From bee4d3a33856b280916038dbfa5c68eb561158b8 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 14 Jun 2014 07:04:02 -0400 Subject: [PATCH 01/61] fixed bug that left false positive, previously fixed, due to the file name modifications that the archive analyzer makes - regex needed updating to not just look for the start of the filename Former-commit-id: 922a9edaf9123524585b97e6cb9f8efd4a389031 --- .../analyzer/FalsePositiveAnalyzer.java | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java index 76078e19c..20f8c3f41 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java @@ -161,11 +161,20 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { */ public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" - + "jdk|jre|jsf|jsse)($|:.*)"); + + "jdk|jre|jsse)($|:.*)"); + + /** + * Regex to identify core jsf libraries. + */ + public static final Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)"); /** * Regex to identify core java library files. This is currently incomplete. */ - public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); + public static final Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); + /** + * Regex to identify core jsf java library files. This is currently incomplete. + */ + public static final Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$"); /** * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar @@ -182,6 +191,11 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { if (coreCPE.matches() && !coreFiles.matches()) { itr.remove(); } + final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue()); + final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName()); + if (coreJsfCPE.matches() && !coreJsfFiles.matches()) { + itr.remove(); + } } } From acbce05fbf4372a212a50a42f1032c1129e7e482 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 20 Jun 2014 06:47:46 -0400 Subject: [PATCH 02/61] updated to support suppression by maven coordinates (GAV) per issue #124 Former-commit-id: 3cff74ded9b0c352fb1d45e784d89c3c20f55467 --- .../suppression/SuppressionRule.java | 78 +++++++++++++++---- .../src/main/resources/schema/suppression.xsd | 1 + .../suppression/SuppressionRuleTest.java | 24 +++--- 3 files changed, 76 insertions(+), 27 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java index b039cb3f4..a0e94f3f2 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java @@ -234,6 +234,37 @@ public class SuppressionRule { public boolean hasCve() { return cve.size() > 0; } + /** + * A Maven GAV to suppression. + */ + private PropertyType gav = null; + + /** + * Get the value of Maven GAV. + * + * @return the value of gav + */ + public PropertyType getGav() { + return gav; + } + + /** + * Set the value of Maven GAV. + * + * @param gav new value of Maven gav + */ + public void setGav(PropertyType gav) { + this.gav = gav; + } + + /** + * Returns whether or not this suppression rule as GAV entries. + * + * @return whether or not this suppression rule as GAV entries + */ + public boolean hasGav() { + return gav != null; + } /** * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any @@ -248,12 +279,27 @@ public class SuppressionRule { if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) { return; } + if (gav != null) { + final Iterator itr = dependency.getIdentifiers().iterator(); + boolean hasMatch = false; + while (itr.hasNext()) { + final Identifier i = itr.next(); + if (identifierMatches("maven", this.gav, i)) { + hasMatch = true; + break; + } + } + if (!hasMatch) { + return; + } + } + if (this.hasCpe()) { final Iterator itr = dependency.getIdentifiers().iterator(); while (itr.hasNext()) { final Identifier i = itr.next(); for (PropertyType c : this.cpe) { - if (cpeMatches(c, i)) { + if (identifierMatches("cpe", c, i)) { dependency.addSuppressedIdentifier(i); itr.remove(); break; @@ -336,23 +382,25 @@ public class SuppressionRule { /** * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. * - * @param cpeEntry a suppression rule entry + * @param suppressionEntry a suppression rule entry * @param identifier a CPE identifier to check * @return true if the entry matches; otherwise false */ - boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) { - if (cpeEntry.matches(identifier.getValue())) { - return true; - } else if (cpeHasNoVersion(cpeEntry)) { - if (cpeEntry.isCaseSensitive()) { - if (identifier.getValue().startsWith(cpeEntry.getValue())) { - return true; - } - } else { - final String id = identifier.getValue().toLowerCase(); - final String check = cpeEntry.getValue().toLowerCase(); - if (id.startsWith(check)) { - return true; + boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) { + if (identifierType.equals(identifier.getType())) { + if (suppressionEntry.matches(identifier.getValue())) { + return true; + } else if (cpeHasNoVersion(suppressionEntry)) { + if (suppressionEntry.isCaseSensitive()) { + if (identifier.getValue().startsWith(suppressionEntry.getValue())) { + return true; + } + } else { + final String id = identifier.getValue().toLowerCase(); + final String check = suppressionEntry.getValue().toLowerCase(); + if (id.startsWith(check)) { + return true; + } } } } diff --git a/dependency-check-core/src/main/resources/schema/suppression.xsd b/dependency-check-core/src/main/resources/schema/suppression.xsd index 14ae67a1a..083c8ae97 100644 --- a/dependency-check-core/src/main/resources/schema/suppression.xsd +++ b/dependency-check-core/src/main/resources/schema/suppression.xsd @@ -41,6 +41,7 @@ + diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java index e1fdfb1d8..a5cfc3068 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java @@ -339,7 +339,7 @@ public class SuppressionRuleTest { } /** - * Test of cpeMatches method, of class SuppressionRule. + * Test of identifierMatches method, of class SuppressionRule. */ @Test public void testCpeMatches() { @@ -350,44 +350,44 @@ public class SuppressionRuleTest { SuppressionRule instance = new SuppressionRule(); boolean expResult = true; - boolean result = instance.cpeMatches(cpe, identifier); + boolean result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:microsoft:.net_framework:4.0"); expResult = false; - result = instance.cpeMatches(cpe, identifier); + result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); cpe.setValue("CPE:/a:microsoft:.net_framework:4.5"); cpe.setCaseSensitive(true); expResult = false; - result = instance.cpeMatches(cpe, identifier); + result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:microsoft:.net_framework"); cpe.setCaseSensitive(false); expResult = true; - result = instance.cpeMatches(cpe, identifier); + result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:microsoft:.*"); cpe.setRegex(true); expResult = true; - result = instance.cpeMatches(cpe, identifier); + result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); cpe.setValue("CPE:/a:microsoft:.*"); cpe.setRegex(true); cpe.setCaseSensitive(true); expResult = false; - result = instance.cpeMatches(cpe, identifier); + result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:apache:.*"); cpe.setRegex(true); cpe.setCaseSensitive(false); expResult = false; - result = instance.cpeMatches(cpe, identifier); + result = instance.identifierMatches(cpe, identifier); assertEquals(expResult, result); } @@ -398,7 +398,7 @@ public class SuppressionRuleTest { public void testProcess() { File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); Dependency dependency = new Dependency(struts); - dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); String sha1 = dependency.getSha1sum(); dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970"); Vulnerability v = createVulnerability(); @@ -455,9 +455,9 @@ public class SuppressionRuleTest { assertTrue(dependency.getIdentifiers().isEmpty()); assertTrue(dependency.getSuppressedIdentifiers().size() == 1); - dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.0", "some url not needed for this test"); - dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); - dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:5.0", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.0", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:microsoft:.net_framework:5.0", "some url not needed for this test"); pt = new PropertyType(); pt.setValue("cpe:/a:microsoft:.net_framework"); instance.addCpe(pt); From d2cd406a622085fb6b197d58db9dc59eab5c24e7 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 16:32:48 -0400 Subject: [PATCH 03/61] added additional test resources Former-commit-id: b788c7420b82d8a108cd2335c536be667c2ab293 --- dependency-check-core/pom.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index a7b640d91..3f0694957 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -531,6 +531,13 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. provided true + + org.springframework.security + spring-security-web + 3.0.0.RELEASE + provided + true + com.hazelcast hazelcast From 13116c5381db476263ede5cca9180bb3fe6366d5 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 16:34:39 -0400 Subject: [PATCH 04/61] added support for suppression by GAV (issue #124), created base suppression.xml (issue #123), and fixed false positives related to spring security (issue #130) Former-commit-id: 330134211d022fec336dc1ca39205a94a088ee84 --- .../analyzer/AbstractSuppressionAnalyzer.java | 13 ++- .../suppression/SuppressionHandler.java | 12 ++- .../suppression/SuppressionRule.java | 81 ++++++++++++++++--- .../dependencycheck-base-suppression.xml | 12 +++ .../AbstractSuppressionAnalyzerTest.java | 6 +- .../suppression/SuppressionRuleTest.java | 68 ++++++++++++++-- src/site/markdown/suppression.md | 9 +++ 7 files changed, 172 insertions(+), 29 deletions(-) create mode 100644 dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java index 466c1d96d..3c66004e1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java @@ -98,11 +98,18 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { * @throws SuppressionParseException thrown if the XML cannot be parsed. */ private void loadSuppressionData() throws SuppressionParseException { + final SuppressionParser parser = new SuppressionParser(); + File file = null; + file = new File(this.getClass().getClassLoader().getResource("dependencycheck-base-suppression.xml").getPath()); + try { + rules = parser.parseSuppressionRules(file); + } catch (SuppressionParseException ex) { + LOGGER.log(Level.FINE, "Unable to parse the base suppression data file", ex); + } final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE); if (suppressionFilePath == null) { return; } - File file = null; boolean deleteTempFile = false; try { final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*", Pattern.CASE_INSENSITIVE); @@ -132,9 +139,9 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { } if (file != null) { - final SuppressionParser parser = new SuppressionParser(); try { - rules = parser.parseSuppressionRules(file); + //rules = parser.parseSuppressionRules(file); + rules.addAll(parser.parseSuppressionRules(file)); LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded."); } catch (SuppressionParseException ex) { final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath()); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java index 498390b9b..4906f4e19 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionHandler.java @@ -54,6 +54,10 @@ public class SuppressionHandler extends DefaultHandler { * The CWE element name. */ public static final String CWE = "cwe"; + /** + * The GAV element name. + */ + public static final String GAV = "gav"; /** * The cvssBelow element name. */ @@ -95,13 +99,10 @@ public class SuppressionHandler extends DefaultHandler { */ @Override public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { - currentAttributes = null; + currentAttributes = attributes; currentText = new StringBuffer(); - if (SUPPRESS.equals(qName)) { rule = new SuppressionRule(); - } else if (FILE_PATH.equals(qName)) { - currentAttributes = attributes; } } @@ -123,6 +124,9 @@ public class SuppressionHandler extends DefaultHandler { rule.setFilePath(pt); } else if (SHA1.equals(qName)) { rule.setSha1(currentText.toString()); + } else if (GAV.equals(qName)) { + final PropertyType pt = processPropertyType(); + rule.setGav(pt); } else if (CPE.equals(qName)) { final PropertyType pt = processPropertyType(); rule.addCpe(pt); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java index a0e94f3f2..9e1261e31 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java @@ -20,6 +20,7 @@ package org.owasp.dependencycheck.suppression; import java.util.ArrayList; import java.util.Iterator; import java.util.List; +import java.util.logging.Logger; import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.dependency.Identifier; import org.owasp.dependencycheck.dependency.Vulnerability; @@ -30,6 +31,10 @@ import org.owasp.dependencycheck.dependency.Vulnerability; */ public class SuppressionRule { + /** + * The Logger for use throughout the class + */ + private static final Logger LOGGER = Logger.getLogger(SuppressionRule.class.getName()); /** * The file path for the suppression. */ @@ -280,16 +285,19 @@ public class SuppressionRule { return; } if (gav != null) { + LOGGER.info(this.toString()); final Iterator itr = dependency.getIdentifiers().iterator(); - boolean hasMatch = false; + boolean gavFound = false; while (itr.hasNext()) { final Identifier i = itr.next(); + LOGGER.info(String.format("%nChecking %s for gav:%s", i.getValue(), this.gav)); if (identifierMatches("maven", this.gav, i)) { - hasMatch = true; + LOGGER.info("GAV Matched!"); + gavFound = true; break; } } - if (!hasMatch) { + if (!gavFound) { return; } } @@ -298,8 +306,17 @@ public class SuppressionRule { final Iterator itr = dependency.getIdentifiers().iterator(); while (itr.hasNext()) { final Identifier i = itr.next(); + if (this.gav != null) { + LOGGER.info(String.format("%nProcessesing %s", i.getValue())); + } for (PropertyType c : this.cpe) { + if (this.gav != null) { + LOGGER.info(String.format("%nChecking %s for cpe:%s", i.getValue(), c.getValue())); + } if (identifierMatches("cpe", c, i)) { + if (this.gav != null) { + LOGGER.info(String.format("%nRemoving %s", i.getValue())); + } dependency.addSuppressedIdentifier(i); itr.remove(); break; @@ -355,7 +372,7 @@ public class SuppressionRule { boolean cpeHasNoVersion(PropertyType c) { if (c.isRegex()) { return false; - } // cpe:/a:jboss:jboss:1.0.0: + } // cpe:/a:jboss:jboss:1.0.0 if (countCharacter(c.getValue(), ':') == 3) { return true; } @@ -390,20 +407,62 @@ public class SuppressionRule { if (identifierType.equals(identifier.getType())) { if (suppressionEntry.matches(identifier.getValue())) { return true; - } else if (cpeHasNoVersion(suppressionEntry)) { + } else if ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) { if (suppressionEntry.isCaseSensitive()) { - if (identifier.getValue().startsWith(suppressionEntry.getValue())) { - return true; - } + return identifier.getValue().startsWith(suppressionEntry.getValue()); } else { final String id = identifier.getValue().toLowerCase(); final String check = suppressionEntry.getValue().toLowerCase(); - if (id.startsWith(check)) { - return true; - } + return id.startsWith(check); } } } return false; } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(); + sb.append("SuppressionRule{"); + if (filePath != null) { + sb.append("filePath=").append(filePath).append(","); + } + if (sha1 != null) { + sb.append("sha1=").append(sha1).append(","); + } + if (gav != null) { + sb.append("gav=").append(gav).append(","); + } + if (cpe != null && cpe.size() > 0) { + sb.append("cpe={"); + for (PropertyType pt : cpe) { + sb.append(pt).append(","); + } + sb.append("}"); + } + if (cwe != null && cwe.size() > 0) { + sb.append("cwe={"); + for (String s : cwe) { + sb.append(s).append(","); + } + sb.append("}"); + } + if (cve != null && cve.size() > 0) { + sb.append("cve={"); + for (String s : cve) { + sb.append(s).append(","); + } + sb.append("}"); + } + if (cvssBelow != null && cvssBelow.size() > 0) { + sb.append("cvssBelow={"); + for (Float s : cvssBelow) { + sb.append(s).append(","); + } + sb.append("}"); + } + sb.append("}"); + return sb.toString(); + } + } diff --git a/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml b/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml new file mode 100644 index 000000000..3a01a55f5 --- /dev/null +++ b/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml @@ -0,0 +1,12 @@ + + + + + org\.springframework\.security:spring.