diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
index 3c8a67471..3cf7d6c0c 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
@@ -112,7 +112,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
while (subIterator.hasNext()) {
final Dependency nextDependency = subIterator.next();
if (hashesMatch(dependency, nextDependency)) {
- if (isCore(dependency, nextDependency)) {
+ if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) {
mergeDependencies(dependency, nextDependency, dependenciesToRemove);
} else {
mergeDependencies(nextDependency, dependency, dependenciesToRemove);
@@ -390,4 +390,43 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
return false;
}
+
+ /**
+ * Determines which path is shortest; if path lengths are equal then we use compareTo of the string method to
+ * determine if the first path is smaller.
+ *
+ * @param leftPath the first path to compare
+ * @param rightPath the second path to compare
+ * @return true if the leftPath is the shortest; otherwise false
+ */
+ protected boolean firstPathIsShortest(String leftPath, String rightPath) {
+ leftPath = leftPath.replace('\\', '/');
+ rightPath = rightPath.replace('\\', '/');
+
+ int leftCount = countChar(leftPath, '/');
+ int rightCount = countChar(rightPath, '/');
+ if (leftCount == rightCount) {
+ return leftPath.compareTo(rightPath) <= 0;
+ } else {
+ return leftCount < rightCount;
+ }
+ }
+
+ /**
+ * Counts the number of times the character is present in the string.
+ *
+ * @param string the string to count the characters in
+ * @param c the character to count
+ * @return the number of times the character is present in the string
+ */
+ private int countChar(String string, char c) {
+ int count = 0;
+ int max = string.length();
+ for (int i = 0; i < max; i++) {
+ if (c == string.charAt(i)) {
+ count++;
+ }
+ }
+ return count;
+ }
}