diff --git a/dependency-check-core/config/checkstyle-header.txt b/dependency-check-core/config/checkstyle-header.txt index 8c08a5267..6cda6c2c4 100644 --- a/dependency-check-core/config/checkstyle-header.txt +++ b/dependency-check-core/config/checkstyle-header.txt @@ -1,18 +1,17 @@ ^/\*\s*$ ^ \* This file is part of dependency-check-core\.\s*$ ^ \*\s*$ -^ \* Dependency-check-core is free software\: you can redistribute it and/or modify it\s*$ -^ \* under the terms of the GNU General Public License as published by the Free\s*$ -^ \* Software Foundation, either version 3 of the License, or \(at your option\) any\s*$ -^ \* later version\. +^ \* Licensed under the Apache License, Version 2\.0 \(the "License"\);\s*$ +^ \* you may not use this file except in compliance with the License.\s*$ +^ \* You may obtain a copy of the License at\s*$ ^ \*\s*$ -^ \* Dependency-check-core is distributed in the hope that it will be useful, but\s*$ -^ \* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or\s*$ -^ \* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more\s*$ -^ \* details\.\s*$ +^ \*\s*http://www.apache.org/licenses/LICENSE-2\.0\s*$ ^ \*\s*$ -^ \* You should have received a copy of the GNU General Public License along with\s*$ -^ \* dependency-check-core\. If not, see http://www.gnu.org/licenses/\.\s*$ +^ \* Unless required by applicable law or agreed to in writing, software\s*$ +^ \* distributed under the License is distributed on an "AS IS" BASIS,\s*$ +^ \* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied\.\s*$ +^ \* See the License for the specific language governing permissions and\s*$ +^ \* limitations under the License\.\s*$ ^ \*\s*$ ^ \* Copyright \(c\) 201[234] (Jeremy Long|Steve Springett)\. All Rights Reserved\.\s*$ ^ \*/\s*$ diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index 3b569f801..07cb7799a 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -1,20 +1,19 @@ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java index db8ff7089..2a65d3684 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.java index 222ccac88..839495283 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -29,9 +28,8 @@ import java.util.Set; public abstract class AbstractAnalyzer implements Analyzer { /** - * Utility method to help in the creation of the extensions set. This - * constructs a new Set that can be used in a final static - * declaration.

+ * Utility method to help in the creation of the extensions set. This constructs a new Set that can be used in a + * final static declaration.

* * This implementation was copied from * http://stackoverflow.com/questions/2041778/initialize-java-hashset-values-by-construction diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java index c13a096ab..bed8b7eb8 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -29,8 +28,7 @@ import org.owasp.dependencycheck.suppression.SuppressionRule; import org.owasp.dependencycheck.utils.Settings; /** - * Abstract base suppression analyzer that contains methods for parsing the - * suppression xml file. + * Abstract base suppression analyzer that contains methods for parsing the suppression xml file. * * @author Jeremy Long */ @@ -50,8 +48,7 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ @Override public boolean supportsExtension(String extension) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisException.java index 5f740366b..68950c296 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java index 950b32d40..5f8562dfc 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/Analyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/Analyzer.java index 3056b76ab..3d917fabe 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/Analyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/Analyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -23,40 +22,38 @@ import org.owasp.dependencycheck.Engine; import org.owasp.dependencycheck.dependency.Dependency; /** - * An interface that defines an Analyzer that is used to identify Dependencies. - * An analyzer will collect information about the dependency in the form of - * Evidence. + * An interface that defines an Analyzer that is used to identify Dependencies. An analyzer will collect information + * about the dependency in the form of Evidence. * * @author Jeremy Long */ public interface Analyzer { /** - * Analyzes the given dependency. The analysis could be anything from - * identifying an Identifier for the dependency, to finding vulnerabilities, - * etc. Additionally, if the analyzer collects enough information to add a - * description or license information for the dependency it should be added. + * Analyzes the given dependency. The analysis could be anything from identifying an Identifier for the dependency, + * to finding vulnerabilities, etc. Additionally, if the analyzer collects enough information to add a description + * or license information for the dependency it should be added. * * @param dependency a dependency to analyze. - * @param engine the engine that is scanning the dependencies - this is - * useful if we need to check other dependencies - * @throws AnalysisException is thrown if there is an error analyzing the - * dependency file + * @param engine the engine that is scanning the dependencies - this is useful if we need to check other + * dependencies + * @throws AnalysisException is thrown if there is an error analyzing the dependency file */ void analyze(Dependency dependency, Engine engine) throws AnalysisException; /** - *

Returns a list of supported file extensions. An example would be an - * analyzer that inspected java jar files. The getSupportedExtensions - * function would return a set with a single element "jar".

+ *

+ * Returns a list of supported file extensions. An example would be an analyzer that inspected java jar files. The + * getSupportedExtensions function would return a set with a single element "jar".

* - *

Note: when implementing this the extensions returned MUST be - * lowercase.

+ *

+ * Note: when implementing this the extensions returned MUST be lowercase.

* * @return The file extensions supported by this analyzer. * - *

If the analyzer returns null it will not cause additional files to be - * analyzed but will be executed against every file loaded

+ *

+ * If the analyzer returns null it will not cause additional files to be analyzed but will be executed against every + * file loaded

*/ Set getSupportedExtensions(); @@ -71,8 +68,7 @@ public interface Analyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ boolean supportsExtension(String extension); @@ -84,17 +80,14 @@ public interface Analyzer { AnalysisPhase getAnalysisPhase(); /** - * The initialize method is called (once) prior to the analyze method being - * called on all of the dependencies. + * The initialize method is called (once) prior to the analyze method being called on all of the dependencies. * - * @throws Exception is thrown if an exception occurs initializing the - * analyzer. + * @throws Exception is thrown if an exception occurs initializing the analyzer. */ void initialize() throws Exception; /** - * The close method is called after all of the dependencies have been - * analyzed. + * The close method is called after all of the dependencies have been analyzed. * * @throws Exception is thrown if an exception occurs closing the analyzer. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalyzerService.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalyzerService.java index fb4fcbec1..d08afc9c8 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalyzerService.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalyzerService.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java index 7c71c20e1..5485a181a 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -45,8 +44,9 @@ import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.utils.Settings; /** - *

An analyzer that extracts files from archives and ensures any supported - * files contained within the archive are added to the dependency list.

+ *

+ * An analyzer that extracts files from archives and ensures any supported files contained within the archive are added + * to the dependency list.

* * @author Jeremy Long */ @@ -57,8 +57,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { */ private static final int BUFFER_SIZE = 4096; /** - * The count of directories created during analysis. This is used for - * creating temporary directories. + * The count of directories created during analysis. This is used for creating temporary directories. */ private static int dirCount = 0; /** @@ -66,8 +65,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { */ private File tempFileLocation = null; /** - * The max scan depth that the analyzer will recursively extract nested - * archives. + * The max scan depth that the analyzer will recursively extract nested archives. */ private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3); /** @@ -110,8 +108,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return EXTENSIONS.contains(extension); @@ -130,8 +127,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { /** * The initialize method does nothing for this Analyzer. * - * @throws Exception is thrown if there is an exception deleting or creating - * temporary files + * @throws Exception is thrown if there is an exception deleting or creating temporary files */ @Override public void initialize() throws Exception { @@ -156,8 +152,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { /** * The close method does nothing for this Analyzer. * - * @throws Exception thrown if there is an exception deleting temporary - * files + * @throws Exception thrown if there is an exception deleting temporary files */ @Override public void close() throws Exception { @@ -167,9 +162,8 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Analyzes a given dependency. If the dependency is an archive, such as a - * WAR or EAR, the contents are extracted, scanned, and added to the list of - * dependencies within the engine. + * Analyzes a given dependency. If the dependency is an archive, such as a WAR or EAR, the contents are extracted, + * scanned, and added to the list of dependencies within the engine. * * @param dependency the dependency to analyze * @param engine the engine scanning @@ -204,7 +198,6 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { d.setFileName(displayName); //TODO - can we get more evidence from the parent? EAR contains module name, etc. - //analyze the dependency (i.e. extract files) if it is a supported type. if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) { scanDepth += 1; @@ -292,8 +285,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { * @param input the archive to extract files from * @param destination the location to write the files too * @param engine the dependency-check engine - * @throws ArchiveExtractionException thrown if there is an exception - * extracting files from the archive + * @throws ArchiveExtractionException thrown if there is an exception extracting files from the archive */ private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException { ArchiveEntry entry; @@ -365,8 +357,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { * * @param inputStream the compressed file * @param outputFile the location to write the decompressed file - * @throws ArchiveExtractionException thrown if there is an exception - * decompressing the file + * @throws ArchiveExtractionException thrown if there is an exception decompressing the file */ private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException { FileOutputStream out = null; diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.java index 0214e9541..ba647e404 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java index 8adbfbb64..29786a99b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -34,26 +33,25 @@ import org.apache.lucene.queryparser.classic.ParseException; import org.apache.lucene.search.ScoreDoc; import org.apache.lucene.search.TopDocs; import org.owasp.dependencycheck.Engine; -import org.owasp.dependencycheck.data.lucene.LuceneUtils; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Evidence; -import org.owasp.dependencycheck.dependency.Evidence.Confidence; -import org.owasp.dependencycheck.dependency.EvidenceCollection; import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; import org.owasp.dependencycheck.data.cpe.Fields; import org.owasp.dependencycheck.data.cpe.IndexEntry; import org.owasp.dependencycheck.data.cpe.IndexException; +import org.owasp.dependencycheck.data.lucene.LuceneUtils; import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; +import org.owasp.dependencycheck.dependency.Evidence.Confidence; +import org.owasp.dependencycheck.dependency.EvidenceCollection; import org.owasp.dependencycheck.dependency.Identifier; import org.owasp.dependencycheck.dependency.VulnerableSoftware; import org.owasp.dependencycheck.utils.DependencyVersion; import org.owasp.dependencycheck.utils.DependencyVersionUtil; /** - * CPEAnalyzer is a utility class that takes a project dependency and attempts - * to discern if there is an associated CPE. It uses the evidence contained - * within the dependency to search the Lucene index. + * CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE. + * It uses the evidence contained within the dependency to search the Lucene index. * * @author Jeremy Long */ @@ -68,18 +66,15 @@ public class CPEAnalyzer implements Analyzer { */ static final String WEIGHTING_BOOST = "^5"; /** - * A string representation of a regular expression defining characters - * utilized within the CPE Names. + * A string representation of a regular expression defining characters utilized within the CPE Names. */ static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]"; /** - * A string representation of a regular expression used to remove all but - * alpha characters. + * A string representation of a regular expression used to remove all but alpha characters. */ static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*"; /** - * The additional size to add to a new StringBuilder to account for extra - * data that will be written into the string. + * The additional size to add to a new StringBuilder to account for extra data that will be written into the string. */ static final int STRING_BUILDER_BUFFER = 20; /** @@ -94,10 +89,9 @@ public class CPEAnalyzer implements Analyzer { /** * Opens the data source. * - * @throws IOException when the Lucene directory to be queried does not - * exist or is corrupt. - * @throws DatabaseException when the database throws an exception. This - * usually occurs when the database is in use by another process. + * @throws IOException when the Lucene directory to be queried does not exist or is corrupt. + * @throws DatabaseException when the database throws an exception. This usually occurs when the database is in use + * by another process. */ public void open() throws IOException, DatabaseException { Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Opening the CVE Database"); @@ -127,9 +121,8 @@ public class CPEAnalyzer implements Analyzer { } /** - * Searches the data store of CPE entries, trying to identify the CPE for - * the given dependency based on the evidence contained within. The - * dependency passed in is updated with any identified CPE values. + * Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence + * contained within. The dependency passed in is updated with any identified CPE values. * * @param dependency the dependency to search for CPE entries on. * @throws CorruptIndexException is thrown when the Lucene index is corrupt. @@ -175,10 +168,9 @@ public class CPEAnalyzer implements Analyzer { } /** - * Returns the text created by concatenating the text and the values from - * the EvidenceCollection (filtered for a specific confidence). This - * attempts to prevent duplicate terms from being added.
Note, if - * the evidence is longer then 200 characters it will be truncated. + * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a + * specific confidence). This attempts to prevent duplicate terms from being added.
Note, if the evidence + * is longer then 200 characters it will be truncated. * * @param text the base text. * @param ec an EvidenceCollection @@ -208,8 +200,7 @@ public class CPEAnalyzer implements Analyzer { } /** - * Reduces the given confidence by one level. This returns LOW if the - * confidence passed in is not HIGH. + * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH. * * @param c the confidence to reduce. * @return One less then the confidence passed in. @@ -225,18 +216,18 @@ public class CPEAnalyzer implements Analyzer { } /** - *

Searches the Lucene CPE index to identify possible CPE entries - * associated with the supplied vendor, product, and version.

+ *

+ * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and + * version.

* - *

If either the vendorWeightings or productWeightings lists have been - * populated this data is used to add weighting factors to the search.

+ *

+ * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting + * factors to the search.

* * @param vendor the text used to search the vendor field * @param product the text used to search the product field - * @param vendorWeightings a list of strings to use to add weighting factors - * to the vendor field - * @param productWeightings Adds a list of strings that will be used to add - * weighting factors to the product search + * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field + * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search * @return a list of possible CPE values * @throws CorruptIndexException when the Lucene index is corrupt * @throws IOException when the Lucene index is not found @@ -276,19 +267,17 @@ public class CPEAnalyzer implements Analyzer { } /** - *

Builds a Lucene search string by properly escaping data and - * constructing a valid search query.

+ *

+ * Builds a Lucene search string by properly escaping data and constructing a valid search query.

* - *

If either the possibleVendor or possibleProducts lists have been - * populated this data is used to add weighting factors to the search string - * generated.

+ *

+ * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting + * factors to the search string generated.

* * @param vendor text to search the vendor field * @param product text to search the product field - * @param vendorWeighting a list of strings to apply to the vendor to boost - * the terms weight - * @param productWeightings a list of strings to apply to the product to - * boost the terms weight + * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight + * @param productWeightings a list of strings to apply to the product to boost the terms weight * @return the Lucene query */ protected String buildSearch(String vendor, String product, @@ -309,17 +298,14 @@ public class CPEAnalyzer implements Analyzer { } /** - * This method constructs a Lucene query for a given field. The searchText - * is split into separate words and if the word is within the list of - * weighted words then an additional weighting is applied to the term as it - * is appended into the query. + * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the + * word is within the list of weighted words then an additional weighting is applied to the term as it is appended + * into the query. * * @param sb a StringBuilder that the query text will be appended to. - * @param field the field within the Lucene index that the query is - * searching. + * @param field the field within the Lucene index that the query is searching. * @param searchText text used to construct the query. - * @param weightedText a list of terms that will be considered higher - * importance when searching. + * @param weightedText a list of terms that will be considered higher importance when searching. * @return if the append was successful. */ private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set weightedText) { @@ -358,8 +344,7 @@ public class CPEAnalyzer implements Analyzer { } /** - * Removes characters from the input text that are not used within the CPE - * index. + * Removes characters from the input text that are not used within the CPE index. * * @param text is the text to remove the characters from. * @return the text having removed some characters. @@ -369,8 +354,7 @@ public class CPEAnalyzer implements Analyzer { } /** - * Compares two strings after lower casing them and removing the non-alpha - * characters. + * Compares two strings after lower casing them and removing the non-alpha characters. * * @param l string one to compare. * @param r string two to compare. @@ -387,9 +371,8 @@ public class CPEAnalyzer implements Analyzer { } /** - * Ensures that the CPE Identified matches the dependency. This validates - * that the product, vendor, and version information for the CPE are - * contained within the dependencies evidence. + * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version + * information for the CPE are contained within the dependencies evidence. * * @param entry a CPE entry. * @param dependency the dependency that the CPE entries could be for. @@ -425,7 +408,6 @@ public class CPEAnalyzer implements Analyzer { // } // } // - //TODO - likely need to change the split... not sure if this will work for CPE with special chars if (text == null) { return false; @@ -435,9 +417,9 @@ public class CPEAnalyzer implements Analyzer { String tempWord = null; for (String word : words) { /* - single letter words should be concatenated with the next word. - so { "m", "core", "sample" } -> { "mcore", "sample" } - */ + single letter words should be concatenated with the next word. + so { "m", "core", "sample" } -> { "mcore", "sample" } + */ if (tempWord != null) { list.add(tempWord + word); tempWord = null; @@ -459,13 +441,11 @@ public class CPEAnalyzer implements Analyzer { } /** - * Analyzes a dependency and attempts to determine if there are any CPE - * identifiers for this dependency. + * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. * * @param dependency The Dependency to analyze. * @param engine The analysis engine - * @throws AnalysisException is thrown if there is an issue analyzing the - * dependency. + * @throws AnalysisException is thrown if there is an issue analyzing the dependency. */ @Override public void analyze(Dependency dependency, Engine engine) throws AnalysisException { @@ -532,11 +512,9 @@ public class CPEAnalyzer implements Analyzer { } /** - * Retrieves a list of CPE values from the CveDB based on the vendor and - * product passed in. The list is then validated to find only CPEs that are - * valid for the given dependency. It is possible that the CPE identified is - * a best effort "guess" based on the vendor, product, and version - * information. + * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then + * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a + * best effort "guess" based on the vendor, product, and version information. * * @param dependency the Dependency being analyzed * @param vendor the vendor for the CPE being analyzed @@ -622,8 +600,7 @@ public class CPEAnalyzer implements Analyzer { } /** - * A simple object to hold an identifier and carry information about the - * confidence in the identifier. + * A simple object to hold an identifier and carry information about the confidence in the identifier. */ private static class IdentifierMatch implements Comparable { @@ -633,10 +610,8 @@ public class CPEAnalyzer implements Analyzer { * @param type the type of identifier (such as CPE) * @param value the value of the identifier * @param url the URL of the identifier - * @param identifierConfidence the confidence in the identifier: best - * guess or exact match - * @param evidenceConfidence the confidence of the evidence used to find - * the identifier + * @param identifierConfidence the confidence in the identifier: best guess or exact match + * @param evidenceConfidence the confidence of the evidence used to find the identifier */ IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { this.identifier = new Identifier(type, value, url); @@ -767,8 +742,8 @@ public class CPEAnalyzer implements Analyzer { // /** - * Standard implementation of compareTo that compares identifier - * confidence, evidence confidence, and then the identifier. + * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the + * identifier. * * @param o the IdentifierMatch to compare to * @return the natural ordering of IdentifierMatch diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.java index daae5e4f3..10f6a838f 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -23,9 +22,8 @@ import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.suppression.SuppressionRule; /** - * The suppression analyzer processes an externally defined XML document that - * complies with the suppressions.xsd schema. Any identified CPE entries within - * the dependencies that match will be removed. + * The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema. + * Any identified CPE entries within the dependencies that match will be removed. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java index a2266f32a..1dc7e4244 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -34,13 +33,12 @@ import org.owasp.dependencycheck.utils.DependencyVersionUtil; import org.owasp.dependencycheck.utils.LogUtils; /** - *

This analyzer ensures dependencies that should be grouped together, to - * remove excess noise from the report, are grouped. An example would be Spring, - * Spring Beans, Spring MVC, etc. If they are all for the same version and have - * the same relative path then these should be grouped into a single dependency - * under the core/main library.