* + cpe:/a:mod_security:mod_security + cpe:/a:springsource:spring_framework + cpe:/a:vmware:springsource_spring_framework + + \ No newline at end of file diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.java index f20a13d44..94ab3c317 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.java @@ -34,8 +34,8 @@ import java.util.Set; import java.util.logging.Level; import java.util.logging.Logger; -import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertNull; +import static org.junit.Assert.assertTrue; /** * @author Jeremy Long @@ -67,7 +67,7 @@ public class AbstractSuppressionAnalyzerTest extends BaseTest { instance.initialize(); int expCount = 5; List result = instance.getRules(); - assertEquals(expCount, result.size()); + assertTrue(expCount <= result.size()); } /** @@ -79,7 +79,7 @@ public class AbstractSuppressionAnalyzerTest extends BaseTest { instance.initialize(); int expCount = 5; List result = instance.getRules(); - assertEquals(expCount, result.size()); + assertTrue(expCount <= result.size()); } @Test(expected = SuppressionParseException.class) diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java index a5cfc3068..86fb99bf9 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/suppression/SuppressionRuleTest.java @@ -343,51 +343,66 @@ public class SuppressionRuleTest { */ @Test public void testCpeMatches() { - Identifier identifier = new Identifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); + Identifier identifier = new Identifier("cpe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); PropertyType cpe = new PropertyType(); cpe.setValue("cpe:/a:microsoft:.net_framework:4.5"); SuppressionRule instance = new SuppressionRule(); boolean expResult = true; - boolean result = instance.identifierMatches(cpe, identifier); + boolean result = instance.identifierMatches("cpe", cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:microsoft:.net_framework:4.0"); expResult = false; - result = instance.identifierMatches(cpe, identifier); + result = instance.identifierMatches("cpe", cpe, identifier); assertEquals(expResult, result); cpe.setValue("CPE:/a:microsoft:.net_framework:4.5"); cpe.setCaseSensitive(true); expResult = false; - result = instance.identifierMatches(cpe, identifier); + result = instance.identifierMatches("cpe", cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:microsoft:.net_framework"); cpe.setCaseSensitive(false); expResult = true; - result = instance.identifierMatches(cpe, identifier); + result = instance.identifierMatches("cpe", cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:microsoft:.*"); cpe.setRegex(true); expResult = true; - result = instance.identifierMatches(cpe, identifier); + result = instance.identifierMatches("cpe", cpe, identifier); assertEquals(expResult, result); cpe.setValue("CPE:/a:microsoft:.*"); cpe.setRegex(true); cpe.setCaseSensitive(true); expResult = false; - result = instance.identifierMatches(cpe, identifier); + result = instance.identifierMatches("cpe", cpe, identifier); assertEquals(expResult, result); cpe.setValue("cpe:/a:apache:.*"); cpe.setRegex(true); cpe.setCaseSensitive(false); expResult = false; - result = instance.identifierMatches(cpe, identifier); + result = instance.identifierMatches("cpe", cpe, identifier); + assertEquals(expResult, result); + + identifier = new Identifier("maven", "org.springframework:spring-core:2.5.5", "https://repository.sonatype.org/service/local/artifact/maven/redirect?r=central-proxy&g=org.springframework&a=spring-core&v=2.5.5&e=jar"); + cpe.setValue("org.springframework:spring-core:2.5.5"); + cpe.setRegex(false); + cpe.setCaseSensitive(false); + expResult = true; + result = instance.identifierMatches("maven", cpe, identifier); + assertEquals(expResult, result); + + cpe.setValue("org\\.springframework\\.security:spring.*"); + cpe.setRegex(true); + cpe.setCaseSensitive(false); + expResult = false; + result = instance.identifierMatches("maven", cpe, identifier); assertEquals(expResult, result); } @@ -467,6 +482,43 @@ public class SuppressionRuleTest { assertTrue(dependency.getSuppressedIdentifiers().size() == 3); } + /** + * Test of process method, of class SuppressionRule. + */ + @Test + public void testProcessGAV() { + File spring = new File(this.getClass().getClassLoader().getResource("spring-security-web-3.0.0.RELEASE.jar").getPath()); + Dependency dependency = new Dependency(spring); + dependency.addIdentifier("cpe", "cpe:/a:vmware:springsource_spring_framework:3.0.0", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:springsource:spring_framework:3.0.0", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:mod_security:mod_security:3.0.0", "some url not needed for this test"); + dependency.addIdentifier("cpe", "cpe:/a:vmware:springsource_spring_security:3.0.0", "some url not needed for this test"); + dependency.addIdentifier("maven", "org.springframework.security:spring-security-web:3.0.0.RELEASE", "some url not needed for this test"); + + //cpe + SuppressionRule instance = new SuppressionRule(); + PropertyType pt = new PropertyType(); + + pt.setValue("org\\.springframework\\.security:spring.*"); + pt.setRegex(true); + pt.setCaseSensitive(false); + instance.setGav(pt); + + pt = new PropertyType(); + pt.setValue("cpe:/a:mod_security:mod_security"); + instance.addCpe(pt); + pt = new PropertyType(); + pt.setValue("cpe:/a:springsource:spring_framework"); + instance.addCpe(pt); + pt = new PropertyType(); + pt.setValue("cpe:/a:vmware:springsource_spring_framework"); + instance.addCpe(pt); + + instance.process(dependency); + assertEquals(2, dependency.getIdentifiers().size()); + + } + private Vulnerability createVulnerability() { Vulnerability v = new Vulnerability(); v.setCwe("CWE-287 Improper Authentication"); diff --git a/src/site/markdown/suppression.md b/src/site/markdown/suppression.md index 5d10a6dc5..d3f789a75 100644 --- a/src/site/markdown/suppression.md +++ b/src/site/markdown/suppression.md @@ -64,6 +64,15 @@ HTML version of the report. The other common scenario would be to ignore all CVE ]]> 7 + + + org\.springframework\.security:spring.* + cpe:/a:vmware:springsource_spring_framework + cpe:/a:springsource:spring_framework + cpe:/a:mod_security:mod_security + ``` From 4b4da8d46768fcf9c2b59b584c0143d73f9aad87 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 19:03:33 -0400 Subject: [PATCH 05/61] checkstyle/pmd/etc. corrections Former-commit-id: 59883bd0b03c8690ce9a20120eafefe7c61384cd --- .../agent/DependencyCheckScanAgent.java | 2 +- .../dependencycheck/analyzer/CPEAnalyzer.java | 1 - .../dependencycheck/analyzer/JarAnalyzer.java | 4 +-- .../dependencycheck/data/nvdcve/CveDB.java | 2 ++ .../suppression/SuppressionRule.java | 28 ++++++------------- .../dependencycheck/utils/ExtractionUtil.java | 8 ++++-- 6 files changed, 18 insertions(+), 27 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java index 5f3894aeb..6fa41e556 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + * Copyright (c) 2014 Steve Springett. All Rights Reserved. */ package org.owasp.dependencycheck.agent; diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java index ef4044543..bb75da624 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java @@ -531,7 +531,6 @@ public class CPEAnalyzer implements Analyzer { if (dbVer == null //special case, no version specified - everything is vulnerable || evVer.equals(dbVer)) { //yeah! exact match - //final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8")); final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8")); final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); collected.add(match); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index a89daaa72..5b6e77eef 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -571,7 +571,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { groupid = parentGroupId; } } - String originalGroupID = groupid; + final String originalGroupID = groupid; if (groupid != null && !groupid.isEmpty()) { if (groupid.startsWith("org.") || groupid.startsWith("com.")) { @@ -601,7 +601,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { artifactid = parentArtifactId; } } - String originalArtifactID = artifactid; + final String originalArtifactID = artifactid; if (artifactid != null && !artifactid.isEmpty()) { if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { artifactid = artifactid.substring(4); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java index 131a28299..da6b2ae58 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java @@ -248,6 +248,7 @@ public class CveDB { /** * SQL Statement to retrieve a property from the database. */ + @SuppressWarnings("unused") private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?"; /** * SQL Statement to insert a new property. @@ -260,6 +261,7 @@ public class CveDB { /** * SQL Statement to delete a property. */ + @SuppressWarnings("unused") private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?"; // diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java index 9e1261e31..958204e48 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java @@ -20,7 +20,6 @@ package org.owasp.dependencycheck.suppression; import java.util.ArrayList; import java.util.Iterator; import java.util.List; -import java.util.logging.Logger; import org.owasp.dependencycheck.dependency.Dependency; import org.owasp.dependencycheck.dependency.Identifier; import org.owasp.dependencycheck.dependency.Vulnerability; @@ -31,10 +30,6 @@ import org.owasp.dependencycheck.dependency.Vulnerability; */ public class SuppressionRule { - /** - * The Logger for use throughout the class - */ - private static final Logger LOGGER = Logger.getLogger(SuppressionRule.class.getName()); /** * The file path for the suppression. */ @@ -285,14 +280,11 @@ public class SuppressionRule { return; } if (gav != null) { - LOGGER.info(this.toString()); final Iterator itr = dependency.getIdentifiers().iterator(); boolean gavFound = false; while (itr.hasNext()) { final Identifier i = itr.next(); - LOGGER.info(String.format("%nChecking %s for gav:%s", i.getValue(), this.gav)); if (identifierMatches("maven", this.gav, i)) { - LOGGER.info("GAV Matched!"); gavFound = true; break; } @@ -306,17 +298,8 @@ public class SuppressionRule { final Iterator itr = dependency.getIdentifiers().iterator(); while (itr.hasNext()) { final Identifier i = itr.next(); - if (this.gav != null) { - LOGGER.info(String.format("%nProcessesing %s", i.getValue())); - } for (PropertyType c : this.cpe) { - if (this.gav != null) { - LOGGER.info(String.format("%nChecking %s for cpe:%s", i.getValue(), c.getValue())); - } if (identifierMatches("cpe", c, i)) { - if (this.gav != null) { - LOGGER.info(String.format("%nRemoving %s", i.getValue())); - } dependency.addSuppressedIdentifier(i); itr.remove(); break; @@ -372,7 +355,7 @@ public class SuppressionRule { boolean cpeHasNoVersion(PropertyType c) { if (c.isRegex()) { return false; - } // cpe:/a:jboss:jboss:1.0.0 + } if (countCharacter(c.getValue(), ':') == 3) { return true; } @@ -399,6 +382,7 @@ public class SuppressionRule { /** * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. * + * @param identifierType the type of identifier ("cpe", "maven", etc.) * @param suppressionEntry a suppression rule entry * @param identifier a CPE identifier to check * @return true if the entry matches; otherwise false @@ -420,9 +404,14 @@ public class SuppressionRule { return false; } + /** + * Standard toString implementation. + * + * @return a string representation of this object + */ @Override public String toString() { - StringBuilder sb = new StringBuilder(); + final StringBuilder sb = new StringBuilder(); sb.append("SuppressionRule{"); if (filePath != null) { sb.append("filePath=").append(filePath).append(","); @@ -464,5 +453,4 @@ public class SuppressionRule { sb.append("}"); return sb.toString(); } - } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java index aae31e6f3..3f0ae2b03 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java @@ -1,17 +1,19 @@ /* - * Copyright 2014 OWASP. + * This file is part of dependency-check-core. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * - * http://www.apache.org/licenses/LICENSE-2.0 + * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. + * + * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.utils; @@ -33,7 +35,7 @@ import static org.owasp.dependencycheck.utils.FileUtils.getFileExtension; * * @author Jeremy Long */ -public class ExtractionUtil { +public final class ExtractionUtil { /** * The logger. From 25eaa11a528ed83bada4d0a33c83b1670db16bee Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 19:53:38 -0400 Subject: [PATCH 06/61] updated description Former-commit-id: c8cb8b041ce351c2d33a3621f772e75d02950193 --- dependency-check-utils/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-utils/pom.xml b/dependency-check-utils/pom.xml index 535feaa03..bad85945e 100644 --- a/dependency-check-utils/pom.xml +++ b/dependency-check-utils/pom.xml @@ -26,7 +26,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. dependency-check-utils Dependency-Check Utils - Dependency-check-utils a collection of common utlity classs used within dependency-check. + Dependency-check-utils a collection of common utlity classes used within dependency-check. From f38bbf4cc7272f97d8e45f65c590a2b56a0c3eb0 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 19:53:59 -0400 Subject: [PATCH 07/61] minor javadoc correction Former-commit-id: 45e621682304820fe17c17e92bd0aa5ac5dfd023 --- .../java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java | 1 - 1 file changed, 1 deletion(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index 5b6e77eef..06d3ac8ae 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -73,7 +73,6 @@ import org.xml.sax.XMLFilter; import org.xml.sax.XMLReader; /** - * * Used to load a JAR file and collect information that can be used to determine the associated CPE. * * @author Jeremy Long From 452955667c6bd00cea9df7e23157c31853074b3d Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 19:54:25 -0400 Subject: [PATCH 08/61] checkstyle correction Former-commit-id: e5a891ea5b438e64e8a3aa5e697cb859d1a1f09a --- .../main/java/org/owasp/dependencycheck/utils/Downloader.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java index 59fc9ec30..70b988ec8 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java @@ -176,7 +176,7 @@ public final class Downloader { conn = URLConnectionFactory.createHttpURLConnection(url); conn.setRequestMethod("HEAD"); conn.connect(); - int t = conn.getResponseCode(); + final int t = conn.getResponseCode(); if (t >= 200 && t < 300) { timestamp = conn.getLastModified(); } else { From b64916ce3f992d20f2b45eaa04d900b12c960d29 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 19:55:21 -0400 Subject: [PATCH 09/61] added file analyzer documentation Former-commit-id: c0c29021cd1197f26942ff36c8b63220d1267c21 --- src/site/markdown/archive-analyzer.md | 16 ++++++++++++++++ src/site/markdown/assembly-analyzer.md | 11 +++++++++++ src/site/markdown/jar-analyzer.md | 10 ++++++++++ src/site/markdown/nexus-analyzer.md | 2 +- src/site/markdown/nuspec-analyzer.md | 13 +++++++++++++ src/site/site.xml | 14 ++++++++++++++ 6 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 src/site/markdown/archive-analyzer.md create mode 100644 src/site/markdown/assembly-analyzer.md create mode 100644 src/site/markdown/jar-analyzer.md create mode 100644 src/site/markdown/nuspec-analyzer.md diff --git a/src/site/markdown/archive-analyzer.md b/src/site/markdown/archive-analyzer.md new file mode 100644 index 000000000..8cb03bef1 --- /dev/null +++ b/src/site/markdown/archive-analyzer.md @@ -0,0 +1,16 @@ +Archive Analyzer +============== + +Dependency-check includes an analyzer an archive analyzer that will attempt +to extract files from the archive that are supported by the other file type +analyzers. + +Files Types Scanned: ZIP, EAR, WAR, JAR, SAR, APK, NUPKG, TAR, GZ, TGZ + +Additional file extensions for ZIP archives can be added, see the configuration +section in the Maven, Ant, or CLI interfaces for more information on configuration. + +Note, since this analyzer does examine the contents of a JAR file there are times +that you may see additional entries in the report and/or warnings in the log file (if used) +for DLL or EXE files contained within the JAR file. In almost all cases these can +be ignored as it is fairly rare to have a .NET dll or exe within a JAR file. diff --git a/src/site/markdown/assembly-analyzer.md b/src/site/markdown/assembly-analyzer.md new file mode 100644 index 000000000..e5c8a553e --- /dev/null +++ b/src/site/markdown/assembly-analyzer.md @@ -0,0 +1,11 @@ +Jar Analyzer +============== + +Dependency-check includes an analyzer that scans JAR files and collect as +much information it can about the file as it can. The information collected +is internally referred to as evidence and is grouped into vendor, product, and version +buckets. Other analyzers later use this evidence to identify any Common Platform +Enumeration (CPE) identifiers that apply. Additionally, if a POM is present +the analyzer will add the Maven group, artifact, and version (GAV). + +Files Types Scanned: JAR, WAR diff --git a/src/site/markdown/jar-analyzer.md b/src/site/markdown/jar-analyzer.md new file mode 100644 index 000000000..418c30621 --- /dev/null +++ b/src/site/markdown/jar-analyzer.md @@ -0,0 +1,10 @@ +Assembly Analyzer +============== + +Dependency-check includes an analyzer that scans .NET dll and exe files and collect as +much information it can about the files as it can. The information collected +is internally referred to as evidence and is grouped into vendor, product, and version +buckets. Other analyzers later use this evidence to identify any Common Platform +Enumeration (CPE) identifiers that apply. + +Files Types Scanned: EXE, DLL diff --git a/src/site/markdown/nexus-analyzer.md b/src/site/markdown/nexus-analyzer.md index 896076a1d..5c3ebb8b6 100644 --- a/src/site/markdown/nexus-analyzer.md +++ b/src/site/markdown/nexus-analyzer.md @@ -1,7 +1,7 @@ Nexus Analyzer ============== -Dependency Check includes an analyzer which will check for the Maven GAV +Dependency-check includes an analyzer that will check for the Maven GAV (Group/Artifact/Version) information for artifacts in the scanned area. By default the information comes from [Maven Central][1], but can be configured to use a local repository if necessary. If the artifact's hash is found in the diff --git a/src/site/markdown/nuspec-analyzer.md b/src/site/markdown/nuspec-analyzer.md new file mode 100644 index 000000000..3ca0fc6c6 --- /dev/null +++ b/src/site/markdown/nuspec-analyzer.md @@ -0,0 +1,13 @@ +Nuspec Analyzer +============== + +Dependency-check includes an analyzer that will scan NuGet's Nuspec file to +collect information about the component being used. The evidence collected +is used by other analyzers to determine if there are any known vulnerabilities +associated with the component. + +Note, the Nuspec Analyzer does not scan dependencies defined. However, if +the dependencies have been downloaded and may be included in the scan depending +on configuration. + +Files Types Scanned: NUSPEC diff --git a/src/site/site.xml b/src/site/site.xml index 0279becc8..52e919265 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -84,9 +84,23 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. Sample Report + + + + Archive Analyzer + + + Jar Analyzer + Nexus Analyzer + + Assembly Analyzer + + + Nuspec Analyzer + From 8bc2364cce4f7296e28a9f39baecae944856115a Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 19:56:14 -0400 Subject: [PATCH 10/61] added site information to the dependency-check utils Former-commit-id: 7d8c4c3c2b98e0d492f4447e5f1dc1f071a2241a --- dependency-check-utils/src/site/site.xml | 30 ++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 dependency-check-utils/src/site/site.xml diff --git a/dependency-check-utils/src/site/site.xml b/dependency-check-utils/src/site/site.xml new file mode 100644 index 000000000..a24688c00 --- /dev/null +++ b/dependency-check-utils/src/site/site.xml @@ -0,0 +1,30 @@ + + + + + dependency-check-utils + + + + + + + + + \ No newline at end of file From 0f9da0731e78d9428a272d984a7e4443b3369f3f Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 21:22:32 -0400 Subject: [PATCH 11/61] updated text Former-commit-id: 7749b9ec6b0ce9502e1c7129bdec902ce5b43595 --- src/site/markdown/assembly-analyzer.md | 11 +++++------ src/site/markdown/jar-analyzer.md | 11 ++++++----- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/site/markdown/assembly-analyzer.md b/src/site/markdown/assembly-analyzer.md index e5c8a553e..418c30621 100644 --- a/src/site/markdown/assembly-analyzer.md +++ b/src/site/markdown/assembly-analyzer.md @@ -1,11 +1,10 @@ -Jar Analyzer +Assembly Analyzer ============== -Dependency-check includes an analyzer that scans JAR files and collect as -much information it can about the file as it can. The information collected +Dependency-check includes an analyzer that scans .NET dll and exe files and collect as +much information it can about the files as it can. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform -Enumeration (CPE) identifiers that apply. Additionally, if a POM is present -the analyzer will add the Maven group, artifact, and version (GAV). +Enumeration (CPE) identifiers that apply. -Files Types Scanned: JAR, WAR +Files Types Scanned: EXE, DLL diff --git a/src/site/markdown/jar-analyzer.md b/src/site/markdown/jar-analyzer.md index 418c30621..e5c8a553e 100644 --- a/src/site/markdown/jar-analyzer.md +++ b/src/site/markdown/jar-analyzer.md @@ -1,10 +1,11 @@ -Assembly Analyzer +Jar Analyzer ============== -Dependency-check includes an analyzer that scans .NET dll and exe files and collect as -much information it can about the files as it can. The information collected +Dependency-check includes an analyzer that scans JAR files and collect as +much information it can about the file as it can. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform -Enumeration (CPE) identifiers that apply. +Enumeration (CPE) identifiers that apply. Additionally, if a POM is present +the analyzer will add the Maven group, artifact, and version (GAV). -Files Types Scanned: EXE, DLL +Files Types Scanned: JAR, WAR From 848be0db6caf96ba42caf6adff445fb42a4b6c45 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 21:31:58 -0400 Subject: [PATCH 12/61] version 1.2.2 Former-commit-id: 8da06e1a2f4b41bccc22105d7bc758442bb14e57 --- dependency-check-ant/pom.xml | 2 +- dependency-check-cli/pom.xml | 2 +- dependency-check-core/pom.xml | 3 +-- dependency-check-jenkins/pom.xml | 2 +- dependency-check-maven/pom.xml | 3 +-- dependency-check-utils/pom.xml | 2 +- pom.xml | 6 +++--- 7 files changed, 9 insertions(+), 11 deletions(-) diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml index 0f4061ed0..2fec61287 100644 --- a/dependency-check-ant/pom.xml +++ b/dependency-check-ant/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 dependency-check-ant diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index a28b61086..1cc00f877 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 dependency-check-cli diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index 3f0694957..b0897140d 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -15,13 +15,12 @@ limitations under the License. Copyright (c) 2012 Jeremy Long. All Rights Reserved. --> - 4.0.0 org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 dependency-check-core diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index 527aaf754..d63095621 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -6,7 +6,7 @@ org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 org.owasp diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index 513dc79c2..e9496c9eb 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -15,7 +15,6 @@ limitations under the License. Copyright (c) 2013 Jeremy Long. All Rights Reserved. --> - 4.0.0 http://maven.apache.org @@ -23,7 +22,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 dependency-check-maven diff --git a/dependency-check-utils/pom.xml b/dependency-check-utils/pom.xml index bad85945e..14ade8dd3 100644 --- a/dependency-check-utils/pom.xml +++ b/dependency-check-utils/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 dependency-check-utils diff --git a/pom.xml b/pom.xml index 515c8ca17..ba74763b8 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long org.owasp dependency-check-parent - 1.2.2-SNAPSHOT + 1.2.2 pom @@ -29,8 +29,8 @@ Copyright (c) 2012 - Jeremy Long dependency-check-ant dependency-check-maven dependency-check-jenkins - dependency-check-utils - + dependency-check-utils + Dependency-Check https://github.com/jeremylong/DependencyCheck.git dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. From 25ac5033fc9fe368f63b6fc96648d51720f2100b Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 22 Jun 2014 21:33:58 -0400 Subject: [PATCH 13/61] snapshot version 1.2.3 Former-commit-id: 58f96e7ef71987a53626287f95b332f04b60a6f6 --- dependency-check-ant/pom.xml | 2 +- dependency-check-cli/pom.xml | 2 +- dependency-check-core/pom.xml | 2 +- dependency-check-jenkins/pom.xml | 2 +- dependency-check-maven/pom.xml | 2 +- dependency-check-utils/pom.xml | 2 +- pom.xml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml index 2fec61287..fa74ee4c1 100644 --- a/dependency-check-ant/pom.xml +++ b/dependency-check-ant/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT dependency-check-ant diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index 1cc00f877..9a2da35a0 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT dependency-check-cli diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index b0897140d..179bd51b0 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT dependency-check-core diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index d63095621..6cd2be9bd 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -6,7 +6,7 @@ org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT org.owasp diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index e9496c9eb..a96fdef76 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -22,7 +22,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT dependency-check-maven diff --git a/dependency-check-utils/pom.xml b/dependency-check-utils/pom.xml index 14ade8dd3..8584e662f 100644 --- a/dependency-check-utils/pom.xml +++ b/dependency-check-utils/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT dependency-check-utils diff --git a/pom.xml b/pom.xml index ba74763b8..344551392 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long org.owasp dependency-check-parent - 1.2.2 + 1.2.3-SNAPSHOT pom From 8cafc14d0961e5288e04149de43fb089d56b5eec Mon Sep 17 00:00:00 2001 From: Will Stranathan Date: Tue, 24 Jun 2014 10:16:53 -0400 Subject: [PATCH 14/61] Updated to 1.1 of GrokAssembly.exe to deal with exceptions Former-commit-id: 8c1d6ad04e378f2a19e2fcdc9ebc1eab12be9aef --- .../src/main/resources/GrokAssembly.exe | Bin 5632 -> 5632 bytes 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 dependency-check-core/src/main/resources/GrokAssembly.exe diff --git a/dependency-check-core/src/main/resources/GrokAssembly.exe b/dependency-check-core/src/main/resources/GrokAssembly.exe old mode 100755 new mode 100644 index 0cea03759a903de123293b159454387cbaf52851..5b2104a54e935c1aae6c9fa9aea06957aba0fdb8 GIT binary patch delta 990 zcmY+DT}YEr7{{OIy!&#^Id!2K*4DHj$J&CC_94wQH8rI*QXyrlHAd>9P09#22_%Zb zaiS=wtSg0XVi(p;*iA8r!l0m}s0>n}tcb!e=s9Qe!t?U~o#*R4=Q;1$6840BlPA`phE~MCXXC3W zUgOI*Yg$(qb&F7U(m?&ne_chkiY@((T z+^XJGv7S89v5?qObfwSQ!WR-bfLA=KJ{(Wu1MGx&tk8%p))W04sEBC~WWsXl2`5WfgD|p}&`d|qDU=tBoCnRAlYod6Wq>FWfU)okU&5*KUrTfHn@KExxWQSy0 za!T@zhOtqXTT{!{bm7s)RTQ!kAfG4RVN2tIC*?F|3sH z%Gk5iZS70c9vnCkY>xQ(v7B4{Z_d2CHW=s+h5Uh@peIK69O#b)!8;I*1$!N}VSlJE z5{-qAL?Kf~KZBOY(O{I%=sQz8R^_5;_-7*h_3dcO(2u#<^x1!Rc)OuP<55|lppH)% zz8KXO#QXsrX6~Ec%yk+cWdBs6$LDtLDJ;Rs)MBm=xzThcPaI8KJ!a0%scR-T7P;t4 gxM3?)(&GRZ*_E&js!}ug<&1sUnaVdWVA84m56;B03;+NC delta 757 zcmY+CPe{{Y7{|ZQ`}=Kko6cA_4q_C1Qs!J+1iNXq@ z^~fqZRVPms!-E~dj^3;;bt2eNb2=PcyalT6zq)&d(gF_#f9rM zgj;Z{xb%aDJJm4Krmn#WMKY>)dMvEQg5e9pq~Vg`Yr_@8H-;a0#?^N42#ui|c4q7C zedXy%nD7YgtG5@I^RQR+(S&CFox1GW+}!rTR|k$-eS`Ie*_D jrHW=WB8t6eldlmiQbo~ Date: Thu, 26 Jun 2014 15:14:55 -0400 Subject: [PATCH 15/61] Fixed suppression analyzer to load from input stream fixing failure Former-commit-id: 4e6f8d7fddcf7ed26ad60b7aa8bc3a6b22ae19cc --- .../analyzer/AbstractSuppressionAnalyzer.java | 3 +-- .../suppression/SuppressionParser.java | 20 +++++++++++++++++-- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java index 3c66004e1..3a8c008ed 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java @@ -100,9 +100,8 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { private void loadSuppressionData() throws SuppressionParseException { final SuppressionParser parser = new SuppressionParser(); File file = null; - file = new File(this.getClass().getClassLoader().getResource("dependencycheck-base-suppression.xml").getPath()); try { - rules = parser.parseSuppressionRules(file); + rules = parser.parseSuppressionRules(this.getClass().getClassLoader().getResourceAsStream("dependencycheck-base-suppression.xml")); } catch (SuppressionParseException ex) { LOGGER.log(Level.FINE, "Unable to parse the base suppression data file", ex); } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java index c47398cde..c3cc9c7d6 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java @@ -27,9 +27,11 @@ import java.io.Reader; import java.util.List; import java.util.logging.Level; import java.util.logging.Logger; + import javax.xml.parsers.ParserConfigurationException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; + import org.xml.sax.InputSource; import org.xml.sax.SAXException; import org.xml.sax.XMLReader; @@ -66,10 +68,25 @@ public class SuppressionParser { * @throws SuppressionParseException thrown if the xml file cannot be parsed */ public List parseSuppressionRules(File file) throws SuppressionParseException { + try { + return parseSuppressionRules(new FileInputStream(file)); + } catch (IOException ex) { + LOGGER.log(Level.FINE, null, ex); + throw new SuppressionParseException(ex); + } + } + + /** + * Parses the given xml stream and returns a list of the suppression rules contained. + * + * @param inputStream an InputStream containing suppression rues + * @return a list of suppression rules + * @throws SuppressionParseException if the xml cannot be parsed + */ + public List parseSuppressionRules(InputStream inputStream) throws SuppressionParseException { try { final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd"); final SuppressionHandler handler = new SuppressionHandler(); - final SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setNamespaceAware(true); factory.setValidating(true); @@ -80,7 +97,6 @@ public class SuppressionParser { xmlReader.setErrorHandler(new SuppressionErrorHandler()); xmlReader.setContentHandler(handler); - final InputStream inputStream = new FileInputStream(file); final Reader reader = new InputStreamReader(inputStream, "UTF-8"); final InputSource in = new InputSource(reader); //in.setEncoding("UTF-8"); From 0badbfc4a0dc0067cc9156a00e0538a54f15813b Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 28 Jun 2014 06:06:33 -0400 Subject: [PATCH 16/61] version 1.2.3 Former-commit-id: c355adf9813220c4b3dac3450e80a83a245209a6 --- dependency-check-ant/pom.xml | 2 +- dependency-check-cli/pom.xml | 2 +- dependency-check-core/pom.xml | 2 +- dependency-check-jenkins/pom.xml | 2 +- dependency-check-maven/pom.xml | 2 +- dependency-check-utils/pom.xml | 2 +- pom.xml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml index fa74ee4c1..8abfa04e2 100644 --- a/dependency-check-ant/pom.xml +++ b/dependency-check-ant/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 dependency-check-ant diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index 9a2da35a0..7b130285a 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 dependency-check-cli diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index 179bd51b0..845465547 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 dependency-check-core diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index 6cd2be9bd..9567f64d0 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -6,7 +6,7 @@ org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 org.owasp diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index a96fdef76..15d37a7c8 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -22,7 +22,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 dependency-check-maven diff --git a/dependency-check-utils/pom.xml b/dependency-check-utils/pom.xml index 8584e662f..83d5cb343 100644 --- a/dependency-check-utils/pom.xml +++ b/dependency-check-utils/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 dependency-check-utils diff --git a/pom.xml b/pom.xml index 344551392..3440f2164 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long org.owasp dependency-check-parent - 1.2.3-SNAPSHOT + 1.2.3 pom From 9cbcc29ddbdc6acf75ca3775285594334f6968c8 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 28 Jun 2014 08:14:35 -0400 Subject: [PATCH 17/61] added utils to the parent site Former-commit-id: 2a80ad86f5ab94fb21131786d9dce3439269f8cb --- src/site/site.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/site/site.xml b/src/site/site.xml index 52e919265..1232b7879 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -104,7 +104,10 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. - The core dependency-check library + The core dependency-check library. + + + A set of utility classes used by dependency-check. The command line interface for dependency-check. From 20ec22407057f58ba4e95f1719a7d77a98ce943f Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 28 Jun 2014 08:14:49 -0400 Subject: [PATCH 18/61] updated version to 1.2.4-SNAPSHOT Former-commit-id: 65d0e1ba5ed781e9f70ec7fd0c115a027e3bbc00 --- dependency-check-ant/pom.xml | 2 +- dependency-check-cli/pom.xml | 2 +- dependency-check-core/pom.xml | 2 +- dependency-check-jenkins/pom.xml | 2 +- dependency-check-maven/pom.xml | 2 +- dependency-check-utils/pom.xml | 2 +- pom.xml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml index 8abfa04e2..da4961203 100644 --- a/dependency-check-ant/pom.xml +++ b/dependency-check-ant/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT dependency-check-ant diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index 7b130285a..fdf11af18 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT dependency-check-cli diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index 845465547..d01416206 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT dependency-check-core diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index 9567f64d0..ff1ba1be8 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -6,7 +6,7 @@ org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT org.owasp diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index 15d37a7c8..84046e127 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -22,7 +22,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT dependency-check-maven diff --git a/dependency-check-utils/pom.xml b/dependency-check-utils/pom.xml index 83d5cb343..9c18043e4 100644 --- a/dependency-check-utils/pom.xml +++ b/dependency-check-utils/pom.xml @@ -21,7 +21,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT dependency-check-utils diff --git a/pom.xml b/pom.xml index 3440f2164..50817e55e 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long org.owasp dependency-check-parent - 1.2.3 + 1.2.4-SNAPSHOT pom From 5cc7aa25cc3903d3c4c09556cf0868969286e00a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Kimminich?