diff --git a/dependency-check-ant/pom.xml b/dependency-check-ant/pom.xml
index a24e2c71e..11066234d 100644
--- a/dependency-check-ant/pom.xml
+++ b/dependency-check-ant/pom.xml
@@ -22,7 +22,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
org.owasp
dependency-check-parent
- 1.0.4
+ 1.0.5-SNAPSHOT
dependency-check-ant
diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml
index 2ab082aff..457eff1f7 100644
--- a/dependency-check-cli/pom.xml
+++ b/dependency-check-cli/pom.xml
@@ -22,7 +22,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
org.owasp
dependency-check-parent
- 1.0.4
+ 1.0.5-SNAPSHOT
dependency-check-cli
diff --git a/dependency-check-core/pom.xml b/dependency-check-core/pom.xml
index d96c56a3c..193667850 100644
--- a/dependency-check-core/pom.xml
+++ b/dependency-check-core/pom.xml
@@ -22,7 +22,7 @@ along with Dependency-Check. If not, see .
org.owasp
dependency-check-parent
- 1.0.4
+ 1.0.5-SNAPSHOT
dependency-check-core
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
index 25bb036eb..0b78373da 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
@@ -231,6 +231,10 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
private File getNextTempDirectory() throws AnalysisException {
dirCount += 1;
final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+ //getting an exception for some directories not being able to be created; might be because the directory already exists?
+ if (directory.exists()) {
+ return getNextTempDirectory();
+ }
if (!directory.mkdirs()) {
throw new AnalysisException("Unable to create temp directory '" + directory.getAbsolutePath() + "'.");
}
@@ -267,8 +271,10 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
while ((entry = zis.getNextZipEntry()) != null) {
if (entry.isDirectory()) {
final File d = new File(extractTo, entry.getName());
- if (!d.mkdirs()) {
- throw new AnalysisException("Unable to create '" + d.getAbsolutePath() + "'.");
+ if (!d.exists()) {
+ if (!d.mkdirs()) {
+ throw new AnalysisException("Unable to create '" + d.getAbsolutePath() + "'.");
+ }
}
} else {
final File file = new File(extractTo, entry.getName());
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
index 9c64495a6..b84acd74f 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
@@ -109,6 +109,7 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
removeJreEntries(dependency);
removeBadMatches(dependency);
+ removeWrongVersionMatches(dependency);
removeSpuriousCPE(dependency);
addFalseNegativeCPEs(dependency);
}
@@ -291,6 +292,40 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
}
}
+ /**
+ * Removes CPE matches for the wrong version of a dependency. Currently,
+ * this only covers Axis 1 & 2.
+ *
+ * @param dependency the dependency to analyze
+ */
+ private void removeWrongVersionMatches(Dependency dependency) {
+ final Set identifiers = dependency.getIdentifiers();
+ final Iterator itr = identifiers.iterator();
+
+ final String fileName = dependency.getFileName();
+ if (fileName != null && fileName.contains("axis2")) {
+ while (itr.hasNext()) {
+ final Identifier i = itr.next();
+ if ("cpe".equals(i.getType())) {
+ final String cpe = i.getValue();
+ if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) {
+ itr.remove();
+ }
+ }
+ }
+ } else if (fileName != null && fileName.contains("axis")) {
+ while (itr.hasNext()) {
+ final Identifier i = itr.next();
+ if ("cpe".equals(i.getType())) {
+ final String cpe = i.getValue();
+ if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) {
+ itr.remove();
+ }
+ }
+ }
+ }
+ }
+
/**
* There are some known CPE entries, specifically regarding sun and oracle
* products due to the acquisition and changes in product names, that based
diff --git a/dependency-check-jenkins/pom.xml b/dependency-check-jenkins/pom.xml
index 00d2a188c..ed609bf97 100644
--- a/dependency-check-jenkins/pom.xml
+++ b/dependency-check-jenkins/pom.xml
@@ -6,7 +6,7 @@
org.owasp
dependency-check-parent
- 1.0.4
+ 1.0.5-SNAPSHOT
org.owasp
diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml
index 94de6dea8..baa4e6616 100644
--- a/dependency-check-maven/pom.xml
+++ b/dependency-check-maven/pom.xml
@@ -24,7 +24,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
org.owasp
dependency-check-parent
- 1.0.4
+ 1.0.5-SNAPSHOT
dependency-check-maven
diff --git a/pom.xml b/pom.xml
index 742503a1a..e2306a06a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,7 +22,7 @@ along with Dependency-Check. If not, see .
org.owasp
dependency-check-parent
- 1.0.4
+ 1.0.5-SNAPSHOT
pom