- *

Note, this grouping only works on dependencies with identified CVE - * entries

+ *

+ * This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are + * grouped. An example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the + * same relative path then these should be grouped into a single dependency under the core/main library.

+ *

+ * Note, this grouping only works on dependencies with identified CVE entries

* * @author Jeremy Long */ @@ -92,8 +90,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return true; @@ -110,14 +107,12 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal // /** - * Analyzes a set of dependencies. If they have been found to have the same - * base path and the same set of identifiers they are likely related. The - * related dependencies are bundled into a single reportable item. + * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of + * identifiers they are likely related. The related dependencies are bundled into a single reportable item. * * @param ignore this analyzer ignores the dependency being analyzed * @param engine the engine that is scanning the dependencies - * @throws AnalysisException is thrown if there is an error reading the JAR - * file. + * @throws AnalysisException is thrown if there is an error reading the JAR file. */ @Override public void analyze(Dependency ignore, Engine engine) throws AnalysisException { @@ -195,13 +190,11 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal } /** - * Returns true if the file names (and version if it exists) of the two - * dependencies are sufficiently similar. + * Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar. * * @param dependency1 a dependency2 to compare * @param dependency2 a dependency2 to compare - * @return true if the identifiers in the two supplied dependencies are - * equal + * @return true if the identifiers in the two supplied dependencies are equal */ private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) { if (dependency1 == null || dependency1.getFileName() == null @@ -248,13 +241,11 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal } /** - * Returns true if the identifiers in the two supplied dependencies are - * equal. + * Returns true if the identifiers in the two supplied dependencies are equal. * * @param dependency1 a dependency2 to compare * @param dependency2 a dependency2 to compare - * @return true if the identifiers in the two supplied dependencies are - * equal + * @return true if the identifiers in the two supplied dependencies are equal */ private boolean identifiersMatch(Dependency dependency1, Dependency dependency2) { if (dependency1 == null || dependency1.getIdentifiers() == null @@ -299,13 +290,12 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal } /** - * This is likely a very broken attempt at determining if the 'left' - * dependency is the 'core' library in comparison to the 'right' library. + * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison + * to the 'right' library. * * @param left the dependency to test * @param right the dependency to test against - * @return a boolean indicating whether or not the left dependency should be - * considered the "core" version. + * @return a boolean indicating whether or not the left dependency should be considered the "core" version. */ private boolean isCore(Dependency left, Dependency right) { final String leftName = left.getFileName().toLowerCase(); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java index 3cabbb940..65b6579f8 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -36,8 +35,7 @@ import org.owasp.dependencycheck.dependency.Identifier; import org.owasp.dependencycheck.dependency.VulnerableSoftware; /** - * This analyzer attempts to remove some well known false positives - - * specifically regarding the java runtime. + * This analyzer attempts to remove some well known false positives - specifically regarding the java runtime. * * @author Jeremy Long */ @@ -79,8 +77,7 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return true; @@ -97,13 +94,11 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { // /** - * Analyzes the dependencies and removes bad/incorrect CPE associations - * based on various heuristics. + * Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics. * * @param dependency the dependency to analyze. * @param engine the engine that is scanning the dependencies - * @throws AnalysisException is thrown if there is an error reading the JAR - * file. + * @throws AnalysisException is thrown if there is an error reading the JAR file. */ @Override public void analyze(Dependency dependency, Engine engine) throws AnalysisException { @@ -115,15 +110,17 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { } /** - *

Intended to remove spurious CPE entries. By spurious we mean - * duplicate, less specific CPE entries.

- *

Example:

+ *

+ * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.

+ *

+ * Example:

* * cpe:/a:some-vendor:some-product * cpe:/a:some-vendor:some-product:1.5 * cpe:/a:some-vendor:some-product:1.5.2 * - *

Should be trimmed to:

+ *

+ * Should be trimmed to:

* * cpe:/a:some-vendor:some-product:1.5.2 * @@ -178,8 +175,7 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { } } /** - * Regex to identify core java libraries and a few other commonly - * misidentified ones. + * Regex to identify core java libraries and a few other commonly misidentified ones. */ public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" @@ -190,8 +186,7 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); /** - * Removes any CPE entries for the JDK/JRE unless the filename ends with - * rt.jar + * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar * * @param dependency the dependency to remove JRE CPEs from */ @@ -251,9 +246,8 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { } /** - * Removes bad CPE matches for a dependency. Unfortunately, right now these - * are hard-coded patches for specific problems identified when testing this - * on a LARGE volume of jar files. + * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific + * problems identified when testing this on a LARGE volume of jar files. * * @param dependency the dependency to analyze */ @@ -266,10 +260,8 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { * found based on LOW confidence evidence should have a different CPE type? (this * might be a better solution then just removing the URL for "best-guess" matches). */ - //Set groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); //Set artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); - while (itr.hasNext()) { final Identifier i = itr.next(); //TODO move this startswith expression to a configuration file? @@ -294,8 +286,7 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { } /** - * Removes CPE matches for the wrong version of a dependency. Currently, - * this only covers Axis 1 & 2. + * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. * * @param dependency the dependency to analyze */ @@ -328,9 +319,8 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { } /** - * There are some known CPE entries, specifically regarding sun and oracle - * products due to the acquisition and changes in product names, that based - * on given evidence we can add the related CPE entries to ensure a complete + * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and + * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete * list of CVE entries. * * @param dependency the dependency being analyzed diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java index 65e1e3964..0a3fb8b53 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java @@ -1,28 +1,27 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; import java.io.File; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Evidence; import java.util.Set; import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; import org.owasp.dependencycheck.utils.DependencyVersion; import org.owasp.dependencycheck.utils.DependencyVersionUtil; @@ -70,8 +69,7 @@ public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return true; @@ -92,8 +90,7 @@ public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer { * * @param dependency the dependency to analyze. * @param engine the engine that is scanning the dependencies - * @throws AnalysisException is thrown if there is an error reading the JAR - * file. + * @throws AnalysisException is thrown if there is an error reading the JAR file. */ @Override public void analyze(Dependency dependency, Engine engine) throws AnalysisException { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java index 43da79701..ffd1ad098 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -67,8 +66,7 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return true; @@ -85,13 +83,12 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer { // /** - * The HintAnalyzer uses knowledge about a dependency to add additional - * information to help in identification of identifiers or vulnerabilities. + * The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + * identifiers or vulnerabilities. * * @param dependency The dependency being analyzed * @param engine The scanning engine - * @throws AnalysisException is thrown if there is an exception analyzing - * the dependency. + * @throws AnalysisException is thrown if there is an exception analyzing the dependency. */ @Override public void analyze(Dependency dependency, Engine engine) throws AnalysisException { @@ -110,7 +107,6 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer { "SpringSource", Evidence.Confidence.HIGH); - Set evidence = dependency.getProductEvidence().getEvidence(); if (evidence.contains(springTest1) || evidence.contains(springTest2)) { dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH); @@ -139,6 +135,5 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer { dependency.getVendorEvidence().addEvidence(e); } - } } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index dbaa04529..d33104af3 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -1,37 +1,28 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; import java.io.File; -import java.util.Enumeration; -import java.util.logging.Level; -import java.util.logging.Logger; -import javax.xml.bind.JAXBException; -import javax.xml.parsers.ParserConfigurationException; -import org.owasp.dependencycheck.Engine; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Evidence; -import org.owasp.dependencycheck.dependency.EvidenceCollection; import java.io.IOException; import java.io.InputStreamReader; import java.io.Reader; import java.util.ArrayList; +import java.util.Enumeration; import java.util.HashMap; import java.util.List; import java.util.Map; @@ -43,15 +34,23 @@ import java.util.jar.Attributes; import java.util.jar.JarEntry; import java.util.jar.JarFile; import java.util.jar.Manifest; +import java.util.logging.Level; +import java.util.logging.Logger; import java.util.regex.Pattern; import java.util.zip.ZipEntry; import javax.xml.bind.JAXBContext; import javax.xml.bind.JAXBElement; +import javax.xml.bind.JAXBException; import javax.xml.bind.Unmarshaller; +import javax.xml.parsers.ParserConfigurationException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import javax.xml.transform.sax.SAXSource; import org.jsoup.Jsoup; +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; +import org.owasp.dependencycheck.dependency.EvidenceCollection; import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter; import org.owasp.dependencycheck.jaxb.pom.generated.License; import org.owasp.dependencycheck.jaxb.pom.generated.Model; @@ -64,8 +63,7 @@ import org.xml.sax.XMLReader; /** * - * Used to load a JAR file and collect information that can be used to determine - * the associated CPE. + * Used to load a JAR file and collect information that can be used to determine the associated CPE. * * @author Jeremy Long */ @@ -77,8 +75,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { */ private static final String NEWLINE = System.getProperty("line.separator"); /** - * A list of values in the manifest to ignore as they only result in false - * positives. + * A list of values in the manifest to ignore as they only result in false positives. */ private static final Set IGNORE_VALUES = newHashSet( "Sun Java System Application Server"); @@ -183,8 +180,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return EXTENSIONS.contains(extension); @@ -201,13 +197,12 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { // /** - * Loads a specified JAR file and collects information from the manifest and - * checksums to identify the correct CPE information. + * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + * information. * * @param dependency the dependency to analyze. * @param engine the engine that is scanning the dependencies - * @throws AnalysisException is thrown if there is an error reading the JAR - * file. + * @throws AnalysisException is thrown if there is an error reading the JAR file. */ @Override public void analyze(Dependency dependency, Engine engine) throws AnalysisException { @@ -231,14 +226,12 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Attempts to find a pom.xml within the JAR file. If found it extracts - * information and adds it to the evidence. This will attempt to interpolate - * the strings contained within the pom.properties if one exists. + * Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence. + * This will attempt to interpolate the strings contained within the pom.properties if one exists. * * @param dependency the dependency being analyzed * @param classes a collection of class name information - * @throws AnalysisException is thrown if there is an exception parsing the - * pom + * @throws AnalysisException is thrown if there is an exception parsing the pom * @return whether or not evidence was added to the dependency */ protected boolean analyzePOM(Dependency dependency, ArrayList classes) throws AnalysisException { @@ -290,14 +283,12 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Given a path to a pom.xml within a JarFile, this method attempts to load - * a sibling pom.properties if one exists. + * Given a path to a pom.xml within a JarFile, this method attempts to load a sibling pom.properties if one exists. * * @param path the path to the pom.xml within the JarFile * @param jar the JarFile to load the pom.properties from * @return a Properties object or null if no pom.properties was found - * @throws IOException thrown if there is an exception reading the - * pom.properties + * @throws IOException thrown if there is an exception reading the pom.properties */ @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM", justification = "The reader is closed by closing the zipEntry") @@ -314,8 +305,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Searches a JarFile for pom.xml entries and returns a listing of these - * entries. + * Searches a JarFile for pom.xml entries and returns a listing of these entries. * * @param jar the JarFile to search * @return a list of pom.xml entries @@ -340,8 +330,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { * @param path the path to the pom.xml file within the jar file * @param jar the jar file to extract the pom from * @return returns a - * @throws AnalysisException is thrown if there is an exception extracting - * or parsing the POM + * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object */ private Model retrievePom(String path, JarFile jar) throws AnalysisException { @@ -401,10 +390,9 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { * @param dependency the dependency to set data on * @param pom the information from the pom * @param pomProperties the pom properties file (null if none exists) - * @param classes a collection of ClassNameInformation - containing data - * about the fully qualified class names within the JAR file being analyzed - * @return true if there was evidence within the pom that we could use; - * otherwise false + * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names + * within the JAR file being analyzed + * @return true if there was evidence within the pom that we could use; otherwise false */ private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList classes) { boolean foundSomething = false; @@ -505,15 +493,12 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Analyzes the path information of the classes contained within the - * JarAnalyzer to try and determine possible vendor or product names. If any - * are found they are stored in the packageVendor and packageProduct - * hashSets. + * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible + * vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets. * * @param classNames a list of class names * @param dependency a dependency to analyze - * @param addPackagesAsEvidence a flag indicating whether or not package - * names should be added as evidence. + * @param addPackagesAsEvidence a flag indicating whether or not package names should be added as evidence. */ protected void analyzePackageNames(ArrayList classNames, Dependency dependency, boolean addPackagesAsEvidence) { @@ -547,12 +532,12 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - *

Reads the manifest from the JAR file and collects the entries. Some - * vendorKey entries are:

  • Implementation Title
    • + *

    + * Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:

    + *
    • Implementation Title
      • *
    • Implementation Version
    • Implementation Vendor
      • - *
    • Implementation VendorId
    • Bundle Name
    • Bundle - * Version
    • Bundle Vendor
    • Bundle Description
    • Main - * Class
    + *
  • Implementation VendorId
  • Bundle Name
  • Bundle Version
  • Bundle Vendor
  • Bundle + * Description
  • Main Class
* However, all but a handful of specific entries are read in. * * @param dependency A reference to the dependency @@ -575,7 +560,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) { Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, String.format("Jar file '%s' does not contain a manifest.", - dependency.getFileName())); + dependency.getFileName())); } return false; } @@ -779,29 +764,30 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - *

A utility function that will interpolate strings based on values given - * in the properties file. It will also interpolate the strings contained - * within the properties file so that properties can reference other + *

+ * A utility function that will interpolate strings based on values given in the properties file. It will also + * interpolate the strings contained within the properties file so that properties can reference other * properties.

- *

Note: if there is no property found the reference will be - * removed. In other words, if the interpolated string will be replaced with - * an empty string. + *

+ * Note: if there is no property found the reference will be removed. In other words, if the interpolated + * string will be replaced with an empty string. *

- *

Example:

+ *

+ * Example:

* * Properties p = new Properties(); * p.setProperty("key", "value"); * String s = interpolateString("'${key}' and '${nothing}'", p); * System.out.println(s); * - *

Will result in:

+ *

+ * Will result in:

* * 'value' and '' * * * @param text the string that contains references to properties. - * @param properties a collection of properties that may be referenced - * within the text. + * @param properties a collection of properties that may be referenced within the text. * @return the interpolated text. */ protected String interpolateString(String text, Properties properties) { @@ -835,13 +821,11 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Determines if the key value pair from the manifest is for an "import" - * type entry for package names. + * Determines if the key value pair from the manifest is for an "import" type entry for package names. * * @param key the key from the manifest * @param value the value from the manifest - * @return true or false depending on if it is believed the entry is an - * "import" entry + * @return true or false depending on if it is believed the entry is an "import" entry */ private boolean isImportPackage(String key, String value) { final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$"); @@ -852,9 +836,8 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Cycles through an enumeration of JarEntries, contained within the - * dependency, and returns a list of the class names. This does not include - * core Java package names (i.e. java.* or javax.*). + * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class + * names. This does not include core Java package names (i.e. java.* or javax.*). * * @param dependency the dependency being analyzed * @return an list of fully qualified class names @@ -891,16 +874,12 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Cycles through the list of class names and places the package levels 0-3 - * into the provided maps for vendor and product. This is helpful when - * analyzing vendor/product as many times this is included in the package - * name. + * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and + * product. This is helpful when analyzing vendor/product as many times this is included in the package name. * * @param classNames a list of class names - * @param vendor HashMap of possible vendor names from package names (e.g. - * owasp) - * @param product HashMap of possible product names from package names (e.g. - * dependencycheck) + * @param vendor HashMap of possible vendor names from package names (e.g. owasp) + * @param product HashMap of possible product names from package names (e.g. dependencycheck) */ private void analyzeFullyQualifiedClassNames(ArrayList classNames, HashMap vendor, HashMap product) { @@ -927,9 +906,8 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Adds an entry to the specified collection and sets the Integer (e.g. the - * count) to 1. If the entry already exists in the collection then the - * Integer is incremented by 1. + * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists + * in the collection then the Integer is incremented by 1. * * @param collection a collection of strings and their occurrence count * @param key the key to add to the collection @@ -943,10 +921,9 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Cycles through the collection of class name information to see if parts - * of the package names are contained in the provided value. If found, it - * will be added as the HIGHEST confidence evidence because we have more - * then one source corroborating the value. + * Cycles through the collection of class name information to see if parts of the package names are contained in the + * provided value. If found, it will be added as the HIGHEST confidence evidence because we have more then one + * source corroborating the value. * * @param classes a collection of class name information * @param value the value to check to see if it contains a package name @@ -967,22 +944,20 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - *

This is currently a failed implementation. Part of the issue is - * I was trying to solve the wrong problem. Instead of multiple POMs being - * in the JAR to just add information about dependencies - I didn't realize - * until later that I was looking at an uber-jar (aka fat-jar) that included - * all of its dependencies.

