github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-01-14 15:53:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

added initial version filter - only supporting struts1/2 right now

Browse Source 
Former-commit-id: 353a6fec78140b50622b4d267ddf6de34461027c
This commit is contained in:
Jeremy Long
2013-05-31 22:57:04 -04:00
parent c515afd8eb
commit e3f401debb
1 changed files with 43 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
src/main/java/org/owasp/dependencycheck/data/nvdcve/NvdCveAnalyzer.java
View File

@@ -29,6 +29,7 @@ import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.dependency.Identifier;
import org.owasp.dependencycheck.analyzer.Analyzer;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
/**
* NvdCveAnalyzer is a utility class that takes a project dependency and
* attempts to discern if there is an associated CVEs. It uses the the
@@ -106,7 +107,9 @@ public class NvdCveAnalyzer implements Analyzer {
final String value = id.getValue();
final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
for (Vulnerability v : vulns) {
dependency.addVulnerability(v);
if (isValidMatch(dependency, v)) {
dependency.addVulnerability(v);
}
}
} catch (DatabaseException ex) {
throw new AnalysisException(ex);
@@ -160,4 +163,43 @@ public class NvdCveAnalyzer implements Analyzer {
public void initialize() throws Exception {
this.open();
}
private boolean isValidMatch(final Dependency dependency, final Vulnerability v) {
//right now I only know of the issue with Struts1/2
// start with fixing this problem.
//TODO extend this solution to do better version matching for the vulnerable software.
boolean struts1 = false;
boolean struts2 = false;
for (Identifier i : dependency.getIdentifiers()) {
if (i.getValue().startsWith("cpe:/a:apache:struts:")) {
char version = i.getValue().charAt(21);
if (version == '1') {
struts1 = true;
}
if (version == '2') {
struts2 = true;
}
}
}
if (!struts1 && !struts2) {
return true; //we are not looking at struts, so return true.
}
if (struts1 && struts2) {
return true; //there is a mismatch here, but we can't solve it here so we return valid.
}
if (struts1) {
boolean hasStruts1Vuln = false;
boolean hasStruts2PreviousVersion = false;
for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2';
hasStruts1Vuln |= vs.getName().charAt(21) == '1';
}
if (!hasStruts1Vuln && hasStruts2PreviousVersion) {
return false;
}
}
return true;
}
}