@Override
public void trace(String msg) {
if (task != null) {
task.log(msg, Project.MSG_VERBOSE);
}
public void debug(String msg) {
task.log(msg, Project.MSG_DEBUG);
public Logger getLogger(String name) {
return antLoggerAdapter;
*/
public static final StaticLoggerBinder getSingleton() {
return SINGLETON;
public ILoggerFactory getLoggerFactory() {
return loggerFactory;
Note: failures are anticipated and checked for with assertions while errors are unanticipated.
Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.
[Summary] [Package List] [Test Cases]
try {
runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getProjectName(), cli.getScanFiles(),
cli.getExcludeList(), cli.getSymLinkDepth());
} catch (InvalidScanPathException ex) {
LOGGER.error("An invalid scan path was detected; unable to scan '//*' paths");
exitCode = -10;
} catch (DatabaseException ex) {
LOGGER.error(ex.getMessage());
exitCode = -11;
} catch (ReportException ex) {
exitCode = -12;
} catch (ExceptionCollection ex) {
if (ex.isFatal()) {
exitCode = -13;
LOGGER.error("One or more fatal errors occured");
final String[] scanFiles = cli.getScanFiles();
if (scanFiles != null) {
runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getProjectName(), scanFiles,
} else {
exitCode = -14;
LOGGER.error("No scan files configured");
for (Throwable e : ex.getExceptions()) {
LOGGER.error(e.getMessage());
cli.printHelp();
return exitCode;
/**
* Scans the specified directories and writes the dependency reports to the
* reportDirectory.
*
* @param reportDirectory the path to the directory where the reports will
* be written
* @param outputFormat the output format of the report
* @param applicationName the application name for the report
* @param files the files/directories to scan
* @param excludes the patterns for files/directories to exclude
* @param symLinkDepth the depth that symbolic links will be followed
* @throws InvalidScanPathException thrown if the path to scan starts with
* "//"
* @throws ReportException thrown when the report cannot be generated
* @throws DatabaseException thrown when there is an error connecting to the
* database
* @throws ExceptionCollection thrown when an exception occurs during
* analysis; there may be multiple exceptions contained within the
* collection.
private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files,
String[] excludes, int symLinkDepth) throws InvalidScanPathException, DatabaseException, ExceptionCollection, ReportException {
Engine engine = null;
engine = new Engine();
final List<String> antStylePaths = new ArrayList<String>();
for (String file : files) {
final String antPath = ensureCanonicalPath(file);
antStylePaths.add(antPath);
final Set<File> paths = new HashSet<File>();
for (String file : antStylePaths) {
LOGGER.debug("Scanning {}", file);
final DirectoryScanner scanner = new DirectoryScanner();
String include = file.replace('\\', '/');
File baseDir;
if (include.startsWith("//")) {
throw new InvalidScanPathException("Unable to scan paths specified by //");
final int pos = getLastFileSeparator(include);
final String tmpBase = include.substring(0, pos);
final String tmpInclude = include.substring(pos + 1);
if (tmpInclude.indexOf('*') >= 0 || tmpInclude.indexOf('?') >= 0
|| (new File(include)).isFile()) {
baseDir = new File(tmpBase);
include = tmpInclude;
baseDir = new File(tmpBase, tmpInclude);
include = "**/*";
scanner.setBasedir(baseDir);
final String[] includes = {include};
scanner.setIncludes(includes);
scanner.setMaxLevelsOfSymlinks(symLinkDepth);
if (symLinkDepth <= 0) {
scanner.setFollowSymlinks(false);
if (excludes != null && excludes.length > 0) {
scanner.addExcludes(excludes);
scanner.scan();
if (scanner.getIncludedFilesCount() > 0) {
for (String s : scanner.getIncludedFiles()) {
final File f = new File(baseDir, s);
LOGGER.debug("Found file {}", f.toString());
paths.add(f);
engine.scan(paths);
ExceptionCollection exCol = null;
engine.analyzeDependencies();
throw ex;
exCol = ex;
final List<Dependency> dependencies = engine.getDependencies();
DatabaseProperties prop = null;
CveDB cve = null;
cve = new CveDB();
cve.open();
prop = cve.getDatabaseProperties();
} finally {
if (cve != null) {
cve.close();
final ReportGenerator report = new ReportGenerator(applicationName, dependencies, engine.getAnalyzers(), prop);
report.generateReports(reportDirectory, outputFormat);
if (exCol != null) {
exCol.addException(ex);
throw exCol;
if (exCol != null && exCol.getExceptions().size()>0) {
if (engine != null) {
engine.cleanup();
* Only executes the update phase of dependency-check.
* @throws UpdateException thrown if there is an error updating
* @throws DatabaseException thrown if a fatal error occurred and a
* connection to the database could not be established
private void runUpdateOnly() throws UpdateException, DatabaseException {
engine.doUpdates();
* Updates the global Settings.
* @param cli a reference to the CLI Parser that contains the command line
* arguments used to set the corresponding settings in the core engine.