- *

I'm leaving this method in the source tree, entirely commented out - * until a solution https://github.com/jeremylong/DependencyCheck/issues/11 - * has been implemented.

- *

Takes a list of pom entries from a JAR file and attempts to filter it - * down to the pom related to the jar (rather then the pom entry for a - * dependency).

+ *

+ * This is currently a failed implementation. Part of the issue is I was trying to solve the wrong problem. + * Instead of multiple POMs being in the JAR to just add information about dependencies - I didn't realize until + * later that I was looking at an uber-jar (aka fat-jar) that included all of its dependencies.

+ *

+ * I'm leaving this method in the source tree, entirely commented out until a solution + * https://github.com/jeremylong/DependencyCheck/issues/11 has been implemented.

+ *

+ * Takes a list of pom entries from a JAR file and attempts to filter it down to the pom related to the jar (rather + * then the pom entry for a dependency).

* * @param pomEntries a list of pom entries * @param classes a list of fully qualified classes from the JAR file - * @return the list of pom entries that are associated with the jar being - * analyzed rather then the dependent poms + * @return the list of pom entries that are associated with the jar being analyzed rather then the dependent poms */ private List filterPomEntries(List pomEntries, ArrayList classes) { return pomEntries; @@ -1040,8 +1015,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { } /** - * Simple check to see if the attribute from a manifest is just a package - * name. + * Simple check to see if the attribute from a manifest is just a package name. * * @param key the key of the value to check * @param value the value to check @@ -1059,16 +1033,13 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { protected static class ClassNameInformation { /** - * Stores information about a given class name. This class will keep the - * fully qualified class name and a list of the important parts of the - * package structure. Up to the first four levels of the package - * structure are stored, excluding a leading "org" or "com". Example: - * ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer"); + * Stores information about a given class name. This class will keep the fully qualified class name and a list + * of the important parts of the package structure. Up to the first four levels of the package structure are + * stored, excluding a leading "org" or "com". Example: ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer"); * System.out.println(obj.getName()); * for (String p : obj.getPackageStructure()) * System.out.println(p); - * Would result in: - * org.owasp.dependencycheck.analyzer.JarAnalyzer + * Would result in: org.owasp.dependencycheck.analyzer.JarAnalyzer * owasp * dependencycheck * analyzer @@ -1119,8 +1090,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { this.name = name; } /** - * Up to the first four levels of the package structure, excluding a - * leading "org" or "com". + * Up to the first four levels of the package structure, excluding a leading "org" or "com". */ private ArrayList packageStructure = new ArrayList(); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java index 9ab06e416..dd8d794e9 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java @@ -1,32 +1,30 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; -import org.owasp.dependencycheck.Engine; -import org.owasp.dependencycheck.dependency.Dependency; import java.util.Set; import java.util.regex.Pattern; +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.dependency.Dependency; /** * - * Used to load a JAR file and collect information that can be used to determine - * the associated CPE. + * Used to load a JAR file and collect information that can be used to determine the associated CPE. * * @author Jeremy Long */ @@ -68,8 +66,7 @@ public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer { * Returns whether or not this analyzer can process the given extension. * * @param extension the file extension to test for support. - * @return whether or not the specified file extension is supported by this - * analyzer. + * @return whether or not the specified file extension is supported by this analyzer. */ public boolean supportsExtension(String extension) { return EXTENSIONS.contains(extension); @@ -86,13 +83,12 @@ public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer { // /** - * Loads a specified JAR file and collects information from the manifest and - * checksums to identify the correct CPE information. + * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + * information. * * @param dependency the dependency to analyze. * @param engine the engine that is scanning the dependencies - * @throws AnalysisException is thrown if there is an error reading the JAR - * file. + * @throws AnalysisException is thrown if there is an error reading the JAR file. */ @Override public void analyze(Dependency dependency, Engine engine) throws AnalysisException { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java index d5a07c3b5..210aa6176 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java @@ -1,20 +1,19 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * - * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; @@ -24,7 +23,6 @@ import java.net.MalformedURLException; import java.net.URL; import java.util.Set; import java.util.logging.Logger; - import org.owasp.dependencycheck.Engine; import org.owasp.dependencycheck.data.nexus.MavenArtifact; import org.owasp.dependencycheck.data.nexus.NexusSearch; @@ -33,23 +31,21 @@ import org.owasp.dependencycheck.dependency.Evidence; import org.owasp.dependencycheck.utils.Settings; /** - * Analyzer which will attempt to locate a dependency on a Nexus service - * by SHA-1 digest of the dependency. + * Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency. * * There are two settings which govern this behavior: * *
    - *
  • {@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED} - * determines whether this analyzer is even enabled. This can be overridden by - * setting the system property.
    • - *
  • {@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL} - * the URL to a Nexus service to search by SHA-1. There is an expected %s - * in this where the SHA-1 will get entered.
    • + *
  • {@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED} determines whether this analyzer is + * even enabled. This can be overridden by setting the system property.
    • + *
  • {@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL} the URL to a Nexus service to search by + * SHA-1. There is an expected %s in this where the SHA-1 will get entered.
    • *
* * @author colezlaw */ public class NexusAnalyzer extends AbstractAnalyzer { + /** * The logger */ @@ -97,7 +93,7 @@ public class NexusAnalyzer extends AbstractAnalyzer { // I know that initialize can throw an exception, but we'll // just disable the analyzer if the URL isn't valid LOGGER.warning(String.format("Property %s not a valid URL. Nexus searching disabled", - searchUrl)); + searchUrl)); } } } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java index 5fee84526..8b1ad467b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -23,16 +22,15 @@ import java.sql.SQLException; import java.util.List; import java.util.Set; import org.owasp.dependencycheck.Engine; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Vulnerability; -import org.owasp.dependencycheck.dependency.Identifier; import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Identifier; +import org.owasp.dependencycheck.dependency.Vulnerability; /** - * NvdCveAnalyzer is a utility class that takes a project dependency and - * attempts to discern if there is an associated CVEs. It uses the the - * identifiers found by other analyzers to lookup the CVE data. + * NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated + * CVEs. It uses the the identifiers found by other analyzers to lookup the CVE data. * * @author Jeremy Long */ @@ -53,8 +51,7 @@ public class NvdCveAnalyzer implements Analyzer { * @throws SQLException thrown when there is a SQL Exception * @throws IOException thrown when there is an IO Exception * @throws DatabaseException thrown when there is a database exceptions - * @throws ClassNotFoundException thrown if the h2 database driver cannot be - * loaded + * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded */ public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException { cveDB = new CveDB(); @@ -92,13 +89,11 @@ public class NvdCveAnalyzer implements Analyzer { } /** - * Analyzes a dependency and attempts to determine if there are any CPE - * identifiers for this dependency. + * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. * * @param dependency The Dependency to analyze * @param engine The analysis engine - * @throws AnalysisException is thrown if there is an issue analyzing the - * dependency + * @throws AnalysisException is thrown if there is an issue analyzing the dependency */ public void analyze(Dependency dependency, Engine engine) throws AnalysisException { for (Identifier id : dependency.getIdentifiers()) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java index 206527bb9..388850bea 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -23,9 +22,8 @@ import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.suppression.SuppressionRule; /** - * The suppression analyzer processes an externally defined XML document that - * complies with the suppressions.xsd schema. Any identified Vulnerability - * entries within the dependencies that match will be removed. + * The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema. + * Any identified Vulnerability entries within the dependencies that match will be removed. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectoryLockException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectoryLockException.java index 2cad9131c..9ab186906 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectoryLockException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectoryLockException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectorySpinLock.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectorySpinLock.java index 887738934..47ad5f05c 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectorySpinLock.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/DirectorySpinLock.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -34,9 +33,8 @@ import java.util.logging.Level; import java.util.logging.Logger; /** - * Implements a spin lock on a given directory. If the lock cannot be obtained, - * the process will "spin" waiting for an opportunity to obtain the lock - * requested. + * Implements a spin lock on a given directory. If the lock cannot be obtained, the process will "spin" waiting for an + * opportunity to obtain the lock requested. * * @author Jeremy Long */ @@ -63,14 +61,12 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { */ private FileLock lock = null; /** - * The maximum number of seconds that the spin lock will wait while trying - * to obtain a lock. + * The maximum number of seconds that the spin lock will wait while trying to obtain a lock. */ private long maxWait = MAX_SPIN; /** - * Get the maximum wait time, in seconds, that the spin lock will wait while - * trying to obtain a lock. + * Get the maximum wait time, in seconds, that the spin lock will wait while trying to obtain a lock. * * @return the number of seconds the spin lock will wait */ @@ -79,8 +75,7 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { } /** - * Set the maximum wait time, in seconds, that the spin lock will wait while - * trying to obtain a lock. + * Set the maximum wait time, in seconds, that the spin lock will wait while trying to obtain a lock. * * @param maxWait the number of seconds the spin lock will wait */ @@ -92,10 +87,8 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { * Constructs a new spin lock on the given directory. * * @param directory the directory to monitor/lock - * @throws InvalidDirectoryException thrown if there is an issue with the - * directory provided - * @throws DirectoryLockException thrown there is an issue obtaining a - * handle to the lock file + * @throws InvalidDirectoryException thrown if there is an issue with the directory provided + * @throws DirectoryLockException thrown there is an issue obtaining a handle to the lock file */ public DirectorySpinLock(File directory) throws InvalidDirectoryException, DirectoryLockException { checkDirectory(directory); @@ -110,39 +103,32 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { } /** - * Attempts to obtain an exclusive lock; an exception is thrown if the lock - * could not be obtained. This method may block for a few seconds if a lock - * cannot be obtained. + * Attempts to obtain an exclusive lock; an exception is thrown if the lock could not be obtained. This method may + * block for a few seconds if a lock cannot be obtained. * - * @throws DirectoryLockException thrown if there is an exception obtaining - * the lock + * @throws DirectoryLockException thrown if there is an exception obtaining the lock */ public void obtainSharedLock() throws DirectoryLockException { obtainLock(true); } /** - * Attempts to obtain an exclusive lock; an exception is thrown if the lock - * could not be obtained. This method may block for a few seconds if a lock - * cannot be obtained. + * Attempts to obtain an exclusive lock; an exception is thrown if the lock could not be obtained. This method may + * block for a few seconds if a lock cannot be obtained. * - * @throws DirectoryLockException thrown if there is an exception obtaining - * the lock + * @throws DirectoryLockException thrown if there is an exception obtaining the lock */ public void obtainExclusiveLock() throws DirectoryLockException { obtainLock(false); } /** - * Attempts to obtain a lock; an exception is thrown if the lock could not - * be obtained. This method may block for a few seconds if a lock cannot be - * obtained. + * Attempts to obtain a lock; an exception is thrown if the lock could not be obtained. This method may block for a + * few seconds if a lock cannot be obtained. * * @param shared true if the lock is shared, otherwise false - * @param maxWait the maximum time to wait, in seconds, while trying to - * obtain the lock - * @throws DirectoryLockException thrown if there is an exception obtaining - * the lock + * @param maxWait the maximum time to wait, in seconds, while trying to obtain the lock + * @throws DirectoryLockException thrown if there is an exception obtaining the lock */ protected void obtainLock(boolean shared, long maxWait) throws DirectoryLockException { setMaxWait(maxWait); @@ -150,13 +136,11 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { } /** - * Attempts to obtain a lock; an exception is thrown if the lock could not - * be obtained. This method may block for a few seconds if a lock cannot be - * obtained. + * Attempts to obtain a lock; an exception is thrown if the lock could not be obtained. This method may block for a + * few seconds if a lock cannot be obtained. * * @param shared true if the lock is shared, otherwise false - * @throws DirectoryLockException thrown if there is an exception obtaining - * the lock + * @throws DirectoryLockException thrown if there is an exception obtaining the lock */ protected void obtainLock(boolean shared) throws DirectoryLockException { if (lock != null) { @@ -199,12 +183,11 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { } /** - * Performs a few simple rudimentary checks on the specified directory. - * Specifically, does the file exist and is it a directory. + * Performs a few simple rudimentary checks on the specified directory. Specifically, does the file exist and is it + * a directory. * * @param directory the File object to inspect - * @throws InvalidDirectoryException thrown if the directory is null or is - * not a directory + * @throws InvalidDirectoryException thrown if the directory is null or is not a directory */ private void checkDirectory(File directory) throws InvalidDirectoryException { if (directory == null) { @@ -250,8 +233,7 @@ public class DirectorySpinLock implements Closeable /*, AutoCloseable*/ { } /** - * Releases the lock. Any exceptions that are thrown by the underlying lock - * during the release are ignored. + * Releases the lock. Any exceptions that are thrown by the underlying lock during the release are ignored. */ public void release() { if (lock != null) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/InvalidDirectoryException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/InvalidDirectoryException.java index 1ad01247a..cfdb6cad7 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/InvalidDirectoryException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/concurrency/InvalidDirectoryException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java index 69de39ba4..93101e417 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -41,15 +40,15 @@ import org.apache.lucene.queryparser.classic.QueryParser; import org.apache.lucene.search.IndexSearcher; import org.apache.lucene.search.Query; import org.apache.lucene.search.TopDocs; -import org.owasp.dependencycheck.data.lucene.FieldAnalyzer; -import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.apache.lucene.store.RAMDirectory; +import org.owasp.dependencycheck.data.lucene.FieldAnalyzer; import org.owasp.dependencycheck.data.lucene.LuceneUtils; import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer; +import org.owasp.dependencycheck.data.nvdcve.CveDB; /** - * An in memory lucene index that contains the vendor/product combinations from - * the CPE (application) identifiers within the NVD CVE data. + * An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within + * the NVD CVE data. * * @author Jeremy Long */ @@ -278,8 +277,7 @@ public final class CpeMemoryIndex { * @param maxQueryResults the maximum number of documents to return * @return the TopDocs found by the search * @throws ParseException thrown when the searchString is invalid - * @throws IOException is thrown if there is an issue with the underlying - * Index + * @throws IOException is thrown if there is an issue with the underlying Index */ public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException { if (searchString == null || searchString.trim().isEmpty()) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java index 794495b4c..b5239e27d 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java @@ -1,26 +1,24 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.cpe; /** - * Fields is a collection of field names used within the Lucene index for CPE - * entries. + * Fields is a collection of field names used within the Lucene index for CPE entries. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexEntry.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexEntry.java index 3008b15a1..142b5eeb4 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexEntry.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexEntry.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -126,16 +125,18 @@ public class IndexEntry implements Serializable { } /** - *

Parses a name attribute value, from the cpe.xml, into its - * corresponding parts: vendor, product.

- *

Example:

+ *

+ * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.

+ *

+ * Example:

* nbsp;nbsp;nbsp;cpe:/a:apache:struts:1.1:rc2 * - *

Results in:

  • Vendor: apache
  • Product: struts
    • + *

    + * Results in:

    • Vendor: apache
    • Product: struts
      • *
    - *

    If it is necessary to parse the CPE into more parts (i.e. to include - * version and revision) then you should use the - * {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}. + *

    + * If it is necessary to parse the CPE into more parts (i.e. to include version and revision) then you should use + * the {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}. * * @param cpeName the cpe name * @throws UnsupportedEncodingException should never be thrown... diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexException.java index 77fff2bb4..3fb5cf9a5 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/IndexException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java index 69d4a32c3..454803a3b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -73,7 +72,8 @@ public final class CweDB { } /** - *

    Returns the full CWE name from the CWE ID.

    + *

    + * Returns the full CWE name from the CWE ID.

    * * @param cweId the CWE ID * @return the full name of the CWE diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java index 5ecf1527f..8cbddbad1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java index f813401cc..a45b653fe 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -24,8 +23,7 @@ import org.apache.lucene.analysis.TokenStream; import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; /** - * An abstract tokenizing filter that can be used as the base for a tokenizing - * filter. + * An abstract tokenizing filter that can be used as the base for a tokenizing filter. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.java index 95383856d..1a58f22a7 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -23,8 +22,7 @@ import org.apache.lucene.analysis.util.CharTokenizer; import org.apache.lucene.util.Version; /** - * Tokenizes the input breaking it into tokens when non-alpha/numeric characters - * are found. + * Tokenizes the input breaking it into tokens when non-alpha/numeric characters are found. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/DependencySimilarity.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/DependencySimilarity.java index 5745b7f27..1118272f0 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/DependencySimilarity.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/DependencySimilarity.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -32,12 +31,10 @@ public class DependencySimilarity extends DefaultSimilarity { private static final long serialVersionUID = 1L; /** - *

    Override the default idf implementation so that frequency within all - * document is ignored.

    + *

    + * Override the default idf implementation so that frequency within all document is ignored.

