From bee4d3a33856b280916038dbfa5c68eb561158b8 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 14 Jun 2014 07:04:02 -0400 Subject: [PATCH] fixed bug that left false positive, previously fixed, due to the file name modifications that the archive analyzer makes - regex needed updating to not just look for the start of the filename Former-commit-id: 922a9edaf9123524585b97e6cb9f8efd4a389031 --- .../analyzer/FalsePositiveAnalyzer.java | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java index 76078e19c..20f8c3f41 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java @@ -161,11 +161,20 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { */ public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" - + "jdk|jre|jsf|jsse)($|:.*)"); + + "jdk|jre|jsse)($|:.*)"); + + /** + * Regex to identify core jsf libraries. + */ + public static final Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)"); /** * Regex to identify core java library files. This is currently incomplete. */ - public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); + public static final Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); + /** + * Regex to identify core jsf java library files. This is currently incomplete. + */ + public static final Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$"); /** * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar @@ -182,6 +191,11 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { if (coreCPE.matches() && !coreFiles.matches()) { itr.remove(); } + final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue()); + final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName()); + if (coreJsfCPE.matches() && !coreJsfFiles.matches()) { + itr.remove(); + } } }