          *
    +  199   +
          * @param source the source of the evidence
    +  200   +
          * @param name the name of the evidence to return
     201   -
          */
    +
          * @return the set of evidence.
     202   +
          */
    +  203  
         public Set<Evidence> getEvidence(String source, String name) {
    -  203  8
             if (source == null || name == null) {
    -  204  0
                 return null;
    -  205   +  204  2
             if (source == null || name == null) {
    +  205  0
                 return null;
    +  206  
             }
    -  206  8
             final Set<Evidence> ret = new HashSet<Evidence>();
    -  207  8
             for (Evidence e : list) {
    -  208  8
                 if (source.equals(e.getSource()) && name.equals(e.getName())) {
    -  209  8
                     ret.add(e);
    -  210   +  207  2
             final Set<Evidence> ret = new HashSet<Evidence>();
    +  208  2
             for (Evidence e : list) {
    +  209  2
                 if (source.equals(e.getSource()) && name.equals(e.getName())) {
    +  210  2
                     ret.add(e);
    +  211  
                 }
    -  211  8
             }
    -  212  8
             return ret;
    -  213   -
         }
    +  212  2
             }
    +  213  2
             return ret;
     214   -
     
    +
         }
     215   -
         /**
    +
     
     216   -
          * Implements the iterator interface for the Evidence Collection.
    +
         /**
     217   -
          *
    +
          * Implements the iterator interface for the Evidence Collection.
     218   -
          * @return an Iterator<Evidence>.
    +
          *
     219   -
          */
    +
          * @return an Iterator<Evidence>.
     220   +
          */
    +  221  
         public Iterator<Evidence> iterator() {
    -  221  468
             return list.iterator();
    -  222   -
         }
    +  222  62
             return list.iterator();
     223   -
     
    +
         }
     224   -
         /**
    +
     
     225   -
          * Used to determine if a given string was used (aka read).
    +
         /**
     226   -
          *
    +
          * Used to determine if a given string was used (aka read).
     227   -
          * @param text the string to search for.
    +
          *
     228   -
          * @return whether or not the string was used.
    +
          * @param text the string to search for.
     229   -
          */
    -  230   -
         public boolean containsUsedString(String text) {
    -  231  448
             if (text == null) {
    -  232  0
                 return false;
    -  233   -
             }
    -  234  448
             final String textToTest = text.toLowerCase();
    -  235   -
     
    -  236  448
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    -  237   -
                 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else)
    -  238  2992
                 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", "");
    -  239  2992
                 if (value.contains(textToTest)) {
    -  240  176
                     return true;
    -  241   -
                 }
    -  242  2816
             }
    -  243  272
             return false;
    -  244   -
         }
    -  245   -
     
    -  246   -
         /**
    -  247   -
          * Used to determine if a given version was used (aka read) from the EvidenceCollection.
    -  248   -
          *
    -  249   -
          * @param version the version to search for within the collected evidence.
    -  250  
          * @return whether or not the string was used.
    +  230   +
          */
    +  231   +
         public boolean containsUsedString(String text) {
    +  232  57
             if (text == null) {
    +  233  0
                 return false;
    +  234   +
             }
    +  235  57
             final String textToTest = text.toLowerCase();
    +  236   +
     
    +  237  57
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    +  238   +
                 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else)
    +  239  259
                 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", "");
    +  240  259
                 if (value.contains(textToTest)) {
    +  241  28
                     return true;
    +  242   +
                 }
    +  243  231
             }
    +  244  29
             return false;
    +  245   +
         }
    +  246   +
     
    +  247   +
         /**
    +  248   +
          * Used to determine if a given version was used (aka read) from the EvidenceCollection.
    +  249   +
          *
    +  250   +
          * @param version the version to search for within the collected evidence.
     251   -
          */
    +
          * @return whether or not the string was used.
     252   +
          */
    +  253  
         public boolean containsUsedVersion(DependencyVersion version) {
    -  253  0
             if (version == null) {
    -  254  0
                 return false;
    -  255   -
             }
    +  254  0
             if (version == null) {
    +  255  0
                 return false;
     256   +
             }
    +  257  
     
    -  257  0
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    -  258  0
                 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue());
    -  259  0
                 if (value != null && value.matchesAtLeastThreeLevels(version)) {
    -  260  0
                     return true;
    -  261   +  258  0
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    +  259  0
                 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue());
    +  260  0
                 if (value != null && value.matchesAtLeastThreeLevels(version)) {
    +  261  0
                     return true;
    +  262  
                 }
    -  262  0
             }
    -  263  0
             return false;
    -  264   -
         }
    +  263  0
             }
    +  264  0
             return false;
     265   -
     
    +
         }
     266   -
         /**
    +
     
     267   -
          * Returns whether or not the collection contains evidence of a specified Confidence.
    +
         /**
     268   -
          *
    +
          * Returns whether or not the collection contains evidence of a specified Confidence.
     269   -
          * @param confidence A Confidence value.
    +
          *
     270   -
          * @return boolean.
    +
          * @param confidence A Confidence value.
     271   -
          */
    +
          * @return boolean.
     272   +
          */
    +  273  
         public boolean contains(Confidence confidence) {
    -  273  96
             for (Evidence e : list) {
    -  274  512
                 if (e.getConfidence().equals(confidence)) {
    -  275  84
                     return true;
    -  276   +  274  12
             for (Evidence e : list) {
    +  275  62
                 if (e.getConfidence().equals(confidence)) {
    +  276  11
                     return true;
    +  277  
                 }
    -  277  428
             }
    -  278  12
             return false;
    -  279   -
         }
    +  278  51
             }
    +  279  1
             return false;
     280   -
     
    +
         }
     281   -
         /**
    +
     
     282   -
          * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
    +
         /**
     283   -
          *
    +
          * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
     284   -
          * @param ec One or more EvidenceCollections.
    +
          *
     285   -
          * @return a new EvidenceCollection containing the used evidence.
    -  286   -
          */
    -  287   -
         public static EvidenceCollection mergeUsed(EvidenceCollection... ec) {
    -  288  4
             final EvidenceCollection ret = new EvidenceCollection();
    -  289  16
             for (EvidenceCollection col : ec) {
    -  290  12
                 for (Evidence e : col.list) {
    -  291  8
                     if (e.isUsed()) {
    -  292  4
                         ret.addEvidence(e);
    -  293   -
                     }
    -  294  8
                 }
    -  295   -
             }
    -  296  4
             return ret;
    -  297   -
         }
    -  298   -
     
    -  299   -
         /**
    -  300   -
          * Merges multiple EvidenceCollections together.
    -  301   -
          *
    -  302  
          * @param ec One or more EvidenceCollections.
    -  303   -
          * @return a new EvidenceCollection.
    -  304   +  286   +
          * @return a new EvidenceCollection containing the used evidence.
    +  287  
          */
    -  305   -
         public static EvidenceCollection merge(EvidenceCollection... ec) {
    -  306  12
             final EvidenceCollection ret = new EvidenceCollection();
    -  307  48
             for (EvidenceCollection col : ec) {
    -  308  36
                 ret.list.addAll(col.list);
    -  309  36
                 ret.weightedStrings.addAll(col.weightedStrings);
    -  310   -
             }
    -  311  12
             return ret;
    -  312   -
         }
    -  313   -
     
    -  314   -
         /**
    -  315   -
          * Merges multiple EvidenceCollections together; flattening all of the evidence items by removing the confidence.
    -  316   -
          *
    -  317   -
          * @param ec One or more EvidenceCollections
    -  318   -
          * @return new set of evidence resulting from merging the evidence in the collections
    -  319   -
          */
    -  320   -
         public static Set<Evidence> mergeForDisplay(EvidenceCollection... ec) {
    -  321  0
             final Set<Evidence> ret = new TreeSet<Evidence>();
    -  322  0
             for (EvidenceCollection col : ec) {
    -  323  0
                 for (Evidence e : col) {
    -  324  0
                     if (e.isUsed()) {
    -  325  0
                         final Evidence newEvidence = new Evidence(e.getSource(), e.getName(), e.getValue(), null);
    -  326  0
                         newEvidence.setUsed(true);
    -  327  0
                         ret.add(newEvidence);
    -  328   +  288   +
         public static EvidenceCollection mergeUsed(EvidenceCollection... ec) {
    +  289  1
             final EvidenceCollection ret = new EvidenceCollection();
    +  290  4
             for (EvidenceCollection col : ec) {
    +  291  3
                 for (Evidence e : col.list) {
    +  292  2
                     if (e.isUsed()) {
    +  293  1
                         ret.addEvidence(e);
    +  294  
                     }
    -  329  0
                 }
    -  330   +  295  2
                 }
    +  296  
             }
    -  331  0
             return ret;
    -  332   +  297  1
             return ret;
    +  298  
         }
    +  299   +
     
    +  300   +
         /**
    +  301   +
          * Merges multiple EvidenceCollections together.
    +  302   +
          *
    +  303   +
          * @param ec One or more EvidenceCollections.
    +  304   +
          * @return a new EvidenceCollection.
    +  305   +
          */
    +  306   +
         public static EvidenceCollection merge(EvidenceCollection... ec) {
    +  307  3
             final EvidenceCollection ret = new EvidenceCollection();
    +  308  12
             for (EvidenceCollection col : ec) {
    +  309  9
                 ret.list.addAll(col.list);
    +  310  9
                 ret.weightedStrings.addAll(col.weightedStrings);
    +  311   +
             }
    +  312  3
             return ret;
    +  313   +
         }
    +  314   +
     
    +  315   +
         /**
    +  316   +
          * Merges multiple EvidenceCollections together; flattening all of the evidence items by removing the confidence.
    +  317   +
          *
    +  318   +
          * @param ec One or more EvidenceCollections
    +  319   +
          * @return new set of evidence resulting from merging the evidence in the collections
    +  320   +
          */
    +  321   +
         public static Set<Evidence> mergeForDisplay(EvidenceCollection... ec) {
    +  322  0
             final Set<Evidence> ret = new TreeSet<Evidence>();
    +  323  0
             for (EvidenceCollection col : ec) {
    +  324  0
                 for (Evidence e : col) {
    +  325  0
                     if (e.isUsed()) {
    +  326  0
                         final Evidence newEvidence = new Evidence(e.getSource(), e.getName(), e.getValue(), null);
    +  327  0
                         newEvidence.setUsed(true);
    +  328  0
                         ret.add(newEvidence);
    +  329   +
                     }
    +  330  0
                 }
    +  331   +
             }
    +  332  0
             return ret;
     333   -
     
    +
         }
     334   -
         /**
    +
     
     335   -
          * Returns a string of evidence 'values'.
    +
         /**
     336   -
          *
    +
          * Returns a string of evidence 'values'.
     337   -
          * @return a string containing the evidence.
    +
          *
     338   -
          */
    +
          * @return a string containing the evidence.
     339   -
         @Override
    +
          */
     340   +
         @Override
    +  341  
         public String toString() {
    -  341  12
             final StringBuilder sb = new StringBuilder();
    -  342  12
             for (Evidence e : this.list) {
    -  343  52
                 sb.append(e.getValue()).append(' ');
    -  344  52
             }
    -  345  12
             return sb.toString();
    -  346   -
         }
    +  342  3
             final StringBuilder sb = new StringBuilder();
    +  343  3
             for (Evidence e : this.list) {
    +  344  13
                 sb.append(e.getValue()).append(' ');
    +  345  13
             }
    +  346  3
             return sb.toString();
     347   -
     
    +
         }
     348   -
         /**
    -  349   -
          * Returns the number of elements in the EvidenceCollection.
    -  350   -
          *
    -  351   -
          * @return the number of elements in the collection.
    -  352   -
          */
    -  353   -
         public int size() {
    -  354  116
             return list.size();
    -  355   -
         }
    -  356  
     
    -  357   +  349  
         /**
    -  358   -
          * <p>
    -  359   -
          * Takes a string that may contain a fully qualified domain and it will return the string having removed the query
    -  360   -
          * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p>
    -  361   -
          * <p>
    -  362   -
          * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file
    -  363   -
          * extension, etc. may produce false positives.
    -  364   +  350   +
          * Returns the number of elements in the EvidenceCollection.
    +  351  
          *
    -  365   -
          * <p>
    -  366   -
          * Example, given the following input:</p>
    -  367   -
          * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code>
    -  368   -
          * <p>
    -  369   -
          * The function would return:</p>
    -  370   -
          * <code>'Please visit somedomain path1 path2 file'</code>
    -  371   -
          *
    -  372   -
          * @param value the value that may contain a url
    -  373   -
          * @return the modified string
    -  374   +  352   +
          * @return the number of elements in the collection.
    +  353  
          */
    -  375   -
         private String urlCorrection(String value) {
    -  376  2992
             if (value == null || !UrlStringUtils.containsUrl(value)) {
    -  377  2972
                 return value;
    -  378   -
             }
    -  379  20
             final StringBuilder sb = new StringBuilder(value.length());
    -  380  20
             final String[] parts = value.split("\\s");
    -  381  40
             for (String part : parts) {
    -  382  20
                 if (UrlStringUtils.isUrl(part)) {
    -  383   -
                     try {
    -  384  20
                         final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    -  385  20
                         sb.append(' ').append(StringUtils.join(data, ' '));
    -  386  0
                     } catch (MalformedURLException ex) {
    -  387  0
                         LOGGER.log(Level.FINE, "error parsing " + part, ex);
    -  388  0
                         sb.append(' ').append(part);
    -  389  20
                     }
    -  390   -
                 } else {
    -  391  0
                     sb.append(' ').append(part);
    -  392   -
                 }
    -  393   -
             }
    -  394  20
             return sb.toString().trim();
    -  395   +  354   +
         public int size() {
    +  355  13
             return list.size();
    +  356  
         }
    +  357   +
     
    +  358   +
         /**
    +  359   +
          * <p>
    +  360   +
          * Takes a string that may contain a fully qualified domain and it will return the string having removed the query
    +  361   +
          * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p>
    +  362   +
          * <p>
    +  363   +
          * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file
    +  364   +
          * extension, etc. may produce false positives.
    +  365   +
          *
    +  366   +
          * <p>
    +  367   +
          * Example, given the following input:</p>
    +  368   +
          * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code>
    +  369   +
          * <p>
    +  370   +
          * The function would return:</p>
    +  371   +
          * <code>'Please visit somedomain path1 path2 file'</code>
    +  372   +
          *
    +  373   +
          * @param value the value that may contain a url
    +  374   +
          * @return the modified string
    +  375   +
          */
    +  376   +
         private String urlCorrection(String value) {
    +  377  259
             if (value == null || !UrlStringUtils.containsUrl(value)) {
    +  378  254
                 return value;
    +  379   +
             }
    +  380  5
             final StringBuilder sb = new StringBuilder(value.length());
    +  381  5
             final String[] parts = value.split("\\s");
    +  382  10
             for (String part : parts) {
    +  383  5
                 if (UrlStringUtils.isUrl(part)) {
    +  384   +
                     try {
    +  385  5
                         final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    +  386  5
                         sb.append(' ').append(StringUtils.join(data, ' '));
    +  387  0
                     } catch (MalformedURLException ex) {
    +  388  0
                         LOGGER.log(Level.FINE, "error parsing " + part, ex);
    +  389  0
                         sb.append(' ').append(part);
    +  390  5
                     }
    +  391   +
                 } else {
    +  392  0
                     sb.append(' ').append(part);
    +  393   +
                 }
    +  394   +
             }
    +  395  5
             return sb.toString().trim();
     396   +
         }
    +  397  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html index a9c1e5d50..70d17fd64 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html @@ -56,375 +56,379 @@  19  
     
     20   -
     /**
    +
     import java.io.Serializable;
     21   -
      *
    +
     
     22   -
      * @author Jeremy Long <jeremy.long@owasp.org>
    +
     /**
     23   -
      */
    -  24  128
     public class Identifier implements Comparable<Identifier> {
    +
      *
    +  24   +
      * @author Jeremy Long <jeremy.long@owasp.org>
     25   -
     
    -  26   -
         /**
    +
      */
    +  26  26
     public class Identifier implements Serializable, Comparable<Identifier> {
     27   -
          * Constructs a new Identifier with the specified data.
    +
     
     28   -
          *
    +
         /**
     29   -
          * @param type the identifier type.
    -  30   -
          * @param value the identifier value.
    -  31   -
          * @param url the identifier url.
    -  32   -
          */
    -  33   -
         public Identifier(String type, String value, String url) {
    -  34   -
             this.type = type;
    -  35   -
             this.value = value;
    -  36   -
             this.url = url;
    -  37   -
         }
    -  38   -
     
    -  39   -
         /**
    -  40  
          * Constructs a new Identifier with the specified data.
    -  41   +  30  
          *
    -  42   +  31  
          * @param type the identifier type.
    -  43   +  32  
          * @param value the identifier value.
    -  44   +  33  
          * @param url the identifier url.
    -  45   -
          * @param description the description of the identifier.
    -  46   +  34  
          */
    -  47   -
         public Identifier(String type, String value, String url, String description) {
    -  48  0
             this(type, value, url);
    -  49  0
             this.description = description;
    -  50  0
         }
    -  51   -
     
    -  52   -
         /**
    -  53   -
          * The confidence that this is the correct identifier.
    -  54   -
          */
    -  55   -
         private Confidence confidence;
    -  56   -
     
    -  57   -
         /**
    -  58   -
          * Get the value of confidence.
    -  59   -
          *
    -  60   -
          * @return the value of confidence
    -  61   -
          */
    -  62   -
         public Confidence getConfidence() {
    -  63   -
             return confidence;
    -  64   -
         }
    -  65   -
     
    -  66   -
         /**
    -  67   -
          * Set the value of confidence.
    -  68   -
          *
    -  69   -
          * @param confidence new value of confidence
    -  70   -
          */
    -  71   -
         public void setConfidence(Confidence confidence) {
    -  72   -
             this.confidence = confidence;
    -  73   -
         }
    -  74   -
     
    -  75   -
         /**
    -  76   -
          * The value of the identifier
    -  77   -
          */
    -  78   -
         private String value;
    -  79   -
     
    -  80   -
         /**
    -  81   -
          * Get the value of value.
    -  82   -
          *
    -  83   -
          * @return the value of value
    -  84   -
          */
    -  85   -
         public String getValue() {
    -  86   -
             return value;
    -  87   -
         }
    -  88   -
     
    -  89   -
         /**
    -  90   -
          * Set the value of value.
    -  91   -
          *
    -  92   -
          * @param value new value of value
    -  93   -
          */
    -  94   -
         public void setValue(String value) {
    -  95   -
             this.value = value;
    -  96   -
         }
    -  97   -
         /**
    -  98   -
          * The url for the identifier.
    -  99   -
          */
    -  100   -
         private String url;
    -  101   -
     
    -  102   -
         /**
    -  103   -
          * Get the value of url.
    -  104   -
          *
    -  105   -
          * @return the value of url
    -  106   -
          */
    -  107   -
         public String getUrl() {
    -  108   -
             return url;
    -  109   -
         }
    -  110   -
     
    -  111   -
         /**
    -  112   -
          * Set the value of url.
    -  113   -
          *
    -  114   -
          * @param url new value of url
    -  115   -
          */
    -  116   -
         public void setUrl(String url) {
    -  117   -
             this.url = url;
    -  118   -
         }
    -  119   -
         /**
    -  120   -
          * The type of the identifier.
    -  121   -
          */
    -  122   -
         private String type;
    -  123   -
     
    -  124   -
         /**
    -  125   -
          * Get the value of type.
    -  126   -
          *
    -  127   -
          * @return the value of type
    -  128   -
          */
    -  129   -
         public String getType() {
    -  130   -
             return type;
    -  131   -
         }
    -  132   -
     
    -  133   -
         /**
    -  134   -
          * <p>
    -  135   -
          * Set the value of type.</p><p>
    -  136   -
          * Example would be "CPE".</p>
    -  137   -
          *
    -  138   -
          * @param type new value of type
    -  139   -
          */
    -  140   -
         public void setType(String type) {
    -  141   +  35   +
         public Identifier(String type, String value, String url) {
    +  36  
             this.type = type;
    +  37   +
             this.value = value;
    +  38   +
             this.url = url;
    +  39   +
         }
    +  40   +
     
    +  41   +
         /**
    +  42   +
          * Constructs a new Identifier with the specified data.
    +  43   +
          *
    +  44   +
          * @param type the identifier type.
    +  45   +
          * @param value the identifier value.
    +  46   +
          * @param url the identifier url.
    +  47   +
          * @param description the description of the identifier.
    +  48   +
          */
    +  49   +
         public Identifier(String type, String value, String url, String description) {
    +  50  0
             this(type, value, url);
    +  51  0
             this.description = description;
    +  52  0
         }
    +  53   +
     
    +  54   +
         /**
    +  55   +
          * The confidence that this is the correct identifier.
    +  56   +
          */
    +  57   +
         private Confidence confidence;
    +  58   +
     
    +  59   +
         /**
    +  60   +
          * Get the value of confidence.
    +  61   +
          *
    +  62   +
          * @return the value of confidence
    +  63   +
          */
    +  64   +
         public Confidence getConfidence() {
    +  65   +
             return confidence;
    +  66   +
         }
    +  67   +
     
    +  68   +
         /**
    +  69   +
          * Set the value of confidence.
    +  70   +
          *
    +  71   +
          * @param confidence new value of confidence
    +  72   +
          */
    +  73   +
         public void setConfidence(Confidence confidence) {
    +  74   +
             this.confidence = confidence;
    +  75   +
         }
    +  76   +
     
    +  77   +
         /**
    +  78   +
          * The value of the identifier
    +  79   +
          */
    +  80   +
         private String value;
    +  81   +
     
    +  82   +
         /**
    +  83   +
          * Get the value of value.
    +  84   +
          *
    +  85   +
          * @return the value of value
    +  86   +
          */
    +  87   +
         public String getValue() {
    +  88   +
             return value;
    +  89   +
         }
    +  90   +
     
    +  91   +
         /**
    +  92   +
          * Set the value of value.
    +  93   +
          *
    +  94   +
          * @param value new value of value
    +  95   +
          */
    +  96   +
         public void setValue(String value) {
    +  97   +
             this.value = value;
    +  98   +
         }
    +  99   +
         /**
    +  100   +
          * The url for the identifier.
    +  101   +
          */
    +  102   +
         private String url;
    +  103   +
     
    +  104   +
         /**
    +  105   +
          * Get the value of url.
    +  106   +
          *
    +  107   +
          * @return the value of url
    +  108   +
          */
    +  109   +
         public String getUrl() {
    +  110   +
             return url;
    +  111   +
         }
    +  112   +
     
    +  113   +
         /**
    +  114   +
          * Set the value of url.
    +  115   +
          *
    +  116   +
          * @param url new value of url
    +  117   +
          */
    +  118   +
         public void setUrl(String url) {
    +  119   +
             this.url = url;
    +  120   +
         }
    +  121   +
         /**
    +  122   +
          * The type of the identifier.
    +  123   +
          */
    +  124   +
         private String type;
    +  125   +
     
    +  126   +
         /**
    +  127   +
          * Get the value of type.
    +  128   +
          *
    +  129   +
          * @return the value of type
    +  130   +
          */
    +  131   +
         public String getType() {
    +  132   +
             return type;
    +  133   +
         }
    +  134   +
     
    +  135   +
         /**
    +  136   +
          * <p>
    +  137   +
          * Set the value of type.</p><p>
    +  138   +
          * Example would be "CPE".</p>
    +  139   +
          *
    +  140   +
          * @param type new value of type
    +  141   +
          */
     142   -
         }
    +
         public void setType(String type) {
     143   -
         /**
    +
             this.type = type;
     144   -
          * A description of the identifier.
    +
         }
     145   -
          */
    +
         /**
     146   -
         private String description;
    +
          * A description of the identifier.
     147   -
     
    +
          */
     148   -
         /**
    +
         private String description;
     149   -
          * Get the value of description.
    +
     
     150   -
          *
    +
         /**
     151   -
          * @return the value of description
    +
          * Get the value of description.
     152   -
          */
    +
          *
     153   -
         public String getDescription() {
    +
          * @return the value of description
     154   -
             return description;
    +
          */
     155   -
         }
    +
         public String getDescription() {
     156   -
     
    +
             return description;
     157   -
         /**
    +
         }
     158   -
          * Set the value of description.
    +
     
     159   -
          *
    +
         /**
     160   -
          * @param description new value of description
    +
          * Set the value of description.
     161   -
          */
    +
          *
     162   -
         public void setDescription(String description) {
    +
          * @param description new value of description
     163   -
             this.description = description;
    +
          */
     164   -
         }
    +
         public void setDescription(String description) {
     165   -
     
    +
             this.description = description;
     166   -
         @Override
    +
         }
     167   +
     
    +  168   +
         @Override
    +  169  
         public boolean equals(Object obj) {
    -  168  0
             if (obj == null) {
    -  169  0
                 return false;
    -  170   +  170  0
             if (obj == null) {
    +  171  0
                 return false;
    +  172  
             }
    -  171  0
             if (getClass() != obj.getClass()) {
    -  172  0
                 return false;
    -  173   +  173  0
             if (getClass() != obj.getClass()) {
    +  174  0
                 return false;
    +  175  
             }
    -  174  0
             final Identifier other = (Identifier) obj;
    -  175  0
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    -  176  0
                 return false;
    -  177   +  176  0
             final Identifier other = (Identifier) obj;
    +  177  0
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    +  178  0
                 return false;
    +  179  
             }
    -  178  0
             if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) {
    -  179  0
                 return false;
    -  180   -
             }
    -  181  0
             return true;
    +  180  0
             if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) {
    +  181  0
                 return false;
     182   -
         }
    -  183   -
     
    -  184   -
         @Override
    -  185   -
         public int hashCode() {
    -  186  40
             int hash = 5;
    -  187  40
             hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0);
    -  188  40
             hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0);
    -  189  40
             return hash;
    -  190   -
         }
    -  191   -
     
    -  192   -
         /**
    -  193   -
          * Standard implementation of toString; displays identifier value and type.
    -  194   -
          *
    -  195   -
          * @return a String representation of the object
    -  196   -
          */
    -  197   -
         @Override
    -  198   -
         public String toString() {
    -  199  0
             return "Identifier{" + "value=" + value + ", type=" + type + '}';
    -  200   -
         }
    -  201   -
     
    -  202   -
         /**
    -  203   -
          * Implementation of the comparator interface. This compares the value of the identifier only.
    -  204   -
          *
    -  205   -
          * @param o the object being compared
    -  206   -
          * @return an integer indicating the ordering
    -  207   -
          */
    -  208   -
         public int compareTo(Identifier o) {
    -  209  144
             if (o == null) {
    -  210  0
                 return -1;
    -  211  
             }
    -  212  144
             return this.value.compareTo(o.value);
    -  213   +  183  0
             return true;
    +  184  
         }
    -  214   +  185   +
     
    +  186   +
         @Override
    +  187   +
         public int hashCode() {
    +  188  10
             int hash = 5;
    +  189  10
             hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0);
    +  190  10
             hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0);
    +  191  10
             return hash;
    +  192   +
         }
    +  193   +
     
    +  194   +
         /**
    +  195   +
          * Standard implementation of toString; displays identifier value and type.
    +  196   +
          *
    +  197   +
          * @return a String representation of the object
    +  198   +
          */
    +  199   +
         @Override
    +  200   +
         public String toString() {
    +  201  0
             return "Identifier{" + "value=" + value + ", type=" + type + '}';
    +  202   +
         }
    +  203   +
     
    +  204   +
         /**
    +  205   +
          * Implementation of the comparator interface. This compares the value of the identifier only.
    +  206   +
          *
    +  207   +
          * @param o the object being compared
    +  208   +
          * @return an integer indicating the ordering
    +  209   +
          */
    +  210   +
         public int compareTo(Identifier o) {
    +  211  28
             if (o == null) {
    +  212  0
                 return -1;
    +  213   +
             }
    +  214  28
             return this.value.compareTo(o.value);
    +  215   +
         }
    +  216  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html index 96d2ed81f..16febd151 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html @@ -69,7 +69,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     26  
      */
    -  27  1408
     public class Reference implements Serializable, Comparable<Reference> {
    +  27  352
     public class Reference implements Serializable, Comparable<Reference> {
     28  
     
     29   @@ -271,10 +271,10 @@
          */
     136  
         public int compareTo(Reference o) {
    -  137  1408
             if (source.equals(o.source)) {
    -  138  420
                 if (name.equals(o.name)) {
    -  139  136
                     if (url.equals(o.url)) {
    -  140  136
                         return 0; //they are equal
    +  137  352
             if (source.equals(o.source)) {
    +  138  105
                 if (name.equals(o.name)) {
    +  139  34
                     if (url.equals(o.url)) {
    +  140  34
                         return 0; //they are equal
     141  
                     } else {
     142  0
                         return url.compareTo(o.url);
    @@ -282,12 +282,12 @@
                     }
     144  
                 } else {
    -  145  284
                     return name.compareTo(o.name);
    +  145  71
                     return name.compareTo(o.name);
     146  
                 }
     147  
             } else {
    -  148  988
                 return source.compareTo(o.source);
    +  148  247
                 return source.compareTo(o.source);
     149  
             }
     150   @@ -296,6 +296,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html index 496b158f6..1576ac49b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html @@ -75,7 +75,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     29  
      */
    -  30  144
     public class Vulnerability implements Serializable, Comparable<Vulnerability> {
    +  30  36
     public class Vulnerability implements Serializable, Comparable<Vulnerability> {
     31  
     
     32   @@ -180,7 +180,7 @@
          * References for this vulnerability.
     82  
          */
    -  83  144
         private SortedSet<Reference> references = new TreeSet<Reference>();
    +  83  36
         private SortedSet<Reference> references = new TreeSet<Reference>();
     84  
     
     85   @@ -231,8 +231,8 @@
          */
     108  
         public void addReference(Reference ref) {
    -  109  360
             this.references.add(ref);
    -  110  360
         }
    +  109  90
             this.references.add(ref);
    +  110  90
         }
     111  
     
     112   @@ -251,19 +251,19 @@
          */
     119  
         public void addReference(String referenceSource, String referenceName, String referenceUrl) {
    -  120  272
             final Reference ref = new Reference();
    -  121  272
             ref.setSource(referenceSource);
    -  122  272
             ref.setName(referenceName);
    -  123  272
             ref.setUrl(referenceUrl);
    -  124  272
             this.references.add(ref);
    -  125  272
         }
    +  120  68
             final Reference ref = new Reference();
    +  121  68
             ref.setSource(referenceSource);
    +  122  68
             ref.setName(referenceName);
    +  123  68
             ref.setUrl(referenceUrl);
    +  124  68
             this.references.add(ref);
    +  125  68
         }
     126  
         /**
     127  
          * A set of vulnerable software.
     128  
          */
    -  129  144
         private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
    +  129  36
         private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
     130  
     
     131   @@ -316,7 +316,7 @@
          */
     155  
         public boolean addVulnerableSoftware(String cpe) {
    -  156  3368
             return addVulnerableSoftware(cpe, null);
    +  156  842
             return addVulnerableSoftware(cpe, null);
     157  
         }
     158   @@ -337,13 +337,13 @@
          */
     166  
         public boolean addVulnerableSoftware(String cpe, String previousVersion) {
    -  167  3400
             final VulnerableSoftware vs = new VulnerableSoftware();
    -  168  3400
             vs.setCpe(cpe);
    -  169  3400
             if (previousVersion != null) {
    -  170  32
                 vs.setPreviousVersion(previousVersion);
    +  167  850
             final VulnerableSoftware vs = new VulnerableSoftware();
    +  168  850
             vs.setCpe(cpe);
    +  169  850
             if (previousVersion != null) {
    +  170  8
                 vs.setPreviousVersion(previousVersion);
     171  
             }
    -  172  3400
             return updateVulnerableSoftware(vs);
    +  172  850
             return updateVulnerableSoftware(vs);
     173  
         }
     174   @@ -362,11 +362,11 @@
          */
     181  
         public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) {
    -  182  3400
             if (vulnerableSoftware.contains(vulnSoftware)) {
    +  182  850
             if (vulnerableSoftware.contains(vulnSoftware)) {
     183  0
                 vulnerableSoftware.remove(vulnSoftware);
     184  
             }
    -  185  3400
             return vulnerableSoftware.add(vulnSoftware);
    +  185  850
             return vulnerableSoftware.add(vulnSoftware);
     186  
         }
     187   @@ -749,9 +749,9 @@
         @Override
     380  
         public int hashCode() {
    -  381  32
             int hash = 5;
    -  382  32
             hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0);
    -  383  32
             return hash;
    +  381  8
             int hash = 5;
    +  382  8
             hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0);
    +  383  8
             return hash;
     384  
         }
     385   @@ -811,9 +811,9 @@
          */
     413  
         public void setMatchedCPE(String cpeId, String previous) {
    -  414  32
             matchedCPE = cpeId;
    -  415  32
             matchedAllPreviousCPE = previous;
    -  416  32
         }
    +  414  8
             matchedCPE = cpeId;
    +  415  8
             matchedAllPreviousCPE = previous;
    +  416  8
         }
     417  
     
     418   @@ -871,6 +871,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html index c4e7c4f9d..07ec2bfa2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html @@ -71,7 +71,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     27  
      */
    -  28  92
     public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
    +  28  23
     public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
     29  
     
     30   @@ -100,13 +100,13 @@
          */
     42  
         public int compare(Vulnerability o1, Vulnerability o2) {
    -  43  92
             return o2.getName().compareTo(o1.getName());
    +  43  23
             return o2.getName().compareTo(o1.getName());
     44  
         }
     45  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html index 4996f3aee..1006a4c4d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html @@ -79,7 +79,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     31  
      */
    -  32  40016
     public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
    +  32  10004
     public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
     33  
     
     34   @@ -88,7 +88,7 @@
          * The logger.
     36  
          */
    -  37  4
         private static final Logger LOGGER = Logger.getLogger(VulnerableSoftware.class.getName());
    +  37  1
         private static final Logger LOGGER = Logger.getLogger(VulnerableSoftware.class.getName());
     38  
         /**
     39   @@ -113,14 +113,14 @@
         public void setCpe(String cpe) {
     49  
             try {
    -  50  4056
                 parseName(cpe);
    +  50  936
                 parseName(cpe);
     51  0
             } catch (UnsupportedEncodingException ex) {
     52  0
                 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe);
     53  0
                 LOGGER.log(Level.WARNING, msg);
     54  0
                 LOGGER.log(Level.FINE, null, ex);
     55  0
                 setName(cpe);
    -  56  4056
             }
    -  57  4056
         }
    +  56  936
             }
    +  57  936
         }
     58  
     
     59   @@ -157,32 +157,32 @@
         @Override
     75  
         public void parseName(String cpeName) throws UnsupportedEncodingException {
    -  76  4204
             this.name = cpeName;
    -  77  4204
             if (cpeName != null && cpeName.length() > 7) {
    -  78  4204
                 final String[] data = cpeName.substring(7).split(":");
    -  79  4204
                 if (data.length >= 1) {
    -  80  4204
                     this.setVendor(urlDecode(data[0]));
    +  76  973
             this.name = cpeName;
    +  77  973
             if (cpeName != null && cpeName.length() > 7) {
    +  78  973
                 final String[] data = cpeName.substring(7).split(":");
    +  79  973
                 if (data.length >= 1) {
    +  80  973
                     this.setVendor(urlDecode(data[0]));
     81  
                 }
    -  82  4204
                 if (data.length >= 2) {
    -  83  4204
                     this.setProduct(urlDecode(data[1]));
    +  82  973
                 if (data.length >= 2) {
    +  83  973
                     this.setProduct(urlDecode(data[1]));
     84  
                 }
    -  85  4204
                 if (data.length >= 3) {
    -  86  4204
                     version = urlDecode(data[2]);
    +  85  973
                 if (data.length >= 3) {
    +  86  973
                     version = urlDecode(data[2]);
     87  
                 }
    -  88  4204
                 if (data.length >= 4) {
    -  89  604
                     revision = urlDecode(data[3]);
    +  88  973
                 if (data.length >= 4) {
    +  89  119
                     revision = urlDecode(data[3]);
     90  
                 }
    -  91  4204
                 if (data.length >= 5) {
    +  91  973
                 if (data.length >= 5) {
     92  0
                     edition = urlDecode(data[4]);
     93  
                 }
     94  
             }
    -  95  4204
         }
    +  95  973
         }
     96  
         /**
     97   @@ -262,17 +262,17 @@
         @Override
     135  
         public boolean equals(Object obj) {
    -  136  4
             if (obj == null) {
    +  136  1
             if (obj == null) {
     137  0
                 return false;
     138  
             }
    -  139  4
             if (getClass() != obj.getClass()) {
    +  139  1
             if (getClass() != obj.getClass()) {
     140  0
                 return false;
     141  
             }
    -  142  4
             final VulnerableSoftware other = (VulnerableSoftware) obj;
    -  143  4
             if ((this.getName() == null) ? (other.getName() != null) : !this.getName().equals(other.getName())) {
    -  144  4
                 return false;
    +  142  1
             final VulnerableSoftware other = (VulnerableSoftware) obj;
    +  143  1
             if ((this.getName() == null) ? (other.getName() != null) : !this.getName().equals(other.getName())) {
    +  144  1
                 return false;
     145  
             }
     146  0
             return true;
    @@ -294,9 +294,9 @@
         @Override
     155  
         public int hashCode() {
    -  156  652
             int hash = 7;
    -  157  652
             hash = 83 * hash + (this.getName() != null ? this.getName().hashCode() : 0);
    -  158  652
             return hash;
    +  156  82
             int hash = 7;
    +  157  82
             hash = 83 * hash + (this.getName() != null ? this.getName().hashCode() : 0);
    +  158  82
             return hash;
     159  
         }
     160   @@ -336,21 +336,21 @@
         @Override
     178  
         public int compareTo(VulnerableSoftware vs) {
    -  179  40024
             int result = 0;
    -  180  40024
             final String[] left = this.getName().split(":");
    -  181  40024
             final String[] right = vs.getName().split(":");
    -  182  40024
             final int max = (left.length <= right.length) ? left.length : right.length;
    -  183  40024
             if (max > 0) {
    -  184  241004
                 for (int i = 0; result == 0 && i < max; i++) {
    -  185  200980
                     final String[] subLeft = left[i].split("\\.");
    -  186  200980
                     final String[] subRight = right[i].split("\\.");
    -  187  200980
                     final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
    -  188  200980
                     if (subMax > 0) {
    -  189  458592
                         for (int x = 0; result == 0 && x < subMax; x++) {
    -  190  257612
                             if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
    +  179  10006
             int result = 0;
    +  180  10006
             final String[] left = this.getName().split(":");
    +  181  10006
             final String[] right = vs.getName().split(":");
    +  182  10006
             final int max = (left.length <= right.length) ? left.length : right.length;
    +  183  10006
             if (max > 0) {
    +  184  60251
                 for (int i = 0; result == 0 && i < max; i++) {
    +  185  50245
                     final String[] subLeft = left[i].split("\\.");
    +  186  50245
                     final String[] subRight = right[i].split("\\.");
    +  187  50245
                     final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
    +  188  50245
                     if (subMax > 0) {
    +  189  114648
                         for (int x = 0; result == 0 && x < subMax; x++) {
    +  190  64403
                             if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
     191  
                                 try {
    -  192  93808
                                     result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x]));
    +  192  23452
                                     result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x]));
     193  
     //                                final long iLeft = Long.parseLong(subLeft[x]);
     194   @@ -376,21 +376,21 @@  205  0
                                         result = subLeft[x].compareToIgnoreCase(subRight[x]);
     206  
                                     }
    -  207  93808
                                 }
    +  207  23452
                                 }
     208  
                             } else {
    -  209  163804
                                 result = subLeft[x].compareToIgnoreCase(subRight[x]);
    +  209  40951
                                 result = subLeft[x].compareToIgnoreCase(subRight[x]);
     210  
                             }
     211  
                         }
    -  212  200980
                         if (result == 0) {
    -  213  161856
                             if (subLeft.length > subRight.length) {
    -  214  456
                                 result = 2;
    +  212  50245
                         if (result == 0) {
    +  213  40464
                             if (subLeft.length > subRight.length) {
    +  214  114
                                 result = 2;
     215  
                             }
    -  216  161856
                             if (subRight.length > subLeft.length) {
    -  217  28
                                 result = -2;
    +  216  40464
                             if (subRight.length > subLeft.length) {
    +  217  7
                                 result = -2;
     218  
                             }
     219   @@ -402,13 +402,13 @@
                     }
     223  
                 }
    -  224  40024
                 if (result == 0) {
    -  225  416
                     if (left.length > right.length) {
    -  226  272
                         result = 2;
    +  224  10006
                 if (result == 0) {
    +  225  104
                     if (left.length > right.length) {
    +  226  68
                         result = 2;
     227  
                     }
    -  228  416
                     if (right.length > left.length) {
    -  229  40
                         result = -2;
    +  228  104
                     if (right.length > left.length) {
    +  229  10
                         result = -2;
     230  
                     }
     231   @@ -418,7 +418,7 @@  233  0
                 result = this.getName().compareToIgnoreCase(vs.getName());
     234  
             }
    -  235  40024
             return result;
    +  235  10006
             return result;
     236  
         }
     237   @@ -437,19 +437,19 @@
          */
     244  
         private static boolean isPositiveInteger(final String str) {
    -  245  351708
             if (str == null || str.isEmpty()) {
    -  246  56
                 return false;
    +  245  87927
             if (str == null || str.isEmpty()) {
    +  246  14
                 return false;
     247  
             }
    -  248  571592
             for (int i = 0; i < str.length(); i++) {
    -  249  383688
                 final char c = str.charAt(i);
    -  250  383688
                 if (c < '0' || c > '9') {
    -  251  163748
                     return false;
    +  248  142898
             for (int i = 0; i < str.length(); i++) {
    +  249  95922
                 final char c = str.charAt(i);
    +  250  95922
                 if (c < '0' || c > '9') {
    +  251  40937
                     return false;
     252  
                 }
     253  
             }
    -  254  187904
             return true;
    +  254  46976
             return true;
     255  
         }
     256   @@ -644,12 +644,12 @@
          */
     351  
         private String urlDecode(String string) {
    -  352  13216
             final String text = string.replace("+", "%2B");
    +  352  3038
             final String text = string.replace("+", "%2B");
     353  
             String result;
     354  
             try {
    -  355  13216
                 result = URLDecoder.decode(text, "UTF-8");
    +  355  3038
                 result = URLDecoder.decode(text, "UTF-8");
     356  0
             } catch (UnsupportedEncodingException ex) {
     357  
                 try {
    @@ -657,14 +657,14 @@  359  0
                 } catch (UnsupportedEncodingException ex1) {
     360  0
                     result = URLDecoder.decode(text);
     361  0
                 }
    -  362  13216
             }
    -  363  13216
             return result;
    +  362  3038
             }
    +  363  3038
             return result;
     364  
         }
     365  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html index 7e26a2779..e2326c052 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.ScanAgentException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.ScanAgentException.html index 5f1b4cd50..74785d686 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.ScanAgentException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.ScanAgentException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html index 83a2f8d2c..7cb28f9af 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html @@ -198,6 +198,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html index 28c673b8d..413958b32 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html @@ -409,6 +409,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html index cc9bf767d..5c04a64bf 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html @@ -233,6 +233,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html index c22270385..770578428 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html @@ -347,6 +347,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html index a85c7460c..41d74e942 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html @@ -233,6 +233,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html index cde480e54..509ae0541 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html @@ -1635,6 +1635,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html index 5d0b8a9cc..536fb5f6c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html @@ -1145,6 +1145,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html index da552ee1d..a93122dc0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html @@ -429,6 +429,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html index 491ef6a9c..8b7079a13 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html @@ -875,6 +875,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html index 216fab006..634501956 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html @@ -783,6 +783,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html index 246b9e18d..02f7de96e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html @@ -317,6 +317,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html index 5d3cc0315..2f13b8489 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html @@ -409,6 +409,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html index bf7c1aa3b..f0b2f04d1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html @@ -929,6 +929,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html index 7ad5e81fd..eb24ab0d4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html @@ -465,6 +465,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html index 3d8d211e7..0e4ff3a90 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html @@ -225,6 +225,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html index db50d0dd7..304135092 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html @@ -283,6 +283,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html index d9ee169b8..68f911977 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html @@ -229,6 +229,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html index f034569a3..22079953e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html @@ -349,6 +349,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html index 4189a47f7..2ae1a51df 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html @@ -609,6 +609,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html index 9b43150bf..589568d08 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html @@ -3169,6 +3169,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html index 426e51de8..dd5b3edff 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html @@ -683,6 +683,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html index 4d79e904d..6a7ecd088 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html @@ -1396,6 +1396,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html index 9f390f458..3cd7d48f0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html @@ -225,6 +225,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html index 0c7a6f861..79110fa02 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html @@ -345,6 +345,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html index 311acc7ba..ae62df5c9 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html @@ -1217,6 +1217,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html index 3a8e8ccb1..412f8401e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html @@ -697,6 +697,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html index e099c8105..5bc8a9f2b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html @@ -317,6 +317,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html index b368bc896..569e854b8 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html @@ -171,6 +171,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html index ebe0f7f13..fc1c30af2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html @@ -1673,6 +1673,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html index 03c1f12f0..0475b287d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html @@ -343,6 +343,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html index 0d5f0baaf..9596b3475 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html @@ -755,6 +755,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html index e8cb50892..4454cf912 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html @@ -639,6 +639,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html index 79c964e7d..e6168ec22 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html @@ -433,6 +433,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html index 73f1bf0a2..dee835671 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html @@ -465,6 +465,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html index 64480d5dc..ae7a03a0b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html @@ -287,6 +287,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html index f1f319d1b..e7423dca4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html @@ -697,6 +697,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html index 8297ef9e0..6fb0fd648 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html @@ -345,6 +345,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html index 6db52e580..c6865eb98 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html @@ -287,6 +287,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html index 42160bbb5..2ea44cf63 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html @@ -37,6 +37,6 @@
     package org.owasp.dependencycheck.jaxb.pom.generated;
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.EscapeTool.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.EscapeTool.html index 5d5e812c8..98d32674a 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.EscapeTool.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.EscapeTool.html @@ -159,6 +159,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html index 044079d5b..24107fbd8 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html @@ -447,6 +447,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html index 23fefb2c9..6e568904f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html @@ -221,6 +221,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html index f384397f4..5f3bc3c8c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html @@ -237,28 +237,28 @@
          */
     110  
         public boolean matches(String text) {
    -  111  136
             if (text == null) {
    +  111  38
             if (text == null) {
     112  0
                 return false;
     113  
             }
    -  114  136
             if (this.regex) {
    +  114  38
             if (this.regex) {
     115  
                 Pattern rx;
    -  116  36
                 if (this.caseSensitive) {
    -  117  8
                     rx = Pattern.compile(this.value);
    +  116  12
                 if (this.caseSensitive) {
    +  117  2
                     rx = Pattern.compile(this.value);
     118  
                 } else {
    -  119  28
                     rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE);
    +  119  10
                     rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE);
     120  
                 }
    -  121  36
                 return rx.matcher(text).matches();
    +  121  12
                 return rx.matcher(text).matches();
     122  
             } else {
    -  123  100
                 if (this.caseSensitive) {
    -  124  8
                     return value.equals(text);
    +  123  26
                 if (this.caseSensitive) {
    +  124  2
                     return value.equals(text);
     125  
                 } else {
    -  126  92
                     return value.equalsIgnoreCase(text);
    +  126  24
                     return value.equalsIgnoreCase(text);
     127  
                 }
     128   @@ -308,28 +308,28 @@
         @Override
     153  
         public boolean equals(Object obj) {
    -  154  4
             if (obj == null) {
    +  154  1
             if (obj == null) {
     155  0
                 return false;
     156  
             }
    -  157  4
             if (getClass() != obj.getClass()) {
    +  157  1
             if (getClass() != obj.getClass()) {
     158  0
                 return false;
     159  
             }
    -  160  4
             final PropertyType other = (PropertyType) obj;
    -  161  4
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    +  160  1
             final PropertyType other = (PropertyType) obj;
    +  161  1
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
     162  0
                 return false;
     163  
             }
    -  164  4
             if (this.regex != other.regex) {
    +  164  1
             if (this.regex != other.regex) {
     165  0
                 return false;
     166  
             }
    -  167  4
             if (this.caseSensitive != other.caseSensitive) {
    +  167  1
             if (this.caseSensitive != other.caseSensitive) {
     168  0
                 return false;
     169  
             }
    -  170  4
             return true;
    +  170  1
             return true;
     171  
         }
     172   @@ -357,6 +357,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html index 286fbe4b7..edfe38d04 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html @@ -87,7 +87,7 @@
          * The logger.
     35  
          */
    -  36  4
         private static final Logger LOGGER = Logger.getLogger(SuppressionErrorHandler.class.getName());
    +  36  1
         private static final Logger LOGGER = Logger.getLogger(SuppressionErrorHandler.class.getName());
     37  
     
     38   @@ -197,6 +197,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html index 318b97fb2..2f57e4bee 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    SuppressionHandler
    97%
    40/41
    80%
    21/26
    3.6
    SuppressionHandler
    95%
    43/45
    78%
    22/28
    3.8
     
    @@ -77,7 +77,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     30  
      */
    -  31  36
     public class SuppressionHandler extends DefaultHandler {
    +  31  9
     public class SuppressionHandler extends DefaultHandler {
     32  
     
     33   @@ -150,7 +150,7 @@
          * A list of suppression rules.
     67  
          */
    -  68  36
         private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
    +  68  9
         private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
     69  
     
     70   @@ -217,121 +217,129 @@
         @Override
     101  
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  102  540
             currentAttributes = attributes;
    -  103  540
             currentText = new StringBuffer();
    -  104  540
             if (SUPPRESS.equals(qName)) {
    -  105  120
                 rule = new SuppressionRule();
    -  106   -
             }
    -  107  540
         }
    -  108   -
     
    +  102  195
             currentAttributes = attributes;
    +  103  195
             currentText = new StringBuffer();
    +  104  195
             if (SUPPRESS.equals(qName)) {
    +  105  45
                 rule = new SuppressionRule();
    +  106  45
                 final String base = currentAttributes.getValue("base");
    +  107  45
                 if (base != null) {
    +  108  45
                     rule.setBase(Boolean.parseBoolean(base));
     109   -
         /**
    -  110   -
          * Handles the end element event.
    +
                 } else {
    +  110  0
                     rule.setBase(false);
     111   -
          *
    +
                 }
     112   -
          * @param uri the URI of the element
    -  113   -
          * @param localName the local name of the element
    +
             }
    +  113  195
         }
     114   -
          * @param qName the qName of the element
    +
     
     115   -
          * @throws SAXException thrown if there is an exception processing
    +
         /**
     116   -
          */
    +
          * Handles the end element event.
     117   -
         @Override
    +
          *
     118   -
         public void endElement(String uri, String localName, String qName) throws SAXException {
    -  119  540
             if (SUPPRESS.equals(qName)) {
    -  120  120
                 suppressionRules.add(rule);
    -  121  120
                 rule = null;
    -  122  420
             } else if (FILE_PATH.equals(qName)) {
    -  123  48
                 final PropertyType pt = processPropertyType();
    -  124  48
                 rule.setFilePath(pt);
    -  125  48
             } else if (SHA1.equals(qName)) {
    -  126  16
                 rule.setSha1(currentText.toString());
    -  127  356
             } else if (GAV.equals(qName)) {
    -  128  40
                 final PropertyType pt = processPropertyType();
    -  129  40
                 rule.setGav(pt);
    -  130  40
             } else if (CPE.equals(qName)) {
    -  131  112
                 final PropertyType pt = processPropertyType();
    -  132  112
                 rule.addCpe(pt);
    -  133  112
             } else if (CWE.equals(qName)) {
    -  134  0
                 rule.addCwe(currentText.toString());
    -  135  204
             } else if (CVE.equals(qName)) {
    -  136  32
                 rule.addCve(currentText.toString());
    -  137  172
             } else if (CVSS_BELOW.equals(qName)) {
    -  138  16
                 final float cvss = Float.parseFloat(currentText.toString());
    -  139  16
                 rule.addCvssBelow(cvss);
    -  140   -
             }
    -  141  540
         }
    -  142   -
     
    -  143   -
         /**
    -  144   -
          * Collects the body text of the node being processed.
    -  145   -
          *
    -  146   -
          * @param ch the char array of text
    -  147   -
          * @param start the start position to copy text from in the char array
    -  148   -
          * @param length the number of characters to copy from the char array
    -  149   -
          * @throws SAXException thrown if there is a parsing exception
    -  150   +
          * @param uri the URI of the element
    +  119   +
          * @param localName the local name of the element
    +  120   +
          * @param qName the qName of the element
    +  121   +
          * @throws SAXException thrown if there is an exception processing
    +  122  
          */
    -  151   +  123  
         @Override
    -  152   -
         public void characters(char[] ch, int start, int length) throws SAXException {
    -  153  1184
             currentText.append(ch, start, length);
    -  154  1184
         }
    -  155   -
     
    -  156   -
         /**
    -  157   -
          * Processes field members that have been collected during the characters and startElement method to construct a
    -  158   -
          * PropertyType object.
    -  159   -
          *
    -  160   -
          * @return a PropertyType object
    -  161   -
          */
    -  162   -
         private PropertyType processPropertyType() {
    -  163  200
             final PropertyType pt = new PropertyType();
    -  164  200
             pt.setValue(currentText.toString());
    -  165  200
             if (currentAttributes != null && currentAttributes.getLength() > 0) {
    -  166  200
                 final String regex = currentAttributes.getValue("regex");
    -  167  200
                 if (regex != null) {
    -  168  200
                     pt.setRegex(Boolean.parseBoolean(regex));
    -  169   -
                 }
    -  170  200
                 final String caseSensitive = currentAttributes.getValue("caseSensitive");
    -  171  200
                 if (caseSensitive != null) {
    -  172  200
                     pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
    -  173   -
                 }
    -  174   +  124   +
         public void endElement(String uri, String localName, String qName) throws SAXException {
    +  125  195
             if (SUPPRESS.equals(qName)) {
    +  126  45
                 suppressionRules.add(rule);
    +  127  45
                 rule = null;
    +  128  150
             } else if (FILE_PATH.equals(qName)) {
    +  129  17
                 final PropertyType pt = processPropertyType();
    +  130  17
                 rule.setFilePath(pt);
    +  131  17
             } else if (SHA1.equals(qName)) {
    +  132  4
                 rule.setSha1(currentText.toString());
    +  133  129
             } else if (GAV.equals(qName)) {
    +  134  20
                 final PropertyType pt = processPropertyType();
    +  135  20
                 rule.setGav(pt);
    +  136  20
             } else if (CPE.equals(qName)) {
    +  137  43
                 final PropertyType pt = processPropertyType();
    +  138  43
                 rule.addCpe(pt);
    +  139  43
             } else if (CWE.equals(qName)) {
    +  140  0
                 rule.addCwe(currentText.toString());
    +  141  66
             } else if (CVE.equals(qName)) {
    +  142  8
                 rule.addCve(currentText.toString());
    +  143  58
             } else if (CVSS_BELOW.equals(qName)) {
    +  144  4
                 final float cvss = Float.parseFloat(currentText.toString());
    +  145  4
                 rule.addCvssBelow(cvss);
    +  146  
             }
    -  175  200
             return pt;
    -  176   +  147  195
         }
    +  148   +
     
    +  149   +
         /**
    +  150   +
          * Collects the body text of the node being processed.
    +  151   +
          *
    +  152   +
          * @param ch the char array of text
    +  153   +
          * @param start the start position to copy text from in the char array
    +  154   +
          * @param length the number of characters to copy from the char array
    +  155   +
          * @throws SAXException thrown if there is a parsing exception
    +  156   +
          */
    +  157   +
         @Override
    +  158   +
         public void characters(char[] ch, int start, int length) throws SAXException {
    +  159  431
             currentText.append(ch, start, length);
    +  160  431
         }
    +  161   +
     
    +  162   +
         /**
    +  163   +
          * Processes field members that have been collected during the characters and startElement method to construct a
    +  164   +
          * PropertyType object.
    +  165   +
          *
    +  166   +
          * @return a PropertyType object
    +  167   +
          */
    +  168   +
         private PropertyType processPropertyType() {
    +  169  80
             final PropertyType pt = new PropertyType();
    +  170  80
             pt.setValue(currentText.toString());
    +  171  80
             if (currentAttributes != null && currentAttributes.getLength() > 0) {
    +  172  80
                 final String regex = currentAttributes.getValue("regex");
    +  173  80
                 if (regex != null) {
    +  174  80
                     pt.setRegex(Boolean.parseBoolean(regex));
    +  175   +
                 }
    +  176  80
                 final String caseSensitive = currentAttributes.getValue("caseSensitive");
    +  177  80
                 if (caseSensitive != null) {
    +  178  80
                     pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
    +  179   +
                 }
    +  180   +
             }
    +  181  80
             return pt;
    +  182  
         }
    -  177   +  183  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html index 9c1ccc172..40a671935 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html index c71526dee..80436c4df 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html @@ -109,7 +109,7 @@
          * The logger.
     46  
          */
    -  47  4
         private static final Logger LOGGER = Logger.getLogger(SuppressionParser.class.getName());
    +  47  1
         private static final Logger LOGGER = Logger.getLogger(SuppressionParser.class.getName());
     48  
         /**
     49   @@ -152,23 +152,23 @@
          */
     68  
         public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException {
    -  69  16
             FileInputStream fis = null;
    +  69  4
             FileInputStream fis = null;
     70  
             try {
    -  71  16
                 fis = new FileInputStream(file);
    -  72  12
                 return parseSuppressionRules(fis);
    -  73  4
             } catch (IOException ex) {
    -  74  4
                 LOGGER.log(Level.FINE, null, ex);
    -  75  4
                 throw new SuppressionParseException(ex);
    +  71  4
                 fis = new FileInputStream(file);
    +  72  3
                 return parseSuppressionRules(fis);
    +  73  1
             } catch (IOException ex) {
    +  74  1
                 LOGGER.log(Level.FINE, null, ex);
    +  75  1
                 throw new SuppressionParseException(ex);
     76  
             } finally {
    -  77  16
                 if (fis != null) {
    +  77  4
                 if (fis != null) {
     78  
                     try {
    -  79  12
                         fis.close();
    +  79  3
                         fis.close();
     80  0
                     } catch (IOException ex) {
     81  0
                         LOGGER.log(Level.FINE, "Unable to close stream", ex);
    -  82  28
                     }
    +  82  7
                     }
     83  
                 }
     84   @@ -195,29 +195,29 @@
         public List<SuppressionRule> parseSuppressionRules(InputStream inputStream) throws SuppressionParseException {
     95  
             try {
    -  96  32
                 final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd");
    -  97  32
                 final SuppressionHandler handler = new SuppressionHandler();
    -  98  32
                 final SAXParserFactory factory = SAXParserFactory.newInstance();
    -  99  32
                 factory.setNamespaceAware(true);
    -  100  32
                 factory.setValidating(true);
    -  101  32
                 final SAXParser saxParser = factory.newSAXParser();
    -  102  32
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
    -  103  32
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
    -  104  32
                 final XMLReader xmlReader = saxParser.getXMLReader();
    -  105  32
                 xmlReader.setErrorHandler(new SuppressionErrorHandler());
    -  106  32
                 xmlReader.setContentHandler(handler);
    +  96  8
                 final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd");
    +  97  8
                 final SuppressionHandler handler = new SuppressionHandler();
    +  98  8
                 final SAXParserFactory factory = SAXParserFactory.newInstance();
    +  99  8
                 factory.setNamespaceAware(true);
    +  100  8
                 factory.setValidating(true);
    +  101  8
                 final SAXParser saxParser = factory.newSAXParser();
    +  102  8
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
    +  103  8
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
    +  104  8
                 final XMLReader xmlReader = saxParser.getXMLReader();
    +  105  8
                 xmlReader.setErrorHandler(new SuppressionErrorHandler());
    +  106  8
                 xmlReader.setContentHandler(handler);
     107  
     
    -  108  32
                 final Reader reader = new InputStreamReader(inputStream, "UTF-8");
    -  109  32
                 final InputSource in = new InputSource(reader);
    +  108  8
                 final Reader reader = new InputStreamReader(inputStream, "UTF-8");
    +  109  8
                 final InputSource in = new InputSource(reader);
     110  
                 //in.setEncoding("UTF-8");
     111  
     
    -  112  32
                 xmlReader.parse(in);
    +  112  8
                 xmlReader.parse(in);
     113  
     
    -  114  32
                 return handler.getSuppressionRules();
    +  114  8
                 return handler.getSuppressionRules();
     115  0
             } catch (ParserConfigurationException ex) {
     116  0
                 LOGGER.log(Level.FINE, null, ex);
     117  0
                 throw new SuppressionParseException(ex);
    @@ -238,6 +238,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html index 620f89c80..ff6dd5971 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    SuppressionRule
    70%
    92/130
    66%
    72/108
    3.036
    SuppressionRule
    71%
    94/132
    66%
    75/112
    2.967
     
    @@ -77,7 +77,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     30  
      */
    -  31  176
     public class SuppressionRule {
    +  31  61
     public class SuppressionRule {
     32  
     
     33   @@ -174,7 +174,7 @@
          * A list of CPEs to suppression
     79  
          */
    -  80  176
         private List<PropertyType> cpe = new ArrayList<PropertyType>();
    +  80  61
         private List<PropertyType> cpe = new ArrayList<PropertyType>();
     81  
     
     82   @@ -225,8 +225,8 @@
          */
     105  
         public void addCpe(PropertyType cpe) {
    -  106  140
             this.cpe.add(cpe);
    -  107  140
         }
    +  106  50
             this.cpe.add(cpe);
    +  107  50
         }
     108  
     
     109   @@ -241,7 +241,7 @@
          */
     114  
         public boolean hasCpe() {
    -  115  44
             return cpe.size() > 0;
    +  115  15
             return cpe.size() > 0;
     116  
         }
     117   @@ -250,7 +250,7 @@
          * The list of cvssBelow scores.
     119  
          */
    -  120  176
         private List<Float> cvssBelow = new ArrayList<Float>();
    +  120  61
         private List<Float> cvssBelow = new ArrayList<Float>();
     121  
     
     122   @@ -301,8 +301,8 @@
          */
     145  
         public void addCvssBelow(Float cvss) {
    -  146  28
             this.cvssBelow.add(cvss);
    -  147  28
         }
    +  146  7
             this.cvssBelow.add(cvss);
    +  147  7
         }
     148  
     
     149   @@ -317,7 +317,7 @@
          */
     154  
         public boolean hasCvssBelow() {
    -  155  32
             return cvssBelow.size() > 0;
    +  155  12
             return cvssBelow.size() > 0;
     156  
         }
     157   @@ -326,7 +326,7 @@
          * The list of cwe entries to suppress.
     159  
          */
    -  160  176
         private List<String> cwe = new ArrayList<String>();
    +  160  61
         private List<String> cwe = new ArrayList<String>();
     161  
     
     162   @@ -377,8 +377,8 @@
          */
     185  
         public void addCwe(String cwe) {
    -  186  8
             this.cwe.add(cwe);
    -  187  8
         }
    +  186  2
             this.cwe.add(cwe);
    +  187  2
         }
     188  
     
     189   @@ -393,7 +393,7 @@
          */
     194  
         public boolean hasCwe() {
    -  195  36
             return cwe.size() > 0;
    +  195  13
             return cwe.size() > 0;
     196  
         }
     197   @@ -402,7 +402,7 @@
          * The list of cve entries to suppress.
     199  
          */
    -  200  176
         private List<String> cve = new ArrayList<String>();
    +  200  61
         private List<String> cve = new ArrayList<String>();
     201  
     
     202   @@ -453,8 +453,8 @@
          */
     225  
         public void addCve(String cve) {
    -  226  44
             this.cve.add(cve);
    -  227  44
         }
    +  226  11
             this.cve.add(cve);
    +  227  11
         }
     228  
     
     229   @@ -469,7 +469,7 @@
          */
     234  
         public boolean hasCve() {
    -  235  44
             return cve.size() > 0;
    +  235  15
             return cve.size() > 0;
     236  
         }
     237   @@ -478,7 +478,7 @@
          * A Maven GAV to suppression.
     239  
          */
    -  240  176
         private PropertyType gav = null;
    +  240  61
         private PropertyType gav = null;
     241  
     
     242   @@ -535,272 +535,318 @@  268  
     
     269   -
         /**
    +
         private boolean base;
     270   -
          * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any
    +
     
     271   -
          * should be, they are removed from the dependency.
    +
         /**
     272   -
          *
    +
          * Get the value of base
     273   -
          * @param dependency a project dependency to analyze
    +
          *
     274   -
          */
    +
          * @return the value of base
     275   -
         public void process(Dependency dependency) {
    -  276  72
             if (filePath != null && !filePath.matches(dependency.getFilePath())) {
    -  277  0
                 return;
    +
          */
    +  276   +
         public boolean isBase() {
    +  277   +
             return base;
     278   -
             }
    -  279  72
             if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
    -  280  4
                 return;
    +
         }
    +  279   +
     
    +  280   +
         /**
     281   -
             }
    -  282  68
             if (gav != null) {
    -  283  36
                 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    -  284  36
                 boolean gavFound = false;
    -  285  84
                 while (itr.hasNext()) {
    -  286  52
                     final Identifier i = itr.next();
    -  287  52
                     if (identifierMatches("maven", this.gav, i)) {
    -  288  4
                         gavFound = true;
    -  289  4
                         break;
    +
          * Set the value of base
    +  282   +
          *
    +  283   +
          * @param base new value of base
    +  284   +
          */
    +  285   +
         public void setBase(boolean base) {
    +  286   +
             this.base = base;
    +  287   +
         }
    +  288   +
     
    +  289   +
         /**
     290   -
                     }
    -  291  48
                 }
    -  292  36
                 if (!gavFound) {
    -  293  32
                     return;
    +
          * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any
    +  291   +
          * should be, they are removed from the dependency.
    +  292   +
          *
    +  293   +
          * @param dependency a project dependency to analyze
     294   -
                 }
    +
          */
     295   +
         public void process(Dependency dependency) {
    +  296  30
             if (filePath != null && !filePath.matches(dependency.getFilePath())) {
    +  297  0
                 return;
    +  298  
             }
    -  296   -
     
    -  297  36
             if (this.hasCpe()) {
    -  298  16
                 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    -  299  56
                 while (itr.hasNext()) {
    -  300  40
                     final Identifier i = itr.next();
    -  301  40
                     for (PropertyType c : this.cpe) {
    -  302  84
                         if (identifierMatches("cpe", c, i)) {
    -  303  28
                             dependency.addSuppressedIdentifier(i);
    -  304  28
                             itr.remove();
    -  305  28
                             break;
    -  306   -
                         }
    -  307  56
                     }
    -  308  40
                 }
    -  309   +  299  30
             if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
    +  300  1
                 return;
    +  301  
             }
    -  310  36
             if (hasCve() || hasCwe() || hasCvssBelow()) {
    -  311  20
                 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
    -  312  40
                 while (itr.hasNext()) {
    -  313  20
                     boolean remove = false;
    -  314  20
                     final Vulnerability v = itr.next();
    -  315  20
                     for (String entry : this.cve) {
    -  316  12
                         if (entry.equalsIgnoreCase(v.getName())) {
    -  317  4
                             remove = true;
    -  318  4
                             break;
    -  319   -
                         }
    -  320  8
                     }
    -  321  20
                     if (!remove) {
    -  322  16
                         for (String entry : this.cwe) {
    -  323  4
                             if (v.getCwe() != null) {
    -  324  4
                                 final String toMatch = String.format("CWE-%s ", entry);
    -  325  4
                                 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
    -  326  4
                                 if (toTest.equals(toMatch)) {
    -  327  4
                                     remove = true;
    -  328  4
                                     break;
    -  329   -
                                 }
    -  330   -
                             }
    -  331  0
                         }
    -  332   +  302  29
             if (gav != null) {
    +  303  17
                 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    +  304  17
                 boolean gavFound = false;
    +  305  37
                 while (itr.hasNext()) {
    +  306  21
                     final Identifier i = itr.next();
    +  307  21
                     if (identifierMatches("maven", this.gav, i)) {
    +  308  1
                         gavFound = true;
    +  309  1
                         break;
    +  310  
                     }
    -  333  20
                     if (!remove) {
    -  334  12
                         for (float cvss : this.cvssBelow) {
    -  335  12
                             if (v.getCvssScore() < cvss) {
    -  336  4
                                 remove = true;
    -  337  4
                                 break;
    -  338   -
                             }
    -  339  8
                         }
    -  340   -
                     }
    -  341  20
                     if (remove) {
    -  342  12
                         dependency.addSuppressedVulnerability(v);
    -  343  12
                         itr.remove();
    -  344   -
                     }
    -  345  20
                 }
    -  346   -
             }
    -  347  36
         }
    -  348   -
     
    -  349   -
         /**
    -  350   -
          * Identifies if the cpe specified by the cpe suppression rule does not specify a version.
    -  351   -
          *
    -  352   -
          * @param c a suppression rule identifier
    -  353   -
          * @return true if the property type does not specify a version; otherwise false
    -  354   -
          */
    -  355   -
         boolean cpeHasNoVersion(PropertyType c) {
    -  356  92
             if (c.isRegex()) {
    -  357  8
                 return false;
    -  358   -
             }
    -  359  84
             if (countCharacter(c.getValue(), ':') == 3) {
    -  360  48
                 return true;
    -  361   -
             }
    -  362  36
             return false;
    -  363   -
         }
    -  364   -
     
    -  365   -
         /**
    -  366   -
          * Counts the number of occurrences of the character found within the string.
    -  367   -
          *
    -  368   -
          * @param str the string to check
    -  369   -
          * @param c the character to count
    -  370   -
          * @return the number of times the character is found in the string
    -  371   -
          */
    -  372   -
         int countCharacter(String str, char c) {
    -  373  96
             int count = 0;
    -  374  96
             int pos = str.indexOf(c) + 1;
    -  375  408
             while (pos > 0) {
    -  376  312
                 count += 1;
    -  377  312
                 pos = str.indexOf(c, pos) + 1;
    -  378   -
             }
    -  379  96
             return count;
    -  380   -
         }
    -  381   -
     
    -  382   -
         /**
    -  383   -
          * Determines if the cpeEntry specified as a PropertyType matches the given Identifier.
    -  384   -
          *
    -  385   -
          * @param identifierType the type of identifier ("cpe", "maven", etc.)
    -  386   -
          * @param suppressionEntry a suppression rule entry
    -  387   -
          * @param identifier a CPE identifier to check
    -  388   -
          * @return true if the entry matches; otherwise false
    -  389   -
          */
    -  390   -
         boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) {
    -  391  172
             if (identifierType.equals(identifier.getType())) {
    -  392  112
                 if (suppressionEntry.matches(identifier.getValue())) {
    -  393  28
                     return true;
    -  394  84
                 } else if ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) {
    -  395  44
                     if (suppressionEntry.isCaseSensitive()) {
    -  396  0
                         return identifier.getValue().startsWith(suppressionEntry.getValue());
    -  397   -
                     } else {
    -  398  44
                         final String id = identifier.getValue().toLowerCase();
    -  399  44
                         final String check = suppressionEntry.getValue().toLowerCase();
    -  400  44
                         return id.startsWith(check);
    -  401   -
                     }
    -  402   +  311  20
                 }
    +  312  17
                 if (!gavFound) {
    +  313  16
                     return;
    +  314  
                 }
    -  403   +  315  
             }
    -  404  100
             return false;
    -  405   -
         }
    -  406   +  316  
     
    -  407   +  317  13
             if (this.hasCpe()) {
    +  318  8
                 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    +  319  22
                 while (itr.hasNext()) {
    +  320  14
                     final Identifier i = itr.next();
    +  321  14
                     for (PropertyType c : this.cpe) {
    +  322  22
                         if (identifierMatches("cpe", c, i)) {
    +  323  7
                             if (!isBase()) {
    +  324  4
                                 dependency.addSuppressedIdentifier(i);
    +  325   +
                             }
    +  326  7
                             itr.remove();
    +  327  7
                             break;
    +  328   +
                         }
    +  329  15
                     }
    +  330  14
                 }
    +  331   +
             }
    +  332  13
             if (hasCve() || hasCwe() || hasCvssBelow()) {
    +  333  5
                 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
    +  334  10
                 while (itr.hasNext()) {
    +  335  5
                     boolean remove = false;
    +  336  5
                     final Vulnerability v = itr.next();
    +  337  5
                     for (String entry : this.cve) {
    +  338  3
                         if (entry.equalsIgnoreCase(v.getName())) {
    +  339  1
                             remove = true;
    +  340  1
                             break;
    +  341   +
                         }
    +  342  2
                     }
    +  343  5
                     if (!remove) {
    +  344  4
                         for (String entry : this.cwe) {
    +  345  1
                             if (v.getCwe() != null) {
    +  346  1
                                 final String toMatch = String.format("CWE-%s ", entry);
    +  347  1
                                 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
    +  348  1
                                 if (toTest.equals(toMatch)) {
    +  349  1
                                     remove = true;
    +  350  1
                                     break;
    +  351   +
                                 }
    +  352   +
                             }
    +  353  0
                         }
    +  354   +
                     }
    +  355  5
                     if (!remove) {
    +  356  3
                         for (float cvss : this.cvssBelow) {
    +  357  3
                             if (v.getCvssScore() < cvss) {
    +  358  1
                                 remove = true;
    +  359  1
                                 break;
    +  360   +
                             }
    +  361  2
                         }
    +  362   +
                     }
    +  363  5
                     if (remove) {
    +  364  3
                         if (!isBase()) {
    +  365  3
                             dependency.addSuppressedVulnerability(v);
    +  366   +
                         }
    +  367  3
                         itr.remove();
    +  368   +
                     }
    +  369  5
                 }
    +  370   +
             }
    +  371  13
         }
    +  372   +
     
    +  373  
         /**
    -  408   -
          * Standard toString implementation.
    -  409   +  374   +
          * Identifies if the cpe specified by the cpe suppression rule does not specify a version.
    +  375  
          *
    -  410   -
          * @return a string representation of this object
    -  411   +  376   +
          * @param c a suppression rule identifier
    +  377   +
          * @return true if the property type does not specify a version; otherwise false
    +  378  
          */
    +  379   +
         boolean cpeHasNoVersion(PropertyType c) {
    +  380  26
             if (c.isRegex()) {
    +  381  2
                 return false;
    +  382   +
             }
    +  383  24
             if (countCharacter(c.getValue(), ':') == 3) {
    +  384  18
                 return true;
    +  385   +
             }
    +  386  6
             return false;
    +  387   +
         }
    +  388   +
     
    +  389   +
         /**
    +  390   +
          * Counts the number of occurrences of the character found within the string.
    +  391   +
          *
    +  392   +
          * @param str the string to check
    +  393   +
          * @param c the character to count
    +  394   +
          * @return the number of times the character is found in the string
    +  395   +
          */
    +  396   +
         int countCharacter(String str, char c) {
    +  397  27
             int count = 0;
    +  398  27
             int pos = str.indexOf(c) + 1;
    +  399  111
             while (pos > 0) {
    +  400  84
                 count += 1;
    +  401  84
                 pos = str.indexOf(c, pos) + 1;
    +  402   +
             }
    +  403  27
             return count;
    +  404   +
         }
    +  405   +
     
    +  406   +
         /**
    +  407   +
          * Determines if the cpeEntry specified as a PropertyType matches the given Identifier.
    +  408   +
          *
    +  409   +
          * @param identifierType the type of identifier ("cpe", "maven", etc.)
    +  410   +
          * @param suppressionEntry a suppression rule entry
    +  411   +
          * @param identifier a CPE identifier to check
     412   -
         @Override
    +
          * @return true if the entry matches; otherwise false
     413   -
         public String toString() {
    -  414  0
             final StringBuilder sb = new StringBuilder();
    -  415  0
             sb.append("SuppressionRule{");
    -  416  0
             if (filePath != null) {
    -  417  0
                 sb.append("filePath=").append(filePath).append(",");
    -  418   -
             }
    -  419  0
             if (sha1 != null) {
    -  420  0
                 sb.append("sha1=").append(sha1).append(",");
    +
          */
    +  414   +
         boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) {
    +  415  52
             if (identifierType.equals(identifier.getType())) {
    +  416  29
                 if (suppressionEntry.matches(identifier.getValue())) {
    +  417  5
                     return true;
    +  418  24
                 } else if ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) {
    +  419  17
                     if (suppressionEntry.isCaseSensitive()) {
    +  420  0
                         return identifier.getValue().startsWith(suppressionEntry.getValue());
     421   +
                     } else {
    +  422  17
                         final String id = identifier.getValue().toLowerCase();
    +  423  17
                         final String check = suppressionEntry.getValue().toLowerCase();
    +  424  17
                         return id.startsWith(check);
    +  425   +
                     }
    +  426   +
                 }
    +  427  
             }
    -  422  0
             if (gav != null) {
    -  423  0
                 sb.append("gav=").append(gav).append(",");
    -  424   -
             }
    -  425  0
             if (cpe != null && cpe.size() > 0) {
    -  426  0
                 sb.append("cpe={");
    -  427  0
                 for (PropertyType pt : cpe) {
    -  428  0
                     sb.append(pt).append(",");
    -  429  0
                 }
    -  430  0
                 sb.append("}");
    +  428  30
             return false;
    +  429   +
         }
    +  430   +
     
     431   +
         /**
    +  432   +
          * Standard toString implementation.
    +  433   +
          *
    +  434   +
          * @return a string representation of this object
    +  435   +
          */
    +  436   +
         @Override
    +  437   +
         public String toString() {
    +  438  0
             final StringBuilder sb = new StringBuilder();
    +  439  0
             sb.append("SuppressionRule{");
    +  440  0
             if (filePath != null) {
    +  441  0
                 sb.append("filePath=").append(filePath).append(",");
    +  442  
             }
    -  432  0
             if (cwe != null && cwe.size() > 0) {
    -  433  0
                 sb.append("cwe={");
    -  434  0
                 for (String s : cwe) {
    -  435  0
                     sb.append(s).append(",");
    -  436  0
                 }
    -  437  0
                 sb.append("}");
    -  438   -
             }
    -  439  0
             if (cve != null && cve.size() > 0) {
    -  440  0
                 sb.append("cve={");
    -  441  0
                 for (String s : cve) {
    -  442  0
                     sb.append(s).append(",");
    -  443  0
                 }
    -  444  0
                 sb.append("}");
    +  443  0
             if (sha1 != null) {
    +  444  0
                 sb.append("sha1=").append(sha1).append(",");
     445  
             }
    -  446  0
             if (cvssBelow != null && cvssBelow.size() > 0) {
    -  447  0
                 sb.append("cvssBelow={");
    -  448  0
                 for (Float s : cvssBelow) {
    -  449  0
                     sb.append(s).append(",");
    -  450  0
                 }
    -  451  0
                 sb.append("}");
    -  452   +  446  0
             if (gav != null) {
    +  447  0
                 sb.append("gav=").append(gav).append(",");
    +  448  
             }
    -  453  0
             sb.append("}");
    -  454  0
             return sb.toString();
    +  449  0
             if (cpe != null && cpe.size() > 0) {
    +  450  0
                 sb.append("cpe={");
    +  451  0
                 for (PropertyType pt : cpe) {
    +  452  0
                     sb.append(pt).append(",");
    +  453  0
                 }
    +  454  0
                 sb.append("}");
     455   +
             }
    +  456  0
             if (cwe != null && cwe.size() > 0) {
    +  457  0
                 sb.append("cwe={");
    +  458  0
                 for (String s : cwe) {
    +  459  0
                     sb.append(s).append(",");
    +  460  0
                 }
    +  461  0
                 sb.append("}");
    +  462   +
             }
    +  463  0
             if (cve != null && cve.size() > 0) {
    +  464  0
                 sb.append("cve={");
    +  465  0
                 for (String s : cve) {
    +  466  0
                     sb.append(s).append(",");
    +  467  0
                 }
    +  468  0
                 sb.append("}");
    +  469   +
             }
    +  470  0
             if (cvssBelow != null && cvssBelow.size() > 0) {
    +  471  0
                 sb.append("cvssBelow={");
    +  472  0
                 for (Float s : cvssBelow) {
    +  473  0
                     sb.append(s).append(",");
    +  474  0
                 }
    +  475  0
                 sb.append("}");
    +  476   +
             }
    +  477  0
             sb.append("}");
    +  478  0
             return sb.toString();
    +  479  
         }
    -  456   +  480  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html index 2de3026d6..c2eccb063 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html @@ -89,7 +89,7 @@
          * The logger.
     36  
          */
    -  37  4
         private static final Logger LOGGER = Logger.getLogger(DBUtils.class.getName());
    +  37  1
         private static final Logger LOGGER = Logger.getLogger(DBUtils.class.getName());
     38  
     
     39   @@ -150,16 +150,16 @@
          */
     72  
         public static void closeStatement(Statement statement) {
    -  73  140
             if (statement != null) {
    +  73  33
             if (statement != null) {
     74  
                 try {
    -  75  140
                     statement.close();
    +  75  33
                     statement.close();
     76  0
                 } catch (SQLException ex) {
     77  0
                     LOGGER.log(Level.FINEST, statement.toString(), ex);
    -  78  140
                 }
    +  78  33
                 }
     79  
             }
    -  80  140
         }
    +  80  33
         }
     81  
     
     82   @@ -174,20 +174,20 @@
          */
     87  
         public static void closeResultSet(ResultSet rs) {
    -  88  148
             if (rs != null) {
    +  88  35
             if (rs != null) {
     89  
                 try {
    -  90  148
                     rs.close();
    +  90  35
                     rs.close();
     91  0
                 } catch (SQLException ex) {
     92  0
                     LOGGER.log(Level.FINEST, rs.toString(), ex);
    -  93  148
                 }
    +  93  35
                 }
     94  
             }
    -  95  148
         }
    +  95  35
         }
     96  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html index 6da0e238d..74f8d8e8d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyVersion
    87%
    67/77
    70%
    44/62
    5.091
    DependencyVersion
    87%
    73/83
    73%
    47/64
    5.273
     
    @@ -95,7 +95,7 @@
      * @author Jeremy Long <jeremy.long@owasp.org>
     39  
      */
    -  40  56
     public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
    +  40  14
     public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
     41  
     
     42   @@ -124,9 +124,9 @@
          * @param version the well formatted version number to parse
     54  
          */
    -  55  2896
         public DependencyVersion(String version) {
    -  56  2896
             parseVersion(version);
    -  57  2896
         }
    +  55  402
         public DependencyVersion(String version) {
    +  56  402
             parseVersion(version);
    +  57  402
         }
     58  
     
     59   @@ -143,21 +143,21 @@
          */
     65  
         public final void parseVersion(String version) {
    -  66  2904
             versionParts = new ArrayList<String>();
    -  67  2904
             if (version != null) {
    -  68  2904
                 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)");
    -  69  2904
                 final Matcher matcher = rx.matcher(version.toLowerCase());
    -  70  12212
                 while (matcher.find()) {
    -  71  9308
                     versionParts.add(matcher.group());
    +  66  404
             versionParts = new ArrayList<String>();
    +  67  404
             if (version != null) {
    +  68  404
                 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)");
    +  69  404
                 final Matcher matcher = rx.matcher(version.toLowerCase());
    +  70  1687
                 while (matcher.find()) {
    +  71  1283
                     versionParts.add(matcher.group());
     72  
                 }
    -  73  2904
                 if (versionParts.isEmpty()) {
    -  74  24
                     versionParts.add(version);
    +  73  404
                 if (versionParts.isEmpty()) {
    +  74  4
                     versionParts.add(version);
     75  
                 }
     76  
             }
    -  77  2904
         }
    +  77  404
         }
     78  
         /**
     79   @@ -216,7 +216,7 @@
          */
     106  
         public Iterator iterator() {
    -  107  4
             return versionParts.iterator();
    +  107  1
             return versionParts.iterator();
     108  
         }
     109   @@ -235,7 +235,7 @@
         @Override
     116  
         public String toString() {
    -  117  340
             return StringUtils.join(versionParts.toArray(), ".");
    +  117  83
             return StringUtils.join(versionParts.toArray(), ".");
     118  
         }
     119   @@ -256,30 +256,30 @@
         @Override
     127  
         public boolean equals(Object obj) {
    -  128  2660
             if (obj == null) {
    +  128  353
             if (obj == null) {
     129  0
                 return false;
     130  
             }
    -  131  2660
             if (getClass() != obj.getClass()) {
    +  131  353
             if (getClass() != obj.getClass()) {
     132  0
                 return false;
     133  
             }
    -  134  2660
             final DependencyVersion other = (DependencyVersion) obj;
    -  135  2660
             final int max = (this.versionParts.size() < other.versionParts.size())
    +  134  353
             final DependencyVersion other = (DependencyVersion) obj;
    +  135  353
             final int max = (this.versionParts.size() < other.versionParts.size())
     136  
                     ? this.versionParts.size() : other.versionParts.size();
     137  
             //TODO steal better version of code from compareTo
    -  138  5772
             for (int i = 0; i < max; i++) {
    -  139  5128
                 final String thisPart = this.versionParts.get(i);
    -  140  5128
                 final String otherPart = other.versionParts.get(i);
    -  141  5128
                 if (!thisPart.equals(otherPart)) {
    -  142  2016
                     return false;
    +  138  767
             for (int i = 0; i < max; i++) {
    +  139  678
                 final String thisPart = this.versionParts.get(i);
    +  140  678
                 final String otherPart = other.versionParts.get(i);
    +  141  678
                 if (!thisPart.equals(otherPart)) {
    +  142  264
                     return false;
     143  
                 }
     144  
             }
    -  145  644
             if (this.versionParts.size() > max) {
    +  145  89
             if (this.versionParts.size() > max) {
     146  0
                 for (int i = max; i < this.versionParts.size(); i++) {
     147  0
                     if (!"0".equals(this.versionParts.get(i))) {
     148  0
                         return false;
    @@ -291,10 +291,10 @@
             }
     152  
     