    * - * See this - * article for more details. + * See this article for more details. * * @param docFreq - the number of documents which contain the term * @param numDocs - the total number of documents in the collection diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java index 160eab83a..e1810e38f 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -29,9 +28,9 @@ import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter; import org.apache.lucene.util.Version; /** - *

    A Lucene Analyzer that utilizes the WhitespaceTokenizer, - * WordDelimiterFilter, LowerCaseFilter, and StopFilter. The intended purpose of - * this Analyzer is to index the CPE fields vendor and product.

    + *

    + * A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter. The + * intended purpose of this Analyzer is to index the CPE fields vendor and product.

    * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java index b380faf01..1b59283d8 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -21,16 +20,16 @@ package org.owasp.dependencycheck.data.lucene; import org.apache.lucene.util.Version; /** - *

    Lucene utils is a set of utilize written to make constructing Lucene - * queries simpler.

    + *

    + * Lucene utils is a set of utilize written to make constructing Lucene queries simpler.

    * * @author Jeremy Long */ public final class LuceneUtils { /** - * The current version of Lucene being used. Declaring this one place so an - * upgrade doesn't require hunting through the code base. + * The current version of Lucene being used. Declaring this one place so an upgrade doesn't require hunting through + * the code base. */ public static final Version CURRENT_VERSION = Version.LUCENE_45; @@ -41,8 +40,7 @@ public final class LuceneUtils { } /** - * Appends the text to the supplied StringBuilder escaping Lucene control - * characters in the process. + * Appends the text to the supplied StringBuilder escaping Lucene control characters in the process. * * @param buf a StringBuilder to append the escaped text to * @param text the data to be escaped @@ -88,8 +86,7 @@ public final class LuceneUtils { } /** - * Escapes the text passed in so that it is treated as data instead of - * control characters. + * Escapes the text passed in so that it is treated as data instead of control characters. * * @param text data to be escaped * @return the escaped text. diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java index a308435b3..7b40e08ed 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -40,8 +39,8 @@ public class SearchFieldAnalyzer extends Analyzer { */ private final Version version; /** - * A local reference to the TokenPairConcatenatingFilter so that we can - * clear any left over state if this analyzer is re-used. + * A local reference to the TokenPairConcatenatingFilter so that we can clear any left over state if this analyzer + * is re-used. */ private TokenPairConcatenatingFilter concatenatingFilter; @@ -85,10 +84,11 @@ public class SearchFieldAnalyzer extends Analyzer { } /** - *

    Resets the analyzer and clears any internal state data that may have - * been left-over from previous uses of the analyzer.

    - *

    If this analyzer is re-used this method must be called between - * uses.

    + *

    + * Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the + * analyzer.

    + *

    + * If this analyzer is re-used this method must be called between uses.

    */ public void clear() { if (concatenatingFilter != null) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java index d2f1672df..995a6d751 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -27,8 +26,7 @@ import org.apache.lucene.analysis.core.WhitespaceTokenizer; import org.apache.lucene.util.Version; /** - * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version - * information. + * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information. * * @author Jeremy Long * @deprecated version information is no longer stored in lucene diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java index ed90a57b4..3a5c52a8a 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -25,10 +24,10 @@ import org.apache.lucene.analysis.TokenStream; import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; /** - *

    Takes a TokenStream and adds additional tokens by concatenating pairs of - * words.

    - *

    Example: "Spring Framework Core" -> "Spring SpringFramework - * Framework FrameworkCore Core".

    + *

    + * Takes a TokenStream and adds additional tokens by concatenating pairs of words.

    + *

    + * Example: "Spring Framework Core" -> "Spring SpringFramework Framework FrameworkCore Core".

    * * @author Jeremy Long */ @@ -76,9 +75,8 @@ public final class TokenPairConcatenatingFilter extends TokenFilter { } /** - * Increments the underlying TokenStream and sets CharTermAttributes to - * construct an expanded set of tokens by concatenating tokens with the - * previous token. + * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + * concatenating tokens with the previous token. * * @return whether or not we have hit the end of the TokenStream * @throws IOException is thrown when an IOException occurs @@ -113,10 +111,11 @@ public final class TokenPairConcatenatingFilter extends TokenFilter { } /** - *

    Resets the Filter and clears any internal state data that may have - * been left-over from previous uses of the Filter.

    - *

    If this Filter is re-used this method must be called between - * uses.

    + *

    + * Resets the Filter and clears any internal state data that may have been left-over from previous uses of the + * Filter.

    + *

    + * If this Filter is re-used this method must be called between uses.

    */ public void clear() { previousWord = null; diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java index 8cae8485c..03f4c0a63 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -29,10 +28,10 @@ import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; import org.owasp.dependencycheck.utils.UrlStringUtils; /** - *

    Takes a TokenStream and splits or adds tokens to correctly index version - * numbers.

    - *

    Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE - * 3.0.0.RELEASE".

    + *

    + * Takes a TokenStream and splits or adds tokens to correctly index version numbers.

    + *

    + * Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".

    * * @author Jeremy Long */ @@ -48,9 +47,8 @@ public final class UrlTokenizingFilter extends AbstractTokenizingFilter { } /** - * Increments the underlying TokenStream and sets CharTermAttributes to - * construct an expanded set of tokens by concatenating tokens with the - * previous token. + * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + * concatenating tokens with the previous token. * * @return whether or not we have hit the end of the TokenStream * @throws IOException is thrown when an IOException occurs diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java index 242eb4ee0..b5510f480 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java index d169ed946..3b4d8bf48 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -24,10 +23,10 @@ import org.apache.lucene.analysis.TokenStream; import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; /** - *

    Takes a TokenStream and splits or adds tokens to correctly index version - * numbers.

    - *

    Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE - * 3.0.0.RELEASE".

    + *

    + * Takes a TokenStream and splits or adds tokens to correctly index version numbers.

    + *

    + * Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".

    * * @author Jeremy Long * @deprecated version information is no longer stored in lucene @@ -45,9 +44,8 @@ public final class VersionTokenizingFilter extends AbstractTokenizingFilter { } /** - * Increments the underlying TokenStream and sets CharTermAttributes to - * construct an expanded set of tokens by concatenating tokens with the - * previous token. + * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + * concatenating tokens with the previous token. * * @return whether or not we have hit the end of the TokenStream * @throws IOException is thrown when an IOException occurs @@ -69,13 +67,13 @@ public final class VersionTokenizingFilter extends AbstractTokenizingFilter { } /** - *

    Analyzes the version and adds several copies of the version as - * different tokens. For example, the version 1.2.7 would create the tokens - * 1 1.2 1.2.7. This is useful in discovering the correct version - - * sometimes a maintenance or build number will throw off the version - * identification.

    + *

    + * Analyzes the version and adds several copies of the version as different tokens. For example, the version 1.2.7 + * would create the tokens 1 1.2 1.2.7. This is useful in discovering the correct version - sometimes a maintenance + * or build number will throw off the version identification.

    * - *

    expected format:&nbps;major.minor[.maintenance[.build]]

    + *

    + * expected format:&nbps;major.minor[.maintenance[.build]]

    * * @param version the version to analyze */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java index 943374088..559f4f8bf 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java @@ -1,20 +1,19 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * - * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.nexus; @@ -24,6 +23,7 @@ package org.owasp.dependencycheck.data.nexus; * @author colezlaw */ public class MavenArtifact { + /** * The groupId */ @@ -40,12 +40,10 @@ public class MavenArtifact { private String version; /** - * The artifact url. This may change depending on which Nexus - * server the search took place. + * The artifact url. This may change depending on which Nexus server the search took place. */ private String artifactUrl; - /** * Creates an empty MavenArtifact. */ @@ -95,42 +93,54 @@ public class MavenArtifact { * * @param groupId the groupId */ - public void setGroupId(String groupId) { this.groupId = groupId; } + public void setGroupId(String groupId) { + this.groupId = groupId; + } /** * Gets the groupId. * * @return the groupId */ - public String getGroupId() { return groupId; } + public String getGroupId() { + return groupId; + } /** * Sets the artifactId. * * @param artifactId the artifactId */ - public void setArtifactId(String artifactId) { this.artifactId = artifactId; } + public void setArtifactId(String artifactId) { + this.artifactId = artifactId; + } /** * Gets the artifactId. * * @return the artifactId */ - public String getArtifactId() { return artifactId; } + public String getArtifactId() { + return artifactId; + } /** * Sets the version. * * @param version the version */ - public void setVersion(String version) { this.version = version; } + public void setVersion(String version) { + this.version = version; + } /** * Gets the version. * * @return the version */ - public String getVersion() { return version; } + public String getVersion() { + return version; + } /** * Sets the artifactUrl. diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java index d8db3392d..5e8e67139 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java @@ -1,20 +1,19 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * - * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.nexus; @@ -35,6 +34,7 @@ import org.w3c.dom.Document; * @author colezlaw */ public class NexusSearch { + /** * The root URL for the Nexus repository service */ @@ -48,22 +48,21 @@ public class NexusSearch { /** * Creates a NexusSearch for the given repository URL. * - * @param rootURL the root URL of the repository on which searches should execute. - * full URL's are calculated relative to this URL, so it should end with a / + * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated + * relative to this URL, so it should end with a / */ public NexusSearch(URL rootURL) { this.rootURL = rootURL; } /** - * Searches the configured Nexus repository for the given sha1 - * hash. If the artifact is found, a MavenArtifact is populated - * with the coordinate information. + * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a + * MavenArtifact is populated with the coordinate information. * * @param sha1 The SHA-1 hash string for which to search * @return the populated Maven coordinates - * @throws IOException if it's unable to connect to the specified repositor or - * if the specified artifact is not found. + * @throws IOException if it's unable to connect to the specified repositor or if the specified artifact is not + * found. */ public MavenArtifact searchSha1(String sha1) throws IOException { if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/package-info.java index 33f810a3a..c79074fae 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/package-info.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/package-info.java @@ -4,9 +4,11 @@ * org.owasp.dependencycheck.data.nexus * * - *

    Contains classes related to searching a Nexus repository.

    - *

    These are used to abstract Nexus searching away from - * OWASP Dependency Check so they can be reused elsewhere.

    + *

    + * Contains classes related to searching a Nexus repository.

    + *

    + * These are used to abstract Nexus searching away from OWASP Dependency Check so they can be reused elsewhere.

    * * */ +package org.owasp.dependencycheck.data.nexus; diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java index f5cd96159..7fdae4bae 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java index fa008a736..a4c9efdd1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java @@ -1,26 +1,25 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.nvdcve; /** - * An exception used to indicate the db4o database is corrupt. This could be due - * to invalid data or a complete failure of the db. + * An exception used to indicate the db4o database is corrupt. This could be due to invalid data or a complete failure + * of the db. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java index dac2632dc..9bb0f4021 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseException.java index c7c320de4..d9d95a1c1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java index ff29c4542..0c5296890 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java @@ -1,26 +1,25 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.nvdcve; import java.util.Properties; -import org.owasp.dependencycheck.data.update.exception.UpdateException; import org.owasp.dependencycheck.data.update.NvdCveInfo; +import org.owasp.dependencycheck.data.update.exception.UpdateException; /** * This is a wrapper around a set of properties that are stored in the database. @@ -30,19 +29,18 @@ import org.owasp.dependencycheck.data.update.NvdCveInfo; public class DatabaseProperties { /** - * Modified key word, used as a key to store information about the modified - * file (i.e. the containing the last 8 days of updates).. + * Modified key word, used as a key to store information about the modified file (i.e. the containing the last 8 + * days of updates).. */ public static final String MODIFIED = "modified"; /** - * The properties file key for the last updated field - used to store the - * last updated time of the Modified NVD CVE xml file. + * The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE + * xml file. */ public static final String LAST_UPDATED = "lastupdated.modified"; /** - * Stores the last updated time for each of the NVD CVE files. These - * timestamps should be updated if we process the modified file within 7 - * days of the last update. + * Stores the last updated time for each of the NVD CVE files. These timestamps should be updated if we process the + * modified file within 7 days of the last update. */ public static final String LAST_UPDATED_BASE = "lastupdated."; /** @@ -81,8 +79,7 @@ public class DatabaseProperties { } /** - * Writes a properties file containing the last updated date to the - * VULNERABLE_CPE directory. + * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory. * * @param updatedValue the updated NVD CVE entry * @throws UpdateException is thrown if there is an update exception @@ -96,8 +93,8 @@ public class DatabaseProperties { } /** - * Returns the property value for the given key. If the key is not contained - * in the underlying properties null is returned. + * Returns the property value for the given key. If the key is not contained in the underlying properties null is + * returned. * * @param key the property key * @return the value of the property @@ -107,8 +104,8 @@ public class DatabaseProperties { } /** - * Returns the property value for the given key. If the key is not contained - * in the underlying properties the default value is returned. + * Returns the property value for the given key. If the key is not contained in the underlying properties the + * default value is returned. * * @param key the property key * @param defaultValue the default value diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.java index a926359be..d5740d3b3 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java index 56df31bdb..78e5f0951 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java index a66b2d3af..8e7b6360b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CachedWebDataSource.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CachedWebDataSource.java index 627aba768..51180cb47 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CachedWebDataSource.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CachedWebDataSource.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -21,20 +20,18 @@ package org.owasp.dependencycheck.data.update; import org.owasp.dependencycheck.data.update.exception.UpdateException; /** - * Defines a data source who's data is retrieved from the Internet. This data - * can be downloaded and the local cache updated. + * Defines a data source who's data is retrieved from the Internet. This data can be downloaded and the local cache + * updated. * * @author Jeremy Long */ public interface CachedWebDataSource { /** - * Determines if an update to the current data store is needed, if it is the - * new data is downloaded from the Internet and imported into the current - * cached data store. + * Determines if an update to the current data store is needed, if it is the new data is downloaded from the + * Internet and imported into the current cached data store. * - * @throws UpdateException is thrown if there is an exception downloading - * the data or updating the data store. + * @throws UpdateException is thrown if there is an exception downloading the data or updating the data store. */ void update() throws UpdateException; } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveInfo.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveInfo.java index 9d2fb3b00..b52f5aa3f 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveInfo.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveInfo.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java index c0daa3fb6..c09b4f72d 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java @@ -1,27 +1,26 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update; -import org.owasp.dependencycheck.data.update.exception.UpdateException; import java.net.MalformedURLException; import java.util.logging.Level; import java.util.logging.Logger; +import org.owasp.dependencycheck.data.update.exception.UpdateException; import org.owasp.dependencycheck.utils.DownloadFailedException; /** @@ -32,11 +31,10 @@ import org.owasp.dependencycheck.utils.DownloadFailedException; public class NvdCveUpdater implements CachedWebDataSource { /** - *

    Downloads the latest NVD CVE XML file from the web and imports it into - * the current CVE Database.

    + *

    + * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.

    * - * @throws UpdateException is thrown if there is an error updating the - * database + * @throws UpdateException is thrown if there is an error updating the database */ @Override public void update() throws UpdateException { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java index ba180e329..ec2802f0d 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java @@ -1,28 +1,22 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update; -import org.owasp.dependencycheck.data.update.task.ProcessTask; -import org.owasp.dependencycheck.data.update.task.CallableDownloadTask; -import org.owasp.dependencycheck.data.update.exception.UpdateException; -import org.owasp.dependencycheck.data.update.exception.InvalidDataException; -import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; import java.net.MalformedURLException; import java.util.Calendar; import java.util.Date; @@ -35,11 +29,16 @@ import java.util.concurrent.Future; import java.util.logging.Level; import java.util.logging.Logger; import org.owasp.dependencycheck.data.nvdcve.CveDB; -import org.owasp.dependencycheck.utils.DownloadFailedException; -import org.owasp.dependencycheck.utils.Settings; import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -import org.owasp.dependencycheck.utils.InvalidSettingException; +import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.MODIFIED; +import org.owasp.dependencycheck.data.update.exception.InvalidDataException; +import org.owasp.dependencycheck.data.update.exception.UpdateException; +import org.owasp.dependencycheck.data.update.task.CallableDownloadTask; +import org.owasp.dependencycheck.data.update.task.ProcessTask; +import org.owasp.dependencycheck.utils.DownloadFailedException; +import org.owasp.dependencycheck.utils.InvalidSettingException; +import org.owasp.dependencycheck.utils.Settings; /** * Class responsible for updating the NVDCVE data store. @@ -53,8 +52,7 @@ public class StandardUpdate { */ public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3); /** - * Information about the timestamps and URLs for data that needs to be - * updated. + * Information about the timestamps and URLs for data that needs to be updated. */ private DatabaseProperties properties; /** @@ -79,10 +77,8 @@ public class StandardUpdate { * Constructs a new Standard Update Task. * * @throws MalformedURLException thrown if a configured URL is malformed - * @throws DownloadFailedException thrown if a timestamp cannot be checked - * on a configured URL - * @throws UpdateException thrown if there is an exception generating the - * update task + * @throws DownloadFailedException thrown if a timestamp cannot be checked on a configured URL + * @throws UpdateException thrown if there is an exception generating the update task */ public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException { openDataStores(); @@ -91,11 +87,10 @@ public class StandardUpdate { } /** - *

    Downloads the latest NVD CVE XML file from the web and imports it into - * the current CVE Database.

    + *

    + * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.

