fixed NPE issues

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java

@@ -209,10 +209,12 @@ public final class CpeMemoryIndex {
 
                 final Set<Pair<String, String>> data = cve.getVendorProductList();
                 for (Pair<String, String> pair : data) {
-                    v.setStringValue(pair.getLeft());
+                    if (pair.getLeft() != null && pair.getRight() != null) {
-                    p.setStringValue(pair.getRight());
+                        v.setStringValue(pair.getLeft());
-                    indexWriter.addDocument(doc);
+                        p.setStringValue(pair.getRight());
-                    resetFieldAnalyzer();
+                        indexWriter.addDocument(doc);
+                        resetFieldAnalyzer();
+                    }
                 }
             } catch (DatabaseException ex) {
                 LOGGER.debug("", ex);

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java

@@ -77,10 +77,10 @@ public class NvdCveUpdater extends BaseUpdater implements CachedWebDataSource {
             }
             if (autoUpdate && checkUpdate()) {
                 final UpdateableNvdCve updateable = getUpdatesNeeded();
-                getProperties().save(DatabaseProperties.LAST_CHECKED, Long.toString(System.currentTimeMillis()));
                 if (updateable.isUpdateNeeded()) {
                     performUpdate(updateable);
                 }
+                getProperties().save(DatabaseProperties.LAST_CHECKED, Long.toString(System.currentTimeMillis()));
             }
         } catch (MalformedURLException ex) {
             throw new UpdateException("NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data.", ex);
@@ -156,93 +156,86 @@ public class NvdCveUpdater extends BaseUpdater implements CachedWebDataSource {
      * @throws UpdateException is thrown if there is an error updating the
      * database
      */
-    public void performUpdate(UpdateableNvdCve updateable) throws UpdateException {
+    private void performUpdate(UpdateableNvdCve updateable) throws UpdateException {
         int maxUpdates = 0;
-        try {
+        for (NvdCveInfo cve : updateable) {
-            for (NvdCveInfo cve : updateable) {
+            if (cve.getNeedsUpdate()) {
-                if (cve.getNeedsUpdate()) {
+                maxUpdates += 1;
-                    maxUpdates += 1;
+            }
+        }
+        if (maxUpdates <= 0) {
+            return;
+        }
+        if (maxUpdates > 3) {
+            LOGGER.info("NVD CVE requires several updates; this could take a couple of minutes.");
+        }
+
+        final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates;
+
+        final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize);
+        final ExecutorService processExecutor = Executors.newSingleThreadExecutor();
+        final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
+        for (NvdCveInfo cve : updateable) {
+            if (cve.getNeedsUpdate()) {
+                final DownloadTask call = new DownloadTask(cve, processExecutor, getCveDB(), Settings.getInstance());
+                downloadFutures.add(downloadExecutors.submit(call));
+            }
+        }
+        downloadExecutors.shutdown();
+
+        //next, move the future future processTasks to just future processTasks
+        final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates);
+        for (Future<Future<ProcessTask>> future : downloadFutures) {
+            Future<ProcessTask> task = null;
+            try {
+                task = future.get();
+            } catch (InterruptedException ex) {
+                downloadExecutors.shutdownNow();
+                processExecutor.shutdownNow();
+
+                LOGGER.debug("Thread was interrupted during download", ex);
+                throw new UpdateException("The download was interrupted", ex);
+            } catch (ExecutionException ex) {
+                downloadExecutors.shutdownNow();
+                processExecutor.shutdownNow();
+
+                LOGGER.debug("Thread was interrupted during download execution", ex);
+                throw new UpdateException("The execution of the download was interrupted", ex);
+            }
+            if (task == null) {
+                downloadExecutors.shutdownNow();
+                processExecutor.shutdownNow();
+                LOGGER.debug("Thread was interrupted during download");
+                throw new UpdateException("The download was interrupted; unable to complete the update");
+            } else {
+                processFutures.add(task);
+            }
+        }
+
+        for (Future<ProcessTask> future : processFutures) {
+            try {
+                final ProcessTask task = future.get();
+                if (task.getException() != null) {
+                    throw task.getException();
                 }
+            } catch (InterruptedException ex) {
+                processExecutor.shutdownNow();
+                LOGGER.debug("Thread was interrupted during processing", ex);
+                throw new UpdateException(ex);
+            } catch (ExecutionException ex) {
+                processExecutor.shutdownNow();
+                LOGGER.debug("Execution Exception during process", ex);
+                throw new UpdateException(ex);
+            } finally {
+                processExecutor.shutdown();
             }
-            if (maxUpdates <= 0) {
+        }
-                return;
-            }
-            if (maxUpdates > 3) {
-                LOGGER.info("NVD CVE requires several updates; this could take a couple of minutes.");
-            }
-            if (maxUpdates > 0) {
-                openDataStores();
-            }
 
