Prints the manifest information to standard output.
*Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);
*/
@Deprecated
@@ -136,6 +136,22 @@ public class Engine {
return dependencies;
}
+ /**
+ * Scans an array of files or directories. If a directory is specified, it
+ * will be scanned recursively. Any dependencies identified are added to the
+ * dependency collection.
+ *
+ * @since v0.3.2.5
+ *
+ * @param paths an array of paths to files or directories to be analyzed.
+ */
+ public void scan(String[] paths) {
+ for (String path : paths) {
+ final File file = new File(path);
+ scan(file);
+ }
+ }
+
/**
* Scans a given file or directory. If a directory is specified, it will be
* scanned recursively. Any dependencies identified are added to the
@@ -147,6 +163,52 @@ public class Engine {
final File file = new File(path);
scan(file);
}
+
+ /**
+ * Scans an array of files or directories. If a directory is specified, it
+ * will be scanned recursively. Any dependencies identified are added to the
+ * dependency collection.
+ *
+ * @since v0.3.2.5
+ *
+ * @param files an array of paths to files or directories to be analyzed.
+ */
+ public void scan(File[] files) {
+ for (File file : files) {
+ scan(file);
+ }
+ }
+
+ /**
+ * Scans a list of files or directories. If a directory is specified, it
+ * will be scanned recursively. Any dependencies identified are added to the
+ * dependency collection.
+ *
+ * @since v0.3.2.5
+ *
+ * @param files a set of paths to files or directories to be analyzed.
+ */
+ public void scan(SetAn analyzer that works on archive files: + *
Intended to remove spurious CPE entries. By spurious we mean + * duplicate, less specific CPE entries.
+ *Example:
+ *
+ * cpe:/a:some-vendor:some-product
+ * cpe:/a:some-vendor:some-product:1.5
+ * cpe:/a:some-vendor:some-product:1.5.2
+ *
+ * Should be trimmed to:
+ *
+ * cpe:/a:some-vendor:some-product:1.5.2
+ *
+ *
+ * @param dependency the dependency being analyzed
+ */
+ private void removeSpuriousCPE(Dependency dependency) {
+ final ListReads the manifest from the JAR file and collects the entries. Some - * key entries are:
A utility function that will interpolate strings based on values given + * in the properties file. It will also interpolate the strings contained * within the properties file so that properties can reference other - * properties. + * properties.
+ *Note: if there is no property found the reference will be + * removed. In other words, if the interpolated string will be replaced with + * an empty string. + *
+ *Example:
+ *
+ * Properties p = new Properties();
+ * p.setProperty("key", "value");
+ * String s = interpolateString("'${key}' and '${nothing}'", p);
+ * System.out.println(s);
+ *
+ * Will result in:
+ *
+ * 'value' and ''
+ *
*
* @param text the string that contains references to properties.
* @param properties a collection of properties that may be referenced
@@ -762,10 +781,13 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
* @return the interpolated text.
*/
protected String interpolateString(String text, Properties properties) {
- //${project.build.directory}
- if (properties == null || text == null) {
+ Properties props = properties;
+ if (text == null) {
return text;
}
+ if (props == null) {
+ props = new Properties();
+ }
final int pos = text.indexOf("${");
if (pos < 0) {
@@ -777,7 +799,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
}
final String propName = text.substring(pos + 2, end);
- String propValue = interpolateString(properties.getProperty(propName), properties);
+ String propValue = interpolateString(props.getProperty(propName), props);
if (propValue == null) {
propValue = "";
}
@@ -785,15 +807,17 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
sb.append(text.subSequence(0, pos));
sb.append(propValue);
sb.append(text.substring(end + 1));
- return interpolateString(sb.toString(), properties); //yes yes, this should be a loop...
+ return interpolateString(sb.toString(), props); //yes yes, this should be a loop...
}
/**
- * Determines if the key value pair from the manifest is for an "import" type
- * entry for package names.
+ * Determines if the key value pair from the manifest is for an "import"
+ * type entry for package names.
+ *
* @param key the key from the manifest
* @param value the value from the manifest
- * @return true or false depending on if it is believed the entry is an "import" entry
+ * @return true or false depending on if it is believed the entry is an
+ * "import" entry
*/
private boolean isImportPackage(String key, String value) {
final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$");
@@ -804,69 +828,285 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
}
/**
- * Cycles through an enumeration of JarEntries and collects level 0-3 directory
- * structure names. This is helpful when analyzing vendor/product as many times
- * this is included in the package name. This does not analyze core Java package
- * names.
+ * Cycles through an enumeration of JarEntries, contained within the
+ * dependency, and returns a list of the class names. This does not include
+ * core Java package names (i.e. java.* or javax.*).
