diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java index 78c5e6ab0..209e686f8 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java @@ -17,15 +17,6 @@ */ package org.owasp.dependencycheck.analyzer; -import java.io.File; -import java.io.IOException; -import java.net.MalformedURLException; -import java.net.URL; -import java.util.List; -import java.util.Set; -import java.util.logging.Level; -import java.util.logging.Logger; -import java.util.regex.Pattern; import org.owasp.dependencycheck.suppression.SuppressionParseException; import org.owasp.dependencycheck.suppression.SuppressionParser; import org.owasp.dependencycheck.suppression.SuppressionRule; @@ -34,6 +25,17 @@ import org.owasp.dependencycheck.utils.Downloader; import org.owasp.dependencycheck.utils.FileUtils; import org.owasp.dependencycheck.utils.Settings; +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.net.MalformedURLException; +import java.net.URL; +import java.util.List; +import java.util.Set; +import java.util.logging.Level; +import java.util.logging.Logger; +import java.util.regex.Pattern; + /** * Abstract base suppression analyzer that contains methods for parsing the suppression xml file. * @@ -47,6 +49,7 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { private static final Logger LOGGER = Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()); // + /** * Returns a list of file EXTENSIONS supported by this analyzer. * @@ -57,6 +60,7 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { } // + /** * The initialize method loads the suppression XML file. * @@ -67,6 +71,7 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { super.initialize(); loadSuppressionData(); } + /** * The list of suppression rules */ @@ -115,6 +120,18 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { } } else { file = new File(suppressionFilePath); + if (!file.exists()) { + InputStream suppressionsFromClasspath = this.getClass().getClassLoader().getResourceAsStream(suppressionFilePath); + if (suppressionsFromClasspath != null) { + deleteTempFile = true; + file = FileUtils.getTempFile("suppression", "xml"); + try { + org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file); + } catch (IOException ex) { + throwSuppressionParseException("Unable to locate suppressions file in classpath", ex); + } + } + } } if (file != null) { @@ -131,24 +148,21 @@ public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { } } } catch (DownloadFailedException ex) { - LOGGER.log(Level.WARNING, - "Unable to fetch the configured suppression file"); - LOGGER.log(Level.FINE, "", ex); - throw new SuppressionParseException("Unable to fetch the configured suppression file", ex); + throwSuppressionParseException("Unable to fetch the configured suppression file", ex); } catch (MalformedURLException ex) { - LOGGER.log(Level.WARNING, - "Configured suppression file has an invalid URL"); - LOGGER.log(Level.FINE, "", ex); - throw new SuppressionParseException("Configured suppression file has an invalid URL", ex); + throwSuppressionParseException("Configured suppression file has an invalid URL", ex); } catch (IOException ex) { - LOGGER.log(Level.WARNING, - "Unable to create temp file for suppressions"); - LOGGER.log(Level.FINE, "", ex); - throw new SuppressionParseException("Unable to create temp file for suppressions", ex); + throwSuppressionParseException("Unable to create temp file for suppressions", ex); } finally { if (deleteTempFile && file != null) { FileUtils.delete(file); } } } + + private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException { + LOGGER.log(Level.WARNING, message); + LOGGER.log(Level.FINE, "", exception); + throw new SuppressionParseException(message, exception); + } }