    -  153  644
             if (other.versionParts.size() > max) {
    -  154  516
                 for (int i = max; i < other.versionParts.size(); i++) {
    -  155  516
                     if (!"0".equals(other.versionParts.get(i))) {
    -  156  516
                         return false;
    +  153  89
             if (other.versionParts.size() > max) {
    +  154  65
                 for (int i = max; i < other.versionParts.size(); i++) {
    +  155  65
                     if (!"0".equals(other.versionParts.get(i))) {
    +  156  65
                         return false;
     157  
                     }
     158   @@ -313,7 +313,7 @@
              *  }
     165  
              */
    -  166  128
             return true;
    +  166  24
             return true;
     167  
         }
     168   @@ -332,9 +332,9 @@
         @Override
     175  
         public int hashCode() {
    -  176  4
             int hash = 5;
    -  177  4
             hash = 71 * hash + (this.versionParts != null ? this.versionParts.hashCode() : 0);
    -  178  4
             return hash;
    +  176  1
             int hash = 5;
    +  177  1
             hash = 71 * hash + (this.versionParts != null ? this.versionParts.hashCode() : 0);
    +  178  1
             return hash;
     179  
         }
     180   @@ -355,95 +355,101 @@
          */
     188  
         public boolean matchesAtLeastThreeLevels(DependencyVersion version) {
    -  189  2416
             if (version == null) {
    +  189  304
             if (version == null) {
     190  0
                 return false;
     191  
             }
    -  192   -
     
    -  193  2416
             boolean ret = true;
    -  194  2416
             int max = (this.versionParts.size() < version.versionParts.size())
    +  192  304
             if (Math.abs(this.versionParts.size() - version.versionParts.size()) >= 3) {
    +  193  1
                 return false;
    +  194   +
             }
     195   +
     
    +  196  303
             final int max = (this.versionParts.size() < version.versionParts.size())
    +  197  
                     ? this.versionParts.size() : version.versionParts.size();
    -  196   +  198  
     
    -  197  2416
             if (max > 3) {
    -  198  8
                 max = 3;
    -  199   -
             }
    -  200   -
     
    -  201  5164
             for (int i = 0; i < max; i++) {
    -  202  4644
                 if (this.versionParts.get(i) == null || !this.versionParts.get(i).equals(version.versionParts.get(i))) {
    -  203  1896
                     ret = false;
    -  204  1896
                     break;
    -  205   -
                 }
    -  206   -
             }
    +  199  303
             boolean ret = true;
    +  200  652
             for (int i = 0; i < max; i++) {
    +  201  586
                 String thisVersion = this.versionParts.get(i);
    +  202  586
                 String otherVersion = version.getVersionParts().get(i);
    +  203  586
                 if (i >= 3) {
    +  204  2
                     if (thisVersion.compareToIgnoreCase(otherVersion) >= 0) {
    +  205  1
                         ret = false;
    +  206  1
                         break;
     207   -
     
    -  208  2416
             return ret;
    -  209   -
         }
    -  210   -
     
    +
                     }
    +  208  584
                 } else if (!thisVersion.equals(otherVersion)) {
    +  209  236
                     ret = false;
    +  210  236
                     break;
     211   -
         @Override
    -  212   -
         public int compareTo(DependencyVersion version) {
    -  213  76
             if (version == null) {
    -  214  0
                 return 1;
    -  215   -
             }
    -  216  76
             final List<String> left = this.getVersionParts();
    -  217  76
             final List<String> right = version.getVersionParts();
    -  218  76
             final int max = left.size() < right.size() ? left.size() : right.size();
    -  219   -
     
    -  220  180
             for (int i = 0; i < max; i++) {
    -  221  152
                 final String lStr = left.get(i);
    -  222  152
                 final String rStr = right.get(i);
    -  223  152
                 if (lStr.equals(rStr)) {
    -  224  104
                     continue;
    -  225  
                 }
    -  226   -
                 try {
    -  227  48
                     final int l = Integer.parseInt(lStr);
    -  228  28
                     final int r = Integer.parseInt(rStr);
    -  229  28
                     if (l < r) {
    -  230  20
                         return -1;
    -  231  8
                     } else if (l > r) {
    -  232  8
                         return 1;
    -  233   -
                     }
    -  234  20
                 } catch (NumberFormatException ex) {
    -  235  20
                     final int comp = left.get(i).compareTo(right.get(i));
    -  236  20
                     if (comp < 0) {
    -  237  20
                         return -1;
    -  238  0
                     } else if (comp > 0) {
    -  239  0
                         return 1;
    -  240   -
                     }
    -  241  0
                 }
    -  242   +  212  
             }
    -  243  28
             if (left.size() < right.size()) {
    -  244  12
                 return -1;
    -  245  16
             } else if (left.size() > right.size()) {
    -  246  12
                 return 1;
    -  247   -
             } else {
    -  248  4
                 return 0;
    -  249   -
             }
    -  250   +  213   +
     
    +  214  303
             return ret;
    +  215  
         }
    -  251   +  216   +
     
    +  217   +
         @Override
    +  218   +
         public int compareTo(DependencyVersion version) {
    +  219  19
             if (version == null) {
    +  220  0
                 return 1;
    +  221   +
             }
    +  222  19
             final List<String> left = this.getVersionParts();
    +  223  19
             final List<String> right = version.getVersionParts();
    +  224  19
             final int max = left.size() < right.size() ? left.size() : right.size();
    +  225   +
     
    +  226  45
             for (int i = 0; i < max; i++) {
    +  227  38
                 final String lStr = left.get(i);
    +  228  38
                 final String rStr = right.get(i);
    +  229  38
                 if (lStr.equals(rStr)) {
    +  230  26
                     continue;
    +  231   +
                 }
    +  232   +
                 try {
    +  233  12
                     final int l = Integer.parseInt(lStr);
    +  234  7
                     final int r = Integer.parseInt(rStr);
    +  235  7
                     if (l < r) {
    +  236  5
                         return -1;
    +  237  2
                     } else if (l > r) {
    +  238  2
                         return 1;
    +  239   +
                     }
    +  240  5
                 } catch (NumberFormatException ex) {
    +  241  5
                     final int comp = left.get(i).compareTo(right.get(i));
    +  242  5
                     if (comp < 0) {
    +  243  5
                         return -1;
    +  244  0
                     } else if (comp > 0) {
    +  245  0
                         return 1;
    +  246   +
                     }
    +  247  0
                 }
    +  248   +
             }
    +  249  7
             if (left.size() < right.size()) {
    +  250  3
                 return -1;
    +  251  4
             } else if (left.size() > right.size()) {
    +  252  3
                 return 1;
    +  253   +
             } else {
    +  254  1
                 return 0;
    +  255   +
             }
    +  256   +
         }
    +  257  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html index a681309c8..383d9600d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html @@ -85,7 +85,7 @@
          * Regular expression to extract version numbers from file names.
     34  
          */
    -  35  4
         private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    +  35  1
         private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
     36  
         /**
     37   @@ -94,7 +94,7 @@
          * in case we are missing a version number using the previous regex.
     39  
          */
    -  40  4
         private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    +  40  1
         private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
     41  
     
     42   @@ -131,56 +131,56 @@
          */
     58  
         public static DependencyVersion parseVersion(String text) {
    -  59  2780
             if (text == null) {
    +  59  375
             if (text == null) {
     60  0
                 return null;
     61  
             }
     62  
             //'-' is a special case used within the CVE entries, just include it as the version.
    -  63  2780
             if ("-".equals(text)) {
    -  64  4
                 final DependencyVersion dv = new DependencyVersion();
    -  65  4
                 final ArrayList<String> list = new ArrayList<String>();
    -  66  4
                 list.add(text);
    -  67  4
                 dv.setVersionParts(list);
    -  68  4
                 return dv;
    +  63  375
             if ("-".equals(text)) {
    +  64  1
                 final DependencyVersion dv = new DependencyVersion();
    +  65  1
                 final ArrayList<String> list = new ArrayList<String>();
    +  66  1
                 list.add(text);
    +  67  1
                 dv.setVersionParts(list);
    +  68  1
                 return dv;
     69  
             }
    -  70  2776
             String version = null;
    -  71  2776
             Matcher matcher = RX_VERSION.matcher(text);
    -  72  2776
             if (matcher.find()) {
    -  73  2760
                 version = matcher.group();
    +  70  374
             String version = null;
    +  71  374
             Matcher matcher = RX_VERSION.matcher(text);
    +  72  374
             if (matcher.find()) {
    +  73  370
                 version = matcher.group();
     74  
             }
     75  
             //throw away the results if there are two things that look like version numbers
    -  76  2776
             if (matcher.find()) {
    -  77  8
                 return null;
    +  76  374
             if (matcher.find()) {
    +  77  2
                 return null;
     78  
             }
    -  79  2768
             if (version == null) {
    -  80  16
                 matcher = RX_SINGLE_VERSION.matcher(text);
    -  81  16
                 if (matcher.find()) {
    -  82  8
                     version = matcher.group();
    +  79  372
             if (version == null) {
    +  80  4
                 matcher = RX_SINGLE_VERSION.matcher(text);
    +  81  4
                 if (matcher.find()) {
    +  82  2
                     version = matcher.group();
     83  
                 } else {
    -  84  8
                     return null;
    +  84  2
                     return null;
     85  
                 }
     86  
                 //throw away the results if there are two things that look like version numbers
    -  87  8
                 if (matcher.find()) {
    -  88  4
                     return null;
    +  87  2
                 if (matcher.find()) {
    +  88  1
                     return null;
     89  
                 }
     90  
             }
    -  91  2756
             return new DependencyVersion(version);
    +  91  369
             return new DependencyVersion(version);
     92  
         }
     93  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html index 9aa28de56..2c0e9f017 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html @@ -258,6 +258,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html index 9f547cb9b..64378d995 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html @@ -57,19 +57,19 @@
     
     19  
         public Iterator<T> filter(Iterator<T> iterator) {
    -  20  628
             return new FilterIterator(iterator);
    +  20  78
             return new FilterIterator(iterator);
     21  
         }
     22  
     
     23  
         public Iterable<T> filter(final Iterable<T> iterable) {
    -  24  628
             return new Iterable<T>() {
    +  24  78
             return new Iterable<T>() {
     25  
     
     26  
                 public Iterator<T> iterator() {
    -  27  628
                     return filter(iterable.iterator());
    +  27  78
                     return filter(iterable.iterator());
     28  
                 }
     29   @@ -78,7 +78,7 @@
         }
     31  
     
    -  32  628
         private class FilterIterator implements Iterator<T> {
    +  32  78
         private class FilterIterator implements Iterator<T> {
     33  
     
     34   @@ -87,28 +87,28 @@
             private T next;
     36  
     
    -  37  628
             private FilterIterator(Iterator<T> iterator) {
    -  38  628
                 this.iterator = iterator;
    -  39  628
                 toNext();
    -  40  628
             }
    +  37  78
             private FilterIterator(Iterator<T> iterator) {
    +  38  78
                 this.iterator = iterator;
    +  39  78
                 toNext();
    +  40  78
             }
     41  
     
     42  
             public boolean hasNext() {
    -  43  3824
                 return next != null;
    +  43  359
                 return next != null;
     44  
             }
     45  
     
     46  
             public T next() {
    -  47  3372
                 if (next == null) {
    +  47  309
                 if (next == null) {
     48  0
                     throw new NoSuchElementException();
     49  
                 }
    -  50  3372
                 T returnValue = next;
    -  51  3372
                 toNext();
    -  52  3372
                 return returnValue;
    +  50  309
                 T returnValue = next;
    +  51  309
                 toNext();
    +  52  309
                 return returnValue;
     53  
             }
     54   @@ -122,22 +122,22 @@
     
     59  
             private void toNext() {
    -  60  4000
                 next = null;
    -  61  5620
                 while (iterator.hasNext()) {
    -  62  5160
                     T item = iterator.next();
    -  63  5160
                     if (item != null && passes(item)) {
    -  64  3540
                         next = item;
    -  65  3540
                         break;
    +  60  387
                 next = null;
    +  61  659
                 while (iterator.hasNext()) {
    +  62  608
                     T item = iterator.next();
    +  63  608
                     if (item != null && passes(item)) {
    +  64  336
                         next = item;
    +  65  336
                         break;
     66  
                     }
    -  67  1620
                 }
    -  68  4000
             }
    +  67  272
                 }
    +  68  387
             }
     69  
         }
     70  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html index 7db5463a7..baecdc637 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html @@ -107,11 +107,11 @@
         public void close() {
     45  
             // don't close the stream.
    -  46  4
         }
    +  46  1
         }
     47  
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html index 87fce6fa2..49247e8b3 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html @@ -211,10 +211,10 @@
         @Override
     97  
         public int hashCode() {
    -  98  88752
             int hash = 3;
    -  99  88752
             hash = 53 * hash + (this.left != null ? this.left.hashCode() : 0);
    -  100  88752
             hash = 53 * hash + (this.right != null ? this.right.hashCode() : 0);
    -  101  88752
             return hash;
    +  98  22146
             int hash = 3;
    +  99  22146
             hash = 53 * hash + (this.left != null ? this.left.hashCode() : 0);
    +  100  22146
             hash = 53 * hash + (this.right != null ? this.right.hashCode() : 0);
    +  101  22146
             return hash;
     102  
         }
     103   @@ -259,6 +259,6 @@
     }
    - + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html index 739721f4d..7223e3f0e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html @@ -99,14 +99,14 @@
          * A regular expression to test if a string contains a URL.
     41  
          */
    -  42  4
         private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$", Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
    +  42  1
         private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$", Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
     43  
         /**
     44  
          * A regular expression to test if a string is a URL.
     45  
          */
    -  46  4
         private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE);
    +  46  1
         private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE);
     47  
     
     48   @@ -125,7 +125,7 @@
          */
     55  
         public static boolean containsUrl(String text) {
    -  56  69045
             return CONTAINS_URL_TEST.matcher(text).matches();
    +  56  21961
             return CONTAINS_URL_TEST.matcher(text).matches();
     57  
         }
     58   @@ -144,7 +144,7 @@
          */
     65  
         public static boolean isUrl(String text) {
    -  66  28
             return IS_URL_TEST.matcher(text).matches();
    +  66  7
             return IS_URL_TEST.matcher(text).matches();
     67  
         }
     68   @@ -153,7 +153,7 @@
          * A listing of domain parts that should not be used as evidence. Yes, this is an incomplete list.
     70  
          */
    -  71  4
         private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
    +  71  1
         private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
     72  
                 Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx"));
     73   @@ -188,40 +188,40 @@
          */
     88  
         public static List<String> extractImportantUrlData(String text) throws MalformedURLException {
    -  89  28
             final ArrayList<String> importantParts = new ArrayList<String>();
    -  90  28
             final URL url = new URL(text);
    -  91  28
             final String[] domain = url.getHost().split("\\.");
    +  89  7
             final ArrayList<String> importantParts = new ArrayList<String>();
    +  90  7
             final URL url = new URL(text);
    +  91  7
             final String[] domain = url.getHost().split("\\.");
     92  
             //add the domain except www and the tld.
    -  93  80
             for (int i = 0; i < domain.length - 1; i++) {
    -  94  52
                 final String sub = domain[i];
    -  95  52
                 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
    -  96  48
                     importantParts.add(sub);
    +  93  20
             for (int i = 0; i < domain.length - 1; i++) {
    +  94  13
                 final String sub = domain[i];
    +  95  13
                 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
    +  96  12
                     importantParts.add(sub);
     97  
                 }
     98  
             }
    -  99  28
             final String document = url.getPath();
    -  100  28
             final String[] pathParts = document.split("[\\//]");
    -  101  48
             for (int i = 0; i < pathParts.length - 2; i++) {
    -  102  20
                 if (!pathParts[i].isEmpty()) {
    +  99  7
             final String document = url.getPath();
    +  100  7
             final String[] pathParts = document.split("[\\//]");
    +  101  12
             for (int i = 0; i < pathParts.length - 2; i++) {
    +  102  5
                 if (!pathParts[i].isEmpty()) {
     103  0
                     importantParts.add(pathParts[i]);
     104  
                 }
     105  
             }
    -  106  28
             if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
    -  107  24
                 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$", "");
    -  108  24
                 importantParts.add(fileNameNoExt);
    +  106  7
             if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
    +  107  6
                 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$", "");
    +  108  6
                 importantParts.add(fileNameNoExt);
     109  
             }
    -  110  28
             return importantParts;
    +  110  7
             return importantParts;
     111  
         }
     112  
     }
    - + diff --git a/dependency-check-core/cpd.html b/dependency-check-core/cpd.html index c5945e96a..1d0595d69 100644 --- a/dependency-check-core/cpd.html +++ b/dependency-check-core/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-core - CPD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -248,10 +248,10 @@ Line org\owasp\dependencycheck\analyzer\ArchiveAnalyzer.java -165 +165 org\owasp\dependencycheck\analyzer\JarAnalyzer.java -986 +986
        @Override
    diff --git a/dependency-check-core/dependency-updates-report.html b/dependency-check-core/dependency-updates-report.html
    index 67f2bfce6..72f1c82fb 100644
    --- a/dependency-check-core/dependency-updates-report.html
    +++ b/dependency-check-core/dependency-updates-report.html
    @@ -1,13 +1,13 @@
     
     
     
       
         
         
    -    
    +    
         
         dependency-check-core - Dependency Updates Report
         
    @@ -54,7 +54,7 @@
                     
                         
                                   
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -244,7 +244,7 @@ # of dependencies using the latest version available -9 +8 # of dependencies where the next version available is smaller than an incremental version update @@ -256,11 +256,11 @@ # of dependencies where the next version available is a minor version update -10 +11 # of dependencies where the next version available is a major version update -1 +2

    Dependency Management

    This project does not declare any dependencies in a dependencyManagement section.

    @@ -556,7 +556,7 @@ 1.4.2 - + org.glassfish.main.admingui war 4.0 @@ -565,7 +565,7 @@ war - +4.1 @@ -595,7 +595,7 @@ org.owasp dependency-check-utils -1.2.4 +1.2.5 compile jar @@ -617,6 +617,18 @@ 3.0.0.RELEASE +org.springframework.retry +spring-retry +1.1.0.RELEASE +provided + +jar + + + +1.1.1.RELEASE + + org.springframework.security spring-security-web 3.0.0.RELEASE @@ -627,7 +639,7 @@ 3.0.1.RELEASE - + Status Group Id Artifact Id @@ -645,28 +657,28 @@

    com.google.code.findbugs:annotations

    - + - + - + - + - + - + - + - +
    Status  There is at least one newer incremental version available. Incremental updates are typically passive.
    Group Id com.google.code.findbugs
    Artifact Id annotations
    Current Version 2.0.1
    Scope compile
    Classifier
    Type jar
    Newer versions 2.0.2 Next Incremental
    2.0.3 Latest Incremental
    3.0.0 Next Major
    @@ -719,7 +731,7 @@ jar Newer versions -1.3.173 Next Incremental
    1.3.174
    1.3.175
    1.3.176 Latest Incremental
    1.4.177 Next Minor
    1.4.178
    1.4.179
    1.4.180 Latest Minor
    +1.3.173 Next Incremental
    1.3.174
    1.3.175
    1.3.176 Latest Incremental
    1.4.177 Next Minor
    1.4.178
    1.4.179
    1.4.180
    1.4.181 Latest Minor

    com.hazelcast:hazelcast

    @@ -746,7 +758,7 @@ -
    jar
    Newer versions2.5.1 Next Incremental
    2.6 Next Minor
    2.6.1
    2.6.2
    2.6.3
    2.6.4
    2.6.5
    2.6.6
    2.6.7
    2.6.8
    2.6.9
    3.0-RC1
    3.0-RC2 Latest Minor
    3.0 Next Major
    3.0.1
    3.0.2
    3.0.3
    3.1
    3.1.1
    3.1.2
    3.1.3
    3.1.4
    3.1.5
    3.1.6
    3.1.7
    3.2-RC1
    3.2-RC2
    3.2
    3.2.1
    3.2.2
    3.2.3
    3.2.4
    3.3-RC1
    3.3-RC2
    3.3-EA
    3.3-EA2 Latest Major
    +2.5.1 Next Incremental
    2.6 Next Minor
    2.6.1
    2.6.2
    2.6.3
    2.6.4
    2.6.5
    2.6.6
    2.6.7
    2.6.8
    2.6.9
    3.0-RC1
    3.0-RC2 Latest Minor
    3.0 Next Major
    3.0.1
    3.0.2
    3.0.3
    3.1
    3.1.1
    3.1.2
    3.1.3
    3.1.4
    3.1.5
    3.1.6
    3.1.7
    3.2-RC1
    3.2-RC2
    3.2
    3.2.1
    3.2.2
    3.2.3
    3.2.4
    3.2.5
    3.2.6
    3.3-RC1
    3.3-RC2
    3.3-RC3
    3.3
    3.3-EA
    3.3-EA2 Latest Major

    commons-cli:commons-cli

    @@ -1004,7 +1016,7 @@ -
    jar
    Newer versions4.6.0 Next Minor
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0 Latest Minor
    +4.6.0 Next Minor
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0
    4.10.0 Latest Minor

    org.apache.lucene:lucene-core

    @@ -1031,7 +1043,7 @@ -
    jar
    Newer versions4.6.0 Next Minor
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0 Latest Minor
    +4.6.0 Next Minor
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0
    4.10.0 Latest Minor

    org.apache.lucene:lucene-queryparser

    @@ -1058,7 +1070,7 @@ -
    jar
    Newer versions4.6.0 Next Minor
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0 Latest Minor
    +4.6.0 Next Minor
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0
    4.10.0 Latest Minor

    org.apache.lucene:lucene-test-framework

    @@ -1085,7 +1097,7 @@ -
    jar
    Newer versions4.4.0 Next Minor
    4.5.0
    4.5.1
    4.6.0
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0 Latest Minor
    +4.4.0 Next Minor
    4.5.0
    4.5.1
    4.6.0
    4.6.1
    4.7.0
    4.7.1
    4.7.2
    4.8.0
    4.8.1
    4.9.0
    4.10.0 Latest Minor

    org.apache.maven.scm:maven-scm-provider-cvsexe

    @@ -1247,7 +1259,7 @@
    - + @@ -1265,7 +1277,10 @@ -
    Status No newer versions available.
     There is at least one newer minor version available. Minor updates are sometimes passive.
    Group Id org.glassfish.main.admingui
    Typewar
    +war + +Newer versions +4.1 Next Minor

    org.jsoup:jsoup

    @@ -1334,7 +1349,7 @@ - + @@ -1370,7 +1385,34 @@ -
    dependency-check-utils
    Current Version1.2.4
    1.2.5
    Scope compile
    jar
    Newer versions2.5.6 Next Incremental
    2.5.6.SEC01
    2.5.6.SEC02
    2.5.6.SEC03 Latest Incremental
    3.0.0.RELEASE Next Major
    3.0.1.RELEASE
    3.0.2.RELEASE
    3.0.3.RELEASE
    3.0.4.RELEASE
    3.0.5.RELEASE
    3.0.6.RELEASE
    3.0.7.RELEASE
    3.1.0.RELEASE
    3.1.1.RELEASE
    3.1.2.RELEASE
    3.2.0.RELEASE
    3.2.1.RELEASE
    3.2.2.RELEASE
    3.2.3.RELEASE
    3.2.4.RELEASE
    3.2.5.RELEASE
    3.2.6.RELEASE
    3.2.7.RELEASE
    3.2.8.RELEASE
    3.2.9.RELEASE
    3.2.10.RELEASE
    4.0.0.RELEASE
    4.0.1.RELEASE
    4.0.2.RELEASE
    4.0.3.RELEASE
    4.0.4.RELEASE
    4.0.5.RELEASE
    4.0.6.RELEASE Latest Major
    +2.5.6 Next Incremental
    2.5.6.SEC01
    2.5.6.SEC02
    2.5.6.SEC03 Latest Incremental
    3.0.0.RELEASE Next Major
    3.0.1.RELEASE
    3.0.2.RELEASE
    3.0.3.RELEASE
    3.0.4.RELEASE
    3.0.5.RELEASE
    3.0.6.RELEASE
    3.0.7.RELEASE
    3.1.0.RELEASE
    3.1.1.RELEASE
    3.1.2.RELEASE
    3.2.0.RELEASE
    3.2.1.RELEASE
    3.2.2.RELEASE
    3.2.3.RELEASE
    3.2.4.RELEASE
    3.2.5.RELEASE
    3.2.6.RELEASE
    3.2.7.RELEASE
    3.2.8.RELEASE
    3.2.9.RELEASE
    3.2.10.RELEASE
    3.2.11.RELEASE
    4.0.0.RELEASE
    4.0.1.RELEASE
    4.0.2.RELEASE
    4.0.3.RELEASE
    4.0.4.RELEASE
    4.0.5.RELEASE
    4.0.6.RELEASE
    4.0.7.RELEASE
    4.1.0.RELEASE Latest Major +
    +

    org.springframework.retry:spring-retry

    + + + + + + + + + + + + + + + + + + + + + + + + +
    Status There is at least one newer major version available. Major updates are rarely passive.
    Group Idorg.springframework.retry
    Artifact Idspring-retry
    Current Version1.1.0.RELEASE
    Scopeprovided
    Classifier
    Typejar
    Newer versions1.1.1.RELEASE Next Major

    org.springframework.security:spring-security-web

    @@ -1397,7 +1439,7 @@ -
    jar
    Newer versions3.0.1.RELEASE Next Major
    3.0.2.RELEASE
    3.0.3.RELEASE
    3.0.4.RELEASE
    3.0.5.RELEASE
    3.0.6.RELEASE
    3.0.7.RELEASE
    3.0.8.RELEASE
    3.1.0.RELEASE
    3.1.1.RELEASE
    3.1.2.RELEASE
    3.1.3.RELEASE
    3.1.4.RELEASE
    3.1.5.RELEASE
    3.1.6.RELEASE
    3.2.0.RELEASE
    3.2.1.RELEASE
    3.2.2.RELEASE
    3.2.3.RELEASE
    3.2.4.RELEASE Latest Major
    +3.0.1.RELEASE Next Major
    3.0.2.RELEASE
    3.0.3.RELEASE
    3.0.4.RELEASE
    3.0.5.RELEASE
    3.0.6.RELEASE
    3.0.7.RELEASE
    3.0.8.RELEASE
    3.1.0.RELEASE
    3.1.1.RELEASE
    3.1.2.RELEASE
    3.1.3.RELEASE
    3.1.4.RELEASE
    3.1.5.RELEASE
    3.1.6.RELEASE
    3.1.7.RELEASE
    3.2.0.RELEASE
    3.2.1.RELEASE
    3.2.2.RELEASE
    3.2.3.RELEASE
    3.2.4.RELEASE
    3.2.5.RELEASE Latest Major diff --git a/dependency-check-core/failsafe-report.html b/dependency-check-core/failsafe-report.html index 3f3c96933..01500cf46 100644 --- a/dependency-check-core/failsafe-report.html +++ b/dependency-check-core/failsafe-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -273,7 +273,7 @@ function toggleDisplay(elementId) { 0 0 100% -341.197
    +214.202

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -294,7 +294,7 @@ function toggleDisplay(elementId) { 0 0 100% -10.057 +11.567 org.owasp.dependencycheck 2 @@ -302,7 +302,7 @@ function toggleDisplay(elementId) { 0 0 100% -245.125 +85.85 org.owasp.dependencycheck.analyzer 17 @@ -310,7 +310,7 @@ function toggleDisplay(elementId) { 0 0 100% -50.086 +44.255 org.owasp.dependencycheck.data.update 4 @@ -318,7 +318,7 @@ function toggleDisplay(elementId) { 0 0 100% -22.453 +56.755 org.owasp.dependencycheck.data.nvdcve 8 @@ -326,7 +326,7 @@ function toggleDisplay(elementId) { 0 0 100% -13.476
    +15.775

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.reporting

    @@ -348,7 +348,7 @@ function toggleDisplay(elementId) { 0 0 100% -10.057
    +11.567

    org.owasp.dependencycheck

    @@ -369,7 +369,7 @@ function toggleDisplay(elementId) { -
    0 0 100%245.125
    +85.85

    org.owasp.dependencycheck.analyzer

    @@ -390,7 +390,7 @@ function toggleDisplay(elementId) { - + @@ -399,7 +399,7 @@ function toggleDisplay(elementId) { - + @@ -408,7 +408,7 @@ function toggleDisplay(elementId) { -
    0 0 100%23.561
    28.619
    CPEAnalyzerIntegrationTest0 0 100%20.633
    8.874
    VulnerabilitySuppressionAnalyzerIntegrationTest0 0 100%5.892
    +6.762

    org.owasp.dependencycheck.data.update

    @@ -429,7 +429,7 @@ function toggleDisplay(elementId) { - + @@ -438,7 +438,7 @@ function toggleDisplay(elementId) { -
    0 0 100%11.862
    26.184
    StandardUpdateIntegrationTest0 0 100%10.591
    +30.571

    org.owasp.dependencycheck.data.nvdcve

    @@ -459,7 +459,7 @@ function toggleDisplay(elementId) { - + @@ -468,7 +468,7 @@ function toggleDisplay(elementId) { -
    0 0 100%4.966
    5.355
    DatabasePropertiesIntegrationTest0 0 100%8.51

    +10.42

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -478,15 +478,15 @@ function toggleDisplay(elementId) { testAnalyzeTar -3.68 +6.076 testAnalyzeTgz -10.074 +13.247 testAnalyze -1.528 +1.312 testGetAnalysisPhase @@ -494,23 +494,23 @@ function toggleDisplay(elementId) { testGetName -0 +0.001 testAnalyze_badZip -0.939 +0.641 testInitialize -0 +0.001 testAnalyzeTarGz -7.339 +7.341 testSupportsExtension -0.001 +0 testGetSupportedExtensions @@ -521,15 +521,15 @@ function toggleDisplay(elementId) { testSearchCPE -2.55 +2.74 testDetermineCPE -3.225 +3.227 testDetermineCPE_full -14.858 +2.907 testBuildSearch @@ -540,7 +540,7 @@ function toggleDisplay(elementId) { testAnalyze -5.892 +6.762 testGetAnalysisPhase @@ -555,82 +555,82 @@ function toggleDisplay(elementId) { testOpen -1.941 +2.048 testGetCPEs -1.43 +1.496 testGetVulnerabilities -1.595
    +1.811

    DatabasePropertiesIntegrationTest

    - + - + - + - + -
    testSave2.87
    3.94
    testGetProperty_String_String1.391
    1.547
    testGetProperties1.421
    1.625
    testGetProperty_String1.395
    1.671
    testIsEmpty1.433
    +1.637

    NvdCveUpdaterIntegrationTest

    -
    testUpdate11.862
    +26.184

    StandardUpdateIntegrationTest

    - + - + -
    testOpenDataStores2.505
    3.042
    testUpdatesNeeded6.111
    25.95
    testWithinRange1.975
    +1.579

    EngineIntegrationTest

    - + -
    testScan0.872
    7.952
    testEngine244.253
    +77.898

    ReportGeneratorIntegrationTest

    - + -
    testGenerateXMLReport10.055
    11.567
    testGenerateReport0.002

    +0
    diff --git a/dependency-check-core/findbugs.html b/dependency-check-core/findbugs.html index fddae27ef..84a69745d 100644 --- a/dependency-check-core/findbugs.html +++ b/dependency-check-core/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-core - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -253,7 +253,7 @@ Missing Classes 198 -5 +8 0 0
    @@ -263,24 +263,54 @@ Class Bugs +org.owasp.dependencycheck.Engine +3 + org.owasp.dependencycheck.analyzer.AssemblyAnalyzer 1 - + org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer 2 - -org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer -1
    -
    -

    org.owasp.dependencycheck.analyzer.AssemblyAnalyzer

    - + +
    org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer1
    +
    +

    org.owasp.dependencycheck.Engine

    + + + + + + + + + + + + + + + + + + +
    Bug Category Details Line Priority
    org.owasp.dependencycheck.Engine is Serializable; consider declaring a serialVersionUIDBAD_PRACTICESE_NO_SERIALVERSIONID77-505Medium
    The field org.owasp.dependencycheck.Engine.analyzers is transient but isn't set by deserializationBAD_PRACTICESE_TRANSIENT_FIELD_NOT_RESTOREDNot availableMedium
    The field org.owasp.dependencycheck.Engine.fileTypeAnalyzers is transient but isn't set by deserializationBAD_PRACTICESE_TRANSIENT_FIELD_NOT_RESTOREDNot availableMedium
    +
    +

    org.owasp.dependencycheck.analyzer.AssemblyAnalyzer

    + + + + + + + + @@ -289,34 +319,34 @@

    org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer

    BugCategoryDetailsLinePriority
    org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer() discards result of readLine after checking if it is nonnull STYLE RV_DONT_JUST_NULL_CHECK_READLINE
    - + - + - + - + - +
    Bug Category Details Line Priority
    Possible null pointer dereference of currentVersion on branch that might be infeasible in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency) STYLE NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE145175 Medium
    Possible null pointer dereference of nextVersion on branch that might be infeasible in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency) STYLE NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE145175 Medium

    org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer

    - + - + diff --git a/dependency-check-core/index.html b/dependency-check-core/index.html index 58a3ce421..e5bdb434c 100644 --- a/dependency-check-core/index.html +++ b/dependency-check-core/index.html @@ -1,13 +1,13 @@ - + dependency-check-core - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-core/javancss.html b/dependency-check-core/javancss.html index 3da2752f3..8457915eb 100644 --- a/dependency-check-core/javancss.html +++ b/dependency-check-core/javancss.html @@ -1,13 +1,13 @@ - + dependency-check-core - JavaNCSS Metric Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -259,11 +259,11 @@ - - - - - + + + + + @@ -277,7 +277,7 @@ - + @@ -294,17 +294,17 @@ - - - - + + + + - + @@ -349,11 +349,11 @@ - + - + - + @@ -455,12 +455,12 @@ - - - - - -
    Bug Category Details Line Priority
    Found reliance on default encoding in org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.analyzeFileType(Dependency, Engine): new java.io.FileReader(File) I18N DM_DEFAULT_ENCODING org.owasp.dependencycheck.analyzer 23 17222321901283149652
    22501891278158654
    org.owasp.dependencycheck.jaxb.pom.generated 86org.owasp.dependencycheck.dependency 14 176807811 173 1097 17
    org.owasp.dependencycheck.suppression 653390593695540261379 5 154
    org.owasp.dependencycheck.utils 10 43341348 40 238 6org.owasp.dependencycheck 1 22223224 22127124 645
    48
    org.owasp.dependencycheck.data.cpe 4Multi lines comment
    195135985751504125834862675
    +1361 +8617 +1505 +12585 +495 +2680

    Objects

    [ package ] [ object ] [ method ] [ explanation ]

    @@ -492,10 +492,10 @@ 67 org.owasp.dependencycheck.analyzer.CPEAnalyzer -261 -17 +263 +16 2 -30 +29 org.owasp.dependencycheck.jaxb.pom.generated.Model 217 @@ -527,23 +527,23 @@ 0 22 +org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer +179 +13 +0 +13 + org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory 175 87 0 88 - -org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer -163 -12 -0 -13 org.owasp.dependencycheck.suppression.SuppressionRule -160 -28 +167 +30 0 -29 +31 org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer 157 @@ -605,17 +605,17 @@ 5 39 +org.owasp.dependencycheck.utils.DependencyVersion +98 +11 +0 +11 + org.owasp.dependencycheck.jaxb.pom.generated.Profile 97 24 6 37 - -org.owasp.dependencycheck.utils.DependencyVersion -91 -11 -0 -11 org.owasp.dependencycheck.reporting.ReportGenerator 88 @@ -641,17 +641,17 @@ 4 27 +org.owasp.dependencycheck.suppression.SuppressionHandler +67 +5 +0 +6 + org.owasp.dependencycheck.jaxb.pom.generated.BuildBase 65 16 4 -25 - -org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer -62 -6 -0 -7 +25

    TOP 30 classes containing the most methods.

    @@ -697,17 +697,17 @@ + + + + + + - - - - - - @@ -763,17 +763,17 @@ - - - - - - + + + + + + @@ -817,14 +817,14 @@ - - - + + + - - + + @@ -849,11 +849,11 @@ - - + + - -
    1 36
    org.owasp.dependencycheck.suppression.SuppressionRule16730031
    org.owasp.dependencycheck.jaxb.pom.generated.Build 101 28 5 39
    org.owasp.dependencycheck.suppression.SuppressionRule16028029
    org.owasp.dependencycheck.jaxb.pom.generated.Profile 974 27
    org.owasp.dependencycheck.analyzer.CPEAnalyzer26117230
    org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element 51 17 0 17
    org.owasp.dependencycheck.analyzer.CPEAnalyzer26316229
    org.owasp.dependencycheck.dependency.Identifier 550 14
    org.owasp.dependencycheck.analyzer.ArchiveAnalyzer21112org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer17913 0 13
    org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer163org.owasp.dependencycheck.analyzer.ArchiveAnalyzer211 12 0 13
    Methods average Javadocs average
    40.578,575.0040.768,617.00 0.326.978.16
    +6.98 +8.17

    Methods

    [ package ] [ object ] [ method ] [ explanation ]

    @@ -891,25 +891,35 @@ 25 1 +org.owasp.dependencycheck.analyzer.CPEAnalyzer.determineIdentifiers(Dependency,String,String,Confidence) +60 +23 +1 + org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.initialize() 60 25 1 - + org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer() 55 20 1 - + org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.startElement(String,String,String,Attributes) 55 21 0 - + org.owasp.dependencycheck.data.nvdcve.CveDB.getVulnerability(String) 54 9 1 + +org.owasp.dependencycheck.suppression.SuppressionRule.process(Dependency) +51 +32 +1 org.owasp.dependencycheck.utils.ExtractionUtil.extractFiles(File,File,Engine) 51 @@ -936,16 +946,6 @@ 9 1 -org.owasp.dependencycheck.suppression.SuppressionRule.process(Dependency) -49 -30 -1 - -org.owasp.dependencycheck.analyzer.CPEAnalyzer.determineIdentifiers(Dependency,String,String) -47 -22 -1 - org.owasp.dependencycheck.Engine.analyzeDependencies() 47 14 @@ -1024,9 +1024,9 @@ CCN average Javadocs average -8,575.00 -4.85 -2.35 +8,617.00 +4.87 +2.36 0.97

    Explanations

    diff --git a/dependency-check-core/license.html b/dependency-check-core/license.html index 2806b5f80..8df58a9e6 100644 --- a/dependency-check-core/license.html +++ b/dependency-check-core/license.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-core/plugin-updates-report.html b/dependency-check-core/plugin-updates-report.html index 7d3d5b6d1..11ccb82b7 100644 --- a/dependency-check-core/plugin-updates-report.html +++ b/dependency-check-core/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-core/pmd.html b/dependency-check-core/pmd.html index 13659b907..734676cae 100644 --- a/dependency-check-core/pmd.html +++ b/dependency-check-core/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-core - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -250,10 +250,10 @@ Line These nested if statements could be combined -362365 +362–365 These nested if statements could be combined -376379
    +376–379

    org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

    @@ -262,7 +262,7 @@ -
    Line
    Avoid empty while statements236238
    +236–238

    org/owasp/dependencycheck/analyzer/CPEAnalyzer.java

    @@ -271,34 +271,40 @@ - + - - + + - + -
    Line
    Useless parentheses.222
    219
    These nested if statements could be combined541546
    Avoid unused method parameters such as 'currentConfidence'.495
    These nested if statements could be combined542545
    530–535
    These nested if statements could be combined551554
    +531–534 + +These nested if statements could be combined +540–543

    org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java

    - + - + -
    Violation Line
    These nested if statements could be combined228230
    +228–230

    org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java

    - + + + + -
    Violation Line
    These nested if statements could be combined100–106
    These nested if statements could be combined134154
    +164–184

    org/owasp/dependencycheck/analyzer/JarAnalyzer.java

    @@ -307,7 +313,7 @@ -
    Line
    Useless parentheses.383
    +383

    org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

    @@ -316,7 +322,7 @@ -
    Line
    Avoid unused local variables such as 'extractComments'.113
    +113

    org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java

    @@ -325,7 +331,7 @@ -
    Line
    Useless parentheses.76
    +76

    org/owasp/dependencycheck/data/cpe/IndexEntry.java

    @@ -334,10 +340,10 @@ - + -
    Line
    Useless parentheses.172
    172
    Useless parentheses.175
    +175

    org/owasp/dependencycheck/data/nvdcve/CveDB.java

    @@ -346,7 +352,7 @@ -
    Line
    Useless parentheses.745
    +745

    org/owasp/dependencycheck/data/nvdcve/DriverShim.java

    @@ -355,7 +361,7 @@ -
    Line
    Useless parentheses.192
    +192

    org/owasp/dependencycheck/data/update/StandardUpdate.java

    @@ -364,7 +370,7 @@ -
    Line
    Useless parentheses.118
    +118

    org/owasp/dependencycheck/dependency/Dependency.java

    @@ -373,28 +379,28 @@ - + - + - + - + - + - + - + -
    Line
    Useless parentheses.599
    600
    Useless parentheses.602
    603
    Useless parentheses.605
    606
    Useless parentheses.608
    609
    Useless parentheses.611
    612
    Useless parentheses.614
    615
    Useless parentheses.629
    630
    Useless parentheses.632
    +633

    org/owasp/dependencycheck/dependency/Evidence.java

    @@ -403,7 +409,7 @@ -
    Line
    Useless parentheses.202
    +204

    org/owasp/dependencycheck/dependency/Identifier.java

    @@ -412,10 +418,10 @@ - + -
    Line
    Useless parentheses.175
    177
    Useless parentheses.178
    +180

    org/owasp/dependencycheck/dependency/Reference.java

    @@ -424,13 +430,13 @@ - + - + -
    Line
    Useless parentheses.109
    109
    Useless parentheses.112
    112
    Useless parentheses.115
    +115

    org/owasp/dependencycheck/dependency/Vulnerability.java

    @@ -439,7 +445,7 @@ -
    Line
    Useless parentheses.373
    +373

    org/owasp/dependencycheck/dependency/VulnerableSoftware.java

    @@ -448,13 +454,13 @@ - + - + -
    Line
    Useless parentheses.143
    143
    Useless parentheses.182
    182
    Useless parentheses.187
    +187

    org/owasp/dependencycheck/suppression/PropertyType.java

    @@ -463,7 +469,7 @@ -
    Line
    Useless parentheses.161
    +161

    org/owasp/dependencycheck/utils/DependencyVersion.java

    @@ -472,10 +478,10 @@ - + -
    Line
    Useless parentheses.135
    135
    Useless parentheses.194
    +196 diff --git a/dependency-check-core/project-info.html b/dependency-check-core/project-info.html index a6674fe7a..ad8c05ad6 100644 --- a/dependency-check-core/project-info.html +++ b/dependency-check-core/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-core/project-reports.html b/dependency-check-core/project-reports.html index 665d0f9f0..d5df97f18 100644 --- a/dependency-check-core/project-reports.html +++ b/dependency-check-core/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-core - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-core/project-summary.html b/dependency-check-core/project-summary.html index 3410bb659..4b34e7cfa 100644 --- a/dependency-check-core/project-summary.html +++ b/dependency-check-core/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -203,7 +203,7 @@ dependency-check-core Version -1.2.4 +1.2.5 Type jar diff --git a/dependency-check-core/surefire-report.html b/dependency-check-core/surefire-report.html index 9226be196..784edd865 100644 --- a/dependency-check-core/surefire-report.html +++ b/dependency-check-core/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -268,12 +268,12 @@ function toggleDisplay(elementId) { Success Rate Time -148 +149 0 0 1 -99.324% -22.57
    +99.329% +19.855

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -302,7 +302,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.023 +0 org.owasp.dependencycheck.data.nexus 4 @@ -310,7 +310,7 @@ function toggleDisplay(elementId) { 0 0 100% -3.336 +1.553 org.owasp.dependencycheck.dependency 23 @@ -318,7 +318,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.015 +0.033 org.owasp.dependencycheck.utils 10 @@ -334,7 +334,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.128 +0.349 org.owasp.dependencycheck.analyzer 42 @@ -342,7 +342,7 @@ function toggleDisplay(elementId) { 0 1 97.619% -18.024 +16.787 org.owasp.dependencycheck.data.update 10 @@ -358,15 +358,15 @@ function toggleDisplay(elementId) { 0 0 100% -0 +0.039 org.owasp.dependencycheck.suppression -36 +37 0 0 0 100% -0.002 +0.005 org.owasp.dependencycheck.data.lucene 10 @@ -374,7 +374,7 @@ function toggleDisplay(elementId) { 0 0 100% -1.042 +1.089 org.owasp.dependencycheck.data.cpe 1 @@ -425,7 +425,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.023
    +0

    org.owasp.dependencycheck.data.nexus

    @@ -446,7 +446,7 @@ function toggleDisplay(elementId) { -
    0 0 100%3.336
    +1.553

    org.owasp.dependencycheck.dependency

    @@ -467,7 +467,7 @@ function toggleDisplay(elementId) { - + @@ -536,7 +536,7 @@ function toggleDisplay(elementId) { - + @@ -545,7 +545,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.015
    0.033
    VulnerableSoftwareTest0 0 100%0
    0.121
    NvdCve_2_0_HandlerTest0 0 100%0.128
    +0.228

    org.owasp.dependencycheck.analyzer

    @@ -566,7 +566,7 @@ function toggleDisplay(elementId) { - + @@ -575,7 +575,7 @@ function toggleDisplay(elementId) { - + @@ -584,7 +584,7 @@ function toggleDisplay(elementId) { - + @@ -593,7 +593,7 @@ function toggleDisplay(elementId) { - + @@ -620,7 +620,7 @@ function toggleDisplay(elementId) { - + @@ -629,7 +629,7 @@ function toggleDisplay(elementId) { - + @@ -638,7 +638,7 @@ function toggleDisplay(elementId) { - + @@ -647,7 +647,7 @@ function toggleDisplay(elementId) { - + @@ -707,7 +707,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.045
    0.089
    AbstractSuppressionAnalyzerTest0 0 100%0.831
    0.681
    AnalyzerServiceTest0 0 100%1.229
    0.684
    AssemblyAnalyzerTest0 1 80%1.277
    1.389
    DependencyBundlingAnalyzerTest0 0 100%0.11
    0.004
    HintAnalyzerTest0 0 100%11.319
    12.317
    JarAnalyzerTest0 0 100%3.181
    1.564
    JavaScriptAnalyzerTest0 0 100%0.032
    0.059
    NuspecAnalyzerTest0 0 100%0
    +0.039

    org.owasp.dependencycheck.suppression

    @@ -750,12 +750,12 @@ function toggleDisplay(elementId) { - + -
    SuppressionRuleTest3031 0 0 0 100%0.002
    +0.005

    org.owasp.dependencycheck.data.lucene

    @@ -785,7 +785,7 @@ function toggleDisplay(elementId) { - + @@ -794,7 +794,7 @@ function toggleDisplay(elementId) { - + @@ -803,7 +803,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0
    0.001
    TokenPairConcatenatingFilterTest0 0 100%0.08
    0.141
    UrlTokenizingFilterTest0 0 100%0.962
    +0.947

    org.owasp.dependencycheck.data.cpe

    @@ -834,22 +834,22 @@ function toggleDisplay(elementId) { -
    testNewHashSet0.045
    +0.089

    AbstractSuppressionAnalyzerTest

    - + - + - + @@ -860,18 +860,18 @@ function toggleDisplay(elementId) { -
    testFailureToLocateSuppressionFileAnywhere0.597
    0.524
    testGetRulesFromSuppressionFileFromURL0.184
    0.112
    testGetRulesFromSuppressionFileInClasspath0.05
    0.045
    testGetSupportedExtensions
    testGetAnalyzers1.229
    +0.684

    AssemblyAnalyzerTest

    - + - + - + -
    testGetName0.471
    0.328
    testAnalysis0.241
    0.398
    testWithSettingMono @@ -884,11 +884,11 @@ function toggleDisplay(elementId) {
    testNonexistent0.175
    0.264
    testLog4Net0.39
    +0.399

    DependencyBundlingAnalyzerTest

    @@ -929,7 +929,7 @@ function toggleDisplay(elementId) { - + @@ -952,11 +952,11 @@ function toggleDisplay(elementId) { - + - + @@ -967,30 +967,30 @@ function toggleDisplay(elementId) { - + - + - + - + -
    testAnalyze0.11
    0.004
    testClose
    testAnalyze11.311
    12.3
    testGetAnalysisPhase0.008
    0.017
    testGetName
    testAnalyze0.731
    0.415
    testGetName0.755
    0.28
    testInterpolateString0.65
    0.262
    testSupportsExtension0.584
    0.283
    testGetSupportedExtensions0.461
    +0.324

    JavaScriptAnalyzerTest

    - + @@ -1002,7 +1002,7 @@ function toggleDisplay(elementId) { - + @@ -1073,52 +1073,52 @@ function toggleDisplay(elementId) { -
    testAnalyze0
    0.058
    testClose
    testGetName0.032
    0.001
    testInitialize
    testAppendEscapedLuceneQuery_null0
    +0.001

    TokenPairConcatenatingFilterTest

    - + -
    testClear0.059
    0.131
    testExamples0.021
    +0.01

    UrlTokenizingFilterTest

    - + - + -
    testRandomStrings0.902
    0.92
    testExamples0.006
    0.01
    testEmptyTerm0.054
    +0.017

    NexusSearchTest

    - + - + - + -
    testNullSha11.713
    1.175
    testMalformedSha10.099
    0.071
    testValidSha11.32
    0.155
    testMissingSha10.204
    +0.152

    XPathNuspecParserTest

    @@ -1129,7 +1129,7 @@ function toggleDisplay(elementId) { - + @@ -1160,7 +1160,7 @@ function toggleDisplay(elementId) { -
    testMissingDocument0.023
    0
    testNotNuspec
    testLoad_String_String_multiple_paths0
    +0.039

    NvdCveInfoTest

    @@ -1213,14 +1213,14 @@ function toggleDisplay(elementId) { -
    testParse0
    +0.121

    NvdCve_2_0_HandlerTest

    -
    testParse0.128
    +0.228

    DependencyTest

    @@ -1231,7 +1231,7 @@ function toggleDisplay(elementId) { - + @@ -1239,11 +1239,11 @@ function toggleDisplay(elementId) { - + - + @@ -1303,7 +1303,7 @@ function toggleDisplay(elementId) { -
    testGetSha1sum0.005
    0
    testGetProductEvidence
    testGetActualFilePath0.001
    0
    testSetFileExtension0
    0.001
    testGetIdentifiers
    testSetActualFilePath0.001
    +0.024

    VulnerableSoftwareTest

    @@ -1366,112 +1366,116 @@ function toggleDisplay(elementId) { - + - + - - + + + + + + - + - - + + - - - - - - + + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + +
    testCve0.001
    0
    testCwe 0
    testSha1testBase 0
    testCpeMatches0
    testSha10.001
    testCpeMatches0.001
    testHasCvssBelow 0
    testProcess0
    0.001
    testGetSha1 0
    testProcessGAV0
    testAddCvssBelow0
    testProcessGAV0.001
    testAddCvssBelow0.001
    testFilePath 0
    testGetCvssBelow 0
    testSetFilePath 0
    testGetFilePath 0
    testAddCpe 0
    testAddCve 0
    testAddCwe 0
    testGetCpe 0
    testGetCve 0
    testGetCwe 0
    testHasCpe 0
    testHasCve 0
    testHasCwe 0
    testSetCvssBelow 0
    testSetSha1 0
    testSetCpe 0
    testSetCve 0
    testSetCwe0.001
    0
    testCountCharacter 0
    diff --git a/dependency-check-core/taglist.html b/dependency-check-core/taglist.html index d940585f3..bc7039c63 100644 --- a/dependency-check-core/taglist.html +++ b/dependency-check-core/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-core - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -247,12 +247,12 @@ Tag strings used by tag class Todo Work -21 +22 todo, FIXME

    Each tag is detailed below:

    Todo Work

    -

    Number of occurrences found in the code: 21

    +

    Number of occurrences found in the code: 22

    @@ -267,96 +267,99 @@ - - + + - - + + + + + - - - - - + + + + + - + - + - + - - + + - - - - + - - + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - + + + - +
    org.owasp.dependencycheck.analyzer.ArchiveAnalyzerorg.owasp.dependencycheck.analyzer.CPEAnalyzer Line
    - likely need to change the split... not sure if this will work for CPE with special chars451
    test dojo-war against this. we shold get dojo-toolkit:dojo-toolkit AND dojo-toolkit:toolkit173
    the following isn't quite right is it? need to think about this guessing game a bit more.538
    - likely need to change the split... not sure if this will work for CPE with special chars432
    the following isn't quite right is it? need to think about this guessing game a bit more.527
    org.owasp.dependencycheck.analyzer.CPEAnalyzerIntegrationTest Line
    - yeah, not a very good test as the results are the same with or without weighting...198
    fix this assert Assert.assertEquals(expResult, result.get(0).getName());206
    - yeah, not a very good test as the results are the same with or without weighting...201
    fix this assert Assert.assertEquals(expResult, result.get(0).getName());209
    org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzerTest Line
    review the generated test code and remove the default call to fail. fail("The test case is a prototype."); 62
    org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer Line
    fix the version problem below132
    162
    - can we utilize the pom's groupid and artifactId to filter??? most of these are due to low quality data. Other idea would be to say any CPE found based on LOW confidence evidence should have a different CPE type? (this might be a better solution then just removing the URL for "best-guess" matches).233
    move this startsWith expression to a configuration file?242
    263
    move this to the hint analyzer330
    move this startsWith expression to a configuration file?272
    move this to the hint analyzer360
    org.owasp.dependencycheck.analyzer.JarAnalyzer Line
    remove weighting 712
    change this to a regex? 830
    org.owasp.dependencycheck.analyzer.JavaScriptAnalyzerTest Line
    improve the assertions assertTrue(depJQ6.getEvidence().size() > 0); assertTrue(depJQ10.getEvidence().size() > 0); assertTrue(depJQ10min.getEvidence().size() > 0); 103
    org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer Line
    consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ 36
    org.owasp.dependencycheck.data.lucene.VersionAnalyzer Line
    consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ 36
    org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter Line
    should we also be splitting on dash or underscore? we would need to incorporate the dash or underscore back in... 81
    org.owasp.dependencycheck.data.nvdcve.CveDB Line
    consider utilizing the matchThreeVersion method to get additional results. However, this might also introduce false positives. 755
    org.owasp.dependencycheck.data.update.StandardUpdateIntegrationTest Line
    make this an actual test } 78
    org.owasp.dependencycheck.dependency.EvidenceCollection Line
    consider changing the regex to only compare alpha-numeric (i.e. strip everything else)237
    consider changing the regex to only compare alpha-numeric (i.e. strip everything else)238
    org.owasp.dependencycheck.utils.DependencyVersion Line
    steal better version of code from compareTo 137
    diff --git a/dependency-check-core/xref-test/index.html b/dependency-check-core/xref-test/index.html index 948e76ede..5151839d8 100644 --- a/dependency-check-core/xref-test/index.html +++ b/dependency-check-core/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Core 1.2.4 Reference + Dependency-Check Core 1.2.5 Reference diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html index 09e9e88e1..04d741229 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html @@ -78,10 +78,10 @@ 70 @Test 71 public void testEngine() throws Exception { 72 String testClasses = "target/test-classes"; -73 // boolean autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); -74 // Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +73 boolean autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); +74 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); 75 Engine instance = new Engine(); -76 // Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +76 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); 77 instance.scan(testClasses); 78 assertTrue(instance.getDependencies().size() > 0); 79 instance.analyzeDependencies(); diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html index 9c5bc8915..2f39f1d7c 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html @@ -89,134 +89,137 @@ 81 */ 82 @Test 83 public void testDetermineCPE_full() throws Exception { -84 callDetermineCPE_full("hazelcast-2.5.jar", null); -85 callDetermineCPE_full("spring-context-support-2.5.5.jar", "cpe:/a:vmware:springsource_spring_framework:2.5.5"); -86 callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:/a:vmware:springsource_spring_framework:3.0.0"); -87 callDetermineCPE_full("org.mortbay.jetty.jar", "cpe:/a:mortbay_jetty:jetty:4.2"); -88 callDetermineCPE_full("jaxb-xercesImpl-1.5.jar", null); -89 callDetermineCPE_full("ehcache-core-2.2.0.jar", null); -90 } -91 -92 /** -93 * Test of determineCPE method, of class CPEAnalyzer. -94 * -95 * @throws Exception is thrown when an exception occurs -96 */ -97 public void callDetermineCPE_full(String depName, String expResult) throws Exception { -98 -99 File file = new File(this.getClass().getClassLoader().getResource(depName).getPath()); -100 -101 Dependency dep = new Dependency(file); -102 -103 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); -104 fnAnalyzer.analyze(dep, null); -105 -106 JarAnalyzer jarAnalyzer = new JarAnalyzer(); -107 jarAnalyzer.analyze(dep, null); -108 HintAnalyzer hAnalyzer = new HintAnalyzer(); -109 hAnalyzer.analyze(dep, null); +84 CPEAnalyzer instance = new CPEAnalyzer(); +85 instance.open(); +86 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); +87 JarAnalyzer jarAnalyzer = new JarAnalyzer(); +88 HintAnalyzer hAnalyzer = new HintAnalyzer(); +89 FalsePositiveAnalyzer fp = new FalsePositiveAnalyzer(); +90 +91 try { +92 //callDetermineCPE_full("struts2-core-2.3.16.3.jar", "cpe:/a:apache:struts:2.3.16.3", instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +93 callDetermineCPE_full("hazelcast-2.5.jar", null, instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +94 callDetermineCPE_full("spring-context-support-2.5.5.jar", "cpe:/a:vmware:springsource_spring_framework:2.5.5", instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +95 callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:/a:vmware:springsource_spring_framework:3.0.0", instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +96 callDetermineCPE_full("org.mortbay.jetty.jar", "cpe:/a:mortbay_jetty:jetty:4.2", instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +97 callDetermineCPE_full("jaxb-xercesImpl-1.5.jar", null, instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +98 callDetermineCPE_full("ehcache-core-2.2.0.jar", null, instance, fnAnalyzer, jarAnalyzer, hAnalyzer, fp); +99 } finally { +100 instance.close(); +101 } +102 } +103 +104 /** +105 * Test of determineCPE method, of class CPEAnalyzer. +106 * +107 * @throws Exception is thrown when an exception occurs +108 */ +109 public void callDetermineCPE_full(String depName, String expResult, CPEAnalyzer instance, FileNameAnalyzer fnAnalyzer, JarAnalyzer jarAnalyzer, HintAnalyzer hAnalyzer, FalsePositiveAnalyzer fp) throws Exception { 110 -111 CPEAnalyzer instance = new CPEAnalyzer(); -112 instance.open(); -113 instance.analyze(dep, null); -114 instance.close(); -115 FalsePositiveAnalyzer fp = new FalsePositiveAnalyzer(); -116 fp.analyze(dep, null); -117 -118 if (expResult != null) { -119 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); -120 Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().contains(expIdentifier)); -121 } else { -122 for (Identifier i : dep.getIdentifiers()) { -123 Assert.assertFalse(String.format("%s - found a CPE identifier when should have been none (found '%s')", dep.getFileName(), i.getValue()), "cpe".equals(i.getType())); -124 } -125 } -126 } -127 -128 /** -129 * Test of determineCPE method, of class CPEAnalyzer. -130 * -131 * @throws Exception is thrown when an exception occurs -132 */ -133 @Test -134 public void testDetermineCPE() throws Exception { -135 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -136 //File file = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); -137 Dependency struts = new Dependency(file); -138 -139 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); -140 fnAnalyzer.analyze(struts, null); +111 File file = new File(this.getClass().getClassLoader().getResource(depName).getPath()); +112 +113 Dependency dep = new Dependency(file); +114 +115 fnAnalyzer.analyze(dep, null); +116 jarAnalyzer.analyze(dep, null); +117 hAnalyzer.analyze(dep, null); +118 instance.analyze(dep, null); +119 fp.analyze(dep, null); +120 +121 if (expResult != null) { +122 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); +123 Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().contains(expIdentifier)); +124 } else { +125 for (Identifier i : dep.getIdentifiers()) { +126 Assert.assertFalse(String.format("%s - found a CPE identifier when should have been none (found '%s')", dep.getFileName(), i.getValue()), "cpe".equals(i.getType())); +127 } +128 } +129 } +130 +131 /** +132 * Test of determineCPE method, of class CPEAnalyzer. +133 * +134 * @throws Exception is thrown when an exception occurs +135 */ +136 @Test +137 public void testDetermineCPE() throws Exception { +138 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +139 //File file = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); +140 Dependency struts = new Dependency(file); 141 -142 JarAnalyzer jarAnalyzer = new JarAnalyzer(); -143 jarAnalyzer.analyze(struts, null); +142 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); +143 fnAnalyzer.analyze(struts, null); 144 -145 File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath()); -146 Dependency commonValidator = new Dependency(fileCommonValidator); -147 jarAnalyzer.analyze(commonValidator, null); -148 -149 File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath()); -150 Dependency spring = new Dependency(fileSpring); -151 jarAnalyzer.analyze(spring, null); -152 -153 File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath()); -154 Dependency spring3 = new Dependency(fileSpring3); -155 jarAnalyzer.analyze(spring3, null); -156 -157 CPEAnalyzer instance = new CPEAnalyzer(); -158 instance.open(); -159 instance.determineCPE(commonValidator); -160 instance.determineCPE(struts); -161 instance.determineCPE(spring); -162 instance.determineCPE(spring3); -163 instance.close(); -164 -165 String expResult = "cpe:/a:apache:struts:2.1.2"; -166 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); -167 String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5"; -168 String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0"; -169 -170 for (Identifier i : commonValidator.getIdentifiers()) { -171 Assert.assertFalse("Apache Common Validator - found a CPE identifier?", "cpe".equals(i.getType())); -172 } -173 -174 Assert.assertTrue("Incorrect match size - struts", struts.getIdentifiers().size() >= 1); -175 Assert.assertTrue("Incorrect match - struts", struts.getIdentifiers().contains(expIdentifier)); -176 Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1); -177 -178 //the following two only work if the HintAnalyzer is used. -179 //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); -180 //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); -181 } -182 -183 /** -184 * Test of searchCPE method, of class CPEAnalyzer. -185 * -186 * @throws Exception is thrown when an exception occurs -187 */ -188 @Test -189 public void testSearchCPE() throws Exception { -190 String vendor = "apache software foundation"; -191 String product = "struts 2 core"; -192 String version = "2.1.2"; -193 String expResult = "cpe:/a:apache:struts:2.1.2"; -194 -195 CPEAnalyzer instance = new CPEAnalyzer(); -196 instance.open(); +145 JarAnalyzer jarAnalyzer = new JarAnalyzer(); +146 jarAnalyzer.analyze(struts, null); +147 +148 File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath()); +149 Dependency commonValidator = new Dependency(fileCommonValidator); +150 jarAnalyzer.analyze(commonValidator, null); +151 +152 File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath()); +153 Dependency spring = new Dependency(fileSpring); +154 jarAnalyzer.analyze(spring, null); +155 +156 File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath()); +157 Dependency spring3 = new Dependency(fileSpring3); +158 jarAnalyzer.analyze(spring3, null); +159 +160 CPEAnalyzer instance = new CPEAnalyzer(); +161 instance.open(); +162 instance.determineCPE(commonValidator); +163 instance.determineCPE(struts); +164 instance.determineCPE(spring); +165 instance.determineCPE(spring3); +166 instance.close(); +167 +168 String expResult = "cpe:/a:apache:struts:2.1.2"; +169 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); +170 String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5"; +171 String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0"; +172 +173 for (Identifier i : commonValidator.getIdentifiers()) { +174 Assert.assertFalse("Apache Common Validator - found a CPE identifier?", "cpe".equals(i.getType())); +175 } +176 +177 Assert.assertTrue("Incorrect match size - struts", struts.getIdentifiers().size() >= 1); +178 Assert.assertTrue("Incorrect match - struts", struts.getIdentifiers().contains(expIdentifier)); +179 Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1); +180 +181 //the following two only work if the HintAnalyzer is used. +182 //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); +183 //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); +184 } +185 +186 /** +187 * Test of searchCPE method, of class CPEAnalyzer. +188 * +189 * @throws Exception is thrown when an exception occurs +190 */ +191 @Test +192 public void testSearchCPE() throws Exception { +193 String vendor = "apache software foundation"; +194 String product = "struts 2 core"; +195 String version = "2.1.2"; +196 String expResult = "cpe:/a:apache:struts:2.1.2"; 197 -198 //TODO - yeah, not a very good test as the results are the same with or without weighting... -199 Set<String> productWeightings = new HashSet<String>(1); -200 productWeightings.add("struts2"); -201 -202 Set<String> vendorWeightings = new HashSet<String>(1); -203 vendorWeightings.add("apache"); +198 CPEAnalyzer instance = new CPEAnalyzer(); +199 instance.open(); +200 +201 //TODO - yeah, not a very good test as the results are the same with or without weighting... +202 Set<String> productWeightings = new HashSet<String>(1); +203 productWeightings.add("struts2"); 204 -205 List<IndexEntry> result = instance.searchCPE(vendor, product, productWeightings, vendorWeightings); -206 //TODO fix this assert -207 //Assert.assertEquals(expResult, result.get(0).getName()); -208 -209 instance.close(); -210 } -211 } +205 Set<String> vendorWeightings = new HashSet<String>(1); +206 vendorWeightings.add("apache"); +207 +208 List<IndexEntry> result = instance.searchCPE(vendor, product, productWeightings, vendorWeightings); +209 //TODO fix this assert +210 //Assert.assertEquals(expResult, result.get(0).getName()); +211 +212 instance.close(); +213 } +214 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html index 0eeb35ec3..514ebb8c7 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html index 84f23eba0..e37f7f4ea 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html index 8f1c59b54..590053314 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html index 4aad65411..88291a15a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html index 176e1971b..3d23d6097 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html index 793a599c0..8d2746271 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html index 5bb53a471..53dae718b 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html index e53db23e4..79c4c5b23 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html index facff37c3..6fd716b3a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html index 6dd8b92e2..fe24f2848 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html index e8be882ae..926fe7df8 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html index d0e7dc39a..59e4ba290 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html index 42a1cf9b6..e79892253 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html index e87a1ecc8..6457995d4 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html index ecd33ab31..a135a7e4a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html index 9957ba85f..60a756137 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html index 190d75fe9..5b4319d59 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html index e654db982..337dd64d1 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html index ae20ae5b4..3fc08ba78 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html index 2337e4183..927ec0f2a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html index 22909a61a..22eb6dcce 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html index d7a4c823b..8df6b8874 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html index 1865552c0..480a9e72d 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html index 5a81c3468..68b24947b 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html index 6945c84e7..7e6c8690f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html @@ -96,10 +96,18 @@ 88 89 xmlReader.parse(in); 90 -91 List result = handler.getSuppressionRules(); +91 List<SuppressionRule> result = handler.getSuppressionRules(); 92 assertTrue(result.size() > 3); -93 } -94 } +93 int baseCount = 0; +94 for (SuppressionRule r : result) { +95 if (r.isBase()) { +96 baseCount++; +97 } +98 } +99 assertTrue(baseCount > 0); +100 +101 } +102 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html index 97ad01ec2..8ffb56106 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html @@ -154,387 +154,401 @@ 146 List<String> result = instance.getCve(); 147 assertEquals(cve, result); 148 } -149 //</editor-fold> -150 -151 //<editor-fold defaultstate="collapsed" desc="Ignored duplicate tests, left in, as empty tests, so IDE doesn't re-generate them"> -152 /** -153 * Test of getFilePath method, of class SuppressionRule. -154 */ -155 @Test -156 public void testGetFilePath() { -157 //already tested, this is just left so the IDE doesn't recreate it. -158 } -159 -160 /** -161 * Test of setFilePath method, of class SuppressionRule. -162 */ -163 @Test -164 public void testSetFilePath() { -165 //already tested, this is just left so the IDE doesn't recreate it. -166 } -167 -168 /** -169 * Test of getSha1 method, of class SuppressionRule. -170 */ -171 @Test -172 public void testGetSha1() { -173 //already tested, this is just left so the IDE doesn't recreate it. -174 } -175 -176 /** -177 * Test of setSha1 method, of class SuppressionRule. -178 */ -179 @Test -180 public void testSetSha1() { -181 //already tested, this is just left so the IDE doesn't recreate it. -182 } -183 -184 /** -185 * Test of getCpe method, of class SuppressionRule. -186 */ -187 @Test -188 public void testGetCpe() { -189 //already tested, this is just left so the IDE doesn't recreate it. -190 } -191 -192 /** -193 * Test of setCpe method, of class SuppressionRule. -194 */ -195 @Test -196 public void testSetCpe() { -197 //already tested, this is just left so the IDE doesn't recreate it. -198 } -199 -200 /** -201 * Test of addCpe method, of class SuppressionRule. -202 */ -203 @Test -204 public void testAddCpe() { -205 //already tested, this is just left so the IDE doesn't recreate it. -206 } -207 -208 /** -209 * Test of hasCpe method, of class SuppressionRule. -210 */ -211 @Test -212 public void testHasCpe() { -213 //already tested, this is just left so the IDE doesn't recreate it. -214 } -215 -216 /** -217 * Test of setCvssBelow method, of class SuppressionRule. -218 */ -219 @Test -220 public void testSetCvssBelow() { -221 //already tested, this is just left so the IDE doesn't recreate it. -222 } -223 -224 /** -225 * Test of addCvssBelow method, of class SuppressionRule. -226 */ -227 @Test -228 public void testAddCvssBelow() { -229 //already tested, this is just left so the IDE doesn't recreate it. -230 } -231 -232 /** -233 * Test of hasCvssBelow method, of class SuppressionRule. -234 */ -235 @Test -236 public void testHasCvssBelow() { -237 //already tested, this is just left so the IDE doesn't recreate it. -238 } -239 -240 /** -241 * Test of getCwe method, of class SuppressionRule. -242 */ -243 @Test -244 public void testGetCwe() { -245 //already tested, this is just left so the IDE doesn't recreate it. -246 } -247 -248 /** -249 * Test of setCwe method, of class SuppressionRule. -250 */ -251 @Test -252 public void testSetCwe() { -253 //already tested, this is just left so the IDE doesn't recreate it. -254 } -255 -256 /** -257 * Test of addCwe method, of class SuppressionRule. -258 */ -259 @Test -260 public void testAddCwe() { -261 //already tested, this is just left so the IDE doesn't recreate it. -262 } -263 -264 /** -265 * Test of hasCwe method, of class SuppressionRule. -266 */ -267 @Test -268 public void testHasCwe() { -269 //already tested, this is just left so the IDE doesn't recreate it. -270 } -271 -272 /** -273 * Test of getCve method, of class SuppressionRule. -274 */ -275 @Test -276 public void testGetCve() { -277 //already tested, this is just left so the IDE doesn't recreate it. -278 } -279 -280 /** -281 * Test of setCve method, of class SuppressionRule. -282 */ -283 @Test -284 public void testSetCve() { -285 //already tested, this is just left so the IDE doesn't recreate it. -286 } -287 -288 /** -289 * Test of addCve method, of class SuppressionRule. -290 */ -291 @Test -292 public void testAddCve() { -293 //already tested, this is just left so the IDE doesn't recreate it. -294 } -295 -296 /** -297 * Test of hasCve method, of class SuppressionRule. -298 */ -299 @Test -300 public void testHasCve() { -301 //already tested, this is just left so the IDE doesn't recreate it. -302 } -303 //</editor-fold> -304 -305 /** -306 * Test of cpeHasNoVersion method, of class SuppressionRule. -307 */ -308 @Test -309 public void testCpeHasNoVersion() { -310 PropertyType c = new PropertyType(); -311 c.setValue("cpe:/a:microsoft:.net_framework:4.5"); -312 SuppressionRule instance = new SuppressionRule(); -313 assertFalse(instance.cpeHasNoVersion(c)); -314 c.setValue("cpe:/a:microsoft:.net_framework:"); -315 assertFalse(instance.cpeHasNoVersion(c)); -316 c.setValue("cpe:/a:microsoft:.net_framework"); -317 assertTrue(instance.cpeHasNoVersion(c)); -318 } -319 -320 /** -321 * Test of countCharacter method, of class SuppressionRule. -322 */ -323 @Test -324 public void testCountCharacter() { -325 String str = "cpe:/a:microsoft:.net_framework:4.5"; -326 char c = ':'; -327 SuppressionRule instance = new SuppressionRule(); -328 int expResult = 4; -329 int result = instance.countCharacter(str, c); -330 assertEquals(expResult, result); -331 str = "::"; -332 expResult = 2; -333 result = instance.countCharacter(str, c); -334 assertEquals(expResult, result); -335 str = "these are not the characters you are looking for"; -336 expResult = 0; -337 result = instance.countCharacter(str, c); -338 assertEquals(expResult, result); -339 } -340 -341 /** -342 * Test of identifierMatches method, of class SuppressionRule. -343 */ -344 @Test -345 public void testCpeMatches() { -346 Identifier identifier = new Identifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); -347 -348 PropertyType cpe = new PropertyType(); -349 cpe.setValue("cpe:/a:microsoft:.net_framework:4.5"); -350 -351 SuppressionRule instance = new SuppressionRule(); -352 boolean expResult = true; -353 boolean result = instance.identifierMatches("cpe", cpe, identifier); -354 assertEquals(expResult, result); -355 -356 cpe.setValue("cpe:/a:microsoft:.net_framework:4.0"); -357 expResult = false; -358 result = instance.identifierMatches("cpe", cpe, identifier); -359 assertEquals(expResult, result); -360 -361 cpe.setValue("CPE:/a:microsoft:.net_framework:4.5"); -362 cpe.setCaseSensitive(true); -363 expResult = false; -364 result = instance.identifierMatches("cpe", cpe, identifier); +149 +150 /** +151 * Test of base property, of class SuppressionRule. +152 */ +153 @Test +154 public void testBase() { +155 SuppressionRule instance = new SuppressionRule(); +156 assertFalse(instance.isBase()); +157 instance.setBase(true); +158 assertTrue(instance.isBase()); +159 } +160 //</editor-fold> +161 +162 //<editor-fold defaultstate="collapsed" desc="Ignored duplicate tests, left in, as empty tests, so IDE doesn't re-generate them"> +163 /** +164 * Test of getFilePath method, of class SuppressionRule. +165 */ +166 @Test +167 public void testGetFilePath() { +168 //already tested, this is just left so the IDE doesn't recreate it. +169 } +170 +171 /** +172 * Test of setFilePath method, of class SuppressionRule. +173 */ +174 @Test +175 public void testSetFilePath() { +176 //already tested, this is just left so the IDE doesn't recreate it. +177 } +178 +179 /** +180 * Test of getSha1 method, of class SuppressionRule. +181 */ +182 @Test +183 public void testGetSha1() { +184 //already tested, this is just left so the IDE doesn't recreate it. +185 } +186 +187 /** +188 * Test of setSha1 method, of class SuppressionRule. +189 */ +190 @Test +191 public void testSetSha1() { +192 //already tested, this is just left so the IDE doesn't recreate it. +193 } +194 +195 /** +196 * Test of getCpe method, of class SuppressionRule. +197 */ +198 @Test +199 public void testGetCpe() { +200 //already tested, this is just left so the IDE doesn't recreate it. +201 } +202 +203 /** +204 * Test of setCpe method, of class SuppressionRule. +205 */ +206 @Test +207 public void testSetCpe() { +208 //already tested, this is just left so the IDE doesn't recreate it. +209 } +210 +211 /** +212 * Test of addCpe method, of class SuppressionRule. +213 */ +214 @Test +215 public void testAddCpe() { +216 //already tested, this is just left so the IDE doesn't recreate it. +217 } +218 +219 /** +220 * Test of hasCpe method, of class SuppressionRule. +221 */ +222 @Test +223 public void testHasCpe() { +224 //already tested, this is just left so the IDE doesn't recreate it. +225 } +226 +227 /** +228 * Test of setCvssBelow method, of class SuppressionRule. +229 */ +230 @Test +231 public void testSetCvssBelow() { +232 //already tested, this is just left so the IDE doesn't recreate it. +233 } +234 +235 /** +236 * Test of addCvssBelow method, of class SuppressionRule. +237 */ +238 @Test +239 public void testAddCvssBelow() { +240 //already tested, this is just left so the IDE doesn't recreate it. +241 } +242 +243 /** +244 * Test of hasCvssBelow method, of class SuppressionRule. +245 */ +246 @Test +247 public void testHasCvssBelow() { +248 //already tested, this is just left so the IDE doesn't recreate it. +249 } +250 +251 /** +252 * Test of getCwe method, of class SuppressionRule. +253 */ +254 @Test +255 public void testGetCwe() { +256 //already tested, this is just left so the IDE doesn't recreate it. +257 } +258 +259 /** +260 * Test of setCwe method, of class SuppressionRule. +261 */ +262 @Test +263 public void testSetCwe() { +264 //already tested, this is just left so the IDE doesn't recreate it. +265 } +266 +267 /** +268 * Test of addCwe method, of class SuppressionRule. +269 */ +270 @Test +271 public void testAddCwe() { +272 //already tested, this is just left so the IDE doesn't recreate it. +273 } +274 +275 /** +276 * Test of hasCwe method, of class SuppressionRule. +277 */ +278 @Test +279 public void testHasCwe() { +280 //already tested, this is just left so the IDE doesn't recreate it. +281 } +282 +283 /** +284 * Test of getCve method, of class SuppressionRule. +285 */ +286 @Test +287 public void testGetCve() { +288 //already tested, this is just left so the IDE doesn't recreate it. +289 } +290 +291 /** +292 * Test of setCve method, of class SuppressionRule. +293 */ +294 @Test +295 public void testSetCve() { +296 //already tested, this is just left so the IDE doesn't recreate it. +297 } +298 +299 /** +300 * Test of addCve method, of class SuppressionRule. +301 */ +302 @Test +303 public void testAddCve() { +304 //already tested, this is just left so the IDE doesn't recreate it. +305 } +306 +307 /** +308 * Test of hasCve method, of class SuppressionRule. +309 */ +310 @Test +311 public void testHasCve() { +312 //already tested, this is just left so the IDE doesn't recreate it. +313 } +314 //</editor-fold> +315 +316 /** +317 * Test of cpeHasNoVersion method, of class SuppressionRule. +318 */ +319 @Test +320 public void testCpeHasNoVersion() { +321 PropertyType c = new PropertyType(); +322 c.setValue("cpe:/a:microsoft:.net_framework:4.5"); +323 SuppressionRule instance = new SuppressionRule(); +324 assertFalse(instance.cpeHasNoVersion(c)); +325 c.setValue("cpe:/a:microsoft:.net_framework:"); +326 assertFalse(instance.cpeHasNoVersion(c)); +327 c.setValue("cpe:/a:microsoft:.net_framework"); +328 assertTrue(instance.cpeHasNoVersion(c)); +329 } +330 +331 /** +332 * Test of countCharacter method, of class SuppressionRule. +333 */ +334 @Test +335 public void testCountCharacter() { +336 String str = "cpe:/a:microsoft:.net_framework:4.5"; +337 char c = ':'; +338 SuppressionRule instance = new SuppressionRule(); +339 int expResult = 4; +340 int result = instance.countCharacter(str, c); +341 assertEquals(expResult, result); +342 str = "::"; +343 expResult = 2; +344 result = instance.countCharacter(str, c); +345 assertEquals(expResult, result); +346 str = "these are not the characters you are looking for"; +347 expResult = 0; +348 result = instance.countCharacter(str, c); +349 assertEquals(expResult, result); +350 } +351 +352 /** +353 * Test of identifierMatches method, of class SuppressionRule. +354 */ +355 @Test +356 public void testCpeMatches() { +357 Identifier identifier = new Identifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); +358 +359 PropertyType cpe = new PropertyType(); +360 cpe.setValue("cpe:/a:microsoft:.net_framework:4.5"); +361 +362 SuppressionRule instance = new SuppressionRule(); +363 boolean expResult = true; +364 boolean result = instance.identifierMatches("cpe", cpe, identifier); 365 assertEquals(expResult, result); 366 -367 cpe.setValue("cpe:/a:microsoft:.net_framework"); -368 cpe.setCaseSensitive(false); -369 expResult = true; -370 result = instance.identifierMatches("cpe", cpe, identifier); -371 assertEquals(expResult, result); -372 -373 cpe.setValue("cpe:/a:microsoft:.*"); -374 cpe.setRegex(true); -375 expResult = true; -376 result = instance.identifierMatches("cpe", cpe, identifier); -377 assertEquals(expResult, result); -378 -379 cpe.setValue("CPE:/a:microsoft:.*"); -380 cpe.setRegex(true); -381 cpe.setCaseSensitive(true); -382 expResult = false; -383 result = instance.identifierMatches("cpe", cpe, identifier); -384 assertEquals(expResult, result); -385 -386 cpe.setValue("cpe:/a:apache:.*"); -387 cpe.setRegex(true); -388 cpe.setCaseSensitive(false); -389 expResult = false; -390 result = instance.identifierMatches("cpe", cpe, identifier); -391 assertEquals(expResult, result); -392 -393 identifier = new Identifier("maven", "org.springframework:spring-core:2.5.5", "https://repository.sonatype.org/service/local/artifact/maven/redirect?r=central-proxy&g=org.springframework&a=spring-core&v=2.5.5&e=jar"); -394 cpe.setValue("org.springframework:spring-core:2.5.5"); -395 cpe.setRegex(false); -396 cpe.setCaseSensitive(false); -397 expResult = true; -398 result = instance.identifierMatches("maven", cpe, identifier); -399 assertEquals(expResult, result); -400 -401 cpe.setValue("org\\.springframework\\.security:spring.*"); -402 cpe.setRegex(true); -403 cpe.setCaseSensitive(false); -404 expResult = false; -405 result = instance.identifierMatches("maven", cpe, identifier); -406 assertEquals(expResult, result); -407 } -408 -409 /** -410 * Test of process method, of class SuppressionRule. -411 */ -412 @Test -413 public void testProcess() { -414 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -415 Dependency dependency = new Dependency(struts); -416 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); -417 String sha1 = dependency.getSha1sum(); -418 dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970"); -419 Vulnerability v = createVulnerability(); -420 dependency.addVulnerability(v); -421 -422 //cwe -423 SuppressionRule instance = new SuppressionRule(); -424 instance.setSha1(sha1); -425 instance.addCwe("287"); -426 instance.process(dependency); -427 assertTrue(dependency.getVulnerabilities().size() == 1); -428 dependency.setSha1sum(sha1); -429 instance.process(dependency); -430 assertTrue(dependency.getVulnerabilities().isEmpty()); -431 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1); +367 cpe.setValue("cpe:/a:microsoft:.net_framework:4.0"); +368 expResult = false; +369 result = instance.identifierMatches("cpe", cpe, identifier); +370 assertEquals(expResult, result); +371 +372 cpe.setValue("CPE:/a:microsoft:.net_framework:4.5"); +373 cpe.setCaseSensitive(true); +374 expResult = false; +375 result = instance.identifierMatches("cpe", cpe, identifier); +376 assertEquals(expResult, result); +377 +378 cpe.setValue("cpe:/a:microsoft:.net_framework"); +379 cpe.setCaseSensitive(false); +380 expResult = true; +381 result = instance.identifierMatches("cpe", cpe, identifier); +382 assertEquals(expResult, result); +383 +384 cpe.setValue("cpe:/a:microsoft:.*"); +385 cpe.setRegex(true); +386 expResult = true; +387 result = instance.identifierMatches("cpe", cpe, identifier); +388 assertEquals(expResult, result); +389 +390 cpe.setValue("CPE:/a:microsoft:.*"); +391 cpe.setRegex(true); +392 cpe.setCaseSensitive(true); +393 expResult = false; +394 result = instance.identifierMatches("cpe", cpe, identifier); +395 assertEquals(expResult, result); +396 +397 cpe.setValue("cpe:/a:apache:.*"); +398 cpe.setRegex(true); +399 cpe.setCaseSensitive(false); +400 expResult = false; +401 result = instance.identifierMatches("cpe", cpe, identifier); +402 assertEquals(expResult, result); +403 +404 identifier = new Identifier("maven", "org.springframework:spring-core:2.5.5", "https://repository.sonatype.org/service/local/artifact/maven/redirect?r=central-proxy&g=org.springframework&a=spring-core&v=2.5.5&e=jar"); +405 cpe.setValue("org.springframework:spring-core:2.5.5"); +406 cpe.setRegex(false); +407 cpe.setCaseSensitive(false); +408 expResult = true; +409 result = instance.identifierMatches("maven", cpe, identifier); +410 assertEquals(expResult, result); +411 +412 cpe.setValue("org\\.springframework\\.security:spring.*"); +413 cpe.setRegex(true); +414 cpe.setCaseSensitive(false); +415 expResult = false; +416 result = instance.identifierMatches("maven", cpe, identifier); +417 assertEquals(expResult, result); +418 } +419 +420 /** +421 * Test of process method, of class SuppressionRule. +422 */ +423 @Test +424 public void testProcess() { +425 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +426 Dependency dependency = new Dependency(struts); +427 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); +428 String sha1 = dependency.getSha1sum(); +429 dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970"); +430 Vulnerability v = createVulnerability(); +431 dependency.addVulnerability(v); 432 -433 //cvss -434 dependency.addVulnerability(v); -435 instance = new SuppressionRule(); -436 instance.addCvssBelow(5f); +433 //cwe +434 SuppressionRule instance = new SuppressionRule(); +435 instance.setSha1(sha1); +436 instance.addCwe("287"); 437 instance.process(dependency); -438 assertTrue(dependency.getVulnerabilities().size() == 1); -439 instance.addCvssBelow(8f); +438 assertEquals(1, dependency.getVulnerabilities().size()); +439 dependency.setSha1sum(sha1); 440 instance.process(dependency); 441 assertTrue(dependency.getVulnerabilities().isEmpty()); -442 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1); +442 assertEquals(1, dependency.getSuppressedVulnerabilities().size()); 443 -444 //cve +444 //cvss 445 dependency.addVulnerability(v); 446 instance = new SuppressionRule(); -447 instance.addCve("CVE-2012-1337"); +447 instance.addCvssBelow(5f); 448 instance.process(dependency); -449 assertTrue(dependency.getVulnerabilities().size() == 1); -450 instance.addCve("CVE-2013-1337"); +449 assertEquals(1, dependency.getVulnerabilities().size()); +450 instance.addCvssBelow(8f); 451 instance.process(dependency); 452 assertTrue(dependency.getVulnerabilities().isEmpty()); -453 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1); +453 assertEquals(1, dependency.getSuppressedVulnerabilities().size()); 454 -455 //cpe -456 instance = new SuppressionRule(); -457 PropertyType pt = new PropertyType(); -458 pt.setValue("cpe:/a:microsoft:.net_framework:4.0"); -459 instance.addCpe(pt); -460 instance.process(dependency); -461 assertTrue(dependency.getIdentifiers().size() == 1); -462 pt = new PropertyType(); -463 pt.setValue("cpe:/a:microsoft:.net_framework:4.5"); -464 instance.addCpe(pt); -465 pt = new PropertyType(); -466 pt.setValue(".*"); -467 pt.setRegex(true); -468 instance.setFilePath(pt); -469 instance.process(dependency); -470 assertTrue(dependency.getIdentifiers().isEmpty()); -471 assertTrue(dependency.getSuppressedIdentifiers().size() == 1); -472 -473 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.0", "some url not needed for this test"); -474 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); -475 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:5.0", "some url not needed for this test"); +455 //cve +456 dependency.addVulnerability(v); +457 instance = new SuppressionRule(); +458 instance.addCve("CVE-2012-1337"); +459 instance.process(dependency); +460 assertEquals(1, dependency.getVulnerabilities().size()); +461 instance.addCve("CVE-2013-1337"); +462 instance.process(dependency); +463 assertTrue(dependency.getVulnerabilities().isEmpty()); +464 assertEquals(1, dependency.getSuppressedVulnerabilities().size()); +465 +466 //cpe +467 instance = new SuppressionRule(); +468 PropertyType pt = new PropertyType(); +469 pt.setValue("cpe:/a:microsoft:.net_framework:4.0"); +470 instance.addCpe(pt); +471 instance.process(dependency); +472 assertTrue(dependency.getIdentifiers().size() == 1); +473 pt = new PropertyType(); +474 pt.setValue("cpe:/a:microsoft:.net_framework:4.5"); +475 instance.addCpe(pt); 476 pt = new PropertyType(); -477 pt.setValue("cpe:/a:microsoft:.net_framework"); -478 instance.addCpe(pt); -479 assertTrue(dependency.getIdentifiers().size() == 3); +477 pt.setValue(".*"); +478 pt.setRegex(true); +479 instance.setFilePath(pt); 480 instance.process(dependency); 481 assertTrue(dependency.getIdentifiers().isEmpty()); -482 assertTrue(dependency.getSuppressedIdentifiers().size() == 3); -483 } -484 -485 /** -486 * Test of process method, of class SuppressionRule. -487 */ -488 @Test -489 public void testProcessGAV() { -490 File spring = new File(this.getClass().getClassLoader().getResource("spring-security-web-3.0.0.RELEASE.jar").getPath()); -491 Dependency dependency = new Dependency(spring); -492 dependency.addIdentifier("cpe", "cpe:/a:vmware:springsource_spring_framework:3.0.0", "some url not needed for this test"); -493 dependency.addIdentifier("cpe", "cpe:/a:springsource:spring_framework:3.0.0", "some url not needed for this test"); -494 dependency.addIdentifier("cpe", "cpe:/a:mod_security:mod_security:3.0.0", "some url not needed for this test"); -495 dependency.addIdentifier("cpe", "cpe:/a:vmware:springsource_spring_security:3.0.0", "some url not needed for this test"); -496 dependency.addIdentifier("maven", "org.springframework.security:spring-security-web:3.0.0.RELEASE", "some url not needed for this test"); -497 -498 //cpe -499 SuppressionRule instance = new SuppressionRule(); -500 PropertyType pt = new PropertyType(); -501 -502 pt.setValue("org\\.springframework\\.security:spring.*"); -503 pt.setRegex(true); -504 pt.setCaseSensitive(false); -505 instance.setGav(pt); -506 -507 pt = new PropertyType(); -508 pt.setValue("cpe:/a:mod_security:mod_security"); -509 instance.addCpe(pt); -510 pt = new PropertyType(); -511 pt.setValue("cpe:/a:springsource:spring_framework"); -512 instance.addCpe(pt); -513 pt = new PropertyType(); -514 pt.setValue("cpe:/a:vmware:springsource_spring_framework"); -515 instance.addCpe(pt); -516 -517 instance.process(dependency); -518 assertEquals(2, dependency.getIdentifiers().size()); -519 -520 } -521 -522 private Vulnerability createVulnerability() { -523 Vulnerability v = new Vulnerability(); -524 v.setCwe("CWE-287 Improper Authentication"); -525 v.setName("CVE-2013-1337"); -526 v.setCvssScore(7.5f); -527 return v; -528 } -529 } +482 assertEquals(1, dependency.getSuppressedIdentifiers().size()); +483 +484 instance = new SuppressionRule(); +485 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.0", "some url not needed for this test"); +486 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); +487 dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:5.0", "some url not needed for this test"); +488 pt = new PropertyType(); +489 pt.setValue("cpe:/a:microsoft:.net_framework"); +490 instance.addCpe(pt); +491 instance.setBase(true); +492 assertEquals(3, dependency.getIdentifiers().size()); +493 assertEquals(1, dependency.getSuppressedIdentifiers().size()); +494 instance.process(dependency); +495 assertTrue(dependency.getIdentifiers().isEmpty()); +496 assertEquals(1, dependency.getSuppressedIdentifiers().size()); +497 } +498 +499 /** +500 * Test of process method, of class SuppressionRule. +501 */ +502 @Test +503 public void testProcessGAV() { +504 File spring = new File(this.getClass().getClassLoader().getResource("spring-security-web-3.0.0.RELEASE.jar").getPath()); +505 Dependency dependency = new Dependency(spring); +506 dependency.addIdentifier("cpe", "cpe:/a:vmware:springsource_spring_framework:3.0.0", "some url not needed for this test"); +507 dependency.addIdentifier("cpe", "cpe:/a:springsource:spring_framework:3.0.0", "some url not needed for this test"); +508 dependency.addIdentifier("cpe", "cpe:/a:mod_security:mod_security:3.0.0", "some url not needed for this test"); +509 dependency.addIdentifier("cpe", "cpe:/a:vmware:springsource_spring_security:3.0.0", "some url not needed for this test"); +510 dependency.addIdentifier("maven", "org.springframework.security:spring-security-web:3.0.0.RELEASE", "some url not needed for this test"); +511 +512 //cpe +513 SuppressionRule instance = new SuppressionRule(); +514 PropertyType pt = new PropertyType(); +515 +516 pt.setValue("org\\.springframework\\.security:spring.*"); +517 pt.setRegex(true); +518 pt.setCaseSensitive(false); +519 instance.setGav(pt); +520 +521 pt = new PropertyType(); +522 pt.setValue("cpe:/a:mod_security:mod_security"); +523 instance.addCpe(pt); +524 pt = new PropertyType(); +525 pt.setValue("cpe:/a:springsource:spring_framework"); +526 instance.addCpe(pt); +527 pt = new PropertyType(); +528 pt.setValue("cpe:/a:vmware:springsource_spring_framework"); +529 instance.addCpe(pt); +530 +531 instance.process(dependency); +532 assertEquals(2, dependency.getIdentifiers().size()); +533 +534 } +535 +536 private Vulnerability createVulnerability() { +537 Vulnerability v = new Vulnerability(); +538 v.setCwe("CWE-287 Improper Authentication"); +539 v.setName("CVE-2013-1337"); +540 v.setCvssScore(7.5f); +541 return v; +542 } +543 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html index 21e5e20a0..094e59d01 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html index 675568f20..3f8ca7a60 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html index a8635bdc1..9842c1845 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html @@ -142,14 +142,14 @@ 134 @Test 135 public void testMatchesAtLeastThreeLevels() { 136 -137 DependencyVersion instance = new DependencyVersion("1.2.3.4"); -138 DependencyVersion version = new DependencyVersion("1.2.3.5"); +137 DependencyVersion instance = new DependencyVersion("2.3.16.3"); +138 DependencyVersion version = new DependencyVersion("2.3.16.4"); 139 //true tests 140 assertEquals(true, instance.matchesAtLeastThreeLevels(version)); -141 version = new DependencyVersion("1.2"); +141 version = new DependencyVersion("2.3"); 142 assertEquals(true, instance.matchesAtLeastThreeLevels(version)); 143 //false tests -144 version = new DependencyVersion("1.2.2.5"); +144 version = new DependencyVersion("2.3.16.1"); 145 assertEquals(false, instance.matchesAtLeastThreeLevels(version)); 146 version = new DependencyVersion("2"); 147 assertEquals(false, instance.matchesAtLeastThreeLevels(version)); diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html index 1183519b1..2f4cfd696 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html index 3ba51b601..3c02ba0a8 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref-test/overview-frame.html b/dependency-check-core/xref-test/overview-frame.html index f62ecbeb4..b3a9b883b 100644 --- a/dependency-check-core/xref-test/overview-frame.html +++ b/dependency-check-core/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference + Dependency-Check Core 1.2.5 Reference diff --git a/dependency-check-core/xref-test/overview-summary.html b/dependency-check-core/xref-test/overview-summary.html index 5c6f28d07..d1af66637 100644 --- a/dependency-check-core/xref-test/overview-summary.html +++ b/dependency-check-core/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference + Dependency-Check Core 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Core 1.2.4 Reference