= Date: Fri, 4 Jul 2014 14:17:57 +0200 Subject: [PATCH 19/61] Update README.md - set version in POM snippet from 1.0.2 to 1.2.3 - set URL to Ant Task docs to http://jeremylong.github.io/DependencyCheck/dependency-check-ant/installation.html Former-commit-id: 8a2176aee9948b5bfd0c1f08c6c7bb9fdadc45a1 --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index eeb3556e4..70ddc6630 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ The plugin can be configured using the following: org.owasp dependency-check-maven - 1.0.2 + 1.2.3 @@ -59,7 +59,7 @@ The plugin can be configured using the following: ### Ant Task -For instructions on the use of the Ant Task, please see the [dependency-check-ant github page](http://jeremylong.github.io/DependencyCheck/dependency-check-maven/installation.html). +For instructions on the use of the Ant Task, please see the [dependency-check-ant github page](http://jeremylong.github.io/DependencyCheck/dependency-check-ant/installation.html). Development Usage ------------- @@ -106,4 +106,4 @@ Dependency-Check makes use of several other open source libraries. Please see th [wiki]: https://github.com/jeremylong/DependencyCheck/wiki [subscribe]: mailto:dependency-check+subscribe@googlegroups.com [post]: mailto:dependency-check@googlegroups.com - [notices]: https://github.com/jeremylong/DependencyCheck/blob/master/NOTICES.txt \ No newline at end of file + [notices]: https://github.com/jeremylong/DependencyCheck/blob/master/NOTICES.txt From 464d91f45a574f85645bb99855cd3d06fd0bf5b4 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Tue, 8 Jul 2014 06:17:36 -0400 Subject: [PATCH 20/61] fixed resource leaks found by coverity Former-commit-id: 0e2d3b866853e2b906b9683e27602fd244298e55 --- .../dependencycheck/analyzer/JarAnalyzer.java | 19 ++++++++---- .../owasp/dependencycheck/utils/Settings.java | 30 ++++++++++++++++--- 2 files changed, 40 insertions(+), 9 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index 06d3ac8ae..d96e8f9ce 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -344,16 +344,25 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { * @return a Properties object or null if no pom.properties was found * @throws IOException thrown if there is an exception reading the pom.properties */ - @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM", - justification = "The reader is closed by closing the zipEntry") private Properties retrievePomProperties(String path, final JarFile jar) throws IOException { Properties pomProperties = null; final String propPath = path.substring(0, path.length() - 7) + "pom.properies"; final ZipEntry propEntry = jar.getEntry(propPath); if (propEntry != null) { - final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8"); - pomProperties = new Properties(); - pomProperties.load(reader); + Reader reader = null; + try { + reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8"); + pomProperties = new Properties(); + pomProperties.load(reader); + } finally { + if (reader != null) { + try { + reader.close(); + } catch (IOException ex) { + LOGGER.log(Level.FINEST, "close error", ex); + } + } + } } return pomProperties; } diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java index 813297a09..0f47db1e3 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java @@ -382,8 +382,19 @@ public final class Settings { * @throws IOException is thrown when there is an exception loading/merging the properties */ public static void mergeProperties(File filePath) throws FileNotFoundException, IOException { - final FileInputStream fis = new FileInputStream(filePath); - mergeProperties(fis); + FileInputStream fis = null; + try { + fis = new FileInputStream(filePath); + mergeProperties(fis); + } finally { + if (fis != null) { + try { + fis.close(); + } catch (IOException ex) { + LOGGER.log(Level.FINEST, "close error", ex); + } + } + } } /** @@ -396,8 +407,19 @@ public final class Settings { * @throws IOException is thrown when there is an exception loading/merging the properties */ public static void mergeProperties(String filePath) throws FileNotFoundException, IOException { - final FileInputStream fis = new FileInputStream(filePath); - mergeProperties(fis); + FileInputStream fis = null; + try { + fis = new FileInputStream(filePath); + mergeProperties(fis); + } finally { + if (fis != null) { + try { + fis.close(); + } catch (IOException ex) { + LOGGER.log(Level.FINEST, "close error", ex); + } + } + } } /** From 4b06d0fd87ecc04a2512de548e2b2cc5b3cd3752 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 13 Jul 2014 06:54:59 -0400 Subject: [PATCH 21/61] upgraded version on commons-compress to 1.8.1 Former-commit-id: 2dc8698035e18764e101b36b11faf9e5c7188c5b --- dependency-check-core/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index d01416206..ed6cef941 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -428,7 +428,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.apache.commons commons-compress - 1.8 + 1.8.1 commons-io From e1179a8e228096b575bea4b0c150d699a995843c Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 13 Jul 2014 06:56:40 -0400 Subject: [PATCH 22/61] moved getConnectionString to the Settings class Former-commit-id: d35df6d103505888ac4d87f964d8d615996ce614 --- .../data/nvdcve/ConnectionFactory.java | 40 ++----------------- 1 file changed, 3 insertions(+), 37 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java index 59965baeb..b500c24e2 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java @@ -42,6 +42,7 @@ import org.owasp.dependencycheck.utils.Settings; * @author Jeremy Long */ public final class ConnectionFactory { + /** * The Logger. */ @@ -111,7 +112,7 @@ public final class ConnectionFactory { //yes, yes - hard-coded password - only if there isn't one in the properties file. password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); try { - connectionString = getConnectionString(); + connectionString = Settings.getConnectionString(Settings.KEYS.DB_CONNECTION_STRING); } catch (IOException ex) { LOGGER.log(Level.FINE, "Unable to retrieve the database connection string", ex); @@ -217,41 +218,6 @@ public final class ConnectionFactory { return conn; } - /** - * Returns the configured connection string. If using the embedded H2 database this function will also ensure the - * data directory exists and if not create it. - * - * @return the connection string - * @throws IOException thrown the data directory cannot be created - */ - private static String getConnectionString() throws IOException { - final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE"); - if (connStr.contains("%s")) { - final String directory = getDataDirectory().getCanonicalPath(); - final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION); - LOGGER.log(Level.FINE, String.format("File path for H2 file: '%s'", dataFile.toString())); - return String.format(connStr, dataFile.getAbsolutePath()); - } - return connStr; - } - - /** - * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory - * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private. - * - * @return the data directory to store data files - * @throws IOException is thrown if an IOException occurs of course... - */ - public static File getDataDirectory() throws IOException { - final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); - if (!path.exists()) { - if (!path.mkdirs()) { - throw new IOException("Unable to create NVD CVE Data directory"); - } - } - return path; - } - /** * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created. * @@ -259,7 +225,7 @@ public final class ConnectionFactory { * @throws IOException thrown if the data directory does not exist and cannot be created */ private static boolean dbSchemaExists() throws IOException { - final File dir = getDataDirectory(); + final File dir = Settings.getDataDirectory(); final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION); final File file = new File(dir, name); return file.exists(); From 288892441fb64ec461cded1d17046b835ee46d1f Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Thu, 17 Jul 2014 05:59:10 -0400 Subject: [PATCH 23/61] corrected javadoc Former-commit-id: c0c7d8da486a08dfc3e9232b57166d4c496bb798 --- .../org/owasp/dependencycheck/exception/ScanAgentException.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ScanAgentException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ScanAgentException.java index 4b325e234..b0be8bfc4 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ScanAgentException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ScanAgentException.java @@ -48,7 +48,7 @@ public class ScanAgentException extends IOException { } /** - * Creates a new NoDataException. + * Creates a new ScanAgentException. * * @param ex the cause of the exception. */ From fe8c60ade156f9e3a1b59dd72e1fe1bf306fc75d Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Thu, 17 Jul 2014 06:00:06 -0400 Subject: [PATCH 24/61] added additional setting keys and methods getDataDirectory and getConnectionString Former-commit-id: 5e8a55c498fa7ae5331ba4fbeb86cd68b9fd8eda --- .../owasp/dependencycheck/utils/Settings.java | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java index 0f47db1e3..97a935585 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java @@ -200,6 +200,28 @@ public final class Settings { * The properties key for whether Provided Scope dependencies should be skipped. */ public static final String SKIP_PROVIDED_SCOPE = "skip.provided.scope"; + + /** + * The key to obtain the path to the VFEED data file. + */ + public static final String VFEED_DATA_FILE = "vfeed.data_file"; + /** + * The key to obtain the VFEED connection string. + */ + public static final String VFEED_CONNECTION_STRING = "vfeed.connection_string"; + + /** + * The key to obtain the base download URL for the VFeed data file. + */ + public static final String VFEED_DOWNLOAD_URL = "vfeed.download_url"; + /** + * The key to obtain the download file name for the VFeed data. + */ + public static final String VFEED_DOWNLOAD_FILE = "vfeed.download_file"; + /** + * The key to obtain the VFeed update status. + */ + public static final String VFEED_UPDATE_STATUS = "vfeed.update_status"; } // @@ -663,4 +685,41 @@ public final class Settings { } return value; } + + /** + * Returns a connection string from the configured properties. If the connection string contains a %s, this method + * will determine the 'data' directory and replace the %s with the path to the data directory. If the data directory + * does not exists it will be created. + * + * @param connectionStringKey the property file key for the connection string + * @return the connection string + * @throws IOException thrown the data directory cannot be created + */ + public static String getConnectionString(String connectionStringKey) throws IOException { + final String connStr = Settings.getString(connectionStringKey, "jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON;"); + if (connStr.contains("%s")) { + final File directory = getDataDirectory(); + final String cString = String.format(connStr, directory.getAbsolutePath()); + LOGGER.log(Level.FINE, String.format("Connection String: '%s'", cString)); + return cString; + } + return connStr; + } + + /** + * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory + * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private. + * + * @return the data directory to store data files + * @throws IOException is thrown if an IOException occurs of course... + */ + public static File getDataDirectory() throws IOException { + final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); + if (!path.exists()) { + if (!path.mkdirs()) { + throw new IOException("Unable to create the data directory"); + } + } + return path; + } } From d7e46b169397fe1aa081e0321bfc40ccc7e778fc Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Thu, 17 Jul 2014 06:00:59 -0400 Subject: [PATCH 25/61] corrected the connection string in the test properties Former-commit-id: 1c37d4bd4de49cddc34b92a27875e0a07eee600f --- .../src/test/resources/dependencycheck.properties | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dependency-check-core/src/test/resources/dependencycheck.properties b/dependency-check-core/src/test/resources/dependencycheck.properties index 70e0d45ab..f6e3d1f13 100644 --- a/dependency-check-core/src/test/resources/dependencycheck.properties +++ b/dependency-check-core/src/test/resources/dependencycheck.properties @@ -13,8 +13,7 @@ max.download.threads=3 # will not be used. The data.directory will be resolved and if the connection string # below contains a %s then the data.directory will replace the %s. data.directory=[JAR]/data -data.connection_string=jdbc:h2:file:%s;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; -#data.connection_string=jdbc:h2:file:%s;AUTO_SERVER=TRUE;AUTOCOMMIT=ON; +data.connection_string=jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; #data.connection_string=jdbc:mysql://localhost:3306/dependencycheck # user name and password for the database connection. The inherent case is to use H2. From 5600c9bc69c5ab5b846ca6b84d814d62fa419ef2 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Thu, 17 Jul 2014 06:01:59 -0400 Subject: [PATCH 26/61] removed commented out property Former-commit-id: 2a07ced007c986d3ab127d8ff216f49c332f41c3 --- .../src/main/resources/dependencycheck.properties | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dependency-check-core/src/main/resources/dependencycheck.properties b/dependency-check-core/src/main/resources/dependencycheck.properties index 19cfb9d6c..6f67c78ea 100644 --- a/dependency-check-core/src/main/resources/dependencycheck.properties +++ b/dependency-check-core/src/main/resources/dependencycheck.properties @@ -13,8 +13,7 @@ max.download.threads=3 # will not be used. The data.directory will be resolved and if the connection string # below contains a %s then the data.directory will replace the %s. data.directory=[JAR]/data -data.connection_string=jdbc:h2:file:%s;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; -#data.connection_string=jdbc:h2:file:%s;AUTO_SERVER=TRUE;AUTOCOMMIT=ON; +data.connection_string=jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; #data.connection_string=jdbc:mysql://localhost:3306/dependencycheck # user name and password for the database connection. The inherent case is to use H2. From 46702bbb5c588d91b3684c4b764f392b619b75d1 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Thu, 17 Jul 2014 06:03:21 -0400 Subject: [PATCH 27/61] moved checkSumTest.file, checksum.java, and checksumTest.java to dependency-check-utils Former-commit-id: 0c05e466b5fe071ca55552660d471431572c0558 --- .../src/main/java/org/owasp/dependencycheck/utils/Checksum.java | 0 .../test/java/org/owasp/dependencycheck/utils/ChecksumTest.java | 2 ++ .../src/test/resources/checkSumTest.file | 0 3 files changed, 2 insertions(+) rename {dependency-check-core => dependency-check-utils}/src/main/java/org/owasp/dependencycheck/utils/Checksum.java (100%) rename {dependency-check-core => dependency-check-utils}/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java (98%) rename {dependency-check-core => dependency-check-utils}/src/test/resources/checkSumTest.file (100%) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Checksum.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java similarity index 100% rename from dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Checksum.java rename to dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java b/dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java similarity index 98% rename from dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java rename to dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java index 5bd82b9b8..142448b83 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java +++ b/dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java @@ -26,6 +26,8 @@ import org.junit.Assert; import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; +import org.owasp.dependencycheck.utils.Checksum; +import org.owasp.dependencycheck.utils.Checksum; /** * diff --git a/dependency-check-core/src/test/resources/checkSumTest.file b/dependency-check-utils/src/test/resources/checkSumTest.file similarity index 100% rename from dependency-check-core/src/test/resources/checkSumTest.file rename to dependency-check-utils/src/test/resources/checkSumTest.file From 2dcef251755aec5a5d65bfb22e1f8c99ee584ccd Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:34:50 -0400 Subject: [PATCH 28/61] performance improvements for large files Former-commit-id: 6a49a7066cb01c613b5c6f07c8497601a88e7f8d --- .../owasp/dependencycheck/utils/Checksum.java | 62 ++++++++++++------- 1 file changed, 39 insertions(+), 23 deletions(-) diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java index 64e358ff7..45c109944 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java @@ -1,9 +1,28 @@ +/* + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ package org.owasp.dependencycheck.utils; +import java.io.BufferedInputStream; import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.io.InputStream; +import java.security.DigestInputStream; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.util.logging.Level; @@ -12,19 +31,16 @@ import java.util.logging.Logger; /** * Includes methods to generate the MD5 and SHA1 checksum. * - * This code was copied from Real's How To. It has been slightly modified. - * - * Written and compiled by Réal Gagnon ©1998-2012 - * - * @author Real's How To: http://www.rgagnon.com/javadetails/java-0416.html + * @author Jeremy Long * */ public final class Checksum { - + /** * The logger. */ private static final Logger LOGGER = Logger.getLogger(Checksum.class.getName()); + /** * Private constructor for a utility class. */ @@ -32,30 +48,25 @@ public final class Checksum { } /** - *