* @throws InvalidSettingException thrown when a user defined properties
* file is unable to be loaded.
private void populateSettings(CliParser cli) throws InvalidSettingException {
final boolean autoUpdate = cli.isAutoUpdate();
final String connectionTimeout = cli.getConnectionTimeout();
final String proxyServer = cli.getProxyServer();
final String proxyPort = cli.getProxyPort();
final String proxyUser = cli.getProxyUsername();
final String proxyPass = cli.getProxyPassword();
final String dataDirectory = cli.getDataDirectory();
final File propertiesFile = cli.getPropertiesFile();
final String suppressionFile = cli.getSuppressionFile();
final String nexusUrl = cli.getNexusUrl();
final String databaseDriverName = cli.getDatabaseDriverName();
final String databaseDriverPath = cli.getDatabaseDriverPath();
final String connectionString = cli.getConnectionString();
final String databaseUser = cli.getDatabaseUser();
final String databasePassword = cli.getDatabasePassword();
final String additionalZipExtensions = cli.getAdditionalZipExtensions();
final String pathToMono = cli.getPathToMono();
final String cveMod12 = cli.getModifiedCve12Url();
final String cveMod20 = cli.getModifiedCve20Url();
final String cveBase12 = cli.getBaseCve12Url();
final String cveBase20 = cli.getBaseCve20Url();
final Integer cveValidForHours = cli.getCveValidForHours();
final boolean experimentalEnabled = cli.isExperimentalEnabled();
if (propertiesFile != null) {
Settings.mergeProperties(propertiesFile);
} catch (FileNotFoundException ex) {
throw new InvalidSettingException("Unable to find properties file '" + propertiesFile.getPath() + "'", ex);
} catch (IOException ex) {
throw new InvalidSettingException("Error reading properties file '" + propertiesFile.getPath() + "'", ex);
// We have to wait until we've merged the properties before attempting to set whether we use
// the proxy for Nexus since it could be disabled in the properties, but not explicitly stated
// on the command line
final boolean nexusUsesProxy = cli.isNexusUsesProxy();
if (dataDirectory != null) {
Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
} else if (System.getProperty("basedir") != null) {
final File dataDir = new File(System.getProperty("basedir"), "data");
Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
final File base = jarPath.getParentFile();
final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
final File dataDir = new File(base, sub);
Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_SERVER, proxyServer);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PORT, proxyPort);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_USERNAME, proxyUser);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PASSWORD, proxyPass);
Settings.setStringIfNotEmpty(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
Settings.setStringIfNotEmpty(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
Settings.setIntIfNotNull(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, cveValidForHours);
//File Type Analyzer Settings
Settings.setBoolean(Settings.KEYS.ANALYZER_EXPERIMENTAL_ENABLED, experimentalEnabled);
Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !cli.isJarDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !cli.isArchiveDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED, !cli.isPythonDistributionDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED, !cli.isPythonPackageDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_AUTOCONF_ENABLED, !cli.isAutoconfDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_CMAKE_ENABLED, !cli.isCmakeDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !cli.isNuspecDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !cli.isAssemblyDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_BUNDLE_AUDIT_ENABLED, !cli.isBundleAuditDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_OPENSSL_ENABLED, !cli.isOpenSSLDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_COMPOSER_LOCK_ENABLED, !cli.isComposerDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED, !cli.isNodeJsDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED, !cli.isRubyGemspecDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, !cli.isCentralDisabled());
Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !cli.isNexusDisabled());
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_BUNDLE_AUDIT_PATH, cli.getPathToBundleAudit());
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY, nexusUsesProxy);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_USER, databaseUser);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_PASSWORD, databasePassword);
Settings.setStringIfNotEmpty(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions);
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
if (cveBase12 != null && !cveBase12.isEmpty()) {
Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveBase12);
Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveBase20);
Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveMod12);
Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveMod20);
* Creates a file appender and adds it to logback.
* @param verboseLog the path to the verbose log file
private void prepareLogger(String verboseLog) {
final StaticLoggerBinder loggerBinder = StaticLoggerBinder.getSingleton();
final LoggerContext context = (LoggerContext) loggerBinder.getLoggerFactory();
final PatternLayoutEncoder encoder = new PatternLayoutEncoder();
encoder.setPattern("%d %C:%L%n%-5level - %msg%n");
encoder.setContext(context);
encoder.start();
final FileAppender fa = new FileAppender();
fa.setAppend(true);
fa.setEncoder(encoder);
fa.setContext(context);
fa.setFile(verboseLog);
final File f = new File(verboseLog);
String name = f.getName();
final int i = name.lastIndexOf('.');
if (i > 1) {
name = name.substring(0, i);
fa.setName(name);
fa.start();
final ch.qos.logback.classic.Logger rootLogger = context.getLogger(ch.qos.logback.classic.Logger.ROOT_LOGGER_NAME);
rootLogger.addAppender(fa);
* Takes a path and resolves it to be a canonical & absolute path. The
* caveats are that this method will take an Ant style file selector path
* (../someDir/**\/*.jar) and convert it to an absolute/canonical path (at
* least to the left of the first * or ?).
* @param path the path to canonicalize
* @return the canonical path
protected String ensureCanonicalPath(String path) {
String basePath;
String wildCards = null;
final String file = path.replace('\\', '/');
if (file.contains("*") || file.contains("?")) {
int pos = getLastFileSeparator(file);
if (pos < 0) {
return file;
pos += 1;
basePath = file.substring(0, pos);
wildCards = file.substring(pos);
basePath = file;
File f = new File(basePath);
f = f.getCanonicalFile();
if (wildCards != null) {
f = new File(f, wildCards);
LOGGER.warn("Invalid path '{}' was provided.", path);
LOGGER.debug("Invalid path provided", ex);
return f.getAbsolutePath().replace('\\', '/');
* Returns the position of the last file separator.
* @param file a file path
* @return the position of the last file separator
private int getLastFileSeparator(String file) {
int p1 = file.indexOf('*');
int p2 = file.indexOf('?');
p1 = p1 > 0 ? p1 : file.length();
p2 = p2 > 0 ? p2 : file.length();
int pos = p1 < p2 ? p1 : p2;
pos = file.lastIndexOf('/', pos);
return pos;
return file.lastIndexOf('/');
if (exCol != null && exCol.getExceptions().size() > 0) {
isValid = false;
final String msg = String.format("Invalid '%s' argument: '%s'%nUnable to scan paths that start with '//'.", argumentName, path);
throw new FileNotFoundException(msg);
} else if ((path.endsWith("/*") && !path.endsWith("**/*")) || (path.endsWith("\\*") && path.endsWith("**\\*"))) {
final String msg = String.format("Possibly incorrect path '%s' from argument '%s' because it ends with a slash star; "
+ "dependency-check uses ant-style paths", path, argumentName);
LOGGER.warn(msg);
* Generates an Options collection that is used to parse the command line
* and to display the help message.
