added sorting for References via Comparable interface

Former-commit-id: d7522ea20250c771d80f164f631107095c8c12c9

src/main/java/org/owasp/dependencycheck/dependency/Reference.java

@@ -26,7 +26,7 @@ import java.io.Serializable;
  *
  * @author Jeremy Long (jeremy.long@gmail.com)
  */
-public class Reference implements Serializable {
+public class Reference implements Serializable, Comparable<Reference> {
 
     /**
      * the serial version uid.
@@ -129,4 +129,19 @@ public class Reference implements Serializable {
         return hash;
     }
 
+    public int compareTo(Reference o) {
+        if (source.equals(o.source)) {
+            if (name.equals(o.name)) {
+                if (url.equals(o.url)) {
+                    return 0; //they are equal
+                } else {
+                    return url.compareTo(o.url);
+                }
+            } else {
+                return name.compareTo(o.name);
+            }
+        } else {
+            return source.compareTo(o.source);
+        }
+    }
 }

src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java

@@ -82,7 +82,7 @@ public class Vulnerability implements Serializable, Comparable<Vulnerability> {
     /**
      * References for this vulnerability.
      */
-    private Set<Reference> references = new HashSet<Reference>();
+    private SortedSet<Reference> references = new TreeSet<Reference>();
 
     /**
      * Get the value of references.
@@ -98,7 +98,7 @@ public class Vulnerability implements Serializable, Comparable<Vulnerability> {
      *
      * @param references new value of references
      */
-    public void setReferences(Set<Reference> references) {
+    public void setReferences(SortedSet<Reference> references) {
         this.references = references;
     }