diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml index a24e2c71e..11066234d 100644 --- a/dependency-check-ant/pom.xml +++ b/dependency-check-ant/pom.xml @@ -22,7 +22,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.0.4 + 1.0.5-SNAPSHOT dependency-check-ant diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index 2ab082aff..457eff1f7 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -22,7 +22,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.0.4 + 1.0.5-SNAPSHOT dependency-check-cli diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml index d96c56a3c..193667850 100644 --- a/dependency-check-core/pom.xml +++ b/dependency-check-core/pom.xml @@ -22,7 +22,7 @@ along with Dependency-Check. If not, see . org.owasp dependency-check-parent - 1.0.4 + 1.0.5-SNAPSHOT dependency-check-core diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java index 25bb036eb..0b78373da 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java @@ -231,6 +231,10 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { private File getNextTempDirectory() throws AnalysisException { dirCount += 1; final File directory = new File(tempFileLocation, String.valueOf(dirCount)); + //getting an exception for some directories not being able to be created; might be because the directory already exists? + if (directory.exists()) { + return getNextTempDirectory(); + } if (!directory.mkdirs()) { throw new AnalysisException("Unable to create temp directory '" + directory.getAbsolutePath() + "'."); } @@ -267,8 +271,10 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { while ((entry = zis.getNextZipEntry()) != null) { if (entry.isDirectory()) { final File d = new File(extractTo, entry.getName()); - if (!d.mkdirs()) { - throw new AnalysisException("Unable to create '" + d.getAbsolutePath() + "'."); + if (!d.exists()) { + if (!d.mkdirs()) { + throw new AnalysisException("Unable to create '" + d.getAbsolutePath() + "'."); + } } } else { final File file = new File(extractTo, entry.getName()); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java index 9c64495a6..b84acd74f 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java @@ -109,6 +109,7 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { public void analyze(Dependency dependency, Engine engine) throws AnalysisException { removeJreEntries(dependency); removeBadMatches(dependency); + removeWrongVersionMatches(dependency); removeSpuriousCPE(dependency); addFalseNegativeCPEs(dependency); } @@ -291,6 +292,40 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { } } + /** + * Removes CPE matches for the wrong version of a dependency. Currently, + * this only covers Axis 1 & 2. + * + * @param dependency the dependency to analyze + */ + private void removeWrongVersionMatches(Dependency dependency) { + final Set identifiers = dependency.getIdentifiers(); + final Iterator itr = identifiers.iterator(); + + final String fileName = dependency.getFileName(); + if (fileName != null && fileName.contains("axis2")) { + while (itr.hasNext()) { + final Identifier i = itr.next(); + if ("cpe".equals(i.getType())) { + final String cpe = i.getValue(); + if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { + itr.remove(); + } + } + } + } else if (fileName != null && fileName.contains("axis")) { + while (itr.hasNext()) { + final Identifier i = itr.next(); + if ("cpe".equals(i.getType())) { + final String cpe = i.getValue(); + if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { + itr.remove(); + } + } + } + } + } + /** * There are some known CPE entries, specifically regarding sun and oracle * products due to the acquisition and changes in product names, that based diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml index 00d2a188c..ed609bf97 100644 --- a/dependency-check-jenkins/pom.xml +++ b/dependency-check-jenkins/pom.xml @@ -6,7 +6,7 @@ org.owasp dependency-check-parent - 1.0.4 + 1.0.5-SNAPSHOT org.owasp diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index 94de6dea8..baa4e6616 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -24,7 +24,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 1.0.4 + 1.0.5-SNAPSHOT dependency-check-maven diff --git a/pom.xml b/pom.xml index 742503a1a..e2306a06a 100644 --- a/pom.xml +++ b/pom.xml @@ -22,7 +22,7 @@ along with Dependency-Check. If not, see . org.owasp dependency-check-parent - 1.0.4 + 1.0.5-SNAPSHOT pom