* @return the command line options used for parsing the command line
@SuppressWarnings("static-access")
private Options createCommandLineOptions() {
final Options options = new Options();
addStandardOptions(options);
addAdvancedOptions(options);
addDeprecatedOptions(options);
return options;
* Adds the standard command line options to the given options collection.
* @param options a collection of command line arguments
* @throws IllegalArgumentException thrown if there is an exception
private void addStandardOptions(final Options options) throws IllegalArgumentException {
final Option help = new Option(ARGUMENT.HELP_SHORT, ARGUMENT.HELP, false,
"Print this message.");
final Option advancedHelp = Option.builder().longOpt(ARGUMENT.ADVANCED_HELP)
.desc("Print the advanced help message.").build();
final Option version = new Option(ARGUMENT.VERSION_SHORT, ARGUMENT.VERSION,
false, "Print the version information.");
final Option noUpdate = new Option(ARGUMENT.DISABLE_AUTO_UPDATE_SHORT, ARGUMENT.DISABLE_AUTO_UPDATE,
false, "Disables the automatic updating of the CPE data.");
final Option projectName = Option.builder().hasArg().argName("name").longOpt(ARGUMENT.PROJECT)
.desc("The name of the project being scanned. This is a required argument.")
.build();
final Option path = Option.builder(ARGUMENT.SCAN_SHORT).argName("path").hasArg().longOpt(ARGUMENT.SCAN)
.desc("The path to scan - this option can be specified multiple times. Ant style"
+ " paths are supported (e.g. path/**/*.jar).")
final Option excludes = Option.builder().argName("pattern").hasArg().longOpt(ARGUMENT.EXCLUDE)
.desc("Specify and exclusion pattern. This option can be specified multiple times"
+ " and it accepts Ant style excludsions.")
final Option props = Option.builder(ARGUMENT.PROP_SHORT).argName("file").hasArg().longOpt(ARGUMENT.PROP)
.desc("A property file to load.")
final Option out = Option.builder(ARGUMENT.OUT_SHORT).argName("path").hasArg().longOpt(ARGUMENT.OUT)
.desc("The folder to write reports to. This defaults to the current directory. "
+ "It is possible to set this to a specific file name if the format argument is not set to ALL.")
final Option outputFormat = Option.builder(ARGUMENT.OUTPUT_FORMAT_SHORT).argName("format").hasArg().longOpt(ARGUMENT.OUTPUT_FORMAT)
.desc("The output format to write to (XML, HTML, VULN, ALL). The default is HTML.")
final Option verboseLog = Option.builder(ARGUMENT.VERBOSE_LOG_SHORT).argName("file").hasArg().longOpt(ARGUMENT.VERBOSE_LOG)
.desc("The file path to write verbose logging information.")
final Option symLinkDepth = Option.builder().argName("depth").hasArg().longOpt(ARGUMENT.SYM_LINK_DEPTH)
.desc("Sets how deep nested symbolic links will be followed; 0 indicates symbolic links will not be followed.")
final Option suppressionFile = Option.builder().argName("file").hasArg().longOpt(ARGUMENT.SUPPRESSION_FILE)
.desc("The file path to the suppression XML file.")
final Option cveValidForHours = Option.builder().argName("hours").hasArg().longOpt(ARGUMENT.CVE_VALID_FOR_HOURS)
.desc("The number of hours to wait before checking for new updates from the NVD.")
final Option experimentalEnabled = Option.builder().longOpt(ARGUMENT.EXPERIMENTAL)
.desc("Enables the experimental analzers.")
//This is an option group because it can be specified more then once.
final OptionGroup og = new OptionGroup();
og.addOption(path);
final OptionGroup exog = new OptionGroup();
exog.addOption(excludes);
options.addOptionGroup(og)
.addOptionGroup(exog)
.addOption(projectName)
.addOption(out)
.addOption(outputFormat)
.addOption(version)
.addOption(help)
.addOption(advancedHelp)
.addOption(noUpdate)
.addOption(symLinkDepth)
.addOption(props)
.addOption(verboseLog)
.addOption(suppressionFile)
.addOption(cveValidForHours)
.addOption(experimentalEnabled);
* Adds the advanced command line options to the given options collection.
* These are split out for purposes of being able to display two different
* help messages.
private void addAdvancedOptions(final Options options) throws IllegalArgumentException {
final Option cve12Base = Option.builder().argName("url").hasArg().longOpt(ARGUMENT.CVE_BASE_12)
.desc("Base URL for each year’s CVE 1.2, the %d will be replaced with the year. ")
final Option cve20Base = Option.builder().argName("url").hasArg().longOpt(ARGUMENT.CVE_BASE_20)
.desc("Base URL for each year’s CVE 2.0, the %d will be replaced with the year.")
final Option cve12Modified = Option.builder().argName("url").hasArg().longOpt(ARGUMENT.CVE_MOD_12)
.desc("URL for the modified CVE 1.2.")
final Option cve20Modified = Option.builder().argName("url").hasArg().longOpt(ARGUMENT.CVE_MOD_20)
.desc("URL for the modified CVE 2.0.")
final Option updateOnly = Option.builder().longOpt(ARGUMENT.UPDATE_ONLY)
.desc("Only update the local NVD data cache; no scan will be executed.").build();
final Option data = Option.builder(ARGUMENT.DATA_DIRECTORY_SHORT).argName("path").hasArg().longOpt(ARGUMENT.DATA_DIRECTORY)
.desc("The location of the H2 Database file. This option should generally not be set.")