*
- * @param en an Enumeration of JarEntries
- * @param level0 HashMap of level 0 package names (e.g. org)
- * @param level1 HashMap of level 1 package names (e.g. owasp)
- * @param level2 HashMap of level 2 package names (e.g. dependencycheck)
- * @param level3 HashMap of level 3 package names (e.g. analyzer)
- * @return the number of entries processed that were included in the above HashMaps
+ * @param dependency the dependency being analyzed
+ * @return an list of fully qualified class names
*/
- private int collectPackageNameInformation(Enumeration en, HashMapThis is currently a failed implementation. Part of the issue is + * I was trying to solve the wrong problem. Instead of multiple POMs being + * in the JAR to just add information about dependencies - I didn't realize + * until later that I was looking at an uber-jar (aka fat-jar) that included + * all of its dependencies.
+ *I'm leaving this method in the source tree, entirely commented out + * until a solution https://github.com/jeremylong/DependencyCheck/issues/11 + * has been implemented.
+ *Takes a list of pom entries from a JAR file and attempts to filter it + * down to the pom related to the jar (rather then the pom entry for a + * dependency).
+ * + * @param pomEntries a list of pom entries + * @param classes a list of fully qualified classes from the JAR file + * @return the list of pom entries that are associated with the jar being + * analyzed rather then the dependent poms + */ + private ListClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer");
+ * System.out.println(obj.getName());
+ * for (String p : obj.getPackageStructure())
+ * System.out.println(p);
+ * Would result in:
+ * org.owasp.dependencycheck.analyzer.JarAnalyzer
+ * owasp
+ * dependencycheck
+ * analyzer
+ * jaranalyzer
+ *
+ * @param className a fully qualified class name
+ */
+ ClassNameInformation(String className) {
+ name = className;
+ if (name.contains("/")) {
+ final String[] tmp = className.toLowerCase().split("/");
+ int start = 0;
+ int end = 3;
+ if ("com".equals(tmp[0]) || "org".equals(tmp[0])) {
+ start = 1;
+ end = 4;
+ }
+ if (tmp.length <= end) {
+ end = tmp.length - 1;
+ }
+ for (int i = start; i <= end; i++) {
+ packageStructure.add(tmp[i]);
+ }
+ } else {
+ packageStructure.add(name);
+ }
+ }
+ /**
+ * The fully qualified class name.
+ */
+ private String name;
+
+ /**
+ * Get the value of name
+ *
+ * @return the value of name
+ */
+ public String getName() {
+ return name;
+ }
+
+ /**
+ * Set the value of name
+ *
+ * @param name new value of name
+ */
+ public void setName(String name) {
+ this.name = name;
+ }
+ /**
+ * Up to the first four levels of the package structure, excluding a
+ * leading "org" or "com".
+ */
+ private ArrayListSearches the Lucene CPE index to identify possible CPE entries + * associated with the supplied vendor, product, and version.
+ * + *If either the vendorWeightings or productWeightings lists have been + * populated this data is used to add weighting factors to the search.
+ * + * @param vendor the text used to search the vendor field + * @param product the text used to search the product field + * @param vendorWeightings a list of strings to use to add weighting factors + * to the vendor field + * @param productWeightings Adds a list of strings that will be used to add + * weighting factors to the product search + * @return a list of possible CPE values + * @throws CorruptIndexException when the Lucene index is corrupt + * @throws IOException when the Lucene index is not found + * @throws ParseException when the generated query is not valid + */ + protected ListBuilds a Lucene search string by properly escaping data and + * constructing a valid search query.
+ * + *If either the possibleVendor or possibleProducts lists have been + * populated this data is used to add weighting factors to the search string + * generated.
+ * + * @param vendor text to search the vendor field + * @param product text to search the product field + * @param vendorWeighting a list of strings to apply to the vendor to boost + * the terms weight + * @param productWeightings a list of strings to apply to the product to + * boost the terms weight + * @return the Lucene query + */ + protected String buildSearch(String vendor, String product, + SetParses a name attribute value, from the cpe.xml, into its - * corresponding parts: vendor, product, version, revision.