    +

    Dependency-Check Core 1.2.5 Reference

    diff --git a/dependency-check-core/xref/index.html b/dependency-check-core/xref/index.html index 948e76ede..5151839d8 100644 --- a/dependency-check-core/xref/index.html +++ b/dependency-check-core/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Core 1.2.4 Reference + Dependency-Check Core 1.2.5 Reference diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html index 3a81192bf..4d4039934 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html @@ -26,491 +26,492 @@ 18package org.owasp.dependencycheck; 1920import java.io.File; -21import java.util.ArrayList; -22import java.util.EnumMap; -23import java.util.HashSet; -24import java.util.Iterator; -25import java.util.List; -26import java.util.Set; -27import java.util.logging.Level; -28import java.util.logging.Logger; -29import org.owasp.dependencycheck.analyzer.AnalysisPhase; -30import org.owasp.dependencycheck.analyzer.Analyzer; -31import org.owasp.dependencycheck.analyzer.AnalyzerService; -32import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer; -33import org.owasp.dependencycheck.analyzer.exception.AnalysisException; -34import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; -35import org.owasp.dependencycheck.data.cpe.IndexException; -36import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory; -37import org.owasp.dependencycheck.data.nvdcve.CveDB; -38import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -39import org.owasp.dependencycheck.data.update.CachedWebDataSource; -40import org.owasp.dependencycheck.data.update.UpdateService; -41import org.owasp.dependencycheck.data.update.exception.UpdateException; -42import org.owasp.dependencycheck.dependency.Dependency; -43import org.owasp.dependencycheck.exception.NoDataException; -44import org.owasp.dependencycheck.utils.FileUtils; -45import org.owasp.dependencycheck.utils.InvalidSettingException; -46import org.owasp.dependencycheck.utils.Settings; -47 -48/** -49 * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the -50 * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a -51 * dependency. -52 * -53 * @author Jeremy Long <jeremy.long@owasp.org> -54 */ -55publicclassEngine { -56 -57/** -58 * The list of dependencies. -59 */ -60private List<Dependency> dependencies; -61/** -62 * A Map of analyzers grouped by Analysis phase. -63 */ -64privatefinal EnumMap<AnalysisPhase, List<Analyzer>> analyzers; -65/** -66 * A Map of analyzers grouped by Analysis phase. -67 */ -68privatefinal Set<FileTypeAnalyzer> fileTypeAnalyzers; -69/** -70 * The ClassLoader to use when dynamically loading Analyzer and Update services. -71 */ -72private ClassLoader serviceClassLoader; -73/** -74 * The Logger for use throughout the class. -75 */ -76privatestaticfinal Logger LOGGER = Logger.getLogger(Engine.class.getName()); -77 -78/** -79 * Creates a new Engine. -80 * -81 * @throws DatabaseException thrown if there is an error connecting to the database -82 */ -83publicEngine() throws DatabaseException { -84this(Thread.currentThread().getContextClassLoader()); -85 } -86 -87/** -88 * Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services. -89 * -90 * @param serviceClassLoader the ClassLoader to use when dynamically loading Analyzer and Update services -91 * @throws DatabaseException thrown if there is an error connecting to the database -92 */ -93publicEngine(ClassLoader serviceClassLoader) throws DatabaseException { -94this.dependencies = new ArrayList<Dependency>(); -95this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class); -96this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>(); -97this.serviceClassLoader = serviceClassLoader; -98 -99 ConnectionFactory.initialize(); -100 -101boolean autoUpdate = true; -102try { -103 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); -104 } catch (InvalidSettingException ex) { -105 LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true."); -106 } -107if (autoUpdate) { -108 doUpdates(); -109 } -110 loadAnalyzers(); -111 } -112 -113/** -114 * Properly cleans up resources allocated during analysis. -115 */ -116publicvoid cleanup() { -117 ConnectionFactory.cleanup(); -118 } -119 -120/** -121 * Loads the analyzers specified in the configuration file (or system properties). -122 */ -123privatevoid loadAnalyzers() { -124 -125for (AnalysisPhase phase : AnalysisPhase.values()) { -126 analyzers.put(phase, new ArrayList<Analyzer>()); -127 } -128 -129finalAnalyzerService service = newAnalyzerService(serviceClassLoader); -130final Iterator<Analyzer> iterator = service.getAnalyzers(); -131while (iterator.hasNext()) { -132finalAnalyzer a = iterator.next(); -133 analyzers.get(a.getAnalysisPhase()).add(a); -134if (a instanceof FileTypeAnalyzer) { -135this.fileTypeAnalyzers.add((FileTypeAnalyzer) a); -136 } -137 } -138 } -139 -140/** -141 * Get the List of the analyzers for a specific phase of analysis. -142 * -143 * @param phase the phase to get the configured analyzers. -144 * @return the analyzers loaded -145 */ -146public List<Analyzer> getAnalyzers(AnalysisPhase phase) { -147return analyzers.get(phase); -148 } -149 -150/** -151 * Get the dependencies identified. -152 * -153 * @return the dependencies identified -154 */ -155public List<Dependency> getDependencies() { -156return dependencies; -157 } -158 -159publicvoid setDependencies(List<Dependency> dependencies) { -160this.dependencies = dependencies; -161//for (Dependency dependency: dependencies) { -162// dependencies.add(dependency); -163//} -164 } -165 -166/** -167 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any -168 * dependencies identified are added to the dependency collection. -169 * -170 * @since v0.3.2.5 -171 * -172 * @param paths an array of paths to files or directories to be analyzed. -173 */ -174publicvoid scan(String[] paths) { -175for (String path : paths) { -176final File file = new File(path); -177 scan(file); -178 } -179 } -180 -181/** -182 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies -183 * identified are added to the dependency collection. -184 * -185 * @param path the path to a file or directory to be analyzed. -186 */ -187publicvoid scan(String path) { -188if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$")) { -189final String[] parts = path.split("\\*\\."); -190final String[] ext = new String[]{parts[parts.length - 1]}; -191final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2)); -192if (dir.isDirectory()) { -193final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true); -194 scan(files); -195 } else { -196final String msg = String.format("Invalid file path provided to scan '%s'", path); -197 LOGGER.log(Level.SEVERE, msg); -198 } -199 } else { -200final File file = new File(path); -201 scan(file); -202 } -203 } -204 -205/** -206 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any -207 * dependencies identified are added to the dependency collection. -208 * -209 * @since v0.3.2.5 -210 * -211 * @param files an array of paths to files or directories to be analyzed. -212 */ -213publicvoid scan(File[] files) { -214for (File file : files) { -215 scan(file); -216 } -217 } -218 -219/** -220 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any -221 * dependencies identified are added to the dependency collection. -222 * -223 * @since v0.3.2.5 -224 * -225 * @param files a set of paths to files or directories to be analyzed. -226 */ -227publicvoid scan(Set<File> files) { -228for (File file : files) { -229 scan(file); -230 } -231 } -232 -233/** -234 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any -235 * dependencies identified are added to the dependency collection. -236 * -237 * @since v0.3.2.5 -238 * -239 * @param files a set of paths to files or directories to be analyzed. -240 */ -241publicvoid scan(List<File> files) { -242for (File file : files) { -243 scan(file); -244 } -245 } -246 -247/** -248 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies -249 * identified are added to the dependency collection. -250 * -251 * @since v0.3.2.4 -252 * -253 * @param file the path to a file or directory to be analyzed. -254 */ -255publicvoid scan(File file) { -256if (file.exists()) { -257if (file.isDirectory()) { -258 scanDirectory(file); -259 } else { -260 scanFile(file); -261 } -262 } -263 } -264 -265/** -266 * Recursively scans files and directories. Any dependencies identified are added to the dependency collection. -267 * -268 * @param dir the directory to scan. -269 */ -270protectedvoid scanDirectory(File dir) { -271final File[] files = dir.listFiles(); -272if (files != null) { -273for (File f : files) { -274if (f.isDirectory()) { -275 scanDirectory(f); -276 } else { -277 scanFile(f); -278 } -279 } -280 } -281 } -282 -283/** -284 * Scans a specified file. If a dependency is identified it is added to the dependency collection. -285 * -286 * @param file The file to scan. -287 */ -288protectedvoid scanFile(File file) { -289if (!file.isFile()) { -290final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString()); -291 LOGGER.log(Level.FINE, msg); -292return; -293 } -294final String fileName = file.getName(); -295final String extension = FileUtils.getFileExtension(fileName); -296if (extension != null) { -297if (supportsExtension(extension)) { -298finalDependency dependency = newDependency(file); -299 dependencies.add(dependency); -300 } -301 } else { -302final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.", -303 file.toString()); -304 LOGGER.log(Level.FINEST, msg); -305 } -306 } -307 -308/** -309 * Runs the analyzers against all of the dependencies. -310 */ -311publicvoid analyzeDependencies() { -312//need to ensure that data exists -313try { -314 ensureDataExists(); -315 } catch (NoDataException ex) { -316final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); -317 LOGGER.log(Level.SEVERE, msg); -318 LOGGER.log(Level.FINE, null, ex); -319return; -320 } catch (DatabaseException ex) { -321final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); -322 LOGGER.log(Level.SEVERE, msg); -323 LOGGER.log(Level.FINE, null, ex); -324return; -325 -326 } -327 -328final String logHeader = String.format("%n" -329 + "----------------------------------------------------%n" -330 + "BEGIN ANALYSIS%n" -331 + "----------------------------------------------------"); -332 LOGGER.log(Level.FINE, logHeader); -333 LOGGER.log(Level.INFO, "Analysis Starting"); -334 -335// analysis phases -336for (AnalysisPhase phase : AnalysisPhase.values()) { -337final List<Analyzer> analyzerList = analyzers.get(phase); -338 -339for (Analyzer a : analyzerList) { -340 initializeAnalyzer(a); -341 -342/* need to create a copy of the collection because some of the -343 * analyzers may modify it. This prevents ConcurrentModificationExceptions. -344 * This is okay for adds/deletes because it happens per analyzer. -345 */ -346final String msg = String.format("Begin Analyzer '%s'", a.getName()); -347 LOGGER.log(Level.FINE, msg); -348final Set<Dependency> dependencySet = new HashSet<Dependency>(); -349 dependencySet.addAll(dependencies); -350for (Dependency d : dependencySet) { -351boolean shouldAnalyze = true; -352if (a instanceof FileTypeAnalyzer) { -353finalFileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a; -354 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension()); -355 } -356if (shouldAnalyze) { -357final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath()); -358 LOGGER.log(Level.FINE, msgFile); -359try { -360 a.analyze(d, this); -361 } catch (AnalysisException ex) { -362final String exMsg = String.format("An error occurred while analyzing '%s'.", d.getActualFilePath()); -363 LOGGER.log(Level.WARNING, exMsg); -364 LOGGER.log(Level.FINE, "", ex); -365 } catch (Throwable ex) { -366final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath()); -367//final AnalysisException ax = new AnalysisException(axMsg, ex); -368 LOGGER.log(Level.WARNING, axMsg); -369 LOGGER.log(Level.FINE, "", ex); -370 } -371 } -372 } -373 } -374 } -375for (AnalysisPhase phase : AnalysisPhase.values()) { -376final List<Analyzer> analyzerList = analyzers.get(phase); -377 -378for (Analyzer a : analyzerList) { -379 closeAnalyzer(a); -380 } -381 } -382 -383final String logFooter = String.format("%n" -384 + "----------------------------------------------------%n" -385 + "END ANALYSIS%n" -386 + "----------------------------------------------------"); -387 LOGGER.log(Level.FINE, logFooter); -388 LOGGER.log(Level.INFO, "Analysis Complete"); -389 } -390 -391/** -392 * Initializes the given analyzer. -393 * -394 * @param analyzer the analyzer to initialize -395 */ -396privatevoid initializeAnalyzer(Analyzer analyzer) { -397try { -398final String msg = String.format("Initializing %s", analyzer.getName()); -399 LOGGER.log(Level.FINE, msg); -400 analyzer.initialize(); -401 } catch (Throwable ex) { -402final String msg = String.format("Exception occurred initializing %s.", analyzer.getName()); -403 LOGGER.log(Level.SEVERE, msg); -404 LOGGER.log(Level.FINE, null, ex); -405try { -406 analyzer.close(); -407 } catch (Throwable ex1) { -408 LOGGER.log(Level.FINEST, null, ex1); -409 } -410 } -411 } -412 -413/** -414 * Closes the given analyzer. -415 * -416 * @param analyzer the analyzer to close -417 */ -418privatevoid closeAnalyzer(Analyzer analyzer) { -419final String msg = String.format("Closing Analyzer '%s'", analyzer.getName()); -420 LOGGER.log(Level.FINE, msg); -421try { -422 analyzer.close(); -423 } catch (Throwable ex) { -424 LOGGER.log(Level.FINEST, null, ex); -425 } -426 } -427 -428/** -429 * Cycles through the cached web data sources and calls update on all of them. -430 */ -431privatevoid doUpdates() { -432finalUpdateService service = newUpdateService(serviceClassLoader); -433final Iterator<CachedWebDataSource> iterator = service.getDataSources(); -434while (iterator.hasNext()) { -435finalCachedWebDataSource source = iterator.next(); -436try { -437 source.update(); -438 } catch (UpdateException ex) { -439 LOGGER.log(Level.WARNING, -440"Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities."); -441 LOGGER.log(Level.FINE, -442 String.format("Unable to update details for %s", source.getClass().getName()), ex); -443 } -444 } -445 } -446 -447/** -448 * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used. -449 * -450 * @return a list of Analyzers -451 */ -452public List<Analyzer> getAnalyzers() { -453final List<Analyzer> ret = new ArrayList<Analyzer>(); -454for (AnalysisPhase phase : AnalysisPhase.values()) { -455final List<Analyzer> analyzerList = analyzers.get(phase); -456 ret.addAll(analyzerList); -457 } -458return ret; -459 } -460 -461/** -462 * Checks all analyzers to see if an extension is supported. -463 * -464 * @param ext a file extension -465 * @return true or false depending on whether or not the file extension is supported -466 */ -467publicboolean supportsExtension(String ext) { -468if (ext == null) { -469return false; -470 } -471boolean scan = false; -472for (FileTypeAnalyzer a : this.fileTypeAnalyzers) { -473/* note, we can't break early on this loop as the analyzers need to know if -474 they have files to work on prior to initialization */ -475 scan |= a.supportsExtension(ext); -476 } -477return scan; -478 } -479 -480/** -481 * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown. -482 * -483 * @throws NoDataException thrown if no data exists in the CPE Index -484 * @throws DatabaseException thrown if there is an exception opening the database -485 */ -486privatevoid ensureDataExists() throws NoDataException, DatabaseException { -487finalCpeMemoryIndex cpe = CpeMemoryIndex.getInstance(); -488finalCveDB cve = newCveDB(); -489 -490try { -491 cve.open(); -492 cpe.open(cve); -493 } catch (IndexException ex) { -494thrownewNoDataException(ex.getMessage(), ex); -495 } catch (DatabaseException ex) { -496thrownewNoDataException(ex.getMessage(), ex); -497 } finally { -498 cve.close(); -499 } -500if (cpe.numDocs() <= 0) { -501 cpe.close(); -502thrownewNoDataException("No documents exist"); -503 } -504 } -505 } +21import java.io.Serializable; +22import java.util.ArrayList; +23import java.util.EnumMap; +24import java.util.HashSet; +25import java.util.Iterator; +26import java.util.List; +27import java.util.Set; +28import java.util.logging.Level; +29import java.util.logging.Logger; +30import org.owasp.dependencycheck.analyzer.AnalysisPhase; +31import org.owasp.dependencycheck.analyzer.Analyzer; +32import org.owasp.dependencycheck.analyzer.AnalyzerService; +33import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer; +34import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +35import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; +36import org.owasp.dependencycheck.data.cpe.IndexException; +37import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory; +38import org.owasp.dependencycheck.data.nvdcve.CveDB; +39import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +40import org.owasp.dependencycheck.data.update.CachedWebDataSource; +41import org.owasp.dependencycheck.data.update.UpdateService; +42import org.owasp.dependencycheck.data.update.exception.UpdateException; +43import org.owasp.dependencycheck.dependency.Dependency; +44import org.owasp.dependencycheck.exception.NoDataException; +45import org.owasp.dependencycheck.utils.FileUtils; +46import org.owasp.dependencycheck.utils.InvalidSettingException; +47import org.owasp.dependencycheck.utils.Settings; +48 +49/** +50 * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the +51 * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a +52 * dependency. +53 * +54 * @author Jeremy Long <jeremy.long@owasp.org> +55 */ +56publicclassEngineimplements Serializable { +57 +58/** +59 * The list of dependencies. +60 */ +61private List<Dependency> dependencies; +62/** +63 * A Map of analyzers grouped by Analysis phase. +64 */ +65privatetransientfinal EnumMap<AnalysisPhase, List<Analyzer>> analyzers; +66/** +67 * A Map of analyzers grouped by Analysis phase. +68 */ +69privatetransientfinal Set<FileTypeAnalyzer> fileTypeAnalyzers; +70/** +71 * The ClassLoader to use when dynamically loading Analyzer and Update services. +72 */ +73privatetransient ClassLoader serviceClassLoader; +74/** +75 * The Logger for use throughout the class. +76 */ +77privatetransientstaticfinal Logger LOGGER = Logger.getLogger(Engine.class.getName()); +78 +79/** +80 * Creates a new Engine. +81 * +82 * @throws DatabaseException thrown if there is an error connecting to the database +83 */ +84publicEngine() throws DatabaseException { +85this(Thread.currentThread().getContextClassLoader()); +86 } +87 +88/** +89 * Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services. +90 * +91 * @param serviceClassLoader the ClassLoader to use when dynamically loading Analyzer and Update services +92 * @throws DatabaseException thrown if there is an error connecting to the database +93 */ +94publicEngine(ClassLoader serviceClassLoader) throws DatabaseException { +95this.dependencies = new ArrayList<Dependency>(); +96this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class); +97this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>(); +98this.serviceClassLoader = serviceClassLoader; +99 +100 ConnectionFactory.initialize(); +101 +102boolean autoUpdate = true; +103try { +104 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); +105 } catch (InvalidSettingException ex) { +106 LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true."); +107 } +108if (autoUpdate) { +109 doUpdates(); +110 } +111 loadAnalyzers(); +112 } +113 +114/** +115 * Properly cleans up resources allocated during analysis. +116 */ +117publicvoid cleanup() { +118 ConnectionFactory.cleanup(); +119 } +120 +121/** +122 * Loads the analyzers specified in the configuration file (or system properties). +123 */ +124privatevoid loadAnalyzers() { +125 +126for (AnalysisPhase phase : AnalysisPhase.values()) { +127 analyzers.put(phase, new ArrayList<Analyzer>()); +128 } +129 +130finalAnalyzerService service = newAnalyzerService(serviceClassLoader); +131final Iterator<Analyzer> iterator = service.getAnalyzers(); +132while (iterator.hasNext()) { +133finalAnalyzer a = iterator.next(); +134 analyzers.get(a.getAnalysisPhase()).add(a); +135if (a instanceof FileTypeAnalyzer) { +136this.fileTypeAnalyzers.add((FileTypeAnalyzer) a); +137 } +138 } +139 } +140 +141/** +142 * Get the List of the analyzers for a specific phase of analysis. +143 * +144 * @param phase the phase to get the configured analyzers. +145 * @return the analyzers loaded +146 */ +147public List<Analyzer> getAnalyzers(AnalysisPhase phase) { +148return analyzers.get(phase); +149 } +150 +151/** +152 * Get the dependencies identified. +153 * +154 * @return the dependencies identified +155 */ +156public List<Dependency> getDependencies() { +157return dependencies; +158 } +159 +160publicvoid setDependencies(List<Dependency> dependencies) { +161this.dependencies = dependencies; +162//for (Dependency dependency: dependencies) { +163// dependencies.add(dependency); +164//} +165 } +166 +167/** +168 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any +169 * dependencies identified are added to the dependency collection. +170 * +171 * @since v0.3.2.5 +172 * +173 * @param paths an array of paths to files or directories to be analyzed. +174 */ +175publicvoid scan(String[] paths) { +176for (String path : paths) { +177final File file = new File(path); +178 scan(file); +179 } +180 } +181 +182/** +183 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies +184 * identified are added to the dependency collection. +185 * +186 * @param path the path to a file or directory to be analyzed. +187 */ +188publicvoid scan(String path) { +189if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$")) { +190final String[] parts = path.split("\\*\\."); +191final String[] ext = new String[]{parts[parts.length - 1]}; +192final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2)); +193if (dir.isDirectory()) { +194final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true); +195 scan(files); +196 } else { +197final String msg = String.format("Invalid file path provided to scan '%s'", path); +198 LOGGER.log(Level.SEVERE, msg); +199 } +200 } else { +201final File file = new File(path); +202 scan(file); +203 } +204 } +205 +206/** +207 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any +208 * dependencies identified are added to the dependency collection. +209 * +210 * @since v0.3.2.5 +211 * +212 * @param files an array of paths to files or directories to be analyzed. +213 */ +214publicvoid scan(File[] files) { +215for (File file : files) { +216 scan(file); +217 } +218 } +219 +220/** +221 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any +222 * dependencies identified are added to the dependency collection. +223 * +224 * @since v0.3.2.5 +225 * +226 * @param files a set of paths to files or directories to be analyzed. +227 */ +228publicvoid scan(Set<File> files) { +229for (File file : files) { +230 scan(file); +231 } +232 } +233 +234/** +235 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any +236 * dependencies identified are added to the dependency collection. +237 * +238 * @since v0.3.2.5 +239 * +240 * @param files a set of paths to files or directories to be analyzed. +241 */ +242publicvoid scan(List<File> files) { +243for (File file : files) { +244 scan(file); +245 } +246 } +247 +248/** +249 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies +250 * identified are added to the dependency collection. +251 * +252 * @since v0.3.2.4 +253 * +254 * @param file the path to a file or directory to be analyzed. +255 */ +256publicvoid scan(File file) { +257if (file.exists()) { +258if (file.isDirectory()) { +259 scanDirectory(file); +260 } else { +261 scanFile(file); +262 } +263 } +264 } +265 +266/** +267 * Recursively scans files and directories. Any dependencies identified are added to the dependency collection. +268 * +269 * @param dir the directory to scan. +270 */ +271protectedvoid scanDirectory(File dir) { +272final File[] files = dir.listFiles(); +273if (files != null) { +274for (File f : files) { +275if (f.isDirectory()) { +276 scanDirectory(f); +277 } else { +278 scanFile(f); +279 } +280 } +281 } +282 } +283 +284/** +285 * Scans a specified file. If a dependency is identified it is added to the dependency collection. +286 * +287 * @param file The file to scan. +288 */ +289protectedvoid scanFile(File file) { +290if (!file.isFile()) { +291final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString()); +292 LOGGER.log(Level.FINE, msg); +293return; +294 } +295final String fileName = file.getName(); +296final String extension = FileUtils.getFileExtension(fileName); +297if (extension != null) { +298if (supportsExtension(extension)) { +299finalDependency dependency = newDependency(file); +300 dependencies.add(dependency); +301 } +302 } else { +303final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.", +304 file.toString()); +305 LOGGER.log(Level.FINEST, msg); +306 } +307 } +308 +309/** +310 * Runs the analyzers against all of the dependencies. +311 */ +312publicvoid analyzeDependencies() { +313//need to ensure that data exists +314try { +315 ensureDataExists(); +316 } catch (NoDataException ex) { +317final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); +318 LOGGER.log(Level.SEVERE, msg); +319 LOGGER.log(Level.FINE, null, ex); +320return; +321 } catch (DatabaseException ex) { +322final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); +323 LOGGER.log(Level.SEVERE, msg); +324 LOGGER.log(Level.FINE, null, ex); +325return; +326 +327 } +328 +329final String logHeader = String.format("%n" +330 + "----------------------------------------------------%n" +331 + "BEGIN ANALYSIS%n" +332 + "----------------------------------------------------"); +333 LOGGER.log(Level.FINE, logHeader); +334 LOGGER.log(Level.INFO, "Analysis Starting"); +335 +336// analysis phases +337for (AnalysisPhase phase : AnalysisPhase.values()) { +338final List<Analyzer> analyzerList = analyzers.get(phase); +339 +340for (Analyzer a : analyzerList) { +341 initializeAnalyzer(a); +342 +343/* need to create a copy of the collection because some of the +344 * analyzers may modify it. This prevents ConcurrentModificationExceptions. +345 * This is okay for adds/deletes because it happens per analyzer. +346 */ +347final String msg = String.format("Begin Analyzer '%s'", a.getName()); +348 LOGGER.log(Level.FINE, msg); +349final Set<Dependency> dependencySet = new HashSet<Dependency>(); +350 dependencySet.addAll(dependencies); +351for (Dependency d : dependencySet) { +352boolean shouldAnalyze = true; +353if (a instanceof FileTypeAnalyzer) { +354finalFileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a; +355 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension()); +356 } +357if (shouldAnalyze) { +358final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath()); +359 LOGGER.log(Level.FINE, msgFile); +360try { +361 a.analyze(d, this); +362 } catch (AnalysisException ex) { +363final String exMsg = String.format("An error occurred while analyzing '%s'.", d.getActualFilePath()); +364 LOGGER.log(Level.WARNING, exMsg); +365 LOGGER.log(Level.FINE, "", ex); +366 } catch (Throwable ex) { +367final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath()); +368//final AnalysisException ax = new AnalysisException(axMsg, ex); +369 LOGGER.log(Level.WARNING, axMsg); +370 LOGGER.log(Level.FINE, "", ex); +371 } +372 } +373 } +374 } +375 } +376for (AnalysisPhase phase : AnalysisPhase.values()) { +377final List<Analyzer> analyzerList = analyzers.get(phase); +378 +379for (Analyzer a : analyzerList) { +380 closeAnalyzer(a); +381 } +382 } +383 +384final String logFooter = String.format("%n" +385 + "----------------------------------------------------%n" +386 + "END ANALYSIS%n" +387 + "----------------------------------------------------"); +388 LOGGER.log(Level.FINE, logFooter); +389 LOGGER.log(Level.INFO, "Analysis Complete"); +390 } +391 +392/** +393 * Initializes the given analyzer. +394 * +395 * @param analyzer the analyzer to initialize +396 */ +397privatevoid initializeAnalyzer(Analyzer analyzer) { +398try { +399final String msg = String.format("Initializing %s", analyzer.getName()); +400 LOGGER.log(Level.FINE, msg); +401 analyzer.initialize(); +402 } catch (Throwable ex) { +403final String msg = String.format("Exception occurred initializing %s.", analyzer.getName()); +404 LOGGER.log(Level.SEVERE, msg); +405 LOGGER.log(Level.FINE, null, ex); +406try { +407 analyzer.close(); +408 } catch (Throwable ex1) { +409 LOGGER.log(Level.FINEST, null, ex1); +410 } +411 } +412 } +413 +414/** +415 * Closes the given analyzer. +416 * +417 * @param analyzer the analyzer to close +418 */ +419privatevoid closeAnalyzer(Analyzer analyzer) { +420final String msg = String.format("Closing Analyzer '%s'", analyzer.getName()); +421 LOGGER.log(Level.FINE, msg); +422try { +423 analyzer.close(); +424 } catch (Throwable ex) { +425 LOGGER.log(Level.FINEST, null, ex); +426 } +427 } +428 +429/** +430 * Cycles through the cached web data sources and calls update on all of them. +431 */ +432privatevoid doUpdates() { +433finalUpdateService service = newUpdateService(serviceClassLoader); +434final Iterator<CachedWebDataSource> iterator = service.getDataSources(); +435while (iterator.hasNext()) { +436finalCachedWebDataSource source = iterator.next(); +437try { +438 source.update(); +439 } catch (UpdateException ex) { +440 LOGGER.log(Level.WARNING, +441"Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities."); +442 LOGGER.log(Level.FINE, +443 String.format("Unable to update details for %s", source.getClass().getName()), ex); +444 } +445 } +446 } +447 +448/** +449 * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used. +450 * +451 * @return a list of Analyzers +452 */ +453public List<Analyzer> getAnalyzers() { +454final List<Analyzer> ret = new ArrayList<Analyzer>(); +455for (AnalysisPhase phase : AnalysisPhase.values()) { +456final List<Analyzer> analyzerList = analyzers.get(phase); +457 ret.addAll(analyzerList); +458 } +459return ret; +460 } +461 +462/** +463 * Checks all analyzers to see if an extension is supported. +464 * +465 * @param ext a file extension +466 * @return true or false depending on whether or not the file extension is supported +467 */ +468publicboolean supportsExtension(String ext) { +469if (ext == null) { +470return false; +471 } +472boolean scan = false; +473for (FileTypeAnalyzer a : this.fileTypeAnalyzers) { +474/* note, we can't break early on this loop as the analyzers need to know if +475 they have files to work on prior to initialization */ +476 scan |= a.supportsExtension(ext); +477 } +478return scan; +479 } +480 +481/** +482 * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown. +483 * +484 * @throws NoDataException thrown if no data exists in the CPE Index +485 * @throws DatabaseException thrown if there is an exception opening the database +486 */ +487privatevoid ensureDataExists() throws NoDataException, DatabaseException { +488finalCpeMemoryIndex cpe = CpeMemoryIndex.getInstance(); +489finalCveDB cve = newCveDB(); +490 +491try { +492 cve.open(); +493 cpe.open(cve); +494 } catch (IndexException ex) { +495thrownewNoDataException(ex.getMessage(), ex); +496 } catch (DatabaseException ex) { +497thrownewNoDataException(ex.getMessage(), ex); +498 } finally { +499 cve.close(); +500 } +501if (cpe.numDocs() <= 0) { +502 cpe.close(); +503thrownewNoDataException("No documents exist"); +504 } +505 } +506 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html index 555fe5e20..44045661c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.agent + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.agent diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html index 6ea8d2abc..6f82bb9c6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.agent + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.agent diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html index d9b59fdab..fbb019367 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html @@ -178,593 +178,594 @@ 170 * @throws ParseException is thrown when the Lucene query cannot be parsed.171 */172protectedvoid determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException { -173Confidence confidence = Confidence.HIGHEST; -174 -175 String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence); -176 String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence); -177/* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no -178 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ -179 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); -180 -181int ctr = 0; -182do { -183if (!vendors.isEmpty() && !products.isEmpty()) { -184final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(), -185 dependency.getVendorEvidence().getWeighting()); -186 -187for (IndexEntry e : entries) { -188if (verifyEntry(e, dependency)) { -189final String vendor = e.getVendor(); -190final String product = e.getProduct(); -191 determineIdentifiers(dependency, vendor, product); -192 } -193 } -194 } -195 confidence = reduceConfidence(confidence); -196if (dependency.getVendorEvidence().contains(confidence)) { -197 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence); -198 } -199if (dependency.getProductEvidence().contains(confidence)) { -200 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence); -201 } -202/* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no -203 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ -204if (dependency.getVersionEvidence().contains(confidence)) { -205 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); -206 } -207 } while ((++ctr) < 4); -208 } -209 -210/** -211 * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a -212 * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence -213 * is longer then 200 characters it will be truncated. -214 * -215 * @param text the base text. -216 * @param ec an EvidenceCollection -217 * @param confidenceFilter a Confidence level to filter the evidence by. -218 * @return the new evidence text -219 */ -220private String addEvidenceWithoutDuplicateTerms(final String text, finalEvidenceCollection ec, Confidence confidenceFilter) { -221final String txt = (text == null) ? "" : text; -222final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size())); -223 sb.append(' ').append(txt).append(' '); -224for (Evidence e : ec.iterator(confidenceFilter)) { -225 String value = e.getValue(); -226 -227//hack to get around the fact that lucene does a really good job of recognizing domains and not -228// splitting them. TODO - put together a better lucene analyzer specific to the domain. -229if (value.startsWith("http://")) { -230 value = value.substring(7).replaceAll("\\.", " "); +173//TODO test dojo-war against this. we shold get dojo-toolkit:dojo-toolkit AND dojo-toolkit:toolkit +174 String vendors = ""; +175 String products = ""; +176for (Confidence confidence : Confidence.values()) { +177if (dependency.getVendorEvidence().contains(confidence)) { +178 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence); +179 } +180if (dependency.getProductEvidence().contains(confidence)) { +181 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence); +182 } +183/* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no +184 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ +185// if (dependency.getVersionEvidence().contains(confidence)) { +186// addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); +187// } +188if (!vendors.isEmpty() && !products.isEmpty()) { +189final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(), +190 dependency.getVendorEvidence().getWeighting()); +191 +192boolean identifierAdded = false; +193for (IndexEntry e : entries) { +194if (verifyEntry(e, dependency)) { +195final String vendor = e.getVendor(); +196final String product = e.getProduct(); +197 identifierAdded |= determineIdentifiers(dependency, vendor, product, confidence); +198 } +199 } +200if (identifierAdded) { +201break; +202 } +203 } +204 } +205 } +206 +207/** +208 * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a +209 * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence +210 * is longer then 200 characters it will be truncated. +211 * +212 * @param text the base text. +213 * @param ec an EvidenceCollection +214 * @param confidenceFilter a Confidence level to filter the evidence by. +215 * @return the new evidence text +216 */ +217private String addEvidenceWithoutDuplicateTerms(final String text, finalEvidenceCollection ec, Confidence confidenceFilter) { +218final String txt = (text == null) ? "" : text; +219final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size())); +220 sb.append(' ').append(txt).append(' '); +221for (Evidence e : ec.iterator(confidenceFilter)) { +222 String value = e.getValue(); +223 +224//hack to get around the fact that lucene does a really good job of recognizing domains and not +225// splitting them. TODO - put together a better lucene analyzer specific to the domain. +226if (value.startsWith("http://")) { +227 value = value.substring(7).replaceAll("\\.", " "); +228 } +229if (value.startsWith("https://")) { +230 value = value.substring(8).replaceAll("\\.", " "); 231 } -232if (value.startsWith("https://")) { -233 value = value.substring(8).replaceAll("\\.", " "); +232if (sb.indexOf(" " + value + " ") < 0) { +233 sb.append(value).append(' '); 234 } -235if (sb.indexOf(" " + value + " ") < 0) { -236 sb.append(value).append(' '); -237 } -238 } -239return sb.toString().trim(); -240 } -241 -242/** -243 * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH. -244 * -245 * @param c the confidence to reduce. -246 * @return One less then the confidence passed in. -247 */ -248privateConfidence reduceConfidence(finalConfidence c) { -249if (c == Confidence.HIGHEST) { -250return Confidence.HIGH; -251 } elseif (c == Confidence.HIGH) { -252return Confidence.MEDIUM; -253 } else { -254return Confidence.LOW; -255 } -256 } -257 -258/** -259 * <p> -260 * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and -261 * version.</p> -262 * -263 * <p> -264 * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting -265 * factors to the search.</p> -266 * -267 * @param vendor the text used to search the vendor field -268 * @param product the text used to search the product field -269 * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field -270 * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search -271 * @return a list of possible CPE values -272 * @throws CorruptIndexException when the Lucene index is corrupt -273 * @throws IOException when the Lucene index is not found -274 * @throws ParseException when the generated query is not valid -275 */ -276protected List<IndexEntry> searchCPE(String vendor, String product, -277 Set<String> vendorWeightings, Set<String> productWeightings) -278throws CorruptIndexException, IOException, ParseException { -279final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS); -280 -281final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings); -282if (searchString == null) { -283return ret; -284 } -285 -286final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); -287for (ScoreDoc d : docs.scoreDocs) { -288if (d.score >= 0.08) { -289final Document doc = cpe.getDocument(d.doc); -290finalIndexEntry entry = newIndexEntry(); -291 entry.setVendor(doc.get(Fields.VENDOR)); -292 entry.setProduct(doc.get(Fields.PRODUCT)); -293// if (d.score < 0.08) { -294// System.out.print(entry.getVendor()); -295// System.out.print(":"); -296// System.out.print(entry.getProduct()); -297// System.out.print(":"); -298// System.out.println(d.score); -299// } -300 entry.setSearchScore(d.score); -301if (!ret.contains(entry)) { -302 ret.add(entry); -303 } -304 } -305 } -306return ret; -307 } -308 -309/** -310 * <p> -311 * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p> -312 * -313 * <p> -314 * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting -315 * factors to the search string generated.</p> -316 * -317 * @param vendor text to search the vendor field -318 * @param product text to search the product field -319 * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight -320 * @param productWeightings a list of strings to apply to the product to boost the terms weight -321 * @return the Lucene query -322 */ -323protected String buildSearch(String vendor, String product, -324 Set<String> vendorWeighting, Set<String> productWeightings) { -325final String v = vendor; //.replaceAll("[^\\w\\d]", " "); -326final String p = product; //.replaceAll("[^\\w\\d]", " "); -327final StringBuilder sb = new StringBuilder(v.length() + p.length() -328 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); -329 -330if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) { -331returnnull; -332 } -333 sb.append(" AND "); -334if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) { -335returnnull; -336 } -337return sb.toString(); -338 } -339 -340/** -341 * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the -342 * word is within the list of weighted words then an additional weighting is applied to the term as it is appended -343 * into the query. -344 * -345 * @param sb a StringBuilder that the query text will be appended to. -346 * @param field the field within the Lucene index that the query is searching. -347 * @param searchText text used to construct the query. -348 * @param weightedText a list of terms that will be considered higher importance when searching. -349 * @return if the append was successful. -350 */ -351privateboolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) { -352 sb.append(" ").append(field).append(":( "); -353 -354final String cleanText = cleanseText(searchText); -355 -356if ("".equals(cleanText)) { -357return false; -358 } -359 -360if (weightedText == null || weightedText.isEmpty()) { -361 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText); -362 } else { -363final StringTokenizer tokens = new StringTokenizer(cleanText); -364while (tokens.hasMoreElements()) { -365final String word = tokens.nextToken(); -366 String temp = null; -367for (String weighted : weightedText) { -368final String weightedStr = cleanseText(weighted); -369if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) { -370 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST; -371if (!word.equalsIgnoreCase(weightedStr)) { -372 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST; -373 } -374 } -375 } -376if (temp == null) { -377 temp = LuceneUtils.escapeLuceneQuery(word); -378 } -379 sb.append(" ").append(temp); -380 } -381 } -382 sb.append(" ) "); -383returntrue; -384 } -385 -386/** -387 * Removes characters from the input text that are not used within the CPE index. -388 * -389 * @param text is the text to remove the characters from. -390 * @return the text having removed some characters. -391 */ -392private String cleanseText(String text) { -393return text.replaceAll(CLEANSE_CHARACTER_RX, " "); -394 } -395 -396/** -397 * Compares two strings after lower casing them and removing the non-alpha characters. -398 * -399 * @param l string one to compare. -400 * @param r string two to compare. -401 * @return whether or not the two strings are similar. -402 */ -403privateboolean equalsIgnoreCaseAndNonAlpha(String l, String r) { -404if (l == null || r == null) { -405return false; -406 } -407 -408final String left = l.replaceAll(CLEANSE_NONALPHA_RX, ""); -409final String right = r.replaceAll(CLEANSE_NONALPHA_RX, ""); -410return left.equalsIgnoreCase(right); +235 } +236return sb.toString().trim(); +237 } +238 +239/** +240 * <p> +241 * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and +242 * version.</p> +243 * +244 * <p> +245 * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting +246 * factors to the search.</p> +247 * +248 * @param vendor the text used to search the vendor field +249 * @param product the text used to search the product field +250 * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field +251 * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search +252 * @return a list of possible CPE values +253 * @throws CorruptIndexException when the Lucene index is corrupt +254 * @throws IOException when the Lucene index is not found +255 * @throws ParseException when the generated query is not valid +256 */ +257protected List<IndexEntry> searchCPE(String vendor, String product, +258 Set<String> vendorWeightings, Set<String> productWeightings) +259throws CorruptIndexException, IOException, ParseException { +260final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS); +261 +262final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings); +263if (searchString == null) { +264return ret; +265 } +266 +267final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); +268for (ScoreDoc d : docs.scoreDocs) { +269if (d.score >= 0.08) { +270final Document doc = cpe.getDocument(d.doc); +271finalIndexEntry entry = newIndexEntry(); +272 entry.setVendor(doc.get(Fields.VENDOR)); +273 entry.setProduct(doc.get(Fields.PRODUCT)); +274// if (d.score < 0.08) { +275// System.out.print(entry.getVendor()); +276// System.out.print(":"); +277// System.out.print(entry.getProduct()); +278// System.out.print(":"); +279// System.out.println(d.score); +280// } +281 entry.setSearchScore(d.score); +282if (!ret.contains(entry)) { +283 ret.add(entry); +284 } +285 } +286 } +287return ret; +288 } +289 +290/** +291 * <p> +292 * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p> +293 * +294 * <p> +295 * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting +296 * factors to the search string generated.</p> +297 * +298 * @param vendor text to search the vendor field +299 * @param product text to search the product field +300 * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight +301 * @param productWeightings a list of strings to apply to the product to boost the terms weight +302 * @return the Lucene query +303 */ +304protected String buildSearch(String vendor, String product, +305 Set<String> vendorWeighting, Set<String> productWeightings) { +306final String v = vendor; //.replaceAll("[^\\w\\d]", " "); +307final String p = product; //.replaceAll("[^\\w\\d]", " "); +308final StringBuilder sb = new StringBuilder(v.length() + p.length() +309 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); +310 +311if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) { +312returnnull; +313 } +314 sb.append(" AND "); +315if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) { +316returnnull; +317 } +318return sb.toString(); +319 } +320 +321/** +322 * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the +323 * word is within the list of weighted words then an additional weighting is applied to the term as it is appended +324 * into the query. +325 * +326 * @param sb a StringBuilder that the query text will be appended to. +327 * @param field the field within the Lucene index that the query is searching. +328 * @param searchText text used to construct the query. +329 * @param weightedText a list of terms that will be considered higher importance when searching. +330 * @return if the append was successful. +331 */ +332privateboolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) { +333 sb.append(" ").append(field).append(":( "); +334 +335final String cleanText = cleanseText(searchText); +336 +337if ("".equals(cleanText)) { +338return false; +339 } +340 +341if (weightedText == null || weightedText.isEmpty()) { +342 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText); +343 } else { +344final StringTokenizer tokens = new StringTokenizer(cleanText); +345while (tokens.hasMoreElements()) { +346final String word = tokens.nextToken(); +347 String temp = null; +348for (String weighted : weightedText) { +349final String weightedStr = cleanseText(weighted); +350if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) { +351 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST; +352if (!word.equalsIgnoreCase(weightedStr)) { +353 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST; +354 } +355 } +356 } +357if (temp == null) { +358 temp = LuceneUtils.escapeLuceneQuery(word); +359 } +360 sb.append(" ").append(temp); +361 } +362 } +363 sb.append(" ) "); +364returntrue; +365 } +366 +367/** +368 * Removes characters from the input text that are not used within the CPE index. +369 * +370 * @param text is the text to remove the characters from. +371 * @return the text having removed some characters. +372 */ +373private String cleanseText(String text) { +374return text.replaceAll(CLEANSE_CHARACTER_RX, " "); +375 } +376 +377/** +378 * Compares two strings after lower casing them and removing the non-alpha characters. +379 * +380 * @param l string one to compare. +381 * @param r string two to compare. +382 * @return whether or not the two strings are similar. +383 */ +384privateboolean equalsIgnoreCaseAndNonAlpha(String l, String r) { +385if (l == null || r == null) { +386return false; +387 } +388 +389final String left = l.replaceAll(CLEANSE_NONALPHA_RX, ""); +390final String right = r.replaceAll(CLEANSE_NONALPHA_RX, ""); +391return left.equalsIgnoreCase(right); +392 } +393 +394/** +395 * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version +396 * information for the CPE are contained within the dependencies evidence. +397 * +398 * @param entry a CPE entry. +399 * @param dependency the dependency that the CPE entries could be for. +400 * @return whether or not the entry is valid. +401 */ +402privateboolean verifyEntry(finalIndexEntry entry, finalDependency dependency) { +403boolean isValid = false; +404 +405if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) +406 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { +407//&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) +408 isValid = true; +409 } +410return isValid; 411 } 412413/** -414 * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version -415 * information for the CPE are contained within the dependencies evidence. -416 * -417 * @param entry a CPE entry. -418 * @param dependency the dependency that the CPE entries could be for. -419 * @return whether or not the entry is valid. -420 */ -421privateboolean verifyEntry(finalIndexEntry entry, finalDependency dependency) { -422boolean isValid = false; -423 -424if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) -425 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { -426//&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) -427 isValid = true; -428 } -429return isValid; -430 } -431 -432/** -433 * Used to determine if the EvidenceCollection contains a specific string. -434 * -435 * @param ec an EvidenceCollection -436 * @param text the text to search for -437 * @return whether or not the EvidenceCollection contains the string -438 */ -439privateboolean collectionContainsString(EvidenceCollection ec, String text) { -440 -441//<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done"> -442// String[] splitText = text.split("[\\s_-]"); -443// -444// for (String search : splitText) { -445// //final String search = text.replaceAll("[\\s_-]", "").toLowerCase(); -446// if (ec.containsUsedString(search)) { -447// return true; -448// } -449// } -450//</editor-fold> -451//TODO - likely need to change the split... not sure if this will work for CPE with special chars -452if (text == null) { -453return false; -454 } -455final String[] words = text.split("[\\s_-]"); -456final List<String> list = new ArrayList<String>(); -457 String tempWord = null; -458for (String word : words) { -459/* -460 single letter words should be concatenated with the next word. -461 so { "m", "core", "sample" } -> { "mcore", "sample" } -462 */ -463if (tempWord != null) { -464 list.add(tempWord + word); -465 tempWord = null; -466 } elseif (word.length() <= 2) { -467 tempWord = word; -468 } else { -469 list.add(word); -470 } -471 } -472if (tempWord != null && !list.isEmpty()) { -473final String tmp = list.get(list.size() - 1) + tempWord; -474 list.add(tmp); -475 } -476boolean contains = true; -477for (String word : list) { -478 contains &= ec.containsUsedString(word); -479 } -480return contains; -481 } -482 -483/** -484 * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. -485 * -486 * @param dependency The Dependency to analyze. -487 * @param engine The analysis engine -488 * @throws AnalysisException is thrown if there is an issue analyzing the dependency. -489 */ -490 @Override -491publicvoid analyze(Dependency dependency, Engine engine) throws AnalysisException { -492try { -493 determineCPE(dependency); -494 } catch (CorruptIndexException ex) { -495thrownewAnalysisException("CPE Index is corrupt.", ex); -496 } catch (IOException ex) { -497thrownewAnalysisException("Failure opening the CPE Index.", ex); -498 } catch (ParseException ex) { -499thrownewAnalysisException("Unable to parse the generated Lucene query for this dependency.", ex); -500 } -501 } -502 -503/** -504 * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then -505 * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a -506 * best effort "guess" based on the vendor, product, and version information. -507 * -508 * @param dependency the Dependency being analyzed -509 * @param vendor the vendor for the CPE being analyzed -510 * @param product the product for the CPE being analyzed -511 * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported -512 */ -513privatevoid determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException { -514final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product); -515DependencyVersion bestGuess = newDependencyVersion("-"); -516Confidence bestGuessConf = null; -517final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>(); -518for (Confidence conf : Confidence.values()) { -519for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) { -520finalDependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue()); -521if (evVer == null) { -522continue; -523 } -524for (VulnerableSoftware vs : cpes) { -525DependencyVersion dbVer; -526if (vs.getRevision() != null && !vs.getRevision().isEmpty()) { -527 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision()); -528 } else { -529 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion()); -530 } -531if (dbVer == null//special case, no version specified - everything is vulnerable -532 || evVer.equals(dbVer)) { //yeah! exact match -533 -534final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8")); -535finalIdentifierMatch match = newIdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); -536 collected.add(match); -537 } else { -538//TODO the following isn't quite right is it? need to think about this guessing game a bit more. -539if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size() -540 && evVer.matchesAtLeastThreeLevels(dbVer)) { -541if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { -542if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) { -543 bestGuess = dbVer; -544 bestGuessConf = conf; -545 } -546 } -547 } -548 } -549 } -550if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { -551if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) { -552 bestGuess = evVer; -553 bestGuessConf = conf; -554 } -555 } -556 } -557 } -558final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString()); -559final String url = null; -560if (bestGuessConf == null) { -561 bestGuessConf = Confidence.LOW; -562 } -563finalIdentifierMatch match = newIdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf); -564 collected.add(match); -565 -566 Collections.sort(collected); -567finalIdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence(); -568finalConfidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence(); -569for (IdentifierMatch m : collected) { -570if (bestIdentifierQuality.equals(m.getConfidence()) -571 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) { -572finalIdentifier i = m.getIdentifier(); -573if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) { -574 i.setConfidence(Confidence.LOW); -575 } else { -576 i.setConfidence(bestEvidenceQuality); -577 } -578 dependency.addIdentifier(i); -579 } -580 } -581 } -582 -583/** -584 * The confidence whether the identifier is an exact match, or a best guess. -585 */ -586private enum IdentifierConfidence { -587 +414 * Used to determine if the EvidenceCollection contains a specific string. +415 * +416 * @param ec an EvidenceCollection +417 * @param text the text to search for +418 * @return whether or not the EvidenceCollection contains the string +419 */ +420privateboolean collectionContainsString(EvidenceCollection ec, String text) { +421 +422//<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done"> +423// String[] splitText = text.split("[\\s_-]"); +424// +425// for (String search : splitText) { +426// //final String search = text.replaceAll("[\\s_-]", "").toLowerCase(); +427// if (ec.containsUsedString(search)) { +428// return true; +429// } +430// } +431//</editor-fold> +432//TODO - likely need to change the split... not sure if this will work for CPE with special chars +433if (text == null) { +434return false; +435 } +436final String[] words = text.split("[\\s_-]"); +437final List<String> list = new ArrayList<String>(); +438 String tempWord = null; +439for (String word : words) { +440/* +441 single letter words should be concatenated with the next word. +442 so { "m", "core", "sample" } -> { "mcore", "sample" } +443 */ +444if (tempWord != null) { +445 list.add(tempWord + word); +446 tempWord = null; +447 } elseif (word.length() <= 2) { +448 tempWord = word; +449 } else { +450 list.add(word); +451 } +452 } +453if (tempWord != null && !list.isEmpty()) { +454final String tmp = list.get(list.size() - 1) + tempWord; +455 list.add(tmp); +456 } +457boolean contains = true; +458for (String word : list) { +459 contains &= ec.containsUsedString(word); +460 } +461return contains; +462 } +463 +464/** +465 * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. +466 * +467 * @param dependency The Dependency to analyze. +468 * @param engine The analysis engine +469 * @throws AnalysisException is thrown if there is an issue analyzing the dependency. +470 */ +471 @Override +472publicvoid analyze(Dependency dependency, Engine engine) throws AnalysisException { +473try { +474 determineCPE(dependency); +475 } catch (CorruptIndexException ex) { +476thrownewAnalysisException("CPE Index is corrupt.", ex); +477 } catch (IOException ex) { +478thrownewAnalysisException("Failure opening the CPE Index.", ex); +479 } catch (ParseException ex) { +480thrownewAnalysisException("Unable to parse the generated Lucene query for this dependency.", ex); +481 } +482 } +483 +484/** +485 * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then +486 * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a +487 * best effort "guess" based on the vendor, product, and version information. +488 * +489 * @param dependency the Dependency being analyzed +490 * @param vendor the vendor for the CPE being analyzed +491 * @param product the product for the CPE being analyzed +492 * @return <code>true</code> if an identifier was added to the dependency; otherwise <code>false</code> +493 * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported +494 */ +495privateboolean determineIdentifiers(Dependency dependency, String vendor, String product, Confidence currentConfidence) throws UnsupportedEncodingException { +496final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product); +497DependencyVersion bestGuess = newDependencyVersion("-"); +498Confidence bestGuessConf = null; +499boolean hasBroadMatch = false; +500final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>(); +501for (Confidence conf : Confidence.values()) { +502// if (conf.compareTo(currentConfidence) > 0) { +503// break; +504// } +505for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) { +506finalDependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue()); +507if (evVer == null) { +508continue; +509 } +510for (VulnerableSoftware vs : cpes) { +511DependencyVersion dbVer; +512if (vs.getRevision() != null && !vs.getRevision().isEmpty()) { +513 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision()); +514 } else { +515 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion()); +516 } +517if (dbVer == null) { //special case, no version specified - everything is vulnerable +518 hasBroadMatch = true; +519final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8")); +520finalIdentifierMatch match = newIdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.BROAD_MATCH, conf); +521 collected.add(match); +522 } elseif (evVer.equals(dbVer)) { //yeah! exact match +523final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8")); +524finalIdentifierMatch match = newIdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); +525 collected.add(match); +526 } else { +527//TODO the following isn't quite right is it? need to think about this guessing game a bit more. +528if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size() +529 && evVer.matchesAtLeastThreeLevels(dbVer)) { +530if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { +531if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) { +532 bestGuess = dbVer; +533 bestGuessConf = conf; +534 } +535 } +536 } +537 } +538 } +539if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { +540if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) { +541 bestGuess = evVer; +542 bestGuessConf = conf; +543 } +544 } +545 } +546 } +547final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString()); +548 String url = null; +549if (hasBroadMatch) { //if we have a broad match we can add the URL to the best guess. +550final String cpeUrlName = String.format("cpe:/a:%s:%s", vendor, product); +551 url = String.format(NVD_SEARCH_URL, URLEncoder.encode(cpeUrlName, "UTF-8")); +552 } +553if (bestGuessConf == null) { +554 bestGuessConf = Confidence.LOW; +555 } +556finalIdentifierMatch match = newIdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf); +557 collected.add(match); +558 +559 Collections.sort(collected); +560finalIdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence(); +561finalConfidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence(); +562boolean identifierAdded = false; +563for (IdentifierMatch m : collected) { +564if (bestIdentifierQuality.equals(m.getConfidence()) +565 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) { +566finalIdentifier i = m.getIdentifier(); +567if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) { +568 i.setConfidence(Confidence.LOW); +569 } else { +570 i.setConfidence(bestEvidenceQuality); +571 } +572 dependency.addIdentifier(i); +573 identifierAdded = true; +574 } +575 } +576return identifierAdded; +577 } +578 +579/** +580 * The confidence whether the identifier is an exact match, or a best guess. +581 */ +582private enum IdentifierConfidence { +583 +584/** +585 * An exact match for the CPE. +586 */ +587 EXACT_MATCH, 588/** -589 * An exact match for the CPE. +589 * A best guess for the CPE.590 */ -591 EXACT_MATCH, +591 BEST_GUESS, 592/** -593 * A best guess for the CPE. -594 */ -595 BEST_GUESS -596 } -597 -598/** -599 * A simple object to hold an identifier and carry information about the confidence in the identifier. -600 */ -601privatestaticclassIdentifierMatchimplements Comparable<IdentifierMatch> { -602 -603/** -604 * Constructs an IdentifierMatch. -605 * -606 * @param type the type of identifier (such as CPE) -607 * @param value the value of the identifier -608 * @param url the URL of the identifier -609 * @param identifierConfidence the confidence in the identifier: best guess or exact match -610 * @param evidenceConfidence the confidence of the evidence used to find the identifier -611 */ -612IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { -613this.identifier = newIdentifier(type, value, url); -614this.confidence = identifierConfidence; -615this.evidenceConfidence = evidenceConfidence; -616 } -617//<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier"> -618/** -619 * The confidence in the evidence used to identify this match. -620 */ -621privateConfidence evidenceConfidence; -622 -623/** -624 * Get the value of evidenceConfidence -625 * -626 * @return the value of evidenceConfidence -627 */ -628publicConfidence getEvidenceConfidence() { -629return evidenceConfidence; -630 } -631 -632/** -633 * Set the value of evidenceConfidence -634 * -635 * @param evidenceConfidence new value of evidenceConfidence -636 */ -637publicvoid setEvidenceConfidence(Confidence evidenceConfidence) { -638this.evidenceConfidence = evidenceConfidence; -639 } -640/** -641 * The confidence whether this is an exact match, or a best guess. -642 */ -643privateIdentifierConfidence confidence; -644 -645/** -646 * Get the value of confidence. -647 * -648 * @return the value of confidence -649 */ -650publicIdentifierConfidence getConfidence() { -651return confidence; -652 } -653 -654/** -655 * Set the value of confidence. -656 * -657 * @param confidence new value of confidence -658 */ -659publicvoid setConfidence(IdentifierConfidence confidence) { -660this.confidence = confidence; -661 } -662/** -663 * The CPE identifier. -664 */ -665privateIdentifier identifier; -666 -667/** -668 * Get the value of identifier. -669 * -670 * @return the value of identifier -671 */ -672publicIdentifier getIdentifier() { -673return identifier; -674 } -675 -676/** -677 * Set the value of identifier. -678 * -679 * @param identifier new value of identifier -680 */ -681publicvoid setIdentifier(Identifier identifier) { -682this.identifier = identifier; -683 } -684//</editor-fold> -685//<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals"> -686 -687/** -688 * Standard toString() implementation. -689 * -690 * @return the string representation of the object -691 */ -692 @Override -693public String toString() { -694return"IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence -695 + ", confidence=" + confidence + ", identifier=" + identifier + '}'; -696 } -697 -698/** -699 * Standard hashCode() implementation. -700 * -701 * @return the hashCode -702 */ -703 @Override -704publicint hashCode() { -705int hash = 5; -706 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0); -707 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); -708 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0); -709return hash; -710 } -711 -712/** -713 * Standard equals implementation. -714 * -715 * @param obj the object to compare -716 * @return true if the objects are equal, otherwise false -717 */ -718 @Override -719publicboolean equals(Object obj) { -720if (obj == null) { -721return false; -722 } -723if (getClass() != obj.getClass()) { -724return false; -725 } -726finalIdentifierMatch other = (IdentifierMatch) obj; -727if (this.evidenceConfidence != other.evidenceConfidence) { -728return false; -729 } -730if (this.confidence != other.confidence) { -731return false; -732 } -733if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) { -734return false; -735 } -736returntrue; -737 } -738//</editor-fold> -739 -740/** -741 * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the -742 * identifier. -743 * -744 * @param o the IdentifierMatch to compare to -745 * @return the natural ordering of IdentifierMatch -746 */ -747 @Override -748publicint compareTo(IdentifierMatch o) { -749int conf = this.confidence.compareTo(o.confidence); -750if (conf == 0) { -751 conf = this.evidenceConfidence.compareTo(o.evidenceConfidence); -752if (conf == 0) { -753 conf = identifier.compareTo(o.identifier); -754 } -755 } -756return conf; -757 } -758 } -759 } +593 * The entire vendor/product group must be added (without a guess at version) because there is a CVE with a VS +594 * that only specifies vendor/product. +595 */ +596 BROAD_MATCH +597 } +598 +599/** +600 * A simple object to hold an identifier and carry information about the confidence in the identifier. +601 */ +602privatestaticclassIdentifierMatchimplements Comparable<IdentifierMatch> { +603 +604/** +605 * Constructs an IdentifierMatch. +606 * +607 * @param type the type of identifier (such as CPE) +608 * @param value the value of the identifier +609 * @param url the URL of the identifier +610 * @param identifierConfidence the confidence in the identifier: best guess or exact match +611 * @param evidenceConfidence the confidence of the evidence used to find the identifier +612 */ +613IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { +614this.identifier = newIdentifier(type, value, url); +615this.confidence = identifierConfidence; +616this.evidenceConfidence = evidenceConfidence; +617 } +618//<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier"> +619/** +620 * The confidence in the evidence used to identify this match. +621 */ +622privateConfidence evidenceConfidence; +623 +624/** +625 * Get the value of evidenceConfidence +626 * +627 * @return the value of evidenceConfidence +628 */ +629publicConfidence getEvidenceConfidence() { +630return evidenceConfidence; +631 } +632 +633/** +634 * Set the value of evidenceConfidence +635 * +636 * @param evidenceConfidence new value of evidenceConfidence +637 */ +638publicvoid setEvidenceConfidence(Confidence evidenceConfidence) { +639this.evidenceConfidence = evidenceConfidence; +640 } +641/** +642 * The confidence whether this is an exact match, or a best guess. +643 */ +644privateIdentifierConfidence confidence; +645 +646/** +647 * Get the value of confidence. +648 * +649 * @return the value of confidence +650 */ +651publicIdentifierConfidence getConfidence() { +652return confidence; +653 } +654 +655/** +656 * Set the value of confidence. +657 * +658 * @param confidence new value of confidence +659 */ +660publicvoid setConfidence(IdentifierConfidence confidence) { +661this.confidence = confidence; +662 } +663/** +664 * The CPE identifier. +665 */ +666privateIdentifier identifier; +667 +668/** +669 * Get the value of identifier. +670 * +671 * @return the value of identifier +672 */ +673publicIdentifier getIdentifier() { +674return identifier; +675 } +676 +677/** +678 * Set the value of identifier. +679 * +680 * @param identifier new value of identifier +681 */ +682publicvoid setIdentifier(Identifier identifier) { +683this.identifier = identifier; +684 } +685//</editor-fold> +686//<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals"> +687 +688/** +689 * Standard toString() implementation. +690 * +691 * @return the string representation of the object +692 */ +693 @Override +694public String toString() { +695return"IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence +696 + ", confidence=" + confidence + ", identifier=" + identifier + '}'; +697 } +698 +699/** +700 * Standard hashCode() implementation. +701 * +702 * @return the hashCode +703 */ +704 @Override +705publicint hashCode() { +706int hash = 5; +707 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0); +708 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); +709 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0); +710return hash; +711 } +712 +713/** +714 * Standard equals implementation. +715 * +716 * @param obj the object to compare +717 * @return true if the objects are equal, otherwise false +718 */ +719 @Override +720publicboolean equals(Object obj) { +721if (obj == null) { +722return false; +723 } +724if (getClass() != obj.getClass()) { +725return false; +726 } +727finalIdentifierMatch other = (IdentifierMatch) obj; +728if (this.evidenceConfidence != other.evidenceConfidence) { +729return false; +730 } +731if (this.confidence != other.confidence) { +732return false; +733 } +734if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) { +735return false; +736 } +737returntrue; +738 } +739//</editor-fold> +740 +741/** +742 * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the +743 * identifier. +744 * +745 * @param o the IdentifierMatch to compare to +746 * @return the natural ordering of IdentifierMatch +747 */ +748 @Override +749publicint compareTo(IdentifierMatch o) { +750int conf = this.confidence.compareTo(o.confidence); +751if (conf == 0) { +752 conf = this.evidenceConfidence.compareTo(o.evidenceConfidence); +753if (conf == 0) { +754 conf = identifier.compareTo(o.identifier); +755 } +756 } +757return conf; +758 } +759 } +760 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html index fd05703f7..f618044a8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html @@ -94,352 +94,382 @@ 86publicvoid analyze(Dependency dependency, Engine engine) throws AnalysisException { 87 removeJreEntries(dependency); 88 removeBadMatches(dependency); -89 removeWrongVersionMatches(dependency); -90 removeSpuriousCPE(dependency); -91 removeDuplicativeEntriesFromJar(dependency, engine); -92 addFalseNegativeCPEs(dependency); -93 } -94 -95/** -96 * <p> -97 * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p> -98 * <p> -99 * Example:</p> -100 * <code> -101 * cpe:/a:some-vendor:some-product -102 * cpe:/a:some-vendor:some-product:1.5 -103 * cpe:/a:some-vendor:some-product:1.5.2 -104 * </code> -105 * <p> -106 * Should be trimmed to:</p> -107 * <code> -108 * cpe:/a:some-vendor:some-product:1.5.2 -109 * </code> -110 * -111 * @param dependency the dependency being analyzed -112 */ -113 @SuppressWarnings("null") -114privatevoid removeSpuriousCPE(Dependency dependency) { -115final List<Identifier> ids = new ArrayList<Identifier>(); -116 ids.addAll(dependency.getIdentifiers()); -117 Collections.sort(ids); -118final ListIterator<Identifier> mainItr = ids.listIterator(); -119while (mainItr.hasNext()) { -120finalIdentifier currentId = mainItr.next(); -121finalVulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue()); -122if (currentCpe == null) { -123continue; -124 } -125final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex()); -126while (subItr.hasNext()) { -127finalIdentifier nextId = subItr.next(); -128finalVulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue()); -129if (nextCpe == null) { -130continue; -131 } -132//TODO fix the version problem below -133if (currentCpe.getVendor().equals(nextCpe.getVendor())) { -134if (currentCpe.getProduct().equals(nextCpe.getProduct())) { -135// see if one is contained in the other.. remove the contained one from dependency.getIdentifier -136final String currentVersion = currentCpe.getVersion(); -137final String nextVersion = nextCpe.getVersion(); -138if (currentVersion == null && nextVersion == null) { -139//how did we get here? -140 LOGGER.log(Level.FINE, "currentVersion and nextVersion are both null?"); -141 } elseif (currentVersion == null && nextVersion != null) { -142 dependency.getIdentifiers().remove(currentId); -143 } elseif (nextVersion == null && currentVersion != null) { -144 dependency.getIdentifiers().remove(nextId); -145 } elseif (currentVersion.length() < nextVersion.length()) { -146if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) { -147 dependency.getIdentifiers().remove(currentId); -148 } -149 } else { -150if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) { -151 dependency.getIdentifiers().remove(nextId); -152 } -153 } -154 } -155 } -156 } -157 } -158 } -159/** -160 * Regex to identify core java libraries and a few other commonly misidentified ones. -161 */ -162publicstaticfinal Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" -163 + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" -164 + "jdk|jre|jsse)($|:.*)"); -165 -166/** -167 * Regex to identify core jsf libraries. -168 */ -169publicstaticfinal Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)"); -170/** -171 * Regex to identify core java library files. This is currently incomplete. -172 */ -173publicstaticfinal Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); -174/** -175 * Regex to identify core jsf java library files. This is currently incomplete. -176 */ -177publicstaticfinal Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$"); -178 -179/** -180 * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar -181 * -182 * @param dependency the dependency to remove JRE CPEs from -183 */ -184privatevoid removeJreEntries(Dependency dependency) { -185final Set<Identifier> identifiers = dependency.getIdentifiers(); -186final Iterator<Identifier> itr = identifiers.iterator(); -187while (itr.hasNext()) { -188finalIdentifier i = itr.next(); -189final Matcher coreCPE = CORE_JAVA.matcher(i.getValue()); -190final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName()); -191if (coreCPE.matches() && !coreFiles.matches()) { -192 itr.remove(); -193 } -194final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue()); -195final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName()); -196if (coreJsfCPE.matches() && !coreJsfFiles.matches()) { -197 itr.remove(); -198 } -199 } -200 } -201 -202/** -203 * Parses a CPE string into an IndexEntry. -204 * -205 * @param type the type of identifier -206 * @param value the cpe identifier to parse -207 * @return an VulnerableSoftware object constructed from the identifier -208 */ -209privateVulnerableSoftware parseCpe(String type, String value) { -210if (!"cpe".equals(type)) { -211returnnull; -212 } -213finalVulnerableSoftware cpe = newVulnerableSoftware(); -214try { -215 cpe.parseName(value); -216 } catch (UnsupportedEncodingException ex) { -217 LOGGER.log(Level.FINEST, null, ex); -218returnnull; -219 } -220return cpe; -221 } -222 -223/** -224 * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific -225 * problems identified when testing this on a LARGE volume of jar files. -226 * -227 * @param dependency the dependency to analyze -228 */ -229privatevoid removeBadMatches(Dependency dependency) { -230final Set<Identifier> identifiers = dependency.getIdentifiers(); -231final Iterator<Identifier> itr = identifiers.iterator(); -232 -233/* TODO - can we utilize the pom's groupid and artifactId to filter??? most of -234 * these are due to low quality data. Other idea would be to say any CPE -235 * found based on LOW confidence evidence should have a different CPE type? (this -236 * might be a better solution then just removing the URL for "best-guess" matches). -237 */ -238//Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); -239//Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); -240while (itr.hasNext()) { -241finalIdentifier i = itr.next(); -242//TODO move this startsWith expression to a configuration file? -243if ("cpe".equals(i.getType())) { -244if ((i.getValue().matches(".*c\\+\\+.*") -245 || i.getValue().startsWith("cpe:/a:file:file") -246 || i.getValue().startsWith("cpe:/a:mozilla:mozilla") -247 || i.getValue().startsWith("cpe:/a:cvs:cvs") -248 || i.getValue().startsWith("cpe:/a:ftp:ftp") -249 || i.getValue().startsWith("cpe:/a:tcp:tcp") -250 || i.getValue().startsWith("cpe:/a:ssh:ssh") -251 || i.getValue().startsWith("cpe:/a:lookup:lookup")) -252 && (dependency.getFileName().toLowerCase().endsWith(".jar") -253 || dependency.getFileName().toLowerCase().endsWith("pom.xml") -254 || dependency.getFileName().toLowerCase().endsWith(".dll") -255 || dependency.getFileName().toLowerCase().endsWith(".exe") -256 || dependency.getFileName().toLowerCase().endsWith(".nuspec") -257 || dependency.getFileName().toLowerCase().endsWith(".nupkg"))) { -258 itr.remove(); -259 } elseif ((i.getValue().startsWith("cpe:/a:jquery:jquery") -260 || i.getValue().startsWith("cpe:/a:prototypejs:prototype") -261 || i.getValue().startsWith("cpe:/a:yahoo:yui")) -262 && (dependency.getFileName().toLowerCase().endsWith(".jar") -263 || dependency.getFileName().toLowerCase().endsWith("pom.xml") -264 || dependency.getFileName().toLowerCase().endsWith(".dll") -265 || dependency.getFileName().toLowerCase().endsWith(".exe"))) { -266 itr.remove(); -267 } elseif ((i.getValue().startsWith("cpe:/a:microsoft:excel") -268 || i.getValue().startsWith("cpe:/a:microsoft:word") -269 || i.getValue().startsWith("cpe:/a:microsoft:visio") -270 || i.getValue().startsWith("cpe:/a:microsoft:powerpoint") -271 || i.getValue().startsWith("cpe:/a:microsoft:office")) -272 && (dependency.getFileName().toLowerCase().endsWith(".jar") -273 || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { -274 itr.remove(); -275 } elseif (i.getValue().startsWith("cpe:/a:apache:maven") -276 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { -277 itr.remove(); -278 } elseif (i.getValue().startsWith("cpe:/a:m-core:m-core") -279 && !dependency.getEvidenceUsed().containsUsedString("m-core")) { -280 itr.remove(); -281 } elseif (i.getValue().startsWith("cpe:/a:jboss:jboss") -282 && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar")) { -283 itr.remove(); -284 } -285 } -286 } -287 } -288 -289/** -290 * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. -291 * -292 * @param dependency the dependency to analyze -293 */ -294privatevoid removeWrongVersionMatches(Dependency dependency) { -295final Set<Identifier> identifiers = dependency.getIdentifiers(); -296final Iterator<Identifier> itr = identifiers.iterator(); -297 -298final String fileName = dependency.getFileName(); -299if (fileName != null && fileName.contains("axis2")) { -300while (itr.hasNext()) { -301finalIdentifier i = itr.next(); -302if ("cpe".equals(i.getType())) { -303final String cpe = i.getValue(); -304if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { -305 itr.remove(); -306 } -307 } -308 } -309 } elseif (fileName != null && fileName.contains("axis")) { -310while (itr.hasNext()) { -311finalIdentifier i = itr.next(); -312if ("cpe".equals(i.getType())) { -313final String cpe = i.getValue(); -314if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { -315 itr.remove(); -316 } -317 } -318 } -319 } -320 } -321 -322/** -323 * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and -324 * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete -325 * list of CVE entries. -326 * -327 * @param dependency the dependency being analyzed -328 */ -329privatevoid addFalseNegativeCPEs(Dependency dependency) { -330//TODO move this to the hint analyzer -331final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); -332while (itr.hasNext()) { -333finalIdentifier i = itr.next(); -334if ("cpe".equals(i.getType()) && i.getValue() != null -335 && (i.getValue().startsWith("cpe:/a:oracle:opensso:") -336 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:") -337 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:") -338 || i.getValue().startsWith("cpe:/a:sun:opensso:"))) { -339final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22)); -340final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22)); -341final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22)); -342final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22)); -343try { -344 dependency.addIdentifier("cpe", -345 newCpe, -346 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8"))); -347 dependency.addIdentifier("cpe", -348 newCpe2, -349 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8"))); -350 dependency.addIdentifier("cpe", -351 newCpe3, -352 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8"))); -353 dependency.addIdentifier("cpe", -354 newCpe4, -355 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8"))); -356 } catch (UnsupportedEncodingException ex) { -357 LOGGER.log(Level.FINE, null, ex); -358 } -359 } -360 } -361 } -362 -363/** -364 * Removes duplicate entries identified that are contained within JAR files. These occasionally crop up due to POM -365 * entries or other types of files (such as DLLs and EXEs) being contained within the JAR. -366 * -367 * @param dependency the dependency that might be a duplicate -368 * @param engine the engine used to scan all dependencies -369 */ -370privatevoid removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) { -371if (dependency.getFileName().toLowerCase().endsWith("pom.xml") -372 || "dll".equals(dependency.getFileExtension()) -373 || "exe".equals(dependency.getFileExtension())) { -374 String parentPath = dependency.getFilePath().toLowerCase(); -375if (parentPath.contains(".jar")) { -376 parentPath = parentPath.substring(0, parentPath.indexOf(".jar") + 4); -377finalDependency parent = findDependency(parentPath, engine.getDependencies()); -378if (parent != null) { -379boolean remove = false; -380for (Identifier i : dependency.getIdentifiers()) { -381if ("cpe".equals(i.getType())) { -382final String trimmedCPE = trimCpeToVendor(i.getValue()); -383for (Identifier parentId : parent.getIdentifiers()) { -384if ("cpe".equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) { -385 remove |= true; -386 } -387 } -388 } -389if (!remove) { //we can escape early -390return; -391 } -392 } -393if (remove) { -394 engine.getDependencies().remove(dependency); -395 } -396 } -397 } -398 -399 } -400 } -401 -402/** -403 * Retrieves a given dependency, based on a given path, from a list of dependencies. -404 * -405 * @param dependencyPath the path of the dependency to return -406 * @param dependencies the collection of dependencies to search -407 * @return the dependency object for the given path, otherwise null -408 */ -409privateDependency findDependency(String dependencyPath, List<Dependency> dependencies) { -410for (Dependency d : dependencies) { -411if (d.getFilePath().equalsIgnoreCase(dependencyPath)) { -412return d; -413 } -414 } -415returnnull; -416 } -417 -418/** -419 * Takes a full CPE and returns the CPE trimmed to include only vendor and product. -420 * -421 * @param value the CPE value to trim -422 * @return a CPE value that only includes the vendor and product -423 */ -424private String trimCpeToVendor(String value) { -425//cpe:/a:jruby:jruby:1.0.8 -426finalint pos1 = value.indexOf(":", 7); //right of vendor -427finalint pos2 = value.indexOf(":", pos1 + 1); //right of product -428if (pos2 < 0) { -429return value; -430 } else { -431return value.substring(0, pos2); -432 } -433 } -434 } +89 removeBadSpringMatches(dependency); +90 removeWrongVersionMatches(dependency); +91 removeSpuriousCPE(dependency); +92 removeDuplicativeEntriesFromJar(dependency, engine); +93 addFalseNegativeCPEs(dependency); +94 } +95 +96privatevoid removeBadSpringMatches(Dependency dependency) { +97 String mustContain = null; +98for (Identifier i : dependency.getIdentifiers()) { +99if ("maven".contains(i.getType())) { +100if (i.getValue() != null && i.getValue().startsWith("org.springframework.")) { +101int endPoint = i.getValue().indexOf(":", 19); +102if (endPoint >= 0) { +103 mustContain = i.getValue().substring(19, endPoint).toLowerCase(); +104break; +105 } +106 } +107 } +108 } +109if (mustContain != null) { +110 Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +111while (itr.hasNext()) { +112Identifier i = itr.next(); +113if ("cpe".contains(i.getType()) +114 && i.getValue() != null +115 && i.getValue().startsWith("cpe:/a:springsource:") +116 && !i.getValue().toLowerCase().contains(mustContain)) { +117 itr.remove(); +118//dependency.getIdentifiers().remove(i); +119 } +120 +121 } +122 } +123 } +124 +125/** +126 * <p> +127 * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p> +128 * <p> +129 * Example:</p> +130 * <code> +131 * cpe:/a:some-vendor:some-product +132 * cpe:/a:some-vendor:some-product:1.5 +133 * cpe:/a:some-vendor:some-product:1.5.2 +134 * </code> +135 * <p> +136 * Should be trimmed to:</p> +137 * <code> +138 * cpe:/a:some-vendor:some-product:1.5.2 +139 * </code> +140 * +141 * @param dependency the dependency being analyzed +142 */ +143 @SuppressWarnings("null") +144privatevoid removeSpuriousCPE(Dependency dependency) { +145final List<Identifier> ids = new ArrayList<Identifier>(); +146 ids.addAll(dependency.getIdentifiers()); +147 Collections.sort(ids); +148final ListIterator<Identifier> mainItr = ids.listIterator(); +149while (mainItr.hasNext()) { +150finalIdentifier currentId = mainItr.next(); +151finalVulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue()); +152if (currentCpe == null) { +153continue; +154 } +155final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex()); +156while (subItr.hasNext()) { +157finalIdentifier nextId = subItr.next(); +158finalVulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue()); +159if (nextCpe == null) { +160continue; +161 } +162//TODO fix the version problem below +163if (currentCpe.getVendor().equals(nextCpe.getVendor())) { +164if (currentCpe.getProduct().equals(nextCpe.getProduct())) { +165// see if one is contained in the other.. remove the contained one from dependency.getIdentifier +166final String currentVersion = currentCpe.getVersion(); +167final String nextVersion = nextCpe.getVersion(); +168if (currentVersion == null && nextVersion == null) { +169//how did we get here? +170 LOGGER.log(Level.FINE, "currentVersion and nextVersion are both null?"); +171 } elseif (currentVersion == null && nextVersion != null) { +172 dependency.getIdentifiers().remove(currentId); +173 } elseif (nextVersion == null && currentVersion != null) { +174 dependency.getIdentifiers().remove(nextId); +175 } elseif (currentVersion.length() < nextVersion.length()) { +176if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) { +177 dependency.getIdentifiers().remove(currentId); +178 } +179 } else { +180if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) { +181 dependency.getIdentifiers().remove(nextId); +182 } +183 } +184 } +185 } +186 } +187 } +188 } +189/** +190 * Regex to identify core java libraries and a few other commonly misidentified ones. +191 */ +192publicstaticfinal Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" +193 + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" +194 + "jdk|jre|jsse)($|:.*)"); +195 +196/** +197 * Regex to identify core jsf libraries. +198 */ +199publicstaticfinal Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)"); +200/** +201 * Regex to identify core java library files. This is currently incomplete. +202 */ +203publicstaticfinal Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); +204/** +205 * Regex to identify core jsf java library files. This is currently incomplete. +206 */ +207publicstaticfinal Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$"); +208 +209/** +210 * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar +211 * +212 * @param dependency the dependency to remove JRE CPEs from +213 */ +214privatevoid removeJreEntries(Dependency dependency) { +215final Set<Identifier> identifiers = dependency.getIdentifiers(); +216final Iterator<Identifier> itr = identifiers.iterator(); +217while (itr.hasNext()) { +218finalIdentifier i = itr.next(); +219final Matcher coreCPE = CORE_JAVA.matcher(i.getValue()); +220final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName()); +221if (coreCPE.matches() && !coreFiles.matches()) { +222 itr.remove(); +223 } +224final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue()); +225final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName()); +226if (coreJsfCPE.matches() && !coreJsfFiles.matches()) { +227 itr.remove(); +228 } +229 } +230 } +231 +232/** +233 * Parses a CPE string into an IndexEntry. +234 * +235 * @param type the type of identifier +236 * @param value the cpe identifier to parse +237 * @return an VulnerableSoftware object constructed from the identifier +238 */ +239privateVulnerableSoftware parseCpe(String type, String value) { +240if (!"cpe".equals(type)) { +241returnnull; +242 } +243finalVulnerableSoftware cpe = newVulnerableSoftware(); +244try { +245 cpe.parseName(value); +246 } catch (UnsupportedEncodingException ex) { +247 LOGGER.log(Level.FINEST, null, ex); +248returnnull; +249 } +250return cpe; +251 } +252 +253/** +254 * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific +255 * problems identified when testing this on a LARGE volume of jar files. +256 * +257 * @param dependency the dependency to analyze +258 */ +259privatevoid removeBadMatches(Dependency dependency) { +260final Set<Identifier> identifiers = dependency.getIdentifiers(); +261final Iterator<Identifier> itr = identifiers.iterator(); +262 +263/* TODO - can we utilize the pom's groupid and artifactId to filter??? most of +264 * these are due to low quality data. Other idea would be to say any CPE +265 * found based on LOW confidence evidence should have a different CPE type? (this +266 * might be a better solution then just removing the URL for "best-guess" matches). +267 */ +268//Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); +269//Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); +270while (itr.hasNext()) { +271finalIdentifier i = itr.next(); +272//TODO move this startsWith expression to a configuration file? +273if ("cpe".equals(i.getType())) { +274if ((i.getValue().matches(".*c\\+\\+.*") +275 || i.getValue().startsWith("cpe:/a:file:file") +276 || i.getValue().startsWith("cpe:/a:mozilla:mozilla") +277 || i.getValue().startsWith("cpe:/a:cvs:cvs") +278 || i.getValue().startsWith("cpe:/a:ftp:ftp") +279 || i.getValue().startsWith("cpe:/a:tcp:tcp") +280 || i.getValue().startsWith("cpe:/a:ssh:ssh") +281 || i.getValue().startsWith("cpe:/a:lookup:lookup")) +282 && (dependency.getFileName().toLowerCase().endsWith(".jar") +283 || dependency.getFileName().toLowerCase().endsWith("pom.xml") +284 || dependency.getFileName().toLowerCase().endsWith(".dll") +285 || dependency.getFileName().toLowerCase().endsWith(".exe") +286 || dependency.getFileName().toLowerCase().endsWith(".nuspec") +287 || dependency.getFileName().toLowerCase().endsWith(".nupkg"))) { +288 itr.remove(); +289 } elseif ((i.getValue().startsWith("cpe:/a:jquery:jquery") +290 || i.getValue().startsWith("cpe:/a:prototypejs:prototype") +291 || i.getValue().startsWith("cpe:/a:yahoo:yui")) +292 && (dependency.getFileName().toLowerCase().endsWith(".jar") +293 || dependency.getFileName().toLowerCase().endsWith("pom.xml") +294 || dependency.getFileName().toLowerCase().endsWith(".dll") +295 || dependency.getFileName().toLowerCase().endsWith(".exe"))) { +296 itr.remove(); +297 } elseif ((i.getValue().startsWith("cpe:/a:microsoft:excel") +298 || i.getValue().startsWith("cpe:/a:microsoft:word") +299 || i.getValue().startsWith("cpe:/a:microsoft:visio") +300 || i.getValue().startsWith("cpe:/a:microsoft:powerpoint") +301 || i.getValue().startsWith("cpe:/a:microsoft:office")) +302 && (dependency.getFileName().toLowerCase().endsWith(".jar") +303 || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { +304 itr.remove(); +305 } elseif (i.getValue().startsWith("cpe:/a:apache:maven") +306 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { +307 itr.remove(); +308 } elseif (i.getValue().startsWith("cpe:/a:m-core:m-core") +309 && !dependency.getEvidenceUsed().containsUsedString("m-core")) { +310 itr.remove(); +311 } elseif (i.getValue().startsWith("cpe:/a:jboss:jboss") +312 && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar")) { +313 itr.remove(); +314 } +315 } +316 } +317 } +318 +319/** +320 * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. +321 * +322 * @param dependency the dependency to analyze +323 */ +324privatevoid removeWrongVersionMatches(Dependency dependency) { +325final Set<Identifier> identifiers = dependency.getIdentifiers(); +326final Iterator<Identifier> itr = identifiers.iterator(); +327 +328final String fileName = dependency.getFileName(); +329if (fileName != null && fileName.contains("axis2")) { +330while (itr.hasNext()) { +331finalIdentifier i = itr.next(); +332if ("cpe".equals(i.getType())) { +333final String cpe = i.getValue(); +334if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { +335 itr.remove(); +336 } +337 } +338 } +339 } elseif (fileName != null && fileName.contains("axis")) { +340while (itr.hasNext()) { +341finalIdentifier i = itr.next(); +342if ("cpe".equals(i.getType())) { +343final String cpe = i.getValue(); +344if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { +345 itr.remove(); +346 } +347 } +348 } +349 } +350 } +351 +352/** +353 * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and +354 * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete +355 * list of CVE entries. +356 * +357 * @param dependency the dependency being analyzed +358 */ +359privatevoid addFalseNegativeCPEs(Dependency dependency) { +360//TODO move this to the hint analyzer +361final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +362while (itr.hasNext()) { +363finalIdentifier i = itr.next(); +364if ("cpe".equals(i.getType()) && i.getValue() != null +365 && (i.getValue().startsWith("cpe:/a:oracle:opensso:") +366 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:") +367 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:") +368 || i.getValue().startsWith("cpe:/a:sun:opensso:"))) { +369final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22)); +370final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22)); +371final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22)); +372final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22)); +373try { +374 dependency.addIdentifier("cpe", +375 newCpe, +376 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8"))); +377 dependency.addIdentifier("cpe", +378 newCpe2, +379 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8"))); +380 dependency.addIdentifier("cpe", +381 newCpe3, +382 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8"))); +383 dependency.addIdentifier("cpe", +384 newCpe4, +385 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8"))); +386 } catch (UnsupportedEncodingException ex) { +387 LOGGER.log(Level.FINE, null, ex); +388 } +389 } +390 } +391 } +392 +393/** +394 * Removes duplicate entries identified that are contained within JAR files. These occasionally crop up due to POM +395 * entries or other types of files (such as DLLs and EXEs) being contained within the JAR. +396 * +397 * @param dependency the dependency that might be a duplicate +398 * @param engine the engine used to scan all dependencies +399 */ +400privatevoid removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) { +401if (dependency.getFileName().toLowerCase().endsWith("pom.xml") +402 || "dll".equals(dependency.getFileExtension()) +403 || "exe".equals(dependency.getFileExtension())) { +404 String parentPath = dependency.getFilePath().toLowerCase(); +405if (parentPath.contains(".jar")) { +406 parentPath = parentPath.substring(0, parentPath.indexOf(".jar") + 4); +407finalDependency parent = findDependency(parentPath, engine.getDependencies()); +408if (parent != null) { +409boolean remove = false; +410for (Identifier i : dependency.getIdentifiers()) { +411if ("cpe".equals(i.getType())) { +412final String trimmedCPE = trimCpeToVendor(i.getValue()); +413for (Identifier parentId : parent.getIdentifiers()) { +414if ("cpe".equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) { +415 remove |= true; +416 } +417 } +418 } +419if (!remove) { //we can escape early +420return; +421 } +422 } +423if (remove) { +424 engine.getDependencies().remove(dependency); +425 } +426 } +427 } +428 +429 } +430 } +431 +432/** +433 * Retrieves a given dependency, based on a given path, from a list of dependencies. +434 * +435 * @param dependencyPath the path of the dependency to return +436 * @param dependencies the collection of dependencies to search +437 * @return the dependency object for the given path, otherwise null +438 */ +439privateDependency findDependency(String dependencyPath, List<Dependency> dependencies) { +440for (Dependency d : dependencies) { +441if (d.getFilePath().equalsIgnoreCase(dependencyPath)) { +442return d; +443 } +444 } +445returnnull; +446 } +447 +448/** +449 * Takes a full CPE and returns the CPE trimmed to include only vendor and product. +450 * +451 * @param value the CPE value to trim +452 * @return a CPE value that only includes the vendor and product +453 */ +454private String trimCpeToVendor(String value) { +455//cpe:/a:jruby:jruby:1.0.8 +456finalint pos1 = value.indexOf(":", 7); //right of vendor +457finalint pos2 = value.indexOf(":", pos1 + 1); //right of product +458if (pos2 < 0) { +459return value; +460 } else { +461return value.substring(0, pos2); +462 } +463 } +464 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html index afbf02499..fe3658e13 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html @@ -595,7 +595,7 @@ 587 groupid = groupid.substring(4); 588 } 589 foundSomething = true; -590 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); +590 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGHEST); 591 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); 592 addMatchingValues(classes, groupid, dependency.getVendorEvidence()); 593 addMatchingValues(classes, groupid, dependency.getProductEvidence()); @@ -624,7 +624,7 @@ 616 artifactid = artifactid.substring(4); 617 } 618 foundSomething = true; -619 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); +619 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGHEST); 620 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); 621 addMatchingValues(classes, artifactid, dependency.getVendorEvidence()); 622 addMatchingValues(classes, artifactid, dependency.getProductEvidence()); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html index 0a607bee7..967bf0ff8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.analyzer.exception + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.analyzer.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html index ec6814c10..b9c729632 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.analyzer.exception + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.analyzer.