github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-21 08:39:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

Node.js Analyzer: Switched from org.json to Glassfish JSR 353 reference implementation.

Browse Source
This commit is contained in:
Dale Visser
2015-08-25 17:28:17 -04:00
parent 9e25480baa
commit c60245ea2b
3 changed files with 25 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
dependency-check-core/pom.xml
View File

@@ -440,8 +440,8 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
<artifactId>h2</artifactId> <artifactId>h2</artifactId>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.json</groupId> <groupId>org.glassfish</groupId>
<artifactId>json</artifactId> <artifactId>javax.json</artifactId>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.jsoup</groupId> <groupId>org.jsoup</groupId>

38
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
View File

@@ -18,8 +18,6 @@
package org.owasp.dependencycheck.analyzer; package org.owasp.dependencycheck.analyzer;
import org.apache.commons.io.FileUtils; import org.apache.commons.io.FileUtils;
import org.json.JSONException;
import org.json.JSONObject;
import org.owasp.dependencycheck.Engine; import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException; import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence; import org.owasp.dependencycheck.dependency.Confidence;
@@ -30,6 +28,7 @@ import org.owasp.dependencycheck.utils.Settings;
import org.slf4j.Logger; import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
import javax.json.*;
import java.io.File; import java.io.File;
import java.io.FileFilter; import java.io.FileFilter;
import java.io.IOException; import java.io.IOException;
@@ -113,22 +112,23 @@ public class NodePackageAnalyzer extends AbstractFileTypeAnalyzer {
protected void analyzeFileType(Dependency dependency, Engine engine) protected void analyzeFileType(Dependency dependency, Engine engine)
throws AnalysisException { throws AnalysisException {
final File file = dependency.getActualFile(); final File file = dependency.getActualFile();
String contents; JsonReader jsonReader;
try { try {
contents = FileUtils.readFileToString(file).trim(); jsonReader = Json.createReader(FileUtils.openInputStream(file));
} catch (IOException e) { } catch (IOException e) {
throw new AnalysisException( throw new AnalysisException(
"Problem occurred while reading dependency file.", e); "Problem occurred while reading dependency file.", e);
} }
try { try {
JSONObject json = new JSONObject(contents); JsonObject json = jsonReader.readObject();
final EvidenceCollection productEvidence = dependency.getProductEvidence(); final EvidenceCollection productEvidence = dependency.getProductEvidence();
final EvidenceCollection vendorEvidence = dependency.getVendorEvidence(); final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
if (json.has("name")) { if (json.containsKey("name")) {
Object value = json.get("name"); Object value = json.get("name");
if (value instanceof String) { if (value instanceof JsonString) {
productEvidence.addEvidence(PACKAGE_JSON, "name", (String) value, Confidence.HIGHEST); String valueString = ((JsonString) value).getString();
vendorEvidence.addEvidence(PACKAGE_JSON, "name_project", String.format("%s_project", value), Confidence.LOW); productEvidence.addEvidence(PACKAGE_JSON, "name", valueString, Confidence.HIGHEST);
vendorEvidence.addEvidence(PACKAGE_JSON, "name_project", String.format("%s_project", valueString), Confidence.LOW);
} else { } else {
LOGGER.warn("JSON value not string as expected: %s", value); LOGGER.warn("JSON value not string as expected: %s", value);
} }
@@ -137,24 +137,26 @@ public class NodePackageAnalyzer extends AbstractFileTypeAnalyzer {
addToEvidence(json, vendorEvidence, "author"); addToEvidence(json, vendorEvidence, "author");
addToEvidence(json, dependency.getVersionEvidence(), "version"); addToEvidence(json, dependency.getVersionEvidence(), "version");
dependency.setDisplayFileName(String.format("%s/%s", file.getParentFile().getName(), file.getName())); dependency.setDisplayFileName(String.format("%s/%s", file.getParentFile().getName(), file.getName()));
} catch (JSONException e) { } catch (JsonException e) {
LOGGER.warn("Failed to parse package.json file.", e); LOGGER.warn("Failed to parse package.json file.", e);
} finally {
jsonReader.close();
} }
} }
private void addToEvidence(JSONObject json, EvidenceCollection collection, String key) { private void addToEvidence(JsonObject json, EvidenceCollection collection, String key) {
if (json.has(key)) { if (json.containsKey(key)) {
Object value = json.get(key); Object value = json.get(key);
if (value instanceof String) { if (value instanceof JsonString) {
collection.addEvidence(PACKAGE_JSON, key, (String) value, Confidence.HIGHEST); collection.addEvidence(PACKAGE_JSON, key, ((JsonString) value).getString(), Confidence.HIGHEST);
} else if (value instanceof JSONObject) { } else if (value instanceof JsonObject) {
final JSONObject jsonObject = (JSONObject) value; final JsonObject jsonObject = (JsonObject) value;
for (String property : jsonObject.keySet()) { for (String property : jsonObject.keySet()) {
final Object subValue = jsonObject.get(property); final Object subValue = jsonObject.get(property);
if (subValue instanceof String) { if (subValue instanceof JsonString) {
collection.addEvidence(PACKAGE_JSON, collection.addEvidence(PACKAGE_JSON,
String.format("%s.%s", key, property), String.format("%s.%s", key, property),
(String) subValue, ((JsonString) subValue).getString(),
Confidence.HIGHEST); Confidence.HIGHEST);
} else { } else {
LOGGER.warn("JSON sub-value not string as expected: %s"); LOGGER.warn("JSON sub-value not string as expected: %s");

6
pom.xml
View File

@@ -522,9 +522,9 @@ Copyright (c) 2012 - Jeremy Long
<version>1.7</version> <version>1.7</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.json</groupId> <groupId>org.glassfish</groupId>
<artifactId>json</artifactId> <artifactId>javax.json</artifactId>
<version>20141113</version> <version>1.0.4</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.hamcrest</groupId> <groupId>org.hamcrest</groupId>