+ * corresponding parts: vendor, product. *Example:
- * cpe:/a:apache:struts:1.1:rc2
+ * nbsp;nbsp;nbsp;cpe:/a:apache:struts:1.1:rc2
*
* Results in:
If it is necessary to parse the CPE into more parts (i.e. to include + * version and revision) then you should use the + * {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}. * * @param cpeName the cpe name * @throws UnsupportedEncodingException should never be thrown... */ public void parseName(String cpeName) throws UnsupportedEncodingException { - this.name = cpeName; if (cpeName != null && cpeName.length() > 7) { final String[] data = cpeName.substring(7).split(":"); if (data.length >= 1) { - vendor = URLDecoder.decode(data[0], "UTF-8").replaceAll("[_-]", " "); + vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8"); if (data.length >= 2) { - product = URLDecoder.decode(data[1], "UTF-8").replaceAll("[_-]", " "); - if (data.length >= 3) { - version = URLDecoder.decode(data[2], "UTF-8"); - if (data.length >= 4) { - revision = URLDecoder.decode(data[3], "UTF-8"); - } - //ignore edition and language fields.. don't really see them used in the a: - } + product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8"); } } } } + @Override + public int hashCode() { + int hash = 7; + hash = 97 * hash + (this.getDocumentId() != null ? this.getDocumentId().hashCode() : 0); + return hash; + } + @Override public boolean equals(Object obj) { if (obj == null) { @@ -227,14 +167,23 @@ public class Entry implements Serializable { if (getClass() != obj.getClass()) { return false; } - final Entry other = (Entry) obj; - return !((this.name == null) ? (other.name != null) : !this.name.equals(other.name)); + final IndexEntry other = (IndexEntry) obj; + if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) { + return false; + } + if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) { + return false; + } + return true; } + /** + * Standard implementation of toString showing vendor and product. + * + * @return the string representation of the object + */ @Override - public int hashCode() { - int hash = 5; - hash = 83 * hash + (this.name != null ? this.name.hashCode() : 0); - return hash; + public String toString() { + return "IndexEntry{" + "vendor=" + vendor + ", product=" + product + '}'; } } diff --git a/src/main/java/org/owasp/dependencycheck/data/cpe/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/package-info.java similarity index 100% rename from src/main/java/org/owasp/dependencycheck/data/cpe/package-info.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/package-info.java diff --git a/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java similarity index 90% rename from src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java index a923be30d..76f0e3561 100644 --- a/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -74,6 +74,7 @@ public final class CweDB { /** *
Returns the full CWE name from the CWE ID.
+ * * @param cweId the CWE ID * @return the full name of the CWE */ diff --git a/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java similarity index 84% rename from src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java index ee52da57c..697b96b6c 100644 --- a/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -37,6 +37,7 @@ public class CweHandler extends DefaultHandler { /** * Returns the HashMap of CWE entries (CWE-ID, Full CWE Name). + * * @return a HashMap of CWE entriesA Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, - * LowerCaseFilter, and StopFilter. The intended purpose of this Analyzer is - * to index the CPE fields vendor and product.
+ *A Lucene Analyzer that utilizes the WhitespaceTokenizer, + * WordDelimiterFilter, LowerCaseFilter, and StopFilter. The intended purpose of + * this Analyzer is to index the CPE fields vendor and product.
* * @author Jeremy Long (jeremy.long@owasp.org) */ @@ -61,7 +60,7 @@ public class FieldAnalyzer extends Analyzer { */ @Override protected TokenStreamComponents createComponents(String fieldName, Reader reader) { - final Tokenizer source = new WhitespaceTokenizer(version, reader); + final Tokenizer source = new AlphaNumericTokenizer(version, reader); TokenStream stream = source; diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java similarity index 87% rename from src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java index 2656bd3de..565014102 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -41,8 +41,8 @@ public final class LuceneUtils { */ @SuppressWarnings("fallthrough") @edu.umd.cs.findbugs.annotations.SuppressWarnings( - value = "SF_SWITCH_NO_DEFAULT", - justification = "The switch below does have a default.") + value = "SF_SWITCH_NO_DEFAULT", + justification = "The switch below does have a default.") public static void appendEscapedLuceneQuery(StringBuilder buf, final CharSequence text) { diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java similarity index 82% rename from src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java index 64c345de9..6ce55c699 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -22,7 +22,6 @@ import java.io.Reader; import org.apache.lucene.analysis.Analyzer; import org.apache.lucene.analysis.TokenStream; import org.apache.lucene.analysis.Tokenizer; -import org.apache.lucene.analysis.core.WhitespaceTokenizer; import org.apache.lucene.analysis.core.LowerCaseFilter; import org.apache.lucene.analysis.core.StopAnalyzer; import org.apache.lucene.analysis.core.StopFilter; @@ -41,8 +40,8 @@ public class SearchFieldAnalyzer extends Analyzer { */ private final Version version; /** - * A local reference to the TokenPairConcatenatingFilter so that we - * can clear any left over state if this analyzer is re-used. + * A local reference to the TokenPairConcatenatingFilter so that we can + * clear any left over state if this analyzer is re-used. */ private TokenPairConcatenatingFilter concatenatingFilter; @@ -57,13 +56,14 @@ public class SearchFieldAnalyzer extends Analyzer { /** * Creates a the TokenStreamComponents used to analyze the stream. + * * @param fieldName the field that this lucene analyzer will process * @param reader a reader containing the tokens * @return the token stream filter chain */ @Override protected TokenStreamComponents createComponents(String fieldName, Reader reader) { - final Tokenizer source = new WhitespaceTokenizer(version, reader); + final Tokenizer source = new AlphaNumericTokenizer(version, reader); TokenStream stream = source; @@ -85,11 +85,14 @@ public class SearchFieldAnalyzer extends Analyzer { } /** - *Resets the analyzer and clears any internal state data that may - * have been left-over from previous uses of the analyzer.