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html index bd25c673f..054c83e52 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html index fa2ce74a0..5bee9e09c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html index abb2c9443..b4962b030 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html index d83d4b2e9..fbb5bfea8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html index 66a6d26d7..6e93f8a45 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html index f3694cf2a..54cfde0f4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html index fe987970c..f231a34a3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html index 6fafe0013..77d47eb2c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html index 7bb7aa186..c03583b23 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html index b54087873..351d24f0f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html index 84f4adb43..0fcb98ded 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html index 8de5145d9..0cf7fcbdb 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html index d7b046f13..401c7ec04 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html index ad7c11ca2..f6a9999c8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html index ee6f04c13..e6213907b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.exception + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html index 84d52fb6d..0fd312b35 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.exception + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html index 345a0847b..d675c0138 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html index 07c2f12b7..87f241b71 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html index 9b2276a97..88857601f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.task + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.task diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html index 0708552bc..b565938fc 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.task + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.task diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html index cf29a6f82..b61bd3b3f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html index 8b9c26254..260d1af06 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html index d650c597d..8f6094210 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html @@ -27,664 +27,665 @@ 1920import java.io.File; 21import java.io.IOException; -22import java.security.NoSuchAlgorithmException; -23import java.util.Set; -24import java.util.SortedSet; -25import java.util.TreeSet; -26import java.util.logging.Level; -27import java.util.logging.Logger; -28import org.owasp.dependencycheck.utils.Checksum; -29import org.owasp.dependencycheck.utils.FileUtils; -30 -31/** -32 * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect -33 * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any -34 * known, published, vulnerabilities associated with the program dependency. -35 * -36 * @author Jeremy Long <jeremy.long@owasp.org> -37 */ -38publicclassDependencyimplements Comparable<Dependency> { -39 -40/** -41 * The logger. -42 */ -43privatestaticfinal Logger LOGGER = Logger.getLogger(Dependency.class.getName()); -44/** -45 * The actual file path of the dependency on disk. -46 */ -47private String actualFilePath; -48/** -49 * The file path to display. -50 */ -51private String filePath; -52/** -53 * The file name of the dependency. -54 */ -55private String fileName; -56/** -57 * The file extension of the dependency. -58 */ -59private String fileExtension; -60/** -61 * The md5 hash of the dependency. -62 */ -63private String md5sum; -64/** -65 * The SHA1 hash of the dependency. -66 */ -67private String sha1sum; -68/** -69 * A list of Identifiers. -70 */ -71private Set<Identifier> identifiers; -72/** -73 * A collection of vendor evidence. -74 */ -75privatefinalEvidenceCollection vendorEvidence; -76/** -77 * A collection of product evidence. -78 */ -79privatefinalEvidenceCollection productEvidence; -80/** -81 * A collection of version evidence. -82 */ -83privatefinalEvidenceCollection versionEvidence; -84 -85/** -86 * Constructs a new Dependency object. -87 */ -88publicDependency() { -89 vendorEvidence = newEvidenceCollection(); -90 productEvidence = newEvidenceCollection(); -91 versionEvidence = newEvidenceCollection(); -92 identifiers = new TreeSet<Identifier>(); -93 vulnerabilities = new TreeSet<Vulnerability>(newVulnerabilityComparator()); -94 suppressedIdentifiers = new TreeSet<Identifier>(); -95 suppressedVulnerabilities = new TreeSet<Vulnerability>(newVulnerabilityComparator()); -96 } -97 -98/** -99 * Constructs a new Dependency object. -100 * -101 * @param file the File to create the dependency object from. -102 */ -103publicDependency(File file) { -104this(); -105this.actualFilePath = file.getPath(); -106this.filePath = this.actualFilePath; -107this.fileName = file.getName(); -108this.fileExtension = FileUtils.getFileExtension(fileName); -109 determineHashes(file); -110 } -111 -112/** -113 * Returns the file name of the dependency. -114 * -115 * @return the file name of the dependency -116 */ -117public String getFileName() { -118returnthis.fileName; -119 } -120 -121/** -122 * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack -123 * as I could not get the replace to work in the template itself. -124 * -125 * @return the file name of the dependency with the backslash escaped for use in JavaScript -126 */ -127public String getFileNameForJavaScript() { -128returnthis.fileName.replace("\\", "\\\\"); -129 } -130 -131/** -132 * Sets the file name of the dependency. -133 * -134 * @param fileName the file name of the dependency -135 */ -136publicvoid setFileName(String fileName) { -137this.fileName = fileName; -138 } -139 -140/** -141 * Sets the actual file path of the dependency on disk. -142 * -143 * @param actualFilePath the file path of the dependency -144 */ -145publicvoid setActualFilePath(String actualFilePath) { -146this.actualFilePath = actualFilePath; -147if (this.sha1sum == null) { -148final File file = new File(this.actualFilePath); -149 determineHashes(file); -150 } -151 } -152 -153/** -154 * Gets the file path of the dependency. -155 * -156 * @return the file path of the dependency -157 */ -158public String getActualFilePath() { -159returnthis.actualFilePath; -160 } -161 -162/** -163 * Gets a reference to the File object. -164 * -165 * @return the File object -166 */ -167public File getActualFile() { -168returnnew File(this.actualFilePath); -169 } -170 -171/** -172 * Sets the file path of the dependency. -173 * -174 * @param filePath the file path of the dependency -175 */ -176publicvoid setFilePath(String filePath) { -177this.filePath = filePath; -178 } -179 -180/** -181 * The file name to display in reports. -182 */ -183private String displayName = null; -184 -185/** -186 * Sets the file name to display in reports. -187 * -188 * @param displayName the name to display -189 */ -190publicvoid setDisplayFileName(String displayName) { -191this.displayName = displayName; -192 } -193 -194/** -195 * Returns the file name to display in reports; if no display file name has been set it will default to the actual -196 * file name. -197 * -198 * @return the file name to display -199 */ -200public String getDisplayFileName() { -201if (displayName == null) { -202returnthis.fileName; -203 } -204returnthis.displayName; -205 } -206 -207/** -208 * <p> -209 * Gets the file path of the dependency.</p> -210 * <p> -211 * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be -212 * obtained via the getActualFilePath().</p> -213 * -214 * @return the file path of the dependency -215 */ -216public String getFilePath() { -217returnthis.filePath; -218 } -219 -220/** -221 * Sets the file name of the dependency. -222 * -223 * @param fileExtension the file name of the dependency -224 */ -225publicvoid setFileExtension(String fileExtension) { -226this.fileExtension = fileExtension; -227 } -228 -229/** -230 * Gets the file extension of the dependency. -231 * -232 * @return the file extension of the dependency -233 */ -234public String getFileExtension() { -235returnthis.fileExtension; -236 } -237 -238/** -239 * Returns the MD5 Checksum of the dependency file. -240 * -241 * @return the MD5 Checksum -242 */ -243public String getMd5sum() { -244returnthis.md5sum; -245 } -246 -247/** -248 * Sets the MD5 Checksum of the dependency. -249 * -250 * @param md5sum the MD5 Checksum -251 */ -252publicvoid setMd5sum(String md5sum) { -253this.md5sum = md5sum; -254 } -255 -256/** -257 * Returns the SHA1 Checksum of the dependency. -258 * -259 * @return the SHA1 Checksum -260 */ -261public String getSha1sum() { -262returnthis.sha1sum; -263 } -264 -265/** -266 * Sets the SHA1 Checksum of the dependency. -267 * -268 * @param sha1sum the SHA1 Checksum -269 */ -270publicvoid setSha1sum(String sha1sum) { -271this.sha1sum = sha1sum; -272 } -273 -274/** -275 * Returns a List of Identifiers. -276 * -277 * @return an ArrayList of Identifiers -278 */ -279public Set<Identifier> getIdentifiers() { -280returnthis.identifiers; -281 } -282 -283/** -284 * Sets a List of Identifiers. -285 * -286 * @param identifiers A list of Identifiers -287 */ -288publicvoid setIdentifiers(Set<Identifier> identifiers) { -289this.identifiers = identifiers; -290 } -291 -292/** -293 * Adds an entry to the list of detected Identifiers for the dependency file. -294 * -295 * @param type the type of identifier (such as CPE) -296 * @param value the value of the identifier -297 * @param url the URL of the identifier -298 */ -299publicvoid addIdentifier(String type, String value, String url) { -300finalIdentifier i = newIdentifier(type, value, url); -301this.identifiers.add(i); -302 } -303 -304/** -305 * Adds an entry to the list of detected Identifiers for the dependency file. -306 * -307 * @param type the type of identifier (such as CPE) -308 * @param value the value of the identifier -309 * @param url the URL of the identifier -310 * @param confidence the confidence in the Identifier being accurate -311 */ -312publicvoid addIdentifier(String type, String value, String url, Confidence confidence) { -313finalIdentifier i = newIdentifier(type, value, url); -314 i.setConfidence(confidence); -315this.identifiers.add(i); -316 } -317 -318/** -319 * Adds an entry to the list of detected Identifiers for the dependency file. -320 * -321 * @param identifier the identifier to add -322 */ -323publicvoid addIdentifier(Identifier identifier) { -324this.identifiers.add(identifier); -325 } -326/** -327 * A set of identifiers that have been suppressed. -328 */ -329private Set<Identifier> suppressedIdentifiers; -330 -331/** -332 * Get the value of suppressedIdentifiers. -333 * -334 * @return the value of suppressedIdentifiers -335 */ -336public Set<Identifier> getSuppressedIdentifiers() { -337return suppressedIdentifiers; -338 } -339 -340/** -341 * Set the value of suppressedIdentifiers. -342 * -343 * @param suppressedIdentifiers new value of suppressedIdentifiers -344 */ -345publicvoid setSuppressedIdentifiers(Set<Identifier> suppressedIdentifiers) { -346this.suppressedIdentifiers = suppressedIdentifiers; -347 } -348 -349/** -350 * Adds an identifier to the list of suppressed identifiers. -351 * -352 * @param identifier an identifier that was suppressed. -353 */ -354publicvoid addSuppressedIdentifier(Identifier identifier) { -355this.suppressedIdentifiers.add(identifier); -356 } -357 -358/** -359 * A set of vulnerabilities that have been suppressed. -360 */ -361private SortedSet<Vulnerability> suppressedVulnerabilities; -362 -363/** -364 * Get the value of suppressedVulnerabilities. -365 * -366 * @return the value of suppressedVulnerabilities -367 */ -368public SortedSet<Vulnerability> getSuppressedVulnerabilities() { -369return suppressedVulnerabilities; -370 } -371 -372/** -373 * Set the value of suppressedVulnerabilities. -374 * -375 * @param suppressedVulnerabilities new value of suppressedVulnerabilities -376 */ -377publicvoid setSuppressedVulnerabilities(SortedSet<Vulnerability> suppressedVulnerabilities) { -378this.suppressedVulnerabilities = suppressedVulnerabilities; -379 } -380 -381/** -382 * Adds a vulnerability to the set of suppressed vulnerabilities. -383 * -384 * @param vulnerability the vulnerability that was suppressed -385 */ -386publicvoid addSuppressedVulnerability(Vulnerability vulnerability) { -387this.suppressedVulnerabilities.add(vulnerability); -388 } -389 -390/** -391 * Returns the evidence used to identify this dependency. -392 * -393 * @return an EvidenceCollection. -394 */ -395publicEvidenceCollection getEvidence() { -396return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); -397 } -398 -399/** -400 * Returns the evidence used to identify this dependency. -401 * -402 * @return an EvidenceCollection. -403 */ -404public Set<Evidence> getEvidenceForDisplay() { -405return EvidenceCollection.mergeForDisplay(this.productEvidence, this.vendorEvidence, this.versionEvidence); -406 } -407 -408/** -409 * Returns the evidence used to identify this dependency. -410 * -411 * @return an EvidenceCollection. -412 */ -413publicEvidenceCollection getEvidenceUsed() { -414return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence); -415 } -416 -417/** -418 * Gets the Vendor Evidence. -419 * -420 * @return an EvidenceCollection. -421 */ -422publicEvidenceCollection getVendorEvidence() { -423returnthis.vendorEvidence; -424 } -425 -426/** -427 * Gets the Product Evidence. -428 * -429 * @return an EvidenceCollection. -430 */ -431publicEvidenceCollection getProductEvidence() { -432returnthis.productEvidence; -433 } -434 -435/** -436 * Gets the Version Evidence. -437 * -438 * @return an EvidenceCollection. -439 */ -440publicEvidenceCollection getVersionEvidence() { -441returnthis.versionEvidence; -442 } -443/** -444 * The description of the JAR file. -445 */ -446private String description; -447 -448/** -449 * Get the value of description. -450 * -451 * @return the value of description -452 */ -453public String getDescription() { -454return description; -455 } -456 -457/** -458 * Set the value of description. -459 * -460 * @param description new value of description -461 */ -462publicvoid setDescription(String description) { -463this.description = description; -464 } -465/** -466 * The license that this dependency uses. -467 */ -468private String license; -469 -470/** -471 * Get the value of license. -472 * -473 * @return the value of license -474 */ -475public String getLicense() { -476return license; -477 } -478 -479/** -480 * Set the value of license. -481 * -482 * @param license new value of license -483 */ -484publicvoid setLicense(String license) { -485this.license = license; -486 } -487/** -488 * A list of vulnerabilities for this dependency. -489 */ -490private SortedSet<Vulnerability> vulnerabilities; -491 -492/** -493 * Get the list of vulnerabilities. -494 * -495 * @return the list of vulnerabilities -496 */ -497public SortedSet<Vulnerability> getVulnerabilities() { -498return vulnerabilities; -499 } -500 -501/** -502 * Set the value of vulnerabilities. -503 * -504 * @param vulnerabilities new value of vulnerabilities -505 */ -506publicvoid setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) { -507this.vulnerabilities = vulnerabilities; -508 } -509 -510/** -511 * Determines the sha1 and md5 sum for the given file. -512 * -513 * @param file the file to create checksums for -514 */ -515privatevoid determineHashes(File file) { -516 String md5 = null; -517 String sha1 = null; -518try { -519 md5 = Checksum.getMD5Checksum(file); -520 sha1 = Checksum.getSHA1Checksum(file); -521 } catch (IOException ex) { -522final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName()); -523 LOGGER.log(Level.WARNING, msg); -524 LOGGER.log(Level.FINE, null, ex); -525 } catch (NoSuchAlgorithmException ex) { -526final String msg = "Unable to use MD5 of SHA1 checksums."; -527 LOGGER.log(Level.WARNING, msg); -528 LOGGER.log(Level.FINE, null, ex); -529 } -530this.setMd5sum(md5); -531this.setSha1sum(sha1); -532 } -533 -534/** -535 * Adds a vulnerability to the dependency. -536 * -537 * @param vulnerability a vulnerability outlining a vulnerability. -538 */ -539publicvoid addVulnerability(Vulnerability vulnerability) { -540this.vulnerabilities.add(vulnerability); -541 } -542/** -543 * A collection of related dependencies. -544 */ -545private Set<Dependency> relatedDependencies = new TreeSet<Dependency>(); -546 -547/** -548 * Get the value of relatedDependencies. -549 * -550 * @return the value of relatedDependencies -551 */ -552public Set<Dependency> getRelatedDependencies() { -553return relatedDependencies; -554 } -555 -556/** -557 * Set the value of relatedDependencies. -558 * -559 * @param relatedDependencies new value of relatedDependencies -560 */ -561publicvoid setRelatedDependencies(Set<Dependency> relatedDependencies) { -562this.relatedDependencies = relatedDependencies; -563 } -564 -565/** -566 * Adds a related dependency. -567 * -568 * @param dependency a reference to the related dependency -569 */ -570publicvoid addRelatedDependency(Dependency dependency) { -571 relatedDependencies.add(dependency); -572 } -573 -574/** -575 * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name. -576 * -577 * @param o a dependency to compare -578 * @return an integer representing the natural ordering -579 */ -580publicint compareTo(Dependency o) { -581returnthis.getFileName().compareToIgnoreCase(o.getFileName()); -582 } -583 -584/** -585 * Implementation of the equals method. -586 * -587 * @param obj the object to compare -588 * @return true if the objects are equal, otherwise false -589 */ -590 @Override -591publicboolean equals(Object obj) { -592if (obj == null) { -593return false; -594 } -595if (getClass() != obj.getClass()) { -596return false; -597 } -598finalDependency other = (Dependency) obj; -599if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) { -600return false; -601 } -602if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) { -603return false; -604 } -605if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) { -606return false; -607 } -608if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) { -609return false; -610 } -611if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) { -612return false; -613 } -614if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) { -615return false; -616 } -617if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) { -618return false; -619 } -620if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) { -621return false; -622 } -623if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) { -624return false; -625 } -626if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) { -627return false; -628 } -629if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) { -630return false; -631 } -632if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) { -633return false; -634 } -635if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) { -636return false; -637 } -638if (this.relatedDependencies != other.relatedDependencies -639 && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) { -640return false; -641 } -642returntrue; -643 } -644 -645/** -646 * Generates the HashCode. -647 * -648 * @return the HashCode -649 */ -650 @Override -651publicint hashCode() { -652int hash = 3; -653 hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0); -654 hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0); -655 hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0); -656 hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0); -657 hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0); -658 hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0); -659 hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0); -660 hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0); -661 hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0); -662 hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0); -663 hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0); -664 hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0); -665 hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0); -666 hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0); -667return hash; -668 } -669 -670/** -671 * Standard toString() implementation showing the filename, actualFilePath, and filePath. -672 * -673 * @return the string representation of the file -674 */ -675 @Override -676public String toString() { -677return"Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}"; -678 } -679 } +22import java.io.Serializable; +23import java.security.NoSuchAlgorithmException; +24import java.util.Set; +25import java.util.SortedSet; +26import java.util.TreeSet; +27import java.util.logging.Level; +28import java.util.logging.Logger; +29import org.owasp.dependencycheck.utils.Checksum; +30import org.owasp.dependencycheck.utils.FileUtils; +31 +32/** +33 * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect +34 * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any +35 * known, published, vulnerabilities associated with the program dependency. +36 * +37 * @author Jeremy Long <jeremy.long@owasp.org> +38 */ +39publicclassDependencyimplements Serializable, Comparable<Dependency> { +40 +41/** +42 * The logger. +43 */ +44privatestaticfinal Logger LOGGER = Logger.getLogger(Dependency.class.getName()); +45/** +46 * The actual file path of the dependency on disk. +47 */ +48private String actualFilePath; +49/** +50 * The file path to display. +51 */ +52private String filePath; +53/** +54 * The file name of the dependency. +55 */ +56private String fileName; +57/** +58 * The file extension of the dependency. +59 */ +60private String fileExtension; +61/** +62 * The md5 hash of the dependency. +63 */ +64private String md5sum; +65/** +66 * The SHA1 hash of the dependency. +67 */ +68private String sha1sum; +69/** +70 * A list of Identifiers. +71 */ +72private Set<Identifier> identifiers; +73/** +74 * A collection of vendor evidence. +75 */ +76privatefinalEvidenceCollection vendorEvidence; +77/** +78 * A collection of product evidence. +79 */ +80privatefinalEvidenceCollection productEvidence; +81/** +82 * A collection of version evidence. +83 */ +84privatefinalEvidenceCollection versionEvidence; +85 +86/** +87 * Constructs a new Dependency object. +88 */ +89publicDependency() { +90 vendorEvidence = newEvidenceCollection(); +91 productEvidence = newEvidenceCollection(); +92 versionEvidence = newEvidenceCollection(); +93 identifiers = new TreeSet<Identifier>(); +94 vulnerabilities = new TreeSet<Vulnerability>(newVulnerabilityComparator()); +95 suppressedIdentifiers = new TreeSet<Identifier>(); +96 suppressedVulnerabilities = new TreeSet<Vulnerability>(newVulnerabilityComparator()); +97 } +98 +99/** +100 * Constructs a new Dependency object. +101 * +102 * @param file the File to create the dependency object from. +103 */ +104publicDependency(File file) { +105this(); +106this.actualFilePath = file.getPath(); +107this.filePath = this.actualFilePath; +108this.fileName = file.getName(); +109this.fileExtension = FileUtils.getFileExtension(fileName); +110 determineHashes(file); +111 } +112 +113/** +114 * Returns the file name of the dependency. +115 * +116 * @return the file name of the dependency +117 */ +118public String getFileName() { +119returnthis.fileName; +120 } +121 +122/** +123 * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack +124 * as I could not get the replace to work in the template itself. +125 * +126 * @return the file name of the dependency with the backslash escaped for use in JavaScript +127 */ +128public String getFileNameForJavaScript() { +129returnthis.fileName.replace("\\", "\\\\"); +130 } +131 +132/** +133 * Sets the file name of the dependency. +134 * +135 * @param fileName the file name of the dependency +136 */ +137publicvoid setFileName(String fileName) { +138this.fileName = fileName; +139 } +140 +141/** +142 * Sets the actual file path of the dependency on disk. +143 * +144 * @param actualFilePath the file path of the dependency +145 */ +146publicvoid setActualFilePath(String actualFilePath) { +147this.actualFilePath = actualFilePath; +148if (this.sha1sum == null) { +149final File file = new File(this.actualFilePath); +150 determineHashes(file); +151 } +152 } +153 +154/** +155 * Gets the file path of the dependency. +156 * +157 * @return the file path of the dependency +158 */ +159public String getActualFilePath() { +160returnthis.actualFilePath; +161 } +162 +163/** +164 * Gets a reference to the File object. +165 * +166 * @return the File object +167 */ +168public File getActualFile() { +169returnnew File(this.actualFilePath); +170 } +171 +172/** +173 * Sets the file path of the dependency. +174 * +175 * @param filePath the file path of the dependency +176 */ +177publicvoid setFilePath(String filePath) { +178this.filePath = filePath; +179 } +180 +181/** +182 * The file name to display in reports. +183 */ +184private String displayName = null; +185 +186/** +187 * Sets the file name to display in reports. +188 * +189 * @param displayName the name to display +190 */ +191publicvoid setDisplayFileName(String displayName) { +192this.displayName = displayName; +193 } +194 +195/** +196 * Returns the file name to display in reports; if no display file name has been set it will default to the actual +197 * file name. +198 * +199 * @return the file name to display +200 */ +201public String getDisplayFileName() { +202if (displayName == null) { +203returnthis.fileName; +204 } +205returnthis.displayName; +206 } +207 +208/** +209 * <p> +210 * Gets the file path of the dependency.</p> +211 * <p> +212 * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be +213 * obtained via the getActualFilePath().</p> +214 * +215 * @return the file path of the dependency +216 */ +217public String getFilePath() { +218returnthis.filePath; +219 } +220 +221/** +222 * Sets the file name of the dependency. +223 * +224 * @param fileExtension the file name of the dependency +225 */ +226publicvoid setFileExtension(String fileExtension) { +227this.fileExtension = fileExtension; +228 } +229 +230/** +231 * Gets the file extension of the dependency. +232 * +233 * @return the file extension of the dependency +234 */ +235public String getFileExtension() { +236returnthis.fileExtension; +237 } +238 +239/** +240 * Returns the MD5 Checksum of the dependency file. +241 * +242 * @return the MD5 Checksum +243 */ +244public String getMd5sum() { +245returnthis.md5sum; +246 } +247 +248/** +249 * Sets the MD5 Checksum of the dependency. +250 * +251 * @param md5sum the MD5 Checksum +252 */ +253publicvoid setMd5sum(String md5sum) { +254this.md5sum = md5sum; +255 } +256 +257/** +258 * Returns the SHA1 Checksum of the dependency. +259 * +260 * @return the SHA1 Checksum +261 */ +262public String getSha1sum() { +263returnthis.sha1sum; +264 } +265 +266/** +267 * Sets the SHA1 Checksum of the dependency. +268 * +269 * @param sha1sum the SHA1 Checksum +270 */ +271publicvoid setSha1sum(String sha1sum) { +272this.sha1sum = sha1sum; +273 } +274 +275/** +276 * Returns a List of Identifiers. +277 * +278 * @return an ArrayList of Identifiers +279 */ +280public Set<Identifier> getIdentifiers() { +281returnthis.identifiers; +282 } +283 +284/** +285 * Sets a List of Identifiers. +286 * +287 * @param identifiers A list of Identifiers +288 */ +289publicvoid setIdentifiers(Set<Identifier> identifiers) { +290this.identifiers = identifiers; +291 } +292 +293/** +294 * Adds an entry to the list of detected Identifiers for the dependency file. +295 * +296 * @param type the type of identifier (such as CPE) +297 * @param value the value of the identifier +298 * @param url the URL of the identifier +299 */ +300publicvoid addIdentifier(String type, String value, String url) { +301finalIdentifier i = newIdentifier(type, value, url); +302this.identifiers.add(i); +303 } +304 +305/** +306 * Adds an entry to the list of detected Identifiers for the dependency file. +307 * +308 * @param type the type of identifier (such as CPE) +309 * @param value the value of the identifier +310 * @param url the URL of the identifier +311 * @param confidence the confidence in the Identifier being accurate +312 */ +313publicvoid addIdentifier(String type, String value, String url, Confidence confidence) { +314finalIdentifier i = newIdentifier(type, value, url); +315 i.setConfidence(confidence); +316this.identifiers.add(i); +317 } +318 +319/** +320 * Adds an entry to the list of detected Identifiers for the dependency file. +321 * +322 * @param identifier the identifier to add +323 */ +324publicvoid addIdentifier(Identifier identifier) { +325this.identifiers.add(identifier); +326 } +327/** +328 * A set of identifiers that have been suppressed. +329 */ +330private Set<Identifier> suppressedIdentifiers; +331 +332/** +333 * Get the value of suppressedIdentifiers. +334 * +335 * @return the value of suppressedIdentifiers +336 */ +337public Set<Identifier> getSuppressedIdentifiers() { +338return suppressedIdentifiers; +339 } +340 +341/** +342 * Set the value of suppressedIdentifiers. +343 * +344 * @param suppressedIdentifiers new value of suppressedIdentifiers +345 */ +346publicvoid setSuppressedIdentifiers(Set<Identifier> suppressedIdentifiers) { +347this.suppressedIdentifiers = suppressedIdentifiers; +348 } +349 +350/** +351 * Adds an identifier to the list of suppressed identifiers. +352 * +353 * @param identifier an identifier that was suppressed. +354 */ +355publicvoid addSuppressedIdentifier(Identifier identifier) { +356this.suppressedIdentifiers.add(identifier); +357 } +358 +359/** +360 * A set of vulnerabilities that have been suppressed. +361 */ +362private SortedSet<Vulnerability> suppressedVulnerabilities; +363 +364/** +365 * Get the value of suppressedVulnerabilities. +366 * +367 * @return the value of suppressedVulnerabilities +368 */ +369public SortedSet<Vulnerability> getSuppressedVulnerabilities() { +370return suppressedVulnerabilities; +371 } +372 +373/** +374 * Set the value of suppressedVulnerabilities. +375 * +376 * @param suppressedVulnerabilities new value of suppressedVulnerabilities +377 */ +378publicvoid setSuppressedVulnerabilities(SortedSet<Vulnerability> suppressedVulnerabilities) { +379this.suppressedVulnerabilities = suppressedVulnerabilities; +380 } +381 +382/** +383 * Adds a vulnerability to the set of suppressed vulnerabilities. +384 * +385 * @param vulnerability the vulnerability that was suppressed +386 */ +387publicvoid addSuppressedVulnerability(Vulnerability vulnerability) { +388this.suppressedVulnerabilities.add(vulnerability); +389 } +390 +391/** +392 * Returns the evidence used to identify this dependency. +393 * +394 * @return an EvidenceCollection. +395 */ +396publicEvidenceCollection getEvidence() { +397return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); +398 } +399 +400/** +401 * Returns the evidence used to identify this dependency. +402 * +403 * @return an EvidenceCollection. +404 */ +405public Set<Evidence> getEvidenceForDisplay() { +406return EvidenceCollection.mergeForDisplay(this.productEvidence, this.vendorEvidence, this.versionEvidence); +407 } +408 +409/** +410 * Returns the evidence used to identify this dependency. +411 * +412 * @return an EvidenceCollection. +413 */ +414publicEvidenceCollection getEvidenceUsed() { +415return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence); +416 } +417 +418/** +419 * Gets the Vendor Evidence. +420 * +421 * @return an EvidenceCollection. +422 */ +423publicEvidenceCollection getVendorEvidence() { +424returnthis.vendorEvidence; +425 } +426 +427/** +428 * Gets the Product Evidence. +429 * +430 * @return an EvidenceCollection. +431 */ +432publicEvidenceCollection getProductEvidence() { +433returnthis.productEvidence; +434 } +435 +436/** +437 * Gets the Version Evidence. +438 * +439 * @return an EvidenceCollection. +440 */ +441publicEvidenceCollection getVersionEvidence() { +442returnthis.versionEvidence; +443 } +444/** +445 * The description of the JAR file. +446 */ +447private String description; +448 +449/** +450 * Get the value of description. +451 * +452 * @return the value of description +453 */ +454public String getDescription() { +455return description; +456 } +457 +458/** +459 * Set the value of description. +460 * +461 * @param description new value of description +462 */ +463publicvoid setDescription(String description) { +464this.description = description; +465 } +466/** +467 * The license that this dependency uses. +468 */ +469private String license; +470 +471/** +472 * Get the value of license. +473 * +474 * @return the value of license +475 */ +476public String getLicense() { +477return license; +478 } +479 +480/** +481 * Set the value of license. +482 * +483 * @param license new value of license +484 */ +485publicvoid setLicense(String license) { +486this.license = license; +487 } +488/** +489 * A list of vulnerabilities for this dependency. +490 */ +491private SortedSet<Vulnerability> vulnerabilities; +492 +493/** +494 * Get the list of vulnerabilities. +495 * +496 * @return the list of vulnerabilities +497 */ +498public SortedSet<Vulnerability> getVulnerabilities() { +499return vulnerabilities; +500 } +501 +502/** +503 * Set the value of vulnerabilities. +504 * +505 * @param vulnerabilities new value of vulnerabilities +506 */ +507publicvoid setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) { +508this.vulnerabilities = vulnerabilities; +509 } +510 +511/** +512 * Determines the sha1 and md5 sum for the given file. +513 * +514 * @param file the file to create checksums for +515 */ +516privatevoid determineHashes(File file) { +517 String md5 = null; +518 String sha1 = null; +519try { +520 md5 = Checksum.getMD5Checksum(file); +521 sha1 = Checksum.getSHA1Checksum(file); +522 } catch (IOException ex) { +523final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName()); +524 LOGGER.log(Level.WARNING, msg); +525 LOGGER.log(Level.FINE, null, ex); +526 } catch (NoSuchAlgorithmException ex) { +527final String msg = "Unable to use MD5 of SHA1 checksums."; +528 LOGGER.log(Level.WARNING, msg); +529 LOGGER.log(Level.FINE, null, ex); +530 } +531this.setMd5sum(md5); +532this.setSha1sum(sha1); +533 } +534 +535/** +536 * Adds a vulnerability to the dependency. +537 * +538 * @param vulnerability a vulnerability outlining a vulnerability. +539 */ +540publicvoid addVulnerability(Vulnerability vulnerability) { +541this.vulnerabilities.add(vulnerability); +542 } +543/** +544 * A collection of related dependencies. +545 */ +546private Set<Dependency> relatedDependencies = new TreeSet<Dependency>(); +547 +548/** +549 * Get the value of relatedDependencies. +550 * +551 * @return the value of relatedDependencies +552 */ +553public Set<Dependency> getRelatedDependencies() { +554return relatedDependencies; +555 } +556 +557/** +558 * Set the value of relatedDependencies. +559 * +560 * @param relatedDependencies new value of relatedDependencies +561 */ +562publicvoid setRelatedDependencies(Set<Dependency> relatedDependencies) { +563this.relatedDependencies = relatedDependencies; +564 } +565 +566/** +567 * Adds a related dependency. +568 * +569 * @param dependency a reference to the related dependency +570 */ +571publicvoid addRelatedDependency(Dependency dependency) { +572 relatedDependencies.add(dependency); +573 } +574 +575/** +576 * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name. +577 * +578 * @param o a dependency to compare +579 * @return an integer representing the natural ordering +580 */ +581publicint compareTo(Dependency o) { +582returnthis.getFileName().compareToIgnoreCase(o.getFileName()); +583 } +584 +585/** +586 * Implementation of the equals method. +587 * +588 * @param obj the object to compare +589 * @return true if the objects are equal, otherwise false +590 */ +591 @Override +592publicboolean equals(Object obj) { +593if (obj == null) { +594return false; +595 } +596if (getClass() != obj.getClass()) { +597return false; +598 } +599finalDependency other = (Dependency) obj; +600if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) { +601return false; +602 } +603if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) { +604return false; +605 } +606if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) { +607return false; +608 } +609if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) { +610return false; +611 } +612if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) { +613return false; +614 } +615if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) { +616return false; +617 } +618if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) { +619return false; +620 } +621if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) { +622return false; +623 } +624if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) { +625return false; +626 } +627if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) { +628return false; +629 } +630if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) { +631return false; +632 } +633if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) { +634return false; +635 } +636if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) { +637return false; +638 } +639if (this.relatedDependencies != other.relatedDependencies +640 && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) { +641return false; +642 } +643returntrue; +644 } +645 +646/** +647 * Generates the HashCode. +648 * +649 * @return the HashCode +650 */ +651 @Override +652publicint hashCode() { +653int hash = 3; +654 hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0); +655 hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0); +656 hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0); +657 hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0); +658 hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0); +659 hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0); +660 hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0); +661 hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0); +662 hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0); +663 hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0); +664 hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0); +665 hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0); +666 hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0); +667 hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0); +668return hash; +669 } +670 +671/** +672 * Standard toString() implementation showing the filename, actualFilePath, and filePath. +673 * +674 * @return the string representation of the file +675 */ +676 @Override +677public String toString() { +678return"Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}"; +679 } +680 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html index 9184d161c..4dcf7efef 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html @@ -25,301 +25,303 @@ 17 */18package org.owasp.dependencycheck.dependency; 19 -20/** -21 * Evidence is a piece of information about a Dependency. -22 * -23 * @author Jeremy Long <jeremy.long@owasp.org> -24 */ -25publicclassEvidenceimplements Comparable<Evidence> { -26 -27/** -28 * Creates a new Evidence object. -29 */ -30publicEvidence() { -31 } -32 -33/** -34 * Creates a new Evidence objects. -35 * -36 * @param source the source of the evidence. -37 * @param name the name of the evidence. -38 * @param value the value of the evidence. -39 * @param confidence the confidence of the evidence. -40 */ -41publicEvidence(String source, String name, String value, Confidence confidence) { -42this.source = source; -43this.name = name; -44this.value = value; -45this.confidence = confidence; -46 } -47/** -48 * The name of the evidence. -49 */ -50private String name; -51 -52/** -53 * Get the value of name. -54 * -55 * @return the value of name -56 */ -57public String getName() { -58return name; -59 } -60 -61/** -62 * Set the value of name. -63 * -64 * @param name new value of name -65 */ -66publicvoid setName(String name) { -67this.name = name; -68 } -69/** -70 * The source of the evidence. -71 */ -72private String source; -73 -74/** -75 * Get the value of source. -76 * -77 * @return the value of source -78 */ -79public String getSource() { -80return source; -81 } -82 -83/** -84 * Set the value of source. -85 * -86 * @param source new value of source -87 */ -88publicvoid setSource(String source) { -89this.source = source; -90 } -91/** -92 * The value of the evidence. -93 */ -94private String value; -95 -96/** -97 * Get the value of value. -98 * -99 * @return the value of value -100 */ -101public String getValue() { -102 used = true; -103return value; -104 } -105 -106/** -107 * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used. -108 * -109 * @param setUsed whether or not this call to getValue should cause the used flag to be updated -110 * @return the value of value -111 */ -112public String getValue(Boolean setUsed) { -113 used = used || setUsed; -114return value; -115 } -116 -117/** -118 * Set the value of value. -119 * -120 * @param value new value of value -121 */ -122publicvoid setValue(String value) { -123this.value = value; -124 } -125/** -126 * A value indicating if the Evidence has been "used" (aka read). -127 */ -128privateboolean used; -129 -130/** -131 * Get the value of used. -132 * -133 * @return the value of used -134 */ -135publicboolean isUsed() { -136return used; -137 } -138 -139/** -140 * Set the value of used. -141 * -142 * @param used new value of used -143 */ -144publicvoid setUsed(boolean used) { -145this.used = used; -146 } -147/** -148 * The confidence level for the evidence. -149 */ -150privateConfidence confidence; -151 -152/** -153 * Get the value of confidence. -154 * -155 * @return the value of confidence -156 */ -157publicConfidence getConfidence() { -158return confidence; -159 } -160 -161/** -162 * Set the value of confidence. -163 * -164 * @param confidence new value of confidence -165 */ -166publicvoid setConfidence(Confidence confidence) { -167this.confidence = confidence; -168 } -169 -170/** -171 * Implements the hashCode for Evidence. -172 * -173 * @return hash code. -174 */ -175 @Override -176publicint hashCode() { -177int hash = 3; -178 hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0); -179 hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0); -180 hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0); -181 hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); -182return hash; -183 } -184 -185/** -186 * Implements equals for Evidence. -187 * -188 * @param that an object to check the equality of. -189 * @return whether the two objects are equal. -190 */ -191 @Override -192publicboolean equals(Object that) { -193if (this == that) { -194returntrue; -195 } -196if (!(that instanceof Evidence)) { -197return false; -198 } -199finalEvidence e = (Evidence) that; -200 -201return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value) -202 && (confidence == null ? e.confidence == null : confidence == e.confidence); -203 } -204 -205/** -206 * Simple equality test for use within the equals method. This does a case insensitive compare. -207 * -208 * @param l a string to compare. -209 * @param r another string to compare. -210 * @return whether the two strings are the same. -211 */ -212privateboolean testEquality(String l, String r) { -213return l == null ? r == null : l.equalsIgnoreCase(r); -214 } -215 -216/** -217 * Implementation of the comparable interface. -218 * -219 * @param o the evidence being compared -220 * @return an integer indicating the ordering of the two objects -221 */ -222publicint compareTo(Evidence o) { -223if (o == null) { -224return 1; -225 } -226if (equalsWithNullCheck(source, o.source)) { -227if (equalsWithNullCheck(name, o.name)) { -228if (equalsWithNullCheck(value, o.value)) { -229if (equalsWithNullCheck(confidence, o.confidence)) { -230return 0; //they are equal -231 } else { -232return compareToWithNullCheck(confidence, o.confidence); -233 } -234 } else { -235return compareToIgnoreCaseWithNullCheck(value, o.value); -236 } -237 } else { -238return compareToIgnoreCaseWithNullCheck(name, o.name); -239 } -240 } else { -241return compareToIgnoreCaseWithNullCheck(source, o.source); -242 } -243 } -244 -245/** -246 * Equality check with an exhaustive, possibly duplicative, check against nulls. -247 * -248 * @param me the value to be compared -249 * @param other the other value to be compared -250 * @return true if the values are equal; otherwise false -251 */ -252privateboolean equalsWithNullCheck(String me, String other) { -253if (me == null && other == null) { -254returntrue; -255 } elseif (me == null || other == null) { -256return false; -257 } -258return me.equals(other); -259 } -260 -261/** -262 * Equality check with an exhaustive, possibly duplicative, check against nulls. -263 * -264 * @param me the value to be compared -265 * @param other the other value to be compared -266 * @return true if the values are equal; otherwise false -267 */ -268privateboolean equalsWithNullCheck(Confidence me, Confidence other) { -269if (me == null && other == null) { -270returntrue; -271 } elseif (me == null || other == null) { -272return false; -273 } -274return me.equals(other); -275 } -276 -277/** -278 * Wrapper around {@link java.lang.String#compareToIgnoreCase(java.lang.String) String.compareToIgnoreCase} with an -279 * exhaustive, possibly duplicative, check against nulls. -280 * -281 * @param me the value to be compared -282 * @param other the other value to be compared -283 * @return true if the values are equal; otherwise false -284 */ -285privateint compareToIgnoreCaseWithNullCheck(String me, String other) { -286if (me == null && other == null) { -287return 0; -288 } elseif (me == null) { -289return -1; //the other string is greater then me -290 } elseif (other == null) { -291return 1; //me is greater then the other string -292 } -293return me.compareToIgnoreCase(other); -294 } -295 -296/** -297 * Wrapper around {@link java.lang.Enum#compareTo(java.lang.Enum) Enum.compareTo} with an exhaustive, possibly -298 * duplicative, check against nulls. -299 * -300 * @param me the value to be compared -301 * @param other the other value to be compared -302 * @return true if the values are equal; otherwise false -303 */ -304privateint compareToWithNullCheck(Confidence me, Confidence other) { -305if (me == null && other == null) { -306return 0; -307 } elseif (me == null) { -308return -1; //the other string is greater then me -309 } elseif (other == null) { -310return 1; //me is greater then the other string -311 } -312return me.compareTo(other); -313 } -314 } +20import java.io.Serializable; +21 +22/** +23 * Evidence is a piece of information about a Dependency. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27publicclassEvidenceimplements Serializable, Comparable<Evidence> { +28 +29/** +30 * Creates a new Evidence object. +31 */ +32publicEvidence() { +33 } +34 +35/** +36 * Creates a new Evidence objects. +37 * +38 * @param source the source of the evidence. +39 * @param name the name of the evidence. +40 * @param value the value of the evidence. +41 * @param confidence the confidence of the evidence. +42 */ +43publicEvidence(String source, String name, String value, Confidence confidence) { +44this.source = source; +45this.name = name; +46this.value = value; +47this.confidence = confidence; +48 } +49/** +50 * The name of the evidence. +51 */ +52private String name; +53 +54/** +55 * Get the value of name. +56 * +57 * @return the value of name +58 */ +59public String getName() { +60return name; +61 } +62 +63/** +64 * Set the value of name. +65 * +66 * @param name new value of name +67 */ +68publicvoid setName(String name) { +69this.name = name; +70 } +71/** +72 * The source of the evidence. +73 */ +74private String source; +75 +76/** +77 * Get the value of source. +78 * +79 * @return the value of source +80 */ +81public String getSource() { +82return source; +83 } +84 +85/** +86 * Set the value of source. +87 * +88 * @param source new value of source +89 */ +90publicvoid setSource(String source) { +91this.source = source; +92 } +93/** +94 * The value of the evidence. +95 */ +96private String value; +97 +98/** +99 * Get the value of value. +100 * +101 * @return the value of value +102 */ +103public String getValue() { +104 used = true; +105return value; +106 } +107 +108/** +109 * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used. +110 * +111 * @param setUsed whether or not this call to getValue should cause the used flag to be updated +112 * @return the value of value +113 */ +114public String getValue(Boolean setUsed) { +115 used = used || setUsed; +116return value; +117 } +118 +119/** +120 * Set the value of value. +121 * +122 * @param value new value of value +123 */ +124publicvoid setValue(String value) { +125this.value = value; +126 } +127/** +128 * A value indicating if the Evidence has been "used" (aka read). +129 */ +130privateboolean used; +131 +132/** +133 * Get the value of used. +134 * +135 * @return the value of used +136 */ +137publicboolean isUsed() { +138return used; +139 } +140 +141/** +142 * Set the value of used. +143 * +144 * @param used new value of used +145 */ +146publicvoid setUsed(boolean used) { +147this.used = used; +148 } +149/** +150 * The confidence level for the evidence. +151 */ +152privateConfidence confidence; +153 +154/** +155 * Get the value of confidence. +156 * +157 * @return the value of confidence +158 */ +159publicConfidence getConfidence() { +160return confidence; +161 } +162 +163/** +164 * Set the value of confidence. +165 * +166 * @param confidence new value of confidence +167 */ +168publicvoid setConfidence(Confidence confidence) { +169this.confidence = confidence; +170 } +171 +172/** +173 * Implements the hashCode for Evidence. +174 * +175 * @return hash code. +176 */ +177 @Override +178publicint hashCode() { +179int hash = 3; +180 hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0); +181 hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0); +182 hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0); +183 hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); +184return hash; +185 } +186 +187/** +188 * Implements equals for Evidence. +189 * +190 * @param that an object to check the equality of. +191 * @return whether the two objects are equal. +192 */ +193 @Override +194publicboolean equals(Object that) { +195if (this == that) { +196returntrue; +197 } +198if (!(that instanceof Evidence)) { +199return false; +200 } +201finalEvidence e = (Evidence) that; +202 +203return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value) +204 && (confidence == null ? e.confidence == null : confidence == e.confidence); +205 } +206 +207/** +208 * Simple equality test for use within the equals method. This does a case insensitive compare. +209 * +210 * @param l a string to compare. +211 * @param r another string to compare. +212 * @return whether the two strings are the same. +213 */ +214privateboolean testEquality(String l, String r) { +215return l == null ? r == null : l.equalsIgnoreCase(r); +216 } +217 +218/** +219 * Implementation of the comparable interface. +220 * +221 * @param o the evidence being compared +222 * @return an integer indicating the ordering of the two objects +223 */ +224publicint compareTo(Evidence o) { +225if (o == null) { +226return 1; +227 } +228if (equalsWithNullCheck(source, o.source)) { +229if (equalsWithNullCheck(name, o.name)) { +230if (equalsWithNullCheck(value, o.value)) { +231if (equalsWithNullCheck(confidence, o.confidence)) { +232return 0; //they are equal +233 } else { +234return compareToWithNullCheck(confidence, o.confidence); +235 } +236 } else { +237return compareToIgnoreCaseWithNullCheck(value, o.value); +238 } +239 } else { +240return compareToIgnoreCaseWithNullCheck(name, o.name); +241 } +242 } else { +243return compareToIgnoreCaseWithNullCheck(source, o.source); +244 } +245 } +246 +247/** +248 * Equality check with an exhaustive, possibly duplicative, check against nulls. +249 * +250 * @param me the value to be compared +251 * @param other the other value to be compared +252 * @return true if the values are equal; otherwise false +253 */ +254privateboolean equalsWithNullCheck(String me, String other) { +255if (me == null && other == null) { +256returntrue; +257 } elseif (me == null || other == null) { +258return false; +259 } +260return me.equals(other); +261 } +262 +263/** +264 * Equality check with an exhaustive, possibly duplicative, check against nulls. +265 * +266 * @param me the value to be compared +267 * @param other the other value to be compared +268 * @return true if the values are equal; otherwise false +269 */ +270privateboolean equalsWithNullCheck(Confidence me, Confidence other) { +271if (me == null && other == null) { +272returntrue; +273 } elseif (me == null || other == null) { +274return false; +275 } +276return me.equals(other); +277 } +278 +279/** +280 * Wrapper around {@link java.lang.String#compareToIgnoreCase(java.lang.String) String.compareToIgnoreCase} with an +281 * exhaustive, possibly duplicative, check against nulls. +282 * +283 * @param me the value to be compared +284 * @param other the other value to be compared +285 * @return true if the values are equal; otherwise false +286 */ +287privateint compareToIgnoreCaseWithNullCheck(String me, String other) { +288if (me == null && other == null) { +289return 0; +290 } elseif (me == null) { +291return -1; //the other string is greater then me +292 } elseif (other == null) { +293return 1; //me is greater then the other string +294 } +295return me.compareToIgnoreCase(other); +296 } +297 +298/** +299 * Wrapper around {@link java.lang.Enum#compareTo(java.lang.Enum) Enum.compareTo} with an exhaustive, possibly +300 * duplicative, check against nulls. +301 * +302 * @param me the value to be compared +303 * @param other the other value to be compared +304 * @return true if the values are equal; otherwise false +305 */ +306privateint compareToWithNullCheck(Confidence me, Confidence other) { +307if (me == null && other == null) { +308return 0; +309 } elseif (me == null) { +310return -1; //the other string is greater then me +311 } elseif (other == null) { +312return 1; //me is greater then the other string +313 } +314return me.compareTo(other); +315 } +316 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html index 9b95904b9..1a24ef314 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html @@ -25,383 +25,384 @@ 17 */18package org.owasp.dependencycheck.dependency; 19 -20import java.net.MalformedURLException; -21import java.util.HashSet; -22import java.util.Iterator; -23import java.util.List; -24import java.util.Set; -25import java.util.TreeSet; -26import java.util.logging.Level; -27import java.util.logging.Logger; -28import org.apache.commons.lang.StringUtils; -29import org.owasp.dependencycheck.utils.DependencyVersion; -30import org.owasp.dependencycheck.utils.DependencyVersionUtil; -31import org.owasp.dependencycheck.utils.Filter; -32import org.owasp.dependencycheck.utils.UrlStringUtils; -33 -34/** -35 * Used to maintain a collection of Evidence. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39publicclassEvidenceCollectionimplements Iterable<Evidence> { -40 -41/** -42 * The logger. -43 */ -44privatestaticfinal Logger LOGGER = Logger.getLogger(EvidenceCollection.class.getName()); -45/** -46 * Used to iterate over highest confidence evidence contained in the collection. -47 */ -48privatestaticfinal Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() { -49publicboolean passes(Evidence evidence) { -50return evidence.getConfidence() == Confidence.HIGHEST; -51 } -52 }; -53/** -54 * Used to iterate over high confidence evidence contained in the collection. -55 */ -56privatestaticfinal Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() { -57publicboolean passes(Evidence evidence) { -58return evidence.getConfidence() == Confidence.HIGH; -59 } -60 }; -61/** -62 * Used to iterate over medium confidence evidence contained in the collection. -63 */ -64privatestaticfinal Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() { -65publicboolean passes(Evidence evidence) { -66return evidence.getConfidence() == Confidence.MEDIUM; -67 } -68 }; -69/** -70 * Used to iterate over low confidence evidence contained in the collection. -71 */ -72privatestaticfinal Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() { -73publicboolean passes(Evidence evidence) { -74return evidence.getConfidence() == Confidence.LOW; -75 } -76 }; -77/** -78 * Used to iterate over evidence that has was used (aka read) from the collection. -79 */ -80privatestaticfinal Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() { -81publicboolean passes(Evidence evidence) { -82return evidence.isUsed(); -83 } -84 }; -85 -86/** -87 * Used to iterate over evidence of the specified confidence. -88 * -89 * @param confidence the confidence level for the evidence to be iterated over. -90 * @return Iterable<Evidence> an iterable collection of evidence -91 */ -92publicfinal Iterable<Evidence> iterator(Confidence confidence) { -93if (confidence == Confidence.HIGHEST) { -94return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list); -95 } elseif (confidence == Confidence.HIGH) { -96return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list); -97 } elseif (confidence == Confidence.MEDIUM) { -98return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list); -99 } else { -100return EvidenceCollection.LOW_CONFIDENCE.filter(this.list); -101 } -102 } -103/** -104 * A collection of evidence. -105 */ -106privatefinal Set<Evidence> list; -107/** -108 * A collection of strings used to adjust Lucene's term weighting. -109 */ -110privatefinal Set<String> weightedStrings; -111 -112/** -113 * Creates a new EvidenceCollection. -114 */ -115publicEvidenceCollection() { -116 list = new TreeSet<Evidence>(); -117 weightedStrings = new HashSet<String>(); -118 } -119 -120/** -121 * Adds evidence to the collection. -122 * -123 * @param e Evidence. -124 */ -125publicvoid addEvidence(Evidence e) { -126 list.add(e); -127 } -128 -129/** -130 * Creates an Evidence object from the parameters and adds the resulting object to the collection. -131 * -132 * @param source the source of the Evidence. -133 * @param name the name of the Evidence. -134 * @param value the value of the Evidence. -135 * @param confidence the confidence of the Evidence. -136 */ -137publicvoid addEvidence(String source, String name, String value, Confidence confidence) { -138finalEvidence e = newEvidence(source, name, value, confidence); -139 addEvidence(e); -140 } -141 -142/** -143 * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. -144 * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. -145 * -146 * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the -147 * package names within the JAR file we may add these package names to the "weighted" strings collection to boost -148 * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the -149 * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache. -150 * -151 * @param str to add to the weighting collection. -152 */ -153publicvoid addWeighting(String str) { -154 weightedStrings.add(str); -155 } -156 -157/** -158 * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in -159 * another location. -160 * -161 * @return Set<String> -162 */ -163public Set<String> getWeighting() { -164return weightedStrings; -165 } -166 -167/** -168 * Returns the set of evidence. -169 * -170 * @return the set of evidence. -171 */ -172public Set<Evidence> getEvidence() { -173return list; -174 } -175 -176/** -177 * Returns the set of evidence from a given source. -178 * -179 * @param source the source of the evidence -180 * @return the set of evidence. -181 */ -182public Set<Evidence> getEvidence(String source) { -183if (source == null) { -184returnnull; -185 } -186final Set<Evidence> ret = new HashSet<Evidence>(); -187for (Evidence e : list) { -188if (source.equals(e.getSource())) { -189 ret.add(e); -190 } -191 } -192return ret; -193 } -194 -195/** -196 * Returns the set of evidence from a given source and name. -197 * -198 * @param source the source of the evidence -199 * @param name the name of the evidence to return -200 * @return the set of evidence. -201 */ -202public Set<Evidence> getEvidence(String source, String name) { -203if (source == null || name == null) { -204returnnull; -205 } -206final Set<Evidence> ret = new HashSet<Evidence>(); -207for (Evidence e : list) { -208if (source.equals(e.getSource()) && name.equals(e.getName())) { -209 ret.add(e); -210 } -211 } -212return ret; -213 } -214 -215/** -216 * Implements the iterator interface for the Evidence Collection. -217 * -218 * @return an Iterator<Evidence>. -219 */ -220public Iterator<Evidence> iterator() { -221return list.iterator(); -222 } -223 -224/** -225 * Used to determine if a given string was used (aka read). -226 * -227 * @param text the string to search for. -228 * @return whether or not the string was used. -229 */ -230publicboolean containsUsedString(String text) { -231if (text == null) { -232return false; -233 } -234final String textToTest = text.toLowerCase(); -235 -236for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { -237//TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else) -238final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", ""); -239if (value.contains(textToTest)) { -240returntrue; -241 } -242 } -243return false; -244 } -245 -246/** -247 * Used to determine if a given version was used (aka read) from the EvidenceCollection. -248 * -249 * @param version the version to search for within the collected evidence. -250 * @return whether or not the string was used. -251 */ -252publicboolean containsUsedVersion(DependencyVersion version) { -253if (version == null) { -254return false; -255 } -256 -257for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { -258finalDependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue()); -259if (value != null && value.matchesAtLeastThreeLevels(version)) { -260returntrue; -261 } -262 } -263return false; -264 } -265 -266/** -267 * Returns whether or not the collection contains evidence of a specified Confidence. -268 * -269 * @param confidence A Confidence value. -270 * @return boolean. -271 */ -272publicboolean contains(Confidence confidence) { -273for (Evidence e : list) { -274if (e.getConfidence().equals(confidence)) { -275returntrue; -276 } -277 } -278return false; -279 } -280 -281/** -282 * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection. -283 * -284 * @param ec One or more EvidenceCollections. -285 * @return a new EvidenceCollection containing the used evidence. -286 */ -287publicstaticEvidenceCollection mergeUsed(EvidenceCollection... ec) { -288finalEvidenceCollection ret = newEvidenceCollection(); -289for (EvidenceCollection col : ec) { -290for (Evidence e : col.list) { -291if (e.isUsed()) { -292 ret.addEvidence(e); -293 } -294 } -295 } -296return ret; -297 } -298 -299/** -300 * Merges multiple EvidenceCollections together. -301 * -302 * @param ec One or more EvidenceCollections. -303 * @return a new EvidenceCollection. -304 */ -305publicstaticEvidenceCollection merge(EvidenceCollection... ec) { -306finalEvidenceCollection ret = newEvidenceCollection(); -307for (EvidenceCollection col : ec) { -308 ret.list.addAll(col.list); -309 ret.weightedStrings.addAll(col.weightedStrings); -310 } -311return ret; -312 } -313 -314/** -315 * Merges multiple EvidenceCollections together; flattening all of the evidence items by removing the confidence. -316 * -317 * @param ec One or more EvidenceCollections -318 * @return new set of evidence resulting from merging the evidence in the collections -319 */ -320publicstatic Set<Evidence> mergeForDisplay(EvidenceCollection... ec) { -321final Set<Evidence> ret = new TreeSet<Evidence>(); -322for (EvidenceCollection col : ec) { -323for (Evidence e : col) { -324if (e.isUsed()) { -325finalEvidence newEvidence = newEvidence(e.getSource(), e.getName(), e.getValue(), null); -326 newEvidence.setUsed(true); -327 ret.add(newEvidence); -328 } -329 } -330 } -331return ret; -332 } -333 -334/** -335 * Returns a string of evidence 'values'. -336 * -337 * @return a string containing the evidence. -338 */ -339 @Override -340public String toString() { -341final StringBuilder sb = new StringBuilder(); -342for (Evidence e : this.list) { -343 sb.append(e.getValue()).append(' '); -344 } -345return sb.toString(); -346 } -347 -348/** -349 * Returns the number of elements in the EvidenceCollection. -350 * -351 * @return the number of elements in the collection. -352 */ -353publicint size() { -354return list.size(); -355 } -356 -357/** -358 * <p> -359 * Takes a string that may contain a fully qualified domain and it will return the string having removed the query -360 * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p> -361 * <p> -362 * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file -363 * extension, etc. may produce false positives. -364 * -365 * <p> -366 * Example, given the following input:</p> -367 * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code> -368 * <p> -369 * The function would return:</p> -370 * <code>'Please visit somedomain path1 path2 file'</code> -371 * -372 * @param value the value that may contain a url -373 * @return the modified string -374 */ -375private String urlCorrection(String value) { -376if (value == null || !UrlStringUtils.containsUrl(value)) { -377return value; -378 } -379final StringBuilder sb = new StringBuilder(value.length()); -380final String[] parts = value.split("\\s"); -381for (String part : parts) { -382if (UrlStringUtils.isUrl(part)) { -383try { -384final List<String> data = UrlStringUtils.extractImportantUrlData(part); -385 sb.append(' ').append(StringUtils.join(data, ' ')); -386 } catch (MalformedURLException ex) { -387 LOGGER.log(Level.FINE, "error parsing " + part, ex); -388 sb.append(' ').append(part); -389 } -390 } else { -391 sb.append(' ').append(part); -392 } -393 } -394return sb.toString().trim(); -395 } -396 } +20import java.io.Serializable; +21import java.net.MalformedURLException; +22import java.util.HashSet; +23import java.util.Iterator; +24import java.util.List; +25import java.util.Set; +26import java.util.TreeSet; +27import java.util.logging.Level; +28import java.util.logging.Logger; +29import org.apache.commons.lang.StringUtils; +30import org.owasp.dependencycheck.utils.DependencyVersion; +31import org.owasp.dependencycheck.utils.DependencyVersionUtil; +32import org.owasp.dependencycheck.utils.Filter; +33import org.owasp.dependencycheck.utils.UrlStringUtils; +34 +35/** +36 * Used to maintain a collection of Evidence. +37 * +38 * @author Jeremy Long <jeremy.long@owasp.org> +39 */ +40publicclassEvidenceCollectionimplements Serializable, Iterable<Evidence> { +41 +42/** +43 * The logger. +44 */ +45privatestaticfinal Logger LOGGER = Logger.getLogger(EvidenceCollection.class.getName()); +46/** +47 * Used to iterate over highest confidence evidence contained in the collection. +48 */ +49privatestaticfinal Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() { +50publicboolean passes(Evidence evidence) { +51return evidence.getConfidence() == Confidence.HIGHEST; +52 } +53 }; +54/** +55 * Used to iterate over high confidence evidence contained in the collection. +56 */ +57privatestaticfinal Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() { +58publicboolean passes(Evidence evidence) { +59return evidence.getConfidence() == Confidence.HIGH; +60 } +61 }; +62/** +63 * Used to iterate over medium confidence evidence contained in the collection. +64 */ +65privatestaticfinal Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() { +66publicboolean passes(Evidence evidence) { +67return evidence.getConfidence() == Confidence.MEDIUM; +68 } +69 }; +70/** +71 * Used to iterate over low confidence evidence contained in the collection. +72 */ +73privatestaticfinal Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() { +74publicboolean passes(Evidence evidence) { +75return evidence.getConfidence() == Confidence.LOW; +76 } +77 }; +78/** +79 * Used to iterate over evidence that has was used (aka read) from the collection. +80 */ +81privatestaticfinal Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() { +82publicboolean passes(Evidence evidence) { +83return evidence.isUsed(); +84 } +85 }; +86 +87/** +88 * Used to iterate over evidence of the specified confidence. +89 * +90 * @param confidence the confidence level for the evidence to be iterated over. +91 * @return Iterable<Evidence> an iterable collection of evidence +92 */ +93publicfinal Iterable<Evidence> iterator(Confidence confidence) { +94if (confidence == Confidence.HIGHEST) { +95return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list); +96 } elseif (confidence == Confidence.HIGH) { +97return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list); +98 } elseif (confidence == Confidence.MEDIUM) { +99return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list); +100 } else { +101return EvidenceCollection.LOW_CONFIDENCE.filter(this.list); +102 } +103 } +104/** +105 * A collection of evidence. +106 */ +107privatefinal Set<Evidence> list; +108/** +109 * A collection of strings used to adjust Lucene's term weighting. +110 */ +111privatefinal Set<String> weightedStrings; +112 +113/** +114 * Creates a new EvidenceCollection. +115 */ +116publicEvidenceCollection() { +117 list = new TreeSet<Evidence>(); +118 weightedStrings = new HashSet<String>(); +119 } +120 +121/** +122 * Adds evidence to the collection. +123 * +124 * @param e Evidence. +125 */ +126publicvoid addEvidence(Evidence e) { +127 list.add(e); +128 } +129 +130/** +131 * Creates an Evidence object from the parameters and adds the resulting object to the collection. +132 * +133 * @param source the source of the Evidence. +134 * @param name the name of the Evidence. +135 * @param value the value of the Evidence. +136 * @param confidence the confidence of the Evidence. +137 */ +138publicvoid addEvidence(String source, String name, String value, Confidence confidence) { +139finalEvidence e = newEvidence(source, name, value, confidence); +140 addEvidence(e); +141 } +142 +143/** +144 * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. +145 * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. +146 * +147 * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the +148 * package names within the JAR file we may add these package names to the "weighted" strings collection to boost +149 * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the +150 * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache. +151 * +152 * @param str to add to the weighting collection. +153 */ +154publicvoid addWeighting(String str) { +155 weightedStrings.add(str); +156 } +157 +158/** +159 * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in +160 * another location. +161 * +162 * @return Set<String> +163 */ +164public Set<String> getWeighting() { +165return weightedStrings; +166 } +167 +168/** +169 * Returns the set of evidence. +170 * +171 * @return the set of evidence. +172 */ +173public Set<Evidence> getEvidence() { +174return list; +175 } +176 +177/** +178 * Returns the set of evidence from a given source. +179 * +180 * @param source the source of the evidence +181 * @return the set of evidence. +182 */ +183public Set<Evidence> getEvidence(String source) { +184if (source == null) { +185returnnull; +186 } +187final Set<Evidence> ret = new HashSet<Evidence>(); +188for (Evidence e : list) { +189if (source.equals(e.getSource())) { +190 ret.add(e); +191 } +192 } +193return ret; +194 } +195 +196/** +197 * Returns the set of evidence from a given source and name. +198 * +199 * @param source the source of the evidence +200 * @param name the name of the evidence to return +201 * @return the set of evidence. +202 */ +203public Set<Evidence> getEvidence(String source, String name) { +204if (source == null || name == null) { +205returnnull; +206 } +207final Set<Evidence> ret = new HashSet<Evidence>(); +208for (Evidence e : list) { +209if (source.equals(e.getSource()) && name.equals(e.getName())) { +210 ret.add(e); +211 } +212 } +213return ret; +214 } +215 +216/** +217 * Implements the iterator interface for the Evidence Collection. +218 * +219 * @return an Iterator<Evidence>. +220 */ +221public Iterator<Evidence> iterator() { +222return list.iterator(); +223 } +224 +225/** +226 * Used to determine if a given string was used (aka read). +227 * +228 * @param text the string to search for. +229 * @return whether or not the string was used. +230 */ +231publicboolean containsUsedString(String text) { +232if (text == null) { +233return false; +234 } +235final String textToTest = text.toLowerCase(); +236 +237for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { +238//TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else) +239final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", ""); +240if (value.contains(textToTest)) { +241returntrue; +242 } +243 } +244return false; +245 } +246 +247/** +248 * Used to determine if a given version was used (aka read) from the EvidenceCollection. +249 * +250 * @param version the version to search for within the collected evidence. +251 * @return whether or not the string was used. +252 */ +253publicboolean containsUsedVersion(DependencyVersion version) { +254if (version == null) { +255return false; +256 } +257 +258for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { +259finalDependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue()); +260if (value != null && value.matchesAtLeastThreeLevels(version)) { +261returntrue; +262 } +263 } +264return false; +265 } +266 +267/** +268 * Returns whether or not the collection contains evidence of a specified Confidence. +269 * +270 * @param confidence A Confidence value. +271 * @return boolean. +272 */ +273publicboolean contains(Confidence confidence) { +274for (Evidence e : list) { +275if (e.getConfidence().equals(confidence)) { +276returntrue; +277 } +278 } +279return false; +280 } +281 +282/** +283 * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection. +284 * +285 * @param ec One or more EvidenceCollections. +286 * @return a new EvidenceCollection containing the used evidence. +287 */ +288publicstaticEvidenceCollection mergeUsed(EvidenceCollection... ec) { +289finalEvidenceCollection ret = newEvidenceCollection(); +290for (EvidenceCollection col : ec) { +291for (Evidence e : col.list) { +292if (e.isUsed()) { +293 ret.addEvidence(e); +294 } +295 } +296 } +297return ret; +298 } +299 +300/** +301 * Merges multiple EvidenceCollections together. +302 * +303 * @param ec One or more EvidenceCollections. +304 * @return a new EvidenceCollection. +305 */ +306publicstaticEvidenceCollection merge(EvidenceCollection... ec) { +307finalEvidenceCollection ret = newEvidenceCollection(); +308for (EvidenceCollection col : ec) { +309 ret.list.addAll(col.list); +310 ret.weightedStrings.addAll(col.weightedStrings); +311 } +312return ret; +313 } +314 +315/** +316 * Merges multiple EvidenceCollections together; flattening all of the evidence items by removing the confidence. +317 * +318 * @param ec One or more EvidenceCollections +319 * @return new set of evidence resulting from merging the evidence in the collections +320 */ +321publicstatic Set<Evidence> mergeForDisplay(EvidenceCollection... ec) { +322final Set<Evidence> ret = new TreeSet<Evidence>(); +323for (EvidenceCollection col : ec) { +324for (Evidence e : col) { +325if (e.isUsed()) { +326finalEvidence newEvidence = newEvidence(e.getSource(), e.getName(), e.getValue(), null); +327 newEvidence.setUsed(true); +328 ret.add(newEvidence); +329 } +330 } +331 } +332return ret; +333 } +334 +335/** +336 * Returns a string of evidence 'values'. +337 * +338 * @return a string containing the evidence. +339 */ +340 @Override +341public String toString() { +342final StringBuilder sb = new StringBuilder(); +343for (Evidence e : this.list) { +344 sb.append(e.getValue()).append(' '); +345 } +346return sb.toString(); +347 } +348 +349/** +350 * Returns the number of elements in the EvidenceCollection. +351 * +352 * @return the number of elements in the collection. +353 */ +354publicint size() { +355return list.size(); +356 } +357 +358/** +359 * <p> +360 * Takes a string that may contain a fully qualified domain and it will return the string having removed the query +361 * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p> +362 * <p> +363 * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file +364 * extension, etc. may produce false positives. +365 * +366 * <p> +367 * Example, given the following input:</p> +368 * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code> +369 * <p> +370 * The function would return:</p> +371 * <code>'Please visit somedomain path1 path2 file'</code> +372 * +373 * @param value the value that may contain a url +374 * @return the modified string +375 */ +376private String urlCorrection(String value) { +377if (value == null || !UrlStringUtils.containsUrl(value)) { +378return value; +379 } +380final StringBuilder sb = new StringBuilder(value.length()); +381final String[] parts = value.split("\\s"); +382for (String part : parts) { +383if (UrlStringUtils.isUrl(part)) { +384try { +385final List<String> data = UrlStringUtils.extractImportantUrlData(part); +386 sb.append(' ').append(StringUtils.join(data, ' ')); +387 } catch (MalformedURLException ex) { +388 LOGGER.log(Level.FINE, "error parsing " + part, ex); +389 sb.append(' ').append(part); +390 } +391 } else { +392 sb.append(' ').append(part); +393 } +394 } +395return sb.toString().trim(); +396 } +397 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html index e34add7b7..49eab3ca7 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html @@ -25,201 +25,203 @@ 17 */18package org.owasp.dependencycheck.dependency; 19 -20/** -21 * -22 * @author Jeremy Long <jeremy.long@owasp.org> -23 */ -24publicclassIdentifierimplements Comparable<Identifier> { -25 -26/** -27 * Constructs a new Identifier with the specified data. -28 * -29 * @param type the identifier type. -30 * @param value the identifier value. -31 * @param url the identifier url. -32 */ -33publicIdentifier(String type, String value, String url) { -34this.type = type; -35this.value = value; -36this.url = url; -37 } -38 -39/** -40 * Constructs a new Identifier with the specified data. -41 * -42 * @param type the identifier type. -43 * @param value the identifier value. -44 * @param url the identifier url. -45 * @param description the description of the identifier. -46 */ -47publicIdentifier(String type, String value, String url, String description) { -48this(type, value, url); -49this.description = description; -50 } -51 -52/** -53 * The confidence that this is the correct identifier. -54 */ -55privateConfidence confidence; -56 -57/** -58 * Get the value of confidence. -59 * -60 * @return the value of confidence -61 */ -62publicConfidence getConfidence() { -63return confidence; -64 } -65 -66/** -67 * Set the value of confidence. -68 * -69 * @param confidence new value of confidence -70 */ -71publicvoid setConfidence(Confidence confidence) { -72this.confidence = confidence; -73 } -74 -75/** -76 * The value of the identifier -77 */ -78private String value; -79 -80/** -81 * Get the value of value. -82 * -83 * @return the value of value -84 */ -85public String getValue() { -86return value; -87 } -88 -89/** -90 * Set the value of value. -91 * -92 * @param value new value of value -93 */ -94publicvoid setValue(String value) { -95this.value = value; -96 } -97/** -98 * The url for the identifier. -99 */ -100private String url; -101 -102/** -103 * Get the value of url. -104 * -105 * @return the value of url -106 */ -107public String getUrl() { -108return url; -109 } -110 -111/** -112 * Set the value of url. -113 * -114 * @param url new value of url -115 */ -116publicvoid setUrl(String url) { -117this.url = url; -118 } -119/** -120 * The type of the identifier. -121 */ -122private String type; -123 -124/** -125 * Get the value of type. -126 * -127 * @return the value of type -128 */ -129public String getType() { -130return type; -131 } -132 -133/** -134 * <p> -135 * Set the value of type.</p><p> -136 * Example would be "CPE".</p> -137 * -138 * @param type new value of type -139 */ -140publicvoid setType(String type) { -141this.type = type; -142 } -143/** -144 * A description of the identifier. -145 */ -146private String description; -147 -148/** -149 * Get the value of description. -150 * -151 * @return the value of description -152 */ -153public String getDescription() { -154return description; -155 } -156 -157/** -158 * Set the value of description. -159 * -160 * @param description new value of description -161 */ -162publicvoid setDescription(String description) { -163this.description = description; -164 } -165 -166 @Override -167publicboolean equals(Object obj) { -168if (obj == null) { -169return false; -170 } -171if (getClass() != obj.getClass()) { -172return false; -173 } -174finalIdentifier other = (Identifier) obj; -175if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) { -176return false; -177 } -178if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) { -179return false; -180 } -181returntrue; -182 } -183 -184 @Override -185publicint hashCode() { -186int hash = 5; -187 hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0); -188 hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0); -189return hash; -190 } -191 -192/** -193 * Standard implementation of toString; displays identifier value and type. -194 * -195 * @return a String representation of the object -196 */ -197 @Override -198public String toString() { -199return"Identifier{" + "value=" + value + ", type=" + type + '}'; -200 } -201 -202/** -203 * Implementation of the comparator interface. This compares the value of the identifier only. -204 * -205 * @param o the object being compared -206 * @return an integer indicating the ordering -207 */ -208publicint compareTo(Identifier o) { -209if (o == null) { -210return -1; -211 } -212returnthis.value.compareTo(o.value); -213 } -214 } +20import java.io.Serializable; +21 +22/** +23 * +24 * @author Jeremy Long <jeremy.long@owasp.org> +25 */ +26publicclassIdentifierimplements Serializable, Comparable<Identifier> { +27 +28/** +29 * Constructs a new Identifier with the specified data. +30 * +31 * @param type the identifier type. +32 * @param value the identifier value. +33 * @param url the identifier url. +34 */ +35publicIdentifier(String type, String value, String url) { +36this.type = type; +37this.value = value; +38this.url = url; +39 } +40 +41/** +42 * Constructs a new Identifier with the specified data. +43 * +44 * @param type the identifier type. +45 * @param value the identifier value. +46 * @param url the identifier url. +47 * @param description the description of the identifier. +48 */ +49publicIdentifier(String type, String value, String url, String description) { +50this(type, value, url); +51this.description = description; +52 } +53 +54/** +55 * The confidence that this is the correct identifier. +56 */ +57privateConfidence confidence; +58 +59/** +60 * Get the value of confidence. +61 * +62 * @return the value of confidence +63 */ +64publicConfidence getConfidence() { +65return confidence; +66 } +67 +68/** +69 * Set the value of confidence. +70 * +71 * @param confidence new value of confidence +72 */ +73publicvoid setConfidence(Confidence confidence) { +74this.confidence = confidence; +75 } +76 +77/** +78 * The value of the identifier +79 */ +80private String value; +81 +82/** +83 * Get the value of value. +84 * +85 * @return the value of value +86 */ +87public String getValue() { +88return value; +89 } +90 +91/** +92 * Set the value of value. +93 * +94 * @param value new value of value +95 */ +96publicvoid setValue(String value) { +97this.value = value; +98 } +99/** +100 * The url for the identifier. +101 */ +102private String url; +103 +104/** +105 * Get the value of url. +106 * +107 * @return the value of url +108 */ +109public String getUrl() { +110return url; +111 } +112 +113/** +114 * Set the value of url. +115 * +116 * @param url new value of url +117 */ +118publicvoid setUrl(String url) { +119this.url = url; +120 } +121/** +122 * The type of the identifier. +123 */ +124private String type; +125 +126/** +127 * Get the value of type. +128 * +129 * @return the value of type +130 */ +131public String getType() { +132return type; +133 } +134 +135/** +136 * <p> +137 * Set the value of type.</p><p> +138 * Example would be "CPE".</p> +139 * +140 * @param type new value of type +141 */ +142publicvoid setType(String type) { +143this.type = type; +144 } +145/** +146 * A description of the identifier. +147 */ +148private String description; +149 +150/** +151 * Get the value of description. +152 * +153 * @return the value of description +154 */ +155public String getDescription() { +156return description; +157 } +158 +159/** +160 * Set the value of description. +161 * +162 * @param description new value of description +163 */ +164publicvoid setDescription(String description) { +165this.description = description; +166 } +167 +168 @Override +169publicboolean equals(Object obj) { +170if (obj == null) { +171return false; +172 } +173if (getClass() != obj.getClass()) { +174return false; +175 } +176finalIdentifier other = (Identifier) obj; +177if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) { +178return false; +179 } +180if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) { +181return false; +182 } +183returntrue; +184 } +185 +186 @Override +187publicint hashCode() { +188int hash = 5; +189 hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0); +190 hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0); +191return hash; +192 } +193 +194/** +195 * Standard implementation of toString; displays identifier value and type. +196 * +197 * @return a String representation of the object +198 */ +199 @Override +200public String toString() { +201return"Identifier{" + "value=" + value + ", type=" + type + '}'; +202 } +203 +204/** +205 * Implementation of the comparator interface. This compares the value of the identifier only. +206 * +207 * @param o the object being compared +208 * @return an integer indicating the ordering +209 */ +210publicint compareTo(Identifier o) { +211if (o == null) { +212return -1; +213 } +214returnthis.value.compareTo(o.value); +215 } +216 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html index b8b49d2bc..852887688 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html index 452cd5391..15e9086f6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html index e1f7d7d79..b769db0d5 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.exception + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html index 501e6613e..ed324c648 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.exception + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html index e24154345..6a34981be 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.jaxb.pom.generated + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.jaxb.pom.generated diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html index ad56085bd..99cd42f53 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.jaxb.pom.generated + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.jaxb.pom.generated diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html index 916feb4a9..d38eaf882 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.jaxb.pom + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.jaxb.pom diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html index 6bcfedec7..c8399d054 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.jaxb.pom + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.jaxb.pom diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html index 654d46aad..b2e08f58b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html index 82a610b1d..b2210ea40 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html index 7c7919a2e..d23497425 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html index 41dacfd7c..74a030fbe 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html index fb6ffb69a..d494065c3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html @@ -111,78 +111,84 @@ 103 currentText = new StringBuffer(); 104if (SUPPRESS.equals(qName)) { 105 rule = newSuppressionRule(); -106 } -107 } -108 -109/** -110 * Handles the end element event. -111 * -112 * @param uri the URI of the element -113 * @param localName the local name of the element -114 * @param qName the qName of the element -115 * @throws SAXException thrown if there is an exception processing -116 */ -117 @Override -118publicvoid endElement(String uri, String localName, String qName) throws SAXException { -119if (SUPPRESS.equals(qName)) { -120 suppressionRules.add(rule); -121 rule = null; -122 } elseif (FILE_PATH.equals(qName)) { -123finalPropertyType pt = processPropertyType(); -124 rule.setFilePath(pt); -125 } elseif (SHA1.equals(qName)) { -126 rule.setSha1(currentText.toString()); -127 } elseif (GAV.equals(qName)) { -128finalPropertyType pt = processPropertyType(); -129 rule.setGav(pt); -130 } elseif (CPE.equals(qName)) { -131finalPropertyType pt = processPropertyType(); -132 rule.addCpe(pt); -133 } elseif (CWE.equals(qName)) { -134 rule.addCwe(currentText.toString()); -135 } elseif (CVE.equals(qName)) { -136 rule.addCve(currentText.toString()); -137 } elseif (CVSS_BELOW.equals(qName)) { -138finalfloat cvss = Float.parseFloat(currentText.toString()); -139 rule.addCvssBelow(cvss); -140 } -141 } -142 -143/** -144 * Collects the body text of the node being processed. -145 * -146 * @param ch the char array of text -147 * @param start the start position to copy text from in the char array -148 * @param length the number of characters to copy from the char array -149 * @throws SAXException thrown if there is a parsing exception -150 */ -151 @Override -152publicvoid characters(char[] ch, int start, int length) throws SAXException { -153 currentText.append(ch, start, length); -154 } -155 -156/** -157 * Processes field members that have been collected during the characters and startElement method to construct a -158 * PropertyType object. -159 * -160 * @return a PropertyType object -161 */ -162privatePropertyType processPropertyType() { -163finalPropertyType pt = newPropertyType(); -164 pt.setValue(currentText.toString()); -165if (currentAttributes != null && currentAttributes.getLength() > 0) { -166final String regex = currentAttributes.getValue("regex"); -167if (regex != null) { -168 pt.setRegex(Boolean.parseBoolean(regex)); -169 } -170final String caseSensitive = currentAttributes.getValue("caseSensitive"); -171if (caseSensitive != null) { -172 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive)); -173 } -174 } -175return pt; -176 } -177 } +106final String base = currentAttributes.getValue("base"); +107if (base != null) { +108 rule.setBase(Boolean.parseBoolean(base)); +109 } else { +110 rule.setBase(false); +111 } +112 } +113 } +114 +115/** +116 * Handles the end element event. +117 * +118 * @param uri the URI of the element +119 * @param localName the local name of the element +120 * @param qName the qName of the element +121 * @throws SAXException thrown if there is an exception processing +122 */ +123 @Override +124publicvoid endElement(String uri, String localName, String qName) throws SAXException { +125if (SUPPRESS.equals(qName)) { +126 suppressionRules.add(rule); +127 rule = null; +128 } elseif (FILE_PATH.equals(qName)) { +129finalPropertyType pt = processPropertyType(); +130 rule.setFilePath(pt); +131 } elseif (SHA1.equals(qName)) { +132 rule.setSha1(currentText.toString()); +133 } elseif (GAV.equals(qName)) { +134finalPropertyType pt = processPropertyType(); +135 rule.setGav(pt); +136 } elseif (CPE.equals(qName)) { +137finalPropertyType pt = processPropertyType(); +138 rule.addCpe(pt); +139 } elseif (CWE.equals(qName)) { +140 rule.addCwe(currentText.toString()); +141 } elseif (CVE.equals(qName)) { +142 rule.addCve(currentText.toString()); +143 } elseif (CVSS_BELOW.equals(qName)) { +144finalfloat cvss = Float.parseFloat(currentText.toString()); +145 rule.addCvssBelow(cvss); +146 } +147 } +148 +149/** +150 * Collects the body text of the node being processed. +151 * +152 * @param ch the char array of text +153 * @param start the start position to copy text from in the char array +154 * @param length the number of characters to copy from the char array +155 * @throws SAXException thrown if there is a parsing exception +156 */ +157 @Override +158publicvoid characters(char[] ch, int start, int length) throws SAXException { +159 currentText.append(ch, start, length); +160 } +161 +162/** +163 * Processes field members that have been collected during the characters and startElement method to construct a +164 * PropertyType object. +165 * +166 * @return a PropertyType object +167 */ +168privatePropertyType processPropertyType() { +169finalPropertyType pt = newPropertyType(); +170 pt.setValue(currentText.toString()); +171if (currentAttributes != null && currentAttributes.getLength() > 0) { +172final String regex = currentAttributes.getValue("regex"); +173if (regex != null) { +174 pt.setRegex(Boolean.parseBoolean(regex)); +175 } +176final String caseSensitive = currentAttributes.getValue("caseSensitive"); +177if (caseSensitive != null) { +178 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive)); +179 } +180 } +181return pt; +182 } +183 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html index 54af14e70..174403973 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html @@ -274,194 +274,218 @@ 266return gav != null; 267 } 268 -269/** -270 * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any -271 * should be, they are removed from the dependency. -272 * -273 * @param dependency a project dependency to analyze -274 */ -275publicvoid process(Dependency dependency) { -276if (filePath != null && !filePath.matches(dependency.getFilePath())) { -277return; -278 } -279if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) { -280return; -281 } -282if (gav != null) { -283final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); -284boolean gavFound = false; -285while (itr.hasNext()) { -286finalIdentifier i = itr.next(); -287if (identifierMatches("maven", this.gav, i)) { -288 gavFound = true; -289break; -290 } -291 } -292if (!gavFound) { -293return; -294 } -295 } -296 -297if (this.hasCpe()) { -298final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); -299while (itr.hasNext()) { -300finalIdentifier i = itr.next(); -301for (PropertyType c : this.cpe) { -302if (identifierMatches("cpe", c, i)) { -303 dependency.addSuppressedIdentifier(i); -304 itr.remove(); -305break; -306 } -307 } -308 } -309 } -310if (hasCve() || hasCwe() || hasCvssBelow()) { -311final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator(); -312while (itr.hasNext()) { -313boolean remove = false; -314finalVulnerability v = itr.next(); -315for (String entry : this.cve) { -316if (entry.equalsIgnoreCase(v.getName())) { -317 remove = true; -318break; -319 } -320 } -321if (!remove) { -322for (String entry : this.cwe) { -323if (v.getCwe() != null) { -324final String toMatch = String.format("CWE-%s ", entry); -325final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase(); -326if (toTest.equals(toMatch)) { -327 remove = true; -328break; -329 } -330 } -331 } -332 } -333if (!remove) { -334for (float cvss : this.cvssBelow) { -335if (v.getCvssScore() < cvss) { -336 remove = true; -337break; -338 } -339 } -340 } -341if (remove) { -342 dependency.addSuppressedVulnerability(v); -343 itr.remove(); -344 } -345 } -346 } -347 } -348 -349/** -350 * Identifies if the cpe specified by the cpe suppression rule does not specify a version. -351 * -352 * @param c a suppression rule identifier -353 * @return true if the property type does not specify a version; otherwise false -354 */ -355boolean cpeHasNoVersion(PropertyType c) { -356if (c.isRegex()) { -357return false; -358 } -359if (countCharacter(c.getValue(), ':') == 3) { -360returntrue; -361 } -362return false; -363 } -364 -365/** -366 * Counts the number of occurrences of the character found within the string. -367 * -368 * @param str the string to check -369 * @param c the character to count -370 * @return the number of times the character is found in the string -371 */ -372int countCharacter(String str, char c) { -373int count = 0; -374int pos = str.indexOf(c) + 1; -375while (pos > 0) { -376 count += 1; -377 pos = str.indexOf(c, pos) + 1; -378 } -379return count; -380 } -381 -382/** -383 * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. -384 * -385 * @param identifierType the type of identifier ("cpe", "maven", etc.) -386 * @param suppressionEntry a suppression rule entry -387 * @param identifier a CPE identifier to check -388 * @return true if the entry matches; otherwise false -389 */ -390boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) { -391if (identifierType.equals(identifier.getType())) { -392if (suppressionEntry.matches(identifier.getValue())) { -393returntrue; -394 } elseif ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) { -395if (suppressionEntry.isCaseSensitive()) { -396return identifier.getValue().startsWith(suppressionEntry.getValue()); -397 } else { -398final String id = identifier.getValue().toLowerCase(); -399final String check = suppressionEntry.getValue().toLowerCase(); -400return id.startsWith(check); -401 } -402 } -403 } -404return false; -405 } -406 -407/** -408 * Standard toString implementation. -409 * -410 * @return a string representation of this object -411 */ -412 @Override -413public String toString() { -414final StringBuilder sb = new StringBuilder(); -415 sb.append("SuppressionRule{"); -416if (filePath != null) { -417 sb.append("filePath=").append(filePath).append(","); -418 } -419if (sha1 != null) { -420 sb.append("sha1=").append(sha1).append(","); -421 } -422if (gav != null) { -423 sb.append("gav=").append(gav).append(","); -424 } -425if (cpe != null && cpe.size() > 0) { -426 sb.append("cpe={"); -427for (PropertyType pt : cpe) { -428 sb.append(pt).append(","); -429 } -430 sb.append("}"); -431 } -432if (cwe != null && cwe.size() > 0) { -433 sb.append("cwe={"); -434for (String s : cwe) { -435 sb.append(s).append(","); -436 } -437 sb.append("}"); -438 } -439if (cve != null && cve.size() > 0) { -440 sb.append("cve={"); -441for (String s : cve) { -442 sb.append(s).append(","); -443 } -444 sb.append("}"); +269privateboolean base; +270 +271/** +272 * Get the value of base +273 * +274 * @return the value of base +275 */ +276publicboolean isBase() { +277return base; +278 } +279 +280/** +281 * Set the value of base +282 * +283 * @param base new value of base +284 */ +285publicvoid setBase(boolean base) { +286this.base = base; +287 } +288 +289/** +290 * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any +291 * should be, they are removed from the dependency. +292 * +293 * @param dependency a project dependency to analyze +294 */ +295publicvoid process(Dependency dependency) { +296if (filePath != null && !filePath.matches(dependency.getFilePath())) { +297return; +298 } +299if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) { +300return; +301 } +302if (gav != null) { +303final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +304boolean gavFound = false; +305while (itr.hasNext()) { +306finalIdentifier i = itr.next(); +307if (identifierMatches("maven", this.gav, i)) { +308 gavFound = true; +309break; +310 } +311 } +312if (!gavFound) { +313return; +314 } +315 } +316 +317if (this.hasCpe()) { +318final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +319while (itr.hasNext()) { +320finalIdentifier i = itr.next(); +321for (PropertyType c : this.cpe) { +322if (identifierMatches("cpe", c, i)) { +323if (!isBase()) { +324 dependency.addSuppressedIdentifier(i); +325 } +326 itr.remove(); +327break; +328 } +329 } +330 } +331 } +332if (hasCve() || hasCwe() || hasCvssBelow()) { +333final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator(); +334while (itr.hasNext()) { +335boolean remove = false; +336finalVulnerability v = itr.next(); +337for (String entry : this.cve) { +338if (entry.equalsIgnoreCase(v.getName())) { +339 remove = true; +340break; +341 } +342 } +343if (!remove) { +344for (String entry : this.cwe) { +345if (v.getCwe() != null) { +346final String toMatch = String.format("CWE-%s ", entry); +347final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase(); +348if (toTest.equals(toMatch)) { +349 remove = true; +350break; +351 } +352 } +353 } +354 } +355if (!remove) { +356for (float cvss : this.cvssBelow) { +357if (v.getCvssScore() < cvss) { +358 remove = true; +359break; +360 } +361 } +362 } +363if (remove) { +364if (!isBase()) { +365 dependency.addSuppressedVulnerability(v); +366 } +367 itr.remove(); +368 } +369 } +370 } +371 } +372 +373/** +374 * Identifies if the cpe specified by the cpe suppression rule does not specify a version. +375 * +376 * @param c a suppression rule identifier +377 * @return true if the property type does not specify a version; otherwise false +378 */ +379boolean cpeHasNoVersion(PropertyType c) { +380if (c.isRegex()) { +381return false; +382 } +383if (countCharacter(c.getValue(), ':') == 3) { +384returntrue; +385 } +386return false; +387 } +388 +389/** +390 * Counts the number of occurrences of the character found within the string. +391 * +392 * @param str the string to check +393 * @param c the character to count +394 * @return the number of times the character is found in the string +395 */ +396int countCharacter(String str, char c) { +397int count = 0; +398int pos = str.indexOf(c) + 1; +399while (pos > 0) { +400 count += 1; +401 pos = str.indexOf(c, pos) + 1; +402 } +403return count; +404 } +405 +406/** +407 * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. +408 * +409 * @param identifierType the type of identifier ("cpe", "maven", etc.) +410 * @param suppressionEntry a suppression rule entry +411 * @param identifier a CPE identifier to check +412 * @return true if the entry matches; otherwise false +413 */ +414boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) { +415if (identifierType.equals(identifier.getType())) { +416if (suppressionEntry.matches(identifier.getValue())) { +417returntrue; +418 } elseif ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) { +419if (suppressionEntry.isCaseSensitive()) { +420return identifier.getValue().startsWith(suppressionEntry.getValue()); +421 } else { +422final String id = identifier.getValue().toLowerCase(); +423final String check = suppressionEntry.getValue().toLowerCase(); +424return id.startsWith(check); +425 } +426 } +427 } +428return false; +429 } +430 +431/** +432 * Standard toString implementation. +433 * +434 * @return a string representation of this object +435 */ +436 @Override +437public String toString() { +438final StringBuilder sb = new StringBuilder(); +439 sb.append("SuppressionRule{"); +440if (filePath != null) { +441 sb.append("filePath=").append(filePath).append(","); +442 } +443if (sha1 != null) { +444 sb.append("sha1=").append(sha1).append(","); 445 } -446if (cvssBelow != null && cvssBelow.size() > 0) { -447 sb.append("cvssBelow={"); -448for (Float s : cvssBelow) { -449 sb.append(s).append(","); -450 } -451 sb.append("}"); -452 } -453 sb.append("}"); -454return sb.toString(); -455 } -456 } +446if (gav != null) { +447 sb.append("gav=").append(gav).append(","); +448 } +449if (cpe != null && cpe.size() > 0) { +450 sb.append("cpe={"); +451for (PropertyType pt : cpe) { +452 sb.append(pt).append(","); +453 } +454 sb.append("}"); +455 } +456if (cwe != null && cwe.size() > 0) { +457 sb.append("cwe={"); +458for (String s : cwe) { +459 sb.append(s).append(","); +460 } +461 sb.append("}"); +462 } +463if (cve != null && cve.size() > 0) { +464 sb.append("cve={"); +465for (String s : cve) { +466 sb.append(s).append(","); +467 } +468 sb.append("}"); +469 } +470if (cvssBelow != null && cvssBelow.size() > 0) { +471 sb.append("cvssBelow={"); +472for (Float s : cvssBelow) { +473 sb.append(s).append(","); +474 } +475 sb.append("}"); +476 } +477 sb.append("}"); +478return sb.toString(); +479 } +480 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html index 7eda7f518..9486eb4c2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html index c5ce1002a..a490c6421 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html index 9ad1ade57..63380d61c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html @@ -197,66 +197,72 @@ 189if (version == null) { 190return false; 191 } -192 -193boolean ret = true; -194int max = (this.versionParts.size() < version.versionParts.size()) -195 ? this.versionParts.size() : version.versionParts.size(); -196 -197if (max > 3) { -198 max = 3; -199 } -200 -201for (int i = 0; i < max; i++) { -202if (this.versionParts.get(i) == null || !this.versionParts.get(i).equals(version.versionParts.get(i))) { -203 ret = false; -204break; -205 } -206 } -207 -208return ret; -209 } -210 -211 @Override -212publicint compareTo(DependencyVersion version) { -213if (version == null) { -214return 1; -215 } -216final List<String> left = this.getVersionParts(); -217final List<String> right = version.getVersionParts(); -218finalint max = left.size() < right.size() ? left.size() : right.size(); -219 -220for (int i = 0; i < max; i++) { -221final String lStr = left.get(i); -222final String rStr = right.get(i); -223if (lStr.equals(rStr)) { -224continue; -225 } -226try { -227finalint l = Integer.parseInt(lStr); -228finalint r = Integer.parseInt(rStr); -229if (l < r) { -230return -1; -231 } elseif (l > r) { -232return 1; -233 } -234 } catch (NumberFormatException ex) { -235finalint comp = left.get(i).compareTo(right.get(i)); -236if (comp < 0) { -237return -1; -238 } elseif (comp > 0) { -239return 1; -240 } -241 } -242 } -243if (left.size() < right.size()) { -244return -1; -245 } elseif (left.size() > right.size()) { -246return 1; -247 } else { -248return 0; -249 } -250 } -251 } +192if (Math.abs(this.versionParts.size() - version.versionParts.size()) >= 3) { +193return false; +194 } +195 +196finalint max = (this.versionParts.size() < version.versionParts.size()) +197 ? this.versionParts.size() : version.versionParts.size(); +198 +199boolean ret = true; +200for (int i = 0; i < max; i++) { +201 String thisVersion = this.versionParts.get(i); +202 String otherVersion = version.getVersionParts().get(i); +203if (i >= 3) { +204if (thisVersion.compareToIgnoreCase(otherVersion) >= 0) { +205 ret = false; +206break; +207 } +208 } elseif (!thisVersion.equals(otherVersion)) { +209 ret = false; +210break; +211 } +212 } +213 +214return ret; +215 } +216 +217 @Override +218publicint compareTo(DependencyVersion version) { +219if (version == null) { +220return 1; +221 } +222final List<String> left = this.getVersionParts(); +223final List<String> right = version.getVersionParts(); +224finalint max = left.size() < right.size() ? left.size() : right.size(); +225 +226for (int i = 0; i < max; i++) { +227final String lStr = left.get(i); +228final String rStr = right.get(i); +229if (lStr.equals(rStr)) { +230continue; +231 } +232try { +233finalint l = Integer.parseInt(lStr); +234finalint r = Integer.parseInt(rStr); +235if (l < r) { +236return -1; +237 } elseif (l > r) { +238return 1; +239 } +240 } catch (NumberFormatException ex) { +241finalint comp = left.get(i).compareTo(right.get(i)); +242if (comp < 0) { +243return -1; +244 } elseif (comp > 0) { +245return 1; +246 } +247 } +248 } +249if (left.size() < right.size()) { +250return -1; +251 } elseif (left.size() > right.size()) { +252return 1; +253 } else { +254return 0; +255 } +256 } +257 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html index 048992a14..b4a761ea2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html index 18cecca38..eb8b664d1 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref/overview-frame.html b/dependency-check-core/xref/overview-frame.html index 66f980f35..e30838387 100644 --- a/dependency-check-core/xref/overview-frame.html +++ b/dependency-check-core/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference + Dependency-Check Core 1.2.5 Reference diff --git a/dependency-check-core/xref/overview-summary.html b/dependency-check-core/xref/overview-summary.html index d9d08effd..61ff8dd43 100644 --- a/dependency-check-core/xref/overview-summary.html +++ b/dependency-check-core/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.2.4 Reference + Dependency-Check Core 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Core 1.2.4 Reference