final Option nexusUrl = Option.builder().argName("url").hasArg().longOpt(ARGUMENT.NEXUS_URL)
.desc("The url to the Nexus Server's REST API Endpoint (http://domain/nexus/service/local). "
+ "If not set the Nexus Analyzer will be disabled.").build();
final Option nexusUsesProxy = Option.builder().argName("true/false").hasArg().longOpt(ARGUMENT.NEXUS_USES_PROXY)
.desc("Whether or not the configured proxy should be used when connecting to Nexus.")
final Option additionalZipExtensions = Option.builder().argName("extensions").hasArg()
.longOpt(ARGUMENT.ADDITIONAL_ZIP_EXTENSIONS)
.desc("A comma separated list of additional extensions to be scanned as ZIP files "
+ "(ZIP, EAR, WAR are already treated as zip files)").build();
final Option pathToMono = Option.builder().argName("path").hasArg().longOpt(ARGUMENT.PATH_TO_MONO)
.desc("The path to Mono for .NET Assembly analysis on non-windows systems.")
final Option pathToBundleAudit = Option.builder().argName("path").hasArg()
.longOpt(ARGUMENT.PATH_TO_BUNDLE_AUDIT)
.desc("The path to bundle-audit for Gem bundle analysis.").build();
final Option connectionTimeout = Option.builder(ARGUMENT.CONNECTION_TIMEOUT_SHORT).argName("timeout").hasArg()
.longOpt(ARGUMENT.CONNECTION_TIMEOUT).desc("The connection timeout (in milliseconds) to use when downloading resources.")
final Option proxyServer = Option.builder().argName("server").hasArg().longOpt(ARGUMENT.PROXY_SERVER)
.desc("The proxy server to use when downloading resources.").build();
final Option proxyPort = Option.builder().argName("port").hasArg().longOpt(ARGUMENT.PROXY_PORT)
.desc("The proxy port to use when downloading resources.").build();
final Option proxyUsername = Option.builder().argName("user").hasArg().longOpt(ARGUMENT.PROXY_USERNAME)
.desc("The proxy username to use when downloading resources.").build();
final Option proxyPassword = Option.builder().argName("pass").hasArg().longOpt(ARGUMENT.PROXY_PASSWORD)
.desc("The proxy password to use when downloading resources.").build();
final Option connectionString = Option.builder().argName("connStr").hasArg().longOpt(ARGUMENT.CONNECTION_STRING)
.desc("The connection string to the database.").build();
final Option dbUser = Option.builder().argName("user").hasArg().longOpt(ARGUMENT.DB_NAME)
.desc("The username used to connect to the database.").build();
final Option dbPassword = Option.builder().argName("password").hasArg().longOpt(ARGUMENT.DB_PASSWORD)
.desc("The password for connecting to the database.").build();
final Option dbDriver = Option.builder().argName("driver").hasArg().longOpt(ARGUMENT.DB_DRIVER)
.desc("The database driver name.").build();
final Option dbDriverPath = Option.builder().argName("path").hasArg().longOpt(ARGUMENT.DB_DRIVER_PATH)
.desc("The path to the database driver; note, this does not need to be set unless the JAR is outside of the classpath.")
final Option disableJarAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_JAR)
.desc("Disable the Jar Analyzer.").build();
final Option disableArchiveAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_ARCHIVE)
.desc("Disable the Archive Analyzer.").build();
final Option disableNuspecAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_NUSPEC)
.desc("Disable the Nuspec Analyzer.").build();
final Option disableAssemblyAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_ASSEMBLY)
.desc("Disable the .NET Assembly Analyzer.").build();
final Option disablePythonDistributionAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_PY_DIST)
.desc("Disable the Python Distribution Analyzer.").build();
final Option disablePythonPackageAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_PY_PKG)
.desc("Disable the Python Package Analyzer.").build();
final Option disableComposerAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_COMPOSER)
.desc("Disable the PHP Composer Analyzer.").build();
final Option disableAutoconfAnalyzer = Option.builder()
.longOpt(ARGUMENT.DISABLE_AUTOCONF)
.desc("Disable the Autoconf Analyzer.").build();
final Option disableOpenSSLAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_OPENSSL)
.desc("Disable the OpenSSL Analyzer.").build();
final Option disableCmakeAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_CMAKE)
.desc("Disable the Cmake Analyzer.").build();
final Option disableCentralAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_CENTRAL)
.desc("Disable the Central Analyzer. If this analyzer is disabled it is likely you also want to disable "
+ "the Nexus Analyzer.").build();
final Option disableNexusAnalyzer = Option.builder().longOpt(ARGUMENT.DISABLE_NEXUS)
.desc("Disable the Nexus Analyzer.").build();
final Option purge = Option.builder().longOpt(ARGUMENT.PURGE_NVD)
.desc("Purges the local NVD data cache")
options.addOption(updateOnly)
.addOption(cve12Base)
.addOption(cve20Base)
.addOption(cve12Modified)
.addOption(cve20Modified)
.addOption(proxyPort)
.addOption(proxyServer)
.addOption(proxyUsername)
.addOption(proxyPassword)
.addOption(connectionTimeout)
.addOption(connectionString)
.addOption(dbUser)
.addOption(data)
.addOption(dbPassword)
.addOption(dbDriver)
.addOption(dbDriverPath)
.addOption(disableJarAnalyzer)
.addOption(disableArchiveAnalyzer)
.addOption(disableAssemblyAnalyzer)
.addOption(pathToBundleAudit)
.addOption(disablePythonDistributionAnalyzer)
.addOption(disableCmakeAnalyzer)
.addOption(disablePythonPackageAnalyzer)
.addOption(Option.builder().longOpt(ARGUMENT.DISABLE_RUBYGEMS)
.desc("Disable the Ruby Gemspec Analyzer.").build())
.addOption(Option.builder().longOpt(ARGUMENT.DISABLE_BUNDLE_AUDIT)
.desc("Disable the Ruby Bundler-Audit Analyzer.").build())
.addOption(disableAutoconfAnalyzer)
.addOption(disableComposerAnalyzer)
.addOption(disableOpenSSLAnalyzer)
.addOption(disableNuspecAnalyzer)
.addOption(disableCentralAnalyzer)
.addOption(disableNexusAnalyzer)
.addOption(Option.builder().longOpt(ARGUMENT.DISABLE_NODE_JS)
.desc("Disable the Node.js Package Analyzer.").build())
.addOption(nexusUrl)
.addOption(nexusUsesProxy)
.addOption(additionalZipExtensions)
.addOption(pathToMono)
.addOption(purge);
* Adds the deprecated command line options to the given options collection.