Creates the cryptographic checksum of a given file using the specified - * algorithm.

This algorithm was copied and heavily modified from - * Real's How To: http://www.rgagnon.com/javadetails/java-0416.html

+ *

+ * Creates the cryptographic checksum of a given file using the specified algorithm.

* * @param algorithm the algorithm to use to calculate the checksum * @param file the file to calculate the checksum for * @return the checksum * @throws IOException when the file does not exist - * @throws NoSuchAlgorithmException when an algorithm is specified that does - * not exist + * @throws NoSuchAlgorithmException when an algorithm is specified that does not exist */ public static byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException { + MessageDigest digest = MessageDigest.getInstance(algorithm); InputStream fis = null; - byte[] buffer = new byte[1024]; - MessageDigest complete = MessageDigest.getInstance(algorithm); - int numRead; try { fis = new FileInputStream(file); - do { - numRead = fis.read(buffer); - if (numRead > 0) { - complete.update(buffer, 0, numRead); - } - } while (numRead != -1); + BufferedInputStream bis = new BufferedInputStream(fis); + DigestInputStream dis = new DigestInputStream(bis, digest); + //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW + byte[] buffer = new byte[8192]; + while (dis.read(buffer) != -1); } finally { if (fis != null) { try { @@ -65,7 +76,7 @@ public final class Checksum { } } } - return complete.digest(); + return digest.digest(); } /** @@ -93,12 +104,17 @@ public final class Checksum { byte[] b = getChecksum("SHA1", file); return getHex(b); } + /** + * Hex code characters used in getHex. + */ private static final String HEXES = "0123456789ABCDEF"; /** - *

Converts a byte array into a hex string.

+ *

+ * Converts a byte array into a hex string.

* - *

This method was copied from + * This method was copied from http://www.rgagnon.com/javadetails/java-0596.html