    +

    Dependency-Check Core 1.2.5 Reference

    diff --git a/dependency-check-jenkins/index.html b/dependency-check-jenkins/index.html index acc75ccd8..f78aba029 100644 --- a/dependency-check-jenkins/index.html +++ b/dependency-check-jenkins/index.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-jenkins/license.html b/dependency-check-jenkins/license.html index a55f43e91..964a632f5 100644 --- a/dependency-check-jenkins/license.html +++ b/dependency-check-jenkins/license.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-jenkins/project-info.html b/dependency-check-jenkins/project-info.html index 40e22b186..b7c231ce2 100644 --- a/dependency-check-jenkins/project-info.html +++ b/dependency-check-jenkins/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-jenkins/project-summary.html b/dependency-check-jenkins/project-summary.html index 57fbe818c..42cfcb7e1 100644 --- a/dependency-check-jenkins/project-summary.html +++ b/dependency-check-jenkins/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -196,7 +196,7 @@ - +
    dependency-check-jenkins
    Version1.2.4
    1.2.5
    Type pom
    diff --git a/dependency-check-maven/apidocs/allclasses-frame.html b/dependency-check-maven/apidocs/allclasses-frame.html index 61c453b4d..0d8750a7a 100644 --- a/dependency-check-maven/apidocs/allclasses-frame.html +++ b/dependency-check-maven/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Maven Plugin 1.2.4 API) - +All Classes (Dependency-Check Maven Plugin 1.2.5 API) + @@ -14,6 +14,7 @@ diff --git a/dependency-check-maven/apidocs/allclasses-noframe.html b/dependency-check-maven/apidocs/allclasses-noframe.html index dc434aa46..81483d18e 100644 --- a/dependency-check-maven/apidocs/allclasses-noframe.html +++ b/dependency-check-maven/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Maven Plugin 1.2.4 API) - +All Classes (Dependency-Check Maven Plugin 1.2.5 API) + @@ -14,6 +14,7 @@ diff --git a/dependency-check-maven/apidocs/constant-values.html b/dependency-check-maven/apidocs/constant-values.html index dc35a88aa..451945e11 100644 --- a/dependency-check-maven/apidocs/constant-values.html +++ b/dependency-check-maven/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Maven Plugin 1.2.4 API) - +Constant Field Values (Dependency-Check Maven Plugin 1.2.5 API) + diff --git a/dependency-check-maven/apidocs/deprecated-list.html b/dependency-check-maven/apidocs/deprecated-list.html index 91e75380d..02f479c7a 100644 --- a/dependency-check-maven/apidocs/deprecated-list.html +++ b/dependency-check-maven/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Maven Plugin 1.2.4 API) - +Deprecated List (Dependency-Check Maven Plugin 1.2.5 API) + @@ -65,6 +65,30 @@

    Deprecated API

    Contents

    + +
    +
    + + +
    diff --git a/dependency-check-maven/apidocs/help-doc.html b/dependency-check-maven/apidocs/help-doc.html index 71cb7948d..bd7c0f722 100644 --- a/dependency-check-maven/apidocs/help-doc.html +++ b/dependency-check-maven/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Maven Plugin 1.2.4 API) - +API Help (Dependency-Check Maven Plugin 1.2.5 API) + diff --git a/dependency-check-maven/apidocs/index-all.html b/dependency-check-maven/apidocs/index-all.html index 10f7588d7..01c8ae053 100644 --- a/dependency-check-maven/apidocs/index-all.html +++ b/dependency-check-maven/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Maven Plugin 1.2.4 API) - +Index (Dependency-Check Maven Plugin 1.2.5 API) + @@ -62,14 +62,30 @@
    -
    C D E G H I O S  +
    C D E G H I O P R S W 

    C

    +
    canGenerateAggregateReport() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Returns whether or not an aggregate report can be generated.
    +
    +
    canGenerateAggregateReport() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns whether or not we can generate any aggregate reports at this time.
    +
    +
    canGenerateNonAggregateReport() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Returns whether or not a non-aggregate report can be generated.
    +
    +
    canGenerateNonAggregateReport() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns whether or not the mojo can generate a non-aggregate report for this project.
    +
    canGenerateReport() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    -
    Returns whether or not the plugin can generate a report.
    +
    Returns whether or not a report can be generated.
    @@ -82,36 +98,78 @@
    Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
    DependencyCheckMojo() - Constructor for class org.owasp.dependencycheck.maven.DependencyCheckMojo
    -
     
    +
    +
    Constructs a new dependency-check-mojo.
    +

    E

    -
    execute() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    -
    -
    Executes the dependency-check and generates the report.
    -
    execute() - Method in class org.owasp.dependencycheck.maven.HelpMojo
    +
    execute() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Is called by Maven to execute the mojo.
    +
    +
    executeAggregateReport(MavenProject, Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
     
    +
    executeAggregateReport(MavenProject, Locale) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Generates the aggregate Site Report.
    +
    +
    executeNonAggregateReport(Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Generates the Dependency-Check Site Report.
    +
    +
    executeNonAggregateReport(Locale) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Generates the non aggregate report.
    +

    G

    -
    generate(Sink, Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    generate(Sink, Locale) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Deprecated. +
    use {@link #generate(org.apache.maven.doxia.sink.Sink, java.util.Locale) instead.
    +
    +
    +
    generate(Sink, Locale) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    Generates the Dependency-Check Site Report.
    -
    generate(Sink, SinkFactory, Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    getAllChildDataFiles(MavenProject) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    -
    Generates the Dependency-Check Site Report.
    +
    Returns a list of data files that were produced by the direct children of the given MavenProject.
    +
    +
    getAllChildren() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns a list containing all the recursive, non-pom children of the given project, never null.
    +
    +
    getAllChildren(MavenProject) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns a list containing all the recursive, non-pom children of the given project, never null.
    getCategoryName() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    Returns the category name.
    +
    getDataFileContextKey() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns the key used to store the path to the data file that is saved by writeDataFile().
    +
    +
    getDataFileName() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns the name of the data file that contains the serialized data.
    +
    +
    getDataFiles(List<MavenProject>) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns any existing output files from the given list of projects.
    +
    getDescription(Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    @@ -120,14 +178,26 @@
    Returns the report name.
    +
    getOutputDirectoryContextKey() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns the key used to store the path to the output directory.
    +
    getOutputName() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    Returns the output name.
    -
    getReportOutputDirectory() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    getProject() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns a reference to the current project.
    +
    +
    getReportOutputDirectory() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    Returns the output directory.
    +
    getReportOutputDirectory(MavenProject) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns the output directory for the given project.
    +
    @@ -147,10 +217,26 @@

    I

    -
    isExternalReport() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    isAggregate() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Returns whether or not the mojo is configured to perform report aggregation.
    +
    +
    isExternalReport() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    Returns whether this is an external report.
    +
    isLastProject() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Check whether the current project is the last project in a multi-module build.
    +
    +
    isMultiModule(MavenProject) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Test if the project has pom packaging
    +
    +
    isMultiModule() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Test if the current project has pom packaging
    +
    @@ -167,17 +253,86 @@ This is the main package containing the Mojo Maven Plugin - dependency-check.
    + + + +

    P

    +
    +
    performExecute() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Executes the dependency-check and generates the report.
    +
    +
    performExecute() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Called when the mojo is being executed.
    +
    +
    postExecute() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
     
    +
    postExecute() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Runs after the mojo has executed.
    +
    +
    postGenerate() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
     
    +
    postGenerate() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Executes after the site report has been generated.
    +
    +
    preExecute() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Called before execute; allows for any setup that is needed.
    +
    +
    preGenerate() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Runs prior to the site report generation.
    +
    +
    + + + +

    R

    +
    +
    readDataFile() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Reads the serialized scan data from disk.
    +
    +
    readDataFile(MavenProject) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Reads the serialized scan data from disk.
    +
    +
    ReportAggregationMojo - Class in org.owasp.dependencycheck.maven
    +
    +
    + This is an abstract reporting mojo that enables report aggregation.
    +
    +
    ReportAggregationMojo() - Constructor for class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
     
    +

    S

    -
    setReportOutputDirectory(File) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    setReportOutputDirectory(File) - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    Sets the Reporting output directory.
    -C D E G H I O S 
    + + + +

    W

    +
    +
    writeDataFile() - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    +
    +
    Writes the scan data to disk.
    +
    +
    writeDataFile() - Method in class org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
    +
    Writes the data file to disk in the target directory.
    +
    +
    +C D E G H I O P R S W 
    diff --git a/dependency-check-maven/apidocs/index.html b/dependency-check-maven/apidocs/index.html index 6d2b8ed87..e8e905784 100644 --- a/dependency-check-maven/apidocs/index.html +++ b/dependency-check-maven/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Maven Plugin 1.2.4 API +Dependency-Check Maven Plugin 1.2.5 API @@ -90,18 +90,23 @@
  • org.apache.maven.plugin.AbstractMojo
  • + +
    • All Implemented Interfaces:
      -
      org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo, org.apache.maven.reporting.MavenMultiPageReport, org.apache.maven.reporting.MavenReport
      +
      org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo, org.apache.maven.reporting.MavenReport


      @@ -111,8 +116,7 @@ requiresDependencyResolution=RUNTIME_PLUS_SYSTEM, requiresOnline=true) public class DependencyCheckMojo -extends org.apache.maven.plugin.AbstractMojo -implements org.apache.maven.reporting.MavenMultiPageReport +extends ReportAggregationMojo
      Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
      Author:
      Jeremy Long
      @@ -156,7 +160,9 @@ implements org.apache.maven.reporting.MavenMultiPageReport Constructor and Description -DependencyCheckMojo()  +DependencyCheckMojo() +
      Constructs a new dependency-check-mojo.
      +
    • @@ -174,76 +180,105 @@ implements org.apache.maven.reporting.MavenMultiPageReport Method and Description +protected boolean +canGenerateAggregateReport() +
      Returns whether or not an aggregate report can be generated.
      + + + +protected boolean +canGenerateNonAggregateReport() +
      Returns whether or not a non-aggregate report can be generated.
      + + + boolean canGenerateReport() -
      Returns whether or not the plugin can generate a report.
      +
      Returns whether or not a report can be generated.
      -void -execute() -
      Executes the dependency-check and generates the report.
      +protected void +executeAggregateReport(org.apache.maven.project.MavenProject project, + Locale locale) +
      Generates the aggregate Site Report.
      -void -generate(org.codehaus.doxia.sink.Sink sink, - Locale locale) +protected void +executeNonAggregateReport(Locale locale)
      Generates the Dependency-Check Site Report.
      -void -generate(org.apache.maven.doxia.sink.Sink sink, - org.apache.maven.doxia.sink.SinkFactory sinkFactory, - Locale locale) -
      Generates the Dependency-Check Site Report.
      - - - String getCategoryName()
      Returns the category name.
      - + String getDescription(Locale locale)
      Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
      - + String getName(Locale locale)
      Returns the report name.
      - + String getOutputName()
      Returns the output name.
      + +protected void +performExecute() +
      Executes the dependency-check and generates the report.
      + + -File -getReportOutputDirectory() -
      Returns the output directory.
      +protected void +postExecute() +
      Runs after the mojo has executed.
      -boolean -isExternalReport() -
      Returns whether this is an external report.
      +protected void +postGenerate() +
      Executes after the site report has been generated.
      -void -setReportOutputDirectory(File directory) -
      Sets the Reporting output directory.
      +protected List<Dependency> +readDataFile() +
      Reads the serialized scan data from disk.
      + + + +protected List<Dependency> +readDataFile(org.apache.maven.project.MavenProject project) +
      Reads the serialized scan data from disk.
      + + + +protected File +writeDataFile() +
      Writes the scan data to disk.
      +
      • @@ -278,6 +313,7 @@ implements org.apache.maven.reporting.MavenMultiPageReport
      • DependencyCheckMojo

        public DependencyCheckMojo()
        +
        Constructs a new dependency-check-mojo.
      @@ -288,57 +324,93 @@ implements org.apache.maven.reporting.MavenMultiPageReport

      Method Detail

      - +
      • -

        execute

        -
        public void execute()
        -             throws org.apache.maven.plugin.MojoExecutionException,
        -                    org.apache.maven.plugin.MojoFailureException
        +

        performExecute

        +
        protected void performExecute()
        +                       throws org.apache.maven.plugin.MojoExecutionException,
        +                              org.apache.maven.plugin.MojoFailureException
        Executes the dependency-check and generates the report.
        Specified by:
        -
        execute in interface org.apache.maven.plugin.Mojo
        +
        performExecute in class ReportAggregationMojo
        Throws:
        org.apache.maven.plugin.MojoExecutionException - if a maven exception occurs
        org.apache.maven.plugin.MojoFailureException - thrown if a CVSS score is found that is higher then the configured level
      - +
      • -

        generate

        -
        public void generate(org.codehaus.doxia.sink.Sink sink,
        -            Locale locale)
        -              throws org.apache.maven.reporting.MavenReportException
        -
        Generates the Dependency-Check Site Report.
        +

        postExecute

        +
        protected void postExecute()
        +                    throws org.apache.maven.plugin.MojoExecutionException,
        +                           org.apache.maven.plugin.MojoFailureException
        +
        Description copied from class: ReportAggregationMojo
        +
        Runs after the mojo has executed. This implementation will call writeDataFile(). As such, it is + important that if this method is overriden that super.postExecute() is called.
        -
        Specified by:
        -
        generate in interface org.apache.maven.reporting.MavenReport
        -
        Parameters:
        sink - the sink to write the report to
        locale - the locale to use when generating the report
        +
        Overrides:
        +
        postExecute in class ReportAggregationMojo
        Throws:
        -
        org.apache.maven.reporting.MavenReportException - if a Maven report exception occurs
        +
        org.apache.maven.plugin.MojoExecutionException - thrown if there is an issue executing the mojo
        +
        org.apache.maven.plugin.MojoFailureException - thrown if there is an issue executing the mojo
      - +
      • -

        generate

        -
        public void generate(org.apache.maven.doxia.sink.Sink sink,
        -            org.apache.maven.doxia.sink.SinkFactory sinkFactory,
        -            Locale locale)
        -              throws org.apache.maven.reporting.MavenReportException
        +

        postGenerate

        +
        protected void postGenerate()
        +                     throws org.apache.maven.reporting.MavenReportException
        +
        Description copied from class: ReportAggregationMojo
        +
        Executes after the site report has been generated.
        +
        +
        Overrides:
        +
        postGenerate in class ReportAggregationMojo
        +
        Throws:
        +
        org.apache.maven.reporting.MavenReportException - if a maven report exception occurs
        +
      • +
      + + + +
        +
      • +

        executeNonAggregateReport

        +
        protected void executeNonAggregateReport(Locale locale)
        +                                  throws org.apache.maven.reporting.MavenReportException
        Generates the Dependency-Check Site Report.
        Specified by:
        -
        generate in interface org.apache.maven.reporting.MavenMultiPageReport
        -
        Parameters:
        sink - the sink to write the report to
        sinkFactory - the sink factory
        locale - the locale to use when generating the report
        +
        executeNonAggregateReport in class ReportAggregationMojo
        +
        Parameters:
        locale - the locale to use when generating the report
        +
        Throws:
        +
        org.apache.maven.reporting.MavenReportException - if a maven report exception occurs
        +
      • +
      + + + +
        +
      • +

        executeAggregateReport

        +
        protected void executeAggregateReport(org.apache.maven.project.MavenProject project,
        +                          Locale locale)
        +                               throws org.apache.maven.reporting.MavenReportException
        +
        Description copied from class: ReportAggregationMojo
        +
        Generates the aggregate Site Report.
        +
        +
        Specified by:
        +
        executeAggregateReport in class ReportAggregationMojo
        +
        Parameters:
        project - the maven project used to generate the aggregate report
        locale - the locale to use when generating the report
        Throws:
        org.apache.maven.reporting.MavenReportException - if a maven report exception occurs
      • @@ -351,10 +423,7 @@ implements org.apache.maven.reporting.MavenMultiPageReport

        getOutputName

        public String getOutputName()
        Returns the output name.
        -
        -
        Specified by:
        -
        getOutputName in interface org.apache.maven.reporting.MavenReport
        -
        Returns:
        the output name
        +
        Returns:
        the output name
      @@ -365,10 +434,7 @@ implements org.apache.maven.reporting.MavenMultiPageReport

      getCategoryName

      public String getCategoryName()
      Returns the category name.
      -
      -
      Specified by:
      -
      getCategoryName in interface org.apache.maven.reporting.MavenReport
      -
      Returns:
      the category name
      +
      Returns:
      the category name
    @@ -379,41 +445,10 @@ implements org.apache.maven.reporting.MavenMultiPageReport

    getName

    public String getName(Locale locale)
    Returns the report name.
    -
    -
    Specified by:
    -
    getName in interface org.apache.maven.reporting.MavenReport
    -
    Parameters:
    locale - the location
    +
    Parameters:
    locale - the location
    Returns:
    the report name
    - - - -
      -
    • -

      setReportOutputDirectory

      -
      public void setReportOutputDirectory(File directory)
      -
      Sets the Reporting output directory.
      -
      -
      Specified by:
      -
      setReportOutputDirectory in interface org.apache.maven.reporting.MavenReport
      -
      Parameters:
      directory - the output directory
      -
    • -
    - - - -
      -
    • -

      getReportOutputDirectory

      -
      public File getReportOutputDirectory()
      -
      Returns the output directory.
      -
      -
      Specified by:
      -
      getReportOutputDirectory in interface org.apache.maven.reporting.MavenReport
      -
      Returns:
      the output directory
      -
    • -
    @@ -422,39 +457,88 @@ implements org.apache.maven.reporting.MavenMultiPageReport

    getDescription

    public String getDescription(Locale locale)
    Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    -
    -
    Specified by:
    -
    getDescription in interface org.apache.maven.reporting.MavenReport
    -
    Parameters:
    locale - The Locale to get the description for
    +
    Parameters:
    locale - The Locale to get the description for
    Returns:
    the description
    - - - -
      -
    • -

      isExternalReport

      -
      public boolean isExternalReport()
      -
      Returns whether this is an external report.
      -
      -
      Specified by:
      -
      isExternalReport in interface org.apache.maven.reporting.MavenReport
      -
      Returns:
      true or false;
      -
    • -
    -
      +
      • canGenerateReport

        public boolean canGenerateReport()
        -
        Returns whether or not the plugin can generate a report.
        +
        Returns whether or not a report can be generated.
        +
        Returns:
        true if a report can be generated; otherwise false
        +
      • +
      + + + +
        +
      • +

        canGenerateNonAggregateReport

        +
        protected boolean canGenerateNonAggregateReport()
        +
        Returns whether or not a non-aggregate report can be generated.
        Specified by:
        -
        canGenerateReport in interface org.apache.maven.reporting.MavenReport
        -
        Returns:
        true
        +
        canGenerateNonAggregateReport in class ReportAggregationMojo
        +
        Returns:
        true if a non-aggregate report can be generated; otherwise false
    + + + + + +
      +
    • +

      canGenerateAggregateReport

      +
      protected boolean canGenerateAggregateReport()
      +
      Returns whether or not an aggregate report can be generated.
      +
      +
      Specified by:
      +
      canGenerateAggregateReport in class ReportAggregationMojo
      +
      Returns:
      true if an aggregate report can be generated; otherwise false
      +
    • +
    + + + +
      +
    • +

      writeDataFile

      +
      protected File writeDataFile()
      +
      Writes the scan data to disk. This is used to serialize the scan data between the "check" and "aggregate" phase.
      +
      +
      Specified by:
      +
      writeDataFile in class ReportAggregationMojo
      +
      Returns:
      the File object referencing the data file that was written
      +
    • +
    + + + +
      +
    • +

      readDataFile

      +
      protected List<Dependency> readDataFile()
      +
      Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and + "aggregate" phase.
      +
      Returns:
      a Engine object populated with dependencies if the serialized data file exists; otherwise + null is returned
      +
    • +
    + + + +
      +
    • +

      readDataFile

      +
      protected List<Dependency> readDataFile(org.apache.maven.project.MavenProject project)
      +
      Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and + "aggregate" phase.
      +
      Parameters:
      project - the Maven project to read the data file from
      +
      Returns:
      a Engine object populated with dependencies if the serialized data file exists; otherwise + null is returned
    diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html index eeb77de83..32950a32a 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html @@ -2,16 +2,16 @@ - + -HelpMojo (Dependency-Check Maven Plugin 1.2.4 API) - +HelpMojo (Dependency-Check Maven Plugin 1.2.5 API) + @@ -37,7 +37,7 @@ + +ReportAggregationMojo + +
    + This is an abstract reporting mojo that enables report aggregation.
    + + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html index fe31708b4..4713e1adb 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.2.4 API) - +org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.2.5 API) + @@ -72,8 +72,12 @@
    • org.apache.maven.plugin.AbstractMojo (implements org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo)
    diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html index e2092cfc1..82519b125 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.5 API) + @@ -65,7 +65,28 @@

    Uses of Package
    org.owasp.dependencycheck.maven

    -
    No usage of org.owasp.dependencycheck.maven
    +
    + +
    diff --git a/dependency-check-maven/apidocs/overview-tree.html b/dependency-check-maven/apidocs/overview-tree.html index bd66a834f..afb165ac4 100644 --- a/dependency-check-maven/apidocs/overview-tree.html +++ b/dependency-check-maven/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Maven Plugin 1.2.4 API) - +Class Hierarchy (Dependency-Check Maven Plugin 1.2.5 API) + @@ -76,8 +76,12 @@ diff --git a/dependency-check-maven/check-mojo.html b/dependency-check-maven/check-mojo.html index a3e362f8a..b0c427651 100644 --- a/dependency-check-maven/check-mojo.html +++ b/dependency-check-maven/check-mojo.html @@ -1,13 +1,13 @@ - + dependency-check-maven - dependency-check:check @@ -55,7 +55,7 @@
  • - + /
  • @@ -69,9 +69,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -107,7 +107,7 @@ Project Information - +
  • @@ -165,7 +165,7 @@

    Full name:

    -

    org.owasp:dependency-check-maven:1.2.4:check

    +

    org.owasp:dependency-check-maven:1.2.5:check

    Description:

    @@ -217,13 +217,13 @@ is not recommended that this be turned to false. Default is true.
    Defaul -
    externalReport +dataFileName -boolean +String - -Sets whether or not the external report format should be used.
    Default value is: false.
    User property is: externalReport. +Sets whether or not the external report format should be used.
    Default value is: dependency-check.ser.
    User property is: metaFileName. @@ -295,6 +295,17 @@ Dependency-Check report. This generally maps to "target/site".
    +aggregate + +boolean + +- + +Generate aggregate reports in multi-module projects.
    Default value is: false.
    User property is: aggregate. + + + + archiveAnalyzerEnabled boolean @@ -304,7 +315,7 @@ Dependency-Check report. This generally maps to "target/site".
    Whether or not the Archive Analyzer is enabled.
    Default value is: true.
    User property is: archiveAnalyzerEnabled. - + assemblyAnalyzerEnabled @@ -315,7 +326,7 @@ Dependency-Check report. This generally maps to "target/site".
    Whether or not the .NET Assembly Analyzer is enabled.
    Default value is: true.
    User property is: assemblyAnalyzerEnabled. - + connectionString @@ -326,7 +337,7 @@ Dependency-Check report. This generally maps to "target/site".
    The database connection string.
    User property is: connectionString. - + connectionTimeout @@ -337,7 +348,7 @@ Dependency-Check report. This generally maps to "target/site".
    The Connection Timeout.
    User property is: connectionTimeout. - + cveUrl12Base @@ -348,7 +359,7 @@ Dependency-Check report. This generally maps to "target/site".
    Base Data Mirror URL for CVE 1.2.
    User property is: cveUrl12Base. - + cveUrl12Modified @@ -359,7 +370,7 @@ Dependency-Check report. This generally maps to "target/site".
    Data Mirror URL for CVE 1.2.
    User property is: cveUrl12Modified. - + cveUrl20Base @@ -370,7 +381,7 @@ Dependency-Check report. This generally maps to "target/site".
    Data Mirror URL for CVE 2.0.
    User property is: cveUrl20Base. - + cveUrl20Modified @@ -381,7 +392,7 @@ Dependency-Check report. This generally maps to "target/site".
    Data Mirror URL for CVE 2.0.
    User property is: cveUrl20Modified. - + dataDirectory @@ -392,7 +403,7 @@ Dependency-Check report. This generally maps to "target/site".
    The data directory, hold DC SQL DB.
    User property is: dataDirectory. - + databaseDriverName @@ -403,7 +414,7 @@ Dependency-Check report. This generally maps to "target/site".
    The database driver name. An example would be org.h2.Driver.
    User property is: databaseDriverName. - + databaseDriverPath @@ -414,7 +425,7 @@ Dependency-Check report. This generally maps to "target/site".
    The path to the database driver if it is not on the class path.
    User property is: databaseDriverPath. - + databasePassword @@ -425,7 +436,7 @@ Dependency-Check report. This generally maps to "target/site".
    The password to use when connecting to the database.
    User property is: databasePassword. - + databaseUser @@ -436,19 +447,18 @@ Dependency-Check report. This generally maps to "target/site".
    The database user name.
    User property is: databaseUser. - + -description +externalReport String - -The description of the Dependency-Check report to be displayed in -the Maven Generated Reports page.
    Default value is: A report providing details on any published vulnerabilities within project dependencies. This report is a best effort but may contain false positives and false negatives..
    User property is: description. +Deprecated. the internal report is no longer supported
    User property is: externalReport. - + jarAnalyzerEnabled @@ -459,7 +469,7 @@ the Maven Generated Reports page.
    Default value is: A report pro Whether or not the Jar Analyzer is enabled.
    Default value is: true.
    User property is: jarAnalyzerEnabled. - + logFile @@ -470,7 +480,7 @@ the Maven Generated Reports page.
    Default value is: A report pro The path to the verbose log.
    User property is: logfile. - + mavenSettings @@ -481,7 +491,7 @@ the Maven Generated Reports page.
    Default value is: A report pro The maven settings.
    Default value is: ${settings}.
    User property is: mavenSettings. - + mavenSettingsProxyId @@ -492,18 +502,6 @@ the Maven Generated Reports page.
    Default value is: A report pro The maven settings proxy id.
    User property is: mavenSettingsProxyId. - - -name - -String - -- - -The name of the report to be displayed in the Maven Generated -Reports page.
    Default value is: Dependency-Check.
    User property is: name. - - nexusAnalyzerEnabled @@ -642,6 +640,20 @@ to jar, zip, ....
    User property is: zipExtensions.

    Parameter Details

    +

    aggregate:

    + +
    Generate aggregate reports in multi-module projects.
    + +
      + +
    • Type: boolean
    • + +
    • Required: No
    • + +
    • User Property: aggregate
    • + +
    • Default: false
    • +

    archiveAnalyzerEnabled:

    Whether or not the Archive Analyzer is enabled.
    @@ -769,6 +781,20 @@ is not recommended that this be turned to false. Default is true.
  • User Property: dataDirectory

  • +

    dataFileName:

    + +
    Sets whether or not the external report format should be used.
    + +
      + +
    • Type: java.lang.String
    • + +
    • Required: Yes
    • + +
    • User Property: metaFileName
    • + +
    • Default: dependency-check.ser
    • +

    databaseDriverName:

    The database driver name. An example would be org.h2.Driver.
    @@ -817,10 +843,11 @@ is not recommended that this be turned to false. Default is true.
  • User Property: databaseUser

  • -

    description:

    +

    externalReport:

    -
    The description of the Dependency-Check report to be displayed in -the Maven Generated Reports page.
    +
    Deprecated. the internal report is no longer supported
    + +
    Sets whether or not the external report format should be used.
      @@ -828,23 +855,7 @@ the Maven Generated Reports page.
  • Required: No
  • -
  • User Property: description
  • - -
  • Default: A report providing details on any published vulnerabilities within project dependencies. This report is a best effort but may contain false positives and false negatives.
  • -
    -

    externalReport:

    - -
    Sets whether or not the external report format should be used.
    - -
      - -
    • Type: boolean
    • - -
    • Required: Yes
    • -
    • User Property: externalReport
    • - -
    • Default: false

    failBuildOnCVSS:

    @@ -930,21 +941,6 @@ plugin unless the externalReport is set to true. Default is HTML.
  • User Property: mavenSettingsProxyId

  • -

    name:

    - -
    The name of the report to be displayed in the Maven Generated -Reports page.
    - -
      - -
    • Type: java.lang.String
    • - -
    • Required: No
    • - -
    • User Property: name
    • - -
    • Default: Dependency-Check
    • -

    nexusAnalyzerEnabled:

    Whether or not the Nexus Analyzer is enabled.
    diff --git a/dependency-check-maven/checkstyle.html b/dependency-check-maven/checkstyle.html index 151e408d7..1cea0aae5 100644 --- a/dependency-check-maven/checkstyle.html +++ b/dependency-check-maven/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Checkstyle Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • @@ -243,10 +250,10 @@ Warnings Warnings Errors Errors -15 +19 0 0 -20 +2 +2

    Details

    -

    src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java

    +

    src/main/java/org/owasp/dependencycheck/maven/ReportAggregationMojo.java

    @@ -271,84 +278,12 @@ - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ViolationLine
    Errors'}' is not preceded with whitespace.141
    Line is longer than 150 characters (found 198).50
    Errors'}' is not preceded with whitespace.147
    Errors'}' is not preceded with whitespace.154
    Errors'}' is not preceded with whitespace.161
    Errors'}' is not preceded with whitespace.168
    Errors'}' is not preceded with whitespace.174
    Errors'}' is not preceded with whitespace.180
    Errors'}' is not preceded with whitespace.187
    Errors'}' is not preceded with whitespace.194
    Errors'}' is not preceded with whitespace.201
    Errors'}' is not preceded with whitespace.208
    Errors'}' is not preceded with whitespace.215
    Errors'}' is not preceded with whitespace.221
    Errors'}' is not preceded with whitespace.227
    Errors'}' is not preceded with whitespace.233
    Errors'}' is not preceded with whitespace.239
    Errors'}' is not preceded with whitespace.245
    Errors'}' is not preceded with whitespace.251
    Errors'}' is not preceded with whitespace.257
    Errors'}' is not preceded with whitespace.320
    +Line is longer than 150 characters (found 170). +54 diff --git a/dependency-check-maven/checkstyle.rss b/dependency-check-maven/checkstyle.rss index 31f0cc0c5..9ce83d4dc 100644 --- a/dependency-check-maven/checkstyle.rss +++ b/dependency-check-maven/checkstyle.rss @@ -25,8 +25,8 @@ under the License. en-us ©2013 - 2014 OWASP - File: 15, - Errors: 20, + <title>File: 19, + Errors: 2, Warnings: 0, Infos: 0 @@ -46,7 +46,7 @@ under the License. - org/owasp/dependencycheck/maven/package-info.java + org/owasp/dependencycheck/maven/ReportingUtil.java 0 @@ -71,6 +71,34 @@ under the License. 0 + + + + org/owasp/dependencycheck/maven/package-info.java + + + 0 + + + 0 + + + 0 + + + + + org/owasp/dependencycheck/maven/ReportAggregationMojo.java + + + 0 + + + 0 + + + 0 + @@ -83,7 +111,7 @@ under the License. 0 - 20 + 0 @@ -197,20 +225,6 @@ under the License. 0 - - - - log.properties - - - 0 - - - 0 - - - 0 - @@ -225,6 +239,34 @@ under the License. 0 + + + + log.properties + + + 0 + + + 0 + + + 0 + + + + + src/main/java/org/owasp/dependencycheck/maven/ReportAggregationMojo.java + + + 0 + + + 0 + + + 2 + @@ -239,6 +281,20 @@ under the License. 0 + + + + src/main/java/org/owasp/dependencycheck/maven/ReportingUtil.java + + + 0 + + + 0 + + + 0 + diff --git a/dependency-check-maven/cobertura/frame-sourcefiles-org.owasp.dependencycheck.maven.html b/dependency-check-maven/cobertura/frame-sourcefiles-org.owasp.dependencycheck.maven.html index ab1109734..3f4ba4014 100644 --- a/dependency-check-maven/cobertura/frame-sourcefiles-org.owasp.dependencycheck.maven.html +++ b/dependency-check-maven/cobertura/frame-sourcefiles-org.owasp.dependencycheck.maven.html @@ -20,6 +20,12 @@ org.owasp.dependencycheck.maven HelpMojo (0%) + +ReportAggregationMojo (0%) + + +ReportingUtil (0%) + diff --git a/dependency-check-maven/cobertura/frame-sourcefiles.html b/dependency-check-maven/cobertura/frame-sourcefiles.html index b3390c2e4..520d305ce 100644 --- a/dependency-check-maven/cobertura/frame-sourcefiles.html +++ b/dependency-check-maven/cobertura/frame-sourcefiles.html @@ -20,6 +20,12 @@ All Packages HelpMojo (0%) + +ReportAggregationMojo (0%) + + +ReportingUtil (0%) + diff --git a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html index e63674c5c..c6e872445 100644 --- a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html +++ b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.maven2
    0%
    0/599
    0%
    0/328
    5.341
    org.owasp.dependencycheck.maven4
    0%
    0/807
    0%
    0/404
    4.036
    - + diff --git a/dependency-check-maven/cobertura/frame-summary.html b/dependency-check-maven/cobertura/frame-summary.html index 31ca109db..ebef30df5 100644 --- a/dependency-check-maven/cobertura/frame-summary.html +++ b/dependency-check-maven/cobertura/frame-summary.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages2
    0%
    0/599
    0%
    0/328
    5.341
    org.owasp.dependencycheck.maven2
    0%
    0/599
    0%
    0/328
    5.341
    All Packages4
    0%
    0/807
    0%
    0/404
    4.036
    org.owasp.dependencycheck.maven4
    0%
    0/807
    0%
    0/404
    4.036
    - + diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html index b74abf8d3..6d75e862f 100644 --- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyCheckMojo
    0%
    0/448
    0%
    0/222
    5.379
    DependencyCheckMojo
    0%
    0/316
    0%
    0/184
    5.96
     
    @@ -56,1773 +56,1499 @@  19  
     
     20   -
     import java.io.File;
    +
     import java.io.BufferedOutputStream;
     21   -
     import java.io.IOException;
    +
     import java.io.File;
     22   -
     import java.io.InputStream;
    +
     import java.io.FileInputStream;
     23   -
     import java.io.UnsupportedEncodingException;
    +
     import java.io.FileNotFoundException;
     24   -
     import java.net.URLEncoder;
    +
     import java.io.FileOutputStream;
     25   -
     import java.text.DateFormat;
    +
     import java.io.IOException;
     26   -
     import java.util.Date;
    +
     import java.io.InputStream;
     27   -
     import java.util.List;
    +
     import java.io.ObjectInputStream;
     28   -
     import java.util.Locale;
    +
     import java.io.ObjectOutputStream;
     29   -
     import java.util.Set;
    +
     import java.io.OutputStream;
     30   -
     import java.util.logging.Level;
    +
     import java.util.List;
     31   -
     import java.util.logging.Logger;
    +
     import java.util.Locale;
     32   -
     import org.apache.maven.artifact.Artifact;
    +
     import java.util.Set;
     33   -
     import org.apache.maven.doxia.sink.Sink;
    +
     import java.util.logging.Level;
     34   -
     import org.apache.maven.doxia.sink.SinkFactory;
    +
     import java.util.logging.Logger;
     35   -
     import org.apache.maven.plugin.AbstractMojo;
    +
     import org.apache.maven.artifact.Artifact;
     36  
     import org.apache.maven.plugin.MojoExecutionException;
     37  
     import org.apache.maven.plugin.MojoFailureException;
     38   -
     import org.apache.maven.plugins.annotations.Component;
    -  39  
     import org.apache.maven.plugins.annotations.LifecyclePhase;
    -  40   +  39  
     import org.apache.maven.plugins.annotations.Mojo;
    -  41   +  40  
     import org.apache.maven.plugins.annotations.Parameter;
    -  42   +  41  
     import org.apache.maven.plugins.annotations.ResolutionScope;
    -  43   +  42  
     import org.apache.maven.project.MavenProject;
    -  44   -
     import org.apache.maven.reporting.MavenMultiPageReport;
    -  45   +  43  
     import org.apache.maven.reporting.MavenReport;
    -  46   +  44  
     import org.apache.maven.reporting.MavenReportException;
    -  47   +  45  
     import org.apache.maven.settings.Proxy;
    -  48   +  46  
     import org.owasp.dependencycheck.Engine;
    +  47   +
     import org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer;
    +  48   +
     import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
     49   -
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  50  
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    -  51   -
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
    -  52   +  50  
     import org.owasp.dependencycheck.dependency.Dependency;
    -  53   -
     import org.owasp.dependencycheck.dependency.Evidence;
    -  54   +  51  
     import org.owasp.dependencycheck.dependency.Identifier;
    -  55   -
     import org.owasp.dependencycheck.dependency.Reference;
    -  56   +  52  
     import org.owasp.dependencycheck.dependency.Vulnerability;
    -  57   -
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    -  58   -
     import org.owasp.dependencycheck.reporting.ReportGenerator;
    -  59   +  53  
     import org.owasp.dependencycheck.utils.LogUtils;
    -  60   +  54  
     import org.owasp.dependencycheck.utils.Settings;
    -  61   +  55  
     
    -  62   +  56  
     /**
    -  63   +  57  
      * Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
    -  64   +  58  
      *
    -  65   +  59  
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  66   +  60  
      */
    -  67   +  61  
     @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true,
    -  68   +  62  
             requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
    -  69   +  63  
             requiresOnline = true)
    -  70  0
     public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
    -  71   +  64   +
     public class DependencyCheckMojo extends ReportAggregationMojo {
    +  65  
     
    -  72   +  66   +
         //<editor-fold defaultstate="collapsed" desc="Private fields">
    +  67  
         /**
    -  73   +  68  
          * Logger field reference.
    -  74   +  69  
          */
    -  75  0
         private final Logger logger = Logger.getLogger(DependencyCheckMojo.class.getName());
    -  76   -
     
    -  77   +  70  0
         private static final Logger LOGGER = Logger.getLogger(DependencyCheckMojo.class.getName());
    +  71  
         /**
    -  78   +  72  
          * The properties file location.
    -  79   +  73  
          */
    -  80   +  74  
         private static final String PROPERTIES_FILE = "mojo.properties";
    -  81   +  75  
         /**
    -  82   +  76  
          * Name of the logging properties file.
    -  83   +  77  
          */
    -  84   +  78  
         private static final String LOG_PROPERTIES_FILE = "log.properties";
    -  85   +  79  
         /**
    -  86   +  80  
          * System specific new line character.
    -  87   +  81  
          */
    -  88  0
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
    +  82  0
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
    +  83   +
         /**
    +  84   +
          * The dependency-check engine used to scan the project.
    +  85   +
          */
    +  86  0
         private Engine engine = null;
    +  87   +
         //</editor-fold>
    +  88   +
     
     89  
         // <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">
     90  
         /**
     91   -
          * The Maven Project Object.
    +
          * The path to the verbose log.
     92  
          */
    -  93   -
         @Component
    +  93  0
         @Parameter(property = "logfile", defaultValue = "")
     94   -
         private MavenProject project;
    +
         private String logFile = null;
     95  
         /**
     96   -
          * The path to the verbose log.
    +
          * The output directory. This generally maps to "target".
     97  
          */
     98   -
         @Parameter(property = "logfile", defaultValue = "")
    +
         @Parameter(defaultValue = "${project.build.directory}", required = true)
     99   -
         private String logFile;
    +
         private File outputDirectory;
     100  
         /**
     101   -
          * The name of the report to be displayed in the Maven Generated Reports page.
    -  102   -
          */
    -  103   -
         @Parameter(property = "name", defaultValue = "Dependency-Check")
    -  104   -
         private String name;
    -  105   -
         /**
    -  106   -
          * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    -  107   -
          */
    -  108   -
         @Parameter(property = "description", defaultValue = "A report providing details on any published "
    -  109   -
                 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
    -  110   -
                 + "false positives and false negatives.")
    -  111   -
         private String description;
    -  112   -
         /**
    -  113   -
          * Specifies the destination directory for the generated Dependency-Check report. This generally maps to
    -  114   -
          * "target/site".
    -  115   -
          */
    -  116   -
         @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
    -  117   -
         private File reportOutputDirectory;
    -  118   -
         /**
    -  119   -
          * The output directory. This generally maps to "target".
    -  120   -
          */
    -  121   -
         @Parameter(defaultValue = "${project.build.directory}", required = true)
    -  122   -
         private File outputDirectory;
    -  123   -
         /**
    -  124  
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
    -  125   +  102  
          * which means since the CVSS scores are 0-10, by default the build will never fail.
    -  126   +  103  
          */
    -  127  0
         @SuppressWarnings("CanBeFinal")
    -  128   +  104  0
         @SuppressWarnings("CanBeFinal")
    +  105  
         @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
    -  129   +  106  
         private float failBuildOnCVSS = 11;
    -  130   +  107  
         /**
    -  131   +  108  
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
    -  132   +  109  
          * false. Default is true.
    -  133   +  110  
          */
    -  134  0
         @SuppressWarnings("CanBeFinal")
    -  135   +  111  0
         @SuppressWarnings("CanBeFinal")
    +  112  
         @Parameter(property = "autoupdate", defaultValue = "true", required = true)
    -  136   +  113  
         private boolean autoUpdate = true;
    -  137   +  114  
         /**
    -  138   +  115  
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
    -  139   +  116  
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
    -  140   +  117  
          */
    -  141  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  142   +  118  0
         @SuppressWarnings("CanBeFinal")
    +  119  
         @Parameter(property = "format", defaultValue = "HTML", required = true)
    -  143   +  120  
         private String format = "HTML";
    -  144   +  121  
         /**
    -  145   -
          * Sets whether or not the external report format should be used.
    -  146   -
          */
    -  147  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  148   -
         @Parameter(property = "externalReport", defaultValue = "false", required = true)
    -  149   -
         private boolean externalReport = false;
    -  150   -
     
    -  151   -
         /**
    -  152   +  122  
          * The maven settings.
    -  153   +  123  
          */
    -  154   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  155   +  124  
         @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false)
    -  156   +  125  
         private org.apache.maven.settings.Settings mavenSettings;
    -  157   +  126  
     
    -  158   +  127  
         /**
    -  159   +  128  
          * The maven settings proxy id.
    -  160   +  129  
          */
    -  161   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  162   +  130   +
         @SuppressWarnings("CanBeFinal")
    +  131  
         @Parameter(property = "mavenSettingsProxyId", required = false)
    -  163   +  132  
         private String mavenSettingsProxyId;
    -  164   +  133  
     
    -  165   +  134  
         /**
    -  166   +  135  
          * The Connection Timeout.
    -  167   +  136  
          */
    -  168  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  169   +  137  0
         @SuppressWarnings("CanBeFinal")
    +  138  
         @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
    -  170   +  139  
         private String connectionTimeout = null;
    -  171   +  140  
         /**
    -  172   +  141  
          * The path to the suppression file.
    -  173   +  142  
          */
    -  174  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  175   +  143  0
         @SuppressWarnings("CanBeFinal")
    +  144  
         @Parameter(property = "suppressionFile", defaultValue = "", required = false)
    -  176   +  145  
         private String suppressionFile = null;
    -  177   +  146  
         /**
    -  178   +  147  
          * Flag indicating whether or not to show a summary in the output.
    -  179   +  148  
          */
    -  180  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  181   +  149  0
         @SuppressWarnings("CanBeFinal")
    +  150  
         @Parameter(property = "showSummary", defaultValue = "true", required = false)
    -  182   +  151  
         private boolean showSummary = true;
    -  183   +  152  
     
    -  184   +  153  
         /**
    -  185   +  154  
          * Whether or not the Jar Analyzer is enabled.
    -  186   +  155  
          */
    -  187  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  188   +  156  0
         @SuppressWarnings("CanBeFinal")
    +  157  
         @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false)
    -  189   +  158  
         private boolean jarAnalyzerEnabled = true;
    -  190   +  159  
     
    -  191   +  160  
         /**
    -  192   +  161  
          * Whether or not the Archive Analyzer is enabled.
    -  193   +  162  
          */
    -  194  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  195   +  163  0
         @SuppressWarnings("CanBeFinal")
    +  164  
         @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false)
    -  196   +  165  
         private boolean archiveAnalyzerEnabled = true;
    -  197   +  166  
     
    -  198   +  167  
         /**
    -  199   +  168  
          * Whether or not the .NET Assembly Analyzer is enabled.
    -  200   +  169  
          */
    -  201  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  202   +  170  0
         @SuppressWarnings("CanBeFinal")
    +  171  
         @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false)
    -  203   +  172  
         private boolean assemblyAnalyzerEnabled = true;
    -  204   +  173  
     
    -  205   +  174  
         /**
    -  206   +  175  
          * Whether or not the .NET Nuspec Analyzer is enabled.
    -  207   +  176  
          */
    -  208  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  209   +  177  0
         @SuppressWarnings("CanBeFinal")
    +  178  
         @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false)
    -  210   +  179  
         private boolean nuspecAnalyzerEnabled = true;
    -  211   +  180  
     
    +  181   +
         /**
    +  182   +
          * Whether or not the Nexus Analyzer is enabled.
    +  183   +
          */
    +  184  0
         @SuppressWarnings("CanBeFinal")
    +  185   +
         @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false)
    +  186   +
         private boolean nexusAnalyzerEnabled = true;
    +  187   +
         /**
    +  188   +
          * Whether or not the Nexus Analyzer is enabled.
    +  189   +
          */
    +  190   +
         @Parameter(property = "nexusUrl", defaultValue = "", required = false)
    +  191   +
         private String nexusUrl;
    +  192   +
         /**
    +  193   +
          * Whether or not the configured proxy is used to connect to Nexus.
    +  194   +
          */
    +  195  0
         @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false)
    +  196   +
         private boolean nexusUsesProxy = true;
    +  197   +
         /**
    +  198   +
          * The database connection string.
    +  199   +
          */
    +  200   +
         @Parameter(property = "connectionString", defaultValue = "", required = false)
    +  201   +
         private String connectionString;
    +  202   +
         /**
    +  203   +
          * The database driver name. An example would be org.h2.Driver.
    +  204   +
          */
    +  205   +
         @Parameter(property = "databaseDriverName", defaultValue = "", required = false)
    +  206   +
         private String databaseDriverName;
    +  207   +
         /**
    +  208   +
          * The path to the database driver if it is not on the class path.
    +  209   +
          */
    +  210   +
         @Parameter(property = "databaseDriverPath", defaultValue = "", required = false)
    +  211   +
         private String databaseDriverPath;
     212  
         /**
     213   -
          * Whether or not the Nexus Analyzer is enabled.
    +
          * The database user name.
     214  
          */
    -  215  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  216   -
         @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false)
    -  217   -
         private boolean nexusAnalyzerEnabled = true;
    -  218   -
         /**
    -  219   -
          * Whether or not the Nexus Analyzer is enabled.
    -  220   -
          */
    -  221   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  222   -
         @Parameter(property = "nexusUrl", defaultValue = "", required = false)
    -  223   -
         private String nexusUrl;
    -  224   -
         /**
    -  225   -
          * Whether or not the configured proxy is used to connect to Nexus.
    -  226   -
          */
    -  227  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  228   -
         @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false)
    -  229   -
         private boolean nexusUsesProxy = true;
    -  230   -
         /**
    -  231   -
          * The database connection string.
    -  232   -
          */
    -  233   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  234   -
         @Parameter(property = "connectionString", defaultValue = "", required = false)
    -  235   -
         private String connectionString;
    -  236   -
         /**
    -  237   -
          * The database driver name. An example would be org.h2.Driver.
    -  238   -
          */
    -  239   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  240   -
         @Parameter(property = "databaseDriverName", defaultValue = "", required = false)
    -  241   -
         private String databaseDriverName;
    -  242   -
         /**
    -  243   -
          * The path to the database driver if it is not on the class path.
    -  244   -
          */
    -  245   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  246   -
         @Parameter(property = "databaseDriverPath", defaultValue = "", required = false)
    -  247   -
         private String databaseDriverPath;
    -  248   -
         /**
    -  249   -
          * The database user name.
    -  250   -
          */
    -  251   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  252   +  215  
         @Parameter(property = "databaseUser", defaultValue = "", required = false)
    -  253   +  216  
         private String databaseUser;
    -  254   +  217  
         /**
    -  255   +  218  
          * The password to use when connecting to the database.
    -  256   +  219  
          */
    -  257   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  258   +  220  
         @Parameter(property = "databasePassword", defaultValue = "", required = false)
    -  259   +  221  
         private String databasePassword;
    +  222   +
         /**
    +  223   +
          * A comma-separated list of file extensions to add to analysis next to jar, zip, ....
    +  224   +
          */
    +  225   +
         @Parameter(property = "zipExtensions", required = false)
    +  226   +
         private String zipExtensions;
    +  227   +
         /**
    +  228   +
          * Skip Analysis for Test Scope Dependencies.
    +  229   +
          */
    +  230  0
         @SuppressWarnings("CanBeFinal")
    +  231   +
         @Parameter(property = "skipTestScope", defaultValue = "true", required = false)
    +  232   +
         private boolean skipTestScope = true;
    +  233   +
         /**
    +  234   +
          * Skip Analysis for Runtime Scope Dependencies.
    +  235   +
          */
    +  236  0
         @SuppressWarnings("CanBeFinal")
    +  237   +
         @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false)
    +  238   +
         private boolean skipRuntimeScope = false;
    +  239   +
         /**
    +  240   +
          * Skip Analysis for Provided Scope Dependencies.
    +  241   +
          */
    +  242  0
         @SuppressWarnings("CanBeFinal")
    +  243   +
         @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false)
    +  244   +
         private boolean skipProvidedScope = false;
    +  245   +
         /**
    +  246   +
          * The data directory, hold DC SQL DB.
    +  247   +
          */
    +  248   +
         @Parameter(property = "dataDirectory", defaultValue = "", required = false)
    +  249   +
         private String dataDirectory;
    +  250   +
         /**
    +  251   +
          * Data Mirror URL for CVE 1.2.
    +  252   +
          */
    +  253   +
         @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false)
    +  254   +
         private String cveUrl12Modified;
    +  255   +
         /**
    +  256   +
          * Data Mirror URL for CVE 2.0.
    +  257   +
          */
    +  258   +
         @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false)
    +  259   +
         private String cveUrl20Modified;
     260  
         /**
     261   -
          * A comma-separated list of file extensions to add to analysis next to jar, zip, ....
    +
          * Base Data Mirror URL for CVE 1.2.
     262  
          */
     263   -
         @Parameter(property = "zipExtensions", required = false)
    +
         @Parameter(property = "cveUrl12Base", defaultValue = "", required = false)
     264   -
         private String zipExtensions;
    +
         private String cveUrl12Base;
     265  
         /**
     266   -
          * Skip Analysis for Test Scope Dependencies.
    +
          * Data Mirror URL for CVE 2.0.
     267  
          */
    -  268  0
         @SuppressWarnings("CanBeFinal")
    +  268   +
         @Parameter(property = "cveUrl20Base", defaultValue = "", required = false)
     269   -
         @Parameter(property = "skipTestScope", defaultValue = "true", required = false)
    +
         private String cveUrl20Base;
     270   -
         private boolean skipTestScope = true;
    +
     
     271  
         /**
     272   -
          * Skip Analysis for Runtime Scope Dependencies.
    +
          * The path to mono for .NET Assembly analysis on non-windows systems.
     273  
          */
    -  274  0
         @SuppressWarnings("CanBeFinal")
    +  274   +
         @Parameter(property = "pathToMono", defaultValue = "", required = false)
     275   -
         @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false)
    +
         private String pathToMono;
     276   -
         private boolean skipRuntimeScope = false;
    +
     
     277  
         /**
     278   -
          * Skip Analysis for Provided Scope Dependencies.
    +
          * The Proxy URL.
     279   -
          */
    -  280  0
         @SuppressWarnings("CanBeFinal")
    +
          *
    +  280   +
          * @deprecated Please use mavenSettings instead
     281   -
         @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false)
    -  282   -
         private boolean skipProvidedScope = false;
    -  283   -
         /**
    -  284   -
          * The data directory, hold DC SQL DB.
    -  285  
          */
    +  282  0
         @SuppressWarnings("CanBeFinal")
    +  283   +
         @Parameter(property = "proxyUrl", defaultValue = "", required = false)
    +  284   +
         @Deprecated
    +  285   +
         private String proxyUrl = null;
     286   -
         @Parameter(property = "dataDirectory", defaultValue = "", required = false)
    -  287   -
         private String dataDirectory;
    -  288  
         /**
    +  287   +
          * Sets whether or not the external report format should be used.
    +  288   +
          *
     289   -
          * Data Mirror URL for CVE 1.2.
    +
          * @deprecated the internal report is no longer supported
     290  
          */
    -  291   -
         @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false)
    +  291  0
         @SuppressWarnings("CanBeFinal")
     292   -
         private String cveUrl12Modified;
    +
         @Parameter(property = "externalReport")
     293   -
         /**
    -  294   -
          * Data Mirror URL for CVE 2.0.
    -  295   -
          */
    -  296   -
         @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false)
    -  297   -
         private String cveUrl20Modified;
    -  298   -
         /**
    -  299   -
          * Base Data Mirror URL for CVE 1.2.
    -  300   -
          */
    -  301   -
         @Parameter(property = "cveUrl12Base", defaultValue = "", required = false)
    -  302   -
         private String cveUrl12Base;
    -  303   -
         /**
    -  304   -
          * Data Mirror URL for CVE 2.0.
    -  305   -
          */
    -  306   -
         @Parameter(property = "cveUrl20Base", defaultValue = "", required = false)
    -  307   -
         private String cveUrl20Base;
    -  308   -
     
    -  309   -
         /**
    -  310   -
          * The path to mono for .NET Assembly analysis on non-windows systems.
    -  311   -
          */
    -  312   -
         @Parameter(property = "pathToMono", defaultValue = "", required = false)
    -  313   -
         private String pathToMono;
    -  314   -
     
    -  315   -
         /**
    -  316   -
          * The Proxy URL.
    -  317   -
          *
    -  318   -
          * @deprecated Please use mavenSettings instead
    -  319   -
          */
    -  320  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  321   -
         @Parameter(property = "proxyUrl", defaultValue = "", required = false)
    -  322  
         @Deprecated
    -  323   -
         private String proxyUrl = null;
    -  324   -
     
    -  325   +  294   +
         private String externalReport = null;
    +  295  
         // </editor-fold>
    -  326   +  296  
         /**
    -  327   -
          * Executes the Dependency-Check on the dependent libraries.
    -  328   -
          *
    -  329   -
          * @return the Engine used to scan the dependencies.
    -  330   -
          * @throws DatabaseException thrown if there is an exception connecting to the database
    -  331   +  297   +
          * Constructs a new dependency-check-mojo.
    +  298  
          */
    -  332   +  299  0
         public DependencyCheckMojo() {
    +  300  0
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  301  0
             LogUtils.prepareLogger(in, logFile);
    +  302  0
         }
    +  303   +
     
    +  304   +
         /**
    +  305   +
          * Executes the Dependency-Check on the dependent libraries.
    +  306   +
          *
    +  307   +
          * @return the Engine used to scan the dependencies.
    +  308   +
          * @throws DatabaseException thrown if there is an exception connecting to the database
    +  309   +
          */
    +  310  
         private Engine executeDependencyCheck() throws DatabaseException {
    +  311  0
             return executeDependencyCheck(getProject());
    +  312   +
         }
    +  313   +
     
    +  314   +
         /**
    +  315   +
          * Executes the Dependency-Check on the dependent libraries.
    +  316   +
          *
    +  317   +
          * @param project the project to run dependency-check on
    +  318   +
          * @return the Engine used to scan the dependencies.
    +  319   +
          * @throws DatabaseException thrown if there is an exception connecting to the database
    +  320   +
          */
    +  321   +
         private Engine executeDependencyCheck(MavenProject project) throws DatabaseException {
    +  322  0
             final Engine localEngine = initializeEngine();
    +  323   +
     
    +  324  0
             final Set<Artifact> artifacts = project.getArtifacts();
    +  325  0
             for (Artifact a : artifacts) {
    +  326  0
                 if (excludeFromScan(a)) {
    +  327  0
                     continue;
    +  328   +
                 }
    +  329   +
     
    +  330  0
                 localEngine.scan(a.getFile().getAbsolutePath());
    +  331  0
             }
    +  332  0
             localEngine.analyzeDependencies();
     333  
     
    -  334  0
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  335  0
             LogUtils.prepareLogger(in, logFile);
    +  334  0
             return localEngine;
    +  335   +
         }
     336  
     
    -  337  0
             populateSettings();
    -  338  0
             final Engine engine = new Engine();
    +  337   +
         /**
    +  338   +
          * Initializes a new <code>Engine</code> that can be used for scanning.
     339   -
     
    -  340  0
             final Set<Artifact> artifacts = project.getArtifacts();
    -  341  0
             for (Artifact a : artifacts) {
    -  342  0
                 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
    -  343  0
                     continue;
    -  344   -
                 }
    -  345   -
     
    -  346  0
                 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
    -  347  0
                     continue;
    +
          *
    +  340   +
          * @return a newly instantiated <code>Engine</code>
    +  341   +
          * @throws DatabaseException thrown if there is a database exception
    +  342   +
          */
    +  343   +
         private Engine initializeEngine() throws DatabaseException {
    +  344  0
             populateSettings();
    +  345  0
             final Engine localEngine = new Engine();
    +  346  0
             return localEngine;
    +  347   +
         }
     348   -
                 }
    +
     
     349   -
     
    -  350  0
                 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
    -  351  0
                     continue;
    +
         /**
    +  350   +
          * Tests is the artifact should be included in the scan (i.e. is the dependency in a scope that is being scanned).
    +  351   +
          *
     352   -
                 }
    +
          * @param a the Artifact to test
     353   -
     
    -  354  0
                 engine.scan(a.getFile().getAbsolutePath());
    -  355  0
             }
    -  356  0
             engine.analyzeDependencies();
    -  357   -
     
