From 2b04c6a7ddff2eba5e1f164fe5ddc69e5b898ea2 Mon Sep 17 00:00:00 2001 From: Prakhash Date: Mon, 13 Mar 2017 15:52:50 +0530 Subject: [PATCH 1/5] changed the coordinates according to the pom file details --- .../reporting/ReportGenerator.java | 22 +++++++++++++++++++ .../resources/schema/dependency-check.1.3.xsd | 3 +++ .../resources/schema/dependency-check.1.4.xsd | 3 +++ .../main/resources/templates/XmlReport.vsl | 3 +++ .../ReportGeneratorIntegrationTest.java | 4 ++-- .../maven/BaseDependencyCheckMojo.java | 2 +- 6 files changed, 34 insertions(+), 3 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java index a97aef3fa..539cbbc85 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java @@ -125,6 +125,28 @@ public class ReportGenerator { context.put("version", Settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown")); } + /** + * Constructs a new ReportGenerator. + * + * @param applicationName the application name being analyzed + * @param applicationVersion the application version being analyzed + * @param artifactID the application version being analyzed + * @param applicationVersion the application version being analyzed + * @param dependencies the list of dependencies + * @param analyzers the list of analyzers used + * @param properties the database properties (containing timestamps of the + * NVD CVE data) + */ + + public ReportGenerator(String applicationName,String applicationVersion,String artifactID,String groupID, List dependencies, List analyzers, DatabaseProperties properties) { + + this(applicationName,dependencies,analyzers,properties); + context.put("applicationVersion",applicationVersion); + context.put("artifactID",artifactID); + context.put("groupID",groupID); + } + + /** * Creates a new Velocity Engine. * diff --git a/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd b/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd index 023eb6f15..a41310151 100644 --- a/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd +++ b/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd @@ -24,6 +24,9 @@ + + + diff --git a/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd b/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd index 01178fa7e..aa8a8547f 100644 --- a/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd +++ b/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd @@ -23,6 +23,9 @@ + + + diff --git a/dependency-check-core/src/main/resources/templates/XmlReport.vsl b/dependency-check-core/src/main/resources/templates/XmlReport.vsl index 143826c57..166f5df14 100644 --- a/dependency-check-core/src/main/resources/templates/XmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/XmlReport.vsl @@ -31,6 +31,9 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. $enc.xml($applicationName) + $enc.xml($version) + $enc.xml($artifactID) + $enc.xml($groupID) $scanDateXML This report contains data retrieved from the National Vulnerability Database: http://nvd.nist.gov diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java index f379d332d..a911a39dd 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java @@ -146,8 +146,8 @@ public class ReportGeneratorIntegrationTest extends BaseDBTestCase { CveDB cveDB = CveDB.getInstance(); DatabaseProperties dbProp = cveDB.getDatabaseProperties(); - - ReportGenerator generator = new ReportGenerator("Test Report", engine.getDependencies(), engine.getAnalyzers(), dbProp); + + ReportGenerator generator = new ReportGenerator("Test Report","1.4.7","dependency-check-core","org.owasp", engine.getDependencies(), engine.getAnalyzers(), dbProp); generator.generateReport(templateName, writeTo); engine.cleanup(); diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java index d2e95260c..cc3c3c5d6 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java @@ -1016,7 +1016,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma getLog().debug("Unable to retrieve DB Properties", ex); } } - final ReportGenerator r = new ReportGenerator(p.getName(), engine.getDependencies(), engine.getAnalyzers(), prop); + final ReportGenerator r = new ReportGenerator(p.getName(),p.getVersion(),p.getArtifactId(),p.getGroupId(), engine.getDependencies(), engine.getAnalyzers(), prop); try { r.generateReports(outputDir.getAbsolutePath(), format); } catch (ReportException ex) { From e3ca70ba0d4e44fef6af9dfc053f1bc3e29ad555 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 5 May 2017 14:13:35 -0400 Subject: [PATCH 2/5] reverted changes in PR to old schemas --- .../src/main/resources/schema/dependency-check.1.3.xsd | 3 --- .../src/main/resources/schema/dependency-check.1.4.xsd | 3 --- 2 files changed, 6 deletions(-) diff --git a/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd b/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd index a41310151..023eb6f15 100644 --- a/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd +++ b/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd @@ -24,9 +24,6 @@ - - - diff --git a/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd b/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd index aa8a8547f..01178fa7e 100644 --- a/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd +++ b/dependency-check-core/src/main/resources/schema/dependency-check.1.4.xsd @@ -23,9 +23,6 @@ - - - From a4899de956589297bcf91c69d2f66c0e2def0189 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 5 May 2017 14:14:17 -0400 Subject: [PATCH 3/5] added new schema to support the addition of the GAV --- .../resources/schema/dependency-check.1.5.xsd | 203 ++++++++++++++++++ 1 file changed, 203 insertions(+) create mode 100644 dependency-check-core/src/main/resources/schema/dependency-check.1.5.xsd diff --git a/dependency-check-core/src/main/resources/schema/dependency-check.1.5.xsd b/dependency-check-core/src/main/resources/schema/dependency-check.1.5.xsd new file mode 100644 index 000000000..191cdb202 --- /dev/null +++ b/dependency-check-core/src/main/resources/schema/dependency-check.1.5.xsd @@ -0,0 +1,203 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file From b3736ac13a59424dcb21aa939ee7696be3117a98 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 5 May 2017 14:15:04 -0400 Subject: [PATCH 4/5] updated template optional add the GAV --- .../src/main/resources/templates/XmlReport.vsl | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/dependency-check-core/src/main/resources/templates/XmlReport.vsl b/dependency-check-core/src/main/resources/templates/XmlReport.vsl index 166f5df14..3ff033714 100644 --- a/dependency-check-core/src/main/resources/templates/XmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/XmlReport.vsl @@ -19,7 +19,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. @version 1.2 *# - + $version #foreach($prop in $properties.getMetaData().entrySet()) @@ -31,9 +31,15 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. $enc.xml($applicationName) - $enc.xml($version) - $enc.xml($artifactID) +#if ($groupID) $enc.xml($groupID) +#end +#if ($artifactID) + $enc.xml($artifactID) +#end +#if ($version) + $enc.xml($version) +#end $scanDateXML This report contains data retrieved from the National Vulnerability Database: http://nvd.nist.gov From 5c2145176055d8183ca12d7b3f5b9033684c726e Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 5 May 2017 14:15:21 -0400 Subject: [PATCH 5/5] updated to use the new schema --- .../reporting/ReportGeneratorIntegrationTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java index e27fa4b6c..05eb28ab8 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/reporting/ReportGeneratorIntegrationTest.java @@ -153,7 +153,7 @@ public class ReportGeneratorIntegrationTest extends BaseDBTestCase { engine.cleanup(); - InputStream xsdStream = ReportGenerator.class.getClassLoader().getResourceAsStream("schema/dependency-check.1.4.xsd"); + InputStream xsdStream = ReportGenerator.class.getClassLoader().getResourceAsStream("schema/dependency-check.1.5.xsd"); StreamSource xsdSource = new StreamSource(xsdStream); StreamSource xmlSource = new StreamSource(new File(writeTo)); SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);