* These are split out for purposes of not including them in the help
* message. We need to add the deprecated options so as not to break
* existing scripts.
@SuppressWarnings({"static-access", "deprecation"})
private void addDeprecatedOptions(final Options options) throws IllegalArgumentException {
final Option proxyServer = Option.builder().argName("url").hasArg().longOpt(ARGUMENT.PROXY_URL)
.desc("The proxy url argument is deprecated, use proxyserver instead.")
final Option appName = Option.builder(ARGUMENT.APP_NAME_SHORT).argName("name").hasArg().longOpt(ARGUMENT.APP_NAME)
.desc("The name of the project being scanned.")
options.addOption(proxyServer);
options.addOption(appName);
* Determines if the 'version' command line argument was passed in.
* @return whether or not the 'version' command line argument was passed in
public boolean isGetVersion() {
return (line != null) && line.hasOption(ARGUMENT.VERSION);
* Determines if the 'help' command line argument was passed in.
* @return whether or not the 'help' command line argument was passed in
public boolean isGetHelp() {
return (line != null) && line.hasOption(ARGUMENT.HELP);
* Determines if the 'scan' command line argument was passed in.
* @return whether or not the 'scan' command line argument was passed in
public boolean isRunScan() {
return (line != null) && isValid && line.hasOption(ARGUMENT.SCAN);
* Returns the symbolic link depth (how deeply symbolic links will be
* followed).
* @return the symbolic link depth
public int getSymLinkDepth() {
int value = 0;
value = Integer.parseInt(line.getOptionValue(ARGUMENT.SYM_LINK_DEPTH, "0"));
if (value < 0) {
value = 0;
} catch (NumberFormatException ex) {
LOGGER.debug("Symbolic link was not a number");
return value;
* Returns true if the disableJar command line argument was specified.
* @return true if the disableJar command line argument was specified;
* otherwise false
public boolean isJarDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_JAR);
* Returns true if the disableArchive command line argument was specified.
* @return true if the disableArchive command line argument was specified;
public boolean isArchiveDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_ARCHIVE);
* Returns true if the disableNuspec command line argument was specified.
* @return true if the disableNuspec command line argument was specified;
public boolean isNuspecDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_NUSPEC);
* Returns true if the disableAssembly command line argument was specified.
* @return true if the disableAssembly command line argument was specified;
public boolean isAssemblyDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_ASSEMBLY);
* Returns true if the disableBundleAudit command line argument was
* specified.
* @return true if the disableBundleAudit command line argument was
* specified; otherwise false
public boolean isBundleAuditDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_BUNDLE_AUDIT);
* Returns true if the disablePyDist command line argument was specified.
* @return true if the disablePyDist command line argument was specified;
public boolean isPythonDistributionDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_PY_DIST);
* Returns true if the disablePyPkg command line argument was specified.
* @return true if the disablePyPkg command line argument was specified;
public boolean isPythonPackageDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_PY_PKG);
* Returns whether the Ruby gemspec analyzer is disabled.
* @return true if the {@link ARGUMENT#DISABLE_RUBYGEMS} command line
* argument was specified; otherwise false
public boolean isRubyGemspecDisabled() {
return (null != line) && line.hasOption(ARGUMENT.DISABLE_RUBYGEMS);
* Returns true if the disableCmake command line argument was specified.
* @return true if the disableCmake command line argument was specified;
public boolean isCmakeDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_CMAKE);
* Returns true if the disableAutoconf command line argument was specified.
* @return true if the disableAutoconf command line argument was specified;
public boolean isAutoconfDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_AUTOCONF);
* Returns true if the disableComposer command line argument was specified.
* @return true if the disableComposer command line argument was specified;
public boolean isComposerDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_COMPOSER);
* Returns true if the disableNexus command line argument was specified.
* @return true if the disableNexus command line argument was specified;
public boolean isNexusDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_NEXUS);
* Returns true if the disableOpenSSL command line argument was specified.
* @return true if the disableOpenSSL command line argument was specified;
public boolean isOpenSSLDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_OPENSSL);
* Returns true if the disableNodeJS command line argument was specified.
* @return true if the disableNodeJS command line argument was specified;
public boolean isNodeJsDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_NODE_JS);
* Returns true if the disableCentral command line argument was specified.
* @return true if the disableCentral command line argument was specified;
public boolean isCentralDisabled() {
return (line != null) && line.hasOption(ARGUMENT.DISABLE_CENTRAL);
* Returns the url to the nexus server if one was specified.
* @return the url to the nexus server; if none was specified this will
* return null;
public String getNexusUrl() {
if (line == null || !line.hasOption(ARGUMENT.NEXUS_URL)) {
return null;
return line.getOptionValue(ARGUMENT.NEXUS_URL);
* Returns true if the Nexus Analyzer should use the configured proxy to
* connect to Nexus; otherwise false is returned.