    -  358  0
             return engine;
    -  359   -
         }
    -  360   -
     
    +
          * @return <code>true</code> if the artifact is in an excluded scope; otherwise <code>false</code>
    +  354   +
          */
    +  355   +
         private boolean excludeFromScan(Artifact a) {
    +  356  0
             if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
    +  357  0
                 return true;
    +  358   +
             }
    +  359  0
             if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
    +  360  0
                 return true;
     361   -
         /**
    -  362   -
          * Generates the reports for a given dependency-check engine.
    -  363   -
          *
    +
             }
    +  362  0
             if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
    +  363  0
                 return true;
     364   -
          * @param engine a dependency-check engine
    -  365   -
          * @param outDirectory the directory to write the reports to
    +
             }
    +  365  0
             return false;
     366   -
          */
    +
         }
     367   -
         private void generateExternalReports(Engine engine, File outDirectory) {
    -  368  0
             DatabaseProperties prop = null;
    -  369  0
             CveDB cve = null;
    +
     
    +  368   +
         //<editor-fold defaultstate="collapsed" desc="Methods to populate global settings">
    +  369   +
         /**
     370   -
             try {
    -  371  0
                 cve = new CveDB();
    -  372  0
                 cve.open();
    -  373  0
                 prop = cve.getDatabaseProperties();
    -  374  0
             } catch (DatabaseException ex) {
    -  375  0
                 logger.log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +
          * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system
    +  371   +
          * properties required to change the proxy url, port, and connection timeout.
    +  372   +
          */
    +  373   +
         private void populateSettings() {
    +  374  0
             Settings.initialize();
    +  375  0
             InputStream mojoProperties = null;
     376   -
             } finally {
    -  377  0
                 if (cve != null) {
    -  378  0
                     cve.close();
    -  379   -
                 }
    -  380   -
             }
    -  381  0
             final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
    -  382  
             try {
    -  383  0
                 r.generateReports(outDirectory.getCanonicalPath(), format);
    -  384  0
             } catch (IOException ex) {
    -  385  0
                 logger.log(Level.SEVERE,
    -  386   -
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    -  387  0
                 logger.log(Level.FINE, null, ex);
    -  388  0
             } catch (Throwable ex) {
    -  389  0
                 logger.log(Level.SEVERE,
    -  390   -
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    -  391  0
                 logger.log(Level.FINE, null, ex);
    -  392  0
             }
    -  393  0
         }
    -  394   -
     
    -  395   -
         /**
    -  396   -
          * Generates a dependency-check report using the Maven Site format.
    -  397   -
          *
    -  398   -
          * @param engine the engine used to scan the dependencies
    -  399   -
          * @param sink the sink to write the data to
    -  400   -
          */
    -  401   -
         private void generateMavenSiteReport(final Engine engine, Sink sink) {
    -  402  0
             final List<Dependency> dependencies = engine.getDependencies();
    -  403   -
     
    -  404  0
             writeSiteReportHeader(sink, project.getName());
    -  405  0
             writeSiteReportTOC(sink, dependencies);
    -  406   -
     
    -  407  0
             int cnt = 0;
    -  408  0
             for (Dependency d : dependencies) {
    -  409  0
                 writeSiteReportDependencyHeader(sink, d);
    -  410  0
                 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
    -  411  0
                 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
    -  412  0
                 writeSiteReportDependencyIdentifiers(d, sink);
    -  413  0
                 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
    -  414  0
             }
    -  415  0
             sink.body_();
    -  416  0
         }
    -  417   -
     
    -  418   -
         // <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report">
    -  419   -
         /**
    -  420   -
          * Writes the vulnerabilities to the site report.
    -  421   -
          *
    -  422   -
          * @param d the dependency
    -  423   -
          * @param sink the sink to write the data to
    -  424   -
          * @param collapsibleHeaderCount the collapsible header count
    -  425   -
          */
    -  426   -
         private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
    -  427  0
             int cnt = collapsibleHeaderCount;
    -  428  0
             if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
    -  429  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  430   -
     
    -  431  0
                     sink.paragraph();
    -  432  0
                     sink.bold();
    -  433   +  377  0
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  378  0
                 Settings.mergeProperties(mojoProperties);
    +  379  0
             } catch (IOException ex) {
    +  380  0
                 LOGGER.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    +  381  0
                 LOGGER.log(Level.FINE, null, ex);
    +  382   +
             } finally {
    +  383  0
                 if (mojoProperties != null) {
    +  384  
                     try {
    -  434  0
                         sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
    -  435  0
                         sink.text(v.getName());
    -  436  0
                         sink.link_();
    -  437  0
                         sink.bold_();
    -  438  0
                     } catch (UnsupportedEncodingException ex) {
    -  439  0
                         sink.text(v.getName());
    -  440  0
                         sink.bold_();
    -  441  0
                         sink.lineBreak();
    -  442  0
                         sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
    -  443  0
                     }
    -  444  0
                     sink.paragraph_();
    -  445  0
                     sink.paragraph();
    -  446  0
                     sink.text("Severity: ");
    -  447  0
                     if (v.getCvssScore() < 4.0) {
    -  448  0
                         sink.text("Low");
    +  385  0
                         mojoProperties.close();
    +  386  0
                     } catch (IOException ex) {
    +  387  0
                         LOGGER.log(Level.FINEST, null, ex);
    +  388  0
                     }
    +  389   +
                 }
    +  390   +
             }
    +  391   +
     
    +  392  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  393  0
             if (externalReport != null) {
    +  394  0
                 LOGGER.warning("The 'externalReport' option was set; this configuration option has been removed. "
    +  395   +
                         + "Please update the dependency-check-maven plugin's configuration");
    +  396   +
             }
    +  397   +
     
    +  398  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  399  0
                 LOGGER.warning("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings "
    +  400   +
                         + "to configure the proxy instead");
    +  401   +
             }
    +  402  0
             final Proxy proxy = getMavenProxy();
    +  403  0
             if (proxy != null) {
    +  404  0
                 Settings.setString(Settings.KEYS.PROXY_SERVER, proxy.getHost());
    +  405  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
    +  406  0
                 final String userName = proxy.getUsername();
    +  407  0
                 final String password = proxy.getPassword();
    +  408  0
                 if (userName != null) {
    +  409  0
                     Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
    +  410   +
                 }
    +  411  0
                 if (password != null) {
    +  412  0
                     Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
    +  413   +
                 }
    +  414   +
     
    +  415   +
             }
    +  416   +
     
    +  417  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  418  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  419   +
             }
    +  420  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  421  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    +  422   +
             }
    +  423   +
     
    +  424   +
             //File Type Analyzer Settings
    +  425   +
             //JAR ANALYZER
    +  426  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
    +  427   +
             //NUSPEC ANALYZER
    +  428  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    +  429   +
             //NEXUS ANALYZER
    +  430  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    +  431  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  432  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  433   +
             }
    +  434  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    +  435   +
             //ARCHIVE ANALYZER
    +  436  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    +  437  0
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    +  438  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
    +  439   +
             }
    +  440   +
             //ASSEMBLY ANALYZER
    +  441  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    +  442  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    +  443  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    +  444   +
             }
    +  445   +
     
    +  446   +
             //Database configuration
    +  447  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  448  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
     449   -
                     } else {
    -  450  0
                         if (v.getCvssScore() >= 7.0) {
    -  451  0
                             sink.text("High");
    +
             }
    +  450  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  451  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
     452   -
                         } else {
    -  453  0
                             sink.text("Medium");
    -  454   -
                         }
    +
             }
    +  453  0
             if (connectionString != null && !connectionString.isEmpty()) {
    +  454  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
     455   -
                     }
    -  456  0
                     sink.lineBreak();
    -  457  0
                     sink.text("CVSS Score: " + v.getCvssScore());
    -  458  0
                     if (v.getCwe() != null && !v.getCwe().isEmpty()) {
    -  459  0
                         sink.lineBreak();
    -  460  0
                         sink.text("CWE: ");
    -  461  0
                         sink.text(v.getCwe());
    +
             }
    +  456  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  457  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  458   +
             }
    +  459  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  460  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    +  461   +
             }
     462   -
                     }
    -  463  0
                     sink.paragraph_();
    -  464  0
                     sink.paragraph();
    -  465  0
                     sink.text(v.getDescription());
    -  466  0
                     if (v.getReferences() != null && !v.getReferences().isEmpty()) {
    -  467  0
                         sink.list();
    -  468  0
                         for (Reference ref : v.getReferences()) {
    -  469  0
                             sink.listItem();
    -  470  0
                             sink.text(ref.getSource());
    -  471  0
                             sink.text(" - ");
    -  472  0
                             sink.link(ref.getUrl());
    -  473  0
                             sink.text(ref.getName());
    -  474  0
                             sink.link_();
    -  475  0
                             sink.listItem_();
    -  476  0
                         }
    -  477  0
                         sink.list_();
    +
             // Data Directory
    +  463  0
             if (dataDirectory != null && !dataDirectory.isEmpty()) {
    +  464  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +  465   +
             }
    +  466   +
     
    +  467   +
             // Scope Exclusion
    +  468  0
             Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
    +  469  0
             Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
    +  470  0
             Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
    +  471   +
     
    +  472   +
             // CVE Data Mirroring
    +  473  0
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    +  474  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
    +  475   +
             }
    +  476  0
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    +  477  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
     478   -
                     }
    -  479  0
                     sink.paragraph_();
    -  480  0
                     if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
    -  481  0
                         sink.paragraph();
    -  482   +
             }
    +  479  0
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    +  480  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
    +  481   +
             }
    +  482  0
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    +  483  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
    +  484   +
             }
    +  485  0
         }
    +  486  
     
    -  483  0
                         cnt += 1;
    -  484  0
                         sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
    -  485  0
                         sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
    -  486  0
                         sink.list();
    -  487  0
                         for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
    -  488  0
                             sink.listItem();
    +  487   +
         /**
    +  488   +
          * Returns the maven proxy.
     489   -
                             try {
    -  490  0
                                 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
    -  491  0
                                 sink.text(vs.getName());
    -  492  0
                                 sink.link_();
    -  493  0
                                 if (vs.hasPreviousVersion()) {
    -  494  0
                                     sink.text(" and all previous versions.");
    -  495   -
                                 }
    -  496  0
                             } catch (UnsupportedEncodingException ex) {
    -  497  0
                                 sink.text(vs.getName());
    -  498  0
                                 if (vs.hasPreviousVersion()) {
    -  499  0
                                     sink.text(" and all previous versions.");
    +
          *
    +  490   +
          * @return the maven proxy
    +  491   +
          */
    +  492   +
         private Proxy getMavenProxy() {
    +  493  0
             if (mavenSettings != null) {
    +  494  0
                 final List<Proxy> proxies = mavenSettings.getProxies();
    +  495  0
                 if (proxies != null && proxies.size() > 0) {
    +  496  0
                     if (mavenSettingsProxyId != null) {
    +  497  0
                         for (Proxy proxy : proxies) {
    +  498  0
                             if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
    +  499  0
                                 return proxy;
     500   -
                                 }
    -  501  0
                                 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
    -  502  0
                             }
    -  503   -
     
    -  504  0
                             sink.listItem_();
    -  505  0
                         }
    -  506  0
                         sink.list_();
    -  507  0
                         sink.rawText("</div>");
    -  508  0
                         sink.paragraph_();
    -  509   -
                     }
    -  510  0
                 }
    -  511   -
             }
    -  512  0
         }
    -  513   -
     
    -  514   -
         /**
    -  515   -
          * Writes the identifiers to the site report.
    -  516   -
          *
    -  517   -
          * @param d the dependency
    -  518   -
          * @param sink the sink to write the data to
    -  519   -
          */
    -  520   -
         private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
    -  521  0
             if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
    -  522  0
                 sink.sectionTitle4();
    -  523  0
                 sink.text("Identifiers");
    -  524  0
                 sink.sectionTitle4_();
    -  525  0
                 sink.list();
    -  526  0
                 for (Identifier i : d.getIdentifiers()) {
    -  527  0
                     sink.listItem();
    -  528  0
                     sink.text(i.getType());
    -  529  0
                     sink.text(": ");
    -  530  0
                     if (i.getUrl() != null && i.getUrl().length() > 0) {
    -  531  0
                         sink.link(i.getUrl());
    -  532  0
                         sink.text(i.getValue());
    -  533  0
                         sink.link_();
    -  534   +
                             }
    +  501  0
                         }
    +  502  0
                     } else if (proxies.size() == 1) {
    +  503  0
                         return proxies.get(0);
    +  504  
                     } else {
    -  535  0
                         sink.text(i.getValue());
    -  536   +  505  0
                         LOGGER.warning("Multiple proxy defentiions exist in the Maven settings. In the dependency-check "
    +  506   +
                                 + "configuration set the maveSettingsProxyId so that the correct proxy will be used.");
    +  507  0
                         throw new IllegalStateException("Ambiguous proxy definition");
    +  508  
                     }
    -  537  0
                     if (i.getDescription() != null && i.getDescription().length() > 0) {
    -  538  0
                         sink.lineBreak();
    -  539  0
                         sink.text(i.getDescription());
    +  509   +
                 }
    +  510   +
             }
    +  511  0
             return null;
    +  512   +
         }
    +  513   +
         //</editor-fold>
    +  514   +
     
    +  515   +
         /**
    +  516   +
          * Executes the dependency-check and generates the report.
    +  517   +
          *
    +  518   +
          * @throws MojoExecutionException if a maven exception occurs
    +  519   +
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level
    +  520   +
          */
    +  521   +
         @Override
    +  522   +
         protected void performExecute() throws MojoExecutionException, MojoFailureException {
    +  523   +
             try {
    +  524  0
                 engine = executeDependencyCheck();
    +  525  0
                 ReportingUtil.generateExternalReports(engine, outputDirectory, getProject().getName(), format);
    +  526  0
                 if (this.showSummary) {
    +  527  0
                     showSummary(engine.getDependencies());
    +  528   +
                 }
    +  529  0
                 if (this.failBuildOnCVSS <= 10) {
    +  530  0
                     checkForFailure(engine.getDependencies());
    +  531   +
                 }
    +  532  0
             } catch (DatabaseException ex) {
    +  533  0
                 LOGGER.log(Level.SEVERE,
    +  534   +
                         "Unable to connect to the dependency-check database; analysis has stopped");
    +  535  0
                 LOGGER.log(Level.FINE, "", ex);
    +  536  0
             }
    +  537  0
         }
    +  538   +
     
    +  539   +
         @Override
     540   -
                     }
    -  541  0
                     sink.listItem_();
    -  542  0
                 }
    -  543  0
                 sink.list_();
    -  544   -
             }
    -  545  0
         }
    -  546   -
     
    +
         protected void postExecute() throws MojoExecutionException, MojoFailureException {
    +  541   +
             try {
    +  542  0
                 super.postExecute();
    +  543   +
             } finally {
    +  544  0
                 cleanupEngine();
    +  545  0
             }
    +  546  0
         }
     547   -
         /**
    +
     
     548   -
          * Writes the related dependencies to the site report.
    +
         @Override
     549   -
          *
    +
         protected void postGenerate() throws MavenReportException {
     550   -
          * @param d the dependency
    -  551   -
          * @param sink the sink to write the data to
    +
             try {
    +  551  0
                 super.postGenerate();
     552   -
          * @param collapsibleHeaderCount the collapsible header count
    -  553   -
          * @return the collapsible header count
    -  554   +
             } finally {
    +  553  0
                 cleanupEngine();
    +  554  0
             }
    +  555  0
         }
    +  556   +
     
    +  557   +
         /**
    +  558   +
          * Calls <code>engine.cleanup()</code> to release resources.
    +  559  
          */
    -  555   -
         private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
    -  556  0
             int cnt = collapsibleHeaderCount;
    -  557  0
             if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
    -  558  0
                 cnt += 1;
    -  559  0
                 sink.sectionTitle4();
    -  560  0
                 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
    -  561  0
                 sink.sectionTitle4_();
    -  562  0
                 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
    -  563  0
                 sink.list();
    -  564  0
                 for (Dependency r : d.getRelatedDependencies()) {
    -  565  0
                     sink.listItem();
    -  566  0
                     sink.text(r.getFileName());
    -  567  0
                     sink.list();
    -  568  0
                     writeListItem(sink, "File Path: " + r.getFilePath());
    -  569  0
                     writeListItem(sink, "SHA1: " + r.getSha1sum());
    -  570  0
                     writeListItem(sink, "MD5: " + r.getMd5sum());
    -  571  0
                     sink.list_();
    -  572  0
                     sink.listItem_();
    -  573  0
                 }
    -  574  0
                 sink.list_();
    -  575  0
                 sink.rawText("</div>");
    +  560   +
         private void cleanupEngine() {
    +  561  0
             if (engine != null) {
    +  562  0
                 engine.cleanup();
    +  563  0
                 engine = null;
    +  564   +
             }
    +  565  0
             Settings.cleanup(true);
    +  566  0
         }
    +  567   +
     
    +  568   +
         /**
    +  569   +
          * Generates the Dependency-Check Site Report.
    +  570   +
          *
    +  571   +
          * @param locale the locale to use when generating the report
    +  572   +
          * @throws MavenReportException if a maven report exception occurs
    +  573   +
          */
    +  574   +
         @Override
    +  575   +
         protected void executeNonAggregateReport(Locale locale) throws MavenReportException {
     576   -
             }
    -  577  0
             return cnt;
    -  578   -
         }
    +
     
    +  577  0
             final List<Dependency> deps = readDataFile();
    +  578  0
             if (deps != null) {
     579   -
     
    -  580   -
         /**
    -  581   -
          * Writes the evidence used to the site report.
    -  582   -
          *
    -  583   -
          * @param d the dependency
    +
                 try {
    +  580  0
                     engine = initializeEngine();
    +  581  0
                     engine.getDependencies().addAll(deps);
    +  582  0
                 } catch (DatabaseException ex) {
    +  583  0
                     final String msg = String.format("An unrecoverable exception with the dependency-check initialization occured while scanning %s",
     584   -
          * @param sink the sink to write the data to
    -  585   -
          * @param collapsibleHeaderCount the collapsible header count
    -  586   -
          * @return the collapsible header count
    +
                             getProject().getName());
    +  585  0
                     throw new MavenReportException(msg, ex);
    +  586  0
                 }
     587   -
          */
    +
             } else {
     588   -
         private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
    -  589  0
             int cnt = collapsibleHeaderCount;
    -  590  0
             final Set<Evidence> evidence = d.getEvidenceForDisplay();
    -  591  0
             if (evidence != null && evidence.size() > 0) {
    -  592  0
                 cnt += 1;
    -  593  0
                 sink.sectionTitle4();
    -  594  0
                 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
    -  595  0
                 sink.sectionTitle4_();
    -  596  0
                 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
    -  597  0
                 sink.table();
    -  598  0
                 sink.tableRow();
    -  599  0
                 writeTableHeaderCell(sink, "Source");
    -  600  0
                 writeTableHeaderCell(sink, "Name");
    -  601  0
                 writeTableHeaderCell(sink, "Value");
    -  602  0
                 sink.tableRow_();
    -  603  0
                 for (Evidence e : evidence) {
    -  604  0
                     sink.tableRow();
    -  605  0
                     writeTableCell(sink, e.getSource());
    -  606  0
                     writeTableCell(sink, e.getName());
    -  607  0
                     writeTableCell(sink, e.getValue());
    -  608  0
                     sink.tableRow_();
    -  609  0
                 }
    -  610  0
                 sink.table_();
    -  611  0
                 sink.rawText("</div>");
    +
                 try {
    +  589  0
                     engine = executeDependencyCheck();
    +  590  0
                 } catch (DatabaseException ex) {
    +  591  0
                     final String msg = String.format("An unrecoverable exception with the dependency-check scan occured while scanning %s",
    +  592   +
                             getProject().getName());
    +  593  0
                     throw new MavenReportException(msg, ex);
    +  594  0
                 }
    +  595   +
             }
    +  596  0
             ReportingUtil.generateExternalReports(engine, getReportOutputDirectory(), getProject().getName(), format);
    +  597  0
         }
    +  598   +
     
    +  599   +
         @Override
    +  600   +
         protected void executeAggregateReport(MavenProject project, Locale locale) throws MavenReportException {
    +  601  0
             List<Dependency> deps = readDataFile(project);
    +  602  0
             if (deps != null) {
    +  603   +
                 try {
    +  604  0
                     engine = initializeEngine();
    +  605  0
                     engine.getDependencies().addAll(deps);
    +  606  0
                 } catch (DatabaseException ex) {
    +  607  0
                     final String msg = String.format("An unrecoverable exception with the dependency-check initialization occured while scanning %s",
    +  608   +
                             project.getName());
    +  609  0
                     throw new MavenReportException(msg, ex);
    +  610  0
                 }
    +  611   +
             } else {
     612   -
             }
    -  613  0
             return cnt;
    -  614   -
         }
    -  615   -
     
    +
                 try {
    +  613  0
                     engine = executeDependencyCheck(project);
    +  614  0
                 } catch (DatabaseException ex) {
    +  615  0
                     final String msg = String.format("An unrecoverable exception with the dependency-check scan occured while scanning %s",
     616   -
         /**
    -  617   -
          * Writes the dependency header to the site report.
    -  618   -
          *
    +
                             project.getName());
    +  617  0
                     throw new MavenReportException(msg, ex);
    +  618  0
                 }
     619   -
          * @param d the dependency
    -  620   -
          * @param sink the sink to write the data to
    -  621   -
          */
    -  622   -
         private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
    -  623  0
             sink.sectionTitle2();
    -  624  0
             sink.anchor("sha1" + d.getSha1sum());
    -  625  0
             sink.text(d.getFileName());
    -  626  0
             sink.anchor_();
    -  627  0
             sink.sectionTitle2_();
    -  628  0
             if (d.getDescription() != null && d.getDescription().length() > 0) {
    -  629  0
                 sink.paragraph();
    -  630  0
                 sink.bold();
    -  631  0
                 sink.text("Description: ");
    -  632  0
                 sink.bold_();
    -  633  0
                 sink.text(d.getDescription());
    -  634  0
                 sink.paragraph_();
    -  635  
             }
    -  636  0
             if (d.getLicense() != null && d.getLicense().length() > 0) {
    -  637  0
                 sink.paragraph();
    -  638  0
                 sink.bold();
    -  639  0
                 sink.text("License: ");
    -  640  0
                 sink.bold_();
    -  641  0
                 if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
    -  642  0
                     sink.link(d.getLicense());
    -  643  0
                     sink.text(d.getLicense());
    -  644  0
                     sink.link_();
    +  620  0
             for (MavenProject child : getAllChildren(project)) {
    +  621  0
                 deps = readDataFile(child);
    +  622  0
                 if (deps == null) {
    +  623  0
                     final String msg = String.format("Unable to include information on %s in the dependency-check aggregate report", child.getName());
    +  624  0
                     LOGGER.severe(msg);
    +  625  0
                 } else {
    +  626  0
                     engine.getDependencies().addAll(deps);
    +  627   +
                 }
    +  628  0
             }
    +  629  0
             final DependencyBundlingAnalyzer bundler = new DependencyBundlingAnalyzer();
    +  630   +
             try {
    +  631  0
                 bundler.analyze(null, engine);
    +  632  0
             } catch (AnalysisException ex) {
    +  633  0
                 LOGGER.log(Level.WARNING, "An error occured grouping the dependencies; duplicate entries may exist in the report", ex);
    +  634  0
                 LOGGER.log(Level.FINE, "Bundling Exception", ex);
    +  635  0
             }
    +  636  0
             final File outputDir = getReportOutputDirectory(project);
    +  637  0
             if (outputDir != null) {
    +  638  0
                 ReportingUtil.generateExternalReports(engine, outputDir, project.getName(), format);
    +  639   +
             }
    +  640  0
         }
    +  641   +
     
    +  642   +
         // <editor-fold defaultstate="collapsed" desc="Mojo interface/abstract required setter/getter methods">
    +  643   +
         /**
    +  644   +
          * Returns the output name.
     645   -
                 } else {
    -  646  0
                     sink.text(d.getLicense());
    +
          *
    +  646   +
          * @return the output name
     647   -
                 }
    -  648  0
                 sink.paragraph_();
    -  649   -
             }
    -  650  0
         }
    -  651   -
     
    -  652   -
         /**
    -  653   -
          * Adds a list item to the site report.
    -  654   -
          *
    -  655   -
          * @param sink the sink to write the data to
    +
          */
    +  648   +
         public String getOutputName() {
    +  649  0
             if ("HTML".equalsIgnoreCase(this.format)
    +  650   +
                     || "ALL".equalsIgnoreCase(this.format)) {
    +  651  0
                 return "dependency-check-report";
    +  652  0
             } else if ("XML".equalsIgnoreCase(this.format)) {
    +  653  0
                 return "dependency-check-report.xml#";
    +  654  0
             } else if ("VULN".equalsIgnoreCase(this.format)) {
    +  655  0
                 return "dependency-check-vulnerability";
     656   -
          * @param text the text to write
    -  657   -
          */
    -  658   -
         private void writeListItem(Sink sink, String text) {
    -  659  0
             sink.listItem();
    -  660  0
             sink.text(text);
    -  661  0
             sink.listItem_();
    -  662  0
         }
    +
             } else {
    +  657  0
                 LOGGER.log(Level.WARNING, "Unknown report format used during site generation.");
    +  658  0
                 return "dependency-check-report";
    +  659   +
             }
    +  660   +
         }
    +  661   +
     
    +  662   +
         /**
     663   -
     
    +
          * Returns the category name.
     664   -
         /**
    +
          *
     665   -
          * Adds a table cell to the site report.
    +
          * @return the category name
     666   -
          *
    +
          */
     667   -
          * @param sink the sink to write the data to
    -  668   -
          * @param text the text to write
    +
         public String getCategoryName() {
    +  668  0
             return MavenReport.CATEGORY_PROJECT_REPORTS;
     669   -
          */
    +
         }
     670   -
         private void writeTableCell(Sink sink, String text) {
    -  671  0
             sink.tableCell();
    -  672  0
             sink.text(text);
    -  673  0
             sink.tableCell_();
    -  674  0
         }
    +
     
    +  671   +
         /**
    +  672   +
          * Returns the report name.
    +  673   +
          *
    +  674   +
          * @param locale the location
     675   -
     
    +
          * @return the report name
     676   -
         /**
    +
          */
     677   -
          * Adds a table header cell to the site report.
    -  678   -
          *
    +
         public String getName(Locale locale) {
    +  678  0
             return "dependency-check";
     679   -
          * @param sink the sink to write the data to
    +
         }
     680   -
          * @param text the text to write
    -  681   -
          */
    -  682   -
         private void writeTableHeaderCell(Sink sink, String text) {
    -  683  0
             sink.tableHeaderCell();
    -  684  0
             sink.text(text);
    -  685  0
             sink.tableHeaderCell_();
    -  686  0
         }
    -  687  
     
    -  688   +  681  
         /**
    -  689   -
          * Writes the TOC for the site report.
    -  690   +  682   +
          * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    +  683  
          *
    -  691   -
          * @param sink the sink to write the data to
    -  692   -
          * @param dependencies the dependencies that are being reported on
    -  693   +  684   +
          * @param locale The Locale to get the description for
    +  685   +
          * @return the description
    +  686  
          */
    +  687   +
         public String getDescription(Locale locale) {
    +  688  0
             return "A report providing details on any published "
    +  689   +
                     + "vulnerabilities within project dependencies. This report is a best effort but may contain "
    +  690   +
                     + "false positives and false negatives.";
    +  691   +
         }
    +  692   +
     
    +  693   +
         /**
     694   -
         private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
    -  695  0
             sink.list();
    -  696  0
             for (Dependency d : dependencies) {
    -  697  0
                 sink.listItem();
    -  698  0
                 sink.link("#sha1" + d.getSha1sum());
    -  699  0
                 sink.text(d.getFileName());
    -  700  0
                 sink.link_();
    -  701  0
                 if (!d.getVulnerabilities().isEmpty()) {
    -  702  0
                     sink.rawText(" <font style=\"color:red\">•</font>");
    -  703   -
                 }
    -  704  0
                 if (!d.getRelatedDependencies().isEmpty()) {
    -  705  0
                     sink.list();
    -  706  0
                     for (Dependency r : d.getRelatedDependencies()) {
    -  707  0
                         writeListItem(sink, r.getFileName());
    -  708  0
                     }
    -  709  0
                     sink.list_();
    +
          * Returns whether or not a report can be generated.
    +  695   +
          *
    +  696   +
          * @return <code>true</code> if a report can be generated; otherwise <code>false</code>
    +  697   +
          */
    +  698   +
         public boolean canGenerateReport() {
    +  699  0
             if (canGenerateAggregateReport() || (isAggregate() && isMultiModule())) {
    +  700  0
                 return true;
    +  701   +
             }
    +  702  0
             if (canGenerateNonAggregateReport()) {
    +  703  0
                 return true;
    +  704   +
             } else {
    +  705   +
                 final String msg;
    +  706  0
                 if (getProject().getArtifacts().size() > 0) {
    +  707  0
                     msg = "No project dependencies exist in the included scope - dependency-check:check is unable to generate a report.";
    +  708   +
                 } else {
    +  709  0
                     msg = "No project dependencies exist - dependency-check:check is unable to generate a report.";
     710  
                 }
    -  711  0
                 sink.listItem_();
    -  712  0
             }
    -  713  0
             sink.list_();
    -  714  0
         }
    -  715   +  711  0
                 LOGGER.warning(msg);
    +  712   +
             }
    +  713  
     
    +  714  0
             return false;
    +  715   +
         }
     716   -
         /**
    +
     
     717   -
          * Writes the site report header.
    +
         /**
     718   -
          *
    +
          * Returns whether or not a non-aggregate report can be generated.
     719   -
          * @param sink the sink to write the data to
    +
          *
     720   -
          * @param projectName the name of the project
    +
          * @return <code>true</code> if a non-aggregate report can be generated; otherwise <code>false</code>
     721  
          */
     722   -
         private void writeSiteReportHeader(Sink sink, String projectName) {
    -  723  0
             sink.head();
    -  724  0
             sink.title();
    -  725  0
             sink.text("Dependency-Check Report: " + projectName);
    -  726  0
             sink.title_();
    -  727  0
             sink.head_();
    -  728  0
             sink.body();
    -  729  0
             sink.rawText("<script type=\"text/javascript\">");
    -  730  0
             sink.rawText("function toggleElement(el, targetId) {");
    -  731  0
             sink.rawText("if (el.innerText == '[+]') {");
    -  732  0
             sink.rawText("    el.innerText = '[-]';");
    -  733  0
             sink.rawText("    document.getElementById(targetId).style.display='block';");
    -  734  0
             sink.rawText("} else {");
    -  735  0
             sink.rawText("    el.innerText = '[+]';");
    -  736  0
             sink.rawText("    document.getElementById(targetId).style.display='none';");
    -  737  0
             sink.rawText("}");
    +
         @Override
    +  723   +
         protected boolean canGenerateNonAggregateReport() {
    +  724  0
             boolean ability = false;
    +  725  0
             for (Artifact a : getProject().getArtifacts()) {
    +  726  0
                 if (!excludeFromScan(a)) {
    +  727  0
                     ability = true;
    +  728  0
                     break;
    +  729   +
                 }
    +  730  0
             }
    +  731  0
             return ability;
    +  732   +
         }
    +  733   +
     
    +  734   +
         /**
    +  735   +
          * Returns whether or not an aggregate report can be generated.
    +  736   +
          *
    +  737   +
          * @return <code>true</code> if an aggregate report can be generated; otherwise <code>false</code>
     738   -
     
    -  739  0
             sink.rawText("}");
    -  740  0
             sink.rawText("</script>");
    -  741  0
             sink.section1();
    -  742  0
             sink.sectionTitle1();
    -  743  0
             sink.text("Project: " + projectName);
    -  744  0
             sink.sectionTitle1_();
    -  745  0
             sink.date();
    -  746  0
             final Date now = new Date();
    -  747  0
             sink.text(DateFormat.getDateTimeInstance().format(now));
    -  748  0
             sink.date_();
    -  749  0
             sink.section1_();
    -  750  0
         }
    -  751   +
          */
    +  739   +
         @Override
    +  740   +
         protected boolean canGenerateAggregateReport() {
    +  741  0
             return isAggregate() && isLastProject();
    +  742   +
         }
    +  743  
         // </editor-fold>
    +  744   +
     
    +  745   +
         //<editor-fold defaultstate="collapsed" desc="Methods to fail build or show summary">
    +  746   +
         /**
    +  747   +
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    +  748   +
          * configuration.
    +  749   +
          *
    +  750   +
          * @param dependencies the list of dependency objects
    +  751   +
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set
     752   -
     
    +
          */
     753   -
         /**
    -  754   -
          * Returns the maven settings proxy server.
    -  755   -
          *
    -  756   -
          * @param proxy the maven proxy
    -  757   -
          * @return the proxy url
    -  758   -
          */
    -  759   -
         private String getMavenSettingsProxyServer(Proxy proxy) {
    -  760  0
             return new StringBuilder(proxy.getProtocol()).append("://").append(proxy.getHost()).toString();
    -  761   -
         }
    -  762   -
     
    +
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
    +  754  0
             final StringBuilder ids = new StringBuilder();
    +  755  0
             for (Dependency d : dependencies) {
    +  756  0
                 boolean addName = true;
    +  757  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  758  0
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    +  759  0
                         if (addName) {
    +  760  0
                             addName = false;
    +  761  0
                             ids.append(NEW_LINE).append(d.getFileName()).append(": ");
    +  762  0
                             ids.append(v.getName());
     763   -
         /**
    -  764   -
          * Returns the maven proxy.
    +
                         } else {
    +  764  0
                             ids.append(", ").append(v.getName());
     765   -
          *
    +
                         }
     766   -
          * @return the maven proxy
    -  767   -
          */
    -  768   -
         private Proxy getMavenProxy() {
    -  769  0
             if (mavenSettings != null) {
    -  770  0
                 final List<Proxy> proxies = mavenSettings.getProxies();
    -  771  0
                 if (proxies != null && proxies.size() > 0) {
    -  772  0
                     if (mavenSettingsProxyId != null) {
    -  773  0
                         for (Proxy proxy : proxies) {
    -  774  0
                             if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
    -  775  0
                                 return proxy;
    -  776   -
                             }
    -  777  0
                         }
    -  778  0
                     } else if (proxies.size() == 1) {
    -  779  0
                         return proxies.get(0);
    -  780   -
                     } else {
    -  781  0
                         throw new IllegalStateException("Ambiguous proxy definition");
    -  782  
                     }
    -  783   -
                 }
    -  784   +  767  0
                 }
    +  768  0
             }
    +  769  0
             if (ids.length() > 0) {
    +  770  0
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    +  771   +
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    +  772   +
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    +  773  0
                 throw new MojoFailureException(msg);
    +  774  
             }
    -  785  0
             return null;
    -  786   -
         }
    -  787   +  775  0
         }
    +  776  
     
    -  788   +  777  
         /**
    -  789   -
          * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system
    -  790   -
          * properties required to change the proxy url, port, and connection timeout.
    -  791   +  778   +
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    +  779   +
          *
    +  780   +
          * @param dependencies a list of dependency objects
    +  781  
          */
    +  782   +
         private void showSummary(List<Dependency> dependencies) {
    +  783  0
             final StringBuilder summary = new StringBuilder();
    +  784  0
             for (Dependency d : dependencies) {
    +  785  0
                 boolean firstEntry = true;
    +  786  0
                 final StringBuilder ids = new StringBuilder();
    +  787  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  788  0
                     if (firstEntry) {
    +  789  0
                         firstEntry = false;
    +  790   +
                     } else {
    +  791  0
                         ids.append(", ");
     792   -
         private void populateSettings() {
    -  793  0
             Settings.initialize();
    -  794  0
             InputStream mojoProperties = null;
    -  795   -
             try {
    -  796  0
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  797  0
                 Settings.mergeProperties(mojoProperties);
    -  798  0
             } catch (IOException ex) {
    -  799  0
                 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    -  800  0
                 logger.log(Level.FINE, null, ex);
    +
                     }
    +  793  0
                     ids.append(v.getName());
    +  794  0
                 }
    +  795  0
                 if (ids.length() > 0) {
    +  796  0
                     summary.append(d.getFileName()).append(" (");
    +  797  0
                     firstEntry = true;
    +  798  0
                     for (Identifier id : d.getIdentifiers()) {
    +  799  0
                         if (firstEntry) {
    +  800  0
                             firstEntry = false;
     801   -
             } finally {
    -  802  0
                 if (mojoProperties != null) {
    +
                         } else {
    +  802  0
                             summary.append(", ");
     803   -
                     try {
    -  804  0
                         mojoProperties.close();
    -  805  0
                     } catch (IOException ex) {
    -  806  0
                         logger.log(Level.FINEST, null, ex);
    -  807  0
                     }
    -  808   +
                         }
    +  804  0
                         summary.append(id.getValue());
    +  805  0
                     }
    +  806  0
                     summary.append(") : ").append(ids).append(NEW_LINE);
    +  807  
                 }
    -  809   -
             }
    -  810   -
     
    -  811  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  808  0
             }
    +  809  0
             if (summary.length() > 0) {
    +  810  0
                 final String msg = String.format("%n%n"
    +  811   +
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
     812   -
     
    -  813  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  814  0
                 logger.warning("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings to configure the proxy instead");
    -  815   +
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    +  813  0
                 LOGGER.log(Level.WARNING, msg);
    +  814  
             }
    +  815  0
         }
     816   +
         //</editor-fold>
    +  817  
     
    -  817  0
             final Proxy proxy = getMavenProxy();
    -  818  0
             if (proxy != null) {
    -  819  0
                 Settings.setString(Settings.KEYS.PROXY_SERVER, getMavenSettingsProxyServer(proxy));
    -  820  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
    -  821  0
                 final String userName = proxy.getUsername();
    -  822  0
                 final String password = proxy.getPassword();
    -  823  0
                 if (userName != null && password != null) {
    -  824  0
                     Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
    -  825  0
                     Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
    -  826   -
                 }
    -  827   -
             }
    -  828   +  818   +
         //<editor-fold defaultstate="collapsed" desc="Methods to read/write the serialized data file">
    +  819   +
         /**
    +  820   +
          * Writes the scan data to disk. This is used to serialize the scan data between the "check" and "aggregate" phase.
    +  821   +
          *
    +  822   +
          * @return the File object referencing the data file that was written
    +  823   +
          */
    +  824   +
         @Override
    +  825   +
         protected File writeDataFile() {
    +  826  0
             File file = null;
    +  827  0
             if (engine != null && getProject().getContextValue(this.getDataFileContextKey()) == null) {
    +  828  0
                 file = new File(getProject().getBuild().getDirectory(), getDataFileName());
    +  829  0
                 OutputStream os = null;
    +  830  0
                 OutputStream bos = null;
    +  831  0
                 ObjectOutputStream out = null;
    +  832   +
                 try {
    +  833  0
                     os = new FileOutputStream(file);
    +  834  0
                     bos = new BufferedOutputStream(os);
    +  835  0
                     out = new ObjectOutputStream(bos);
    +  836  0
                     out.writeObject(engine.getDependencies());
    +  837  0
                     out.flush();
    +  838  
     
    -  829  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  830  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    -  831   -
             }
    -  832  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  833  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    -  834   -
             }
    -  835   -
     
    -  836   -
             //File Type Analyzer Settings
    -  837   -
             //JAR ANALYZER
    -  838  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
     839   -
             //NUSPEC ANALYZER
    -  840  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    -  841   -
             //NEXUS ANALYZER
    -  842  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    -  843  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    -  844  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    -  845   -
             }
    -  846  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    -  847   -
             //ARCHIVE ANALYZER
    -  848  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    -  849  0
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    -  850  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
    -  851   -
             }
    -  852   -
             //ASSEMBLY ANALYZER
    -  853  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    -  854  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    -  855  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    -  856   -
             }
    -  857   +
                     //call reset to prevent resource leaks per
    +  840   +
                     //https://www.securecoding.cert.org/confluence/display/java/SER10-J.+Avoid+memory+and+resource+leaks+during+serialization
    +  841  0
                     out.reset();
    +  842  
     
    -  858   -
             //Database configuration
    -  859  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    -  860  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  843  0
                 } catch (IOException ex) {
    +  844  0
                     LOGGER.log(Level.WARNING, "Unable to create data file used for report aggregation; "
    +  845   +
                             + "if report aggregation is being used the results may be incomplete.");
    +  846  0
                     LOGGER.log(Level.FINE, ex.getMessage(), ex);
    +  847   +
                 } finally {
    +  848  0
                     if (out != null) {
    +  849   +
                         try {
    +  850  0
                             out.close();
    +  851  0
                         } catch (IOException ex) {
    +  852  0
                             LOGGER.log(Level.FINEST, "ignore", ex);
    +  853  0
                         }
    +  854   +
                     }
    +  855  0
                     if (bos != null) {
    +  856   +
                         try {
    +  857  0
                             bos.close();
    +  858  0
                         } catch (IOException ex) {
    +  859  0
                             LOGGER.log(Level.FINEST, "ignore", ex);
    +  860  0
                         }
     861   -
             }
    -  862  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    -  863  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    -  864   -
             }
    -  865  0
             if (connectionString != null && !connectionString.isEmpty()) {
    -  866  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    -  867   -
             }
    -  868  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    -  869  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +
                     }
    +  862  0
                     if (os != null) {
    +  863   +
                         try {
    +  864  0
                             os.close();
    +  865  0
                         } catch (IOException ex) {
    +  866  0
                             LOGGER.log(Level.FINEST, "ignore", ex);
    +  867  0
                         }
    +  868   +
                     }
    +  869   +
                 }
     870  
             }
    -  871  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    -  872  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    +  871  0
             return file;
    +  872   +
         }
     873   -
             }
    +
     
     874   -
             // Data Directory
    -  875  0
             if (dataDirectory != null && !dataDirectory.isEmpty()) {
    -  876  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +
         /**
    +  875   +
          * Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and
    +  876   +
          * "aggregate" phase.
     877   -
             }
    +
          *
     878   -
     
    +
          * @return a <code>Engine</code> object populated with dependencies if the serialized data file exists; otherwise
     879   -
             // Scope Exclusion
    -  880  0
             Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
    -  881  0
             Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
    -  882  0
             Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
    +
          * <code>null</code> is returned
    +  880   +
          */
    +  881   +
         protected List<Dependency> readDataFile() {
    +  882  0
             return readDataFile(getProject());
     883   -
     
    +
         }
     884   -
             // CVE Data Mirroring
    -  885  0
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    -  886  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
    +
     
    +  885   +
         /**
    +  886   +
          * Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and
     887   -
             }
    -  888  0
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    -  889  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
    +
          * "aggregate" phase.
    +  888   +
          *
    +  889   +
          * @param project the Maven project to read the data file from
     890   -
             }
    -  891  0
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    -  892  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
    +
          * @return a <code>Engine</code> object populated with dependencies if the serialized data file exists; otherwise
    +  891   +
          * <code>null</code> is returned
    +  892   +
          */
     893   -
             }
    -  894  0
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    -  895  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
    -  896   -
             }
    +
         protected List<Dependency> readDataFile(MavenProject project) {
    +  894  0
             final Object oPath = project.getContextValue(this.getDataFileContextKey());
    +  895  0
             if (oPath == null) {
    +  896  0
                 return null;
     897   -
     
    -  898  0
         }
    -  899   -
     
    -  900   -
         /**
    +
             }
    +  898  0
             List<Dependency> ret = null;
    +  899  0
             final String path = (String) oPath;
    +  900  0
             ObjectInputStream ois = null;
     901   -
          * Executes the dependency-check and generates the report.
    -  902   -
          *
    -  903   -
          * @throws MojoExecutionException if a maven exception occurs
    -  904   -
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level
    +
             try {
    +  902  0
                 ois = new ObjectInputStream(new FileInputStream(path));
    +  903  0
                 ret = (List<Dependency>) ois.readObject();
    +  904  0
             } catch (FileNotFoundException ex) {
     905   -
          */
    -  906   -
         public void execute() throws MojoExecutionException, MojoFailureException {
    -  907  0
             Engine engine = null;
    -  908   -
             try {
    -  909  0
                 engine = executeDependencyCheck();
    -  910  0
                 generateExternalReports(engine, outputDirectory);
    -  911  0
                 if (this.showSummary) {
    -  912  0
                     showSummary(engine.getDependencies());
    +
                 //TODO fix logging
    +  906  0
                 LOGGER.log(Level.SEVERE, null, ex);
    +  907  0
             } catch (IOException ex) {
    +  908  0
                 LOGGER.log(Level.SEVERE, null, ex);
    +  909  0
             } catch (ClassNotFoundException ex) {
    +  910  0
                 LOGGER.log(Level.SEVERE, null, ex);
    +  911   +
             } finally {
    +  912  0
                 if (ois != null) {
     913   +
                     try {
    +  914  0
                         ois.close();
    +  915  0
                     } catch (IOException ex) {
    +  916  0
                         LOGGER.log(Level.SEVERE, null, ex);
    +  917  0
                     }
    +  918  
                 }
    -  914  0
                 if (this.failBuildOnCVSS <= 10) {
    -  915  0
                     checkForFailure(engine.getDependencies());
    -  916   -
                 }
    -  917  0
             } catch (DatabaseException ex) {
    -  918  0
                 logger.log(Level.SEVERE,
     919   -
                         "Unable to connect to the dependency-check database; analysis has stopped");
    -  920  0
                 logger.log(Level.FINE, "", ex);
    +
             }
    +  920  0
             return ret;
     921   -
             } finally {
    -  922  0
                 Settings.cleanup(true);
    -  923  0
                 if (engine != null) {
    -  924  0
                     engine.cleanup();
    -  925   -
                 }
    -  926   -
             }
    -  927  0
         }
    -  928   -
     
    -  929   -
         /**
    -  930   -
          * Generates the Dependency-Check Site Report.
    -  931   -
          *
    -  932   -
          * @param sink the sink to write the report to
    -  933   -
          * @param locale the locale to use when generating the report
    -  934   -
          * @throws MavenReportException if a Maven report exception occurs
    -  935   -
          */
    -  936   -
         public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
    -  937   -
                 Locale locale) throws MavenReportException {
    -  938  0
             generate((Sink) sink, null, locale);
    -  939  0
         }
    -  940   -
     
    -  941   -
         /**
    -  942   -
          * Generates the Dependency-Check Site Report.
    -  943   -
          *
    -  944   -
          * @param sink the sink to write the report to
    -  945   -
          * @param sinkFactory the sink factory
    -  946   -
          * @param locale the locale to use when generating the report
    -  947   -
          * @throws MavenReportException if a maven report exception occurs
    -  948   -
          */
    -  949   -
         public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
    -  950  0
             Engine engine = null;
    -  951   -
             try {
    -  952  0
                 engine = executeDependencyCheck();
    -  953  0
                 if (this.externalReport) {
    -  954  0
                     generateExternalReports(engine, reportOutputDirectory);
    -  955   -
                 } else {
    -  956  0
                     generateMavenSiteReport(engine, sink);
    -  957   -
                 }
    -  958  0
             } catch (DatabaseException ex) {
    -  959  0
                 logger.log(Level.SEVERE,
    -  960   -
                         "Unable to connect to the dependency-check database; analysis has stopped");
    -  961  0
                 logger.log(Level.FINE, "", ex);
    -  962   -
             } finally {
    -  963  0
                 Settings.cleanup(true);
    -  964  0
                 if (engine != null) {
    -  965  0
                     engine.cleanup();
    -  966   -
                 }
    -  967   -
             }
    -  968  0
         }
    -  969   -
     
    -  970   -
         // <editor-fold defaultstate="collapsed" desc="required setter/getter methods">
    -  971   -
         /**
    -  972   -
          * Returns the output name.
    -  973   -
          *
    -  974   -
          * @return the output name
    -  975   -
          */
    -  976   -
         public String getOutputName() {
    -  977  0
             if ("HTML".equalsIgnoreCase(this.format)
    -  978   -
                     || "ALL".equalsIgnoreCase(this.format)) {
    -  979  0
                 return "dependency-check-report";
    -  980  0
             } else if ("XML".equalsIgnoreCase(this.format)) {
    -  981  0
                 return "dependency-check-report.xml#";
    -  982  0
             } else if ("VULN".equalsIgnoreCase(this.format)) {
    -  983  0
                 return "dependency-check-vulnerability";
    -  984   -
             } else {
    -  985  0
                 logger.log(Level.WARNING, "Unknown report format used during site generation.");
    -  986  0
                 return "dependency-check-report";
    -  987   -
             }
    -  988  
         }
    -  989   -
     
    -  990   -
         /**
    -  991   -
          * Returns the category name.
    -  992   -
          *
    -  993   -
          * @return the category name
    -  994   -
          */
    -  995   -
         public String getCategoryName() {
    -  996  0
             return MavenReport.CATEGORY_PROJECT_REPORTS;
    -  997   -
         }
    -  998   -
     
    -  999   -
         /**
    -  1000   -
          * Returns the report name.
    -  1001   -
          *
    -  1002   -
          * @param locale the location
    -  1003   -
          * @return the report name
    -  1004   -
          */
    -  1005   -
         public String getName(Locale locale) {
    -  1006  0
             return name;
    -  1007   -
         }
    -  1008   -
     
    -  1009   -
         /**
    -  1010   -
          * Sets the Reporting output directory.
    -  1011   -
          *
    -  1012   -
          * @param directory the output directory
    -  1013   -
          */
    -  1014   -
         public void setReportOutputDirectory(File directory) {
    -  1015  0
             reportOutputDirectory = directory;
    -  1016  0
         }
    -  1017   -
     
    -  1018   -
         /**
    -  1019   -
          * Returns the output directory.
    -  1020   -
          *
    -  1021   -
          * @return the output directory
    -  1022   -
          */
    -  1023   -
         public File getReportOutputDirectory() {
    -  1024  0
             return reportOutputDirectory;
    -  1025   -
         }
    -  1026   -
     
    -  1027   -
         /**
    -  1028   -
          * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    -  1029   -
          *
    -  1030   -
          * @param locale The Locale to get the description for
    -  1031   -
          * @return the description
    -  1032   -
          */
    -  1033   -
         public String getDescription(Locale locale) {
    -  1034  0
             return description;
    -  1035   -
         }
    -  1036   -
     
    -  1037   -
         /**
    -  1038   -
          * Returns whether this is an external report.
    -  1039   -
          *
    -  1040   -
          * @return true or false;
    -  1041   -
          */
    -  1042   -
         public boolean isExternalReport() {
    -  1043  0
             return externalReport;
    -  1044   -
         }
    -  1045   -
     
    -  1046   -
         /**
    -  1047   -
          * Returns whether or not the plugin can generate a report.
    -  1048   -
          *
    -  1049   -
          * @return true
    -  1050   -
          */
    -  1051   -
         public boolean canGenerateReport() {
    -  1052  0
             return true;
    -  1053   -
         }
    -  1054   -
         // </editor-fold>
    -  1055   -
     
    -  1056   -
         /**
    -  1057   -
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    -  1058   -
          * configuration.
    -  1059   -
          *
    -  1060   -
          * @param dependencies the list of dependency objects
    -  1061   -
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set
    -  1062   -
          */
    -  1063   -
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
    -  1064  0
             final StringBuilder ids = new StringBuilder();
    -  1065  0
             for (Dependency d : dependencies) {
    -  1066  0
                 boolean addName = true;
    -  1067  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1068  0
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    -  1069  0
                         if (addName) {
    -  1070  0
                             addName = false;
    -  1071  0
                             ids.append(NEW_LINE).append(d.getFileName()).append(": ");
    -  1072  0
                             ids.append(v.getName());
    -  1073   -
                         } else {
    -  1074  0
                             ids.append(", ").append(v.getName());
    -  1075   -
                         }
    -  1076   -
                     }
    -  1077  0
                 }
    -  1078  0
             }
    -  1079  0
             if (ids.length() > 0) {
    -  1080  0
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    -  1081   -
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    -  1082   -
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    -  1083  0
                 throw new MojoFailureException(msg);
    -  1084   -
             }
    -  1085  0
         }
    -  1086   -
     
    -  1087   -
         /**
    -  1088   -
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    -  1089   -
          *
    -  1090   -
          * @param dependencies a list of dependency objects
    -  1091   -
          */
    -  1092   -
         private void showSummary(List<Dependency> dependencies) {
    -  1093  0
             final StringBuilder summary = new StringBuilder();
    -  1094  0
             for (Dependency d : dependencies) {
    -  1095  0
                 boolean firstEntry = true;
    -  1096  0
                 final StringBuilder ids = new StringBuilder();
    -  1097  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1098  0
                     if (firstEntry) {
    -  1099  0
                         firstEntry = false;
    -  1100   -
                     } else {
    -  1101  0
                         ids.append(", ");
    -  1102   -
                     }
    -  1103  0
                     ids.append(v.getName());
    -  1104  0
                 }
    -  1105  0
                 if (ids.length() > 0) {
    -  1106  0
                     summary.append(d.getFileName()).append(" (");
    -  1107  0
                     firstEntry = true;
    -  1108  0
                     for (Identifier id : d.getIdentifiers()) {
    -  1109  0
                         if (firstEntry) {
    -  1110  0
                             firstEntry = false;
    -  1111   -
                         } else {
    -  1112  0
                             summary.append(", ");
    -  1113   -
                         }
    -  1114  0
                         summary.append(id.getValue());
    -  1115  0
                     }
    -  1116  0
                     summary.append(") : ").append(ids).append(NEW_LINE);
    -  1117   -
                 }
    -  1118  0
             }
    -  1119  0
             if (summary.length() > 0) {
    -  1120  0
                 final String msg = String.format("%n%n"
    -  1121   -
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    -  1122   -
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    -  1123  0
                 logger.log(Level.WARNING, msg);
    -  1124   -
             }
    -  1125  0
         }
    -  1126   +  922   +
         //</editor-fold>
    +  923  
     }
    - + diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html index eedcb2da8..9157f91ac 100644 --- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html @@ -744,6 +744,6 @@
     }
    - + diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.ReportAggregationMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.ReportAggregationMojo.html new file mode 100644 index 000000000..4c000f950 --- /dev/null +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.ReportAggregationMojo.html @@ -0,0 +1,861 @@ + + + + +Coverage Report + + + + +
    Coverage Report - org.owasp.dependencycheck.maven.ReportAggregationMojo
    +
     
    + + + + +
    Classes in this File Line Coverage Branch Coverage Complexity
    ReportAggregationMojo
    0%
    0/87
    0%
    0/34
    1.633
    +
     
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
     1  
     /*
     2  
      * This file is part of dependency-check-maven.
     3  
      *
     4  
      * Licensed under the Apache License, Version 2.0 (the "License");
     5  
      * you may not use this file except in compliance with the License.
     6  
      * You may obtain a copy of the License at
     7  
      *
     8  
      *     http://www.apache.org/licenses/LICENSE-2.0
     9  
      *
     10  
      * Unless required by applicable law or agreed to in writing, software
     11  
      * distributed under the License is distributed on an "AS IS" BASIS,
     12  
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  
      * See the License for the specific language governing permissions and
     14  
      * limitations under the License.
     15  
      *
     16  
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
     17  
      */
     18  
     package org.owasp.dependencycheck.maven;
     19  
     
     20  
     import java.io.File;
     21  
     import java.util.ArrayList;
     22  
     import java.util.Collections;
     23  
     import java.util.HashMap;
     24  
     import java.util.HashSet;
     25  
     import java.util.List;
     26  
     import java.util.Locale;
     27  
     import java.util.Map;
     28  
     import java.util.Set;
     29  
     import java.util.logging.Logger;
     30  
     import org.apache.maven.doxia.sink.Sink;
     31  
     import org.apache.maven.plugin.AbstractMojo;
     32  
     import org.apache.maven.plugin.MojoExecutionException;
     33  
     import org.apache.maven.plugin.MojoFailureException;
     34  
     import org.apache.maven.plugins.annotations.Component;
     35  
     import org.apache.maven.plugins.annotations.Parameter;
     36  
     import org.apache.maven.project.MavenProject;
     37  
     import org.apache.maven.reporting.MavenReport;
     38  
     import org.apache.maven.reporting.MavenReportException;
     39  
     
     40  
     /**
     41  
      * <p>
     42  
      * This is an abstract reporting mojo that enables report aggregation. Some of the code in the this class was copied
     43  
      * from the CoberturaReportMojo (http://mojo.codehaus.org/cobertura-maven-plugin/, version 2.6). The authors of the
     44  
      * CoberturaReportMojo were <a href="will.gwaltney@sas.com">Will Gwaltney</a> and
     45  
      * <a href="mailto:joakim@erdfelt.com">Joakim Erdfelt</a>. There working example of how to do report aggregation was
     46  
      * invaluable.</p>
     47  
      * <p>
     48  
      * An important point about using this abstract class is that it is intended for one to write some form of serialized
     49  
      * data (via the {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#writeDataFile() }; note that the
     50  
      * <code>writeDataFile()</code> function is called automatically after either {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#executeNonAggregateReport(org.apache.maven.doxia.sink.Sink,
     51  
      * org.apache.maven.doxia.sink.SinkFactory, java.util.Locale)
     52  
      * } or {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#executeAggregateReport(org.apache.maven.doxia.sink.Sink,
     53  
      * org.apache.maven.doxia.sink.SinkFactory, java.util.Locale)
     54  
      * } are called. When  <code>executeAggregateReport()</code> is implemented, one can call {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#getChildDataFiles()
     55  
      * } to obtain a list of the data files to aggregate.</p>
     56  
      *
     57  
      *
     58  
      * @author Jeremy Long <jeremy.long@owasp.org>
     59  
      */
     60  0
     public abstract class ReportAggregationMojo extends AbstractMojo implements MavenReport {
     61  
     
     62  
         /**
     63  
          * The Maven Project Object.
     64  
          */
     65  
         @Component
     66  
         private MavenProject project;
     67  
     
     68  
         /**
     69  
          * Logger field reference.
     70  
          */
     71  0
         private static final Logger LOGGER = Logger.getLogger(ReportAggregationMojo.class.getName());
     72  
     
     73  
         /**
     74  
          * List of Maven project of the current build
     75  
          */
     76  
         @Parameter(readonly = true, required = true, property = "reactorProjects")
     77  
         private List<MavenProject> reactorProjects;
     78  
     
     79  
         /**
     80  
          * Generate aggregate reports in multi-module projects.
     81  
          */
     82  
         @Parameter(property = "aggregate", defaultValue = "false")
     83  
         private boolean aggregate;
     84  
     
     85  
         /**
     86  
          * Sets whether or not the external report format should be used.
     87  
          */
     88  
         @Parameter(property = "metaFileName", defaultValue = "dependency-check.ser", required = true)
     89  
         private String dataFileName;
     90  
         /**
     91  
          * Specifies the destination directory for the generated Dependency-Check report. This generally maps to
     92  
          * "target/site".
     93  
          */
     94  
         @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
     95  
         private File reportOutputDirectory;
     96  
     
     97  
         /**
     98  
          * Sets the Reporting output directory.
     99  
          *
     100  
          * @param directory the output directory
     101  
          */
     102  
         @Override
     103  
         public void setReportOutputDirectory(File directory) {
     104  0
             reportOutputDirectory = directory;
     105  0
         }
     106  
     
     107  
         /**
     108  
          * Returns the output directory.
     109  
          *
     110  
          * @return the output directory
     111  
          */
     112  
         @Override
     113  
         public File getReportOutputDirectory() {
     114  0
             return reportOutputDirectory;
     115  
         }
     116  
     
     117  
         /**
     118  
          * Returns the output directory for the given project.
     119  
          *
     120  
          * @param project the Maven project to get the output directory for
     121  
          * @return the output directory for the given project
     122  
          */
     123  
         public File getReportOutputDirectory(MavenProject project) {
     124  0
             final Object o = project.getContextValue(getOutputDirectoryContextKey());
     125  0
             if (o != null && o instanceof File) {
     126  0
                 return (File) o;
     127  
             }
     128  0
             return null;
     129  
         }
     130  
     
     131  
         /**
     132  
          * Returns whether this is an external report. This method always returns true.
     133  
          *
     134  
          * @return <code>true</code>
     135  
          */
     136  
         @Override
     137  
         public final boolean isExternalReport() {
     138  0
             return true;
     139  
         }
     140  
     
     141  
         /**
     142  
          * The collection of child projects.
     143  
          */
     144  0
         private final Map<MavenProject, Set<MavenProject>> projectChildren = new HashMap<MavenProject, Set<MavenProject>>();
     145  
     
     146  
         /**
     147  
          * Called before execute; allows for any setup that is needed. If this is overridden you must call
     148  
          * </code>super.preExecute()</code>.
     149  
          *
     150  
          * @throws MojoExecutionException thrown if there is an issue executing the mojo
     151  
          * @throws MojoFailureException thrown if there is an issue executing the mojo
     152  
          */
     153  
         protected void preExecute() throws MojoExecutionException, MojoFailureException {
     154  0
             buildAggregateInfo();
     155  0
         }
     156  
     
     157  
         /**
     158  
          * Called when the mojo is being executed.
     159  
          *
     160  
          * @throws MojoExecutionException thrown if there is an issue executing the mojo
     161  
          * @throws MojoFailureException thrown if there is an issue executing the mojo
     162  
          */
     163  
         protected abstract void performExecute() throws MojoExecutionException, MojoFailureException;
     164  
     
     165  
         /**
     166  
          * Runs after the mojo has executed. This implementation will call <code>writeDataFile()</code>. As such, it is
     167  
          * important that if this method is overriden that <code>super.postExecute()</code> is called.
     168  
          *
     169  
          * @throws MojoExecutionException thrown if there is an issue executing the mojo
     170  
          * @throws MojoFailureException thrown if there is an issue executing the mojo
     171  
          */
     172  
         protected void postExecute() throws MojoExecutionException, MojoFailureException {
     173  0
             final File written = writeDataFile();
     174  0
             if (written != null) {
     175  0
                 project.setContextValue(getDataFileContextKey(), written.getAbsolutePath());
     176  
             }
     177  0
         }
     178  
     
     179  
         /**
     180  
          * Returns the key used to store the path to the data file that is saved by <code>writeDataFile()</code>. This key
     181  
          * is used in the <code>MavenProject.(set|get)ContextValue</code>.
     182  
          *
     183  
          * @return the key used to store the path to the data file
     184  
          */
     185  
         protected String getDataFileContextKey() {
     186  0
             return "dependency-check-path-" + this.getDataFileName();
     187  
         }
     188  
     
     189  
         /**
     190  
          * Returns the key used to store the path to the output directory. When generating the report in the
     191  
          * <code>executeAggregateReport()</code> the output directory should be obtained by using this key.
     192  
          *
     193  
          * @return the key used to store the path to the output directory
     194  
          */
     195  
         protected String getOutputDirectoryContextKey() {
     196  0
             return "dependency-output-dir-" + this.getDataFileName();
     197  
         }
     198  
     
     199  
         /**
     200  
          * Is called by Maven to execute the mojo.
     201  
          *
     202  
          * @throws MojoExecutionException thrown if there is an issue executing the mojo
     203  
          * @throws MojoFailureException thrown if there is an issue executing the mojo
     204  
          */
     205  
         public final void execute() throws MojoExecutionException, MojoFailureException {
     206  
             try {
     207  0
                 preExecute();
     208  0
                 performExecute();
     209  
             } finally {
     210  0
                 postExecute();
     211  0
             }
     212  0
         }
     213  
     
     214  
         /**
     215  
          * Runs prior to the site report generation.
     216  
          *
     217  
          * @throws MavenReportException if a maven report exception occurs
     218  
          */
     219  
         protected void preGenerate() throws MavenReportException {
     220  0
             buildAggregateInfo();
     221  
     
     222  0
             project.setContextValue(getOutputDirectoryContextKey(), getReportOutputDirectory());
     223  0
         }
     224  
     
     225  
         /**
     226  
          * Executes after the site report has been generated.
     227  
          *
     228  
          * @throws MavenReportException if a maven report exception occurs
     229  
          */
     230  
         protected void postGenerate() throws MavenReportException {
     231  0
             final File written = writeDataFile();
     232  0
             if (written != null) {
     233  0
                 project.setContextValue(getDataFileContextKey(), written.getAbsolutePath());
     234  
             }
     235  0
         }
     236  
     
     237  
         /**
     238  
          * Generates the non aggregate report.
     239  
          *
     240  
          * @param locale the locale to use when generating the report
     241  
          * @throws MavenReportException if a maven report exception occurs
     242  
          */
     243  
         protected abstract void executeNonAggregateReport(Locale locale) throws MavenReportException;
     244  
     
     245  
         /**
     246  
          * Generates the aggregate Site Report.
     247  
          *
     248  
          * @param project the maven project used to generate the aggregate report
     249  
          * @param locale the locale to use when generating the report
     250  
          * @throws MavenReportException if a maven report exception occurs
     251  
          */
     252  
         protected abstract void executeAggregateReport(MavenProject project, Locale locale) throws MavenReportException;
     253  
     
     254  
         /**
     255  
          * Generates the Dependency-Check Site Report.
     256  
          *
     257  
          * @param sink the sink to write the report to
     258  
          * @param locale the locale to use when generating the report
     259  
          * @throws MavenReportException if a maven report exception occurs
     260  
          * @deprecated use {@link #generate(org.apache.maven.doxia.sink.Sink, java.util.Locale) instead.
     261  
          */
     262  
         @Deprecated
     263  
         public final void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, Locale locale) throws MavenReportException {
     264  0
             generate((Sink) sink, locale);
     265  0
         }
     266  
     
     267  
         /**
     268  
          * Generates the Dependency-Check Site Report.
     269  
          *
     270  
          * @param sink the sink to write the report to
     271  
          * @param locale the locale to use when generating the report
     272  
          * @throws MavenReportException if a maven report exception occurs
     273  
          */
     274  
         public final void generate(Sink sink, Locale locale) throws MavenReportException {
     275  
             try {
     276  0
                 preGenerate();
     277  0
                 if (canGenerateNonAggregateReport()) {
     278  0
                     executeNonAggregateReport(locale);
     279  
                 }
     280  
     
     281  0
                 if (canGenerateAggregateReport()) {
     282  0
                     for (MavenProject proj : reactorProjects) {
     283  0
                         if (!isMultiModule(proj)) {
     284  0
                             continue;
     285  
                         }
     286  0
                         executeAggregateReport(proj, locale);
     287  0
                     }
     288  
                 }
     289  
             } finally {
     290  0
                 postGenerate();
     291  0
             }
     292  0
         }
     293  
     
     294  
         /**
     295  
          * Returns whether or not the mojo can generate a non-aggregate report for this project.
     296  
          *
     297  
          * @return <code>true</code> if a non-aggregate report can be generated, otherwise <code>false</code>
     298  
          */
     299  
         protected abstract boolean canGenerateNonAggregateReport();
     300  
     
     301  
         /**
     302  
          * Returns whether or not we can generate any aggregate reports at this time.
     303  
          *
     304  
          * @return <code>true</code> if an aggregate report can be generated, otherwise <code>false</code>
     305  
          */
     306  
         protected abstract boolean canGenerateAggregateReport();
     307  
     
     308  
         /**
     309  
          * Returns the name of the data file that contains the serialized data.
     310  
          *
     311  
          * @return the name of the data file that contains the serialized data
     312  
          */
     313  
         protected String getDataFileName() {
     314  0
             return dataFileName;
     315  
         }
     316  
     
     317  
         /**
     318  
          * Writes the data file to disk in the target directory.
     319  
          *
     320  
          * @return the File object referencing the data file that was written
     321  
          */
     322  
         protected abstract File writeDataFile();
     323  
     
     324  
         /**
     325  
          * Collects the information needed for building aggregate reports.
     326  
          */
     327  
         private void buildAggregateInfo() {
     328  
             // build parent-child map
     329  0
             for (MavenProject proj : reactorProjects) {
     330  0
                 Set<MavenProject> depList = projectChildren.get(proj.getParent());
     331  0
                 if (depList == null) {
     332  0
                     depList = new HashSet<MavenProject>();
     333  0
                     projectChildren.put(proj.getParent(), depList);
     334  
                 }
     335  0
                 depList.add(proj);
     336  0
             }
     337  0
         }
     338  
     
     339  
         /**
     340  
          * Returns a list containing all the recursive, non-pom children of the given project, never <code>null</code>.
     341  
          *
     342  
          * @return a list of child projects
     343  
          */
     344  
         protected List<MavenProject> getAllChildren() {
     345  0
             return getAllChildren(project);
     346  
         }
     347  
     
     348  
         /**
     349  
          * Returns a list containing all the recursive, non-pom children of the given project, never <code>null</code>.
     350  
          *
     351  
          * @param parentProject the parent project to collect the child project references
     352  
          * @return a list of child projects
     353  
          */
     354  
         protected List<MavenProject> getAllChildren(MavenProject parentProject) {
     355  0
             final Set<MavenProject> children = projectChildren.get(parentProject);
     356  0
             if (children == null) {
     357  0
                 return Collections.emptyList();
     358  
             }
     359  
     
     360  0
             final List<MavenProject> result = new ArrayList<MavenProject>();
     361  0
             for (MavenProject child : children) {
     362  0
                 if (isMultiModule(child)) {
     363  0
                     result.addAll(getAllChildren(child));
     364  
                 } else {
     365  0
                     result.add(child);
     366  
                 }
     367  0
             }
     368  0
             return result;
     369  
         }
     370  
     
     371  
         /**
     372  
          * Returns a list of data files that were produced by the direct children of the given MavenProject.
     373  
          *
     374  
          * @param project the Maven project to obtain the child data files from
     375  
          * @return a list of the data files
     376  
          */
     377  
         protected List<File> getAllChildDataFiles(MavenProject project) {
     378  0
             final List<MavenProject> children = getAllChildren(project);
     379  0
             return getDataFiles(children);
     380  
         }
     381  
     
     382  
         /**
     383  
          * Returns any existing output files from the given list of projects.
     384  
          *
     385  
          * @param projects the list of projects to obtain the output files from
     386  
          * @return a list of output files
     387  
          */
     388  
         protected List<File> getDataFiles(List<MavenProject> projects) {
     389  0
             final List<File> files = new ArrayList<File>();
     390  0
             for (MavenProject proj : projects) {
     391  0
                 final Object path = project.getContextValue(getDataFileContextKey());
     392  0
                 if (path == null) {
     393  0
                     final String msg = String.format("Unable to aggregate data for '%s' - aggregate data file was not generated",
     394  
                             proj.getName());
     395  0
                     LOGGER.warning(msg);
     396  0
                 } else {
     397  0
                     final File outputFile = new File((String) path);
     398  0
                     if (outputFile.exists()) {
     399  0
                         files.add(outputFile);
     400  
                     } else {
     401  0
                         if (!isMultiModule(project)) {
     402  0
                             final String msg = String.format("Unable to aggregate data for '%s' - missing data file '%s'",
     403  
                                     proj.getName(), outputFile.getPath());
     404  0
                             LOGGER.warning(msg);
     405  
                         }
     406  
                     }
     407  
                 }
     408  0
             }
     409  0
             return files;
     410  
         }
     411  
     
     412  
         /**
     413  
          * Test if the project has pom packaging
     414  
          *
     415  
          * @param mavenProject Project to test
     416  
          * @return <code>true</code> if it has a pom packaging; otherwise <code>false</code>
     417  
          */
     418  
         protected boolean isMultiModule(MavenProject mavenProject) {
     419  0
             return "pom".equals(mavenProject.getPackaging());
     420  
         }
     421  
     
     422  
         /**
     423  
          * Test if the current project has pom packaging
     424  
          *
     425  
          * @return <code>true</code> if it has a pom packaging; otherwise <code>false</code>
     426  
          */
     427  
         protected boolean isMultiModule() {
     428  0
             return isMultiModule(project);
     429  
         }
     430  
     
     431  
         /**
     432  
          * Check whether the current project is the last project in a multi-module build. If the maven build is not a
     433  
          * multi-module project then this will always return true.
     434  
          *
     435  
          * @return <code>true</code> if the current project is the last project in a multi-module build; otherwise
     436  
          * <code>false</code>
     437  
          */
     438  
         protected boolean isLastProject() {
     439  0
             return project.equals(reactorProjects.get(reactorProjects.size() - 1));
     440  
         }
     441  
     
     442  
         /**
     443  
          * Returns whether or not the mojo is configured to perform report aggregation.
     444  
          *
     445  
          * @return <code>true</code> if report aggregation is enabled; otherwise <code>false</code>
     446  
          */
     447  
         public boolean isAggregate() {
     448  0
             return aggregate;
     449  
         }
     450  
     
     451  
         /**
     452  
          * Returns a reference to the current project. This method is used instead of auto-binding the project via component
     453  
          * annotation in concrete implementations of this. If the child has a <code>@Component MavenProject project;</code>
     454  
          * defined then the abstract class (i.e. this class) will not have access to the current project (just the way Maven
     455  
          * works with the binding).
     456  
          *
     457  
          * @return returns a reference to the current project
     458  
          */
     459  
         protected MavenProject getProject() {
     460  0
             return project;
     461  
         }
     462  
     }
    + + + + diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.ReportingUtil.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.ReportingUtil.html new file mode 100644 index 000000000..4457a7bf1 --- /dev/null +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.ReportingUtil.html @@ -0,0 +1,683 @@ + + + + +Coverage Report + + + + +
    Coverage Report - org.owasp.dependencycheck.maven.ReportingUtil
    +
     
    + + + + +
    Classes in this File Line Coverage Branch Coverage Complexity
    ReportingUtil
    0%
    0/253
    0%
    0/80
    4.462
    +
     
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
     1  
     /*
     2  
      * This file is part of dependency-check-maven.
     3  
      *
     4  
      * Licensed under the Apache License, Version 2.0 (the "License");
     5  
      * you may not use this file except in compliance with the License.
     6  
      * You may obtain a copy of the License at
     7  
      *
     8  
      *     http://www.apache.org/licenses/LICENSE-2.0
     9  
      *
     10  
      * Unless required by applicable law or agreed to in writing, software
     11  
      * distributed under the License is distributed on an "AS IS" BASIS,
     12  
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  
      * See the License for the specific language governing permissions and
     14  
      * limitations under the License.
     15  
      *
     16  
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
     17  
      */
     18  
     package org.owasp.dependencycheck.maven;
     19  
     
     20  
     import java.io.File;
     21  
     import java.io.IOException;
     22  
     import java.io.UnsupportedEncodingException;
     23  
     import java.net.URLEncoder;
     24  
     import java.text.DateFormat;
     25  
     import java.util.Date;
     26  
     import java.util.List;
     27  
     import java.util.Set;
     28  
     import java.util.logging.Level;
     29  
     import java.util.logging.Logger;
     30  
     import org.apache.maven.doxia.sink.Sink;
     31  
     import org.owasp.dependencycheck.Engine;
     32  
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
     33  
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
     34  
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
     35  
     import org.owasp.dependencycheck.dependency.Dependency;
     36  
     import org.owasp.dependencycheck.dependency.Evidence;
     37  
     import org.owasp.dependencycheck.dependency.Identifier;
     38  
     import org.owasp.dependencycheck.dependency.Reference;
     39  
     import org.owasp.dependencycheck.dependency.Vulnerability;
     40  
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
     41  
     import org.owasp.dependencycheck.reporting.ReportGenerator;
     42  
     
     43  
     /**
     44  
      * A utility class that encapsulates the report generation for dependency-check-maven.
     45  
      *
     46  
      * @author Jeremy Long <jeremy.long@owasp.org>
     47  
      */
     48  
     final class ReportingUtil {
     49  
     
     50  
         /**
     51  
          * Logger field reference.
     52  
          */
     53  0
         private static final Logger LOGGER = Logger.getLogger(ReportingUtil.class.getName());
     54  
     
     55  
         /**
     56  
          * Empty private constructor for this utility class.
     57  
          */
     58  0
         private ReportingUtil() {
     59  0
         }
     60  
     
     61  
         /**
     62  
          * Generates the reports for a given dependency-check engine.
     63  
          *
     64  
          * @param engine a dependency-check engine
     65  
          * @param outDirectory the directory to write the reports to
     66  
          * @param projectName the name of the project that a report is being generated for
     67  
          * @param format the format of the report to generate
     68  
          */
     69  
         static void generateExternalReports(Engine engine, File outDirectory, String projectName, String format) {
     70  0
             DatabaseProperties prop = null;
     71  0
             CveDB cve = null;
     72  
             try {
     73  0
                 cve = new CveDB();
     74  0
                 cve.open();
     75  0
                 prop = cve.getDatabaseProperties();
     76  0
             } catch (DatabaseException ex) {
     77  0
                 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
     78  
             } finally {
     79  0
                 if (cve != null) {
     80  0
                     cve.close();
     81  
                 }
     82  
             }
     83  0
             final ReportGenerator r = new ReportGenerator(projectName, engine.getDependencies(), engine.getAnalyzers(), prop);
     84  
             try {
     85  0
                 r.generateReports(outDirectory.getCanonicalPath(), format);
     86  0
             } catch (IOException ex) {
     87  0
                 LOGGER.log(Level.SEVERE,
     88  
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
     89  0
                 LOGGER.log(Level.FINE, null, ex);
     90  0
             } catch (Throwable ex) {
     91  0
                 LOGGER.log(Level.SEVERE,
     92  
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
     93  0
                 LOGGER.log(Level.FINE, null, ex);
     94  0
             }
     95  0
         }
     96  
     
     97  
         /**
     98  
          * Generates a dependency-check report using the Maven Site format.
     99  
          *
     100  
          * @param engine the engine used to scan the dependencies
     101  
          * @param sink the sink to write the data to
     102  
          * @param projectName the name of the project
     103  
          */
     104  
         static void generateMavenSiteReport(final Engine engine, Sink sink, String projectName) {
     105  0
             final List<Dependency> dependencies = engine.getDependencies();
     106  
     
     107  0
             writeSiteReportHeader(sink, projectName);
     108  0
             writeSiteReportTOC(sink, dependencies);
     109  
     
     110  0
             int cnt = 0;
     111  0
             for (Dependency d : dependencies) {
     112  0
                 writeSiteReportDependencyHeader(sink, d);
     113  0
                 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
     114  0
                 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
     115  0
                 writeSiteReportDependencyIdentifiers(d, sink);
     116  0
                 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
     117  0
             }
     118  0
             sink.body_();
     119  0
         }
     120  
     
     121  
         // <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report">
     122  
         /**
     123  
          * Writes the vulnerabilities to the site report.
     124  
          *
     125  
          * @param d the dependency
     126  
          * @param sink the sink to write the data to
     127  
          * @param collapsibleHeaderCount the collapsible header count
     128  
          */
     129  
         private static void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
     130  0
             int cnt = collapsibleHeaderCount;
     131  0
             if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
     132  0
                 for (Vulnerability v : d.getVulnerabilities()) {
     133  
     
     134  0
                     sink.paragraph();
     135  0
                     sink.bold();
     136  
                     try {
     137  0
                         sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
     138  0
                         sink.text(v.getName());
     139  0
                         sink.link_();
     140  0
                         sink.bold_();
     141  0
                     } catch (UnsupportedEncodingException ex) {
     142  0
                         sink.text(v.getName());
     143  0
                         sink.bold_();
     144  0
                         sink.lineBreak();
     145  0
                         sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
     146  0
                     }
     147  0
                     sink.paragraph_();
     148  0
                     sink.paragraph();
     149  0
                     sink.text("Severity: ");
     150  0
                     if (v.getCvssScore() < 4.0) {
     151  0
                         sink.text("Low");
     152  
                     } else {
     153  0
                         if (v.getCvssScore() >= 7.0) {
     154  0
                             sink.text("High");
     155  
                         } else {
     156  0
                             sink.text("Medium");
     157  
                         }
     158  
                     }
     159  0
                     sink.lineBreak();
     160  0
                     sink.text("CVSS Score: " + v.getCvssScore());
     161  0
                     if (v.getCwe() != null && !v.getCwe().isEmpty()) {
     162  0
                         sink.lineBreak();
     163  0
                         sink.text("CWE: ");
     164  0
                         sink.text(v.getCwe());
     165  
                     }
     166  0
                     sink.paragraph_();
     167  0
                     sink.paragraph();
     168  0
                     sink.text(v.getDescription());
     169  0
                     if (v.getReferences() != null && !v.getReferences().isEmpty()) {
     170  0
                         sink.list();
     171  0
                         for (Reference ref : v.getReferences()) {
     172  0
                             sink.listItem();
     173  0
                             sink.text(ref.getSource());
     174  0
                             sink.text(" - ");
     175  0
                             sink.link(ref.getUrl());
     176  0
                             sink.text(ref.getName());
     177  0
                             sink.link_();
     178  0
                             sink.listItem_();
     179  0
                         }
     180  0
                         sink.list_();
     181  
                     }
     182  0
                     sink.paragraph_();
     183  0
                     if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
     184  0
                         sink.paragraph();
     185  
     
     186  0
                         cnt += 1;
     187  0
                         sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
     188  0
                         sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
     189  0
                         sink.list();
     190  0
                         for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
     191  0
                             sink.listItem();
     192  
                             try {
     193  0
                                 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
     194  0
                                 sink.text(vs.getName());
     195  0
                                 sink.link_();
     196  0
                                 if (vs.hasPreviousVersion()) {
     197  0
                                     sink.text(" and all previous versions.");
     198  
                                 }
     199  0
                             } catch (UnsupportedEncodingException ex) {
     200  0
                                 sink.text(vs.getName());
     201  0
                                 if (vs.hasPreviousVersion()) {
     202  0
                                     sink.text(" and all previous versions.");
     203  
                                 }
     204  0
                                 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
     205  0
                             }
     206  
     
     207  0
                             sink.listItem_();
     208  0
                         }
     209  0
                         sink.list_();
     210  0
                         sink.rawText("</div>");
     211  0
                         sink.paragraph_();
     212  
                     }
     213  0
                 }
     214  
             }
     215  0
         }
     216  
     
     217  
         /**
     218  
          * Writes the identifiers to the site report.
     219  
          *
     220  
          * @param d the dependency
     221  
          * @param sink the sink to write the data to
     222  
          */
     223  
         private static void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
     224  0
             if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
     225  0
                 sink.sectionTitle4();
     226  0
                 sink.text("Identifiers");
     227  0
                 sink.sectionTitle4_();
     228  0
                 sink.list();
     229  0
                 for (Identifier i : d.getIdentifiers()) {
     230  0
                     sink.listItem();
     231  0
                     sink.text(i.getType());
     232  0
                     sink.text(": ");
     233  0
                     if (i.getUrl() != null && i.getUrl().length() > 0) {
     234  0
                         sink.link(i.getUrl());
     235  0
                         sink.text(i.getValue());
     236  0
                         sink.link_();
     237  
                     } else {
     238  0
                         sink.text(i.getValue());
     239  
                     }
     240  0
                     if (i.getDescription() != null && i.getDescription().length() > 0) {
     241  0
                         sink.lineBreak();
     242  0
                         sink.text(i.getDescription());
     243  
                     }
     244  0
                     sink.listItem_();
     245  0
                 }
     246  0
                 sink.list_();
     247  
             }
     248  0
         }
     249  
     
     250  
         /**
     251  
          * Writes the related dependencies to the site report.
     252  
          *
     253  
          * @param d the dependency
     254  
          * @param sink the sink to write the data to
     255  
          * @param collapsibleHeaderCount the collapsible header count
     256  
          * @return the collapsible header count
     257  
          */
     258  
         private static int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
     259  0
             int cnt = collapsibleHeaderCount;
     260  0
             if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
     261  0
                 cnt += 1;
     262  0
                 sink.sectionTitle4();
     263  0
                 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
     264  0
                 sink.sectionTitle4_();
     265  0
                 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
     266  0
                 sink.list();
     267  0
                 for (Dependency r : d.getRelatedDependencies()) {
     268  0
                     sink.listItem();
     269  0
                     sink.text(r.getFileName());
     270  0
                     sink.list();
     271  0
                     writeListItem(sink, "File Path: " + r.getFilePath());
     272  0
                     writeListItem(sink, "SHA1: " + r.getSha1sum());
     273  0
                     writeListItem(sink, "MD5: " + r.getMd5sum());
     274  0
                     sink.list_();
     275  0
                     sink.listItem_();
     276  0
                 }
     277  0
                 sink.list_();
     278  0
                 sink.rawText("</div>");
     279  
             }
     280  0
             return cnt;
     281  
         }
     282  
     
     283  
         /**
     284  
          * Writes the evidence used to the site report.
     285  
          *
     286  
          * @param d the dependency
     287  
          * @param sink the sink to write the data to
     288  
          * @param collapsibleHeaderCount the collapsible header count
     289  
          * @return the collapsible header count
     290  
          */
     291  
         private static int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
     292  0
             int cnt = collapsibleHeaderCount;
     293  0
             final Set<Evidence> evidence = d.getEvidenceForDisplay();
     294  0
             if (evidence != null && evidence.size() > 0) {
     295  0
                 cnt += 1;
     296  0
                 sink.sectionTitle4();
     297  0
                 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
     298  0
                 sink.sectionTitle4_();
     299  0
                 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
     300  0
                 sink.table();
     301  0
                 sink.tableRow();
     302  0
                 writeTableHeaderCell(sink, "Source");
     303  0
                 writeTableHeaderCell(sink, "Name");
     304  0
                 writeTableHeaderCell(sink, "Value");
     305  0
                 sink.tableRow_();
     306  0
                 for (Evidence e : evidence) {
     307  0
                     sink.tableRow();
     308  0
                     writeTableCell(sink, e.getSource());
     309  0
                     writeTableCell(sink, e.getName());
     310  0
                     writeTableCell(sink, e.getValue());
     311  0
                     sink.tableRow_();
     312  0
                 }
     313  0
                 sink.table_();
     314  0
                 sink.rawText("</div>");
     315  
             }
     316  0
             return cnt;
     317  
         }
     318  
     
     319  
         /**
     320  
          * Writes the dependency header to the site report.
     321  
          *
     322  
          * @param d the dependency
     323  
          * @param sink the sink to write the data to
     324  
          */
     325  
         private static void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
     326  0
             sink.sectionTitle2();
     327  0
             sink.anchor("sha1" + d.getSha1sum());
     328  0
             sink.text(d.getFileName());
     329  0
             sink.anchor_();
     330  0
             sink.sectionTitle2_();
     331  0
             if (d.getDescription() != null && d.getDescription().length() > 0) {
     332  0
                 sink.paragraph();
     333  0
                 sink.bold();
     334  0
                 sink.text("Description: ");
     335  0
                 sink.bold_();
     336  0
                 sink.text(d.getDescription());
     337  0
                 sink.paragraph_();
     338  
             }
     339  0
             if (d.getLicense() != null && d.getLicense().length() > 0) {
     340  0
                 sink.paragraph();
     341  0
                 sink.bold();
     342  0
                 sink.text("License: ");
     343  0
                 sink.bold_();
     344  0
                 if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
     345  0
                     sink.link(d.getLicense());
     346  0
                     sink.text(d.getLicense());
     347  0
                     sink.link_();
     348  
                 } else {
     349  0
                     sink.text(d.getLicense());
     350  
                 }
     351  0
                 sink.paragraph_();
     352  
             }
     353  0
         }
     354  
     
     355  
         /**
     356  
          * Adds a list item to the site report.
     357  
          *
     358  
          * @param sink the sink to write the data to
     359  
          * @param text the text to write
     360  
          */
     361  
         private static void writeListItem(Sink sink, String text) {
     362  0
             sink.listItem();
     363  0
             sink.text(text);
     364  0
             sink.listItem_();
     365  0
         }
     366  
     
     367  
         /**
     368  
          * Adds a table cell to the site report.
     369  
          *
     370  
          * @param sink the sink to write the data to
     371  
          * @param text the text to write
     372  
          */
     373  
         private static void writeTableCell(Sink sink, String text) {
     374  0
             sink.tableCell();
     375  0
             sink.text(text);
     376  0
             sink.tableCell_();
     377  0
         }
     378  
     
     379  
         /**
     380  
          * Adds a table header cell to the site report.
     381  
          *
     382  
          * @param sink the sink to write the data to
     383  
          * @param text the text to write
     384  
          */
     385  
         private static void writeTableHeaderCell(Sink sink, String text) {
     386  0
             sink.tableHeaderCell();
     387  0
             sink.text(text);
     388  0
             sink.tableHeaderCell_();
     389  0
         }
     390  
     
     391  
         /**
     392  
          * Writes the TOC for the site report.
     393  
          *
     394  
          * @param sink the sink to write the data to
     395  
          * @param dependencies the dependencies that are being reported on
     396  
          */
     397  
         private static void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
     398  0
             sink.list();
     399  0
             for (Dependency d : dependencies) {
     400  0
                 sink.listItem();
     401  0
                 sink.link("#sha1" + d.getSha1sum());
     402  0
                 sink.text(d.getFileName());
     403  0
                 sink.link_();
     404  0
                 if (!d.getVulnerabilities().isEmpty()) {
     405  0
                     sink.rawText(" <font style=\"color:red\">•</font>");
     406  
                 }
     407  0
                 if (!d.getRelatedDependencies().isEmpty()) {
     408  0
                     sink.list();
     409  0
                     for (Dependency r : d.getRelatedDependencies()) {
     410  0
                         writeListItem(sink, r.getFileName());
     411  0
                     }
     412  0
                     sink.list_();
     413  
                 }
     414  0
                 sink.listItem_();
     415  0
             }
     416  0
             sink.list_();
     417  0
         }
     418  
     
     419  
         /**
     420  
          * Writes the site report header.
     421  
          *
     422  
          * @param sink the sink to write the data to
     423  
          * @param projectName the name of the project
     424  
          */
     425  
         private static void writeSiteReportHeader(Sink sink, String projectName) {
     426  0
             sink.head();
     427  0
             sink.title();
     428  0
             sink.text("Dependency-Check Report: " + projectName);
     429  0
             sink.title_();
     430  0
             sink.head_();
     431  0
             sink.body();
     432  0
             sink.rawText("<script type=\"text/javascript\">");
     433  0
             sink.rawText("function toggleElement(el, targetId) {");
     434  0
             sink.rawText("if (el.innerText == '[+]') {");
     435  0
             sink.rawText("    el.innerText = '[-]';");
     436  0
             sink.rawText("    document.getElementById(targetId).style.display='block';");
     437  0
             sink.rawText("} else {");
     438  0
             sink.rawText("    el.innerText = '[+]';");
     439  0
             sink.rawText("    document.getElementById(targetId).style.display='none';");
     440  0
             sink.rawText("}");
     441  
     
     442  0
             sink.rawText("}");
     443  0
             sink.rawText("</script>");
     444  0
             sink.section1();
     445  0
             sink.sectionTitle1();
     446  0
             sink.text("Project: " + projectName);
     447  0
             sink.sectionTitle1_();
     448  0
             sink.date();
     449  0
             final Date now = new Date();
     450  0
             sink.text(DateFormat.getDateTimeInstance().format(now));
     451  0
             sink.date_();
     452  0
             sink.section1_();
     453  0
         }
     454  
         // </editor-fold>
     455  
     
     456  
     }
    + + + + diff --git a/dependency-check-maven/configuration.html b/dependency-check-maven/configuration.html index 6ba879617..9f9387182 100644 --- a/dependency-check-maven/configuration.html +++ b/dependency-check-maven/configuration.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Configuration @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -103,7 +103,7 @@ Project Information - +
  • @@ -171,6 +171,15 @@ +aggregate + +Sets whether report aggregation will be performed for multi-module site reports. This option only affects the report generation when configured within the reporting section. + +false + + + + autoUpdate Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. @@ -178,15 +187,6 @@ true - - -externalReport - -When using as a Site plugin this parameter sets whether or not the external report format should be used. - -false - - outputDirectory @@ -380,7 +380,7 @@ cveUrl12Modified -URL for the modified CVE 1.2 +URL for the modified CVE 1.2. http://nvd.nist.gov/download/nvdcve-modified.xml @@ -389,7 +389,7 @@ cveUrl20Modified -URL for the modified CVE 2.0 +URL for the modified CVE 2.0. http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml @@ -398,7 +398,7 @@ cveUrl12Base -Base URL for each year’s CVE 1.2, the %d will be replaced with the year +Base URL for each year’s CVE 1.2, the %d will be replaced with the year. http://nvd.nist.gov/download/nvdcve-%d.xml @@ -407,7 +407,7 @@ cveUrl20Base -Base URL for each year’s CVE 2.0, the %d will be replaced with the year +Base URL for each year’s CVE 2.0, the %d will be replaced with the year. http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml @@ -416,7 +416,7 @@ connectionTimeout -The URL Connection Timeout. +Sets the URL Connection Timeout used when downloading external data.   @@ -425,7 +425,7 @@ dataDirectory -Data directory to hold SQL CVEs contents. This should generally not be changed. +Sets the data directory to hold SQL CVEs contents. This should generally not be changed.   @@ -474,10 +474,44 @@   + + + +metaFileName + +Sets the name of the file to use for storing the metadata about the project. + +dependency-check.ser +

    Proxy Configuration

    -

    Use Maven’s settings to configure a proxy server.

