github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-25 02:21:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated test case per issue #792

Browse Source
This commit is contained in:
Jeremy Long
2017-07-16 08:46:48 -04:00
parent d4c1a9ea08
commit ed56eb2ec1
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
dependency-check-maven/src/it/629-jackson-dataformat/pom.xml
View File

@@ -43,5 +43,25 @@ Copyright (c) 2017 Jeremy Long. All Rights Reserved.
<artifactId>jackson-dataformat-xml</artifactId> <artifactId>jackson-dataformat-xml</artifactId>
<version>2.4.5</version> <version>2.4.5</version>
</dependency> </dependency>
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-kotlin</artifactId>
<version>2.8.9</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-ion</artifactId>
<version>2.8.9</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-hppc</artifactId>
<version>2.8.9</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.jaxrs</groupId>
<artifactId>jackson-jaxrs-yaml-provider</artifactId>
<version>2.8.9</version>
</dependency>
</dependencies> </dependencies>
</project> </project>

7
dependency-check-maven/src/it/629-jackson-dataformat/postbuild.groovy
View File

@@ -24,7 +24,12 @@ import java.nio.charset.Charset;
// Check to see if jackson-dataformat-xml-2.4.5.jar was identified. // Check to see if jackson-dataformat-xml-2.4.5.jar was identified.
//TODO change this to xpath and check for CVE-2016-3720 //TODO change this to xpath and check for CVE-2016-3720
String log = FileUtils.readFileToString(new File(basedir, "target/dependency-check-report.xml"), Charset.defaultCharset().name()); String log = FileUtils.readFileToString(new File(basedir, "target/dependency-check-report.xml"), Charset.defaultCharset().name());
int count = StringUtils.countMatches(log, "<fileName>jackson-dataformat-xml-2.4.5.jar</fileName>"); int count = StringUtils.countMatches(log, "<name>CVE-2016-7051</name>");
if (count == 0){
System.out.println(String.format("jackson-dataformat-xml was identified %s times, expected 1", count));
return false;
}
count = StringUtils.countMatches(log, "<name>CVE-2016-3720</name>");
if (count == 0){ if (count == 0){
System.out.println(String.format("jackson-dataformat-xml was identified %s times, expected 1", count)); System.out.println(String.format("jackson-dataformat-xml was identified %s times, expected 1", count));
return false; return false;