* * @param raw a byte array From ff346dc429376a8b0da55036a78bb67eec4c462e Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:35:48 -0400 Subject: [PATCH 29/61] changed getConnectionString to allow a more dynamically constructed string based on more setting keys Former-commit-id: 1fb18720ab1a1c6d947bc94366b8ee2ca9cb711e --- .../owasp/dependencycheck/utils/Settings.java | 50 ++++++++++++++++--- 1 file changed, 44 insertions(+), 6 deletions(-) diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java index 97a935585..be2fef823 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java @@ -78,6 +78,14 @@ public final class Settings { * The base path to use for the data directory (for embedded db). */ public static final String DATA_DIRECTORY = "data.directory"; + /** + * The database file name. + */ + public static final String DB_FILE_NAME = "data.file_name"; + /** + * The database schema version. + */ + public static final String DB_VERSION = "data.version"; /** * The properties key for the URL to retrieve the "meta" data from about the CVE entries. */ @@ -97,7 +105,7 @@ public final class Settings { */ public static final String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays"; /** - * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with + * The properties key for the telling us how many cve.url.* URLs exists. This is used in combination with * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing. */ public static final String CVE_START_YEAR = "cve.startyear"; @@ -485,7 +493,7 @@ public final class Settings { * @param key the key to lookup within the properties file * @return the property from the properties file converted to a File object */ - public static File getDataFile(String key) { + protected static File getDataFile(String key) { final String file = getString(key); LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file)); if (file == null) { @@ -692,14 +700,44 @@ public final class Settings { * does not exists it will be created. * * @param connectionStringKey the property file key for the connection string + * @param dbFileNameKey the settings key for the db filename + * @param dbVersionKey the settings key for the dbVersion * @return the connection string * @throws IOException thrown the data directory cannot be created + * @throws org.owasp.dependencycheck.utils.InvalidSettingException */ - public static String getConnectionString(String connectionStringKey) throws IOException { - final String connStr = Settings.getString(connectionStringKey, "jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON;"); + public static String getConnectionString(String connectionStringKey, String dbFileNameKey, String dbVersionKey) throws IOException, InvalidSettingException { + final String connStr = Settings.getString(connectionStringKey); + if (connStr == null) { + throw new InvalidSettingException(String.format("Invalid properties file to get the connection string; '%s' must be defined.", connectionStringKey)); + } if (connStr.contains("%s")) { final File directory = getDataDirectory(); - final String cString = String.format(connStr, directory.getAbsolutePath()); + String fileName = null; + if (dbFileNameKey != null) { + fileName = Settings.getString(dbFileNameKey); + } + if (fileName == null) { + throw new InvalidSettingException(String.format("Invalid properties file to get a file based connection string; '%s' must be defined.", dbFileNameKey)); + } + if (fileName.contains("%s")) { + String version = null; + if (dbVersionKey != null) { + version = Settings.getString(dbVersionKey); + } + if (version == null) { + throw new InvalidSettingException(String.format("Invalid properties file to get a file based connection string; '%s' must be defined.", dbFileNameKey)); + } + fileName = String.format(fileName, version); + } + if (connStr.startsWith("jdbc:h2:file:")) { + if (fileName.endsWith(".h2.db")) { + fileName = fileName.substring(0, fileName.length() - 6); + } + } + // yes, for H2 this path won't actually exists - but this is sufficient to get the value needed + final File dbFile = new File(directory, fileName); + final String cString = String.format(connStr, dbFile.getCanonicalPath()); LOGGER.log(Level.FINE, String.format("Connection String: '%s'", cString)); return cString; } @@ -717,7 +755,7 @@ public final class Settings { final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); if (!path.exists()) { if (!path.mkdirs()) { - throw new IOException("Unable to create the data directory"); + throw new IOException(String.format("Unable to create the data directory '%s'", path.getAbsolutePath())); } } return path; From 226b2482b12dded6a2cf4bac85945e538f399086 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:36:16 -0400 Subject: [PATCH 30/61] added data.file_name and data.version Former-commit-id: 6f33c306170f96f344bb85aa7820cc94cd4d5eeb --- .../src/test/resources/dependencycheck.properties | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dependency-check-utils/src/test/resources/dependencycheck.properties b/dependency-check-utils/src/test/resources/dependencycheck.properties index 70e0d45ab..8ed80a630 100644 --- a/dependency-check-utils/src/test/resources/dependencycheck.properties +++ b/dependency-check-utils/src/test/resources/dependencycheck.properties @@ -13,6 +13,8 @@ max.download.threads=3 # will not be used. The data.directory will be resolved and if the connection string # below contains a %s then the data.directory will replace the %s. data.directory=[JAR]/data +data.file_name=cve.%s.h2.db +data.version=2.9 data.connection_string=jdbc:h2:file:%s;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; #data.connection_string=jdbc:h2:file:%s;AUTO_SERVER=TRUE;AUTOCOMMIT=ON; #data.connection_string=jdbc:mysql://localhost:3306/dependencycheck From 1c261c746309ab75099e2421a54667117b587582 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:36:35 -0400 Subject: [PATCH 31/61] added more tests Former-commit-id: 75a4e44d06838221b060c0569716e85e1c6fc996 --- .../dependencycheck/utils/SettingsTest.java | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java b/dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java index fec2b026e..c486814a9 100644 --- a/dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java +++ b/dependency-check-utils/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java @@ -157,4 +157,35 @@ public class SettingsTest extends BaseTest { ret = Settings.getString(key, dfault); Assert.assertEquals(dfault, ret); } + + /** + * Test of getConnectionString. + */ + @Test + public void testGetConnectionString() throws Exception { + String value = Settings.getConnectionString(Settings.KEYS.DB_CONNECTION_STRING, Settings.KEYS.DB_FILE_NAME, Settings.KEYS.DB_VERSION); + Assert.assertNotNull(value); + String msg = null; + try { + value = Settings.getConnectionString(Settings.KEYS.DB_CONNECTION_STRING, Settings.KEYS.DB_FILE_NAME, null); + } catch (InvalidSettingException e) { + msg = e.getMessage(); + } + Assert.assertNotNull(msg, msg); + try { + value = Settings.getConnectionString("invalidKey", null, null); + } catch (InvalidSettingException e) { + msg = e.getMessage(); + } + Assert.assertNotNull(msg, msg); + } + + /** + * Test of getTempDirectory. + */ + @Test + public void testGetTempDirectory() throws Exception { + File tmp = Settings.getTempDirectory(); + Assert.assertTrue(tmp.exists()); + } } From f28b566992c64339b916ce54ba10ca77f34dd364 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:37:11 -0400 Subject: [PATCH 32/61] added data.file_name and data.version Former-commit-id: e692a13a216ec6808e3fd92397fd3c50854cfa56 --- .../src/main/resources/dependencycheck.properties | 5 ++++- .../src/test/resources/dependencycheck.properties | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/dependency-check-core/src/main/resources/dependencycheck.properties b/dependency-check-core/src/main/resources/dependencycheck.properties index 6f67c78ea..0090e0c50 100644 --- a/dependency-check-core/src/main/resources/dependencycheck.properties +++ b/dependency-check-core/src/main/resources/dependencycheck.properties @@ -13,7 +13,10 @@ max.download.threads=3 # will not be used. The data.directory will be resolved and if the connection string # below contains a %s then the data.directory will replace the %s. data.directory=[JAR]/data -data.connection_string=jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; +#if the filename has a %s it will be replaced with the current expected version +data.file_name=cve.%s.h2.db +data.version=2.9 +data.connection_string=jdbc:h2:file:%s;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; #data.connection_string=jdbc:mysql://localhost:3306/dependencycheck # user name and password for the database connection. The inherent case is to use H2. diff --git a/dependency-check-core/src/test/resources/dependencycheck.properties b/dependency-check-core/src/test/resources/dependencycheck.properties index f6e3d1f13..f7b0f6f4e 100644 --- a/dependency-check-core/src/test/resources/dependencycheck.properties +++ b/dependency-check-core/src/test/resources/dependencycheck.properties @@ -13,6 +13,11 @@ max.download.threads=3 # will not be used. The data.directory will be resolved and if the connection string # below contains a %s then the data.directory will replace the %s. data.directory=[JAR]/data +# if the filename has a %s it will be replaced with the current expected version. For file +# based databases the below filename will be added to the data directory above and then +# if the connection string has a %s it will be replaced by the directory/filename path. +data.file_name=cve.%s.h2.db +data.version=2.9 data.connection_string=jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; #data.connection_string=jdbc:mysql://localhost:3306/dependencycheck From 860d3d9c8b336fd5a2ce3b80ea282a746ffaed83 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:38:08 -0400 Subject: [PATCH 33/61] made the ensureDBExists method perform a correct check rather then the previous hack Former-commit-id: 5fae859fa7531761e78022eb2e8c4c41e6d5d150 --- .../owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java index fb8f3bb03..db812d114 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.java @@ -45,8 +45,10 @@ public abstract class BaseDBTestCase extends BaseTest { public static void ensureDBExists() throws Exception { - java.io.File dataPath = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); - if (!dataPath.exists() || (dataPath.isDirectory() && dataPath.listFiles().length < 3)) { + java.io.File dataPath = Settings.getDataDirectory(); + String fileName = String.format(Settings.getString(Settings.KEYS.DB_FILE_NAME), Settings.getString(Settings.KEYS.DB_VERSION)); + java.io.File dataFile = new File(dataPath, fileName); + if (!dataPath.exists() || !dataFile.exists()) { dataPath.mkdirs(); FileInputStream fis = null; ZipInputStream zin = null; From 718d7af8bccdd460a2057fb901e084aee815e731 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 07:38:51 -0400 Subject: [PATCH 34/61] updated to use the new getConnectionString implementation Former-commit-id: c5bd68b3d2fb4c2470d6c50dc5f8f9f6036b9fce --- .../data/nvdcve/ConnectionFactory.java | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java index b500c24e2..1ace1fc20 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java @@ -50,7 +50,7 @@ public final class ConnectionFactory { /** * The version of the current DB Schema. */ - public static final String DB_SCHEMA_VERSION = "2.9"; + public static final String DB_SCHEMA_VERSION = Settings.getString(Settings.KEYS.DB_VERSION); /** * Resource location for SQL file used to create the database schema. */ @@ -112,7 +112,7 @@ public final class ConnectionFactory { //yes, yes - hard-coded password - only if there isn't one in the properties file. password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); try { - connectionString = Settings.getConnectionString(Settings.KEYS.DB_CONNECTION_STRING); + connectionString = Settings.getConnectionString(Settings.KEYS.DB_CONNECTION_STRING, Settings.KEYS.DB_FILE_NAME, Settings.KEYS.DB_VERSION); } catch (IOException ex) { LOGGER.log(Level.FINE, "Unable to retrieve the database connection string", ex); @@ -121,7 +121,7 @@ public final class ConnectionFactory { boolean shouldCreateSchema = false; try { if (connectionString.startsWith("jdbc:h2:file:")) { //H2 - shouldCreateSchema = !dbSchemaExists(); + shouldCreateSchema = !h2DataFileExists(); LOGGER.log(Level.FINE, "Need to create DB Structure: {0}", shouldCreateSchema); } } catch (IOException ioex) { @@ -224,9 +224,10 @@ public final class ConnectionFactory { * @return true if the H2 database file does not exist; otherwise false * @throws IOException thrown if the data directory does not exist and cannot be created */ - private static boolean dbSchemaExists() throws IOException { + private static boolean h2DataFileExists() throws IOException { final File dir = Settings.getDataDirectory(); - final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION); + String name = Settings.getString(Settings.KEYS.DB_FILE_NAME); + final String fileName = String.format(name, DB_SCHEMA_VERSION); final File file = new File(dir, name); return file.exists(); } From 034a274b07dec049366d6beaf2e35bf195603111 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 13:57:15 -0400 Subject: [PATCH 35/61] fixed copy paste error Former-commit-id: 83c51cb5b43c635088025a2076121911af32a7ec --- .../owasp/dependencycheck/data/nvdcve/ConnectionFactory.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java index 1ace1fc20..ac93f861f 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java @@ -228,7 +228,7 @@ public final class ConnectionFactory { final File dir = Settings.getDataDirectory(); String name = Settings.getString(Settings.KEYS.DB_FILE_NAME); final String fileName = String.format(name, DB_SCHEMA_VERSION); - final File file = new File(dir, name); + final File file = new File(dir, fileName); return file.exists(); } From d9d646c5fbc4fb13e7d36279b57c09f4fd71d30f Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 13:57:36 -0400 Subject: [PATCH 36/61] fixed connection string property Former-commit-id: 951cf212c80a52909cc2dd66e843b63b35991045 --- .../src/test/resources/dependencycheck.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/test/resources/dependencycheck.properties b/dependency-check-core/src/test/resources/dependencycheck.properties index f7b0f6f4e..61efb2407 100644 --- a/dependency-check-core/src/test/resources/dependencycheck.properties +++ b/dependency-check-core/src/test/resources/dependencycheck.properties @@ -18,7 +18,7 @@ data.directory=[JAR]/data # if the connection string has a %s it will be replaced by the directory/filename path. data.file_name=cve.%s.h2.db data.version=2.9 -data.connection_string=jdbc:h2:file:%s/cve.2.9;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; +data.connection_string=jdbc:h2:file:%s;FILE_LOCK=SERIALIZED;AUTOCOMMIT=ON; #data.connection_string=jdbc:mysql://localhost:3306/dependencycheck # user name and password for the database connection. The inherent case is to use H2. From 803fcf146b2fd3db2ff3f8f520fd8931b37ad5ac Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 19 Jul 2014 13:58:30 -0400 Subject: [PATCH 37/61] minor fix to test case Former-commit-id: bf20319aed4f100d124cdeb7abeafe6598778891 --- .../org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java index d5af29939..f4a8cb63d 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java @@ -85,7 +85,7 @@ public class HintAnalyzerTest extends BaseTest { for (Dependency d : engine.getDependencies()) { if (d.getActualFile().equals(guice)) { gdep = d; - } else { + } else if (d.getActualFile().equals(spring)) { sdep = d; } } From 356509865091a04d8e538c091631381de067d280 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 20 Jul 2014 06:36:33 -0400 Subject: [PATCH 38/61] converted abstract class to a final class with a private constructor Former-commit-id: 582a421e69eac2bfc008ca8ee2fe88c7734c9a31 --- .../java/org/owasp/dependencycheck/data/cpe/Fields.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java index b5239e27d..8880793b1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/Fields.java @@ -22,7 +22,7 @@ package org.owasp.dependencycheck.data.cpe; * * @author Jeremy Long */ -public abstract class Fields { +public final class Fields { /** * The key for the name document id. @@ -36,7 +36,10 @@ public abstract class Fields { * The key for the product field. */ public static final String PRODUCT = "product"; + /** - * The key for the version field. + * Private constructor as this is more of an enumeration rather then a full class. */ + private Fields() { + } } From 8b3894f213e86b48aa85438ba0a11adc51bc0f1e Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 20 Jul 2014 06:49:31 -0400 Subject: [PATCH 39/61] removed version from maven usage Former-commit-id: 234d0bc0e147cdb9ebf7d1c59e5ef53421589d42 --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 70ddc6630..5afe5f557 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,6 @@ The plugin can be configured using the following: org.owasp dependency-check-maven - 1.2.3 From 47c817de1c9a9f40d106f1a518ccf6b588708b2d Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 20 Jul 2014 07:54:54 -0400 Subject: [PATCH 40/61] performance improvement for checksum calculations - using MappedByteBuffer Former-commit-id: 5024926737f1abbae47da5e95615dd2f2bddbcc6 --- .../owasp/dependencycheck/utils/Checksum.java | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java index 45c109944..0f354b8ad 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Checksum.java @@ -17,12 +17,11 @@ */ package org.owasp.dependencycheck.utils; -import java.io.BufferedInputStream; import java.io.File; import java.io.FileInputStream; import java.io.IOException; -import java.io.InputStream; -import java.security.DigestInputStream; +import java.nio.MappedByteBuffer; +import java.nio.channels.FileChannel; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.util.logging.Level; @@ -57,16 +56,20 @@ public final class Checksum { * @throws IOException when the file does not exist * @throws NoSuchAlgorithmException when an algorithm is specified that does not exist */ + @SuppressWarnings("empty-statement") public static byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException { MessageDigest digest = MessageDigest.getInstance(algorithm); - InputStream fis = null; + FileInputStream fis = null; try { fis = new FileInputStream(file); - BufferedInputStream bis = new BufferedInputStream(fis); - DigestInputStream dis = new DigestInputStream(bis, digest); - //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW - byte[] buffer = new byte[8192]; - while (dis.read(buffer) != -1); + FileChannel ch = fis.getChannel(); + MappedByteBuffer byteBuffer = ch.map(FileChannel.MapMode.READ_ONLY, 0, file.length()); + digest.update(byteBuffer); +// BufferedInputStream bis = new BufferedInputStream(fis); +// DigestInputStream dis = new DigestInputStream(bis, digest); +// //yes, we are reading in a buffer for performance reasons - 1 byte at a time is SLOW +// byte[] buffer = new byte[8192]; +// while (dis.read(buffer) != -1); } finally { if (fis != null) { try { From 195818a432eff58d868754798f3545633d3dddca Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 1 Aug 2014 06:02:22 -0400 Subject: [PATCH 41/61] minor changes to logger and added a catch for throwable Former-commit-id: 0ca337442a3f60db9655c3527711ba16af3096a6 --- .../owasp/dependencycheck/utils/LogUtils.java | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java index 1841be1d7..99c5ddbb0 100644 --- a/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java +++ b/dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java @@ -53,20 +53,24 @@ public final class LogUtils { try { LogManager.getLogManager().reset(); LogManager.getLogManager().readConfiguration(in); + if (verboseLogFile != null && !verboseLogFile.isEmpty()) { verboseLoggingEnabled = true; final Logger logger = Logger.getLogger(""); - final FileHandler handler = new FileHandler(verboseLogFile, true); - handler.setFormatter(new SimpleFormatter()); - handler.setLevel(Level.FINE); - handler.setFilter(new LogFilter()); - logger.addHandler(handler); + final FileHandler fileHandler = new FileHandler(verboseLogFile, true); + fileHandler.setFormatter(new SimpleFormatter()); + fileHandler.setLevel(Level.FINE); + fileHandler.setFilter(new LogFilter()); + + logger.addHandler(fileHandler); logger.setLevel(Level.FINE); } } catch (IOException ex) { - LOGGER.log(Level.FINE, "IO Error preparing the logger", ex); + LOGGER.log(Level.WARNING, "IO Error preparing the logger", ex); } catch (SecurityException ex) { - LOGGER.log(Level.FINE, "Error preparing the logger", ex); + LOGGER.log(Level.WARNING, "Error preparing the logger", ex); + } catch (Throwable ex) { + LOGGER.log(Level.WARNING, "Error preparing the logger", ex); } finally { if (in != null) { try { From 73f6ce304ca67196e12b2b2e1a4ee877baaac6da Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 1 Aug 2014 14:21:55 -0400 Subject: [PATCH 42/61] corrected jaxb newInstance Former-commit-id: 32a1b759ad1e127784ae9bff902cca01c6faaad7 --- .../java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index d96e8f9ce..b333c1e36 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -169,7 +169,8 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { */ public JarAnalyzer() { try { - final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated"); + //final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated"); + final JAXBContext jaxbContext = JAXBContext.newInstance(org.owasp.dependencycheck.jaxb.pom.generated.Model.class); pomUnmarshaller = jaxbContext.createUnmarshaller(); } catch (JAXBException ex) { //guess we will just have a null pointer exception later... LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details."); From 0b06b194b061c3f04e333200a403dcb4657616e8 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 1 Aug 2014 14:22:40 -0400 Subject: [PATCH 43/61] added XmlRootElement attribute Former-commit-id: a3263e63c8c7b12c90ad388c8eda1ab09e43786c --- .../jaxb/pom/generated/Model.java | 446 ++++++------------ 1 file changed, 157 insertions(+), 289 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java index d848bb182..16d230d51 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java @@ -4,8 +4,6 @@ // Any modifications to this file will be lost upon recompilation of the source schema. // Generated on: 2012.11.09 at 12:33:57 PM EST // - - package org.owasp.dependencycheck.jaxb.pom.generated; import java.util.ArrayList; @@ -15,19 +13,21 @@ import javax.xml.bind.annotation.XmlAccessType; import javax.xml.bind.annotation.XmlAccessorType; import javax.xml.bind.annotation.XmlAnyElement; import javax.xml.bind.annotation.XmlElement; +import javax.xml.bind.annotation.XmlRootElement; import javax.xml.bind.annotation.XmlType; import org.w3c.dom.Element; - /** * - * The <project> element is the root of the descriptor. - * The following table lists all of the possible child elements. + * The <project> element is the root of the descriptor. The following table lists all of the possible + * child elements. * * - *

Java class for Model complex type. + *

+ * Java class for Model complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

  * <complexType name="Model">
@@ -183,10 +183,9 @@ import org.w3c.dom.Element;
  *
  */
 @XmlAccessorType(XmlAccessType.FIELD)
-@XmlType(name = "Model", propOrder = {
-
-})
+@XmlType(name = "Model", propOrder = {})
 @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
+@XmlRootElement
 public class Model {
 