    * - * @throws UpdateException is thrown if there is an error updating the - * database + * @throws UpdateException is thrown if there is an error updating the database */ public void update() throws UpdateException { int maxUpdates = 0; @@ -187,18 +182,14 @@ public class StandardUpdate { } /** - * Determines if the index needs to be updated. This is done by fetching the - * NVD CVE meta data and checking the last update date. If the data needs to - * be refreshed this method will return the NvdCveUrl for the files that - * need to be updated. + * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last + * update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to + * be updated. * * @return the collection of files that need to be updated - * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta - * data is incorrect - * @throws DownloadFailedException is thrown if there is an error. - * downloading the NVD CVE download data file - * @throws UpdateException Is thrown if there is an issue with the last - * updated properties file + * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta data is incorrect + * @throws DownloadFailedException is thrown if there is an error. downloading the NVD CVE download data file + * @throws UpdateException Is thrown if there is an issue with the last updated properties file */ protected final UpdateableNvdCve updatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException { UpdateableNvdCve updates = null; @@ -244,7 +235,7 @@ public class StandardUpdate { DatabaseProperties.LAST_UPDATED_BASE, entry.getId()); Logger .getLogger(StandardUpdate.class - .getName()).log(Level.FINE, msg, ex); + .getName()).log(Level.FINE, msg, ex); } if (currentTimestamp == entry.getTimestamp()) { entry.setNeedsUpdate(false); @@ -256,7 +247,7 @@ public class StandardUpdate { final String msg = "An invalid schema version or timestamp exists in the data.properties file."; Logger .getLogger(StandardUpdate.class - .getName()).log(Level.WARNING, msg); + .getName()).log(Level.WARNING, msg); Logger.getLogger(StandardUpdate.class .getName()).log(Level.FINE, null, ex); } @@ -268,12 +259,9 @@ public class StandardUpdate { * Retrieves the timestamps from the NVD CVE meta data file. * * @return the timestamp from the currently published nvdcve downloads page - * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data - * is incorrect. - * @throws DownloadFailedException thrown if there is an error downloading - * the nvd cve meta data file - * @throws InvalidDataException thrown if there is an exception parsing the - * timestamps + * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data is incorrect. + * @throws DownloadFailedException thrown if there is an error downloading the nvd cve meta data file + * @throws InvalidDataException thrown if there is an exception parsing the timestamps * @throws InvalidSettingException thrown if the settings are invalid */ private UpdateableNvdCve retrieveCurrentTimestampsFromWeb() @@ -330,10 +318,9 @@ public class StandardUpdate { } /** - * Determines if the epoch date is within the range specified of the - * compareTo epoch time. This takes the (compareTo-date)/1000/60/60/24 to - * get the number of days. If the calculated days is less then the range the - * date is considered valid. + * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the + * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date + * is considered valid. * * @param date the date to be checked. * @param compareTo the date to compare to. diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateService.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateService.java index 50b3a9aa5..9c6dac1cc 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateService.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateService.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -56,8 +55,7 @@ public final class UpdateService { } /** - * Returns an Iterator for all instances of the CachedWebDataSource - * interface. + * Returns an Iterator for all instances of the CachedWebDataSource interface. * * @return an iterator of CachedWebDataSource. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateableNvdCve.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateableNvdCve.java index 2cc071eed..3e7eed5bf 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateableNvdCve.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/UpdateableNvdCve.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -28,8 +27,8 @@ import org.owasp.dependencycheck.utils.DownloadFailedException; import org.owasp.dependencycheck.utils.Downloader; /** - * Contains a collection of updateable NvdCveInfo objects. This is used to - * determine which files need to be downloaded and processed. + * Contains a collection of updateable NvdCveInfo objects. This is used to determine which files need to be downloaded + * and processed. * * @author Jeremy Long */ @@ -41,8 +40,7 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato private Map collection = new TreeMap(); /** - * Returns the collection of NvdCveInfo objects. This method is mainly used - * for testing. + * Returns the collection of NvdCveInfo objects. This method is mainly used for testing. * * @return the collection of NvdCveInfo objects */ @@ -69,8 +67,8 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato * * @param id the key for the item to be added * @param url the URL to download the item - * @param oldUrl the URL for the old version of the item (the NVD CVE old - * schema still contains useful data we need). + * @param oldUrl the URL for the old version of the item (the NVD CVE old schema still contains useful data we + * need). * @throws MalformedURLException thrown if the URL provided is invalid * @throws DownloadFailedException thrown if the download fails. */ @@ -83,8 +81,8 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato * * @param id the key for the item to be added * @param url the URL to download the item - * @param oldUrl the URL for the old version of the item (the NVD CVE old - * schema still contains useful data we need). + * @param oldUrl the URL for the old version of the item (the NVD CVE old schema still contains useful data we + * need). * @param needsUpdate whether or not the data needs to be updated * @throws MalformedURLException thrown if the URL provided is invalid * @throws DownloadFailedException thrown if the download fails. @@ -121,8 +119,10 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato private Iterator> iterableContent = null; /** - *

    Returns an iterator for the NvdCveInfo contained.

    - *

    This method is not thread safe.

    + *

    + * Returns an iterator for the NvdCveInfo contained.

    + *

    + * This method is not thread safe.

    * * @return an NvdCveInfo Iterator */ @@ -133,11 +133,12 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato } /** - *

    Returns whether or not there is another item in the collection.

    - *

    This method is not thread safe.

    + *

    + * Returns whether or not there is another item in the collection.

    + *

    + * This method is not thread safe.

    * - * @return true or false depending on whether or not another item exists in - * the collection + * @return true or false depending on whether or not another item exists in the collection */ @Override public boolean hasNext() { @@ -145,8 +146,10 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato } /** - *

    Returns the next item in the collection.

    - *

    This method is not thread safe.

    + *

    + * Returns the next item in the collection.

    + *

    + * This method is not thread safe.

    * * @return the next NvdCveInfo item in the collection */ @@ -156,8 +159,10 @@ public class UpdateableNvdCve implements java.lang.Iterable, Iterato } /** - *

    Removes the current NvdCveInfo object from the collection.

    - *

    This method is not thread safe.

    + *

    + * Removes the current NvdCveInfo object from the collection.

    + *

    + * This method is not thread safe.

    */ @Override public void remove() { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/InvalidDataException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/InvalidDataException.java index e4c59ca63..f916be8ea 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/InvalidDataException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/InvalidDataException.java @@ -1,26 +1,24 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update.exception; /** - * An InvalidDataDataException is a generic exception used when trying to load - * the NVD CVE meta data. + * An InvalidDataDataException is a generic exception used when trying to load the NVD CVE meta data. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/UpdateException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/UpdateException.java index b7f57ff9f..432bfd2d5 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/UpdateException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/exception/UpdateException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java index 44e44fc30..cf158785b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -53,7 +52,6 @@ public class CallableDownloadTask implements Callable> { final File file1; final File file2; - try { file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml"); file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml"); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/ProcessTask.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/ProcessTask.java index b85e311f5..f8a43806d 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/ProcessTask.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/ProcessTask.java @@ -1,27 +1,22 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update.task; -import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; -import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; -import org.owasp.dependencycheck.data.update.exception.UpdateException; -import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; import java.io.File; import java.io.FileNotFoundException; import java.io.IOException; @@ -36,13 +31,16 @@ import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; import org.owasp.dependencycheck.data.update.StandardUpdate; +import org.owasp.dependencycheck.data.update.exception.UpdateException; +import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; +import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; import org.owasp.dependencycheck.dependency.VulnerableSoftware; import org.xml.sax.SAXException; /** - * A callable task that will process a given set of NVD CVE xml files and update - * the Cve Database accordingly. + * A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly. * * @author Jeremy Long */ @@ -87,8 +85,7 @@ public class ProcessTask implements Callable { * Constructs a new ProcessTask used to process an NVD CVE update. * * @param cveDB the data store object - * @param filePair the download task that contains the URL references to - * download + * @param filePair the download task that contains the URL references to download */ public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair) { this.cveDB = cveDB; @@ -100,8 +97,8 @@ public class ProcessTask implements Callable { * Implements the callable interface. * * @return this object - * @throws Exception thrown if there is an exception; note that any - * UpdateExceptions are simply added to the tasks exception collection + * @throws Exception thrown if there is an exception; note that any UpdateExceptions are simply added to the tasks + * exception collection */ @Override public ProcessTask call() throws Exception { @@ -118,14 +115,12 @@ public class ProcessTask implements Callable { * * @param file the file containing the NVD CVE XML * @param oldVersion contains the file containing the NVD CVE XML 1.2 - * @throws ParserConfigurationException is thrown if there is a parser - * configuration exception + * @throws ParserConfigurationException is thrown if there is a parser configuration exception * @throws SAXException is thrown if there is a SAXException * @throws IOException is thrown if there is a IO Exception * @throws SQLException is thrown if there is a SQL exception * @throws DatabaseException is thrown if there is a database exception - * @throws ClassNotFoundException thrown if the h2 database driver cannot be - * loaded + * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded */ protected void importXML(File file, File oldVersion) throws ParserConfigurationException, SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException { @@ -146,8 +141,7 @@ public class ProcessTask implements Callable { /** * Processes the NVD CVE XML file and imports the data into the DB. * - * @throws UpdateException thrown if there is an error loading the data into - * the database + * @throws UpdateException thrown if there is an error loading the data into the database */ private void processFiles() throws UpdateException { String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId()); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.java index 84cda98f0..b23e2fa5c 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -29,11 +28,9 @@ import org.xml.sax.SAXNotSupportedException; import org.xml.sax.helpers.DefaultHandler; /** - * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This - * parses the xml and retrieves a listing of CPEs that have previous versions - * specified. The previous version information is not in the 2.0 version of the - * schema and is useful to ensure accurate identification (or at least - * complete). + * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This parses the xml and retrieves a listing of + * CPEs that have previous versions specified. The previous version information is not in the 2.0 version of the schema + * and is useful to ensure accurate identification (or at least complete). * * @author Jeremy Long */ @@ -150,8 +147,7 @@ public class NvdCve12Handler extends DefaultHandler { // /** - * A simple class to maintain information about the current element while - * parsing the NVD CVE XML. + * A simple class to maintain information about the current element while parsing the NVD CVE XML. */ protected static class Element { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.java index c80ff441f..4c05420bc 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -229,16 +228,14 @@ public class NvdCve20Handler extends DefaultHandler { cveDB = db; } /** - * A list of CVE entries and associated VulnerableSoftware entries that - * contain previous entries. + * A list of CVE entries and associated VulnerableSoftware entries that contain previous entries. */ private Map> prevVersionVulnMap; /** * Sets the prevVersionVulnMap. * - * @param map the map of vulnerable software with previous versions being - * vulnerable + * @param map the map of vulnerable software with previous versions being vulnerable */ public void setPrevVersionVulnMap(Map> map) { prevVersionVulnMap = map; @@ -248,8 +245,7 @@ public class NvdCve20Handler extends DefaultHandler { * Saves a vulnerability to the CVE Database. * * @param vuln the vulnerability to store in the database - * @throws DatabaseException thrown if there is an error writing to the - * database + * @throws DatabaseException thrown if there is an error writing to the database * @throws CorruptIndexException is thrown if the CPE Index is corrupt * @throws IOException thrown if there is an IOException with the CPE Index */ @@ -269,8 +265,7 @@ public class NvdCve20Handler extends DefaultHandler { // /** - * A simple class to maintain information about the current element while - * parsing the NVD CVE XML. + * A simple class to maintain information about the current element while parsing the NVD CVE XML. */ protected static class Element { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java index 3eccd58e9..636640a1b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -32,9 +31,8 @@ import org.owasp.dependencycheck.utils.Checksum; import org.owasp.dependencycheck.utils.FileUtils; /** - * A program dependency. This object is one of the core components within - * DependencyCheck. It is used to collect information about the dependency in - * the form of evidence. The Evidence is then used to determine if there are any + * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect + * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any * known, published, vulnerabilities associated with the program dependency. * * @author Jeremy Long @@ -153,9 +151,11 @@ public class Dependency implements Comparable { } /** - *

    Gets the file path of the dependency.

    NOTE: This may not - * be the actual path of the file on disk. The actual path of the file on - * disk can be obtained via the getActualFilePath().

    + *

    + * Gets the file path of the dependency.

    + *

    + * NOTE: This may not be the actual path of the file on disk. The actual path of the file on disk can be + * obtained via the getActualFilePath().

    * * @return the file path of the dependency. */ @@ -236,8 +236,7 @@ public class Dependency implements Comparable { } /** - * Adds an entry to the list of detected Identifiers for the dependency - * file. + * Adds an entry to the list of detected Identifiers for the dependency file. * * @param type the type of identifier (such as CPE) * @param value the value of the identifier @@ -249,8 +248,7 @@ public class Dependency implements Comparable { } /** - * Adds an entry to the list of detected Identifiers for the dependency - * file. + * Adds an entry to the list of detected Identifiers for the dependency file. * * @param identifier the identifier to add */ @@ -465,8 +463,7 @@ public class Dependency implements Comparable { } /** - * Implementation of the Comparable interface. The comparison is - * solely based on the file name. + * Implementation of the Comparable interface. The comparison is solely based on the file name. * * @param o a dependency to compare * @return an integer representing the natural ordering @@ -567,8 +564,7 @@ public class Dependency implements Comparable { } /** - * Standard toString() implementation showing the filename, actualFilePath, - * and filePath. + * Standard toString() implementation showing the filename, actualFilePath, and filePath. * * @return the string representation of the file */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java index 63619af31..86433c893 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -128,11 +127,9 @@ public class Evidence implements Comparable { } /** - * Get the value of value. If setUsed is set to false this call to get will - * not mark the evidence as used. + * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used. * - * @param setUsed whether or not this call to getValue should cause the used - * flag to be updated + * @param setUsed whether or not this call to getValue should cause the used flag to be updated * @return the value of value */ public String getValue(Boolean setUsed) { @@ -229,8 +226,7 @@ public class Evidence implements Comparable { } /** - * Simple equality test for use within the equals method. This does a case - * insensitive compare. + * Simple equality test for use within the equals method. This does a case insensitive compare. * * @param l a string to compare. * @param r another string to compare. diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java index 5d215800a..2319d3f8d 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -40,8 +39,7 @@ import org.owasp.dependencycheck.utils.UrlStringUtils; public class EvidenceCollection implements Iterable { /** - * Used to iterate over highest confidence evidence contained in the - * collection. + * Used to iterate over highest confidence evidence contained in the collection. */ private static final Filter HIGHEST_CONFIDENCE = new Filter() { public boolean passes(Evidence evidence) { @@ -49,8 +47,7 @@ public class EvidenceCollection implements Iterable { } }; /** - * Used to iterate over high confidence evidence contained in the - * collection. + * Used to iterate over high confidence evidence contained in the collection. */ private static final Filter HIGH_CONFIDENCE = new Filter() { public boolean passes(Evidence evidence) { @@ -58,8 +55,7 @@ public class EvidenceCollection implements Iterable { } }; /** - * Used to iterate over medium confidence evidence contained in the - * collection. + * Used to iterate over medium confidence evidence contained in the collection. */ private static final Filter MEDIUM_CONFIDENCE = new Filter() { public boolean passes(Evidence evidence) { @@ -75,8 +71,7 @@ public class EvidenceCollection implements Iterable { } }; /** - * Used to iterate over evidence that has was used (aka read) from the - * collection. + * Used to iterate over evidence that has was used (aka read) from the collection. */ private static final Filter EVIDENCE_USED = new Filter() { public boolean passes(Evidence evidence) { @@ -87,8 +82,7 @@ public class EvidenceCollection implements Iterable { /** * Used to iterate over evidence of the specified confidence. * - * @param confidence the confidence level for the evidence to be iterated - * over. + * @param confidence the confidence level for the evidence to be iterated over. * @return Iterable an iterable collection of evidence */ public final Iterable iterator(Evidence.Confidence confidence) { @@ -129,8 +123,7 @@ public class EvidenceCollection implements Iterable { } /** - * Creates an Evidence object from the parameters and adds the resulting - * object to the collection. + * Creates an Evidence object from the parameters and adds the resulting object to the collection. * * @param source the source of the Evidence. * @param name the name of the Evidence. @@ -143,17 +136,13 @@ public class EvidenceCollection implements Iterable { } /** - * Adds term to the weighting collection. The terms added here are used - * later to boost the score of other terms. This is a way of combining - * evidence from multiple sources to boost the confidence of the given - * evidence. + * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. + * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. * - * Example: The term 'Apache' is found in the manifest of a JAR and is added - * to the Collection. When we parse the package names within the JAR file we - * may add these package names to the "weighted" strings collection to boost - * the score in the Lucene query. That way when we construct the Lucene - * query we find the term Apache in the collection AND in the weighted - * strings; as such, we will boost the confidence of the term Apache. + * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the + * package names within the JAR file we may add these package names to the "weighted" strings collection to boost + * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the + * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache. * * @param str to add to the weighting collection. */ @@ -162,8 +151,8 @@ public class EvidenceCollection implements Iterable { } /** - * Returns a set of Weightings - a list of terms that are believed to be of - * higher confidence when also found in another location. + * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in + * another location. * * @return Set */ @@ -251,8 +240,7 @@ public class EvidenceCollection implements Iterable { } /** - * Used to determine if a given version was used (aka read) from the - * EvidenceCollection. + * Used to determine if a given version was used (aka read) from the EvidenceCollection. * * @param version the version to search for within the collected evidence. * @return whether or not the string was used. @@ -272,8 +260,7 @@ public class EvidenceCollection implements Iterable { } /** - * Returns whether or not the collection contains evidence of a specified - * Confidence. + * Returns whether or not the collection contains evidence of a specified Confidence. * * @param confidence A Confidence value. * @return boolean. @@ -288,8 +275,7 @@ public class EvidenceCollection implements Iterable { } /** - * Merges multiple EvidenceCollections together, only merging evidence that - * was used, into a new EvidenceCollection. + * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection. * * @param ec One or more EvidenceCollections. * @return a new EvidenceCollection containing the used evidence. @@ -345,16 +331,18 @@ public class EvidenceCollection implements Iterable { } /** - *

    Takes a string that may contain a fully qualified domain and it will - * return the string having removed the query string, the protocol, the - * sub-domain of 'www', and the file extension of the path.