- *If this analyzer is re-used this method must be called between uses.
+ *Resets the analyzer and clears any internal state data that may have + * been left-over from previous uses of the analyzer.
+ *If this analyzer is re-used this method must be called between + * uses.
*/ public void clear() { - concatenatingFilter.clear(); + if (concatenatingFilter != null) { + concatenatingFilter.clear(); + } } } diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java similarity index 86% rename from src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java index 473c06514..a385ae22d 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -27,10 +27,13 @@ import org.apache.lucene.analysis.core.WhitespaceTokenizer; import org.apache.lucene.util.Version; /** - * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information. + * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version + * information. * * @author Jeremy Long (jeremy.long@owasp.org) + * @deprecated version information is no longer stored in lucene */ +@Deprecated public class SearchVersionAnalyzer extends Analyzer { //TODO consider implementing payloads/custom attributes... // use custom attributes for major, minor, x, x, x, rcx diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java similarity index 86% rename from src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java index 363559935..f7473d690 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -23,7 +23,6 @@ import java.util.LinkedList; import org.apache.lucene.analysis.TokenFilter; import org.apache.lucene.analysis.TokenStream; import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; -import org.apache.lucene.analysis.tokenattributes.PositionIncrementAttribute; /** *Takes a TokenStream and adds additional tokens by concatenating pairs of @@ -39,10 +38,6 @@ public final class TokenPairConcatenatingFilter extends TokenFilter { * The char term attribute. */ private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class); - /** - * The position increment attribute. - */ - private final PositionIncrementAttribute posIncAtt = addAttribute(PositionIncrementAttribute.class); /** * The previous word parsed. */ @@ -85,7 +80,6 @@ public final class TokenPairConcatenatingFilter extends TokenFilter { final String word = words.getFirst(); clearAttributes(); termAtt.append(previousWord).append(word); - posIncAtt.setPositionIncrement(0); previousWord = null; return true; } diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java similarity index 91% rename from src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java index f3f8e2dd6..e1b15c8c1 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2013 Jeremy Long. All Rights Reserved. */ diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java similarity index 86% rename from src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java index 821548716..3af9a233d 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -30,7 +30,9 @@ import org.apache.lucene.util.Version; * VersionAnalyzer is a Lucene Analyzer used to analyze version information. * * @author Jeremy Long (jeremy.long@owasp.org) + * @deprecated version information is no longer stored in lucene */ +@Deprecated public class VersionAnalyzer extends Analyzer { //TODO consider implementing payloads/custom attributes... // use custom attributes for major, minor, x, x, x, rcx diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java similarity index 90% rename from src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java index 31fb9e9bc..917acb5fc 100644 --- a/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -30,7 +30,9 @@ import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; * 3.0.0.RELEASE".
* * @author Jeremy Long (jeremy.long@owasp.org) + * @deprecated version information is no longer stored in lucene */ +@Deprecated public final class VersionTokenizingFilter extends AbstractTokenizingFilter { /** diff --git a/src/main/java/org/owasp/dependencycheck/data/lucene/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/package-info.java similarity index 100% rename from src/main/java/org/owasp/dependencycheck/data/lucene/package-info.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/package-info.java diff --git a/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java similarity index 74% rename from src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java index 4d32a0b10..3c7d8019c 100644 --- a/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java @@ -1,26 +1,26 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ package org.owasp.dependencycheck.data.nvdcve; /** - * An exception used to indicate the db4o database is corrupt. - * This could be due to invalid data or a complete failure of the db. + * An exception used to indicate the db4o database is corrupt. This could be due + * to invalid data or a complete failure of the db. * * @author Jeremy Long (jeremy.long@owasp.org) */ diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java new file mode 100644 index 000000000..7c4502384 --- /dev/null +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java @@ -0,0 +1,733 @@ +/* + * This file is part of dependency-check-core. + * + * Dependency-check-core is free software: you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the Free + * Software Foundation, either version 3 of the License, or (at your option) any + * later version. + * + * Dependency-check-core is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * dependency-check-core. If not, see http://www.gnu.org/licenses/. + * + * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + */ +package org.owasp.dependencycheck.data.nvdcve; + +import java.io.BufferedReader; +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.UnsupportedEncodingException; +import java.sql.Connection; +import java.sql.DriverManager; +import java.sql.PreparedStatement; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.sql.Statement; +import java.util.ArrayList; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.logging.Level; +import java.util.logging.Logger; +import org.owasp.dependencycheck.data.cwe.CweDB; +import org.owasp.dependencycheck.dependency.Reference; +import org.owasp.dependencycheck.dependency.Vulnerability; +import org.owasp.dependencycheck.dependency.VulnerableSoftware; +import org.owasp.dependencycheck.utils.DependencyVersion; +import org.owasp.dependencycheck.utils.DependencyVersionUtil; +import org.owasp.dependencycheck.utils.Settings; + +/** + * The database holding information about the NVD CVE data. + * + * @author Jeremy Long (jeremy.long@owasp.org) + */ +public class CveDB { + + /** + * Resource location for SQL file used to create the database schema. + */ + public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql"; + /** + * The version of the current DB Schema. + */ + public static final String DB_SCHEMA_VERSION = "2.5"; + /** + * Database connection + */ + private Connection conn; + //Determines if this is a valid vulnerability match for the given dependency. - * Specifically, this is concerned with ensuring the version numbers are correct.
