diff --git a/dependency-check-ant/apidocs/allclasses-frame.html b/dependency-check-ant/apidocs/allclasses-frame.html index 7dabd3bf6..dd22dcce7 100644 --- a/dependency-check-ant/apidocs/allclasses-frame.html +++ b/dependency-check-ant/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Ant Task 1.1.4 API) - +All Classes (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/allclasses-noframe.html b/dependency-check-ant/apidocs/allclasses-noframe.html index e2b565f0b..9393ba0de 100644 --- a/dependency-check-ant/apidocs/allclasses-noframe.html +++ b/dependency-check-ant/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Ant Task 1.1.4 API) - +All Classes (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/constant-values.html b/dependency-check-ant/apidocs/constant-values.html index 4db5c4bc3..495d6277c 100644 --- a/dependency-check-ant/apidocs/constant-values.html +++ b/dependency-check-ant/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Ant Task 1.1.4 API) - +Constant Field Values (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/deprecated-list.html b/dependency-check-ant/apidocs/deprecated-list.html index 8110cdd23..c5af70f86 100644 --- a/dependency-check-ant/apidocs/deprecated-list.html +++ b/dependency-check-ant/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Ant Task 1.1.4 API) - +Deprecated List (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/help-doc.html b/dependency-check-ant/apidocs/help-doc.html index 08b77bef7..7708c7a9d 100644 --- a/dependency-check-ant/apidocs/help-doc.html +++ b/dependency-check-ant/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Ant Task 1.1.4 API) - +API Help (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/index-all.html b/dependency-check-ant/apidocs/index-all.html index 209e359fc..65a4f6960 100644 --- a/dependency-check-ant/apidocs/index-all.html +++ b/dependency-check-ant/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Ant Task 1.1.4 API) - +Index (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/index.html b/dependency-check-ant/apidocs/index.html index 842052271..ccc2cacb7 100644 --- a/dependency-check-ant/apidocs/index.html +++ b/dependency-check-ant/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Ant Task 1.1.4 API +Dependency-Check Ant Task 1.2.0 API diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html index b9541eb3a..3c02163ea 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html @@ -2,16 +2,16 @@ - + -DependencyCheckTask (Dependency-Check Ant Task 1.1.4 API) - +DependencyCheckTask (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html index 4b9b38191..06ea1a733 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats (Dependency-Check Ant Task 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html index 5ce819837..f75e8d65b 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask (Dependency-Check Ant Task 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html index f0b5a0b26..d005116ee 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.1.4 API) - +org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html index a21a07c98..1bfd59435 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.1.4 API) - +org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html index fb220366a..4c71d3a8d 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.taskdefs Class Hierarchy (Dependency-Check Ant Task 1.1.4 API) - +org.owasp.dependencycheck.taskdefs Class Hierarchy (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html index fe8707391..199769732 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.1.4 API) - +Uses of Package org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/apidocs/overview-tree.html b/dependency-check-ant/apidocs/overview-tree.html index 46e199296..94ebbe683 100644 --- a/dependency-check-ant/apidocs/overview-tree.html +++ b/dependency-check-ant/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Ant Task 1.1.4 API) - +Class Hierarchy (Dependency-Check Ant Task 1.2.0 API) + diff --git a/dependency-check-ant/checkstyle.html b/dependency-check-ant/checkstyle.html index 9771ed9a9..76dc7d954 100644 --- a/dependency-check-ant/checkstyle.html +++ b/dependency-check-ant/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Checkstyle Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html index 2fe57f4fa..d11b323cf 100644 --- a/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html +++ b/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.taskdefs - +
    DependencyCheckTask (0%)DependencyCheckTask (70%)
    diff --git a/dependency-check-ant/cobertura/frame-sourcefiles.html b/dependency-check-ant/cobertura/frame-sourcefiles.html index 144da4b90..a62712431 100644 --- a/dependency-check-ant/cobertura/frame-sourcefiles.html +++ b/dependency-check-ant/cobertura/frame-sourcefiles.html @@ -15,7 +15,7 @@ All Packages - +
    DependencyCheckTask (0%)DependencyCheckTask (70%)
    diff --git a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html index 7562ceb4d..af8ac4557 100644 --- a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html +++ b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.taskdefs2
    0%
    0/194
    0%
    0/148
    2.066
    org.owasp.dependencycheck.taskdefs2
    70%
    138/197
    36%
    54/148
    2.066
    - + diff --git a/dependency-check-ant/cobertura/frame-summary.html b/dependency-check-ant/cobertura/frame-summary.html index a025efb0e..28710b952 100644 --- a/dependency-check-ant/cobertura/frame-summary.html +++ b/dependency-check-ant/cobertura/frame-summary.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages2
    0%
    0/194
    0%
    0/148
    2.066
    org.owasp.dependencycheck.taskdefs2
    0%
    0/194
    0%
    0/148
    2.066
    All Packages2
    70%
    138/197
    36%
    54/148
    2.066
    org.owasp.dependencycheck.taskdefs2
    70%
    138/197
    36%
    54/148
    2.066
    - + diff --git a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html index e452437fc..de0fc4a94 100644 --- a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html +++ b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html @@ -12,8 +12,8 @@
     