* @return true if the Nexus Analyzer should use the configured proxy to
* connect to Nexus; otherwise false
public boolean isNexusUsesProxy() {
// If they didn't specify whether Nexus needs to use the proxy, we should
// still honor the property if it's set.
if (line == null || !line.hasOption(ARGUMENT.NEXUS_USES_PROXY)) {
return Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY);
} catch (InvalidSettingException ise) {
return true;
return Boolean.parseBoolean(line.getOptionValue(ARGUMENT.NEXUS_USES_PROXY));
* Displays the command line help message to the standard output.
public void printHelp() {
final HelpFormatter formatter = new HelpFormatter();
if (line != null && line.hasOption(ARGUMENT.ADVANCED_HELP)) {
final String helpMsg = String.format("%n%s"
+ " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. "
+ "%s will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov.%n%n",
Settings.getString("application.name", "DependencyCheck"),
Settings.getString("application.name", "DependencyCheck"));
formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
helpMsg,
options,
"",
true);
* Retrieves the file command line parameter(s) specified for the 'scan'
* argument.
* @return the file paths specified on the command line for scan
public String[] getScanFiles() {
return line.getOptionValues(ARGUMENT.SCAN);
* Retrieves the list of excluded file patterns specified by the 'exclude'
* @return the excluded file patterns
public String[] getExcludeList() {
return line.getOptionValues(ARGUMENT.EXCLUDE);
* Returns the directory to write the reports to specified on the command
* line.
* @return the path to the reports directory.
public String getReportDirectory() {
return line.getOptionValue(ARGUMENT.OUT, ".");
* Returns the path to Mono for .NET Assembly analysis on non-windows
* systems.
* @return the path to Mono
public String getPathToMono() {
return line.getOptionValue(ARGUMENT.PATH_TO_MONO);
* Returns the path to bundle-audit for Ruby bundle analysis.
public String getPathToBundleAudit() {
return line.getOptionValue(ARGUMENT.PATH_TO_BUNDLE_AUDIT);
* Returns the output format specified on the command line. Defaults to HTML
* if no format was specified.
* @return the output format name.
public String getReportFormat() {
return line.getOptionValue(ARGUMENT.OUTPUT_FORMAT, "HTML");
* Returns the application name specified on the command line.
* @return the application name.
public String getProjectName() {
final String appName = line.getOptionValue(ARGUMENT.APP_NAME);
String name = line.getOptionValue(ARGUMENT.PROJECT);
if (name == null && appName != null) {
name = appName;
LOGGER.warn("The '" + ARGUMENT.APP_NAME + "' argument should no longer be used; use '" + ARGUMENT.PROJECT + "' instead.");
return name;
* Returns the base URL for the CVE 1.2 XMl file.
* @return the URL to the CVE 1.2 XML file.
public String getBaseCve12Url() {
return line.getOptionValue(ARGUMENT.CVE_BASE_12);
* Returns the base URL for the CVE 2.0 XMl file.
* @return the URL to the CVE 2.0 XML file.
public String getBaseCve20Url() {
return line.getOptionValue(ARGUMENT.CVE_BASE_20);
* Returns the URL for the modified CVE 1.2 XMl file.
* @return the URL to the modified CVE 1.2 XML file.
public String getModifiedCve12Url() {
return line.getOptionValue(ARGUMENT.CVE_MOD_12);
* Returns the URL for the modified CVE 2.0 XMl file.
* @return the URL to the modified CVE 2.0 XML file.
public String getModifiedCve20Url() {
return line.getOptionValue(ARGUMENT.CVE_MOD_20);
* Returns the connection timeout.
* @return the connection timeout
public String getConnectionTimeout() {
return line.getOptionValue(ARGUMENT.CONNECTION_TIMEOUT);
* Returns the proxy server.
* @return the proxy server
@SuppressWarnings("deprecation")
public String getProxyServer() {
String server = line.getOptionValue(ARGUMENT.PROXY_SERVER);
if (server == null) {
server = line.getOptionValue(ARGUMENT.PROXY_URL);
if (server != null) {
LOGGER.warn("An old command line argument 'proxyurl' was detected; use proxyserver instead");
return server;
* Returns the proxy port.
* @return the proxy port
public String getProxyPort() {
return line.getOptionValue(ARGUMENT.PROXY_PORT);
* Returns the proxy username.
* @return the proxy username
public String getProxyUsername() {
return line.getOptionValue(ARGUMENT.PROXY_USERNAME);
* Returns the proxy password.
* @return the proxy password
public String getProxyPassword() {
return line.getOptionValue(ARGUMENT.PROXY_PASSWORD);
* Get the value of dataDirectory.
* @return the value of dataDirectory
public String getDataDirectory() {
return line.getOptionValue(ARGUMENT.DATA_DIRECTORY);
* Returns the properties file specified on the command line.
* @return the properties file specified on the command line
public File getPropertiesFile() {
final String path = line.getOptionValue(ARGUMENT.PROP);
if (path != null) {
return new File(path);
* Returns the path to the verbose log file.
* @return the path to the verbose log file
public String getVerboseLog() {
return line.getOptionValue(ARGUMENT.VERBOSE_LOG);
* Returns the path to the suppression file.
* @return the path to the suppression file
public String getSuppressionFile() {
return line.getOptionValue(ARGUMENT.SUPPRESSION_FILE);
* <p>
* Prints the manifest information to standard output.</p>
* <ul><li>Implementation-Title: ${pom.name}</li>
* <li>Implementation-Version: ${pom.version}</li></ul>
public void printVersionInfo() {
final String version = String.format("%s version %s",
Settings.getString(Settings.KEYS.APPLICATION_VAME, "dependency-check"),
Settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown"));
System.out.println(version);
* Checks if the auto update feature has been disabled. If it has been
* disabled via the command line this will return false.