- *Currently, this is focused on the issues with the versions for Struts 1 and Struts 2. - * In the future this will due better matching on more version numbers.
- * @param dependency the dependency - * @param v the vulnerability - * @return returns true if the vulnerability is for the given dependency - */ - private boolean isValidMatch(final Dependency dependency, final Vulnerability v) { - //right now I only know of the issue with Struts1/2 - // start with fixing this problem. - - //TODO extend this solution to do better version matching for the vulnerable software. - boolean struts1 = false; - boolean struts2 = false; - for (Identifier i : dependency.getIdentifiers()) { - if (i.getValue().startsWith("cpe:/a:apache:struts:")) { - final char version = i.getValue().charAt(21); - if (version == '1') { - struts1 = true; - } - if (version == '2') { - struts2 = true; - } - } - } - if (!struts1 && !struts2) { - return true; //we are not looking at struts, so return true. - } - if (struts1 && struts2) { - return true; //there is a mismatch here, but we can't solve it here so we return valid. - } - if (struts1) { - boolean hasStruts1Vuln = false; - boolean hasStruts2PreviousVersion = false; - for (VulnerableSoftware vs : v.getVulnerableSoftware()) { - hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2'; - hasStruts1Vuln |= vs.getName().charAt(21) == '1'; - } - if (!hasStruts1Vuln && hasStruts2PreviousVersion) { - return false; - } - } - - return true; - } +//TODO - remove this comment block after additional testing is completed +// The following check has been moved into the CveDB class. +//// /** +//// *Determines if this is a valid vulnerability match for the given +//// * dependency. Specifically, this is concerned with ensuring the version +//// * numbers are correct.
+//// *Currently, this is focused on the issues with the versions for Struts +//// * 1 and Struts 2. In the future this will due better matching on more +//// * version numbers.
+//// * +//// * @param dependency the dependency +//// * @param v the vulnerability +//// * @return returns true if the vulnerability is for the given dependency +//// */ +//// private boolean isValidMatch(final Dependency dependency, final Vulnerability v) { +//// //right now I only know of the issue with Struts1/2 +//// // start with fixing this problem. +//// +//// //TODO extend this solution to do better version matching for the vulnerable software. +//// boolean struts1 = false; +//// boolean struts2 = false; +//// for (Identifier i : dependency.getIdentifiers()) { +//// if (i.getValue().startsWith("cpe:/a:apache:struts:")) { +//// final char version = i.getValue().charAt(21); +//// if (version == '1') { +//// struts1 = true; +//// } +//// if (version == '2') { +//// struts2 = true; +//// } +//// } +//// } +//// if (!struts1 && !struts2) { +//// return true; //we are not looking at struts, so return true. +//// } +//// if (struts1 && struts2) { +//// return true; //there is a mismatch here, but we can't solve it here so we return valid. +//// } +//// if (struts1) { +//// boolean hasStruts1Vuln = false; +//// boolean hasStruts2PreviousVersion = false; +//// for (VulnerableSoftware vs : v.getVulnerableSoftware()) { +//// //TODO FIX THIS +//// //hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2'; +//// //hasStruts1Vuln |= vs.getName().charAt(21) == '1'; +//// } +//// if (!hasStruts1Vuln && hasStruts2PreviousVersion) { +//// return false; +//// } +//// } +//// +//// return true; +//// } } diff --git a/src/main/java/org/owasp/dependencycheck/data/nvdcve/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/package-info.java similarity index 100% rename from src/main/java/org/owasp/dependencycheck/data/nvdcve/package-info.