    - *

    This is useful for checking if the evidence contains a specific - * string. The presence of the protocol, file extension, etc. may produce - * false positives. + *

    + * Takes a string that may contain a fully qualified domain and it will return the string having removed the query + * string, the protocol, the sub-domain of 'www', and the file extension of the path.

    + *

    + * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file + * extension, etc. may produce false positives. * - *

    Example, given the following input:

    + *

    + * Example, given the following input:

    * 'Please visit https://www.somedomain.com/path1/path2/file.php?id=439' - *

    The function would return:

    + *

    + * The function would return:

    * 'Please visit somedomain path1 path2 file' * * @param value the value that may contain a url diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java index a4bfcd287..0d36249c9 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -108,7 +107,9 @@ public class Identifier implements Comparable { } /** - *

    Set the value of type.

    Example would be "CPE".

    + *

    + * Set the value of type.

    + * Example would be "CPE".

    * * @param type new value of type */ @@ -175,8 +176,7 @@ public class Identifier implements Comparable { } /** - * Implementation of the comparator interface. This compares the value of - * the identifier only. + * Implementation of the comparator interface. This compares the value of the identifier only. * * @param o the object being compared * @return an integer indicating the ordering diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Reference.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Reference.java index 0a0393c2a..4842af810 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Reference.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Reference.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -21,8 +20,7 @@ package org.owasp.dependencycheck.dependency; import java.io.Serializable; /** - * An external reference for a vulnerability. This contains a name, URL, and a - * source. + * An external reference for a vulnerability. This contains a name, URL, and a source. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java index 6ff0a4fd4..5ba17ef2d 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -161,8 +160,7 @@ public class Vulnerability implements Serializable, Comparable { * Adds an entry for vulnerable software. * * @param cpe string representation of a cpe - * @param previousVersion the previous version (previousVersion - cpe would - * be considered vulnerable) + * @param previousVersion the previous version (previousVersion - cpe would be considered vulnerable) * @return if the add succeeded */ public boolean addVulnerableSoftware(String cpe, String previousVersion) { @@ -389,8 +387,8 @@ public class Vulnerability implements Serializable, Comparable { * Compares two vulnerabilities. * * @param v a vulnerability to be compared - * @return a negative integer, zero, or a positive integer as this object is - * less than, equal to, or greater than the specified vulnerability + * @return a negative integer, zero, or a positive integer as this object is less than, equal to, or greater than + * the specified vulnerability */ public int compareTo(Vulnerability v) { return v.getName().compareTo(this.getName()); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerabilityComparator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerabilityComparator.java index 420a1e370..a65de4de9 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerabilityComparator.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerabilityComparator.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java index e9f3278a4..d38591642 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -26,8 +25,7 @@ import java.util.logging.Logger; import org.owasp.dependencycheck.data.cpe.IndexEntry; /** - * A record containing information about vulnerable software. This is referenced - * from a vulnerability. + * A record containing information about vulnerable software. This is referenced from a vulnerability. * * @author Jeremy Long */ @@ -55,12 +53,15 @@ public class VulnerableSoftware extends IndexEntry implements Serializable, Comp } /** - *

    Parses a name attribute value, from the cpe.xml, into its - * corresponding parts: vendor, product, version, revision.

    - *

    Example:

    + *

    + * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, + * revision.

    + *

    + * Example:

    *    cpe:/a:apache:struts:1.1:rc2 * - *

    Results in:

    • Vendor: apache
    • Product: struts
      • + *

      + * Results in:

      • Vendor: apache
      • Product: struts
        • *
      • Version: 1.1
      • Revision: rc2
      * * @param cpeName the cpe name @@ -121,8 +122,7 @@ public class VulnerableSoftware extends IndexEntry implements Serializable, Comp } /** - * Standard equals implementation to compare this VulnerableSoftware to - * another object. + * Standard equals implementation to compare this VulnerableSoftware to another object. * * @param obj the object to compare * @return whether or not the objects are equal @@ -155,8 +155,7 @@ public class VulnerableSoftware extends IndexEntry implements Serializable, Comp } /** - * Standard toString() implementation display the name and whether or not - * previous versions are also affected. + * Standard toString() implementation display the name and whether or not previous versions are also affected. * * @return a string representation of the object */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/NoDataException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/NoDataException.java index 6851c6c4f..b64eee63b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/NoDataException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/NoDataException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java index 7d57b9b8b..d4d345293 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -23,9 +22,9 @@ import org.xml.sax.SAXException; import org.xml.sax.helpers.XMLFilterImpl; /** - * This filter is used when parsing POM documents. Some POM documents do not - * specify the xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures - * that the correct namespace is added so that both types of POMs can be read. + * This filter is used when parsing POM documents. Some POM documents do not specify the + * xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures that the correct namespace is added so that both types + * of POMs can be read. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java index 86e63226b..4901ea48a 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java @@ -1,25 +1,24 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.reporting; -import java.io.FileInputStream; import java.io.File; +import java.io.FileInputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; import java.io.IOException; @@ -40,10 +39,8 @@ import org.owasp.dependencycheck.analyzer.Analyzer; import org.owasp.dependencycheck.dependency.Dependency; /** - * The ReportGenerator is used to, as the name implies, generate reports. - * Internally the generator uses the Velocity Templating Engine. The - * ReportGenerator exposes a list of Dependencies to the template when - * generating the report. + * The ReportGenerator is used to, as the name implies, generate reports. Internally the generator uses the Velocity + * Templating Engine. The ReportGenerator exposes a list of Dependencies to the template when generating the report. * * @author Jeremy Long */ @@ -152,8 +149,7 @@ public class ReportGenerator { * Generates the Dependency Reports for the identified dependencies. * * @param outputDir the path where the reports should be written - * @param outputFormat the format the report should be written in (XML, - * HTML, ALL) + * @param outputFormat the format the report should be written in (XML, HTML, ALL) * @throws IOException is thrown when the template file does not exist * @throws Exception is thrown if there is an error writing out the reports. */ @@ -176,9 +172,8 @@ public class ReportGenerator { } /** - * Generates a report from a given Velocity Template. The template name - * provided can be the name of a template contained in the jar file, such as - * 'XmlReport' or 'HtmlReport', or the template name can be the path to a + * Generates a report from a given Velocity Template. The template name provided can be the name of a template + * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a * template file. * * @param templateName the name of the template to load. diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java index 13456ceeb..c9e55b2c4 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.java @@ -1,41 +1,37 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Steve Springett. All Rights Reserved. */ package org.owasp.dependencycheck.reporting; +import java.util.logging.Level; +import java.util.logging.Logger; import org.apache.velocity.app.Velocity; import org.apache.velocity.runtime.RuntimeServices; import org.apache.velocity.runtime.log.LogChute; -import java.util.logging.Level; -import java.util.logging.Logger; - /** - *

      DependencyCheck uses {@link java.util.logging.Logger} as a logging - * framework, and Apache Velocity uses a custom logging implementation that - * outputs to a file named velocity.log by default. This class is an - * implementation of a custom Velocity logger that redirects all velocity - * logging to the Java Logger class. + *

      + * DependencyCheck uses {@link java.util.logging.Logger} as a logging framework, and Apache Velocity uses a custom + * logging implementation that outputs to a file named velocity.log by default. This class is an implementation of a + * custom Velocity logger that redirects all velocity logging to the Java Logger class. *

      - * This class was written to address permission issues when using - * Dependency-Check in a server environment (such as the Jenkins plugin). In - * some circumstances, Velocity would attempt to create velocity.log in an - * un-writable directory.

      + * This class was written to address permission issues when using Dependency-Check in a server environment (such as the + * Jenkins plugin). In some circumstances, Velocity would attempt to create velocity.log in an un-writable + * directory.

      * * @author Steve Springett (steve.springett@owasp.org) */ @@ -51,8 +47,8 @@ public class VelocityLoggerRedirect implements LogChute { } /** - * Given a Velocity log level and message, this method will call the - * appropriate Logger level and log the specified values. + * Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified + * values. * * @param level the logging level * @param message the message to be logged @@ -62,8 +58,8 @@ public class VelocityLoggerRedirect implements LogChute { } /** - * Given a Velocity log level, message and Throwable, this method will call - * the appropriate Logger level and log the specified values. + * Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the + * specified values. * * @param level the logging level * @param message the message to be logged diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/PropertyType.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/PropertyType.java index b1663801d..889709338 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/PropertyType.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/PropertyType.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -21,9 +20,8 @@ package org.owasp.dependencycheck.suppression; import java.util.regex.Pattern; /** - * A simple PropertyType used to represent a string value that could be used as - * a regular expression or could be case insensitive. The equals method has been - * over-ridden so that the object will correctly compare to strings. + * A simple PropertyType used to represent a string value that could be used as a regular expression or could be case + * insensitive. The equals method has been over-ridden so that the object will correctly compare to strings. * * @author Jeremy Long */ @@ -104,8 +102,7 @@ public class PropertyType { // /** - * Uses the object's properties to determine if the supplied string matches - * the value of this property. + * Uses the object's properties to determine if the supplied string matches the value of this property. * * @param text the String to validate * @return whether the text supplied is matched by the value of the property diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.java index 6a05044b2..d5e2846c6 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java index 872016877..93f683edc 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParseException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParseException.java index fb2084157..411ac9662 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParseException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParseException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java index de2f2eaeb..0075006df 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java index c69ddf4ed..4cdb1b63b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -237,9 +236,8 @@ public class SuppressionRule { } /** - * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS - * scores should be suppressed. If any should be, they are removed from the - * dependency. + * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any + * should be, they are removed from the dependency. * * @param dependency a project dependency to analyze */ @@ -301,12 +299,10 @@ public class SuppressionRule { } /** - * Identifies if the cpe specified by the cpe suppression rule does not - * specify a version. + * Identifies if the cpe specified by the cpe suppression rule does not specify a version. * * @param c a suppression rule identifier - * @return true if the property type does not specify a version; otherwise - * false + * @return true if the property type does not specify a version; otherwise false */ boolean cpeHasNoVersion(PropertyType c) { if (c.isRegex()) { @@ -319,8 +315,7 @@ public class SuppressionRule { } /** - * Counts the number of occurrences of the character found within the - * string. + * Counts the number of occurrences of the character found within the string. * * @param str the string to check * @param c the character to count @@ -337,8 +332,7 @@ public class SuppressionRule { } /** - * Determines if the cpeEntry specified as a PropertyType matches the given - * Identifier. + * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. * * @param cpeEntry a suppression rule entry * @param identifier a CPE identifier to check diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java index c4f7fcf75..f6b6aa873 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -44,8 +43,7 @@ public final class DBUtils { * * @param statement a prepared statement that just executed an insert * @return a primary key - * @throws DatabaseException thrown if there is an exception obtaining the - * key + * @throws DatabaseException thrown if there is an exception obtaining the key */ public static int getGeneratedKey(PreparedStatement statement) throws DatabaseException { ResultSet rs = null; @@ -79,8 +77,7 @@ public final class DBUtils { } /** - * Closes the result set capturing and ignoring any SQLExceptions that - * occur. + * Closes the result set capturing and ignoring any SQLExceptions that occur. * * @param rs a ResultSet to close */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java index 2e5ecb3c7..538d2bc31 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -26,15 +25,15 @@ import java.util.regex.Pattern; import org.apache.commons.lang.StringUtils; /** - *

      Simple object to track the parts of a version number. The parts are - * contained in a List such that version 1.2.3 will be stored as: - * versionParts[0] = 1; + *

      + * Simple object to track the parts of a version number. The parts are contained in a List such that version 1.2.3 will + * be stored as: versionParts[0] = 1; * versionParts[1] = 2; * versionParts[2] = 3; *

      - *

      Note, the parser contained in this class expects the version numbers to be - * separated by periods. If a different separator is used the parser will likely - * fail.

      + *

      + * Note, the parser contained in this class expects the version numbers to be separated by periods. If a different + * separator is used the parser will likely fail.

      * * @author Jeremy Long */ @@ -48,9 +47,8 @@ public class DependencyVersion implements Iterable, ComparableNote, this should only be used when the version passed in is - * already known to be a well formated version number. Otherwise, - * DependencyVersionUtil.parseVersion() should be used instead. + * Note, this should only be used when the version passed in is already known to be a well formated version + * number. Otherwise, DependencyVersionUtil.parseVersion() should be used instead. * * @param version the well formated version number to parse */ @@ -59,9 +57,8 @@ public class DependencyVersion implements Iterable, ComparableNote, this should only be used to parse something that - * is already known to be a version number. + * Parses a version string into its sub parts: major, minor, revision, build, etc. Note, this should only be + * used to parse something that is already known to be a version number. * * @param version the version string to parse */ @@ -182,9 +179,8 @@ public class DependencyVersion implements Iterable, ComparableA utility class to extract version numbers from file names (or other - * strings containing version numbers.

      + *

      + * A utility class to extract version numbers from file names (or other strings containing version numbers.

      * * @author Jeremy Long */ @@ -35,9 +34,8 @@ public final class DependencyVersionUtil { */ private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); /** - * Regular expression to extract a single version number without periods. - * This is a last ditch effort just to check in case we are missing a - * version number using the previous regex. + * Regular expression to extract a single version number without periods. This is a last ditch effort just to check + * in case we are missing a version number using the previous regex. */ private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); @@ -48,8 +46,8 @@ public final class DependencyVersionUtil { } /** - *

      A utility class to extract version numbers from file names (or other - * strings containing version numbers.
      + *

      + * A utility class to extract version numbers from file names (or other strings containing version numbers.
      * Example:
      * Give the file name: library-name-1.4.1r2-release.jar
      * This function would return: 1.4.1.r2

      diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DownloadFailedException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DownloadFailedException.java index d7a405199..7734aa2bd 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DownloadFailedException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DownloadFailedException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Downloader.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Downloader.java index 1fceaa6fa..e8cbc0466 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Downloader.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Downloader.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -54,8 +53,7 @@ public final class Downloader { * * @param url the URL of the file to download. * @param outputPath the path to the save the file to. - * @throws DownloadFailedException is thrown if there is an error - * downloading the file. + * @throws DownloadFailedException is thrown if there is an error downloading the file. */ public static void fetchFile(URL url, File outputPath) throws DownloadFailedException { HttpURLConnection conn = null; @@ -120,14 +118,12 @@ public final class Downloader { } /** - * Makes an HTTP Head request to retrieve the last modified date of the - * given URL. If the file:// protocol is specified, then the lastTimestamp - * of the file is returned. + * Makes an HTTP Head request to retrieve the last modified date of the given URL. If the file:// protocol is + * specified, then the lastTimestamp of the file is returned. * * @param url the URL to retrieve the timestamp from * @return an epoch timestamp - * @throws DownloadFailedException is thrown if an exception occurs making - * the HTTP request + * @throws DownloadFailedException is thrown if an exception occurs making the HTTP request */ public static long getLastModified(URL url) throws DownloadFailedException { long timestamp = 0; @@ -173,9 +169,8 @@ public final class Downloader { } /** - * Utility method to get an HttpURLConnection. If the app is configured to - * use a proxy this method will retrieve the proxy settings and use them - * when setting up the connection. + * Utility method to get an HttpURLConnection. If the app is configured to use a proxy this method will retrieve the + * proxy settings and use them when setting up the connection. * * @param url the url to connect to * @return an HttpURLConnection diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionException.java index 60860e03e..43c8b0b06 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileUtils.java index 29bd9d22b..ff5c48f96 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileUtils.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileUtils.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -67,8 +66,7 @@ public final class FileUtils { } /** - * Deletes a file. If the File is a directory it will recursively delete the - * contents. + * Deletes a file. If the File is a directory it will recursively delete the contents. * * @param file the File to delete * @throws IOException is thrown if the file could not be deleted @@ -91,19 +89,16 @@ public final class FileUtils { } /** - * Returns the data directory. If a path was specified in - * dependencycheck.properties or was specified using the Settings object, - * and the path exists, that path will be returned as a File object. If it - * does not exist, then a File object will be created based on the file - * location of the JAR containing the specified class. + * Returns the data directory. If a path was specified in dependencycheck.properties or was specified using the + * Settings object, and the path exists, that path will be returned as a File object. If it does not exist, then a + * File object will be created based on the file location of the JAR containing the specified class. * * @param configuredFilePath the configured relative or absolute path * @param clazz the class to resolve the path * @return a File object * @throws IOException is thrown if the path could not be decoded - * @deprecated This method should no longer be used. See the implementation - * in dependency-check-cli/App.java to see how the data directory should be - * set. + * @deprecated This method should no longer be used. See the implementation in dependency-check-cli/App.java to see + * how the data directory should be set. */ @java.lang.Deprecated public static File getDataDirectory(String configuredFilePath, Class clazz) throws IOException { @@ -117,10 +112,8 @@ public final class FileUtils { } /** - * Retrieves the physical path to the parent directory containing the - * provided class. For example, if a JAR file contained a class - * org.something.clazz this method would return the parent directory of the - * JAR file. + * Retrieves the physical path to the parent directory containing the provided class. For example, if a JAR file + * contained a class org.something.clazz this method would return the parent directory of the JAR file. * * @param clazz the class to determine the parent directory of * @return the parent directory of the file containing the specified class. @@ -140,24 +133,21 @@ public final class FileUtils { * * @param archive an archive file such as a WAR or EAR * @param extractTo a directory to extract the contents to - * @throws ExtractionException thrown if an exception occurs while - * extracting the files + * @throws ExtractionException thrown if an exception occurs while extracting the files */ public static void extractFiles(File archive, File extractTo) throws ExtractionException { extractFiles(archive, extractTo, null); } /** - * Extracts the contents of an archive into the specified directory. The - * files are only extracted if they are supported by the analyzers loaded - * into the specified engine. If the engine is specified as null then all - * files are extracted. + * Extracts the contents of an archive into the specified directory. The files are only extracted if they are + * supported by the analyzers loaded into the specified engine. If the engine is specified as null then all files + * are extracted. * * @param archive an archive file such as a WAR or EAR * @param extractTo a directory to extract the contents to * @param engine the scanning engine - * @throws ExtractionException thrown if there is an error extracting the - * files + * @throws ExtractionException thrown if there is an error extracting the files */ public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException { if (archive == null || extractTo == null) { diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/InvalidSettingException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/InvalidSettingException.java index e63a014d4..64d4d4b6b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/InvalidSettingException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/InvalidSettingException.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogFilter.java index 393b77bae..36830a0fe 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogFilter.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -22,9 +21,8 @@ import java.util.logging.Filter; import java.util.logging.LogRecord; /** - * A simple log filter to limit the entries written to the verbose log file. The - * verbose log file uses the root logger as I couldn't get anything else to - * work; as such, this filter limits the log entries to specific classes. + * A simple log filter to limit the entries written to the verbose log file. The verbose log file uses the root logger + * as I couldn't get anything else to work; as such, this filter limits the log entries to specific classes. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java index 663a0801c..d99dc1e88 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/NonClosingStream.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/NonClosingStream.java index 3689753ec..f0d58579a 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/NonClosingStream.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/NonClosingStream.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -22,9 +21,8 @@ import java.io.FilterInputStream; import java.io.InputStream; /** - * NonClosingStream is a stream filter which prevents another class that - * processes the stream from closing it. This is necessary when dealing with - * things like JAXB and zipInputStreams. + * NonClosingStream is a stream filter which prevents another class that processes the stream from closing it. This is + * necessary when dealing with things like JAXB and zipInputStreams. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Settings.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Settings.java index 706399999..9366ffcf0 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Settings.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Settings.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -42,30 +41,25 @@ public final class Settings { public static final class KEYS { /** - * private constructor because this is a "utility" class containing - * constants + * private constructor because this is a "utility" class containing constants */ private KEYS() { //do nothing } /** - * The properties key indicating whether or not the cached data sources - * should be updated. + * The properties key indicating whether or not the cached data sources should be updated. */ public static final String AUTO_UPDATE = "autoupdate"; /** - * The database driver class name. If this is not in the properties file - * the embedded database is used. + * The database driver class name. If this is not in the properties file the embedded database is used. */ public static final String DB_DRIVER_NAME = "data.driver_name"; /** - * The database driver class name. If this is not in the properties file - * the embedded database is used. + * The database driver class name. If this is not in the properties file the embedded database is used. */ public static final String DB_DRIVER_PATH = "data.driver_path"; /** - * The database connection string. If this is not in the properties file - * the embedded database is used. + * The database connection string. If this is not in the properties file the embedded database is used. */ public static final String DB_CONNECTION_STRING = "data.connection_string"; /** @@ -81,29 +75,26 @@ public final class Settings { */ public static final String DATA_DIRECTORY = "data.directory"; /** - * The properties key for the URL to retrieve the "meta" data from about - * the CVE entries. + * The properties key for the URL to retrieve the "meta" data from about the CVE entries. */ public static final String CVE_META_URL = "cve.url.meta"; /** - * The properties key for the URL to retrieve the recently modified and - * added CVE entries (last 8 days) using the 2.0 schema. + * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + * the 2.0 schema. */ public static final String CVE_MODIFIED_20_URL = "cve.url-2.0.modified"; /** - * The properties key for the URL to retrieve the recently modified and - * added CVE entries (last 8 days) using the 1.2 schema. + * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + * the 1.2 schema. */ public static final String CVE_MODIFIED_12_URL = "cve.url-1.2.modified"; /** - * The properties key for the URL to retrieve the recently modified and - * added CVE entries (last 8 days). + * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days). */ public static final String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays"; /** - * The properties key for the telling us how many cvr.url.* URLs exists. - * This is used in combination with CVE_BASE_URL to be able to retrieve - * the URLs for all of the files that make up the NVD CVE listing. + * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with + * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing. */ public static final String CVE_START_YEAR = "cve.startyear"; /** @@ -119,8 +110,7 @@ public final class Settings { */ public static final String PROXY_URL = "proxy.url"; /** - * The properties key for the proxy port - this must be an integer - * value. + * The properties key for the proxy port - this must be an integer value. */ public static final String PROXY_PORT = "proxy.port"; /** @@ -170,8 +160,7 @@ public final class Settings { private Properties props = null; /** - * Private constructor for the Settings class. This class loads the - * properties files. + * Private constructor for the Settings class. This class loads the properties files. */ private Settings() { InputStream in = null; @@ -218,16 +207,13 @@ public final class Settings { } /** - * Merges a new properties file into the current properties. This method - * allows for the loading of a user provided properties file.

      - * Note: even if using this method - system properties will be loaded before - * properties loaded from files. + * Merges a new properties file into the current properties. This method allows for the loading of a user provided + * properties file.

      + * Note: even if using this method - system properties will be loaded before properties loaded from files. * * @param filePath the path to the properties file to merge. - * @throws FileNotFoundException is thrown when the filePath points to a - * non-existent file - * @throws IOException is thrown when there is an exception loading/merging - * the properties + * @throws FileNotFoundException is thrown when the filePath points to a non-existent file + * @throws IOException is thrown when there is an exception loading/merging the properties */ public static void mergeProperties(File filePath) throws FileNotFoundException, IOException { final FileInputStream fis = new FileInputStream(filePath); @@ -235,16 +221,13 @@ public final class Settings { } /** - * Merges a new properties file into the current properties. This method - * allows for the loading of a user provided properties file.

      - * Note: even if using this method - system properties will be loaded before - * properties loaded from files. + * Merges a new properties file into the current properties. This method allows for the loading of a user provided + * properties file.

      + * Note: even if using this method - system properties will be loaded before properties loaded from files. * * @param filePath the path to the properties file to merge. - * @throws FileNotFoundException is thrown when the filePath points to a - * non-existent file - * @throws IOException is thrown when there is an exception loading/merging - * the properties + * @throws FileNotFoundException is thrown when the filePath points to a non-existent file + * @throws IOException is thrown when there is an exception loading/merging the properties */ public static void mergeProperties(String filePath) throws FileNotFoundException, IOException { final FileInputStream fis = new FileInputStream(filePath); @@ -252,24 +235,21 @@ public final class Settings { } /** - * Merges a new properties file into the current properties. This method - * allows for the loading of a user provided properties file.

      - * Note: even if using this method - system properties will be loaded before - * properties loaded from files. + * Merges a new properties file into the current properties. This method allows for the loading of a user provided + * properties file.

      + * Note: even if using this method - system properties will be loaded before properties loaded from files. * * @param stream an Input Stream pointing at a properties file to merge - * @throws IOException is thrown when there is an exception loading/merging - * the properties + * @throws IOException is thrown when there is an exception loading/merging the properties */ public static void mergeProperties(InputStream stream) throws IOException { INSTANCE.props.load(stream); } /** - * Returns a value from the properties file as a File object. If the value - * was specified as a system property or passed in via the -Dprop=value - * argument - this method will return the value from the system properties - * before the values in the contained configuration file. + * Returns a value from the properties file as a File object. If the value was specified as a system property or + * passed in via the -Dprop=value argument - this method will return the value from the system properties before the + * values in the contained configuration file. * * @param key the key to lookup within the properties file * @return the property from the properties file converted to a File object @@ -283,15 +263,13 @@ public final class Settings { } /** - * Returns a value from the properties file as a File object. If the value - * was specified as a system property or passed in via the -Dprop=value - * argument - this method will return the value from the system properties - * before the values in the contained configuration file. + * Returns a value from the properties file as a File object. If the value was specified as a system property or + * passed in via the -Dprop=value argument - this method will return the value from the system properties before the + * values in the contained configuration file. * - * This method will check the configured base directory and will use this as - * the base of the file path. Additionally, if the base directory begins - * with a leading "[JAR]\" sequence with the path to the folder containing - * the JAR file containing this class. + * This method will check the configured base directory and will use this as the base of the file path. + * Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder + * containing the JAR file containing this class. * * @param key the key to lookup within the properties file * @return the property from the properties file converted to a File object @@ -310,8 +288,7 @@ public final class Settings { } /** - * Attempts to retrieve the folder containing the Jar file containing the - * Settings class. + * Attempts to retrieve the folder containing the Jar file containing the Settings class. * * @return a File object */ @@ -333,9 +310,8 @@ public final class Settings { } /** - * Returns a value from the properties file. If the value was specified as a - * system property or passed in via the -Dprop=value argument - this method - * will return the value from the system properties before the values in the + * Returns a value from the properties file. If the value was specified as a system property or passed in via the + * -Dprop=value argument - this method will return the value from the system properties before the values in the * contained configuration file. * * @param key the key to lookup within the properties file @@ -357,9 +333,8 @@ public final class Settings { } /** - * Returns a value from the properties file. If the value was specified as a - * system property or passed in via the -Dprop=value argument - this method - * will return the value from the system properties before the values in the + * Returns a value from the properties file. If the value was specified as a system property or passed in via the + * -Dprop=value argument - this method will return the value from the system properties before the values in the * contained configuration file. * * @param key the key to lookup within the properties file @@ -370,8 +345,7 @@ public final class Settings { } /** - * Removes a property from the local properties collection. This is mainly - * used in test cases. + * Removes a property from the local properties collection. This is mainly used in test cases. * * @param key the property key to remove */ @@ -380,15 +354,13 @@ public final class Settings { } /** - * Returns an int value from the properties file. If the value was specified - * as a system property or passed in via the -Dprop=value argument - this - * method will return the value from the system properties before the values - * in the contained configuration file. + * Returns an int value from the properties file. If the value was specified as a system property or passed in via + * the -Dprop=value argument - this method will return the value from the system properties before the values in the + * contained configuration file. * * @param key the key to lookup within the properties file * @return the property from the properties file - * @throws InvalidSettingException is thrown if there is an error retrieving - * the setting + * @throws InvalidSettingException is thrown if there is an error retrieving the setting */ public static int getInt(String key) throws InvalidSettingException { int value; @@ -401,15 +373,14 @@ public final class Settings { } /** - * Returns an int value from the properties file. If the value was specified - * as a system property or passed in via the -Dprop=value argument - this - * method will return the value from the system properties before the values - * in the contained configuration file. + * Returns an int value from the properties file. If the value was specified as a system property or passed in via + * the -Dprop=value argument - this method will return the value from the system properties before the values in the + * contained configuration file. * * @param key the key to lookup within the properties file * @param defaultValue the default value to return - * @return the property from the properties file or the defaultValue if the - * property does not exist or cannot be converted to an integer + * @return the property from the properties file or the defaultValue if the property does not exist or cannot be + * converted to an integer */ public static int getInt(String key, int defaultValue) { int value; @@ -424,15 +395,13 @@ public final class Settings { } /** - * Returns a long value from the properties file. If the value was specified - * as a system property or passed in via the -Dprop=value argument - this - * method will return the value from the system properties before the values - * in the contained configuration file. + * Returns a long value from the properties file. If the value was specified as a system property or passed in via + * the -Dprop=value argument - this method will return the value from the system properties before the values in the + * contained configuration file. * * @param key the key to lookup within the properties file * @return the property from the properties file - * @throws InvalidSettingException is thrown if there is an error retrieving - * the setting + * @throws InvalidSettingException is thrown if there is an error retrieving the setting */ public static long getLong(String key) throws InvalidSettingException { long value; @@ -445,16 +414,13 @@ public final class Settings { } /** - * Returns a boolean value from the properties file. If the value was - * specified as a system property or passed in via the - * -Dprop=value argument this method will return the value from - * the system properties before the values in the contained configuration - * file. + * Returns a boolean value from the properties file. If the value was specified as a system property or passed in + * via the -Dprop=value argument this method will return the value from the system properties before + * the values in the contained configuration file. * * @param key the key to lookup within the properties file * @return the property from the properties file - * @throws InvalidSettingException is thrown if there is an error retrieving - * the setting + * @throws InvalidSettingException is thrown if there is an error retrieving the setting */ public static boolean getBoolean(String key) throws InvalidSettingException { boolean value; diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java index 44909f372..bdec9b3e5 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -47,8 +46,8 @@ public final class UrlStringUtils { private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE); /** - * Tests if the text provided contains a URL. This is somewhat limited - * search in that it only looks for (ftp|http|https):// + * Tests if the text provided contains a URL. This is somewhat limited search in that it only looks for + * (ftp|http|https):// * * @param text the text to search * @return true if the text contains a url, otherwise false @@ -67,18 +66,19 @@ public final class UrlStringUtils { return IS_URL_TEST.matcher(text).matches(); } /** - * A listing of domain parts that should not be used as evidence. Yes, this - * is an incomplete list. + * A listing of domain parts that should not be used as evidence. Yes, this is an incomplete list. */ private static final HashSet IGNORE_LIST = new HashSet( Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx")); /** - *

      Takes a URL, in String format, and adds the important parts of the URL - * to a list of strings.

      - *

      Example, given the following input:

      + *

      + * Takes a URL, in String format, and adds the important parts of the URL to a list of strings.

      + *

      + * Example, given the following input:

      * "https://www.somedomain.com/path1/path2/file.php?id=439" - *

      The function would return:

      + *

      + * The function would return:

      * {"some.domain", "path1", "path2", "file"} * * @param text a URL diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl index ec94cd73a..e71e67b12 100644 --- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl @@ -1,18 +1,17 @@ #** -This file is part of Dependency-Check. +This file is part of dependency-check-core. -Dependency-Check is free software: you can redistribute it and/or modify -it under the terms of the GNU General Public License as published by -the Free Software Foundation, either version 3 of the License, or -(at your option) any later version. +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at -Dependency-Check is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU General Public License for more details. + http://www.apache.org/licenses/LICENSE-2.0 -You should have received a copy of the GNU General Public License -along with Dependency-Check. If not, see http://www.gnu.org/licenses/. +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. Copyright (c) 2012 Jeremy Long. All Rights Reserved. diff --git a/dependency-check-core/src/main/resources/templates/VulnerabilityReport.vsl b/dependency-check-core/src/main/resources/templates/VulnerabilityReport.vsl index 1df4c9c8f..355118cf3 100644 --- a/dependency-check-core/src/main/resources/templates/VulnerabilityReport.vsl +++ b/dependency-check-core/src/main/resources/templates/VulnerabilityReport.vsl @@ -1,18 +1,17 @@ #** This file is part of Dependency-Check. -Dependency-Check is free software: you can redistribute it and/or modify -it under the terms of the GNU General Public License as published by -the Free Software Foundation, either version 3 of the License, or -(at your option) any later version. +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at -Dependency-Check is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU General Public License for more details. + http://www.apache.org/licenses/LICENSE-2.0 -You should have received a copy of the GNU General Public License -along with Dependency-Check. If not, see http://www.gnu.org/licenses/. +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. Copyright (c) 2013 Jeremy Long. All Rights Reserved. diff --git a/dependency-check-core/src/main/resources/templates/XmlReport.vsl b/dependency-check-core/src/main/resources/templates/XmlReport.vsl index ae3cc068a..e1cf05261 100644 --- a/dependency-check-core/src/main/resources/templates/XmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/XmlReport.vsl @@ -1,18 +1,17 @@ #** This file is part of Dependency-Check. -Dependency-Check is free software: you can redistribute it and/or modify -it under the terms of the GNU General Public License as published by -the Free Software Foundation, either version 3 of the License, or -(at your option) any later version. +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at -Dependency-Check is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU General Public License for more details. + http://www.apache.org/licenses/LICENSE-2.0 -You should have received a copy of the GNU General Public License -along with Dependency-Check. If not, see http://www.gnu.org/licenses/. +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. Copyright (c) 2012 Jeremy Long. All Rights Reserved. diff --git a/dependency-check-core/src/site/site.xml b/dependency-check-core/src/site/site.xml index 004b95520..bedc502ae 100644 --- a/dependency-check-core/src/site/site.xml +++ b/dependency-check-core/src/site/site.xml @@ -2,18 +2,17 @@ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineIntegrationTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineIntegrationTest.java index db7b5d0e6..253fa7900 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineIntegrationTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineIntegrationTest.java @@ -1,31 +1,29 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck; -import org.owasp.dependencycheck.Engine; -import org.owasp.dependencycheck.reporting.ReportGenerator; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; +import org.owasp.dependencycheck.reporting.ReportGenerator; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.java index 102a1a98f..38cc12cec 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.java @@ -1,31 +1,30 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; -import org.owasp.dependencycheck.analyzer.AbstractAnalyzer; import java.util.Set; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.java index 741fa1b54..77b367424 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.java @@ -1,33 +1,30 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; -import org.owasp.dependencycheck.analyzer.AnalyzerService; -import org.owasp.dependencycheck.analyzer.Analyzer; -import java.util.Set; import java.util.Iterator; +import java.util.Set; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java index 443191037..564d17e4c 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.java index 67add265c..900a0c578 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -27,13 +26,13 @@ import org.apache.lucene.index.CorruptIndexException; import org.apache.lucene.queryparser.classic.ParseException; import org.junit.After; import org.junit.AfterClass; -import org.owasp.dependencycheck.dependency.Dependency; import org.junit.Assert; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase; import org.owasp.dependencycheck.data.cpe.IndexEntry; +import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.dependency.Identifier; /** @@ -133,7 +132,6 @@ public class CPEAnalyzerTest extends BaseIndexTestCase { HintAnalyzer hAnalyzer = new HintAnalyzer(); hAnalyzer.analyze(dep, null); - CPEAnalyzer instance = new CPEAnalyzer(); instance.open(); instance.analyze(dep, null); @@ -171,7 +169,6 @@ public class CPEAnalyzerTest extends BaseIndexTestCase { JarAnalyzer jarAnalyzer = new JarAnalyzer(); jarAnalyzer.analyze(struts, null); - File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath()); Dependency commonValidator = new Dependency(fileCommonValidator); jarAnalyzer.analyze(commonValidator, null); @@ -205,7 +202,6 @@ public class CPEAnalyzerTest extends BaseIndexTestCase { //the following two only work if the HintAnalyzer is used. //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); - } /** @@ -234,7 +230,6 @@ public class CPEAnalyzerTest extends BaseIndexTestCase { //TODO fix this assert //Assert.assertEquals(expResult, result.get(0).getName()); - instance.close(); } } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.java index df3ae1462..d6a865512 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.java @@ -1,34 +1,32 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; -import org.owasp.dependencycheck.analyzer.AnalysisPhase; -import org.owasp.dependencycheck.analyzer.FileNameAnalyzer; import java.io.File; import java.util.Set; -import org.owasp.dependencycheck.dependency.Dependency; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; +import org.owasp.dependencycheck.dependency.Dependency; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java index e89260181..a33c43569 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java @@ -1,36 +1,35 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.analyzer; -import java.util.Properties; -import org.owasp.dependencycheck.analyzer.JarAnalyzer; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Evidence; -import java.util.HashSet; import java.io.File; +import java.util.HashSet; +import java.util.Properties; import java.util.Set; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/DirectorySpinLockTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/DirectorySpinLockTest.java index c522628e7..3152d18bf 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/DirectorySpinLockTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/DirectorySpinLockTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -22,10 +21,12 @@ import java.io.File; import java.net.URL; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * @@ -53,11 +54,9 @@ public class DirectorySpinLockTest { } /** - * Test of obtainSharedLock method, of class DirectorySpinLock. - * Specifically, this test uses the SpinLockTask to obtain an exclusive lock - * that is held for 5 seconds. We then try to obtain a shared lock while - * that task is running. It should take longer then 5 seconds to obtain the - * shared lock. + * Test of obtainSharedLock method, of class DirectorySpinLock. Specifically, this test uses the SpinLockTask to + * obtain an exclusive lock that is held for 5 seconds. We then try to obtain a shared lock while that task is + * running. It should take longer then 5 seconds to obtain the shared lock. */ @Test public void testObtainSharedLock_withContention() throws Exception { @@ -79,9 +78,8 @@ public class DirectorySpinLockTest { } /** - * Test of obtainSharedLock method, of class DirectorySpinLock. This method - * obtains two shared locks by using the SpinLockTask to obtain a lock in - * another thread. + * Test of obtainSharedLock method, of class DirectorySpinLock. This method obtains two shared locks by using the + * SpinLockTask to obtain a lock in another thread. */ @Test public void testObtainSharedLock() throws Exception { diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/SpinLockTask.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/SpinLockTask.java index 0363cf921..7c2315898 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/SpinLockTask.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/concurrency/SpinLockTask.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -22,8 +21,7 @@ import java.io.File; import java.io.IOException; /** - * A simple task that obtains a lock on a directory. This is used in testing of - * the shared and exclusive locks. + * A simple task that obtains a lock on a directory. This is used in testing of the shared and exclusive locks. * * @author Jeremy Long */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.java index a643dc662..f80907ce4 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/IndexEntryTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/IndexEntryTest.java index daea3d243..4720db5cd 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/IndexEntryTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cpe/IndexEntryTest.java @@ -1,31 +1,29 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.cpe; -import org.owasp.dependencycheck.data.cpe.IndexEntry; import junit.framework.TestCase; import org.junit.After; import org.junit.AfterClass; +import org.junit.Assert; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import org.junit.Assert; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cwe/CweDBTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cwe/CweDBTest.java index f804dc341..dd4572f96 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cwe/CweDBTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/cwe/CweDBTest.java @@ -1,30 +1,28 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.cwe; -import org.owasp.dependencycheck.data.cwe.CweDB; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * @@ -52,8 +50,8 @@ public class CweDBTest { } /** - * Method to serialize the CWE HashMap. This is not used in production; this - * is only used once during dev to create the serialized HashMap. + * Method to serialize the CWE HashMap. This is not used in production; this is only used once during dev to create + * the serialized HashMap. */ // @Test // public void testUpdate() throws Exception { diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java index dcbe4e8bc..6fae2382f 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java @@ -1,50 +1,48 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.lucene; -import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer; -import org.owasp.dependencycheck.data.lucene.FieldAnalyzer; -import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper; -import java.util.HashMap; -import org.apache.lucene.queryparser.classic.QueryParser; -import org.apache.lucene.analysis.standard.StandardAnalyzer; -import org.apache.lucene.analysis.Analyzer; -import org.apache.lucene.search.ScoreDoc; -import org.apache.lucene.search.TopScoreDocCollector; -import org.apache.lucene.search.IndexSearcher; -import org.apache.lucene.index.IndexReader; -import org.apache.lucene.search.Query; import java.io.IOException; +import java.util.HashMap; +import org.apache.lucene.analysis.Analyzer; +import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper; +import org.apache.lucene.analysis.standard.StandardAnalyzer; +import org.apache.lucene.document.Document; import org.apache.lucene.document.Field; import org.apache.lucene.document.TextField; -import org.apache.lucene.document.Document; import org.apache.lucene.index.DirectoryReader; +import org.apache.lucene.index.IndexReader; import org.apache.lucene.index.IndexWriter; import org.apache.lucene.index.IndexWriterConfig; -import org.apache.lucene.store.RAMDirectory; +import org.apache.lucene.queryparser.classic.QueryParser; +import org.apache.lucene.search.IndexSearcher; +import org.apache.lucene.search.Query; +import org.apache.lucene.search.ScoreDoc; +import org.apache.lucene.search.TopScoreDocCollector; import org.apache.lucene.store.Directory; +import org.apache.lucene.store.RAMDirectory; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.java index b4b2ef1fc..4a9b5c027 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.java @@ -1,30 +1,28 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.lucene; -import org.owasp.dependencycheck.data.lucene.LuceneUtils; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.java index 4dea374fc..e85b2bea2 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.java @@ -1,22 +1,37 @@ /* - * To change this template, choose Tools | Templates - * and open the template in the editor. + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.lucene; import java.io.IOException; import java.io.StringReader; import org.apache.lucene.analysis.BaseTokenStreamTestCase; +import static org.apache.lucene.analysis.BaseTokenStreamTestCase.assertTokenStreamContents; import org.apache.lucene.analysis.TokenStream; import org.apache.lucene.analysis.Tokenizer; import org.apache.lucene.analysis.core.WhitespaceTokenizer; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.apache.lucene.analysis.BaseTokenStreamTestCase.assertTokenStreamContents; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java index 9424f6bba..cd13e0e15 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java @@ -1,6 +1,19 @@ /* - * To change this template, choose Tools | Templates - * and open the template in the editor. + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.lucene; diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nexus/NexusSearchTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nexus/NexusSearchTest.java index e19fab5a2..c83d06701 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nexus/NexusSearchTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nexus/NexusSearchTest.java @@ -1,17 +1,34 @@ +/* + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ package org.owasp.dependencycheck.data.nexus; import java.io.FileNotFoundException; import java.net.URL; import java.util.logging.Logger; - -import static org.junit.Assert.*; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; import org.junit.Before; import org.junit.Ignore; import org.junit.Test; - import org.owasp.dependencycheck.utils.Settings; public class NexusSearchTest { + private static final Logger LOGGER = Logger.getLogger(NexusSearchTest.class.getName()); private NexusSearch searcher; @@ -21,7 +38,7 @@ public class NexusSearchTest { LOGGER.fine(nexusUrl); searcher = new NexusSearch(new URL(nexusUrl)); } - + @Test(expected = IllegalArgumentException.class) public void testNullSha1() throws Exception { searcher.searchSha1(null); @@ -35,7 +52,8 @@ public class NexusSearchTest { // This test does generate network traffic and communicates with a host // you may not be able to reach. Remove the @Ignore annotation if you want to // test it anyway - @Ignore @Test + @Ignore + @Test public void testValidSha1() throws Exception { MavenArtifact ma = searcher.searchSha1("9977a8d04e75609cf01badc4eb6a9c7198c4c5ea"); assertEquals("Incorrect group", "org.apache.maven.plugins", ma.getGroupId()); @@ -47,7 +65,8 @@ public class NexusSearchTest { // This test does generate network traffic and communicates with a host // you may not be able to reach. Remove the @Ignore annotation if you want to // test it anyway - @Ignore @Test(expected = FileNotFoundException.class) + @Ignore + @Test(expected = FileNotFoundException.class) public void testMissingSha1() throws Exception { searcher.searchSha1("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java index ec9423e06..db36bd613 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.java index be0db2ac0..b1873cfc0 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBTest.java index af8a513d5..3c348daeb 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/CveDBTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -20,7 +19,6 @@ package org.owasp.dependencycheck.data.nvdcve; import java.util.List; import java.util.Set; - import org.junit.After; import org.junit.AfterClass; import org.junit.Before; diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.java index 4008a189d..f613265f0 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.java @@ -1,31 +1,28 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.nvdcve; -import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; -import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.owasp.dependencycheck.data.update.NvdCveInfo; /** diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.java index 3ab599ec1..7059fcc5d 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2014 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveInfoTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveInfoTest.java index 182389bf7..097d2dcc2 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveInfoTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveInfoTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -20,10 +19,10 @@ package org.owasp.dependencycheck.data.update; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * Rigorous test of setters/getters. diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.java index 605c7d3ce..ca1f1a080 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.java index 0f8f4139f..bd4aa1074 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.java @@ -1,33 +1,32 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update; -import org.owasp.dependencycheck.data.update.exception.UpdateException; - import java.net.MalformedURLException; import java.util.Calendar; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNotNull; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; +import org.owasp.dependencycheck.data.update.exception.UpdateException; import org.owasp.dependencycheck.utils.DownloadFailedException; /** diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.java index 9ca21fcd0..9e2edfda5 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -23,10 +22,12 @@ import java.io.IOException; import java.net.MalformedURLException; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; import org.owasp.dependencycheck.utils.DownloadFailedException; /** diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.java index 4b4f70fe5..178211569 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.java @@ -1,36 +1,34 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update.xml; -import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; import java.io.File; import java.util.List; import java.util.Map; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; -import org.owasp.dependencycheck.dependency.VulnerableSoftware; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; +import org.owasp.dependencycheck.dependency.VulnerableSoftware; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.java index 75f39460f..b326ebf55 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.java @@ -1,33 +1,31 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.update.xml; -import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; import java.io.File; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/DependencyTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/DependencyTest.java index 471f149ef..646f583b9 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/DependencyTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/DependencyTest.java @@ -1,36 +1,32 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.dependency; -import java.util.Set; -import org.owasp.dependencycheck.dependency.EvidenceCollection; -import org.owasp.dependencycheck.dependency.Identifier; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Evidence; import java.io.File; import java.util.List; +import java.util.Set; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java index 9eece14eb..e4d0e907d 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -20,10 +19,10 @@ package org.owasp.dependencycheck.dependency; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorTest.java index 0328fd96d..4182f6c2d 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorTest.java @@ -1,37 +1,35 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.reporting; -import org.owasp.dependencycheck.Engine; -import org.junit.After; -import org.junit.AfterClass; -import org.junit.Before; -import org.junit.BeforeClass; -import org.junit.Test; - +import java.io.File; +import java.io.InputStream; import javax.xml.XMLConstants; import javax.xml.transform.stream.StreamSource; import javax.xml.validation.Schema; import javax.xml.validation.SchemaFactory; import javax.xml.validation.Validator; -import java.io.File; -import java.io.InputStream; +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Before; +import org.junit.BeforeClass; +import org.junit.Test; +import org.owasp.dependencycheck.Engine; /** * @@ -117,8 +115,9 @@ public class ReportGeneratorTest { } /** - * Generates an XML report containing known vulnerabilities and realistic - * data and validates the generated XML document against the XSD. + * Generates an XML report containing known vulnerabilities and realistic data and validates the generated XML + * document against the XSD. + * * @throws Exception */ @Test @@ -146,7 +145,7 @@ public class ReportGeneratorTest { InputStream xsdStream = ReportGenerator.class.getClassLoader().getResourceAsStream("schema/DependencyCheck.xsd"); StreamSource xsdSource = new StreamSource(xsdStream); - StreamSource xmlSource = new StreamSource(new File(writeTo)); + StreamSource xmlSource = new StreamSource(new File(writeTo)); SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); Schema schema = sf.newSchema(xsdSource); Validator validator = schema.newValidator(); diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/PropertyTypeTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/PropertyTypeTest.java index 3bb31b1f6..972f26001 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/PropertyTypeTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/PropertyTypeTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -20,10 +19,12 @@ package org.owasp.dependencycheck.suppression; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.java index 2b555fc54..bc38b3d6d 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionParserTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionParserTest.java index 38b49bcd8..fd6c0e930 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionParserTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionParserTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -22,10 +21,10 @@ import java.io.File; import java.util.List; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * Test of the suppression parser. diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java index 314706832..4ca3948a8 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ @@ -23,10 +22,12 @@ import java.util.ArrayList; import java.util.List; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.dependency.Identifier; import org.owasp.dependencycheck.dependency.Vulnerability; diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java index 3cbc9489d..5bd82b9b8 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java @@ -1,24 +1,22 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; -import org.owasp.dependencycheck.utils.Checksum; import java.io.File; import java.io.IOException; import java.security.NoSuchAlgorithmException; @@ -74,8 +72,8 @@ public class ChecksumTest { } /** - * Test of getChecksum method, of class Checksum. This checks that an - * exception is thrown when an invalid path is specified. + * Test of getChecksum method, of class Checksum. This checks that an exception is thrown when an invalid path is + * specified. * * @throws Exception is thrown when an exception occurs. */ @@ -93,8 +91,8 @@ public class ChecksumTest { } /** - * Test of getChecksum method, of class Checksum. This checks that an - * exception is thrown when an invalid algorithm is specified. + * Test of getChecksum method, of class Checksum. This checks that an exception is thrown when an invalid algorithm + * is specified. * * @throws Exception is thrown when an exception occurs. */ diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionTest.java index 311da9a98..62e4b4397 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionTest.java @@ -1,6 +1,19 @@ /* - * To change this template, choose Tools | Templates - * and open the template in the editor. + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; @@ -8,10 +21,12 @@ import java.util.Iterator; import java.util.List; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertArrayEquals; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * @@ -59,7 +74,6 @@ public class DependencyVersionTest { assertEquals("0", parts.get(1)); //assertEquals("0", parts.get(2)); - } /** diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.java index ad288e78f..9cb022a06 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -20,10 +19,11 @@ package org.owasp.dependencycheck.utils; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertNull; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.java index 7e55c01be..f44dbfd07 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.java @@ -1,33 +1,30 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; import java.io.File; -import org.owasp.dependencycheck.utils.Settings; -import org.owasp.dependencycheck.utils.Downloader; import java.net.URL; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * @@ -62,7 +59,6 @@ public class DownloaderIntegrationTest { // Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, "1000"); // Settings.setString(Settings.KEYS.PROXY_PORT, "8080"); // Settings.setString(Settings.KEYS.PROXY_URL, "127.0.0.1"); - URL url = new URL(Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL)); File outputPath = new File("target/downloaded_cve.xml"); Downloader.fetchFile(url, outputPath); diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderTest.java index a2792fcca..b04fee4c0 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DownloaderTest.java @@ -1,32 +1,30 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; import java.io.File; -import org.owasp.dependencycheck.utils.Downloader; import java.net.URL; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FileUtilsTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FileUtilsTest.java index 71c8d3bee..bf23a3af3 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FileUtilsTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FileUtilsTest.java @@ -1,18 +1,17 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -21,10 +20,12 @@ package org.owasp.dependencycheck.utils; import java.io.File; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.fail; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java index 0b3cc4006..6441d6ab6 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java @@ -1,32 +1,32 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; -import org.owasp.dependencycheck.utils.Filter; -import java.util.List; import java.util.ArrayList; +import java.util.List; import org.junit.After; import org.junit.AfterClass; +import static org.junit.Assert.assertArrayEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; -import static org.junit.Assert.*; /** * @@ -85,10 +85,10 @@ public class FilterTest { } assertArrayEquals(expResults.toArray(), actResults.toArray()); } - private static final Filter TEST_FILTER = - new Filter() { - public boolean passes(String str) { - return str.contains("keep"); - } - }; + private static final Filter TEST_FILTER + = new Filter() { + public boolean passes(String str) { + return str.contains("keep"); + } + }; } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java index 8e3a68bae..1980cc2c3 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java @@ -1,25 +1,22 @@ /* * This file is part of dependency-check-core. * - * Dependency-check-core is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation, either version 3 of the License, or (at your option) any - * later version. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at * - * Dependency-check-core is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. + * http://www.apache.org/licenses/LICENSE-2.0 * - * You should have received a copy of the GNU General Public License along with - * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; -import org.owasp.dependencycheck.utils.InvalidSettingException; -import org.owasp.dependencycheck.utils.Settings; import java.io.File; import java.io.IOException; import java.net.URISyntaxException;