* @return <code>true</code> if auto-update is allowed; otherwise
* <code>false</code>
public boolean isAutoUpdate() {
return line != null && !line.hasOption(ARGUMENT.DISABLE_AUTO_UPDATE);
* Checks if the update only flag has been set.
* @return <code>true</code> if the update only flag has been set; otherwise
* <code>false</code>.
public boolean isUpdateOnly() {
return line != null && line.hasOption(ARGUMENT.UPDATE_ONLY);
* Checks if the purge NVD flag has been set.
* @return <code>true</code> if the purge nvd flag has been set; otherwise
public boolean isPurge() {
return line != null && line.hasOption(ARGUMENT.PURGE_NVD);
* Returns the database driver name if specified; otherwise null is
* returned.
* @return the database driver name if specified; otherwise null is returned
public String getDatabaseDriverName() {
return line.getOptionValue(ARGUMENT.DB_DRIVER);
* Returns the database driver path if specified; otherwise null is
public String getDatabaseDriverPath() {
return line.getOptionValue(ARGUMENT.DB_DRIVER_PATH);
* Returns the database connection string if specified; otherwise null is
* @return the database connection string if specified; otherwise null is
* returned
public String getConnectionString() {
return line.getOptionValue(ARGUMENT.CONNECTION_STRING);
* Returns the database database user name if specified; otherwise null is
* @return the database database user name if specified; otherwise null is
public String getDatabaseUser() {
return line.getOptionValue(ARGUMENT.DB_NAME);
* Returns the database database password if specified; otherwise null is
* @return the database database password if specified; otherwise null is
public String getDatabasePassword() {
return line.getOptionValue(ARGUMENT.DB_PASSWORD);
* Returns the additional Extensions if specified; otherwise null is
* @return the additional Extensions; otherwise null is returned
public String getAdditionalZipExtensions() {
return line.getOptionValue(ARGUMENT.ADDITIONAL_ZIP_EXTENSIONS);
* Get the value of cveValidForHours.
* @return the value of cveValidForHours
public Integer getCveValidForHours() {
final String v = line.getOptionValue(ARGUMENT.CVE_VALID_FOR_HOURS);
if (v != null) {
return Integer.parseInt(v);
* Returns true if the experimental analyzers are enabled.
* @return true if the experimental analyzers are enabled; otherwise false
public boolean isExperimentalEnabled() {
return line.hasOption(ARGUMENT.EXPERIMENTAL);
* A collection of static final strings that represent the possible command
* line arguments.
public static class ARGUMENT {
Settings.getString(Settings.KEYS.APPLICATION_NAME, "dependency-check"),
* The long CLI argument name specifying the directory/file to scan.
public static final String SCAN = "scan";
* The short CLI argument name specifying the directory/file to scan.
public static final String SCAN_SHORT = "s";
* The long CLI argument name specifying that the CPE/CVE/etc. data
* should not be automatically updated.
public static final String DISABLE_AUTO_UPDATE = "noupdate";
* The short CLI argument name specifying that the CPE/CVE/etc. data
public static final String DISABLE_AUTO_UPDATE_SHORT = "n";
* The long CLI argument name specifying that only the update phase
* should be executed; no scan should be run.
public static final String UPDATE_ONLY = "updateonly";
public static final String PURGE_NVD = "purge";
* The long CLI argument name specifying the directory to write the
* reports to.
public static final String OUT = "out";
* The short CLI argument name specifying the directory to write the
public static final String OUT_SHORT = "o";
* The long CLI argument name specifying the output format to write the
public static final String OUTPUT_FORMAT = "format";
* The short CLI argument name specifying the output format to write the
public static final String OUTPUT_FORMAT_SHORT = "f";
* The long CLI argument name specifying the name of the project to be
* scanned.
public static final String PROJECT = "project";
* The long CLI argument name specifying the name of the application to
* be scanned.
* @deprecated project should be used instead
@Deprecated
public static final String APP_NAME = "app";
* The short CLI argument name specifying the name of the application to
public static final String APP_NAME_SHORT = "a";
* The long CLI argument name asking for help.
public static final String HELP = "help";
* The long CLI argument name asking for advanced help.
public static final String ADVANCED_HELP = "advancedHelp";
* The short CLI argument name asking for help.
public static final String HELP_SHORT = "h";
* The long CLI argument name asking for the version.
public static final String VERSION_SHORT = "v";
* The short CLI argument name asking for the version.
public static final String VERSION = "version";
* The CLI argument name indicating the proxy port.
public static final String PROXY_PORT = "proxyport";
* The CLI argument name indicating the proxy server.
public static final String PROXY_SERVER = "proxyserver";
* The CLI argument name indicating the proxy url.
* @deprecated use {@link #PROXY_SERVER} instead
public static final String PROXY_URL = "proxyurl";
* The CLI argument name indicating the proxy username.
public static final String PROXY_USERNAME = "proxyuser";
* The CLI argument name indicating the proxy password.
public static final String PROXY_PASSWORD = "proxypass";
* The short CLI argument name indicating the connection timeout.
public static final String CONNECTION_TIMEOUT_SHORT = "c";
* The CLI argument name indicating the connection timeout.
public static final String CONNECTION_TIMEOUT = "connectiontimeout";
* The short CLI argument name for setting the location of an additional
* properties file.
public static final String PROP_SHORT = "P";
* The CLI argument name for setting the location of an additional
public static final String PROP = "propertyfile";
* The CLI argument name for setting the location of the data directory.
public static final String DATA_DIRECTORY = "data";
* The CLI argument name for setting the URL for the CVE Data Files.
