diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java index 3c8a67471..3cf7d6c0c 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java @@ -112,7 +112,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal while (subIterator.hasNext()) { final Dependency nextDependency = subIterator.next(); if (hashesMatch(dependency, nextDependency)) { - if (isCore(dependency, nextDependency)) { + if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) { mergeDependencies(dependency, nextDependency, dependenciesToRemove); } else { mergeDependencies(nextDependency, dependency, dependenciesToRemove); @@ -390,4 +390,43 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal } return false; } + + /** + * Determines which path is shortest; if path lengths are equal then we use compareTo of the string method to + * determine if the first path is smaller. + * + * @param leftPath the first path to compare + * @param rightPath the second path to compare + * @return true if the leftPath is the shortest; otherwise false + */ + protected boolean firstPathIsShortest(String leftPath, String rightPath) { + leftPath = leftPath.replace('\\', '/'); + rightPath = rightPath.replace('\\', '/'); + + int leftCount = countChar(leftPath, '/'); + int rightCount = countChar(rightPath, '/'); + if (leftCount == rightCount) { + return leftPath.compareTo(rightPath) <= 0; + } else { + return leftCount < rightCount; + } + } + + /** + * Counts the number of times the character is present in the string. + * + * @param string the string to count the characters in + * @param c the character to count + * @return the number of times the character is present in the string + */ + private int countChar(String string, char c) { + int count = 0; + int max = string.length(); + for (int i = 0; i < max; i++) { + if (c == string.charAt(i)) { + count++; + } + } + return count; + } }