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/package-info.java diff --git a/src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java similarity index 76% rename from src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java index adb6def48..a1d9a9823 100644 --- a/src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/xml/DatabaseUpdater.java @@ -1,18 +1,18 @@ /* - * This file is part of Dependency-Check. + * This file is part of dependency-check-core. * - * Dependency-Check is free software: you can redistribute it and/or modify it + * Dependency-check-core is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the Free * Software Foundation, either version 3 of the License, or (at your option) any * later version. * - * Dependency-Check is distributed in the hope that it will be useful, but + * Dependency-check-core is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more * details. * * You should have received a copy of the GNU General Public License along with - * Dependency-Check. If not, see http://www.gnu.org/licenses/. + * dependency-check-core. If not, see http://www.gnu.org/licenses/. * * Copyright (c) 2012 Jeremy Long. All Rights Reserved. */ @@ -31,6 +31,7 @@ import org.owasp.dependencycheck.data.CachedWebDataSource; import java.net.MalformedURLException; import java.net.URL; import java.sql.SQLException; +import java.util.Calendar; import java.util.Date; import java.util.HashMap; import java.util.List; @@ -75,9 +76,17 @@ public class DatabaseUpdater implements CachedWebDataSource { */ private static final String LAST_UPDATED_BASE = "lastupdated."; /** - * The current version of the database. + * Modified key word. */ - public static final String DATABASE_VERSION = "2.2"; + public static final String MODIFIED = "modified"; + /** + * Reference to the Cve Database. + */ + private CveDB cveDB = null; + /** + * Reference to the Cpe Index. + */ + private Index cpeIndex = null; /** *Downloads the latest NVD CVE XML file from the web and imports it into
@@ -99,7 +108,11 @@ public class DatabaseUpdater implements CachedWebDataSource {
Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.INFO,
"NVD CVE requires several updates; this could take a couple of minutes.");
}
+ if (maxUpdates > 0) {
+ openDataStores();
+ }
int count = 0;
+
for (NvdCveUrl cve : update.values()) {
if (cve.getNeedsUpdate()) {
count += 1;
@@ -121,10 +134,16 @@ public class DatabaseUpdater implements CachedWebDataSource {
Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.INFO,
"Processing {0}", cve.getUrl());
+
importXML(outputPath, outputPath12);
+ cveDB.commit();
+ cpeIndex.commit();
+
+ writeLastUpdatedPropertyFile(cve);
+
Logger.getLogger(DatabaseUpdater.class.getName()).log(Level.INFO,
- "Completed updated {0} of {1}", new Object[]{count, maxUpdates});
+ "Completed update {0} of {1}", new Object[]{count, maxUpdates});
} catch (FileNotFoundException ex) {
throw new UpdateException(ex);
} catch (ParserConfigurationException ex) {
@@ -164,12 +183,15 @@ public class DatabaseUpdater implements CachedWebDataSource {
}
}
if (maxUpdates >= 1) {
- writeLastUpdatedPropertyFile(update);
+ ensureModifiedIsInLastUpdatedProperties(update);
+ cveDB.cleanupDatabase();
}
} catch (MalformedURLException ex) {
throw new UpdateException(ex);
} catch (DownloadFailedException ex) {
throw new UpdateException(ex);
+ } finally {
+ closeDataStores();
}
}
@@ -189,39 +211,69 @@ public class DatabaseUpdater implements CachedWebDataSource {
*/
private void importXML(File file, File oldVersion)
throws ParserConfigurationException, SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException {
- CveDB cveDB = null;
- Index cpeIndex = null;
+ final SAXParserFactory factory = SAXParserFactory.newInstance();
+ final SAXParser saxParser = factory.newSAXParser();
+
+ final NvdCve12Handler cve12Handler = new NvdCve12Handler();
+ saxParser.parse(oldVersion, cve12Handler);
+ final Map Parses a name attribute value, from the cpe.xml, into its
+ * corresponding parts: vendor, product, version, revision. Example: Results in: DependencyCheck uses {@link java.util.logging.Logger} as a logging framework,
- * and Apache Velocity uses a custom logging implementation that outputs to a
- * file named velocity.log by default. This class is an implementation of a
- * custom Velocity logger that redirects all velocity logging to the Java Logger
- * class.
+ * DependencyCheck uses {@link java.util.logging.Logger} as a logging
+ * framework, and Apache Velocity uses a custom logging implementation that
+ * outputs to a file named velocity.log by default. This class is an
+ * implementation of a custom Velocity logger that redirects all velocity
+ * logging to the Java Logger class.
