github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-01-14 07:43:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated to fix issue #31

Browse Source 
Former-commit-id: 569d1aee14d0f51a990e0cc059dce5aa500f10b2
This commit is contained in:
Jeremy Long
2014-01-17 19:43:01 -05:00
parent fdca41a71b
commit cb53ddf8a8
1 changed files with 62 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
View File

@@ -127,29 +127,20 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
while (subIterator.hasNext()) {
final Dependency nextDependency = subIterator.next();
if (identifiersMatch(dependency, nextDependency)
if (hashesMatch(dependency, nextDependency)) {
if (isCore(dependency, nextDependency)) {
mergeDependencies(dependency, nextDependency, dependenciesToRemove);
} else {
mergeDependencies(nextDependency, dependency, dependenciesToRemove);
}
} else if (identifiersMatch(dependency, nextDependency)
&& hasSameBasePath(dependency, nextDependency)
&& fileNameMatch(dependency, nextDependency)) {
if (isCore(dependency, nextDependency)) {
dependency.addRelatedDependency(nextDependency);
//move any "related dependencies" to the new "parent" dependency
final Iterator<Dependency> i = nextDependency.getRelatedDependencies().iterator();
while (i.hasNext()) {
dependency.addRelatedDependency(i.next());
i.remove();
}
dependenciesToRemove.add(nextDependency);
mergeDependencies(dependency, nextDependency, dependenciesToRemove);
} else {
nextDependency.addRelatedDependency(dependency);
//move any "related dependencies" to the new "parent" dependency
final Iterator<Dependency> i = dependency.getRelatedDependencies().iterator();
while (i.hasNext()) {
nextDependency.addRelatedDependency(i.next());
i.remove();
}
dependenciesToRemove.add(dependency);
mergeDependencies(nextDependency, dependency, dependenciesToRemove);
}
}
}
@@ -163,6 +154,23 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
}
/**
* Adds the relatedDependency to the dependency's related dependencies.
*
* @param dependency the main dependency
* @param nextDependency the related dependency
* @param relatedDependency a collection of dependencies to be removed from the main analysis loop
*/
private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
dependency.addRelatedDependency(relatedDependency);
final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
while (i.hasNext()) {
dependency.addRelatedDependency(i.next());
i.remove();
}
dependenciesToRemove.add(relatedDependency);
}
/**
* Attempts to trim a maven repo to a common base path. This is typically
* [drive]\[repo_location]\repository\[path1]\[path2].
@@ -286,7 +294,16 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
left = getBaseRepoPath(left);
right = getBaseRepoPath(right);
}
return left.equalsIgnoreCase(right);
if (left.equalsIgnoreCase(right)) {
return true;
}
//new code
for (Dependency child : dependency2.getRelatedDependencies()) {
if (hasSameBasePath(dependency1, child)) {
return true;
}
}
return false;
}
/**
@@ -297,13 +314,22 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
* @param right the dependency to test against
* @return a boolean indicating whether or not the left dependency should be considered the "core" version.
*/
private boolean isCore(Dependency left, Dependency right) {
boolean isCore(Dependency left, Dependency right) {
final String leftName = left.getFileName().toLowerCase();
final String rightName = right.getFileName().toLowerCase();
if (leftName.equals("struts-1.2.7.jar") || rightName.equals("struts-1.2.7.jar")) {
String pause = "pause";
}
final boolean returnVal;
if (rightName.contains("core") && !leftName.contains("core")) {
if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
|| rightName.contains("core") && !leftName.contains("core")
|| rightName.contains("kernel") && !leftName.contains("kernel")) {
returnVal = false;
} else if (!rightName.contains("core") && leftName.contains("core")) {
} else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
|| !rightName.contains("core") && leftName.contains("core")
|| !rightName.contains("kernel") && leftName.contains("kernel")) {
returnVal = true;
} else {
/*
@@ -323,4 +349,18 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
return returnVal;
}
/**
* Compares the SHA1 hashes of two dependencies to determine if they are equal.
*
* @param dependency1 a dependency object to compare
* @param dependency2 a dependency object to compare
* @return true if the sha1 hashes of the two dependencies match; otherwise false
*/
private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) {
return false;
}
return dependency1.getSha1sum().equals(dependency2.getSha1sum());
}
}