    +

    Use Maven’s settings to configure a proxy server. If multiple proxies are configured in the Maven settings file you must tell dependency-check which proxy to use with the following property:

    + + + + + + + + + + + + + + + + + + + + + + + + +
    Property Description Default Value
    mavenSettingsProxyId The id for the proxy, configured via settings.xml, that dependency-check should use.  
    diff --git a/dependency-check-maven/dependency-updates-report.html b/dependency-check-maven/dependency-updates-report.html index 1db9f76f8..05fa851cd 100644 --- a/dependency-check-maven/dependency-updates-report.html +++ b/dependency-check-maven/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • @@ -373,7 +380,7 @@ org.owasp dependency-check-core -1.2.4 +1.2.5 compile jar @@ -385,7 +392,7 @@ org.owasp dependency-check-utils -1.2.4 +1.2.5 compile jar @@ -461,7 +468,7 @@ jar Newer versions -3.0.1 Next Incremental
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.1.0-alpha-1 Latest Incremental
    3.1.0 Next Minor
    3.1.1
    3.2.1
    3.2.2 Latest Minor +3.0.1 Next Incremental
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.1.0-alpha-1 Latest Incremental
    3.1.0 Next Minor
    3.1.1
    3.2.1
    3.2.2
    3.2.3 Latest Minor

    org.apache.maven:maven-plugin-api

    @@ -488,7 +495,7 @@ -
    jar
    Newer versions3.0.1 Next Incremental
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.1.0-alpha-1 Latest Incremental
    3.1.0 Next Minor
    3.1.1
    3.2.1
    3.2.2 Latest Minor
    +3.0.1 Next Incremental
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.1.0-alpha-1 Latest Incremental
    3.1.0 Next Minor
    3.1.1
    3.2.1
    3.2.2
    3.2.3 Latest Minor

    org.apache.maven:maven-settings

    @@ -515,7 +522,7 @@ -
    jar
    Newer versions3.0.1 Next Incremental
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.1.0-alpha-1 Latest Incremental
    3.1.0 Next Minor
    3.1.1
    3.2.1
    3.2.2 Latest Minor
    +3.0.1 Next Incremental
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.1.0-alpha-1 Latest Incremental
    3.1.0 Next Minor
    3.1.1
    3.2.1
    3.2.2
    3.2.3 Latest Minor

    org.apache.maven.plugin-testing:maven-plugin-testing-harness

    @@ -635,7 +642,7 @@ - + @@ -659,7 +666,7 @@ - + diff --git a/dependency-check-maven/findbugs.html b/dependency-check-maven/findbugs.html index 854f8f8ce..0ed23e954 100644 --- a/dependency-check-maven/findbugs.html +++ b/dependency-check-maven/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-maven - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -183,6 +183,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • FindBugs Report @@ -246,7 +253,7 @@
  • - +
    dependency-check-core
    Current Version1.2.4
    1.2.5
    Scope compile
    dependency-check-utils
    Current Version1.2.4
    1.2.5
    Scope compile
    Errors Missing Classes
    24 1 0 0
    diff --git a/dependency-check-maven/help-mojo.html b/dependency-check-maven/help-mojo.html index c882cd5b4..d8ff713f5 100644 --- a/dependency-check-maven/help-mojo.html +++ b/dependency-check-maven/help-mojo.html @@ -1,13 +1,13 @@ - + dependency-check-maven - dependency-check:help @@ -55,7 +55,7 @@
  • - + /
  • @@ -69,9 +69,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -107,7 +107,7 @@ Project Information - +
  • @@ -163,7 +163,7 @@

    Full name:

    -

    org.owasp:dependency-check-maven:1.2.4:help

    +

    org.owasp:dependency-check-maven:1.2.5:help

    Description:

    diff --git a/dependency-check-maven/index.html b/dependency-check-maven/index.html index 3bec9778b..bcc5b13e8 100644 --- a/dependency-check-maven/index.html +++ b/dependency-check-maven/index.html @@ -1,13 +1,13 @@ - + dependency-check-maven - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -126,7 +126,7 @@ - +
  • diff --git a/dependency-check-maven/license.html b/dependency-check-maven/license.html index 38805cc04..5ce846900 100644 --- a/dependency-check-maven/license.html +++ b/dependency-check-maven/license.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -126,7 +126,7 @@ - +
  • diff --git a/dependency-check-maven/plugin-info.html b/dependency-check-maven/plugin-info.html index 0652ee359..265bd544e 100644 --- a/dependency-check-maven/plugin-info.html +++ b/dependency-check-maven/plugin-info.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Plugin Documentation @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • @@ -279,7 +286,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.2.4</version> + <version>1.2.5</version> </plugin> ... </plugins> @@ -289,7 +296,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.2.4</version> + <version>1.2.5</version> </plugin> ... </plugins> @@ -301,7 +308,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.2.4</version> + <version>1.2.5</version> </plugin> ... </plugins> diff --git a/dependency-check-maven/plugin-updates-report.html b/dependency-check-maven/plugin-updates-report.html index a171a1034..e07af35c7 100644 --- a/dependency-check-maven/plugin-updates-report.html +++ b/dependency-check-maven/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • diff --git a/dependency-check-maven/pmd.html b/dependency-check-maven/pmd.html index 55e424e63..1f521b45a 100644 --- a/dependency-check-maven/pmd.html +++ b/dependency-check-maven/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-maven - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.1.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -183,16 +183,9 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • -
  • - PMD Report + PMD
  • @@ -247,27 +240,18 @@

    PMD Results

    -

    The following document contains the results of PMD 5.0.2.

    +

    The following document contains the results of PMD 5.0.5.

    Files

    -

    org/owasp/dependencycheck/maven/HelpMojo.java

    +

    org/owasp/dependencycheck/maven/DependencyCheckMojo.java

    - - - - - - - - - -
    Violation Line
    Avoid unused imports such as 'java.util.Iterator'20
    Useless parentheses.224
    Useless parentheses.269
    Useless parentheses.280
    +699 diff --git a/dependency-check-maven/project-info.html b/dependency-check-maven/project-info.html index 6e96e6079..6114a72f8 100644 --- a/dependency-check-maven/project-info.html +++ b/dependency-check-maven/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -126,7 +126,7 @@ - +
  • diff --git a/dependency-check-maven/project-reports.html b/dependency-check-maven/project-reports.html index 1c8486b40..d80c8be37 100644 --- a/dependency-check-maven/project-reports.html +++ b/dependency-check-maven/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • Project Reports @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • @@ -271,6 +278,9 @@ Checkstyle Report on coding style conventions. +PMD +Verification of coding rules. + FindBugs Report Generates a source code report with the FindBugs Library. diff --git a/dependency-check-maven/project-summary.html b/dependency-check-maven/project-summary.html index e0ba1ca85..5ce4bd91e 100644 --- a/dependency-check-maven/project-summary.html +++ b/dependency-check-maven/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -126,7 +126,7 @@ - +
  • @@ -218,7 +218,7 @@ dependency-check-maven Version -1.2.4 +1.2.5 Type maven-plugin diff --git a/dependency-check-maven/surefire-report.html b/dependency-check-maven/surefire-report.html index e4d3b98a5..c228f509b 100644 --- a/dependency-check-maven/surefire-report.html +++ b/dependency-check-maven/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • @@ -267,7 +274,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.089
    +0.164

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -288,7 +295,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.089
    +0.164

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.maven

    @@ -310,7 +317,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.089

    +0.164

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -320,7 +327,7 @@ function toggleDisplay(elementId) { testGenerate_Sink_SinkFactory_Locale -0.002

    +0.006
    diff --git a/dependency-check-maven/taglist.html b/dependency-check-maven/taglist.html index a16b9dd39..a4f48cec9 100644 --- a/dependency-check-maven/taglist.html +++ b/dependency-check-maven/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,6 +181,13 @@ Checkstyle
  • +
  • + + + + PMD +
  • +
  • @@ -241,14 +248,20 @@ Tag strings used by tag class Todo Work -12 +13 todo, FIXME

    Each tag is detailed below:

    Todo Work

    -

    Number of occurrences found in the code: 12

    +

    Number of occurrences found in the code: 13

    + + + + + + diff --git a/dependency-check-maven/usage.html b/dependency-check-maven/usage.html index c49228a91..f4f0b037c 100644 --- a/dependency-check-maven/usage.html +++ b/dependency-check-maven/usage.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Usage @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -103,7 +103,7 @@ Project Information - +
  • @@ -163,13 +163,15 @@
    <project>
    +    ...
         <build>
    +        ...
             <plugins>
                 ...
                 <plugin>
                   <groupId>org.owasp</groupId>
                   <artifactId>dependency-check-maven</artifactId>
    -              <version>1.2.4</version>
    +              <version>1.2.5</version>
                   <executions>
                       <execution>
                           <goals>
    @@ -187,17 +189,54 @@
     

    Example 2:

    +

    Create an aggregated dependency-check report within the site

    + +
    +
    <project>
    +    ...
    +    <reporting>
    +        ...
    +        <plugins>
    +            ...
    +            <plugin>
    +                <plugin>
    +                    <groupId>org.owasp</groupId>
    +                    <artifactId>dependency-check-maven</artifactId>
    +                    <version>1.2.5</version>
    +                    <configuration>
    +                        <aggregate>true</aggregate>
    +                    </configuration>
    +                    <reportSets>
    +                        <reportSet>
    +                            <reports>
    +                                <report>check</report>
    +                            </reports>
    +                        </reportSet>
    +                    </reportSets>
    +                </plugin>
    +            </plugin>
    +            ...
    +        </plugins>
    +        ...
    +    </reporting>
    +    ...
    +</project>
    +
    +
    +

    Example 3:

    Create the DependencyCheck-report.html and fail the build for CVSS greater then 8

    <project>
    +    ...
         <build>
    +        ...
             <plugins>
                 ...
                 <plugin>
                   <groupId>org.owasp</groupId>
                   <artifactId>dependency-check-maven</artifactId>
    -              <version>1.2.4</version>
    +              <version>1.2.5</version>
                   <configuration>
                       <failBuildOnCVSS>8</failBuildOnCVSS>
                   </configuration>
    @@ -217,50 +256,20 @@
     </project>
     
    -

    Example 3:

    -

    Create the dependency-check report within the site

    - -
    -
    <project>
    -    <build>
    -        <plugins>
    -            ...
    -            <plugin>
    -                <groupId>org.apache.maven.plugins</groupId>
    -                <artifactId>maven-site-plugin</artifactId>
    -                <configuration>
    -                    <reportPlugins>
    -                        <plugin>
    -                            <groupId>org.owasp</groupId>
    -                            <artifactId>dependency-check-maven</artifactId>
    -                            <version>1.2.4</version>
    -                            <configuration>
    -                                <externalReport>false</externalReport>
    -                            </configuration>
    -                        </plugin>
    -                    </reportPlugins>
    -                </configuration>
    -            </plugin>
    -            ...
    -        </plugins>
    -        ...
    -    </build>
    -    ...
    -</project>
    -
    -

    Example 4:

    -

    Create the DependencyCheck-report.html and skip artifacts no bundled in distribution (Provided and Runtime scope)

    +

    Create the DependencyCheck-report.html and skip artifacts not bundled in distribution (Provided and Runtime scope)

    <project>
    +    ...
         <build>
    +        ...
             <plugins>
                 ...
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
    -                <version>1.2.4</version>
    +                <version>1.2.5</version>
                     <configuration>
                         <skipProvidedScope>true</skipProvidedScope>
                         <skipRuntimeScope>true</skipRuntimeScope>
    @@ -286,13 +295,15 @@
     
     
    <project>
    +    ...
         <build>
    +        ...
             <plugins>
                 ...
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
    -                <version>1.2.4</version>
    +                <version>1.2.5</version>
                     <configuration>
                         <cveUrl12Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-modified.xml</cveUrl12Modified>
                         <cveUrl20Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-2.0-modified.xml</cveUrl20Modified>
    diff --git a/dependency-check-maven/xref-test/index.html b/dependency-check-maven/xref-test/index.html
    index 783adda81..ac4632c06 100644
    --- a/dependency-check-maven/xref-test/index.html
    +++ b/dependency-check-maven/xref-test/index.html
    @@ -4,7 +4,7 @@
     
     	
     		
    -		Dependency-Check Maven Plugin 1.2.4 Reference
    +		Dependency-Check Maven Plugin 1.2.5 Reference
     	
         
     		
    diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
    index eefe93d0e..1ca4ba145 100644
    --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
    +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
    @@ -3,7 +3,7 @@
     
     	
     		
    -		Dependency-Check Maven Plugin 1.2.4 Reference Package org.owasp.dependencycheck.maven
    +		Dependency-Check Maven Plugin 1.2.5 Reference Package org.owasp.dependencycheck.maven
     		
     	
     	
    diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html
    index 817511b4b..053b34b67 100644
    --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html
    +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html
    @@ -3,7 +3,7 @@
     
     	
     		
    -		Dependency-Check Maven Plugin 1.2.4 Reference Package org.owasp.dependencycheck.maven
    +		Dependency-Check Maven Plugin 1.2.5 Reference Package org.owasp.dependencycheck.maven
     		
     	
     	
    diff --git a/dependency-check-maven/xref-test/overview-frame.html b/dependency-check-maven/xref-test/overview-frame.html
    index 231df996b..1dcb2eb31 100644
    --- a/dependency-check-maven/xref-test/overview-frame.html
    +++ b/dependency-check-maven/xref-test/overview-frame.html
    @@ -3,7 +3,7 @@
     
     	
     		
    -		Dependency-Check Maven Plugin 1.2.4 Reference
    +		Dependency-Check Maven Plugin 1.2.5 Reference
     		
     	
     	
    diff --git a/dependency-check-maven/xref-test/overview-summary.html b/dependency-check-maven/xref-test/overview-summary.html
    index f09fea6bd..cfa7a5fe6 100644
    --- a/dependency-check-maven/xref-test/overview-summary.html
    +++ b/dependency-check-maven/xref-test/overview-summary.html
    @@ -3,7 +3,7 @@
     
     	
     		
    -		Dependency-Check Maven Plugin 1.2.4 Reference
    +		Dependency-Check Maven Plugin 1.2.5 Reference
     		
     	
     	
    @@ -24,7 +24,7 @@
     	        
           	
    -

    Dependency-Check Maven Plugin 1.2.4 Reference

    +

    Dependency-Check Maven Plugin 1.2.5 Reference

  • org.owasp.dependencycheck.maven.DependencyCheckMojoLine
    fix logging905
    org.owasp.dependencycheck.maven.DependencyCheckMojoTest Line
    diff --git a/dependency-check-maven/xref/allclasses-frame.html b/dependency-check-maven/xref/allclasses-frame.html index 27a40ecce..30b717d76 100644 --- a/dependency-check-maven/xref/allclasses-frame.html +++ b/dependency-check-maven/xref/allclasses-frame.html @@ -16,6 +16,12 @@
  • HelpMojo +
  • +
  • + ReportAggregationMojo +
  • +
  • + ReportingUtil
  • diff --git a/dependency-check-maven/xref/index.html b/dependency-check-maven/xref/index.html index 783adda81..ac4632c06 100644 --- a/dependency-check-maven/xref/index.html +++ b/dependency-check-maven/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Maven Plugin 1.2.4 Reference + Dependency-Check Maven Plugin 1.2.5 Reference diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html index 7f5d537b3..6a6944612 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html @@ -25,1113 +25,910 @@ 17 */18package org.owasp.dependencycheck.maven; 19 -20import java.io.File; -21import java.io.IOException; -22import java.io.InputStream; -23import java.io.UnsupportedEncodingException; -24import java.net.URLEncoder; -25import java.text.DateFormat; -26import java.util.Date; -27import java.util.List; -28import java.util.Locale; -29import java.util.Set; -30import java.util.logging.Level; -31import java.util.logging.Logger; -32import org.apache.maven.artifact.Artifact; -33import org.apache.maven.doxia.sink.Sink; -34import org.apache.maven.doxia.sink.SinkFactory; -35import org.apache.maven.plugin.AbstractMojo; +20import java.io.BufferedOutputStream; +21import java.io.File; +22import java.io.FileInputStream; +23import java.io.FileNotFoundException; +24import java.io.FileOutputStream; +25import java.io.IOException; +26import java.io.InputStream; +27import java.io.ObjectInputStream; +28import java.io.ObjectOutputStream; +29import java.io.OutputStream; +30import java.util.List; +31import java.util.Locale; +32import java.util.Set; +33import java.util.logging.Level; +34import java.util.logging.Logger; +35import org.apache.maven.artifact.Artifact; 36import org.apache.maven.plugin.MojoExecutionException; 37import org.apache.maven.plugin.MojoFailureException; -38import org.apache.maven.plugins.annotations.Component; -39import org.apache.maven.plugins.annotations.LifecyclePhase; -40import org.apache.maven.plugins.annotations.Mojo; -41import org.apache.maven.plugins.annotations.Parameter; -42import org.apache.maven.plugins.annotations.ResolutionScope; -43import org.apache.maven.project.MavenProject; -44import org.apache.maven.reporting.MavenMultiPageReport; -45import org.apache.maven.reporting.MavenReport; -46import org.apache.maven.reporting.MavenReportException; -47import org.apache.maven.settings.Proxy; -48import org.owasp.dependencycheck.Engine; -49import org.owasp.dependencycheck.data.nvdcve.CveDB; -50import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -51import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -52import org.owasp.dependencycheck.dependency.Dependency; -53import org.owasp.dependencycheck.dependency.Evidence; -54import org.owasp.dependencycheck.dependency.Identifier; -55import org.owasp.dependencycheck.dependency.Reference; -56import org.owasp.dependencycheck.dependency.Vulnerability; -57import org.owasp.dependencycheck.dependency.VulnerableSoftware; -58import org.owasp.dependencycheck.reporting.ReportGenerator; -59import org.owasp.dependencycheck.utils.LogUtils; -60import org.owasp.dependencycheck.utils.Settings; -61 -62/** -63 * Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities. -64 * -65 * @author Jeremy Long <jeremy.long@owasp.org> -66 */ -67 @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true, -68 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM, -69 requiresOnline = true) -70publicclassDependencyCheckMojoextends AbstractMojo implements MavenMultiPageReport { -71 -72/** -73 * Logger field reference. -74 */ -75privatefinal Logger logger = Logger.getLogger(DependencyCheckMojo.class.getName()); -76 -77/** -78 * The properties file location. -79 */ -80privatestaticfinal String PROPERTIES_FILE = "mojo.properties"; -81/** -82 * Name of the logging properties file. -83 */ -84privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; -85/** -86 * System specific new line character. -87 */ -88privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); +38import org.apache.maven.plugins.annotations.LifecyclePhase; +39import org.apache.maven.plugins.annotations.Mojo; +40import org.apache.maven.plugins.annotations.Parameter; +41import org.apache.maven.plugins.annotations.ResolutionScope; +42import org.apache.maven.project.MavenProject; +43import org.apache.maven.reporting.MavenReport; +44import org.apache.maven.reporting.MavenReportException; +45import org.apache.maven.settings.Proxy; +46import org.owasp.dependencycheck.Engine; +47import org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer; +48import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +49import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +50import org.owasp.dependencycheck.dependency.Dependency; +51import org.owasp.dependencycheck.dependency.Identifier; +52import org.owasp.dependencycheck.dependency.Vulnerability; +53import org.owasp.dependencycheck.utils.LogUtils; +54import org.owasp.dependencycheck.utils.Settings; +55 +56/** +57 * Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities. +58 * +59 * @author Jeremy Long <jeremy.long@owasp.org> +60 */ +61 @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true, +62 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM, +63 requiresOnline = true) +64publicclassDependencyCheckMojoextendsReportAggregationMojo { +65 +66//<editor-fold defaultstate="collapsed" desc="Private fields"> +67/** +68 * Logger field reference. +69 */ +70privatestaticfinal Logger LOGGER = Logger.getLogger(DependencyCheckMojo.class.getName()); +71/** +72 * The properties file location. +73 */ +74privatestaticfinal String PROPERTIES_FILE = "mojo.properties"; +75/** +76 * Name of the logging properties file. +77 */ +78privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; +79/** +80 * System specific new line character. +81 */ +82privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); +83/** +84 * The dependency-check engine used to scan the project. +85 */ +86private Engine engine = null; +87//</editor-fold> +8889// <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">90/** -91 * The Maven Project Object. +91 * The path to the verbose log.92 */ -93 @Component -94private MavenProject project; +93 @Parameter(property = "logfile", defaultValue = "") +94private String logFile = null; 95/** -96 * The path to the verbose log. +96 * The output directory. This generally maps to "target".97 */ -98 @Parameter(property = "logfile", defaultValue = "") -99private String logFile; +98 @Parameter(defaultValue = "${project.build.directory}", required = true) +99private File outputDirectory; 100/** -101 * The name of the report to be displayed in the Maven Generated Reports page. -102 */ -103 @Parameter(property = "name", defaultValue = "Dependency-Check") -104private String name; -105/** -106 * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page. -107 */ -108 @Parameter(property = "description", defaultValue = "A report providing details on any published " -109 + "vulnerabilities within project dependencies. This report is a best effort but may contain " -110 + "false positives and false negatives.") -111private String description; -112/** -113 * Specifies the destination directory for the generated Dependency-Check report. This generally maps to -114 * "target/site". -115 */ -116 @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true) -117private File reportOutputDirectory; -118/** -119 * The output directory. This generally maps to "target". -120 */ -121 @Parameter(defaultValue = "${project.build.directory}", required = true) -122private File outputDirectory; -123/** -124 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 -125 * which means since the CVSS scores are 0-10, by default the build will never fail. -126 */ -127 @SuppressWarnings("CanBeFinal") -128 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true) -129privatefloat failBuildOnCVSS = 11; -130/** -131 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to -132 * false. Default is true. -133 */ -134 @SuppressWarnings("CanBeFinal") -135 @Parameter(property = "autoupdate", defaultValue = "true", required = true) -136privateboolean autoUpdate = true; -137/** -138 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this -139 * within the Site plugin unless the externalReport is set to true. Default is HTML. -140 */ -141 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -142 @Parameter(property = "format", defaultValue = "HTML", required = true) -143private String format = "HTML"; -144/** -145 * Sets whether or not the external report format should be used. -146 */ -147 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -148 @Parameter(property = "externalReport", defaultValue = "false", required = true) -149privateboolean externalReport = false; -150 -151/** -152 * The maven settings. -153 */ -154 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -155 @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false) -156private org.apache.maven.settings.Settings mavenSettings; -157 -158/** -159 * The maven settings proxy id. -160 */ -161 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -162 @Parameter(property = "mavenSettingsProxyId", required = false) -163private String mavenSettingsProxyId; -164 -165/** -166 * The Connection Timeout. -167 */ -168 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -169 @Parameter(property = "connectionTimeout", defaultValue = "", required = false) -170private String connectionTimeout = null; -171/** -172 * The path to the suppression file. -173 */ -174 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -175 @Parameter(property = "suppressionFile", defaultValue = "", required = false) -176private String suppressionFile = null; -177/** -178 * Flag indicating whether or not to show a summary in the output. -179 */ -180 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -181 @Parameter(property = "showSummary", defaultValue = "true", required = false) -182privateboolean showSummary = true; -183 -184/** -185 * Whether or not the Jar Analyzer is enabled. -186 */ -187 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -188 @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false) -189privateboolean jarAnalyzerEnabled = true; -190 -191/** -192 * Whether or not the Archive Analyzer is enabled. -193 */ -194 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -195 @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false) -196privateboolean archiveAnalyzerEnabled = true; -197 -198/** -199 * Whether or not the .NET Assembly Analyzer is enabled. -200 */ -201 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -202 @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false) -203privateboolean assemblyAnalyzerEnabled = true; -204 -205/** -206 * Whether or not the .NET Nuspec Analyzer is enabled. -207 */ -208 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -209 @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false) -210privateboolean nuspecAnalyzerEnabled = true; -211 +101 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 +102 * which means since the CVSS scores are 0-10, by default the build will never fail. +103 */ +104 @SuppressWarnings("CanBeFinal") +105 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true) +106privatefloat failBuildOnCVSS = 11; +107/** +108 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to +109 * false. Default is true. +110 */ +111 @SuppressWarnings("CanBeFinal") +112 @Parameter(property = "autoupdate", defaultValue = "true", required = true) +113privateboolean autoUpdate = true; +114/** +115 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this +116 * within the Site plugin unless the externalReport is set to true. Default is HTML. +117 */ +118 @SuppressWarnings("CanBeFinal") +119 @Parameter(property = "format", defaultValue = "HTML", required = true) +120private String format = "HTML"; +121/** +122 * The maven settings. +123 */ +124 @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false) +125private org.apache.maven.settings.Settings mavenSettings; +126 +127/** +128 * The maven settings proxy id. +129 */ +130 @SuppressWarnings("CanBeFinal") +131 @Parameter(property = "mavenSettingsProxyId", required = false) +132private String mavenSettingsProxyId; +133 +134/** +135 * The Connection Timeout. +136 */ +137 @SuppressWarnings("CanBeFinal") +138 @Parameter(property = "connectionTimeout", defaultValue = "", required = false) +139private String connectionTimeout = null; +140/** +141 * The path to the suppression file. +142 */ +143 @SuppressWarnings("CanBeFinal") +144 @Parameter(property = "suppressionFile", defaultValue = "", required = false) +145private String suppressionFile = null; +146/** +147 * Flag indicating whether or not to show a summary in the output. +148 */ +149 @SuppressWarnings("CanBeFinal") +150 @Parameter(property = "showSummary", defaultValue = "true", required = false) +151privateboolean showSummary = true; +152 +153/** +154 * Whether or not the Jar Analyzer is enabled. +155 */ +156 @SuppressWarnings("CanBeFinal") +157 @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false) +158privateboolean jarAnalyzerEnabled = true; +159 +160/** +161 * Whether or not the Archive Analyzer is enabled. +162 */ +163 @SuppressWarnings("CanBeFinal") +164 @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false) +165privateboolean archiveAnalyzerEnabled = true; +166 +167/** +168 * Whether or not the .NET Assembly Analyzer is enabled. +169 */ +170 @SuppressWarnings("CanBeFinal") +171 @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false) +172privateboolean assemblyAnalyzerEnabled = true; +173 +174/** +175 * Whether or not the .NET Nuspec Analyzer is enabled. +176 */ +177 @SuppressWarnings("CanBeFinal") +178 @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false) +179privateboolean nuspecAnalyzerEnabled = true; +180 +181/** +182 * Whether or not the Nexus Analyzer is enabled. +183 */ +184 @SuppressWarnings("CanBeFinal") +185 @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false) +186privateboolean nexusAnalyzerEnabled = true; +187/** +188 * Whether or not the Nexus Analyzer is enabled. +189 */ +190 @Parameter(property = "nexusUrl", defaultValue = "", required = false) +191private String nexusUrl; +192/** +193 * Whether or not the configured proxy is used to connect to Nexus. +194 */ +195 @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false) +196privateboolean nexusUsesProxy = true; +197/** +198 * The database connection string. +199 */ +200 @Parameter(property = "connectionString", defaultValue = "", required = false) +201private String connectionString; +202/** +203 * The database driver name. An example would be org.h2.Driver. +204 */ +205 @Parameter(property = "databaseDriverName", defaultValue = "", required = false) +206private String databaseDriverName; +207/** +208 * The path to the database driver if it is not on the class path. +209 */ +210 @Parameter(property = "databaseDriverPath", defaultValue = "", required = false) +211private String databaseDriverPath; 212/** -213 * Whether or not the Nexus Analyzer is enabled. +213 * The database user name.214 */ -215 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -216 @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false) -217privateboolean nexusAnalyzerEnabled = true; -218/** -219 * Whether or not the Nexus Analyzer is enabled. -220 */ -221 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -222 @Parameter(property = "nexusUrl", defaultValue = "", required = false) -223private String nexusUrl; -224/** -225 * Whether or not the configured proxy is used to connect to Nexus. -226 */ -227 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -228 @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false) -229privateboolean nexusUsesProxy = true; -230/** -231 * The database connection string. -232 */ -233 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -234 @Parameter(property = "connectionString", defaultValue = "", required = false) -235private String connectionString; -236/** -237 * The database driver name. An example would be org.h2.Driver. -238 */ -239 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -240 @Parameter(property = "databaseDriverName", defaultValue = "", required = false) -241private String databaseDriverName; -242/** -243 * The path to the database driver if it is not on the class path. -244 */ -245 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -246 @Parameter(property = "databaseDriverPath", defaultValue = "", required = false) -247private String databaseDriverPath; -248/** -249 * The database user name. -250 */ -251 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -252 @Parameter(property = "databaseUser", defaultValue = "", required = false) -253private String databaseUser; -254/** -255 * The password to use when connecting to the database. -256 */ -257 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -258 @Parameter(property = "databasePassword", defaultValue = "", required = false) -259private String databasePassword; +215 @Parameter(property = "databaseUser", defaultValue = "", required = false) +216private String databaseUser; +217/** +218 * The password to use when connecting to the database. +219 */ +220 @Parameter(property = "databasePassword", defaultValue = "", required = false) +221private String databasePassword; +222/** +223 * A comma-separated list of file extensions to add to analysis next to jar, zip, .... +224 */ +225 @Parameter(property = "zipExtensions", required = false) +226private String zipExtensions; +227/** +228 * Skip Analysis for Test Scope Dependencies. +229 */ +230 @SuppressWarnings("CanBeFinal") +231 @Parameter(property = "skipTestScope", defaultValue = "true", required = false) +232privateboolean skipTestScope = true; +233/** +234 * Skip Analysis for Runtime Scope Dependencies. +235 */ +236 @SuppressWarnings("CanBeFinal") +237 @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false) +238privateboolean skipRuntimeScope = false; +239/** +240 * Skip Analysis for Provided Scope Dependencies. +241 */ +242 @SuppressWarnings("CanBeFinal") +243 @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false) +244privateboolean skipProvidedScope = false; +245/** +246 * The data directory, hold DC SQL DB. +247 */ +248 @Parameter(property = "dataDirectory", defaultValue = "", required = false) +249private String dataDirectory; +250/** +251 * Data Mirror URL for CVE 1.2. +252 */ +253 @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false) +254private String cveUrl12Modified; +255/** +256 * Data Mirror URL for CVE 2.0. +257 */ +258 @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false) +259private String cveUrl20Modified; 260/** -261 * A comma-separated list of file extensions to add to analysis next to jar, zip, .... +261 * Base Data Mirror URL for CVE 1.2.262 */ -263 @Parameter(property = "zipExtensions", required = false) -264private String zipExtensions; +263 @Parameter(property = "cveUrl12Base", defaultValue = "", required = false) +264private String cveUrl12Base; 265/** -266 * Skip Analysis for Test Scope Dependencies. +266 * Data Mirror URL for CVE 2.0.267 */ -268 @SuppressWarnings("CanBeFinal") -269 @Parameter(property = "skipTestScope", defaultValue = "true", required = false) -270privateboolean skipTestScope = true; +268 @Parameter(property = "cveUrl20Base", defaultValue = "", required = false) +269private String cveUrl20Base; +270271/** -272 * Skip Analysis for Runtime Scope Dependencies. +272 * The path to mono for .NET Assembly analysis on non-windows systems.273 */ -274 @SuppressWarnings("CanBeFinal") -275 @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false) -276privateboolean skipRuntimeScope = false; +274 @Parameter(property = "pathToMono", defaultValue = "", required = false) +275private String pathToMono; +276277/** -278 * Skip Analysis for Provided Scope Dependencies. -279 */ -280 @SuppressWarnings("CanBeFinal") -281 @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false) -282privateboolean skipProvidedScope = false; -283/** -284 * The data directory, hold DC SQL DB. -285 */ -286 @Parameter(property = "dataDirectory", defaultValue = "", required = false) -287private String dataDirectory; -288/** -289 * Data Mirror URL for CVE 1.2. +278 * The Proxy URL. +279 * +280 * @deprecated Please use mavenSettings instead +281 */ +282 @SuppressWarnings("CanBeFinal") +283 @Parameter(property = "proxyUrl", defaultValue = "", required = false) +284 @Deprecated +285private String proxyUrl = null; +286/** +287 * Sets whether or not the external report format should be used. +288 * +289 * @deprecated the internal report is no longer supported290 */ -291 @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false) -292private String cveUrl12Modified; -293/** -294 * Data Mirror URL for CVE 2.0. -295 */ -296 @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false) -297private String cveUrl20Modified; -298/** -299 * Base Data Mirror URL for CVE 1.2. -300 */ -301 @Parameter(property = "cveUrl12Base", defaultValue = "", required = false) -302private String cveUrl12Base; -303/** -304 * Data Mirror URL for CVE 2.0. -305 */ -306 @Parameter(property = "cveUrl20Base", defaultValue = "", required = false) -307private String cveUrl20Base; -308 -309/** -310 * The path to mono for .NET Assembly analysis on non-windows systems. -311 */ -312 @Parameter(property = "pathToMono", defaultValue = "", required = false) -313private String pathToMono; -314 -315/** -316 * The Proxy URL. -317 * -318 * @deprecated Please use mavenSettings instead -319 */ -320 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -321 @Parameter(property = "proxyUrl", defaultValue = "", required = false) -322 @Deprecated -323private String proxyUrl = null; -324 -325// </editor-fold> -326/** -327 * Executes the Dependency-Check on the dependent libraries. -328 * -329 * @return the Engine used to scan the dependencies. -330 * @throws DatabaseException thrown if there is an exception connecting to the database -331 */ -332private Engine executeDependencyCheck() throws DatabaseException { +291 @SuppressWarnings("CanBeFinal") +292 @Parameter(property = "externalReport") +293 @Deprecated +294private String externalReport = null; +295// </editor-fold> +296/** +297 * Constructs a new dependency-check-mojo. +298 */ +299publicDependencyCheckMojo() { +300final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +301 LogUtils.prepareLogger(in, logFile); +302 } +303 +304/** +305 * Executes the Dependency-Check on the dependent libraries. +306 * +307 * @return the Engine used to scan the dependencies. +308 * @throws DatabaseException thrown if there is an exception connecting to the database +309 */ +310private Engine executeDependencyCheck() throws DatabaseException { +311return executeDependencyCheck(getProject()); +312 } +313 +314/** +315 * Executes the Dependency-Check on the dependent libraries. +316 * +317 * @param project the project to run dependency-check on +318 * @return the Engine used to scan the dependencies. +319 * @throws DatabaseException thrown if there is an exception connecting to the database +320 */ +321private Engine executeDependencyCheck(MavenProject project) throws DatabaseException { +322final Engine localEngine = initializeEngine(); +323 +324final Set<Artifact> artifacts = project.getArtifacts(); +325for (Artifact a : artifacts) { +326if (excludeFromScan(a)) { +327continue; +328 } +329 +330 localEngine.scan(a.getFile().getAbsolutePath()); +331 } +332 localEngine.analyzeDependencies(); 333 -334final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -335 LogUtils.prepareLogger(in, logFile); +334return localEngine; +335 } 336 -337 populateSettings(); -338final Engine engine = new Engine(); -339 -340final Set<Artifact> artifacts = project.getArtifacts(); -341for (Artifact a : artifacts) { -342if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) { -343continue; -344 } -345 -346if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) { -347continue; -348 } -349 -350if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) { -351continue; -352 } -353 -354 engine.scan(a.getFile().getAbsolutePath()); -355 } -356 engine.analyzeDependencies(); -357 -358return engine; -359 } -360 -361/** -362 * Generates the reports for a given dependency-check engine. -363 * -364 * @param engine a dependency-check engine -365 * @param outDirectory the directory to write the reports to -366 */ -367privatevoid generateExternalReports(Engine engine, File outDirectory) { -368 DatabaseProperties prop = null; -369 CveDB cve = null; -370try { -371 cve = new CveDB(); -372 cve.open(); -373 prop = cve.getDatabaseProperties(); -374 } catch (DatabaseException ex) { -375 logger.log(Level.FINE, "Unable to retrieve DB Properties", ex); -376 } finally { -377if (cve != null) { -378 cve.close(); -379 } -380 } -381final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop); -382try { -383 r.generateReports(outDirectory.getCanonicalPath(), format); -384 } catch (IOException ex) { -385 logger.log(Level.SEVERE, -386"Unexpected exception occurred during analysis; please see the verbose error log for more details."); -387 logger.log(Level.FINE, null, ex); -388 } catch (Throwable ex) { -389 logger.log(Level.SEVERE, -390"Unexpected exception occurred during analysis; please see the verbose error log for more details."); -391 logger.log(Level.FINE, null, ex); -392 } -393 } -394 -395/** -396 * Generates a dependency-check report using the Maven Site format. -397 * -398 * @param engine the engine used to scan the dependencies -399 * @param sink the sink to write the data to -400 */ -401privatevoid generateMavenSiteReport(final Engine engine, Sink sink) { -402final List<Dependency> dependencies = engine.getDependencies(); -403 -404 writeSiteReportHeader(sink, project.getName()); -405 writeSiteReportTOC(sink, dependencies); -406 -407int cnt = 0; -408for (Dependency d : dependencies) { -409 writeSiteReportDependencyHeader(sink, d); -410 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink); -411 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink); -412 writeSiteReportDependencyIdentifiers(d, sink); -413 writeSiteReportDependencyVulnerabilities(d, sink, cnt); -414 } -415 sink.body_(); -416 } -417 -418// <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report"> -419/** -420 * Writes the vulnerabilities to the site report. -421 * -422 * @param d the dependency -423 * @param sink the sink to write the data to -424 * @param collapsibleHeaderCount the collapsible header count -425 */ -426privatevoid writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) { -427int cnt = collapsibleHeaderCount; -428if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) { -429for (Vulnerability v : d.getVulnerabilities()) { -430 -431 sink.paragraph(); -432 sink.bold(); -433try { -434 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII")); -435 sink.text(v.getName()); -436 sink.link_(); -437 sink.bold_(); -438 } catch (UnsupportedEncodingException ex) { -439 sink.text(v.getName()); -440 sink.bold_(); -441 sink.lineBreak(); -442 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName()); -443 } -444 sink.paragraph_(); -445 sink.paragraph(); -446 sink.text("Severity: "); -447if (v.getCvssScore() < 4.0) { -448 sink.text("Low"); -449 } else { -450if (v.getCvssScore() >= 7.0) { -451 sink.text("High"); -452 } else { -453 sink.text("Medium"); -454 } -455 } -456 sink.lineBreak(); -457 sink.text("CVSS Score: " + v.getCvssScore()); -458if (v.getCwe() != null && !v.getCwe().isEmpty()) { -459 sink.lineBreak(); -460 sink.text("CWE: "); -461 sink.text(v.getCwe()); -462 } -463 sink.paragraph_(); -464 sink.paragraph(); -465 sink.text(v.getDescription()); -466if (v.getReferences() != null && !v.getReferences().isEmpty()) { -467 sink.list(); -468for (Reference ref : v.getReferences()) { -469 sink.listItem(); -470 sink.text(ref.getSource()); -471 sink.text(" - "); -472 sink.link(ref.getUrl()); -473 sink.text(ref.getName()); -474 sink.link_(); -475 sink.listItem_(); -476 } -477 sink.list_(); -478 } -479 sink.paragraph_(); -480if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) { -481 sink.paragraph(); -482 -483 cnt += 1; -484 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>"); -485 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">"); -486 sink.list(); -487for (VulnerableSoftware vs : v.getVulnerableSoftware()) { -488 sink.listItem(); -489try { -490 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII")); -491 sink.text(vs.getName()); -492 sink.link_(); -493if (vs.hasPreviousVersion()) { -494 sink.text(" and all previous versions."); -495 } -496 } catch (UnsupportedEncodingException ex) { -497 sink.text(vs.getName()); -498if (vs.hasPreviousVersion()) { -499 sink.text(" and all previous versions."); -500 } -501 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")"); -502 } -503 -504 sink.listItem_(); -505 } -506 sink.list_(); -507 sink.rawText("</div>"); -508 sink.paragraph_(); -509 } -510 } -511 } +337/** +338 * Initializes a new <code>Engine</code> that can be used for scanning. +339 * +340 * @return a newly instantiated <code>Engine</code> +341 * @throws DatabaseException thrown if there is a database exception +342 */ +343private Engine initializeEngine() throws DatabaseException { +344 populateSettings(); +345final Engine localEngine = new Engine(); +346return localEngine; +347 } +348 +349/** +350 * Tests is the artifact should be included in the scan (i.e. is the dependency in a scope that is being scanned). +351 * +352 * @param a the Artifact to test +353 * @return <code>true</code> if the artifact is in an excluded scope; otherwise <code>false</code> +354 */ +355privateboolean excludeFromScan(Artifact a) { +356if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) { +357returntrue; +358 } +359if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) { +360returntrue; +361 } +362if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) { +363returntrue; +364 } +365return false; +366 } +367 +368//<editor-fold defaultstate="collapsed" desc="Methods to populate global settings"> +369/** +370 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system +371 * properties required to change the proxy url, port, and connection timeout. +372 */ +373privatevoid populateSettings() { +374 Settings.initialize(); +375 InputStream mojoProperties = null; +376try { +377 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +378 Settings.mergeProperties(mojoProperties); +379 } catch (IOException ex) { +380 LOGGER.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); +381 LOGGER.log(Level.FINE, null, ex); +382 } finally { +383if (mojoProperties != null) { +384try { +385 mojoProperties.close(); +386 } catch (IOException ex) { +387 LOGGER.log(Level.FINEST, null, ex); +388 } +389 } +390 } +391 +392 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +393if (externalReport != null) { +394 LOGGER.warning("The 'externalReport' option was set; this configuration option has been removed. " +395 + "Please update the dependency-check-maven plugin's configuration"); +396 } +397 +398if (proxyUrl != null && !proxyUrl.isEmpty()) { +399 LOGGER.warning("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings " +400 + "to configure the proxy instead"); +401 } +402final Proxy proxy = getMavenProxy(); +403if (proxy != null) { +404 Settings.setString(Settings.KEYS.PROXY_SERVER, proxy.getHost()); +405 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort())); +406final String userName = proxy.getUsername(); +407final String password = proxy.getPassword(); +408if (userName != null) { +409 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName); +410 } +411if (password != null) { +412 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password); +413 } +414 +415 } +416 +417if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +418 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +419 } +420if (suppressionFile != null && !suppressionFile.isEmpty()) { +421 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +422 } +423 +424//File Type Analyzer Settings +425//JAR ANALYZER +426 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled); +427//NUSPEC ANALYZER +428 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled); +429//NEXUS ANALYZER +430 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); +431if (nexusUrl != null && !nexusUrl.isEmpty()) { +432 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +433 } +434 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); +435//ARCHIVE ANALYZER +436 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled); +437if (zipExtensions != null && !zipExtensions.isEmpty()) { +438 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); +439 } +440//ASSEMBLY ANALYZER +441 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled); +442if (pathToMono != null && !pathToMono.isEmpty()) { +443 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); +444 } +445 +446//Database configuration +447if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +448 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +449 } +450if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +451 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +452 } +453if (connectionString != null && !connectionString.isEmpty()) { +454 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +455 } +456if (databaseUser != null && !databaseUser.isEmpty()) { +457 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +458 } +459if (databasePassword != null && !databasePassword.isEmpty()) { +460 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +461 } +462// Data Directory +463if (dataDirectory != null && !dataDirectory.isEmpty()) { +464 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +465 } +466 +467// Scope Exclusion +468 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope); +469 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope); +470 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope); +471 +472// CVE Data Mirroring +473if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { +474 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); +475 } +476if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { +477 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); +478 } +479if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { +480 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); +481 } +482if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { +483 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); +484 } +485 } +486 +487/** +488 * Returns the maven proxy. +489 * +490 * @return the maven proxy +491 */ +492private Proxy getMavenProxy() { +493if (mavenSettings != null) { +494final List<Proxy> proxies = mavenSettings.getProxies(); +495if (proxies != null && proxies.size() > 0) { +496if (mavenSettingsProxyId != null) { +497for (Proxy proxy : proxies) { +498if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) { +499return proxy; +500 } +501 } +502 } elseif (proxies.size() == 1) { +503return proxies.get(0); +504 } else { +505 LOGGER.warning("Multiple proxy defentiions exist in the Maven settings. In the dependency-check " +506 + "configuration set the maveSettingsProxyId so that the correct proxy will be used."); +507thrownew IllegalStateException("Ambiguous proxy definition"); +508 } +509 } +510 } +511returnnull; 512 } -513 -514/** -515 * Writes the identifiers to the site report. -516 * -517 * @param d the dependency -518 * @param sink the sink to write the data to -519 */ -520privatevoid writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) { -521if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) { -522 sink.sectionTitle4(); -523 sink.text("Identifiers"); -524 sink.sectionTitle4_(); -525 sink.list(); -526for (Identifier i : d.getIdentifiers()) { -527 sink.listItem(); -528 sink.text(i.getType()); -529 sink.text(": "); -530if (i.getUrl() != null && i.getUrl().length() > 0) { -531 sink.link(i.getUrl()); -532 sink.text(i.getValue()); -533 sink.link_(); -534 } else { -535 sink.text(i.getValue()); -536 } -537if (i.getDescription() != null && i.getDescription().length() > 0) { -538 sink.lineBreak(); -539 sink.text(i.getDescription()); -540 } -541 sink.listItem_(); -542 } -543 sink.list_(); -544 } -545 } -546 -547/** -548 * Writes the related dependencies to the site report. -549 * -550 * @param d the dependency -551 * @param sink the sink to write the data to -552 * @param collapsibleHeaderCount the collapsible header count -553 * @return the collapsible header count -554 */ -555privateint writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) { -556int cnt = collapsibleHeaderCount; -557if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) { -558 cnt += 1; -559 sink.sectionTitle4(); -560 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>"); -561 sink.sectionTitle4_(); -562 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">"); -563 sink.list(); -564for (Dependency r : d.getRelatedDependencies()) { -565 sink.listItem(); -566 sink.text(r.getFileName()); -567 sink.list(); -568 writeListItem(sink, "File Path: " + r.getFilePath()); -569 writeListItem(sink, "SHA1: " + r.getSha1sum()); -570 writeListItem(sink, "MD5: " + r.getMd5sum()); -571 sink.list_(); -572 sink.listItem_(); -573 } -574 sink.list_(); -575 sink.rawText("</div>"); -576 } -577return cnt; -578 } -579 -580/** -581 * Writes the evidence used to the site report. -582 * -583 * @param d the dependency -584 * @param sink the sink to write the data to -585 * @param collapsibleHeaderCount the collapsible header count -586 * @return the collapsible header count -587 */ -588privateint writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) { -589int cnt = collapsibleHeaderCount; -590final Set<Evidence> evidence = d.getEvidenceForDisplay(); -591if (evidence != null && evidence.size() > 0) { -592 cnt += 1; -593 sink.sectionTitle4(); -594 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>"); -595 sink.sectionTitle4_(); -596 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">"); -597 sink.table(); -598 sink.tableRow(); -599 writeTableHeaderCell(sink, "Source"); -600 writeTableHeaderCell(sink, "Name"); -601 writeTableHeaderCell(sink, "Value"); -602 sink.tableRow_(); -603for (Evidence e : evidence) { -604 sink.tableRow(); -605 writeTableCell(sink, e.getSource()); -606 writeTableCell(sink, e.getName()); -607 writeTableCell(sink, e.getValue()); -608 sink.tableRow_(); -609 } -610 sink.table_(); -611 sink.rawText("</div>"); -612 } -613return cnt; -614 } -615 -616/** -617 * Writes the dependency header to the site report. -618 * -619 * @param d the dependency -620 * @param sink the sink to write the data to -621 */ -622privatevoid writeSiteReportDependencyHeader(Sink sink, Dependency d) { -623 sink.sectionTitle2(); -624 sink.anchor("sha1" + d.getSha1sum()); -625 sink.text(d.getFileName()); -626 sink.anchor_(); -627 sink.sectionTitle2_(); -628if (d.getDescription() != null && d.getDescription().length() > 0) { -629 sink.paragraph(); -630 sink.bold(); -631 sink.text("Description: "); -632 sink.bold_(); -633 sink.text(d.getDescription()); -634 sink.paragraph_(); +513//</editor-fold> +514 +515/** +516 * Executes the dependency-check and generates the report. +517 * +518 * @throws MojoExecutionException if a maven exception occurs +519 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level +520 */ +521 @Override +522protectedvoid performExecute() throws MojoExecutionException, MojoFailureException { +523try { +524 engine = executeDependencyCheck(); +525 ReportingUtil.generateExternalReports(engine, outputDirectory, getProject().getName(), format); +526if (this.showSummary) { +527 showSummary(engine.getDependencies()); +528 } +529if (this.failBuildOnCVSS <= 10) { +530 checkForFailure(engine.getDependencies()); +531 } +532 } catch (DatabaseException ex) { +533 LOGGER.log(Level.SEVERE, +534"Unable to connect to the dependency-check database; analysis has stopped"); +535 LOGGER.log(Level.FINE, "", ex); +536 } +537 } +538 +539 @Override +540protectedvoid postExecute() throws MojoExecutionException, MojoFailureException { +541try { +542super.postExecute(); +543 } finally { +544 cleanupEngine(); +545 } +546 } +547 +548 @Override +549protectedvoid postGenerate() throws MavenReportException { +550try { +551super.postGenerate(); +552 } finally { +553 cleanupEngine(); +554 } +555 } +556 +557/** +558 * Calls <code>engine.cleanup()</code> to release resources. +559 */ +560privatevoid cleanupEngine() { +561if (engine != null) { +562 engine.cleanup(); +563 engine = null; +564 } +565 Settings.cleanup(true); +566 } +567 +568/** +569 * Generates the Dependency-Check Site Report. +570 * +571 * @param locale the locale to use when generating the report +572 * @throws MavenReportException if a maven report exception occurs +573 */ +574 @Override +575protectedvoid executeNonAggregateReport(Locale locale) throws MavenReportException { +576 +577final List<Dependency> deps = readDataFile(); +578if (deps != null) { +579try { +580 engine = initializeEngine(); +581 engine.getDependencies().addAll(deps); +582 } catch (DatabaseException ex) { +583final String msg = String.format("An unrecoverable exception with the dependency-check initialization occured while scanning %s", +584 getProject().getName()); +585thrownew MavenReportException(msg, ex); +586 } +587 } else { +588try { +589 engine = executeDependencyCheck(); +590 } catch (DatabaseException ex) { +591final String msg = String.format("An unrecoverable exception with the dependency-check scan occured while scanning %s", +592 getProject().getName()); +593thrownew MavenReportException(msg, ex); +594 } +595 } +596 ReportingUtil.generateExternalReports(engine, getReportOutputDirectory(), getProject().getName(), format); +597 } +598 +599 @Override +600protectedvoid executeAggregateReport(MavenProject project, Locale locale) throws MavenReportException { +601 List<Dependency> deps = readDataFile(project); +602if (deps != null) { +603try { +604 engine = initializeEngine(); +605 engine.getDependencies().addAll(deps); +606 } catch (DatabaseException ex) { +607final String msg = String.format("An unrecoverable exception with the dependency-check initialization occured while scanning %s", +608 project.getName()); +609thrownew MavenReportException(msg, ex); +610 } +611 } else { +612try { +613 engine = executeDependencyCheck(project); +614 } catch (DatabaseException ex) { +615final String msg = String.format("An unrecoverable exception with the dependency-check scan occured while scanning %s", +616 project.getName()); +617thrownew MavenReportException(msg, ex); +618 } +619 } +620for (MavenProject child : getAllChildren(project)) { +621 deps = readDataFile(child); +622if (deps == null) { +623final String msg = String.format("Unable to include information on %s in the dependency-check aggregate report", child.getName()); +624 LOGGER.severe(msg); +625 } else { +626 engine.getDependencies().addAll(deps); +627 } +628 } +629final DependencyBundlingAnalyzer bundler = new DependencyBundlingAnalyzer(); +630try { +631 bundler.analyze(null, engine); +632 } catch (AnalysisException ex) { +633 LOGGER.log(Level.WARNING, "An error occured grouping the dependencies; duplicate entries may exist in the report", ex); +634 LOGGER.log(Level.FINE, "Bundling Exception", ex); 635 } -636if (d.getLicense() != null && d.getLicense().length() > 0) { -637 sink.paragraph(); -638 sink.bold(); -639 sink.text("License: "); -640 sink.bold_(); -641if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) { -642 sink.link(d.getLicense()); -643 sink.text(d.getLicense()); -644 sink.link_(); -645 } else { -646 sink.text(d.getLicense()); -647 } -648 sink.paragraph_(); -649 } -650 } -651 -652/** -653 * Adds a list item to the site report. -654 * -655 * @param sink the sink to write the data to -656 * @param text the text to write -657 */ -658privatevoid writeListItem(Sink sink, String text) { -659 sink.listItem(); -660 sink.text(text); -661 sink.listItem_(); -662 } -663 -664/** -665 * Adds a table cell to the site report. -666 * -667 * @param sink the sink to write the data to -668 * @param text the text to write -669 */ -670privatevoid writeTableCell(Sink sink, String text) { -671 sink.tableCell(); -672 sink.text(text); -673 sink.tableCell_(); -674 } -675 -676/** -677 * Adds a table header cell to the site report. -678 * -679 * @param sink the sink to write the data to -680 * @param text the text to write -681 */ -682privatevoid writeTableHeaderCell(Sink sink, String text) { -683 sink.tableHeaderCell(); -684 sink.text(text); -685 sink.tableHeaderCell_(); -686 } -687 -688/** -689 * Writes the TOC for the site report. -690 * -691 * @param sink the sink to write the data to -692 * @param dependencies the dependencies that are being reported on -693 */ -694privatevoid writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) { -695 sink.list(); -696for (Dependency d : dependencies) { -697 sink.listItem(); -698 sink.link("#sha1" + d.getSha1sum()); -699 sink.text(d.getFileName()); -700 sink.link_(); -701if (!d.getVulnerabilities().isEmpty()) { -702 sink.rawText(" <font style=\"color:red\">•</font>"); -703 } -704if (!d.getRelatedDependencies().isEmpty()) { -705 sink.list(); -706for (Dependency r : d.getRelatedDependencies()) { -707 writeListItem(sink, r.getFileName()); -708 } -709 sink.list_(); +636final File outputDir = getReportOutputDirectory(project); +637if (outputDir != null) { +638 ReportingUtil.generateExternalReports(engine, outputDir, project.getName(), format); +639 } +640 } +641 +642// <editor-fold defaultstate="collapsed" desc="Mojo interface/abstract required setter/getter methods"> +643/** +644 * Returns the output name. +645 * +646 * @return the output name +647 */ +648public String getOutputName() { +649if ("HTML".equalsIgnoreCase(this.format) +650 || "ALL".equalsIgnoreCase(this.format)) { +651return"dependency-check-report"; +652 } elseif ("XML".equalsIgnoreCase(this.format)) { +653return"dependency-check-report.xml#"; +654 } elseif ("VULN".equalsIgnoreCase(this.format)) { +655return"dependency-check-vulnerability"; +656 } else { +657 LOGGER.log(Level.WARNING, "Unknown report format used during site generation."); +658return"dependency-check-report"; +659 } +660 } +661 +662/** +663 * Returns the category name. +664 * +665 * @return the category name +666 */ +667public String getCategoryName() { +668return MavenReport.CATEGORY_PROJECT_REPORTS; +669 } +670 +671/** +672 * Returns the report name. +673 * +674 * @param locale the location +675 * @return the report name +676 */ +677public String getName(Locale locale) { +678return"dependency-check"; +679 } +680 +681/** +682 * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page. +683 * +684 * @param locale The Locale to get the description for +685 * @return the description +686 */ +687public String getDescription(Locale locale) { +688return"A report providing details on any published " +689 + "vulnerabilities within project dependencies. This report is a best effort but may contain " +690 + "false positives and false negatives."; +691 } +692 +693/** +694 * Returns whether or not a report can be generated. +695 * +696 * @return <code>true</code> if a report can be generated; otherwise <code>false</code> +697 */ +698publicboolean canGenerateReport() { +699if (canGenerateAggregateReport() || (isAggregate() && isMultiModule())) { +700returntrue; +701 } +702if (canGenerateNonAggregateReport()) { +703returntrue; +704 } else { +705final String msg; +706if (getProject().getArtifacts().size() > 0) { +707 msg = "No project dependencies exist in the included scope - dependency-check:check is unable to generate a report."; +708 } else { +709 msg = "No project dependencies exist - dependency-check:check is unable to generate a report."; 710 } -711 sink.listItem_(); +711 LOGGER.warning(msg); 712 } -713 sink.list_(); -714 } -715 -716/** -717 * Writes the site report header. -718 * -719 * @param sink the sink to write the data to -720 * @param projectName the name of the project +713 +714return false; +715 } +716 +717/** +718 * Returns whether or not a non-aggregate report can be generated. +719 * +720 * @return <code>true</code> if a non-aggregate report can be generated; otherwise <code>false</code>721 */ -722privatevoid writeSiteReportHeader(Sink sink, String projectName) { -723 sink.head(); -724 sink.title(); -725 sink.text("Dependency-Check Report: " + projectName); -726 sink.title_(); -727 sink.head_(); -728 sink.body(); -729 sink.rawText("<script type=\"text/javascript\">"); -730 sink.rawText("function toggleElement(el, targetId) {"); -731 sink.rawText("if (el.innerText == '[+]') {"); -732 sink.rawText(" el.innerText = '[-]';"); -733 sink.rawText(" document.getElementById(targetId).style.display='block';"); -734 sink.rawText("} else {"); -735 sink.rawText(" el.innerText = '[+]';"); -736 sink.rawText(" document.getElementById(targetId).style.display='none';"); -737 sink.rawText("}"); -738 -739 sink.rawText("}"); -740 sink.rawText("</script>"); -741 sink.section1(); -742 sink.sectionTitle1(); -743 sink.text("Project: " + projectName); -744 sink.sectionTitle1_(); -745 sink.date(); -746final Date now = new Date(); -747 sink.text(DateFormat.getDateTimeInstance().format(now)); -748 sink.date_(); -749 sink.section1_(); -750 } -751// </editor-fold> -752 -753/** -754 * Returns the maven settings proxy server. -755 * -756 * @param proxy the maven proxy -757 * @return the proxy url -758 */ -759private String getMavenSettingsProxyServer(Proxy proxy) { -760returnnew StringBuilder(proxy.getProtocol()).append("://").append(proxy.getHost()).toString(); -761 } -762 -763/** -764 * Returns the maven proxy. -765 * -766 * @return the maven proxy -767 */ -768private Proxy getMavenProxy() { -769if (mavenSettings != null) { -770final List<Proxy> proxies = mavenSettings.getProxies(); -771if (proxies != null && proxies.size() > 0) { -772if (mavenSettingsProxyId != null) { -773for (Proxy proxy : proxies) { -774if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) { -775return proxy; -776 } -777 } -778 } elseif (proxies.size() == 1) { -779return proxies.get(0); -780 } else { -781thrownew IllegalStateException("Ambiguous proxy definition"); -782 } -783 } -784 } -785returnnull; -786 } -787 -788/** -789 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system -790 * properties required to change the proxy url, port, and connection timeout. -791 */ -792privatevoid populateSettings() { -793 Settings.initialize(); -794 InputStream mojoProperties = null; -795try { -796 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -797 Settings.mergeProperties(mojoProperties); -798 } catch (IOException ex) { -799 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); -800 logger.log(Level.FINE, null, ex); -801 } finally { -802if (mojoProperties != null) { -803try { -804 mojoProperties.close(); -805 } catch (IOException ex) { -806 logger.log(Level.FINEST, null, ex); -807 } -808 } -809 } -810 -811 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -812 -813if (proxyUrl != null && !proxyUrl.isEmpty()) { -814 logger.warning("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings to configure the proxy instead"); -815 } -816 -817final Proxy proxy = getMavenProxy(); -818if (proxy != null) { -819 Settings.setString(Settings.KEYS.PROXY_SERVER, getMavenSettingsProxyServer(proxy)); -820 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort())); -821final String userName = proxy.getUsername(); -822final String password = proxy.getPassword(); -823if (userName != null && password != null) { -824 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName); -825 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password); -826 } -827 } -828 -829if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -830 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); -831 } -832if (suppressionFile != null && !suppressionFile.isEmpty()) { -833 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -834 } -835 -836//File Type Analyzer Settings -837//JAR ANALYZER -838 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled); -839//NUSPEC ANALYZER -840 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled); -841//NEXUS ANALYZER -842 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); -843if (nexusUrl != null && !nexusUrl.isEmpty()) { -844 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); -845 } -846 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); -847//ARCHIVE ANALYZER -848 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled); -849if (zipExtensions != null && !zipExtensions.isEmpty()) { -850 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); -851 } -852//ASSEMBLY ANALYZER -853 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled); -854if (pathToMono != null && !pathToMono.isEmpty()) { -855 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); -856 } -857 -858//Database configuration -859if (databaseDriverName != null && !databaseDriverName.isEmpty()) { -860 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); -861 } -862if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { -863 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); -864 } -865if (connectionString != null && !connectionString.isEmpty()) { -866 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); -867 } -868if (databaseUser != null && !databaseUser.isEmpty()) { -869 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +722 @Override +723protectedboolean canGenerateNonAggregateReport() { +724boolean ability = false; +725for (Artifact a : getProject().getArtifacts()) { +726if (!excludeFromScan(a)) { +727 ability = true; +728break; +729 } +730 } +731return ability; +732 } +733 +734/** +735 * Returns whether or not an aggregate report can be generated. +736 * +737 * @return <code>true</code> if an aggregate report can be generated; otherwise <code>false</code> +738 */ +739 @Override +740protectedboolean canGenerateAggregateReport() { +741return isAggregate() && isLastProject(); +742 } +743// </editor-fold> +744 +745//<editor-fold defaultstate="collapsed" desc="Methods to fail build or show summary"> +746/** +747 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the +748 * configuration. +749 * +750 * @param dependencies the list of dependency objects +751 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set +752 */ +753privatevoid checkForFailure(List<Dependency> dependencies) throws MojoFailureException { +754final StringBuilder ids = new StringBuilder(); +755for (Dependency d : dependencies) { +756boolean addName = true; +757for (Vulnerability v : d.getVulnerabilities()) { +758if (v.getCvssScore() >= failBuildOnCVSS) { +759if (addName) { +760 addName = false; +761 ids.append(NEW_LINE).append(d.getFileName()).append(": "); +762 ids.append(v.getName()); +763 } else { +764 ids.append(", ").append(v.getName()); +765 } +766 } +767 } +768 } +769if (ids.length() > 0) { +770final String msg = String.format("%n%nDependency-Check Failure:%n" +771 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" +772 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); +773thrownew MojoFailureException(msg); +774 } +775 } +776 +777/** +778 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. +779 * +780 * @param dependencies a list of dependency objects +781 */ +782privatevoid showSummary(List<Dependency> dependencies) { +783final StringBuilder summary = new StringBuilder(); +784for (Dependency d : dependencies) { +785boolean firstEntry = true; +786final StringBuilder ids = new StringBuilder(); +787for (Vulnerability v : d.getVulnerabilities()) { +788if (firstEntry) { +789 firstEntry = false; +790 } else { +791 ids.append(", "); +792 } +793 ids.append(v.getName()); +794 } +795if (ids.length() > 0) { +796 summary.append(d.getFileName()).append(" ("); +797 firstEntry = true; +798for (Identifier id : d.getIdentifiers()) { +799if (firstEntry) { +800 firstEntry = false; +801 } else { +802 summary.append(", "); +803 } +804 summary.append(id.getValue()); +805 } +806 summary.append(") : ").append(ids).append(NEW_LINE); +807 } +808 } +809if (summary.length() > 0) { +810final String msg = String.format("%n%n" +811 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" +812 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); +813 LOGGER.log(Level.WARNING, msg); +814 } +815 } +816//</editor-fold> +817 +818//<editor-fold defaultstate="collapsed" desc="Methods to read/write the serialized data file"> +819/** +820 * Writes the scan data to disk. This is used to serialize the scan data between the "check" and "aggregate" phase. +821 * +822 * @return the File object referencing the data file that was written +823 */ +824 @Override +825protected File writeDataFile() { +826 File file = null; +827if (engine != null && getProject().getContextValue(this.getDataFileContextKey()) == null) { +828 file = new File(getProject().getBuild().getDirectory(), getDataFileName()); +829 OutputStream os = null; +830 OutputStream bos = null; +831 ObjectOutputStream out = null; +832try { +833 os = new FileOutputStream(file); +834 bos = new BufferedOutputStream(os); +835 out = new ObjectOutputStream(bos); +836 out.writeObject(engine.getDependencies()); +837 out.flush(); +838 +839//call reset to prevent resource leaks per +840//https://www.securecoding.cert.org/confluence/display/java/SER10-J.+Avoid+memory+and+resource+leaks+during+serialization +841 out.reset(); +842 +843 } catch (IOException ex) { +844 LOGGER.log(Level.WARNING, "Unable to create data file used for report aggregation; " +845 + "if report aggregation is being used the results may be incomplete."); +846 LOGGER.log(Level.FINE, ex.getMessage(), ex); +847 } finally { +848if (out != null) { +849try { +850 out.close(); +851 } catch (IOException ex) { +852 LOGGER.log(Level.FINEST, "ignore", ex); +853 } +854 } +855if (bos != null) { +856try { +857 bos.close(); +858 } catch (IOException ex) { +859 LOGGER.log(Level.FINEST, "ignore", ex); +860 } +861 } +862if (os != null) { +863try { +864 os.close(); +865 } catch (IOException ex) { +866 LOGGER.log(Level.FINEST, "ignore", ex); +867 } +868 } +869 } 870 } -871if (databasePassword != null && !databasePassword.isEmpty()) { -872 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); -873 } -874// Data Directory -875if (dataDirectory != null && !dataDirectory.isEmpty()) { -876 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -877 } -878 -879// Scope Exclusion -880 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope); -881 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope); -882 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope); -883 -884// CVE Data Mirroring -885if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { -886 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); -887 } -888if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { -889 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); -890 } -891if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { -892 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); -893 } -894if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { -895 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); -896 } -897 -898 } -899 -900/** -901 * Executes the dependency-check and generates the report. -902 * -903 * @throws MojoExecutionException if a maven exception occurs -904 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level -905 */ -906publicvoid execute() throws MojoExecutionException, MojoFailureException { -907 Engine engine = null; -908try { -909 engine = executeDependencyCheck(); -910 generateExternalReports(engine, outputDirectory); -911if (this.showSummary) { -912 showSummary(engine.getDependencies()); -913 } -914if (this.failBuildOnCVSS <= 10) { -915 checkForFailure(engine.getDependencies()); -916 } -917 } catch (DatabaseException ex) { -918 logger.log(Level.SEVERE, -919"Unable to connect to the dependency-check database; analysis has stopped"); -920 logger.log(Level.FINE, "", ex); -921 } finally { -922 Settings.cleanup(true); -923if (engine != null) { -924 engine.cleanup(); -925 } -926 } -927 } -928 -929/** -930 * Generates the Dependency-Check Site Report. -931 * -932 * @param sink the sink to write the report to -933 * @param locale the locale to use when generating the report -934 * @throws MavenReportException if a Maven report exception occurs -935 */ -936publicvoid generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, -937 Locale locale) throws MavenReportException { -938 generate((Sink) sink, null, locale); -939 } -940 -941/** -942 * Generates the Dependency-Check Site Report. -943 * -944 * @param sink the sink to write the report to -945 * @param sinkFactory the sink factory -946 * @param locale the locale to use when generating the report -947 * @throws MavenReportException if a maven report exception occurs -948 */ -949publicvoid generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException { -950 Engine engine = null; -951try { -952 engine = executeDependencyCheck(); -953if (this.externalReport) { -954 generateExternalReports(engine, reportOutputDirectory); -955 } else { -956 generateMavenSiteReport(engine, sink); -957 } -958 } catch (DatabaseException ex) { -959 logger.log(Level.SEVERE, -960"Unable to connect to the dependency-check database; analysis has stopped"); -961 logger.log(Level.FINE, "", ex); -962 } finally { -963 Settings.cleanup(true); -964if (engine != null) { -965 engine.cleanup(); -966 } -967 } -968 } -969 -970// <editor-fold defaultstate="collapsed" desc="required setter/getter methods"> -971/** -972 * Returns the output name. -973 * -974 * @return the output name -975 */ -976public String getOutputName() { -977if ("HTML".equalsIgnoreCase(this.format) -978 || "ALL".equalsIgnoreCase(this.format)) { -979return"dependency-check-report"; -980 } elseif ("XML".equalsIgnoreCase(this.format)) { -981return"dependency-check-report.xml#"; -982 } elseif ("VULN".equalsIgnoreCase(this.format)) { -983return"dependency-check-vulnerability"; -984 } else { -985 logger.log(Level.WARNING, "Unknown report format used during site generation."); -986return"dependency-check-report"; -987 } -988 } -989 -990/** -991 * Returns the category name. -992 * -993 * @return the category name -994 */ -995public String getCategoryName() { -996return MavenReport.CATEGORY_PROJECT_REPORTS; -997 } -998 -999/** -1000 * Returns the report name. -1001 * -1002 * @param locale the location -1003 * @return the report name -1004 */ -1005public String getName(Locale locale) { -1006return name; -1007 } -1008 -1009/** -1010 * Sets the Reporting output directory. -1011 * -1012 * @param directory the output directory -1013 */ -1014publicvoid setReportOutputDirectory(File directory) { -1015 reportOutputDirectory = directory; -1016 } -1017 -1018/** -1019 * Returns the output directory. -1020 * -1021 * @return the output directory -1022 */ -1023public File getReportOutputDirectory() { -1024return reportOutputDirectory; -1025 } -1026 -1027/** -1028 * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page. -1029 * -1030 * @param locale The Locale to get the description for -1031 * @return the description -1032 */ -1033public String getDescription(Locale locale) { -1034return description; -1035 } -1036 -1037/** -1038 * Returns whether this is an external report. -1039 * -1040 * @return true or false; -1041 */ -1042publicboolean isExternalReport() { -1043return externalReport; -1044 } -1045 -1046/** -1047 * Returns whether or not the plugin can generate a report. -1048 * -1049 * @return true -1050 */ -1051publicboolean canGenerateReport() { -1052returntrue; -1053 } -1054// </editor-fold> -1055 -1056/** -1057 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the -1058 * configuration. -1059 * -1060 * @param dependencies the list of dependency objects -1061 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set -1062 */ -1063privatevoid checkForFailure(List<Dependency> dependencies) throws MojoFailureException { -1064final StringBuilder ids = new StringBuilder(); -1065for (Dependency d : dependencies) { -1066boolean addName = true; -1067for (Vulnerability v : d.getVulnerabilities()) { -1068if (v.getCvssScore() >= failBuildOnCVSS) { -1069if (addName) { -1070 addName = false; -1071 ids.append(NEW_LINE).append(d.getFileName()).append(": "); -1072 ids.append(v.getName()); -1073 } else { -1074 ids.append(", ").append(v.getName()); -1075 } -1076 } -1077 } -1078 } -1079if (ids.length() > 0) { -1080final String msg = String.format("%n%nDependency-Check Failure:%n" -1081 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" -1082 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); -1083thrownew MojoFailureException(msg); -1084 } -1085 } -1086 -1087/** -1088 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. -1089 * -1090 * @param dependencies a list of dependency objects -1091 */ -1092privatevoid showSummary(List<Dependency> dependencies) { -1093final StringBuilder summary = new StringBuilder(); -1094for (Dependency d : dependencies) { -1095boolean firstEntry = true; -1096final StringBuilder ids = new StringBuilder(); -1097for (Vulnerability v : d.getVulnerabilities()) { -1098if (firstEntry) { -1099 firstEntry = false; -1100 } else { -1101 ids.append(", "); -1102 } -1103 ids.append(v.getName()); -1104 } -1105if (ids.length() > 0) { -1106 summary.append(d.getFileName()).append(" ("); -1107 firstEntry = true; -1108for (Identifier id : d.getIdentifiers()) { -1109if (firstEntry) { -1110 firstEntry = false; -1111 } else { -1112 summary.append(", "); -1113 } -1114 summary.append(id.getValue()); -1115 } -1116 summary.append(") : ").append(ids).append(NEW_LINE); -1117 } -1118 } -1119if (summary.length() > 0) { -1120final String msg = String.format("%n%n" -1121 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" -1122 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); -1123 logger.log(Level.WARNING, msg); -1124 } -1125 } -1126 } +871return file; +872 } +873 +874/** +875 * Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and +876 * "aggregate" phase. +877 * +878 * @return a <code>Engine</code> object populated with dependencies if the serialized data file exists; otherwise +879 * <code>null</code> is returned +880 */ +881protected List<Dependency> readDataFile() { +882return readDataFile(getProject()); +883 } +884 +885/** +886 * Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and +887 * "aggregate" phase. +888 * +889 * @param project the Maven project to read the data file from +890 * @return a <code>Engine</code> object populated with dependencies if the serialized data file exists; otherwise +891 * <code>null</code> is returned +892 */ +893protected List<Dependency> readDataFile(MavenProject project) { +894final Object oPath = project.getContextValue(this.getDataFileContextKey()); +895if (oPath == null) { +896returnnull; +897 } +898 List<Dependency> ret = null; +899final String path = (String) oPath; +900 ObjectInputStream ois = null; +901try { +902 ois = new ObjectInputStream(new FileInputStream(path)); +903 ret = (List<Dependency>) ois.readObject(); +904 } catch (FileNotFoundException ex) { +905//TODO fix logging +906 LOGGER.log(Level.SEVERE, null, ex); +907 } catch (IOException ex) { +908 LOGGER.log(Level.SEVERE, null, ex); +909 } catch (ClassNotFoundException ex) { +910 LOGGER.log(Level.SEVERE, null, ex); +911 } finally { +912if (ois != null) { +913try { +914 ois.close(); +915 } catch (IOException ex) { +916 LOGGER.log(Level.SEVERE, null, ex); +917 } +918 } +919 } +920return ret; +921 } +922//</editor-fold> +923 }
    diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/ReportAggregationMojo.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/ReportAggregationMojo.html new file mode 100644 index 000000000..cf63e0e32 --- /dev/null +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/ReportAggregationMojo.html @@ -0,0 +1,475 @@ + + + +ReportAggregationMojo xref + + + +
    +1   /*
    +2    * This file is part of dependency-check-maven.
    +3    *
    +4    * Licensed under the Apache License, Version 2.0 (the "License");
    +5    * you may not use this file except in compliance with the License.
    +6    * You may obtain a copy of the License at
    +7    *
    +8    *     http://www.apache.org/licenses/LICENSE-2.0
    +9    *
    +10   * Unless required by applicable law or agreed to in writing, software
    +11   * distributed under the License is distributed on an "AS IS" BASIS,
    +12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    +13   * See the License for the specific language governing permissions and
    +14   * limitations under the License.
    +15   *
    +16   * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
    +17   */
    +18  package org.owasp.dependencycheck.maven;
    +19  
    +20  import java.io.File;
    +21  import java.util.ArrayList;
    +22  import java.util.Collections;
    +23  import java.util.HashMap;
    +24  import java.util.HashSet;
    +25  import java.util.List;
    +26  import java.util.Locale;
    +27  import java.util.Map;
    +28  import java.util.Set;
    +29  import java.util.logging.Logger;
    +30  import org.apache.maven.doxia.sink.Sink;
    +31  import org.apache.maven.plugin.AbstractMojo;
    +32  import org.apache.maven.plugin.MojoExecutionException;
    +33  import org.apache.maven.plugin.MojoFailureException;
    +34  import org.apache.maven.plugins.annotations.Component;
    +35  import org.apache.maven.plugins.annotations.Parameter;
    +36  import org.apache.maven.project.MavenProject;
    +37  import org.apache.maven.reporting.MavenReport;
    +38  import org.apache.maven.reporting.MavenReportException;
    +39  
    +40  /**
    +41   * <p>
    +42   * This is an abstract reporting mojo that enables report aggregation. Some of the code in the this class was copied
    +43   * from the CoberturaReportMojo (http://mojo.codehaus.org/cobertura-maven-plugin/, version 2.6). The authors of the
    +44   * CoberturaReportMojo were <a href="will.gwaltney@sas.com">Will Gwaltney</a> and
    +45   * <a href="mailto:joakim@erdfelt.com">Joakim Erdfelt</a>. There working example of how to do report aggregation was
    +46   * invaluable.</p>
    +47   * <p>
    +48   * An important point about using this abstract class is that it is intended for one to write some form of serialized
    +49   * data (via the {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#writeDataFile() }; note that the
    +50   * <code>writeDataFile()</code> function is called automatically after either {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#executeNonAggregateReport(org.apache.maven.doxia.sink.Sink,
    +51   * org.apache.maven.doxia.sink.SinkFactory, java.util.Locale)
    +52   * } or {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#executeAggregateReport(org.apache.maven.doxia.sink.Sink,
    +53   * org.apache.maven.doxia.sink.SinkFactory, java.util.Locale)
    +54   * } are called. When  <code>executeAggregateReport()</code> is implemented, one can call {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#getChildDataFiles()
    +55   * } to obtain a list of the data files to aggregate.</p>
    +56   *
    +57   *
    +58   * @author Jeremy Long <jeremy.long@owasp.org>
    +59   */
    +60  public abstract class ReportAggregationMojo extends AbstractMojo implements MavenReport {
    +61  
    +62      /**
    +63       * The Maven Project Object.
    +64       */
    +65      @Component
    +66      private MavenProject project;
    +67  
    +68      /**
    +69       * Logger field reference.
    +70       */
    +71      private static final Logger LOGGER = Logger.getLogger(ReportAggregationMojo.class.getName());
    +72  
    +73      /**
    +74       * List of Maven project of the current build
    +75       */
    +76      @Parameter(readonly = true, required = true, property = "reactorProjects")
    +77      private List<MavenProject> reactorProjects;
    +78  
    +79      /**
    +80       * Generate aggregate reports in multi-module projects.
    +81       */
    +82      @Parameter(property = "aggregate", defaultValue = "false")
    +83      private boolean aggregate;
    +84  
    +85      /**
    +86       * Sets whether or not the external report format should be used.
    +87       */
    +88      @Parameter(property = "metaFileName", defaultValue = "dependency-check.ser", required = true)
    +89      private String dataFileName;
    +90      /**
    +91       * Specifies the destination directory for the generated Dependency-Check report. This generally maps to
    +92       * "target/site".
    +93       */
    +94      @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
    +95      private File reportOutputDirectory;
    +96  
    +97      /**
    +98       * Sets the Reporting output directory.
    +99       *
    +100      * @param directory the output directory
    +101      */
    +102     @Override
    +103     public void setReportOutputDirectory(File directory) {
    +104         reportOutputDirectory = directory;
    +105     }
    +106 
    +107     /**
    +108      * Returns the output directory.
    +109      *
    +110      * @return the output directory
    +111      */
    +112     @Override
    +113     public File getReportOutputDirectory() {
    +114         return reportOutputDirectory;
    +115     }
    +116 
    +117     /**
    +118      * Returns the output directory for the given project.
    +119      *
    +120      * @param project the Maven project to get the output directory for
    +121      * @return the output directory for the given project
    +122      */
    +123     public File getReportOutputDirectory(MavenProject project) {
    +124         final Object o = project.getContextValue(getOutputDirectoryContextKey());
    +125         if (o != null && o instanceof File) {
    +126             return (File) o;
    +127         }
    +128         return null;
    +129     }
    +130 
    +131     /**
    +132      * Returns whether this is an external report. This method always returns true.
    +133      *
    +134      * @return <code>true</code>
    +135      */
    +136     @Override
    +137     public final boolean isExternalReport() {
    +138         return true;
    +139     }
    +140 
    +141     /**
    +142      * The collection of child projects.
    +143      */
    +144     private final Map<MavenProject, Set<MavenProject>> projectChildren = new HashMap<MavenProject, Set<MavenProject>>();
    +145 
    +146     /**
    +147      * Called before execute; allows for any setup that is needed. If this is overridden you must call
    +148      * </code>super.preExecute()</code>.
    +149      *
    +150      * @throws MojoExecutionException thrown if there is an issue executing the mojo
    +151      * @throws MojoFailureException thrown if there is an issue executing the mojo
    +152      */
    +153     protected void preExecute() throws MojoExecutionException, MojoFailureException {
    +154         buildAggregateInfo();
    +155     }
    +156 
    +157     /**
    +158      * Called when the mojo is being executed.
    +159      *
    +160      * @throws MojoExecutionException thrown if there is an issue executing the mojo
    +161      * @throws MojoFailureException thrown if there is an issue executing the mojo
    +162      */
    +163     protected abstract void performExecute() throws MojoExecutionException, MojoFailureException;
    +164 
    +165     /**
    +166      * Runs after the mojo has executed. This implementation will call <code>writeDataFile()</code>. As such, it is
    +167      * important that if this method is overriden that <code>super.postExecute()</code> is called.
    +168      *
    +169      * @throws MojoExecutionException thrown if there is an issue executing the mojo
    +170      * @throws MojoFailureException thrown if there is an issue executing the mojo
    +171      */
    +172     protected void postExecute() throws MojoExecutionException, MojoFailureException {
    +173         final File written = writeDataFile();
    +174         if (written != null) {
    +175             project.setContextValue(getDataFileContextKey(), written.getAbsolutePath());
    +176         }
    +177     }
    +178 
    +179     /**
    +180      * Returns the key used to store the path to the data file that is saved by <code>writeDataFile()</code>. This key
    +181      * is used in the <code>MavenProject.(set|get)ContextValue</code>.
    +182      *
    +183      * @return the key used to store the path to the data file
    +184      */
    +185     protected String getDataFileContextKey() {
    +186         return "dependency-check-path-" + this.getDataFileName();
    +187     }
    +188 
    +189     /**
    +190      * Returns the key used to store the path to the output directory. When generating the report in the
    +191      * <code>executeAggregateReport()</code> the output directory should be obtained by using this key.
    +192      *
    +193      * @return the key used to store the path to the output directory
    +194      */
    +195     protected String getOutputDirectoryContextKey() {
    +196         return "dependency-output-dir-" + this.getDataFileName();
    +197     }
    +198 
    +199     /**
    +200      * Is called by Maven to execute the mojo.
    +201      *
    +202      * @throws MojoExecutionException thrown if there is an issue executing the mojo
    +203      * @throws MojoFailureException thrown if there is an issue executing the mojo
    +204      */
    +205     public final void execute() throws MojoExecutionException, MojoFailureException {
    +206         try {
    +207             preExecute();
    +208             performExecute();
    +209         } finally {
    +210             postExecute();
    +211         }
    +212     }
    +213 
    +214     /**
    +215      * Runs prior to the site report generation.
    +216      *
    +217      * @throws MavenReportException if a maven report exception occurs
    +218      */
    +219     protected void preGenerate() throws MavenReportException {
    +220         buildAggregateInfo();
    +221 
    +222         project.setContextValue(getOutputDirectoryContextKey(), getReportOutputDirectory());
    +223     }
    +224 
    +225     /**
    +226      * Executes after the site report has been generated.
    +227      *
    +228      * @throws MavenReportException if a maven report exception occurs
    +229      */
    +230     protected void postGenerate() throws MavenReportException {
    +231         final File written = writeDataFile();
    +232         if (written != null) {
    +233             project.setContextValue(getDataFileContextKey(), written.getAbsolutePath());
    +234         }
    +235     }
    +236 
    +237     /**
    +238      * Generates the non aggregate report.
    +239      *
    +240      * @param locale the locale to use when generating the report
    +241      * @throws MavenReportException if a maven report exception occurs
    +242      */
    +243     protected abstract void executeNonAggregateReport(Locale locale) throws MavenReportException;
    +244 
    +245     /**
    +246      * Generates the aggregate Site Report.
    +247      *
    +248      * @param project the maven project used to generate the aggregate report
    +249      * @param locale the locale to use when generating the report
    +250      * @throws MavenReportException if a maven report exception occurs
    +251      */
    +252     protected abstract void executeAggregateReport(MavenProject project, Locale locale) throws MavenReportException;
    +253 
    +254     /**
    +255      * Generates the Dependency-Check Site Report.
    +256      *
    +257      * @param sink the sink to write the report to
    +258      * @param locale the locale to use when generating the report
    +259      * @throws MavenReportException if a maven report exception occurs
    +260      * @deprecated use {@link #generate(org.apache.maven.doxia.sink.Sink, java.util.Locale) instead.
    +261      */
    +262     @Deprecated
    +263     public final void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, Locale locale) throws MavenReportException {
    +264         generate((Sink) sink, locale);
    +265     }
    +266 
    +267     /**
    +268      * Generates the Dependency-Check Site Report.
    +269      *
    +270      * @param sink the sink to write the report to
    +271      * @param locale the locale to use when generating the report
    +272      * @throws MavenReportException if a maven report exception occurs
    +273      */
    +274     public final void generate(Sink sink, Locale locale) throws MavenReportException {
    +275         try {
    +276             preGenerate();
    +277             if (canGenerateNonAggregateReport()) {
    +278                 executeNonAggregateReport(locale);
    +279             }
    +280 
    +281             if (canGenerateAggregateReport()) {
    +282                 for (MavenProject proj : reactorProjects) {
    +283                     if (!isMultiModule(proj)) {
    +284                         continue;
    +285                     }
    +286                     executeAggregateReport(proj, locale);
    +287                 }
    +288             }
    +289         } finally {
    +290             postGenerate();
    +291         }
    +292     }
    +293 
    +294     /**
    +295      * Returns whether or not the mojo can generate a non-aggregate report for this project.
    +296      *
    +297      * @return <code>true</code> if a non-aggregate report can be generated, otherwise <code>false</code>
    +298      */
    +299     protected abstract boolean canGenerateNonAggregateReport();
    +300 
    +301     /**
    +302      * Returns whether or not we can generate any aggregate reports at this time.
    +303      *
    +304      * @return <code>true</code> if an aggregate report can be generated, otherwise <code>false</code>
    +305      */
    +306     protected abstract boolean canGenerateAggregateReport();
    +307 
    +308     /**
    +309      * Returns the name of the data file that contains the serialized data.
    +310      *
    +311      * @return the name of the data file that contains the serialized data
    +312      */
    +313     protected String getDataFileName() {
    +314         return dataFileName;
    +315     }
    +316 
    +317     /**
    +318      * Writes the data file to disk in the target directory.
    +319      *
    +320      * @return the File object referencing the data file that was written
    +321      */
    +322     protected abstract File writeDataFile();
    +323 
    +324     /**
    +325      * Collects the information needed for building aggregate reports.
    +326      */
    +327     private void buildAggregateInfo() {
    +328         // build parent-child map
    +329         for (MavenProject proj : reactorProjects) {
    +330             Set<MavenProject> depList = projectChildren.get(proj.getParent());
    +331             if (depList == null) {
    +332                 depList = new HashSet<MavenProject>();
    +333                 projectChildren.put(proj.getParent(), depList);
    +334             }
    +335             depList.add(proj);
    +336         }
    +337     }
    +338 
    +339     /**
    +340      * Returns a list containing all the recursive, non-pom children of the given project, never <code>null</code>.
    +341      *
    +342      * @return a list of child projects
    +343      */
    +344     protected List<MavenProject> getAllChildren() {
    +345         return getAllChildren(project);
    +346     }
    +347 
    +348     /**
    +349      * Returns a list containing all the recursive, non-pom children of the given project, never <code>null</code>.
    +350      *
    +351      * @param parentProject the parent project to collect the child project references
    +352      * @return a list of child projects
    +353      */
    +354     protected List<MavenProject> getAllChildren(MavenProject parentProject) {
    +355         final Set<MavenProject> children = projectChildren.get(parentProject);
    +356         if (children == null) {
    +357             return Collections.emptyList();
    +358         }
    +359 
    +360         final List<MavenProject> result = new ArrayList<MavenProject>();
    +361         for (MavenProject child : children) {
    +362             if (isMultiModule(child)) {
    +363                 result.addAll(getAllChildren(child));
    +364             } else {
    +365                 result.add(child);
    +366             }
    +367         }
    +368         return result;
    +369     }
    +370 
    +371     /**
    +372      * Returns a list of data files that were produced by the direct children of the given MavenProject.
    +373      *
    +374      * @param project the Maven project to obtain the child data files from
    +375      * @return a list of the data files
    +376      */
    +377     protected List<File> getAllChildDataFiles(MavenProject project) {
    +378         final List<MavenProject> children = getAllChildren(project);
    +379         return getDataFiles(children);
    +380     }
    +381 
    +382     /**
    +383      * Returns any existing output files from the given list of projects.
    +384      *
    +385      * @param projects the list of projects to obtain the output files from
    +386      * @return a list of output files
    +387      */
    +388     protected List<File> getDataFiles(List<MavenProject> projects) {
    +389         final List<File> files = new ArrayList<File>();
    +390         for (MavenProject proj : projects) {
    +391             final Object path = project.getContextValue(getDataFileContextKey());
    +392             if (path == null) {
    +393                 final String msg = String.format("Unable to aggregate data for '%s' - aggregate data file was not generated",
    +394                         proj.getName());
    +395                 LOGGER.warning(msg);
    +396             } else {
    +397                 final File outputFile = new File((String) path);
    +398                 if (outputFile.exists()) {
    +399                     files.add(outputFile);
    +400                 } else {
    +401                     if (!isMultiModule(project)) {
    +402                         final String msg = String.format("Unable to aggregate data for '%s' - missing data file '%s'",
    +403                                 proj.getName(), outputFile.getPath());
    +404                         LOGGER.warning(msg);
    +405                     }
    +406                 }
    +407             }
    +408         }
    +409         return files;
    +410     }
    +411 
    +412     /**
    +413      * Test if the project has pom packaging
    +414      *
    +415      * @param mavenProject Project to test
    +416      * @return <code>true</code> if it has a pom packaging; otherwise <code>false</code>
    +417      */
    +418     protected boolean isMultiModule(MavenProject mavenProject) {
    +419         return "pom".equals(mavenProject.getPackaging());
    +420     }
    +421 
    +422     /**
    +423      * Test if the current project has pom packaging
    +424      *
    +425      * @return <code>true</code> if it has a pom packaging; otherwise <code>false</code>
    +426      */
    +427     protected boolean isMultiModule() {
    +428         return isMultiModule(project);
    +429     }
    +430 
    +431     /**
    +432      * Check whether the current project is the last project in a multi-module build. If the maven build is not a
    +433      * multi-module project then this will always return true.
    +434      *
    +435      * @return <code>true</code> if the current project is the last project in a multi-module build; otherwise
    +436      * <code>false</code>
    +437      */
    +438     protected boolean isLastProject() {
    +439         return project.equals(reactorProjects.get(reactorProjects.size() - 1));
    +440     }
    +441 
    +442     /**
    +443      * Returns whether or not the mojo is configured to perform report aggregation.
    +444      *
    +445      * @return <code>true</code> if report aggregation is enabled; otherwise <code>false</code>
    +446      */
    +447     public boolean isAggregate() {
    +448         return aggregate;
    +449     }
    +450 
    +451     /**
    +452      * Returns a reference to the current project. This method is used instead of auto-binding the project via component
    +453      * annotation in concrete implementations of this. If the child has a <code>@Component MavenProject project;</code>
    +454      * defined then the abstract class (i.e. this class) will not have access to the current project (just the way Maven
    +455      * works with the binding).
    +456      *
    +457      * @return returns a reference to the current project
    +458      */
    +459     protected MavenProject getProject() {
    +460         return project;
    +461     }
    +462 }
    +
    +
    + + + diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/ReportingUtil.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/ReportingUtil.html new file mode 100644 index 000000000..d32c3a405 --- /dev/null +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/ReportingUtil.html @@ -0,0 +1,469 @@ + + + +ReportingUtil xref + + + +
    +1   /*
    +2    * This file is part of dependency-check-maven.
    +3    *
    +4    * Licensed under the Apache License, Version 2.0 (the "License");
    +5    * you may not use this file except in compliance with the License.
    +6    * You may obtain a copy of the License at
    +7    *
    +8    *     http://www.apache.org/licenses/LICENSE-2.0
    +9    *
    +10   * Unless required by applicable law or agreed to in writing, software
    +11   * distributed under the License is distributed on an "AS IS" BASIS,
    +12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    +13   * See the License for the specific language governing permissions and
    +14   * limitations under the License.
    +15   *
    +16   * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
    +17   */
    +18  package org.owasp.dependencycheck.maven;
    +19  
    +20  import java.io.File;
    +21  import java.io.IOException;
    +22  import java.io.UnsupportedEncodingException;
    +23  import java.net.URLEncoder;
    +24  import java.text.DateFormat;
    +25  import java.util.Date;
    +26  import java.util.List;
    +27  import java.util.Set;
    +28  import java.util.logging.Level;
    +29  import java.util.logging.Logger;
    +30  import org.apache.maven.doxia.sink.Sink;
    +31  import org.owasp.dependencycheck.Engine;
    +32  import org.owasp.dependencycheck.data.nvdcve.CveDB;
    +33  import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    +34  import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
    +35  import org.owasp.dependencycheck.dependency.Dependency;
    +36  import org.owasp.dependencycheck.dependency.Evidence;
    +37  import org.owasp.dependencycheck.dependency.Identifier;
    +38  import org.owasp.dependencycheck.dependency.Reference;
    +39  import org.owasp.dependencycheck.dependency.Vulnerability;
    +40  import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    +41  import org.owasp.dependencycheck.reporting.ReportGenerator;
    +42  
    +43  /**
    +44   * A utility class that encapsulates the report generation for dependency-check-maven.
    +45   *
    +46   * @author Jeremy Long <jeremy.long@owasp.org>
    +47   */
    +48  final class ReportingUtil {
    +49  
    +50      /**
    +51       * Logger field reference.
    +52       */
    +53      private static final Logger LOGGER = Logger.getLogger(ReportingUtil.class.getName());
    +54  
    +55      /**
    +56       * Empty private constructor for this utility class.
    +57       */
    +58      private ReportingUtil() {
    +59      }
    +60  
    +61      /**
    +62       * Generates the reports for a given dependency-check engine.
    +63       *
    +64       * @param engine a dependency-check engine
    +65       * @param outDirectory the directory to write the reports to
    +66       * @param projectName the name of the project that a report is being generated for
    +67       * @param format the format of the report to generate
    +68       */
    +69      static void generateExternalReports(Engine engine, File outDirectory, String projectName, String format) {
    +70          DatabaseProperties prop = null;
    +71          CveDB cve = null;
    +72          try {
    +73              cve = new CveDB();
    +74              cve.open();
    +75              prop = cve.getDatabaseProperties();
    +76          } catch (DatabaseException ex) {
    +77              LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +78          } finally {
    +79              if (cve != null) {
    +80                  cve.close();
    +81              }
    +82          }
    +83          final ReportGenerator r = new ReportGenerator(projectName, engine.getDependencies(), engine.getAnalyzers(), prop);
    +84          try {
    +85              r.generateReports(outDirectory.getCanonicalPath(), format);
    +86          } catch (IOException ex) {
    +87              LOGGER.log(Level.SEVERE,
    +88                      "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    +89              LOGGER.log(Level.FINE, null, ex);
    +90          } catch (Throwable ex) {
    +91              LOGGER.log(Level.SEVERE,
    +92                      "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    +93              LOGGER.log(Level.FINE, null, ex);
    +94          }
    +95      }
    +96  
    +97      /**
    +98       * Generates a dependency-check report using the Maven Site format.
    +99       *
    +100      * @param engine the engine used to scan the dependencies
    +101      * @param sink the sink to write the data to
    +102      * @param projectName the name of the project
    +103      */
    +104     static void generateMavenSiteReport(final Engine engine, Sink sink, String projectName) {
    +105         final List<Dependency> dependencies = engine.getDependencies();
    +106 
    +107         writeSiteReportHeader(sink, projectName);
    +108         writeSiteReportTOC(sink, dependencies);
    +109 
    +110         int cnt = 0;
    +111         for (Dependency d : dependencies) {
    +112             writeSiteReportDependencyHeader(sink, d);
    +113             cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
    +114             cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
    +115             writeSiteReportDependencyIdentifiers(d, sink);
    +116             writeSiteReportDependencyVulnerabilities(d, sink, cnt);
    +117         }
    +118         sink.body_();
    +119     }
    +120 
    +121     // <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report">
    +122     /**
    +123      * Writes the vulnerabilities to the site report.
    +124      *
    +125      * @param d the dependency
    +126      * @param sink the sink to write the data to
    +127      * @param collapsibleHeaderCount the collapsible header count
    +128      */
    +129     private static void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
    +130         int cnt = collapsibleHeaderCount;
    +131         if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
    +132             for (Vulnerability v : d.getVulnerabilities()) {
    +133 
    +134                 sink.paragraph();
    +135                 sink.bold();
    +136                 try {
    +137                     sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
    +138                     sink.text(v.getName());
    +139                     sink.link_();
    +140                     sink.bold_();
    +141                 } catch (UnsupportedEncodingException ex) {
    +142                     sink.text(v.getName());
    +143                     sink.bold_();
    +144                     sink.lineBreak();
    +145                     sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
    +146                 }
    +147                 sink.paragraph_();
    +148                 sink.paragraph();
    +149                 sink.text("Severity: ");
    +150                 if (v.getCvssScore() < 4.0) {
    +151                     sink.text("Low");
    +152                 } else {
    +153                     if (v.getCvssScore() >= 7.0) {
    +154                         sink.text("High");
    +155                     } else {
    +156                         sink.text("Medium");
    +157                     }
    +158                 }
    +159                 sink.lineBreak();
    +160                 sink.text("CVSS Score: " + v.getCvssScore());
    +161                 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
    +162                     sink.lineBreak();
    +163                     sink.text("CWE: ");
    +164                     sink.text(v.getCwe());
    +165                 }
    +166                 sink.paragraph_();
    +167                 sink.paragraph();
    +168                 sink.text(v.getDescription());
    +169                 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
    +170                     sink.list();
    +171                     for (Reference ref : v.getReferences()) {
    +172                         sink.listItem();
    +173                         sink.text(ref.getSource());
    +174                         sink.text(" - ");
    +175                         sink.link(ref.getUrl());
    +176                         sink.text(ref.getName());
    +177                         sink.link_();
    +178                         sink.listItem_();
    +179                     }
    +180                     sink.list_();
    +181                 }
    +182                 sink.paragraph_();
    +183                 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
    +184                     sink.paragraph();
    +185 
    +186                     cnt += 1;
    +187                     sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
    +188                     sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
    +189                     sink.list();
    +190                     for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
    +191                         sink.listItem();
    +192                         try {
    +193                             sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
    +194                             sink.text(vs.getName());
    +195                             sink.link_();
    +196                             if (vs.hasPreviousVersion()) {
    +197                                 sink.text(" and all previous versions.");
    +198                             }
    +199                         } catch (UnsupportedEncodingException ex) {
    +200                             sink.text(vs.getName());
    +201                             if (vs.hasPreviousVersion()) {
    +202                                 sink.text(" and all previous versions.");
    +203                             }
    +204                             sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
    +205                         }
    +206 
    +207                         sink.listItem_();
    +208                     }
    +209                     sink.list_();
    +210                     sink.rawText("</div>");
    +211                     sink.paragraph_();
    +212                 }
    +213             }
    +214         }
    +215     }
    +216 
    +217     /**
    +218      * Writes the identifiers to the site report.
    +219      *
    +220      * @param d the dependency
    +221      * @param sink the sink to write the data to
    +222      */
    +223     private static void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
    +224         if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
    +225             sink.sectionTitle4();
    +226             sink.text("Identifiers");
    +227             sink.sectionTitle4_();
    +228             sink.list();
    +229             for (Identifier i : d.getIdentifiers()) {
    +230                 sink.listItem();
    +231                 sink.text(i.getType());
    +232                 sink.text(": ");
    +233                 if (i.getUrl() != null && i.getUrl().length() > 0) {
    +234                     sink.link(i.getUrl());
    +235                     sink.text(i.getValue());
    +236                     sink.link_();
    +237                 } else {
    +238                     sink.text(i.getValue());
    +239                 }
    +240                 if (i.getDescription() != null && i.getDescription().length() > 0) {
    +241                     sink.lineBreak();
    +242                     sink.text(i.getDescription());
    +243                 }
    +244                 sink.listItem_();
    +245             }
    +246             sink.list_();
    +247         }
    +248     }
    +249 
    +250     /**
    +251      * Writes the related dependencies to the site report.
    +252      *
    +253      * @param d the dependency
    +254      * @param sink the sink to write the data to
    +255      * @param collapsibleHeaderCount the collapsible header count
    +256      * @return the collapsible header count
    +257      */
    +258     private static int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
    +259         int cnt = collapsibleHeaderCount;
    +260         if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
    +261             cnt += 1;
    +262             sink.sectionTitle4();
    +263             sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
    +264             sink.sectionTitle4_();
    +265             sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
    +266             sink.list();
    +267             for (Dependency r : d.getRelatedDependencies()) {
    +268                 sink.listItem();
    +269                 sink.text(r.getFileName());
    +270                 sink.list();
    +271                 writeListItem(sink, "File Path: " + r.getFilePath());
    +272                 writeListItem(sink, "SHA1: " + r.getSha1sum());
    +273                 writeListItem(sink, "MD5: " + r.getMd5sum());
    +274                 sink.list_();
    +275                 sink.listItem_();
    +276             }
    +277             sink.list_();
    +278             sink.rawText("</div>");
    +279         }
    +280         return cnt;
    +281     }
    +282 
    +283     /**
    +284      * Writes the evidence used to the site report.
    +285      *
    +286      * @param d the dependency
    +287      * @param sink the sink to write the data to
    +288      * @param collapsibleHeaderCount the collapsible header count
    +289      * @return the collapsible header count
    +290      */
    +291     private static int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
    +292         int cnt = collapsibleHeaderCount;
    +293         final Set<Evidence> evidence = d.getEvidenceForDisplay();
    +294         if (evidence != null && evidence.size() > 0) {
    +295             cnt += 1;
    +296             sink.sectionTitle4();
    +297             sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
    +298             sink.sectionTitle4_();
    +299             sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
    +300             sink.table();
    +301             sink.tableRow();
    +302             writeTableHeaderCell(sink, "Source");
    +303             writeTableHeaderCell(sink, "Name");
    +304             writeTableHeaderCell(sink, "Value");
    +305             sink.tableRow_();
    +306             for (Evidence e : evidence) {
    +307                 sink.tableRow();
    +308                 writeTableCell(sink, e.getSource());
    +309                 writeTableCell(sink, e.getName());
    +310                 writeTableCell(sink, e.getValue());
    +311                 sink.tableRow_();
    +312             }
    +313             sink.table_();
    +314             sink.rawText("</div>");
    +315         }
    +316         return cnt;
    +317     }
    +318 
    +319     /**
    +320      * Writes the dependency header to the site report.
    +321      *
    +322      * @param d the dependency
    +323      * @param sink the sink to write the data to
    +324      */
    +325     private static void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
    +326         sink.sectionTitle2();
    +327         sink.anchor("sha1" + d.getSha1sum());
    +328         sink.text(d.getFileName());
    +329         sink.anchor_();
    +330         sink.sectionTitle2_();
    +331         if (d.getDescription() != null && d.getDescription().length() > 0) {
    +332             sink.paragraph();
    +333             sink.bold();
    +334             sink.text("Description: ");
    +335             sink.bold_();
    +336             sink.text(d.getDescription());
    +337             sink.paragraph_();
    +338         }
    +339         if (d.getLicense() != null && d.getLicense().length() > 0) {
    +340             sink.paragraph();
    +341             sink.bold();
    +342             sink.text("License: ");
    +343             sink.bold_();
    +344             if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
    +345                 sink.link(d.getLicense());
    +346                 sink.text(d.getLicense());
    +347                 sink.link_();
    +348             } else {
    +349                 sink.text(d.getLicense());
    +350             }
    +351             sink.paragraph_();
    +352         }
    +353     }
    +354 
    +355     /**
    +356      * Adds a list item to the site report.
    +357      *
    +358      * @param sink the sink to write the data to
    +359      * @param text the text to write
    +360      */
    +361     private static void writeListItem(Sink sink, String text) {
    +362         sink.listItem();
    +363         sink.text(text);
    +364         sink.listItem_();
    +365     }
    +366 
    +367     /**
    +368      * Adds a table cell to the site report.
    +369      *
    +370      * @param sink the sink to write the data to
    +371      * @param text the text to write
    +372      */
    +373     private static void writeTableCell(Sink sink, String text) {
    +374         sink.tableCell();
    +375         sink.text(text);
    +376         sink.tableCell_();
    +377     }
    +378 
    +379     /**
    +380      * Adds a table header cell to the site report.
    +381      *
    +382      * @param sink the sink to write the data to
    +383      * @param text the text to write
    +384      */
    +385     private static void writeTableHeaderCell(Sink sink, String text) {
    +386         sink.tableHeaderCell();
    +387         sink.text(text);
    +388         sink.tableHeaderCell_();
    +389     }
    +390 
    +391     /**
    +392      * Writes the TOC for the site report.
    +393      *
    +394      * @param sink the sink to write the data to
    +395      * @param dependencies the dependencies that are being reported on
    +396      */
    +397     private static void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
    +398         sink.list();
    +399         for (Dependency d : dependencies) {
    +400             sink.listItem();
    +401             sink.link("#sha1" + d.getSha1sum());
    +402             sink.text(d.getFileName());
    +403             sink.link_();
    +404             if (!d.getVulnerabilities().isEmpty()) {
    +405                 sink.rawText(" <font style=\"color:red\">•</font>");
    +406             }
    +407             if (!d.getRelatedDependencies().isEmpty()) {
    +408                 sink.list();
    +409                 for (Dependency r : d.getRelatedDependencies()) {
    +410                     writeListItem(sink, r.getFileName());
    +411                 }
    +412                 sink.list_();
    +413             }
    +414             sink.listItem_();
    +415         }
    +416         sink.list_();
    +417     }
    +418 
    +419     /**
    +420      * Writes the site report header.
    +421      *
    +422      * @param sink the sink to write the data to
    +423      * @param projectName the name of the project
    +424      */
    +425     private static void writeSiteReportHeader(Sink sink, String projectName) {
    +426         sink.head();
    +427         sink.title();
    +428         sink.text("Dependency-Check Report: " + projectName);
    +429         sink.title_();
    +430         sink.head_();
    +431         sink.body();
    +432         sink.rawText("<script type=\"text/javascript\">");
    +433         sink.rawText("function toggleElement(el, targetId) {");
    +434         sink.rawText("if (el.innerText == '[+]') {");
    +435         sink.rawText("    el.innerText = '[-]';");
    +436         sink.rawText("    document.getElementById(targetId).style.display='block';");
    +437         sink.rawText("} else {");
    +438         sink.rawText("    el.innerText = '[+]';");
    +439         sink.rawText("    document.getElementById(targetId).style.display='none';");
    +440         sink.rawText("}");
    +441 
    +442         sink.rawText("}");
    +443         sink.rawText("</script>");
    +444         sink.section1();
    +445         sink.sectionTitle1();
    +446         sink.text("Project: " + projectName);
    +447         sink.sectionTitle1_();
    +448         sink.date();
    +449         final Date now = new Date();
    +450         sink.text(DateFormat.getDateTimeInstance().format(now));
    +451         sink.date_();
    +452         sink.section1_();
    +453     }
    +454     // </editor-fold>
    +455 
    +456 }
    +
    +
    + + + diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html index 7635ffe55..1c24ca41a 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.2.4 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.2.5 Reference Package org.owasp.dependencycheck.maven @@ -20,6 +20,12 @@
  • HelpMojo +
  • +
  • + ReportAggregationMojo +
  • +
  • + ReportingUtil
  • diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html index e360e9e48..605bda809 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.2.4 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.2.5 Reference Package org.owasp.dependencycheck.maven @@ -44,6 +44,16 @@ + + + + + +
    HelpMojo
    + ReportAggregationMojo +
    + ReportingUtil +
    diff --git a/dependency-check-maven/xref/overview-frame.html b/dependency-check-maven/xref/overview-frame.html index 231df996b..1dcb2eb31 100644 --- a/dependency-check-maven/xref/overview-frame.html +++ b/dependency-check-maven/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.2.4 Reference + Dependency-Check Maven Plugin 1.2.5 Reference diff --git a/dependency-check-maven/xref/overview-summary.html b/dependency-check-maven/xref/overview-summary.html index f09fea6bd..cfa7a5fe6 100644 --- a/dependency-check-maven/xref/overview-summary.html +++ b/dependency-check-maven/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.2.4 Reference + Dependency-Check Maven Plugin 1.2.5 Reference @@ -24,7 +24,7 @@
    -