*
- * This class was written to address permission issues when using Dependency-Check
- * in a server environment (such as the Jenkins plugin). In some circumstances,
- * Velocity would attempt to create velocity.log in an un-writable directory. cpe:/a:apache:struts:1.1:rc2
+ *
+ *
+ *
+ * @param cpeName the cpe name
+ * @throws UnsupportedEncodingException should never be thrown...
+ */
+ @Override
+ public void parseName(String cpeName) throws UnsupportedEncodingException {
+ this.name = cpeName;
+ if (cpeName != null && cpeName.length() > 7) {
+ final String[] data = cpeName.substring(7).split(":");
+ if (data.length >= 1) {
+ this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8")); //.replaceAll("[_-]", " ")
+ if (data.length >= 2) {
+ this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8")); //.replaceAll("[_-]", " ")
+ if (data.length >= 3) {
+ version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8");
+ if (data.length >= 4) {
+ revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8");
+ if (data.length >= 5) {
+ edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8");
+ }
+ }
+ }
+ }
+ }
+ }
+ }
/**
* If present, indicates that previous version are vulnerable.
*/
@@ -84,6 +120,13 @@ public class VulnerableSoftware extends Entry implements Serializable, Comparabl
this.previousVersion = previousVersion;
}
+ /**
+ * Standard equals implementation to compare this VulnerableSoftware to
+ * another object.
+ *
+ * @param obj the object to compare
+ * @return whether or not the objects are equal
+ */
@Override
public boolean equals(Object obj) {
if (obj == null) {
@@ -99,6 +142,11 @@ public class VulnerableSoftware extends Entry implements Serializable, Comparabl
return true;
}
+ /**
+ * Standard implementation of hashCode.
+ *
+ * @return the hashCode for the object
+ */
@Override
public int hashCode() {
int hash = 7;
@@ -106,11 +154,24 @@ public class VulnerableSoftware extends Entry implements Serializable, Comparabl
return hash;
}
+ /**
+ * Standard toString() implementation display the name and whether or not
+ * previous versions are also affected.
+ *
+ * @return a string representation of the object
+ */
+ @Override
+ public String toString() {
+ return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}';
+ }
+
/**
* Implementation of the comparable interface.
+ *
* @param vs the VulnerableSoftware to compare
* @return an integer indicating the ordering of the two objects
*/
+ @Override
public int compareTo(VulnerableSoftware vs) {
int result = 0;
final String[] left = this.getName().split(":");
@@ -165,6 +226,7 @@ public class VulnerableSoftware extends Entry implements Serializable, Comparabl
/**
* Determines if the string passed in is a positive integer.
+ *
* @param str the string to test
* @return true if the string only contains 0-9, otherwise false.
*/
@@ -180,4 +242,92 @@ public class VulnerableSoftware extends Entry implements Serializable, Comparabl
}
return true;
}
+ /**
+ * The name of the cpe.
+ */
+ private String name;
+
+ /**
+ * Get the value of name.
+ *
+ * @return the value of name
+ */
+ public String getName() {
+ return name;
+ }
+
+ /**
+ * Set the value of name.
+ *
+ * @param name new value of name
+ */
+ public void setName(String name) {
+ this.name = name;
+ }
+ /**
+ * The product version number.
+ */
+ private String version;
+
+ /**
+ * Get the value of version.
+ *
+ * @return the value of version
+ */
+ public String getVersion() {
+ return version;
+ }
+
+ /**
+ * Set the value of version.
+ *
+ * @param version new value of version
+ */
+ public void setVersion(String version) {
+ this.version = version;
+ }
+ /**
+ * The product revision version.
+ */
+ private String revision;
+
+ /**
+ * Get the value of revision.
+ *
+ * @return the value of revision
+ */
+ public String getRevision() {
+ return revision;
+ }
+
+ /**
+ * Set the value of revision.
+ *
+ * @param revision new value of revision
+ */
+ public void setRevision(String revision) {
+ this.revision = revision;
+ }
+ /**
+ * The product edition.
+ */
+ private String edition;
+
+ /**
+ * Get the value of edition.
+ *
+ * @return the value of edition
+ */
+ public String getEdition() {
+ return edition;
+ }
+
+ /**
+ * Set the value of edition.
+ *
+ * @param edition new value of edition
+ */
+ public void setEdition(String edition) {
+ this.edition = edition;
+ }
}
diff --git a/src/main/java/org/owasp/dependencycheck/dependency/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/package-info.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/dependency/package-info.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/package-info.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java
similarity index 83%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java
index f653d1dee..0b330d0e0 100644
--- a/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.java
@@ -1,18 +1,18 @@
/*
- * This file is part of Dependency-Check.