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -254,9 +253,7 @@ public class Model {
     /**
      * Gets the value of the parent property.
      *
-     * @return
-     *     possible object is
-     *     {@link Parent }
+     * @return possible object is {@link Parent }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -267,9 +264,7 @@ public class Model {
     /**
      * Sets the value of the parent property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Parent }
+     * @param value allowed object is {@link Parent }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -280,9 +275,7 @@ public class Model {
     /**
      * Gets the value of the modelVersion property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -293,9 +286,7 @@ public class Model {
     /**
      * Sets the value of the modelVersion property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -306,9 +297,7 @@ public class Model {
     /**
      * Gets the value of the groupId property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -319,9 +308,7 @@ public class Model {
     /**
      * Sets the value of the groupId property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -332,9 +319,7 @@ public class Model {
     /**
      * Gets the value of the artifactId property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -345,9 +330,7 @@ public class Model {
     /**
      * Sets the value of the artifactId property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -358,9 +341,7 @@ public class Model {
     /**
      * Gets the value of the packaging property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -371,9 +352,7 @@ public class Model {
     /**
      * Sets the value of the packaging property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -384,9 +363,7 @@ public class Model {
     /**
      * Gets the value of the name property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -397,9 +374,7 @@ public class Model {
     /**
      * Sets the value of the name property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -410,9 +385,7 @@ public class Model {
     /**
      * Gets the value of the version property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -423,9 +396,7 @@ public class Model {
     /**
      * Sets the value of the version property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -436,9 +407,7 @@ public class Model {
     /**
      * Gets the value of the description property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -449,9 +418,7 @@ public class Model {
     /**
      * Sets the value of the description property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -462,9 +429,7 @@ public class Model {
     /**
      * Gets the value of the url property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -475,9 +440,7 @@ public class Model {
     /**
      * Sets the value of the url property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -488,9 +451,7 @@ public class Model {
     /**
      * Gets the value of the prerequisites property.
      *
-     * @return
-     *     possible object is
-     *     {@link Prerequisites }
+     * @return possible object is {@link Prerequisites }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -501,9 +462,7 @@ public class Model {
     /**
      * Sets the value of the prerequisites property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Prerequisites }
+     * @param value allowed object is {@link Prerequisites }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -514,9 +473,7 @@ public class Model {
     /**
      * Gets the value of the issueManagement property.
      *
-     * @return
-     *     possible object is
-     *     {@link IssueManagement }
+     * @return possible object is {@link IssueManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -527,9 +484,7 @@ public class Model {
     /**
      * Sets the value of the issueManagement property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link IssueManagement }
+     * @param value allowed object is {@link IssueManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -540,9 +495,7 @@ public class Model {
     /**
      * Gets the value of the ciManagement property.
      *
-     * @return
-     *     possible object is
-     *     {@link CiManagement }
+     * @return possible object is {@link CiManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -553,9 +506,7 @@ public class Model {
     /**
      * Sets the value of the ciManagement property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link CiManagement }
+     * @param value allowed object is {@link CiManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -566,9 +517,7 @@ public class Model {
     /**
      * Gets the value of the inceptionYear property.
      *
-     * @return
-     *     possible object is
-     *     {@link String }
+     * @return possible object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -579,9 +528,7 @@ public class Model {
     /**
      * Sets the value of the inceptionYear property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link String }
+     * @param value allowed object is {@link String }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -592,9 +539,7 @@ public class Model {
     /**
      * Gets the value of the mailingLists property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.MailingLists }
+     * @return possible object is {@link Model.MailingLists }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -605,9 +550,7 @@ public class Model {
     /**
      * Sets the value of the mailingLists property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.MailingLists }
+     * @param value allowed object is {@link Model.MailingLists }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -618,9 +561,7 @@ public class Model {
     /**
      * Gets the value of the developers property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Developers }
+     * @return possible object is {@link Model.Developers }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -631,9 +572,7 @@ public class Model {
     /**
      * Sets the value of the developers property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Developers }
+     * @param value allowed object is {@link Model.Developers }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -644,9 +583,7 @@ public class Model {
     /**
      * Gets the value of the contributors property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Contributors }
+     * @return possible object is {@link Model.Contributors }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -657,9 +594,7 @@ public class Model {
     /**
      * Sets the value of the contributors property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Contributors }
+     * @param value allowed object is {@link Model.Contributors }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -670,9 +605,7 @@ public class Model {
     /**
      * Gets the value of the licenses property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Licenses }
+     * @return possible object is {@link Model.Licenses }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -683,9 +616,7 @@ public class Model {
     /**
      * Sets the value of the licenses property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Licenses }
+     * @param value allowed object is {@link Model.Licenses }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -696,9 +627,7 @@ public class Model {
     /**
      * Gets the value of the scm property.
      *
-     * @return
-     *     possible object is
-     *     {@link Scm }
+     * @return possible object is {@link Scm }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -709,9 +638,7 @@ public class Model {
     /**
      * Sets the value of the scm property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Scm }
+     * @param value allowed object is {@link Scm }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -722,9 +649,7 @@ public class Model {
     /**
      * Gets the value of the organization property.
      *
-     * @return
-     *     possible object is
-     *     {@link Organization }
+     * @return possible object is {@link Organization }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -735,9 +660,7 @@ public class Model {
     /**
      * Sets the value of the organization property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Organization }
+     * @param value allowed object is {@link Organization }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -748,9 +671,7 @@ public class Model {
     /**
      * Gets the value of the build property.
      *
-     * @return
-     *     possible object is
-     *     {@link Build }
+     * @return possible object is {@link Build }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -761,9 +682,7 @@ public class Model {
     /**
      * Sets the value of the build property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Build }
+     * @param value allowed object is {@link Build }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -774,9 +693,7 @@ public class Model {
     /**
      * Gets the value of the profiles property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Profiles }
+     * @return possible object is {@link Model.Profiles }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -787,9 +704,7 @@ public class Model {
     /**
      * Sets the value of the profiles property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Profiles }
+     * @param value allowed object is {@link Model.Profiles }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -800,9 +715,7 @@ public class Model {
     /**
      * Gets the value of the modules property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Modules }
+     * @return possible object is {@link Model.Modules }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -813,9 +726,7 @@ public class Model {
     /**
      * Sets the value of the modules property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Modules }
+     * @param value allowed object is {@link Model.Modules }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -826,9 +737,7 @@ public class Model {
     /**
      * Gets the value of the repositories property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Repositories }
+     * @return possible object is {@link Model.Repositories }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -839,9 +748,7 @@ public class Model {
     /**
      * Sets the value of the repositories property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Repositories }
+     * @param value allowed object is {@link Model.Repositories }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -852,9 +759,7 @@ public class Model {
     /**
      * Gets the value of the pluginRepositories property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.PluginRepositories }
+     * @return possible object is {@link Model.PluginRepositories }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -865,9 +770,7 @@ public class Model {
     /**
      * Sets the value of the pluginRepositories property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.PluginRepositories }
+     * @param value allowed object is {@link Model.PluginRepositories }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -878,9 +781,7 @@ public class Model {
     /**
      * Gets the value of the dependencies property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Dependencies }
+     * @return possible object is {@link Model.Dependencies }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -891,9 +792,7 @@ public class Model {
     /**
      * Sets the value of the dependencies property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Dependencies }
+     * @param value allowed object is {@link Model.Dependencies }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -904,9 +803,7 @@ public class Model {
     /**
      * Gets the value of the reports property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Reports }
+     * @return possible object is {@link Model.Reports }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -917,9 +814,7 @@ public class Model {
     /**
      * Sets the value of the reports property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Reports }
+     * @param value allowed object is {@link Model.Reports }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -930,9 +825,7 @@ public class Model {
     /**
      * Gets the value of the reporting property.
      *
-     * @return
-     *     possible object is
-     *     {@link Reporting }
+     * @return possible object is {@link Reporting }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -943,9 +836,7 @@ public class Model {
     /**
      * Sets the value of the reporting property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Reporting }
+     * @param value allowed object is {@link Reporting }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -956,9 +847,7 @@ public class Model {
     /**
      * Gets the value of the dependencyManagement property.
      *
-     * @return
-     *     possible object is
-     *     {@link DependencyManagement }
+     * @return possible object is {@link DependencyManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -969,9 +858,7 @@ public class Model {
     /**
      * Sets the value of the dependencyManagement property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link DependencyManagement }
+     * @param value allowed object is {@link DependencyManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -982,9 +869,7 @@ public class Model {
     /**
      * Gets the value of the distributionManagement property.
      *
-     * @return
-     *     possible object is
-     *     {@link DistributionManagement }
+     * @return possible object is {@link DistributionManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -995,9 +880,7 @@ public class Model {
     /**
      * Sets the value of the distributionManagement property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link DistributionManagement }
+     * @param value allowed object is {@link DistributionManagement }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -1008,9 +891,7 @@ public class Model {
     /**
      * Gets the value of the properties property.
      *
-     * @return
-     *     possible object is
-     *     {@link Model.Properties }
+     * @return possible object is {@link Model.Properties }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -1021,9 +902,7 @@ public class Model {
     /**
      * Sets the value of the properties property.
      *
-     * @param value
-     *     allowed object is
-     *     {@link Model.Properties }
+     * @param value allowed object is {@link Model.Properties }
      *
      */
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
@@ -1031,11 +910,12 @@ public class Model {
         this.properties = value;
     }
 
-
     /**
-     * 

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1065,10 +945,9 @@ public class Model {
          * Gets the value of the contributor property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the contributor property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the contributor property. * *

* For example, to add a new item, do as follows: @@ -1078,8 +957,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Contributor } + * Objects of the following type(s) are allowed in the list {@link Contributor } * * */ @@ -1093,11 +971,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1127,10 +1006,9 @@ public class Model {
          * Gets the value of the dependency property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the dependency property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the dependency property. * *

* For example, to add a new item, do as follows: @@ -1140,8 +1018,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Dependency } + * Objects of the following type(s) are allowed in the list {@link Dependency } * * */ @@ -1155,11 +1032,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1189,10 +1067,9 @@ public class Model {
          * Gets the value of the developer property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the developer property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the developer property. * *

* For example, to add a new item, do as follows: @@ -1202,8 +1079,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Developer } + * Objects of the following type(s) are allowed in the list {@link Developer } * * */ @@ -1217,11 +1093,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1251,10 +1128,9 @@ public class Model {
          * Gets the value of the license property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the license property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the license property. * *

* For example, to add a new item, do as follows: @@ -1264,8 +1140,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link License } + * Objects of the following type(s) are allowed in the list {@link License } * * */ @@ -1279,11 +1154,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1313,10 +1189,9 @@ public class Model {
          * Gets the value of the mailingList property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the mailingList property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the mailingList property. * *

* For example, to add a new item, do as follows: @@ -1326,8 +1201,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link MailingList } + * Objects of the following type(s) are allowed in the list {@link MailingList } * * */ @@ -1341,11 +1215,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1375,10 +1250,9 @@ public class Model {
          * Gets the value of the module property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the module property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the module property. * *

* For example, to add a new item, do as follows: @@ -1388,8 +1262,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link String } + * Objects of the following type(s) are allowed in the list {@link String } * * */ @@ -1403,11 +1276,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1437,10 +1311,9 @@ public class Model {
          * Gets the value of the pluginRepository property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the pluginRepository property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the pluginRepository property. * *

* For example, to add a new item, do as follows: @@ -1450,8 +1323,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Repository } + * Objects of the following type(s) are allowed in the list {@link Repository } * * */ @@ -1465,11 +1337,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1499,10 +1372,9 @@ public class Model {
          * Gets the value of the profile property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the profile property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the profile property. * *

* For example, to add a new item, do as follows: @@ -1512,8 +1384,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Profile } + * Objects of the following type(s) are allowed in the list {@link Profile } * * */ @@ -1527,11 +1398,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1562,10 +1434,9 @@ public class Model {
          * Gets the value of the any property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the any property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the any property. * *

* For example, to add a new item, do as follows: @@ -1575,8 +1446,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Element } + * Objects of the following type(s) are allowed in the list {@link Element } * * */ @@ -1590,11 +1460,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1625,10 +1496,9 @@ public class Model {
          * Gets the value of the any property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the any property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the any property. * *

* For example, to add a new item, do as follows: @@ -1638,8 +1508,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Element } + * Objects of the following type(s) are allowed in the list {@link Element } * * */ @@ -1653,11 +1522,12 @@ public class Model { } - /** - *

Java class for anonymous complex type. + *

+ * Java class for anonymous complex type. * - *

The following schema fragment specifies the expected content contained within this class. + *

+ * The following schema fragment specifies the expected content contained within this class. * *

      * <complexType>
@@ -1687,10 +1557,9 @@ public class Model {
          * Gets the value of the repository property.
          *
          * 

- * This accessor method returns a reference to the live list, - * not a snapshot. Therefore any modification you make to the - * returned list will be present inside the JAXB object. - * This is why there is not a set method for the repository property. + * This accessor method returns a reference to the live list, not a snapshot. Therefore any modification you + * make to the returned list will be present inside the JAXB object. This is why there is not a set + * method for the repository property. * *

* For example, to add a new item, do as follows: @@ -1700,8 +1569,7 @@ public class Model { * * *

- * Objects of the following type(s) are allowed in the list - * {@link Repository } + * Objects of the following type(s) are allowed in the list {@link Repository } * * */ From a69804f84dbd1c18c2d85104a9ff023fe02226f1 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 1 Aug 2014 14:31:19 -0400 Subject: [PATCH 44/61] updated documentation Former-commit-id: e8b6c86e47cff66f72ffb53ccba4bef18479b43e --- .../src/site/markdown/installation.md.vm | 15 ++++++++++++++- .../src/site/markdown/{usage.md => usage.md.vm} | 10 +++++++++- 2 files changed, 23 insertions(+), 2 deletions(-) rename dependency-check-ant/src/site/markdown/{usage.md => usage.md.vm} (67%) diff --git a/dependency-check-ant/src/site/markdown/installation.md.vm b/dependency-check-ant/src/site/markdown/installation.md.vm index f45edf1f2..a49cd6568 100644 --- a/dependency-check-ant/src/site/markdown/installation.md.vm +++ b/dependency-check-ant/src/site/markdown/installation.md.vm @@ -3,7 +3,20 @@ Installation Download dependency-check-ant from [bintray here](http://dl.bintray.com/jeremy-long/owasp/dependency-check-ant-${project.version}.jar). To install dependency-check-ant place the dependency-check-ant-${project.version}.jar into the lib directory of your Ant instalation directory. Once installed you can add -the taskdef to you build.xml and add the task to a new or existing target. +the taskdef to you build.xml and add the task to a new or existing target: + +```xml + +``` + +If you do not want to install dependency-check-ant into your ant's lib directory when you define the task def you +must add the classpath to the taskdef: + +```xml + + + +``` It is important to understand that the first time this task is executed it may take 20 minutes or more as it downloads and processes the data from the National diff --git a/dependency-check-ant/src/site/markdown/usage.md b/dependency-check-ant/src/site/markdown/usage.md.vm similarity index 67% rename from dependency-check-ant/src/site/markdown/usage.md rename to dependency-check-ant/src/site/markdown/usage.md.vm index 7968b772a..49a4b8624 100644 --- a/dependency-check-ant/src/site/markdown/usage.md +++ b/dependency-check-ant/src/site/markdown/usage.md.vm @@ -1,11 +1,19 @@ Usage ==================== -First, add the dependency-check-ant taskdef to your build.xml: +First, add the dependency-check-ant taskdef to your build.xml (see the [installation guide](installation.html): ```xml ``` +Or + +```xml + + + +``` + Next, add the task to a target of your choosing: ```xml From f6eef54566391e819ffa2b9bed959685c0bdc4c4 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 1 Aug 2014 15:09:41 -0400 Subject: [PATCH 45/61] added fix for issue #136 Former-commit-id: c259a419769b41e138d3cbb3811f1c24652601d5 --- .../src/main/resources/templates/HtmlReport.vsl | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl index 96ea47a70..4c4f95d8d 100644 --- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl @@ -86,10 +86,10 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. } function toggleDisplay(el, clzName) { $(clzName).toggle(); - if (el.innerHTML == 'show all') { - el.innerHTML = 'less'; + if (el.innerHTML == 'Show All') { + el.innerHTML = 'Showing Vulnerable Dependencies'; } else { - el.innerHTML = 'show all'; + el.innerHTML = 'Show All'; } } @@ -481,7 +481,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.

Dependency-Check Report

@@ -513,7 +513,7 @@ arising out of or in connection with the use of this tool, the analysis performe #set($vulnSuppressedCount=$vulnSuppressedCount+$dependency.getSuppressedVulnerabilities().size()) #end #end - Scan Information (show all):
+ Scan Information (Showing Vulnerable Dependencies):
  • dependency-check version: $version
  • Report Generated On: $scanDate
  • @@ -630,7 +630,7 @@ arising out of or in connection with the use of this tool, the analysis performe #end #if ($id.type=="cpe") ##yes, we are HTML Encoding into JavaScript... the escape utils don't have a JS Encode and I haven't written one yet -    +    #end #if ($id.description)
    $enc.html($id.description) @@ -646,7 +646,7 @@ arising out of or in connection with the use of this tool, the analysis performe
    #foreach($vuln in $dependency.getVulnerabilities()) #set($vsctr=$vsctr+1) -

    $enc.html($vuln.name)  

    +

    $enc.html($vuln.name)  

    Severity: #if ($vuln.cvssScore<4.0) Low From 0a0c302cb24186bf13d8039137576cfcb379afd6 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Mon, 4 Aug 2014 06:22:11 -0400 Subject: [PATCH 46/61] re-orered the module listing Former-commit-id: 1ec7ccbc98463c5b2af09c973a1bc83319630ec8 --- src/site/site.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/site/site.xml b/src/site/site.xml index 1232b7879..5831d72b3 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -103,12 +103,6 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.

