From da82f975e49e457d00958f468d3643e7ad40725d Mon Sep 17 00:00:00 2001 From: bjiang Date: Fri, 15 Apr 2016 12:30:14 -0400 Subject: [PATCH] Add test for project url from pom.xml --- .../dependencycheck/analyzer/JarAnalyzer.java | 2 +- .../analyzer/JarAnalyzerTest.java | 29 +++++++++++++----- .../src/test/resources/dwr.jar | Bin 0 -> 2087 bytes 3 files changed, 23 insertions(+), 8 deletions(-) create mode 100644 dependency-check-core/src/test/resources/dwr.jar diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index 22549e6c9..51bf51724 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -568,7 +568,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { String projectURL = pom.getProjectURL(); if(projectURL != null && !projectURL.trim().isEmpty()) { - dependency.getVersionEvidence().addEvidence("pom", "url", projectURL, Confidence.HIGHEST); + dependency.getVendorEvidence().addEvidence("pom", "url", projectURL, Confidence.HIGHEST); } extractLicense(pom, dependency); diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java index de85050be..9c8b44cf6 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java @@ -17,23 +17,25 @@ */ package org.owasp.dependencycheck.analyzer; -import org.junit.Test; -import org.owasp.dependencycheck.BaseTest; -import org.owasp.dependencycheck.dependency.Dependency; -import org.owasp.dependencycheck.dependency.Evidence; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; import java.io.File; import java.util.ArrayList; import java.util.List; -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertTrue; +import org.junit.Test; +import org.owasp.dependencycheck.BaseTest; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; /** * @author Jeremy Long */ public class JarAnalyzerTest extends BaseTest { +// private static final Logger LOGGER = LoggerFactory.getLogger(JarAnalyzerTest.class); + /** * Test of inspect method, of class JarAnalyzer. * @@ -48,12 +50,25 @@ public class JarAnalyzerTest extends BaseTest { instance.analyze(result, null); assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache")); assertTrue(result.getVendorEvidence().getWeighting().contains("apache")); + + file = BaseTest.getResourceAsFile(this, "dwr.jar"); + result = new Dependency(file); + instance.analyze(result, null); + boolean found = false; + for (Evidence e : result.getVendorEvidence()) { + if (e.getName().equals("url")) { + assertEquals("Project url was not as expected in dwr.jar", e.getValue(), "http://getahead.ltd.uk/dwr"); + found = true; + break; + } + } + assertTrue("Project url was not found in dwr.jar", found); //file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); file = BaseTest.getResourceAsFile(this, "org.mortbay.jetty.jar"); result = new Dependency(file); instance.analyze(result, null); - boolean found = false; + found = false; for (Evidence e : result.getProductEvidence()) { if (e.getName().equalsIgnoreCase("package-title") && e.getValue().equalsIgnoreCase("org.mortbay.http")) { diff --git a/dependency-check-core/src/test/resources/dwr.jar b/dependency-check-core/src/test/resources/dwr.jar new file mode 100644 index 0000000000000000000000000000000000000000..cbe768ad601f9b3a32955a0d1350f48cb07eeda0 GIT binary patch literal 2087 zcmZ{lcT^MBAH^dfY!Ims_E12PS;I8O03kpK!ITEsVTNfMWLT)Q0+AUuD3l?}7Lg5t z$`C{rmJ>;myRI&Zo1v>2oY1sz8ei zrF$bNP)J4w+2)TIYzPiwGG04*E}B#h6$*udn#@`$`Gs?!f!244OqENCN#6~V#quMk zgIEowtJ#@lr|@Cz=r&}8_$|41!xX*#+jtR)lzYy^0lti6ywH7+NuDgF;@+Iu>TOxd z_wslKQ+{+`s7^rhto}j-uDe_v?uaxp4x4vmdPI^6^uSc;vzON*3@_AHifB5XvvQOj z_99|RNy%1&)BI8?HBmd6GobXga$il{Bnm|E34vg_w*b+^V051Ygu-jnrF=O~K1K_q zK;>Lqdu$xG#-4v7mfJ~nN?vO%`Q#^+F2(sKQzrHez6`LyL7z=CFj)voPqzHd^f zQEp&ve!8O@O4R0gcz8y<+=li)yJGdIB~w{smjj{KX_-ZF&qkN9WRA~}M0@Sz+}3hr8?D-U zSt?Jjdh7GcFG&WbzOd=BGhAcyBZG5T;xP?#4McL$?|oMF6XuQbr%8z$ zkegkE6NIPkL_dV6lmt;xyy43f@KR)R-+I~jt*EDUXG}yx?h#Hx6~qT%?soGM6ZjWs ztHBd=k>Msz*51$~f}oQ%urg|ZGk8?K)MW%E#i-@&ey9pFVeYyz)PNkP()3(1v&P>s z>mgG)*Y!%M*u-6*t$_ zT1_-|5)P;-Mf#b9#P85iUuqr{!Ri8H5uX=jLyc*QrKDZyyUBJF&CMD;fiiHYL_p`B zhvi+jG9a)nY~ho=s4J}Tu@X>1K+v1V;Q0sjz^R@}IXnGM7IoPu1VELy9lXC=g}~SP!_N9Zs|sNzY!jU{NurL~_YSWVtebDd&BU*mLAr1& zgF`Cz3^J@(_;t{-aHas1vGbC?R3s}b4GH%!^TsU+(eeP$ap+~jLHxM>{ueNpIStPhk02>(o z$0N6XF?|Uz7<)`PY(6)@9=n)TEafl~Uuy8PXmNCj=rV7%e6UzvQc+7U%P8%M^aSiN z#NH`aY0n(0tbBiw)g7NQ zi`frn${%(n4*RjEaa^1c^Ws+U^f&(G>e4!9Zgc)#uJ$=;0skQnnzcytj)h#64il7G zudOq?Zuoj2>gvZUJP9#ls@s!_MKV$aef`f3SyC2#zO@zc>&ftURY~WLnMw=cq90@D zFWejzeq+-h|9i;u3g^M%FrS(fSmMp#bWPit(Bb+$KNiLn&zrx|;#za|S;V$oxsE0H=z!*3e{HFGU@gGuR(V&CwhqMO*Y7Ta%zny;pQ9X(h literal 0 HcmV?d00001