+ * This file is part of dependency-check-core.
*
- * Dependency-Check is free software: you can redistribute it and/or modify it
+ * Dependency-check-core is free software: you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation, either version 3 of the License, or (at your option) any
* later version.
*
- * Dependency-Check is distributed in the hope that it will be useful, but
+ * Dependency-check-core is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
* details.
*
* You should have received a copy of the GNU General Public License along with
- * Dependency-Check. If not, see http://www.gnu.org/licenses/.
+ * dependency-check-core. If not, see http://www.gnu.org/licenses/.
*
* Copyright (c) 2013 Jeremy Long. All Rights Reserved.
*/
@@ -23,11 +23,11 @@ import org.xml.sax.SAXException;
import org.xml.sax.helpers.XMLFilterImpl;
/**
- * This filter is used when parsing POM documents. Some POM documents
- * do not specify the xmlns="http://maven.apache.org/POM/4.0.0". This
- * filter ensures that the correct namespace is added so that both
- * types of POMs can be read.
- * @author Jeremy Long (jeremy.long@gmail.com)
+ * This filter is used when parsing POM documents. Some POM documents do not
+ * specify the xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures
+ * that the correct namespace is added so that both types of POMs can be read.
+ *
+ * @author Jeremy Long (jeremy.long@owasp.org)
*/
public class MavenNamespaceFilter extends XMLFilterImpl {
@@ -42,6 +42,7 @@ public class MavenNamespaceFilter extends XMLFilterImpl {
/**
* Called at the start of the document parsing.
+ *
* @throws SAXException thrown if there is a SAXException
*/
@Override
@@ -52,6 +53,7 @@ public class MavenNamespaceFilter extends XMLFilterImpl {
/**
* Called when an element is started.
+ *
* @param uri the uri
* @param localName the localName
* @param qName the qualified name
@@ -65,6 +67,7 @@ public class MavenNamespaceFilter extends XMLFilterImpl {
/**
* Indicatees the start of the document.
+ *
* @param uri the uri
* @param localName the localName
* @param qName the qualified name
@@ -78,6 +81,7 @@ public class MavenNamespaceFilter extends XMLFilterImpl {
/**
* Called when prefix mapping is started.
+ *
* @param prefix the prefix
* @param url the url
* @throws SAXException thrown if there is a SAXException
@@ -89,5 +93,4 @@ public class MavenNamespaceFilter extends XMLFilterImpl {
super.startPrefixMapping("", NAMESPACE);
}
}
-
}
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Activation.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Activation.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Activation.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Activation.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Build.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Build.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Build.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Build.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Developer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Developer.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Developer.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Developer.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Extension.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Extension.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Extension.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Extension.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/License.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/License.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/License.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/License.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Model.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Organization.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Parent.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Parent.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Parent.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Parent.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Profile.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Profile.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Profile.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Profile.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Repository.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Repository.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Repository.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Repository.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Resource.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Resource.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Resource.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Resource.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Scm.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Scm.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Scm.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Scm.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Site.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Site.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Site.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/Site.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/package-info.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/package-info.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/package-info.java
diff --git a/src/main/java/org/owasp/dependencycheck/jaxb/pom/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/package-info.java
similarity index 100%
rename from src/main/java/org/owasp/dependencycheck/jaxb/pom/package-info.java
rename to dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/package-info.java
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/package-info.java
new file mode 100644
index 000000000..83644b4d3
--- /dev/null
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/package-info.java
@@ -0,0 +1,12 @@
+/**
+ *
+ *
+ *
Simple object to track the parts of a version number. The parts are
+ * contained in a List such that version 1.2.3 will be stored as:
+ * versionParts[0] = 1;
+ * versionParts[1] = 2;
+ * versionParts[2] = 3;
+ *
Note, the parser contained in this class expects the version numbers to be + * separated by periods. If a different separator is used the parser will likely + * fail.
+ * + * @author Jeremy Long (jeremy.long@owasp.org) + */ +public class DependencyVersion implements Iterable, ComparableA utility class to extract version numbers from file names (or other + * strings containing version numbers.
+ * + * @author Jeremy Long (jeremy.long@owasp.org) + */ +public final class DependencyVersionUtil { + + /** + * Regular expression to extract version numbers from file names. + */ + private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); + /** + * Regular expression to extract a single version number without periods. + * This is a last ditch effort just to check in case we are missing a + * version number using the previous regex. + */ + private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); + + /** + * Private constructor for utility class. + */ + private DependencyVersionUtil() { + } + + /** + *A utility class to extract version numbers from file names (or other
+ * strings containing version numbers.
+ * Example:
+ * Give the file name: library-name-1.4.1r2-release.jar
+ * This function would return: 1.4.1.r2