- - The core dependency-check library. - - - A set of utility classes used by dependency-check. - The command line interface for dependency-check. @@ -121,6 +115,12 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. A Jenkins plugin for dependency-check. + + The core dependency-check engine and reporting tool. + + + A set of utility classes used by dependency-check. +
Copyright © 2012-2014 Jeremy Long. All Rights Reserved.
From 54ceb630deb2a6f6bf8da035090fccf465ed02a4 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Mon, 4 Aug 2014 06:24:00 -0400 Subject: [PATCH 47/61] fixed project descriptions and corrected site deployment issues Former-commit-id: 39373b0805b84b99c3e84dbad1c8a2301f277221 --- dependency-check-ant/pom.xml | 5 ++++- dependency-check-cli/pom.xml | 5 ++++- dependency-check-core/pom.xml | 4 ++++ dependency-check-jenkins/pom.xml | 25 ++++++++++++------------- dependency-check-maven/pom.xml | 5 ++++- dependency-check-utils/pom.xml | 7 +++++-- pom.xml | 10 +--------- 7 files changed, 34 insertions(+), 27 deletions(-) diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml index da4961203..12d183bb0 100644 --- a/dependency-check-ant/pom.xml +++ b/dependency-check-ant/pom.xml @@ -28,7 +28,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. jar Dependency-Check Ant Task - Dependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. + dependency-check-ant is an Ant Task that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the project's dependencies. The task will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. @@ -324,6 +324,9 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.apache.maven.plugins maven-javadoc-plugin 2.9.1 + + Copyright© 2012-14 Jeremy Long. All Rights Reserved. + default diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index fdf11af18..8af381366 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -28,7 +28,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. jar Dependency-Check Command Line - Dependency-Check-Maven is a Maven Plugin that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. + dependency-check-cli is an command line tool that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the scanned project dependencies. The tool will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. @@ -174,6 +174,9 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.apache.maven.plugins maven-javadoc-plugin 2.9.1 + + Copyright© 2012-14 Jeremy Long. All Rights Reserved. + default diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index ed6cef941..e760639d4 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -27,6 +27,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. jar Dependency-Check Core + dependency-check-core is the engine and reporting tool used to identify and report if there are any known, publicly disclosed vulnerabilities in the scanned project's dependencies. The engine extracts meta-data from the dependencies and uses this to do fuzzy key-word matching against the Common Platfrom Enumeration (CPE), if any CPE identifiers are found the associated Common Vulnerability and Exposure (CVE) entries are added to the generated report. @@ -271,6 +272,9 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.apache.maven.plugins maven-javadoc-plugin 2.9.1 + + Copyright© 2012-14 Jeremy Long. All Rights Reserved. + default diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index ff1ba1be8..5966fe386 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -1,17 +1,25 @@ 4.0.0 - - This plug-in can independently execute a Dependency-Check analysis and visualize the results. - http://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin org.owasp dependency-check-parent 1.2.4-SNAPSHOT - org.owasp dependency-check-jenkins Dependency-Check Jenkins Plugin + http://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin + dependency-check-jenkins is a Jenkins plugin that runs dependency-check-core on a project to detect publicly disclosed vulnerabilities associated with the project's dependencies. The plugin will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. This module is simply a placeholder and does not contain the actual plugin source code. The source code and distribution of the plugin is handled via https://github.com/jenkinsci/dependency-check-jenkins and Jenkin's plugin management. + + + + github-pages-site + Deployment through GitHub's site deployment plugin + ${basedir}/../target/site/${project.version}/dependency-check-jenkins + + + + pom 2012 @@ -31,15 +39,6 @@ - - - - github-pages-site - Deployment through GitHub's site deployment plugin - ${basedir}/../target/site/${project.version}/dependency-check-maven - - - scm:git:git@github.com:jenkinsci/dependency-check-jenkins.git https://github.com/jenkinsci/dependency-check-jenkins diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index 84046e127..91fa518ca 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -29,7 +29,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. maven-plugin Dependency-Check Maven Plugin - Dependency-Check-Maven is a Maven Plugin that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. + dependency-check-maven is a Maven Plugin that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the project's dependencies. The plugin will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. 2013 @@ -149,6 +149,9 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.apache.maven.plugins maven-javadoc-plugin 2.9.1 + + Copyright© 2012-14 Jeremy Long. All Rights Reserved. + default diff --git a/dependency-check-utils/pom.xml b/dependency-check-utils/pom.xml index 9c18043e4..1200559cf 100644 --- a/dependency-check-utils/pom.xml +++ b/dependency-check-utils/pom.xml @@ -26,13 +26,13 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. dependency-check-utils Dependency-Check Utils - Dependency-check-utils a collection of common utlity classes used within dependency-check. + dependency-check-utils is a collection of common utlity classes used within dependency-check that might be useful in other projects. github-pages-site Deployment through GitHub's site deployment plugin - ${basedir}/../target/site/${project.version}/dependency-check-ant + ${basedir}/../target/site/${project.version}/dependency-check-utils @@ -158,6 +158,9 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.apache.maven.plugins maven-javadoc-plugin 2.9.1 + + Copyright© 2012-14 Jeremy Long. All Rights Reserved. + default diff --git a/pom.xml b/pom.xml index 50817e55e..e1b968423 100644 --- a/pom.xml +++ b/pom.xml @@ -33,7 +33,7 @@ Copyright (c) 2012 - Jeremy Long Dependency-Check https://github.com/jeremylong/DependencyCheck.git - dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. + dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. 2012 @@ -141,14 +141,6 @@ Copyright (c) 2012 - Jeremy Long 1.6 - - org.apache.maven.plugins - maven-javadoc-plugin - 2.9.1 - - Copyright© 2012-13 Jeremy Long. All Rights Reserved. - - org.apache.maven.plugins From cf21dfaa3a980095763c85a2acaf46ac730bf94b Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Mon, 4 Aug 2014 08:05:31 -0400 Subject: [PATCH 48/61] changed warning log message Former-commit-id: 9a7fd59cd15e627ed103a6e797bc47518805276b --- .../org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java index 413e35da9..9cab329ee 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java @@ -242,7 +242,7 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer { final File tdir = getNextTempDirectory(); final String fileName = dependency.getFileName(); - LOGGER.info(String.format("The zip file '%s' appears to be a JAR file, making a deep copy and analyzing it as a JAR.", fileName)); + LOGGER.info(String.format("The zip file '%s' appears to be a JAR file, making a copy and analyzing it as a JAR.", fileName)); final File tmpLoc = new File(tdir, fileName.substring(0, fileName.length() - 3) + "jar"); try { From 6ccc053d7e949f3f1a8388b1a55f552e4bcef25a Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Tue, 5 Aug 2014 09:16:38 -0400 Subject: [PATCH 49/61] added more documentation Former-commit-id: 87a761ffe89d36fb2011d5a38d607c35178d70ec --- src/site/markdown/internals.md | 35 ++++++++++++++++++++++++++++++++++ src/site/markdown/thereport.md | 26 +++++++++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 src/site/markdown/internals.md create mode 100644 src/site/markdown/thereport.md diff --git a/src/site/markdown/internals.md b/src/site/markdown/internals.md new file mode 100644 index 000000000..3eeeb7086 --- /dev/null +++ b/src/site/markdown/internals.md @@ -0,0 +1,35 @@ +How does dependency-check work? +=========== +Dependency-check works by collecting information about the files it scans (using Analyzers). The information collected +is called Evidence; there are three types of evidence collected: vendor, product, and version. For instance, the +JarAnalyzer will collect information from the Manifest, pom.xml, and the package names within the JAR files scanned and +it has heuristics to place the information from the various sources into one or more buckets of evidence. + +Within the NVD CVE Data (schema can be found [here](http://nvd.nist.gov/schema/nvd-cve-feed_2.0.xsd)) each CVE Entry has a list of vulnerable software: +```xml + + ... + + cpe:/a:vmware:springsource_spring_security:3.1.2 + cpe:/a:vmware:springsource_spring_security:2.0.4 + cpe:/a:vmware:springsource_spring_security:3.0.1 +``` + +These CPE entries are read "cpe:/[Entry Type]:[Vendor]:[Product]:[Version]:[Revision]:...". The CPE data is collected +and stored in a [Lucene Index](http://lucene.apache.org/). Dependency-check then use the Evidence collected and attempt +to match an entry from the Lucene CPE Index. If found, the CPEAnalyzer will add an Identifier to the Dependency and +subsequently to the report. Once a CPE has been identified the associated CVE entries are added to the report. + +One important point about the evidence is that it is rated using different confidence levels - low, medium, high, and +highest. These confidence levels are applied to each item of evidence. When the CPE is determined it is given a confidence +level that is equal to the lowest level confidence level of evidence used during identification. If only highest confidence +evidence was used in determining the CPE then the CPE would have a highest confidence level. + +Because of the way dependency-check works both false positives and false negatives may exist. Please read +(How to read the report)[thereport.html] to get a better understanding of sorting through the false positives and false +negatives. + +Dependency-check does not currently use file hashes for identification. If the dependency was built from source the hash +likely will not match the "published" hash. While the evidence based mechanism currently used can also be unreliable the +design decision was to avoid maintaining a hash database of known vulnerable libraries. A future enhancement may add some +hash matching for very common well known libraries (Spring, Struts, etc.). \ No newline at end of file diff --git a/src/site/markdown/thereport.md b/src/site/markdown/thereport.md new file mode 100644 index 000000000..ab3c31525 --- /dev/null +++ b/src/site/markdown/thereport.md @@ -0,0 +1,26 @@ +How To Read The Report +======== +There is a lot of information contained in the HTML version of the report. When analyzing the results, the first thing one should do is determine if the CPE looks +appropriate. Due to the way dependency-check works (see above) the report may contain false positives; these false positives are primarily on the CPE values. If the CPE value +is wrong, this is usually obvious and one should use the suppression feature in the report to generate a suppression XML file that can be used on future scans. In addition +to just looking at the CPE values in comparison to the name of the dependency - one may also consider the confidence of the CPE (as discussed in (How does dependency-check +work)[internals.html]). See the (Suppression False Positives)[suppression.html] page for more information on how to generate and use the suppression file. + +Once you have weeded out any obvious false positives one can then look at the remaining entries and determine if any of the identified CVE entries are actually +exploitable in your environment. Determining if a CVE is exploitable in your environment can be tricky - for this I do not currently have any tips other then +upgrade the library if you can just to be safe. Note, some CVE entries can be fixed by either upgrading the library or changing configuration options. + +One item that dependency-check flags that many may think is a false positive are old database drivers. One thing to consider about an old database driver is that the +CPE/CVEs identified are usually for the server rather then the driver. However, the presence of an old driver may indicate that you have an older version of the server +running in your environment and that server may need to be patched or upgraded. However, in some cases the old database drivers are actually unused, transitive dependencies +from other dependencies. + +Regarding False Negatives +======= +As stated above, due to the nature of dependency-check there may be publicly disclosed vulnerabilities in the project dependencies scanned by dependency-check that +are not identified. With the current version of dependency-check the HTML report has a table at the top that initially displays just the dependencies with identified +vulnerabilities. This can be toggled to show all dependencies. If you examine the rows that do not have identified CPE/CVE entries you will see an "evidence count". +If the evidence count is extremely low (0-5 entries) then there may not have been enough information contained in the dependency to identify a CPE and associated CVEs. + +It should be noted that while the false positives described above are bad, more concerning is that there may be vulnerabilities within the project dependencies that +have yet to be publicly known. If one has the resources consider performing security assessments on the project dependencies. From ba5dbb94b84638442382996be643d5fd10bba719 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Tue, 5 Aug 2014 09:18:35 -0400 Subject: [PATCH 50/61] removed fully qualified class name from jaxb instantiation Former-commit-id: 15d5f9e2013daba62f7e32618958743e87e8ea79 --- .../java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index b333c1e36..2895bf6e2 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -170,7 +170,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { public JarAnalyzer() { try { //final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated"); - final JAXBContext jaxbContext = JAXBContext.newInstance(org.owasp.dependencycheck.jaxb.pom.generated.Model.class); + final JAXBContext jaxbContext = JAXBContext.newInstance(Model.class); pomUnmarshaller = jaxbContext.createUnmarshaller(); } catch (JAXBException ex) { //guess we will just have a null pointer exception later... LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details."); From fabe1aa94058438a42349249b2bf2ae6a71119b8 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Tue, 5 Aug 2014 09:19:00 -0400 Subject: [PATCH 51/61] checkstyle corrections Former-commit-id: d23c5d17629f8484c1c07d328c9c1b74a678e062 --- .../dependencycheck/data/nvdcve/ConnectionFactory.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java index ac93f861f..18a50c7d3 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java @@ -112,7 +112,10 @@ public final class ConnectionFactory { //yes, yes - hard-coded password - only if there isn't one in the properties file. password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); try { - connectionString = Settings.getConnectionString(Settings.KEYS.DB_CONNECTION_STRING, Settings.KEYS.DB_FILE_NAME, Settings.KEYS.DB_VERSION); + connectionString = Settings.getConnectionString( + Settings.KEYS.DB_CONNECTION_STRING, + Settings.KEYS.DB_FILE_NAME, + Settings.KEYS.DB_VERSION); } catch (IOException ex) { LOGGER.log(Level.FINE, "Unable to retrieve the database connection string", ex); @@ -226,7 +229,7 @@ public final class ConnectionFactory { */ private static boolean h2DataFileExists() throws IOException { final File dir = Settings.getDataDirectory(); - String name = Settings.getString(Settings.KEYS.DB_FILE_NAME); + final String name = Settings.getString(Settings.KEYS.DB_FILE_NAME); final String fileName = String.format(name, DB_SCHEMA_VERSION); final File file = new File(dir, fileName); return file.exists(); From c6dbc01912b668aa6e9e243cb474d534fd0c10c3 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Tue, 5 Aug 2014 09:19:35 -0400 Subject: [PATCH 52/61] ensured FileInputStream is correctly closed Former-commit-id: 6e0362476f456e5af07e686fdccf04e600a97de8 --- .../suppression/SuppressionParser.java | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java index c3cc9c7d6..aa3b0da30 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionParser.java @@ -27,11 +27,9 @@ import java.io.Reader; import java.util.List; import java.util.logging.Level; import java.util.logging.Logger; - import javax.xml.parsers.ParserConfigurationException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; - import org.xml.sax.InputSource; import org.xml.sax.SAXException; import org.xml.sax.XMLReader; @@ -68,17 +66,27 @@ public class SuppressionParser { * @throws SuppressionParseException thrown if the xml file cannot be parsed */ public List parseSuppressionRules(File file) throws SuppressionParseException { + FileInputStream fis = null; try { - return parseSuppressionRules(new FileInputStream(file)); + fis = new FileInputStream(file); + return parseSuppressionRules(fis); } catch (IOException ex) { LOGGER.log(Level.FINE, null, ex); throw new SuppressionParseException(ex); + } finally { + if (fis != null) { + try { + fis.close(); + } catch (IOException ex) { + LOGGER.log(Level.FINE, "Unable to close stream", ex); + } + } } } /** * Parses the given xml stream and returns a list of the suppression rules contained. - * + * * @param inputStream an InputStream containing suppression rues * @return a list of suppression rules * @throws SuppressionParseException if the xml cannot be parsed From bd955cda061faa7bf3072da665aa3f83ecfb7bd3 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Tue, 5 Aug 2014 09:22:28 -0400 Subject: [PATCH 53/61] improved TOC per issue #138 Former-commit-id: 7cc7ccb9d0dd8257588438220bf61d78caa2bcec --- .../main/resources/templates/HtmlReport.vsl | 128 ++++++++++++++---- 1 file changed, 104 insertions(+), 24 deletions(-) diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl index 4c4f95d8d..52062ca6f 100644 --- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl @@ -84,13 +84,14 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. $('#modal-text').focus(); $('#modal-text').select(); } - function toggleDisplay(el, clzName) { + function toggleDisplay(el, clzName, all, some) { $(clzName).toggle(); - if (el.innerHTML == 'Show All') { - el.innerHTML = 'Showing Vulnerable Dependencies'; + if (el.innerHTML == all) { + el.innerHTML = some; } else { - el.innerHTML = 'Show All'; + el.innerHTML = all; } + return false; }