-            final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates;
+        if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it)
-
+            getProperties().save(updateable.get(MODIFIED));
-            final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize);
+            LOGGER.info("Begin database maintenance.");
-            final ExecutorService processExecutor = Executors.newSingleThreadExecutor();
+            getCveDB().cleanupDatabase();
-            final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
+            LOGGER.info("End database maintenance.");
-            for (NvdCveInfo cve : updateable) {
-                if (cve.getNeedsUpdate()) {
-                    final DownloadTask call = new DownloadTask(cve, processExecutor, getCveDB(), Settings.getInstance());
-                    downloadFutures.add(downloadExecutors.submit(call));
-                }
-            }
-            downloadExecutors.shutdown();
-
-            //next, move the future future processTasks to just future processTasks
-            final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates);
-            for (Future<Future<ProcessTask>> future : downloadFutures) {
-                Future<ProcessTask> task = null;
-                try {
-                    task = future.get();
-                } catch (InterruptedException ex) {
-                    downloadExecutors.shutdownNow();
-                    processExecutor.shutdownNow();
-
-                    LOGGER.debug("Thread was interrupted during download", ex);
-                    throw new UpdateException("The download was interrupted", ex);
-                } catch (ExecutionException ex) {
-                    downloadExecutors.shutdownNow();
-                    processExecutor.shutdownNow();
-
-                    LOGGER.debug("Thread was interrupted during download execution", ex);
-                    throw new UpdateException("The execution of the download was interrupted", ex);
-                }
-                if (task == null) {
-                    downloadExecutors.shutdownNow();
-                    processExecutor.shutdownNow();
-                    LOGGER.debug("Thread was interrupted during download");
-                    throw new UpdateException("The download was interrupted; unable to complete the update");
-                } else {
-                    processFutures.add(task);
-                }
-            }
-
-            for (Future<ProcessTask> future : processFutures) {
-                try {
-                    final ProcessTask task = future.get();
-                    if (task.getException() != null) {
-                        throw task.getException();
-                    }
-                } catch (InterruptedException ex) {
-                    processExecutor.shutdownNow();
-                    LOGGER.debug("Thread was interrupted during processing", ex);
-                    throw new UpdateException(ex);
-                } catch (ExecutionException ex) {
-                    processExecutor.shutdownNow();
-                    LOGGER.debug("Execution Exception during process", ex);
-                    throw new UpdateException(ex);
-                } finally {
-                    processExecutor.shutdown();
-                }
-            }
-
-            if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it)
-                getProperties().save(updateable.get(MODIFIED));
-                LOGGER.info("Begin database maintenance.");
-                getCveDB().cleanupDatabase();
-                LOGGER.info("End database maintenance.");
-            }
-        } finally {
-            closeDataStores();
         }
     }
 

dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Reference.java

@@ -18,6 +18,7 @@
 package org.owasp.dependencycheck.dependency;
 
 import java.io.Serializable;
+import org.apache.commons.lang3.builder.CompareToBuilder;
 
 /**
  * An external reference for a vulnerability. This contains a name, URL, and a
@@ -141,18 +142,10 @@ public class Reference implements Serializable, Comparable<Reference> {
      */
     @Override
     public int compareTo(Reference o) {
-        if (source.equals(o.source)) {
+        return new CompareToBuilder()
-            if (name.equals(o.name)) {
+                .append(source, o.source)
-                if (url.equals(o.url)) {
+                .append(name, o.name)
-                    return 0; //they are equal
+                .append(url, o.url)
-                } else {
+                .toComparison();
-                    return url.compareTo(o.url);
-                }
-            } else {
-                return name.compareTo(o.name);
-            }
-        } else {
-            return source.compareTo(o.source);
-        }
     }
 }

dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.java

@@ -183,12 +183,17 @@ public class CPEAnalyzerIntegrationTest extends BaseDBTestCase {
         hintAnalyzer.analyze(spring3, null);
 
         CPEAnalyzer instance = new CPEAnalyzer();
+        try {
         instance.open();
         instance.determineCPE(commonValidator);
         instance.determineCPE(struts);
         instance.determineCPE(spring);
         instance.determineCPE(spring3);
         instance.close();
+        } catch (Throwable ex) {
+            ex.printStackTrace();
+        }
+                
 
         String expResult = "cpe:/a:apache:struts:2.1.2";
         Identifier expIdentifier = new Identifier("cpe", expResult, expResult);

dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.java

@@ -40,12 +40,11 @@ public class NvdCveUpdaterIntegrationTest extends BaseTest {
 //    /**
 //     * Test of update method, of class StandardUpdate.
 //     */
-//    @Test
+    @Test
-//    public void testUpdate() throws Exception {
+    public void testUpdate() throws Exception {
-//        StandardUpdate instance = getStandardUpdateTask();
+        NvdCveUpdater instance = getUpdater();
-//        instance.update();
+        instance.update();
-//        //TODO make this an actual test
+    }
-//    }
     /**
      * Test of updatesNeeded method, of class StandardUpdate.
      */