    Dependency-Check Maven Plugin 1.2.4 Reference

    +

    Dependency-Check Maven Plugin 1.2.5 Reference

    diff --git a/dependency-check-utils/apidocs/allclasses-frame.html b/dependency-check-utils/apidocs/allclasses-frame.html index a0e2746a9..39083e9a7 100644 --- a/dependency-check-utils/apidocs/allclasses-frame.html +++ b/dependency-check-utils/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Utils 1.2.4 API) - +All Classes (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/allclasses-noframe.html b/dependency-check-utils/apidocs/allclasses-noframe.html index c33ca3118..60073a27d 100644 --- a/dependency-check-utils/apidocs/allclasses-noframe.html +++ b/dependency-check-utils/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Utils 1.2.4 API) - +All Classes (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/constant-values.html b/dependency-check-utils/apidocs/constant-values.html index 680e23e81..e5c19ba51 100644 --- a/dependency-check-utils/apidocs/constant-values.html +++ b/dependency-check-utils/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Utils 1.2.4 API) - +Constant Field Values (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/deprecated-list.html b/dependency-check-utils/apidocs/deprecated-list.html index 0e314ac6c..6aff70bfb 100644 --- a/dependency-check-utils/apidocs/deprecated-list.html +++ b/dependency-check-utils/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Utils 1.2.4 API) - +Deprecated List (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/help-doc.html b/dependency-check-utils/apidocs/help-doc.html index e503ab1e3..186a30b48 100644 --- a/dependency-check-utils/apidocs/help-doc.html +++ b/dependency-check-utils/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Utils 1.2.4 API) - +API Help (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/index-all.html b/dependency-check-utils/apidocs/index-all.html index 227c057a5..80edd0f85 100644 --- a/dependency-check-utils/apidocs/index-all.html +++ b/dependency-check-utils/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Utils 1.2.4 API) - +Index (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/index.html b/dependency-check-utils/apidocs/index.html index 4017bf9ed..ace6d9f42 100644 --- a/dependency-check-utils/apidocs/index.html +++ b/dependency-check-utils/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Utils 1.2.4 API +Dependency-Check Utils 1.2.5 API diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html index a0f592410..77b24bf1a 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html @@ -2,16 +2,16 @@ - + -DownloadFailedException (Dependency-Check Utils 1.2.4 API) - +DownloadFailedException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Downloader.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Downloader.html index 3db16bdf3..ea886bb50 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Downloader.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Downloader.html @@ -2,16 +2,16 @@ - + -Downloader (Dependency-Check Utils 1.2.4 API) - +Downloader (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html index ebbbf5d6d..a232047af 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html @@ -2,16 +2,16 @@ - + -ExtractionException (Dependency-Check Utils 1.2.4 API) - +ExtractionException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/FileUtils.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/FileUtils.html index 5e1c0cbf8..d11d3413f 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/FileUtils.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/FileUtils.html @@ -2,16 +2,16 @@ - + -FileUtils (Dependency-Check Utils 1.2.4 API) - +FileUtils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html index 5af5a11f2..b26b33bb1 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html @@ -2,16 +2,16 @@ - + -InvalidSettingException (Dependency-Check Utils 1.2.4 API) - +InvalidSettingException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogFilter.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogFilter.html index cfd910d94..b32ad37b9 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogFilter.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogFilter.html @@ -2,16 +2,16 @@ - + -LogFilter (Dependency-Check Utils 1.2.4 API) - +LogFilter (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogUtils.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogUtils.html index 4ea23dd42..2e60050f6 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogUtils.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/LogUtils.html @@ -2,16 +2,16 @@ - + -LogUtils (Dependency-Check Utils 1.2.4 API) - +LogUtils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html index 6b82e83e0..3879b4425 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html @@ -2,16 +2,16 @@ - + -Settings.KEYS (Dependency-Check Utils 1.2.4 API) - +Settings.KEYS (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.html index 0df5d1684..8b32b5dac 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/Settings.html @@ -2,16 +2,16 @@ - + -Settings (Dependency-Check Utils 1.2.4 API) - +Settings (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFactory.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFactory.html index 953f174f4..9f4f0a371 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFactory.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFactory.html @@ -2,16 +2,16 @@ - + -URLConnectionFactory (Dependency-Check Utils 1.2.4 API) - +URLConnectionFactory (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFailureException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFailureException.html index c68baf589..634ce015c 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFailureException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/URLConnectionFailureException.html @@ -2,16 +2,16 @@ - + -URLConnectionFailureException (Dependency-Check Utils 1.2.4 API) - +URLConnectionFailureException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html index 63d053124..c471bf7a5 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Checksum (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.Checksum (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html index cd2d2b67e..7e9b89ed7 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DownloadFailedException (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.DownloadFailedException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html index c0fccfb8d..1cbb523f3 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Downloader (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.Downloader (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html index a430871d1..520efc27d 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.ExtractionException (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.ExtractionException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html index af6fb5414..328af7011 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.FileUtils (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.FileUtils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html index 2e5806596..432d03ced 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.InvalidSettingException (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.InvalidSettingException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html index abd28db0c..2d3e7fd81 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.LogFilter (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.LogFilter (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html index 2dedaff75..4751a0f5d 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.LogUtils (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.LogUtils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html index 2e160e9ae..a35abd1ac 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Settings.KEYS (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.Settings.KEYS (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html index ad19c8398..62773bea6 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Settings (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.Settings (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFactory.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFactory.html index 1060ce236..9c481bf72 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFactory.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFactory.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.URLConnectionFactory (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.URLConnectionFactory (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFailureException.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFailureException.html index 9869f49a1..91428510b 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFailureException.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/class-use/URLConnectionFailureException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.URLConnectionFailureException (Dependency-Check Utils 1.2.4 API) - +Uses of Class org.owasp.dependencycheck.utils.URLConnectionFailureException (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-frame.html index 1134ff3cd..a7f0d8630 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.utils (Dependency-Check Utils 1.2.4 API) - +org.owasp.dependencycheck.utils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-summary.html index e0a4b2fd8..184a927ef 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.utils (Dependency-Check Utils 1.2.4 API) - +org.owasp.dependencycheck.utils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-tree.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-tree.html index 4f9495ea0..e8d2797be 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-tree.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.utils Class Hierarchy (Dependency-Check Utils 1.2.4 API) - +org.owasp.dependencycheck.utils Class Hierarchy (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-use.html b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-use.html index 1a524f7d8..21a858d04 100644 --- a/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-use.html +++ b/dependency-check-utils/apidocs/org/owasp/dependencycheck/utils/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.utils (Dependency-Check Utils 1.2.4 API) - +Uses of Package org.owasp.dependencycheck.utils (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/overview-tree.html b/dependency-check-utils/apidocs/overview-tree.html index a802a4358..981ffc567 100644 --- a/dependency-check-utils/apidocs/overview-tree.html +++ b/dependency-check-utils/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Utils 1.2.4 API) - +Class Hierarchy (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/apidocs/serialized-form.html b/dependency-check-utils/apidocs/serialized-form.html index 9fc5c3e50..9423223a7 100644 --- a/dependency-check-utils/apidocs/serialized-form.html +++ b/dependency-check-utils/apidocs/serialized-form.html @@ -2,16 +2,16 @@ - + -Serialized Form (Dependency-Check Utils 1.2.4 API) - +Serialized Form (Dependency-Check Utils 1.2.5 API) + diff --git a/dependency-check-utils/checkstyle.html b/dependency-check-utils/checkstyle.html index 867973d14..9f8d641bd 100644 --- a/dependency-check-utils/checkstyle.html +++ b/dependency-check-utils/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Checkstyle Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html b/dependency-check-utils/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html index 827e5b970..8ceedd54f 100644 --- a/dependency-check-utils/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html +++ b/dependency-check-utils/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.utils
    - + diff --git a/dependency-check-utils/cobertura/frame-sourcefiles.html b/dependency-check-utils/cobertura/frame-sourcefiles.html index 2cc3913a8..eb71c9e4d 100644 --- a/dependency-check-utils/cobertura/frame-sourcefiles.html +++ b/dependency-check-utils/cobertura/frame-sourcefiles.html @@ -15,7 +15,7 @@ All Packages
    Checksum (86%)Checksum (84%)
    DownloadFailedException (N/A)
    - + diff --git a/dependency-check-utils/cobertura/frame-summary-org.owasp.dependencycheck.utils.html b/dependency-check-utils/cobertura/frame-summary-org.owasp.dependencycheck.utils.html index d56032f78..e7ef3b4a7 100644 --- a/dependency-check-utils/cobertura/frame-summary-org.owasp.dependencycheck.utils.html +++ b/dependency-check-utils/cobertura/frame-summary-org.owasp.dependencycheck.utils.html @@ -16,7 +16,7 @@
    Checksum (86%)Checksum (84%)
    DownloadFailedException (N/A)
    - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.utils13
    35%
    139/387
    22%
    34/150
    2.853
    org.owasp.dependencycheck.utils13
    37%
    147/397
    24%
    37/154
    2.882
    - + diff --git a/dependency-check-utils/cobertura/frame-summary.html b/dependency-check-utils/cobertura/frame-summary.html index fd04deb0e..203735164 100644 --- a/dependency-check-utils/cobertura/frame-summary.html +++ b/dependency-check-utils/cobertura/frame-summary.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages13
    35%
    139/387
    22%
    34/150
    2.853
    org.owasp.dependencycheck.utils13
    35%
    139/387
    22%
    34/150
    2.853
    All Packages13
    37%
    147/397
    24%
    37/154
    2.882
    org.owasp.dependencycheck.utils13
    37%
    147/397
    24%
    37/154
    2.882
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Checksum.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Checksum.html index a53e9875d..6cb29a24a 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Checksum.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Checksum.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    Checksum
    86%
    20/23
    62%
    5/8
    2
    Checksum
    84%
    28/33
    66%
    8/12
    2.4
     
    @@ -97,7 +97,7 @@
          * The logger.
     40  
          */
    -  41  5
         private static final Logger LOGGER = Logger.getLogger(Checksum.class.getName());
    +  41  1
         private static final Logger LOGGER = Logger.getLogger(Checksum.class.getName());
     42  
     
     43   @@ -136,138 +136,156 @@
         @SuppressWarnings("empty-statement")
     60  
         public static byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException {
    -  61  25
             MessageDigest digest = MessageDigest.getInstance(algorithm);
    -  62  20
             FileInputStream fis = null;
    +  61  5
             MessageDigest digest = MessageDigest.getInstance(algorithm);
    +  62  4
             FileInputStream fis = null;
     63  
             try {
    -  64  20
                 fis = new FileInputStream(file);
    -  65  15
                 FileChannel ch = fis.getChannel();
    -  66  15
                 MappedByteBuffer byteBuffer = ch.map(FileChannel.MapMode.READ_ONLY, 0, file.length());
    -  67  15
                 digest.update(byteBuffer);
    -  68   -
     //            BufferedInputStream bis = new BufferedInputStream(fis);
    +  64  4
                 fis = new FileInputStream(file);
    +  65  3
                 FileChannel ch = fis.getChannel();
    +  66  3
                 long remainingToRead = file.length();
    +  67  3
                 long start = 0;
    +  68  6
                 while (remainingToRead > 0) {
     69   -
     //            DigestInputStream dis = new DigestInputStream(bis, digest);
    -  70   -
     //            //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW
    -  71   -
     //            byte[] buffer = new byte[8192];
    -  72   -
     //            while (dis.read(buffer) != -1);
    +
                     long amountToRead;
    +  70  3
                     if (remainingToRead > Integer.MAX_VALUE) {
    +  71  0
                         remainingToRead -= Integer.MAX_VALUE;
    +  72  0
                         amountToRead = Integer.MAX_VALUE;
     73   -
             } finally {
    -  74  20
                 if (fis != null) {
    -  75   -
                     try {
    -  76  15
                         fis.close();
    -  77  0
                     } catch (IOException ex) {
    -  78  0
                         LOGGER.log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex);
    -  79  20
                     }
    -  80   -
                 }
    +
                     } else {
    +  74  3
                         amountToRead = remainingToRead;
    +  75  3
                         remainingToRead = 0;
    +  76   +
                     }
    +  77  3
                     MappedByteBuffer byteBuffer = ch.map(FileChannel.MapMode.READ_ONLY, start, amountToRead);
    +  78  3
                     digest.update(byteBuffer);
    +  79  3
                     start += amountToRead;
    +  80  3
                 }
     81   -
             }
    -  82  15
             return digest.digest();
    +
     
    +  82   +
     //            BufferedInputStream bis = new BufferedInputStream(fis);
     83   -
         }
    +
     //            DigestInputStream dis = new DigestInputStream(bis, digest);
     84   -
     
    +
     //            //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW
     85   -
         /**
    +
     //            byte[] buffer = new byte[8192];
     86   -
          * Calculates the MD5 checksum of a specified file.
    +
     //            while (dis.read(buffer) != -1);
     87   -
          *
    -  88   -
          * @param file the file to generate the MD5 checksum
    +
             } finally {
    +  88  4
                 if (fis != null) {
     89   -
          * @return the hex representation of the MD5 hash
    -  90   -
          * @throws IOException when the file passed in does not exist
    -  91   -
          * @throws NoSuchAlgorithmException when the MD5 algorithm is not available
    -  92   -
          */
    -  93   -
         public static String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException {
    -  94  5
             byte[] b = getChecksum("MD5", file);
    -  95  5
             return getHex(b);
    -  96   -
         }
    +
                     try {
    +  90  3
                         fis.close();
    +  91  0
                     } catch (IOException ex) {
    +  92  0
                         LOGGER.log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex);
    +  93  4
                     }
    +  94   +
                 }
    +  95   +
             }
    +  96  3
             return digest.digest();
     97   -
     
    +
         }
     98   -
         /**
    -  99   -
          * Calculates the SHA1 checksum of a specified file.
    -  100   -
          *
    -  101   -
          * @param file the file to generate the MD5 checksum
    -  102   -
          * @return the hex representation of the SHA1 hash
    -  103   -
          * @throws IOException when the file passed in does not exist
    -  104   -
          * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available
    -  105   -
          */
    -  106   -
         public static String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException {
    -  107  5
             byte[] b = getChecksum("SHA1", file);
    -  108  5
             return getHex(b);
    -  109   -
         }
    -  110   -
         /**
    -  111   -
          * Hex code characters used in getHex.
    -  112   -
          */
    -  113   -
         private static final String HEXES = "0123456789ABCDEF";
    -  114  
     
    -  115   +  99  
         /**
    -  116   -
          * <p>
    -  117   -
          * Converts a byte array into a hex string.</p>
    -  118   +  100   +
          * Calculates the MD5 checksum of a specified file.
    +  101  
          *
    -  119   -
          * <p>
    -  120   -
          * This method was copied from <a
    -  121   -
          * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p>
    -  122   -
          *
    -  123   -
          * @param raw a byte array
    -  124   -
          * @return the hex representation of the byte array
    -  125   +  102   +
          * @param file the file to generate the MD5 checksum
    +  103   +
          * @return the hex representation of the MD5 hash
    +  104   +
          * @throws IOException when the file passed in does not exist
    +  105   +
          * @throws NoSuchAlgorithmException when the MD5 algorithm is not available
    +  106  
          */
    -  126   -
         public static String getHex(byte[] raw) {
    -  127  15
             if (raw == null) {
    -  128  0
                 return null;
    -  129   -
             }
    -  130  15
             final StringBuilder hex = new StringBuilder(2 * raw.length);
    -  131  280
             for (final byte b : raw) {
    -  132  265
                 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt(b & 0x0F));
    -  133   -
             }
    -  134  15
             return hex.toString();
    -  135   +  107   +
         public static String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException {
    +  108  1
             byte[] b = getChecksum("MD5", file);
    +  109  1
             return getHex(b);
    +  110  
         }
    +  111   +
     
    +  112   +
         /**
    +  113   +
          * Calculates the SHA1 checksum of a specified file.
    +  114   +
          *
    +  115   +
          * @param file the file to generate the MD5 checksum
    +  116   +
          * @return the hex representation of the SHA1 hash
    +  117   +
          * @throws IOException when the file passed in does not exist
    +  118   +
          * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available
    +  119   +
          */
    +  120   +
         public static String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException {
    +  121  1
             byte[] b = getChecksum("SHA1", file);
    +  122  1
             return getHex(b);
    +  123   +
         }
    +  124   +
         /**
    +  125   +
          * Hex code characters used in getHex.
    +  126   +
          */
    +  127   +
         private static final String HEXES = "0123456789ABCDEF";
    +  128   +
     
    +  129   +
         /**
    +  130   +
          * <p>
    +  131   +
          * Converts a byte array into a hex string.</p>
    +  132   +
          *
    +  133   +
          * <p>
    +  134   +
          * This method was copied from <a
    +  135   +
          * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p>
     136   +
          *
    +  137   +
          * @param raw a byte array
    +  138   +
          * @return the hex representation of the byte array
    +  139   +
          */
    +  140   +
         public static String getHex(byte[] raw) {
    +  141  3
             if (raw == null) {
    +  142  0
                 return null;
    +  143   +
             }
    +  144  3
             final StringBuilder hex = new StringBuilder(2 * raw.length);
    +  145  56
             for (final byte b : raw) {
    +  146  53
                 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt(b & 0x0F));
    +  147   +
             }
    +  148  3
             return hex.toString();
    +  149   +
         }
    +  150  
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html index 1fb352a96..aa0d4937f 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Downloader.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Downloader.html index bd65a88cc..ed797b17f 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Downloader.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Downloader.html @@ -101,7 +101,7 @@
          * The logger.
     42  
          */
    -  43  5
         private static final Logger LOGGER = Logger.getLogger(Downloader.class.getName());
    +  43  1
         private static final Logger LOGGER = Logger.getLogger(Downloader.class.getName());
     44  
     
     45   @@ -281,21 +281,21 @@
          */
     161  
         public static long getLastModified(URL url) throws DownloadFailedException {
    -  162  5
             long timestamp = 0;
    +  162  1
             long timestamp = 0;
     163  
             //TODO add the FTP protocol?
    -  164  5
             if ("file".equalsIgnoreCase(url.getProtocol())) {
    +  164  1
             if ("file".equalsIgnoreCase(url.getProtocol())) {
     165  
                 File lastModifiedFile;
     166  
                 try {
    -  167  5
                     lastModifiedFile = new File(url.toURI());
    +  167  1
                     lastModifiedFile = new File(url.toURI());
     168  0
                 } catch (URISyntaxException ex) {
     169  0
                     final String msg = String.format("Unable to locate '%s'", url.toString());
     170  0
                     throw new DownloadFailedException(msg);
    -  171  5
                 }
    -  172  5
                 timestamp = lastModifiedFile.lastModified();
    -  173  5
             } else {
    +  171  1
                 }
    +  172  1
                 timestamp = lastModifiedFile.lastModified();
    +  173  1
             } else {
     174  0
                 HttpURLConnection conn = null;
     175  
                 try {
    @@ -330,13 +330,13 @@
                 }
     198  
             }
    -  199  5
             return timestamp;
    +  199  1
             return timestamp;
     200  
         }
     201  
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html index 86a9c37fc..02b187e55 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.FileUtils.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.FileUtils.html index adb0dcc0f..fe97cb5cb 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.FileUtils.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.FileUtils.html @@ -91,7 +91,7 @@
          * The logger.
     37  
          */
    -  38  5
         private static final Logger LOGGER = Logger.getLogger(FileUtils.class.getName());
    +  38  1
         private static final Logger LOGGER = Logger.getLogger(FileUtils.class.getName());
     39  
         /**
     40   @@ -138,13 +138,13 @@
          */
     61  
         public static String getFileExtension(String fileName) {
    -  62  10
             String ret = null;
    -  63  10
             final int pos = fileName.lastIndexOf(".");
    -  64  10
             if (pos >= 0) {
    -  65  10
                 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
    +  62  2
             String ret = null;
    +  63  2
             final int pos = fileName.lastIndexOf(".");
    +  64  2
             if (pos >= 0) {
    +  65  2
                 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
     66  
             }
    -  67  10
             return ret;
    +  67  2
             return ret;
     68  
         }
     69   @@ -163,15 +163,15 @@
          */
     76  
         public static boolean delete(File file) {
    -  77  15
             boolean success = true;
    -  78  15
             if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
    +  77  3
             boolean success = true;
    +  78  3
             if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
     79  0
                 success = false;
     80  0
                 final String msg = String.format("Failed to delete file: %s; attempting to delete on exit.", file.getPath());
     81  0
                 LOGGER.log(Level.FINE, msg);
     82  0
                 file.deleteOnExit();
     83  
             }
    -  84  15
             return success;
    +  84  3
             return success;
     85  
         }
     86   @@ -302,6 +302,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html index adda1e473..232da8968 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogFilter.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogFilter.html index 31abfcffb..7fca9f696 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogFilter.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogFilter.html @@ -101,6 +101,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogUtils.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogUtils.html index b287aa894..e69d3f6d2 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogUtils.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.LogUtils.html @@ -187,6 +187,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Settings.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Settings.html index bbe3986f4..802671ae9 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Settings.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.Settings.html @@ -494,7 +494,7 @@
          * The logger.
     238  
          */
    -  239  5
         private static final Logger LOGGER = Logger.getLogger(Settings.class.getName());
    +  239  1
         private static final Logger LOGGER = Logger.getLogger(Settings.class.getName());
     240  
         /**
     241   @@ -509,14 +509,14 @@
          * Thread local settings.
     246  
          */
    -  247  5
         private static ThreadLocal<Settings> localSettings = new ThreadLocal();
    +  247  1
         private static ThreadLocal<Settings> localSettings = new ThreadLocal();
     248  
         /**
     249  
          * The properties.
     250  
          */
    -  251  10
         private Properties props = null;
    +  251  2
         private Properties props = null;
     252  
     
     253   @@ -529,31 +529,31 @@
          * @param propertiesFilePath the path to the base properties file to load
     257  
          */
    -  258  10
         private Settings(String propertiesFilePath) {
    -  259  10
             InputStream in = null;
    -  260  10
             props = new Properties();
    +  258  2
         private Settings(String propertiesFilePath) {
    +  259  2
             InputStream in = null;
    +  260  2
             props = new Properties();
     261  
             try {
    -  262  10
                 in = this.getClass().getClassLoader().getResourceAsStream(propertiesFilePath);
    -  263  10
                 props.load(in);
    +  262  2
                 in = this.getClass().getClassLoader().getResourceAsStream(propertiesFilePath);
    +  263  2
                 props.load(in);
     264  0
             } catch (IOException ex) {
     265  0
                 LOGGER.log(Level.SEVERE, "Unable to load default settings.");
     266  0
                 LOGGER.log(Level.FINE, null, ex);
     267  
             } finally {
    -  268  10
                 if (in != null) {
    +  268  2
                 if (in != null) {
     269  
                     try {
    -  270  10
                         in.close();
    +  270  2
                         in.close();
     271  0
                     } catch (IOException ex) {
     272  0
                         LOGGER.log(Level.FINEST, null, ex);
    -  273  10
                     }
    +  273  2
                     }
     274  
                 }
     275  
             }
    -  276  10
             logProperties("Properties loaded", props);
    -  277  10
         }
    +  276  2
             logProperties("Properties loaded", props);
    +  277  2
         }
     278  
     
     279   @@ -566,8 +566,8 @@
          */
     283  
         public static void initialize() {
    -  284  10
             localSettings.set(new Settings(PROPERTIES_FILE));
    -  285  10
         }
    +  284  2
             localSettings.set(new Settings(PROPERTIES_FILE));
    +  285  2
         }
     286  
     
     287   @@ -614,17 +614,17 @@
          */
     310  
         public static void cleanup(boolean deleteTemporary) {
    -  311  10
             if (deleteTemporary && tempDirectory != null && tempDirectory.exists()) {
    -  312  10
                 FileUtils.delete(tempDirectory);
    +  311  2
             if (deleteTemporary && tempDirectory != null && tempDirectory.exists()) {
    +  312  2
                 FileUtils.delete(tempDirectory);
     313  
             }
     314  
             try {
    -  315  10
                 localSettings.remove();
    +  315  2
                 localSettings.remove();
     316  0
             } catch (Throwable ex) {
     317  0
                 LOGGER.log(Level.FINE, "Error cleaning up Settings", ex);
    -  318  10
             }
    -  319  10
         }
    +  318  2
             }
    +  319  2
         }
     320  
     
     321   @@ -674,7 +674,7 @@
          */
     345  
         private static void logProperties(String header, Properties properties) {
    -  346  15
             if (LOGGER.isLoggable(Level.FINE)) {
    +  346  3
             if (LOGGER.isLoggable(Level.FINE)) {
     347  0
                 final StringWriter sw = new StringWriter();
     348  0
                 PrintWriter pw = null;
     349   @@ -710,7 +710,7 @@
     
     372  
             }
    -  373  15
         }
    +  373  3
         }
     374  
     
     375   @@ -727,12 +727,12 @@
          */
     381  
         public static void setString(String key, String value) {
    -  382  25
             localSettings.get().props.setProperty(key, value);
    -  383  25
             if (LOGGER.isLoggable(Level.FINE)) {
    +  382  5
             localSettings.get().props.setProperty(key, value);
    +  383  5
             if (LOGGER.isLoggable(Level.FINE)) {
     384  0
                 LOGGER.fine(String.format("Setting: %s='%s'", key, value));
     385  
             }
    -  386  25
         }
    +  386  5
         }
     387  
     
     388   @@ -824,25 +824,25 @@
          */
     439  
         public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
    -  440  5
             FileInputStream fis = null;
    +  440  1
             FileInputStream fis = null;
     441  
             try {
    -  442  5
                 fis = new FileInputStream(filePath);
    -  443  5
                 mergeProperties(fis);
    +  442  1
                 fis = new FileInputStream(filePath);
    +  443  1
                 mergeProperties(fis);
     444  
             } finally {
    -  445  5
                 if (fis != null) {
    +  445  1
                 if (fis != null) {
     446  
                     try {
    -  447  5
                         fis.close();
    +  447  1
                         fis.close();
     448  0
                     } catch (IOException ex) {
     449  0
                         LOGGER.log(Level.FINEST, "close error", ex);
    -  450  5
                     }
    +  450  1
                     }
     451  
                 }
     452  
             }
    -  453  5
         }
    +  453  1
         }
     454  
     
     455   @@ -863,9 +863,9 @@
          */
     463  
         public static void mergeProperties(InputStream stream) throws IOException {
    -  464  5
             localSettings.get().props.load(stream);
    -  465  5
             logProperties("Properties updated via merge", localSettings.get().props);
    -  466  5
         }
    +  464  1
             localSettings.get().props.load(stream);
    +  465  1
             logProperties("Properties updated via merge", localSettings.get().props);
    +  466  1
         }
     467  
     
     468   @@ -922,19 +922,19 @@
          */
     496  
         protected static File getDataFile(String key) {
    -  497  15
             final String file = getString(key);
    -  498  15
             LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file));
    -  499  15
             if (file == null) {
    +  497  3
             final String file = getString(key);
    +  498  3
             LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file));
    +  499  3
             if (file == null) {
     500  0
                 return null;
     501  
             }
    -  502  15
             if (file.startsWith("[JAR]")) {
    -  503  15
                 LOGGER.log(Level.FINE, "Settings.getDataFile() - transforming filename");
    -  504  15
                 final File jarPath = getJarPath();
    -  505  15
                 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString()));
    -  506  15
                 final File retVal = new File(jarPath, file.substring(6));
    -  507  15
                 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString()));
    -  508  15
                 return retVal;
    +  502  3
             if (file.startsWith("[JAR]")) {
    +  503  3
                 LOGGER.log(Level.FINE, "Settings.getDataFile() - transforming filename");
    +  504  3
                 final File jarPath = getJarPath();
    +  505  3
                 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString()));
    +  506  3
                 final File retVal = new File(jarPath, file.substring(6));
    +  507  3
                 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString()));
    +  508  3
                 return retVal;
     509  
             }
     510  0
             return new File(file);
    @@ -954,22 +954,22 @@
          */
     518  
         private static File getJarPath() {
    -  519  15
             final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
    -  520  15
             String decodedPath = ".";
    +  519  3
             final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
    +  520  3
             String decodedPath = ".";
     521  
             try {
    -  522  15
                 decodedPath = URLDecoder.decode(jarPath, "UTF-8");
    +  522  3
                 decodedPath = URLDecoder.decode(jarPath, "UTF-8");
     523  0
             } catch (UnsupportedEncodingException ex) {
     524  0
                 LOGGER.log(Level.FINEST, null, ex);
    -  525  15
             }
    +  525  3
             }
     526  
     
    -  527  15
             final File path = new File(decodedPath);
    -  528  15
             if (path.getName().toLowerCase().endsWith(".jar")) {
    +  527  3
             final File path = new File(decodedPath);
    +  528  3
             if (path.getName().toLowerCase().endsWith(".jar")) {
     529  0
                 return path.getParentFile();
     530  
             } else {
    -  531  15
                 return new File(".");
    +  531  3
                 return new File(".");
     532  
             }
     533   @@ -996,8 +996,8 @@
          */
     544  
         public static String getString(String key, String defaultValue) {
    -  545  20
             final String str = System.getProperty(key, localSettings.get().props.getProperty(key, defaultValue));
    -  546  20
             return str;
    +  545  4
             final String str = System.getProperty(key, localSettings.get().props.getProperty(key, defaultValue));
    +  546  4
             return str;
     547  
         }
     548   @@ -1008,7 +1008,7 @@
          * A reference to the temporary directory; used incase it needs to be deleted during cleanup.
     551  
          */
    -  552  5
         private static File tempDirectory = null;
    +  552  1
         private static File tempDirectory = null;
     553  
     
     554   @@ -1025,19 +1025,19 @@
          */
     560  
         public static File getTempDirectory() throws IOException {
    -  561  10
             final File tmpDir = new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir")));
    -  562  10
             if (!tmpDir.exists()) {
    -  563  10
                 if (!tmpDir.mkdirs()) {
    +  561  2
             final File tmpDir = new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir")));
    +  562  2
             if (!tmpDir.exists()) {
    +  563  2
                 if (!tmpDir.mkdirs()) {
     564  0
                     final String msg = String.format("Unable to make a temporary folder '%s'", tmpDir.getPath());
     565  0
                     throw new IOException(msg);
     566  
                 } else {
    -  567  10
                     tempDirectory = tmpDir;
    +  567  2
                     tempDirectory = tmpDir;
     568  
                 }
     569  
             }
    -  570  10
             return tmpDir;
    +  570  2
             return tmpDir;
     571  
         }
     572   @@ -1060,7 +1060,7 @@
          */
     581  
         public static String getString(String key) {
    -  582  100
             return System.getProperty(key, localSettings.get().props.getProperty(key));
    +  582  20
             return System.getProperty(key, localSettings.get().props.getProperty(key));
     583  
         }
     584   @@ -1077,8 +1077,8 @@
          */
     590  
         public static void removeProperty(String key) {
    -  591  5
             localSettings.get().props.remove(key);
    -  592  5
         }
    +  591  1
             localSettings.get().props.remove(key);
    +  592  1
         }
     593  
     
     594   @@ -1105,11 +1105,11 @@
             int value;
     605  
             try {
    -  606  5
                 value = Integer.parseInt(Settings.getString(key));
    +  606  1
                 value = Integer.parseInt(Settings.getString(key));
     607  0
             } catch (NumberFormatException ex) {
     608  0
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    -  609  5
             }
    -  610  5
             return value;
    +  609  1
             }
    +  610  1
             return value;
     611  
         }
     612   @@ -1175,11 +1175,11 @@
             long value;
     646  
             try {
    -  647  5
                 value = Long.parseLong(Settings.getString(key));
    +  647  1
                 value = Long.parseLong(Settings.getString(key));
     648  0
             } catch (NumberFormatException ex) {
     649  0
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    -  650  5
             }
    -  651  5
             return value;
    +  650  1
             }
    +  651  1
             return value;
     652  
         }
     653   @@ -1208,11 +1208,11 @@
             boolean value;
     665  
             try {
    -  666  5
                 value = Boolean.parseBoolean(Settings.getString(key));
    +  666  1
                 value = Boolean.parseBoolean(Settings.getString(key));
     667  0
             } catch (NumberFormatException ex) {
     668  0
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    -  669  5
             }
    -  670  5
             return value;
    +  669  1
             }
    +  670  1
             return value;
     671  
         }
     672   @@ -1243,9 +1243,9 @@
             boolean value;
     685  
             try {
    -  686  5
                 final String strValue = Settings.getString(key);
    -  687  5
                 if (strValue == null) {
    -  688  5
                     return defaultValue;
    +  686  1
                 final String strValue = Settings.getString(key);
    +  687  1
                 if (strValue == null) {
    +  688  1
                     return defaultValue;
     689  
                 }
     690  0
                 value = Boolean.parseBoolean(strValue);
    @@ -1285,54 +1285,54 @@
         public static String getConnectionString(String connectionStringKey, String dbFileNameKey, String dbVersionKey)
     710  
                 throws IOException, InvalidSettingException {
    -  711  15
             final String connStr = Settings.getString(connectionStringKey);
    -  712  15
             if (connStr == null) {
    -  713  5
                 final String msg = String.format("Invalid properties file to get the connection string; '%s' must be defined.",
    +  711  3
             final String connStr = Settings.getString(connectionStringKey);
    +  712  3
             if (connStr == null) {
    +  713  1
                 final String msg = String.format("Invalid properties file to get the connection string; '%s' must be defined.",
     714  
                         connectionStringKey);
    -  715  5
                 throw new InvalidSettingException(msg);
    +  715  1
                 throw new InvalidSettingException(msg);
     716  
             }
    -  717  10
             if (connStr.contains("%s")) {
    -  718  10
                 final File directory = getDataDirectory();
    -  719  10
                 String fileName = null;
    -  720  10
                 if (dbFileNameKey != null) {
    -  721  10
                     fileName = Settings.getString(dbFileNameKey);
    +  717  2
             if (connStr.contains("%s")) {
    +  718  2
                 final File directory = getDataDirectory();
    +  719  2
                 String fileName = null;
    +  720  2
                 if (dbFileNameKey != null) {
    +  721  2
                     fileName = Settings.getString(dbFileNameKey);
     722  
                 }
    -  723  10
                 if (fileName == null) {
    +  723  2
                 if (fileName == null) {
     724  0
                     final String msg = String.format("Invalid properties file to get a file based connection string; '%s' must be defined.",
     725  
                             dbFileNameKey);
     726  0
                     throw new InvalidSettingException(msg);
     727  
                 }
    -  728  10
                 if (fileName.contains("%s")) {
    -  729  10
                     String version = null;
    -  730  10
                     if (dbVersionKey != null) {
    -  731  5
                         version = Settings.getString(dbVersionKey);
    +  728  2
                 if (fileName.contains("%s")) {
    +  729  2
                     String version = null;
    +  730  2
                     if (dbVersionKey != null) {
    +  731  1
                         version = Settings.getString(dbVersionKey);
     732  
                     }
    -  733  10
                     if (version == null) {
    -  734  5
                         final String msg = String.format("Invalid properties file to get a file based connection string; '%s' must be defined.",
    +  733  2
                     if (version == null) {
    +  734  1
                         final String msg = String.format("Invalid properties file to get a file based connection string; '%s' must be defined.",
     735  
                                 dbFileNameKey);
    -  736  5
                         throw new InvalidSettingException(msg);
    +  736  1
                         throw new InvalidSettingException(msg);
     737  
                     }
    -  738  5
                     fileName = String.format(fileName, version);
    +  738  1
                     fileName = String.format(fileName, version);
     739  
                 }
    -  740  5
                 if (connStr.startsWith("jdbc:h2:file:") && fileName.endsWith(".h2.db")) {
    -  741  5
                     fileName = fileName.substring(0, fileName.length() - 6);
    +  740  1
                 if (connStr.startsWith("jdbc:h2:file:") && fileName.endsWith(".h2.db")) {
    +  741  1
                     fileName = fileName.substring(0, fileName.length() - 6);
     742  
                 }
     743  
                 // yes, for H2 this path won't actually exists - but this is sufficient to get the value needed
    -  744  5
                 final File dbFile = new File(directory, fileName);
    -  745  5
                 final String cString = String.format(connStr, dbFile.getCanonicalPath());
    -  746  5
                 LOGGER.log(Level.FINE, String.format("Connection String: '%s'", cString));
    -  747  5
                 return cString;
    +  744  1
                 final File dbFile = new File(directory, fileName);
    +  745  1
                 final String cString = String.format(connStr, dbFile.getCanonicalPath());
    +  746  1
                 LOGGER.log(Level.FINE, String.format("Connection String: '%s'", cString));
    +  747  1
                 return cString;
     748  
             }
     749  0
             return connStr;
    @@ -1356,9 +1356,9 @@
          */
     759  
         public static File getDataDirectory() throws IOException {
    -  760  10
             final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
    -  761  10
             if (path.exists() || path.mkdirs()) {
    -  762  10
                 return path;
    +  760  2
             final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
    +  761  2
             if (path.exists() || path.mkdirs()) {
    +  762  2
                 return path;
     763  
             }
     764  0
             throw new IOException(String.format("Unable to create the data directory '%s'", path.getAbsolutePath()));
    @@ -1368,6 +1368,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html index 545230929..a11f4375a 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFactory.html @@ -219,6 +219,6 @@
     }
    - + diff --git a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html index e8409ae74..6b3ed6f25 100644 --- a/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html +++ b/dependency-check-utils/cobertura/org.owasp.dependencycheck.utils.URLConnectionFailureException.html @@ -155,6 +155,6 @@
     }
    - + diff --git a/dependency-check-utils/cpd.html b/dependency-check-utils/cpd.html index a476a0f22..955d3e2ec 100644 --- a/dependency-check-utils/cpd.html +++ b/dependency-check-utils/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - CPD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/dependency-updates-report.html b/dependency-check-utils/dependency-updates-report.html index 104f0aae3..6de80c299 100644 --- a/dependency-check-utils/dependency-updates-report.html +++ b/dependency-check-utils/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/findbugs.html b/dependency-check-utils/findbugs.html index 04da45bf1..68cafbc0a 100644 --- a/dependency-check-utils/findbugs.html +++ b/dependency-check-utils/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-ant - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/index.html b/dependency-check-utils/index.html index 61b043ea7..cca50a7c6 100644 --- a/dependency-check-utils/index.html +++ b/dependency-check-utils/index.html @@ -1,13 +1,13 @@ - + dependency-check-ant - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/license.html b/dependency-check-utils/license.html index 46230859b..799022483 100644 --- a/dependency-check-utils/license.html +++ b/dependency-check-utils/license.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/plugin-updates-report.html b/dependency-check-utils/plugin-updates-report.html index 0436cba88..e8eb91b13 100644 --- a/dependency-check-utils/plugin-updates-report.html +++ b/dependency-check-utils/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/pmd.html b/dependency-check-utils/pmd.html index 0b86b4752..cd5eb0d0c 100644 --- a/dependency-check-utils/pmd.html +++ b/dependency-check-utils/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/project-info.html b/dependency-check-utils/project-info.html index fd9856a48..83a8c8aca 100644 --- a/dependency-check-utils/project-info.html +++ b/dependency-check-utils/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/project-reports.html b/dependency-check-utils/project-reports.html index b037ef38a..caab7ca75 100644 --- a/dependency-check-utils/project-reports.html +++ b/dependency-check-utils/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/project-summary.html b/dependency-check-utils/project-summary.html index 7c6ec8c17..fffae35d2 100644 --- a/dependency-check-utils/project-summary.html +++ b/dependency-check-utils/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -203,7 +203,7 @@ dependency-check-utils Version -1.2.4 +1.2.5 Type jar diff --git a/dependency-check-utils/surefire-report.html b/dependency-check-utils/surefire-report.html index 83537866d..3abe4fac3 100644 --- a/dependency-check-utils/surefire-report.html +++ b/dependency-check-utils/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -259,7 +259,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.181
    +0.263

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -280,7 +280,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.181
    +0.263

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.utils

    @@ -302,7 +302,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.141 +0.263 DownloaderTest @@ -311,7 +311,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.001 +0 FileUtilsTest @@ -320,7 +320,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.035 +0 SettingsTest @@ -329,7 +329,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.004

    +0

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -339,19 +339,19 @@ function toggleDisplay(elementId) { testGetChecksum_NoSuchAlgorithm -0.131 +0.26 testGetChecksum -0.008 +0.002 testGetMD5Checksum -0.001 +0 testGetChecksum_FileNotFound -0.001 +0 testGetHex @@ -359,14 +359,14 @@ function toggleDisplay(elementId) { testGetSHA1Checksum -0
    +0.001

    DownloaderTest

    -
    testGetLastModified_file0.001
    +0

    FileUtilsTest

    @@ -377,7 +377,7 @@ function toggleDisplay(elementId) { -
    testDelete0.035
    +0

    SettingsTest

    @@ -404,11 +404,11 @@ function toggleDisplay(elementId) { - + - + @@ -424,7 +424,7 @@ function toggleDisplay(elementId) { - + diff --git a/dependency-check-utils/taglist.html b/dependency-check-utils/taglist.html index 7e7c95551..43b7d3686 100644 --- a/dependency-check-utils/taglist.html +++ b/dependency-check-utils/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/dependency-check-utils/xref-test/index.html b/dependency-check-utils/xref-test/index.html index d5db9f04b..11a59e267 100644 --- a/dependency-check-utils/xref-test/index.html +++ b/dependency-check-utils/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Utils 1.2.4 Reference + Dependency-Check Utils 1.2.5 Reference diff --git a/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-frame.html index 5361d7d5b..7dac3172e 100644 --- a/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Utils 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-summary.html index c151678b5..bda36d226 100644 --- a/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-utils/xref-test/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Utils 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-utils/xref-test/overview-frame.html b/dependency-check-utils/xref-test/overview-frame.html index 8d4a0ef58..879cf6ab8 100644 --- a/dependency-check-utils/xref-test/overview-frame.html +++ b/dependency-check-utils/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference + Dependency-Check Utils 1.2.5 Reference diff --git a/dependency-check-utils/xref-test/overview-summary.html b/dependency-check-utils/xref-test/overview-summary.html index 8d6d2de75..2cb4f6f35 100644 --- a/dependency-check-utils/xref-test/overview-summary.html +++ b/dependency-check-utils/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference + Dependency-Check Utils 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Utils 1.2.4 Reference

    +

    Dependency-Check Utils 1.2.5 Reference

    testGetTempDirectory0.001
    0
    testSetString0.001
    0
    testGetInt
    testGetConnectionString0.002
    0
    testGetString_String_String
    diff --git a/dependency-check-utils/xref/index.html b/dependency-check-utils/xref/index.html index d5db9f04b..11a59e267 100644 --- a/dependency-check-utils/xref/index.html +++ b/dependency-check-utils/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Utils 1.2.4 Reference + Dependency-Check Utils 1.2.5 Reference diff --git a/dependency-check-utils/xref/org/owasp/dependencycheck/utils/Checksum.html b/dependency-check-utils/xref/org/owasp/dependencycheck/utils/Checksum.html index 8b9008016..9eda654ea 100644 --- a/dependency-check-utils/xref/org/owasp/dependencycheck/utils/Checksum.html +++ b/dependency-check-utils/xref/org/owasp/dependencycheck/utils/Checksum.html @@ -71,77 +71,91 @@ 63try { 64 fis = new FileInputStream(file); 65 FileChannel ch = fis.getChannel(); -66 MappedByteBuffer byteBuffer = ch.map(FileChannel.MapMode.READ_ONLY, 0, file.length()); -67 digest.update(byteBuffer); -68// BufferedInputStream bis = new BufferedInputStream(fis); -69// DigestInputStream dis = new DigestInputStream(bis, digest); -70// //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW -71// byte[] buffer = new byte[8192]; -72// while (dis.read(buffer) != -1); -73 } finally { -74if (fis != null) { -75try { -76 fis.close(); -77 } catch (IOException ex) { -78 LOGGER.log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex); -79 } +66long remainingToRead = file.length(); +67long start = 0; +68while (remainingToRead > 0) { +69long amountToRead; +70if (remainingToRead > Integer.MAX_VALUE) { +71 remainingToRead -= Integer.MAX_VALUE; +72 amountToRead = Integer.MAX_VALUE; +73 } else { +74 amountToRead = remainingToRead; +75 remainingToRead = 0; +76 } +77 MappedByteBuffer byteBuffer = ch.map(FileChannel.MapMode.READ_ONLY, start, amountToRead); +78 digest.update(byteBuffer); +79 start += amountToRead; 80 } -81 } -82return digest.digest(); -83 } -84 -85/** -86 * Calculates the MD5 checksum of a specified file. -87 * -88 * @param file the file to generate the MD5 checksum -89 * @return the hex representation of the MD5 hash -90 * @throws IOException when the file passed in does not exist -91 * @throws NoSuchAlgorithmException when the MD5 algorithm is not available -92 */ -93publicstatic String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException { -94 byte[] b = getChecksum("MD5", file); -95return getHex(b); -96 } -97 -98/** -99 * Calculates the SHA1 checksum of a specified file. -100 * -101 * @param file the file to generate the MD5 checksum -102 * @return the hex representation of the SHA1 hash -103 * @throws IOException when the file passed in does not exist -104 * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available -105 */ -106publicstatic String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException { -107 byte[] b = getChecksum("SHA1", file); -108return getHex(b); -109 } -110/** -111 * Hex code characters used in getHex. -112 */ -113privatestaticfinal String HEXES = "0123456789ABCDEF"; -114 -115/** -116 * <p> -117 * Converts a byte array into a hex string.</p> -118 * -119 * <p> -120 * This method was copied from <a -121 * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p> -122 * -123 * @param raw a byte array -124 * @return the hex representation of the byte array -125 */ -126publicstatic String getHex(byte[] raw) { -127if (raw == null) { -128returnnull; -129 } -130final StringBuilder hex = new StringBuilder(2 * raw.length); -131for (final byte b : raw) { -132 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt(b & 0x0F)); -133 } -134return hex.toString(); -135 } -136 } +81 +82// BufferedInputStream bis = new BufferedInputStream(fis); +83// DigestInputStream dis = new DigestInputStream(bis, digest); +84// //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW +85// byte[] buffer = new byte[8192]; +86// while (dis.read(buffer) != -1); +87 } finally { +88if (fis != null) { +89try { +90 fis.close(); +91 } catch (IOException ex) { +92 LOGGER.log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex); +93 } +94 } +95 } +96return digest.digest(); +97 } +98 +99/** +100 * Calculates the MD5 checksum of a specified file. +101 * +102 * @param file the file to generate the MD5 checksum +103 * @return the hex representation of the MD5 hash +104 * @throws IOException when the file passed in does not exist +105 * @throws NoSuchAlgorithmException when the MD5 algorithm is not available +106 */ +107publicstatic String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException { +108 byte[] b = getChecksum("MD5", file); +109return getHex(b); +110 } +111 +112/** +113 * Calculates the SHA1 checksum of a specified file. +114 * +115 * @param file the file to generate the MD5 checksum +116 * @return the hex representation of the SHA1 hash +117 * @throws IOException when the file passed in does not exist +118 * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available +119 */ +120publicstatic String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException { +121 byte[] b = getChecksum("SHA1", file); +122return getHex(b); +123 } +124/** +125 * Hex code characters used in getHex. +126 */ +127privatestaticfinal String HEXES = "0123456789ABCDEF"; +128 +129/** +130 * <p> +131 * Converts a byte array into a hex string.</p> +132 * +133 * <p> +134 * This method was copied from <a +135 * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p> +136 * +137 * @param raw a byte array +138 * @return the hex representation of the byte array +139 */ +140publicstatic String getHex(byte[] raw) { +141if (raw == null) { +142returnnull; +143 } +144final StringBuilder hex = new StringBuilder(2 * raw.length); +145for (final byte b : raw) { +146 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt(b & 0x0F)); +147 } +148return hex.toString(); +149 } +150 }
    diff --git a/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-frame.html index 9c33803a8..5add21560 100644 --- a/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Utils 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-summary.html index 0b8b97477..35d5dd1b0 100644 --- a/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-utils/xref/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Utils 1.2.5 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-utils/xref/overview-frame.html b/dependency-check-utils/xref/overview-frame.html index 8d4a0ef58..879cf6ab8 100644 --- a/dependency-check-utils/xref/overview-frame.html +++ b/dependency-check-utils/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference + Dependency-Check Utils 1.2.5 Reference diff --git a/dependency-check-utils/xref/overview-summary.html b/dependency-check-utils/xref/overview-summary.html index 8d6d2de75..2cb4f6f35 100644 --- a/dependency-check-utils/xref/overview-summary.html +++ b/dependency-check-utils/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Utils 1.2.4 Reference + Dependency-Check Utils 1.2.5 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Utils 1.2.4 Reference

    +

    Dependency-Check Utils 1.2.5 Reference

    diff --git a/index.html b/index.html index 50aca2845..54afccc7c 100644 --- a/index.html +++ b/index.html @@ -1,13 +1,13 @@ - + dependency-check - About @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/internals.html b/internals.html index e676aa628..2cda21663 100644 --- a/internals.html +++ b/internals.html @@ -1,13 +1,13 @@ - + dependency-check - How does dependency-check work? @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/issue-tracking.html b/issue-tracking.html index 45078abff..805977357 100644 --- a/issue-tracking.html +++ b/issue-tracking.html @@ -1,13 +1,13 @@ - + dependency-check - Issue Tracking @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/jar-analyzer.html b/jar-analyzer.html index 77be6764d..e83d2ed33 100644 --- a/jar-analyzer.html +++ b/jar-analyzer.html @@ -1,13 +1,13 @@ - + dependency-check - Jar Analyzer @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/license.html b/license.html index f32462d20..028760503 100644 --- a/license.html +++ b/license.html @@ -1,13 +1,13 @@ - + dependency-check - Project License @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/mail-lists.html b/mail-lists.html index 9eadcc7c8..d2084aa5d 100644 --- a/mail-lists.html +++ b/mail-lists.html @@ -1,13 +1,13 @@ - + dependency-check - Project Mailing Lists @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/modules.html b/modules.html index a0884dc12..7ecc2e4be 100644 --- a/modules.html +++ b/modules.html @@ -1,13 +1,13 @@ - + dependency-check - Project Modules @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/nexus-analyzer.html b/nexus-analyzer.html index 71e2af270..e250d5d48 100644 --- a/nexus-analyzer.html +++ b/nexus-analyzer.html @@ -1,13 +1,13 @@ - + dependency-check - Nexus Analyzer @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/nuspec-analyzer.html b/nuspec-analyzer.html index 634f9ed78..40138b4d3 100644 --- a/nuspec-analyzer.html +++ b/nuspec-analyzer.html @@ -1,13 +1,13 @@ - + dependency-check - Nuspec Analyzer @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/project-info.html b/project-info.html index 43eccc2cb..1e2276eb0 100644 --- a/project-info.html +++ b/project-info.html @@ -1,13 +1,13 @@ - + dependency-check - Project Information @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/project-summary.html b/project-summary.html index e869da746..7e69eb3a9 100644 --- a/project-summary.html +++ b/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check - Project Summary @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -348,7 +348,7 @@ - +
    dependency-check-parent
    Version1.2.4
    1.2.5
    Type pom
    diff --git a/source-repository.html b/source-repository.html index 54ac3d9a1..51f7ffb7e 100644 --- a/source-repository.html +++ b/source-repository.html @@ -1,13 +1,13 @@ - + dependency-check - Source Repository @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/suppression.html b/suppression.html index 357177cc5..ed4f60074 100644 --- a/suppression.html +++ b/suppression.html @@ -1,13 +1,13 @@ - + dependency-check - Suppressing False Positives @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/team-list.html b/team-list.html index d82e2a1a1..2c23758b5 100644 --- a/team-list.html +++ b/team-list.html @@ -1,13 +1,13 @@ - + dependency-check - Team list @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • diff --git a/thereport.html b/thereport.html index 15f7efb2f..b010c1723 100644 --- a/thereport.html +++ b/thereport.html @@ -1,13 +1,13 @@ - + dependency-check - How To Read The Report @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-08-05
  • +
  • | Last Published: 2014-09-16
  • - Version: 1.2.4 + Version: 1.2.5
  • @@ -248,7 +248,7 @@

    How To Read The Report

    -

    There is a lot of information contained in the HTML version of the report. When analyzing the results, the first thing one should do is determine if the CPE looks appropriate. Due to the way dependency-check works (see above) the report may contain false positives; these false positives are primarily on the CPE values. If the CPE value is wrong, this is usually obvious and one should use the suppression feature in the report to generate a suppression XML file that can be used on future scans. In addition to just looking at the CPE values in comparison to the name of the dependency - one may also consider the confidence of the CPE (as discussed in How does dependency-check work). See the (Suppression False Positives)[./suppression.html] page for more information on how to generate and use the suppression file.

    +

    There is a lot of information contained in the HTML version of the report. When analyzing the results, the first thing one should do is determine if the CPE looks appropriate. Due to the way dependency-check works (see above) the report may contain false positives; these false positives are primarily on the CPE values. If the CPE value is wrong, this is usually obvious and one should use the suppression feature in the report to generate a suppression XML file that can be used on future scans. In addition to just looking at the CPE values in comparison to the name of the dependency - one may also consider the confidence of the CPE (as discussed in How does dependency-check work). See the Suppressing False Positives page for more information on how to generate and use the suppression file.

    Once you have weeded out any obvious false positives one can then look at the remaining entries and determine if any of the identified CVE entries are actually exploitable in your environment. Determining if a CVE is exploitable in your environment can be tricky - for this I do not currently have any tips other then upgrade the library if you can just to be safe. Note, some CVE entries can be fixed by either upgrading the library or changing configuration options.

    One item that dependency-check flags that many may think is a false positive are old database drivers. One thing to consider about an old database driver is that the CPE/CVEs identified are usually for the server rather then the driver. However, the presence of an old driver may indicate that you have an older version of the server running in your environment and that server may need to be patched or upgraded. However, in some cases the old database drivers are actually unused, transitive dependencies from other dependencies.

    Regarding False Negatives