public static final String CVE_MOD_12 = "cveUrl12Modified";
public static final String CVE_MOD_20 = "cveUrl20Modified";
public static final String CVE_BASE_12 = "cveUrl12Base";
public static final String CVE_BASE_20 = "cveUrl20Base";
* The short CLI argument name for setting the location of the data
* directory.
public static final String DATA_DIRECTORY_SHORT = "d";
public static final String VERBOSE_LOG = "log";
public static final String VERBOSE_LOG_SHORT = "l";
* The CLI argument name for setting the depth of symbolic links that
* will be followed.
public static final String SYM_LINK_DEPTH = "symLink";
* The CLI argument name for setting the location of the suppression
* file.
public static final String SUPPRESSION_FILE = "suppression";
public static final String CVE_VALID_FOR_HOURS = "cveValidForHours";
* Disables the Jar Analyzer.
public static final String DISABLE_JAR = "disableJar";
* Disables the Archive Analyzer.
public static final String DISABLE_ARCHIVE = "disableArchive";
* Disables the Python Distribution Analyzer.
public static final String DISABLE_PY_DIST = "disablePyDist";
* Disables the Python Package Analyzer.
public static final String DISABLE_PY_PKG = "disablePyPkg";
public static final String DISABLE_COMPOSER = "disableComposer";
* Disables the Ruby Gemspec Analyzer.
public static final String DISABLE_RUBYGEMS = "disableRubygems";
* Disables the Autoconf Analyzer.
public static final String DISABLE_AUTOCONF = "disableAutoconf";
* Disables the Cmake Analyzer.
public static final String DISABLE_CMAKE = "disableCmake";
* Disables the Assembly Analyzer.
public static final String DISABLE_ASSEMBLY = "disableAssembly";
* Disables the Ruby Bundler Audit Analyzer.
public static final String DISABLE_BUNDLE_AUDIT = "disableBundleAudit";
* Disables the Nuspec Analyzer.
public static final String DISABLE_NUSPEC = "disableNuspec";
* Disables the Central Analyzer.
public static final String DISABLE_CENTRAL = "disableCentral";
* Disables the Nexus Analyzer.
public static final String DISABLE_NEXUS = "disableNexus";
* Disables the OpenSSL Analyzer.
public static final String DISABLE_OPENSSL = "disableOpenSSL";
* Disables the Node.js Package Analyzer.
public static final String DISABLE_NODE_JS = "disableNodeJS";
* The URL of the nexus server.
public static final String NEXUS_URL = "nexus";
* Whether or not the defined proxy should be used when connecting to
* Nexus.
public static final String NEXUS_USES_PROXY = "nexusUsesProxy";
* The CLI argument name for setting the connection string.
public static final String CONNECTION_STRING = "connectionString";
* The CLI argument name for setting the database user name.
public static final String DB_NAME = "dbUser";
* The CLI argument name for setting the database password.
public static final String DB_PASSWORD = "dbPassword";
* The CLI argument name for setting the database driver name.
public static final String DB_DRIVER = "dbDriverName";
* The CLI argument name for setting the path to the database driver; in
* case it is not on the class path.
public static final String DB_DRIVER_PATH = "dbDriverPath";
* The CLI argument name for setting the path to mono for .NET Assembly
* analysis on non-windows systems.
public static final String PATH_TO_MONO = "mono";
* The CLI argument name for setting extra extensions.
public static final String ADDITIONAL_ZIP_EXTENSIONS = "zipExtensions";
* Exclude path argument.
public static final String EXCLUDE = "exclude";
* The CLI argument name for setting the path to bundle-audit for Ruby
* bundle analysis.
public static final String PATH_TO_BUNDLE_AUDIT = "bundleAudit";
* The CLI argument to enable the experimental analyzers.
private static final String EXPERIMENTAL = "enableExperimental";
OWASP dependency-check-cli is an command line tool that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the scanned project dependencies. The tool will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries.
Download the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:
$ chmod +777 dependency-check.sh diff --git a/dependency-check-cli/integration.html b/dependency-check-cli/integration.html index f0eb2ab2c..1a9efc9db 100644 --- a/dependency-check-cli/integration.html +++ b/dependency-check-cli/integration.html @@ -1,13 +1,13 @@ - + dependency-check-cli – CI Management @@ -52,7 +52,7 @@
public class CocoaPodsAnalyzer +extends AbstractFileTypeAnalyzer
static String
PODSPEC
CocoaPodsAnalyzer()
protected void
analyzeFileType(Dependency dependency, + Engine engine)
AnalysisPhase
getAnalysisPhase()
protected String
getAnalyzerEnabledSettingKey()
protected FileFilter
getFileFilter()
String
getName()
initializeFileTypeAnalyzer()
accept, analyze, initialize, isEnabled, isFilesMatched, newHashSet, reset, setEnabled, setFilesMatched
close
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
public static final String PODSPEC
public CocoaPodsAnalyzer()
protected FileFilter getFileFilter()
getFileFilter
AbstractFileTypeAnalyzer
protected void initializeFileTypeAnalyzer()
initializeFileTypeAnalyzer
public String getName()
public AnalysisPhase getAnalysisPhase()
protected String getAnalyzerEnabledSettingKey()
getAnalyzerEnabledSettingKey
protected void analyzeFileType(Dependency dependency, + Engine engine) + throws AnalysisException
analyzeFileType
dependency
engine
AnalysisException
Copyright? 2012-15 Jeremy Long. All Rights Reserved.
public class SwiftPackageManagerAnalyzer +extends AbstractFileTypeAnalyzer
SPM_FILE_NAME
SwiftPackageManagerAnalyzer()
public static final String SPM_FILE_NAME
public SwiftPackageManagerAnalyzer()