    - - + +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyCheckTask
    0%
    0/188
    0%
    0/146
    2.066
    DependencyCheckTask$ReportFormats
    0%
    0/6
    0%
    0/2
    2.066
    DependencyCheckTask
    69%
    132/191
    35%
    52/146
    2.066
    DependencyCheckTask$ReportFormats
    100%
    6/6
    100%
    2/2
    2.066
     
    @@ -144,1968 +144,1971 @@
          * System specific new line character.
     63  
          */
    -  64  0
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
    +  64  1
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
     65   -
     
    +
         /**
     66   -
         /**
    +
          * The logger.
     67   -
          * Construct a new DependencyCheckTask.
    -  68  
          */
    +  68  1
         private static final Logger LOGGER = Logger.getLogger(DependencyCheckTask.class.getName());
     69   -
         public DependencyCheckTask() {
    -  70  0
             super();
    -  71  0
         }
    -  72   -
         //The following code was copied Apache Ant PathConvert
    -  73   -
         //BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert
    -  74   +
     
    +  70  
         /**
    -  75   -
          * Path to be converted
    -  76   +  71   +
          * Construct a new DependencyCheckTask.
    +  72  
          */
    -  77  0
         private Resources path = null;
    +  73   +
         public DependencyCheckTask() {
    +  74  4
             super();
    +  75  4
         }
    +  76   +
         //The following code was copied Apache Ant PathConvert
    +  77   +
         //BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert
     78  
         /**
     79   -
          * Reference to path/fileset to convert
    +
          * Path to be converted
     80  
          */
    -  81  0
         private Reference refid = null;
    +  81  4
         private Resources path = null;
     82   -
     
    +
         /**
     83   -
         /**
    +
          * Reference to path/fileset to convert
     84   -
          * Add an arbitrary ResourceCollection.
    -  85   -
          *
    +
          */
    +  85  4
         private Reference refid = null;
     86   -
          * @param rc the ResourceCollection to add.
    +
     
     87   -
          * @since Ant 1.7
    +
         /**
     88   -
          */
    +
          * Add an arbitrary ResourceCollection.
     89   -
         public void add(ResourceCollection rc) {
    -  90  0
             if (isReference()) {
    -  91  0
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
    +
          *
    +  90   +
          * @param rc the ResourceCollection to add.
    +  91   +
          * @since Ant 1.7
     92   -
             }
    -  93  0
             getPath().add(rc);
    -  94  0
         }
    -  95   -
     
    +
          */
    +  93   +
         public void add(ResourceCollection rc) {
    +  94  4
             if (isReference()) {
    +  95  0
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
     96   -
         /**
    -  97   -
          * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the
    -  98   -
          * path object.
    +
             }
    +  97  4
             getPath().add(rc);
    +  98  4
         }
     99   -
          *
    +
     
     100   -
          * @return the path
    +
         /**
     101   -
          */
    +
          * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the
     102   -
         private synchronized Resources getPath() {
    -  103  0
             if (path == null) {
    -  104  0
                 path = new Resources(getProject());
    -  105  0
                 path.setCache(true);
    +
          * path object.
    +  103   +
          *
    +  104   +
          * @return the path
    +  105   +
          */
     106   -
             }
    -  107  0
             return path;
    -  108   -
         }
    -  109   -
     
    +
         private synchronized Resources getPath() {
    +  107  4
             if (path == null) {
    +  108  3
                 path = new Resources(getProject());
    +  109  3
                 path.setCache(true);
     110   -
         /**
    -  111   -
          * Learn whether the refid attribute of this element been set.
    +
             }
    +  111  4
             return path;
     112   -
          *
    +
         }
     113   -
          * @return true if refid is valid.
    +
     
     114   -
          */
    +
         /**
     115   -
         public boolean isReference() {
    -  116  0
             return refid != null;
    +
          * Learn whether the refid attribute of this element been set.
    +  116   +
          *
     117   -
         }
    +
          * @return true if refid is valid.
     118   -
     
    +
          */
     119   -
         /**
    -  120   -
          * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere.
    +
         public boolean isReference() {
    +  120  8
             return refid != null;
     121   -
          *
    +
         }
     122   -
          * @param r the reference to a path, fileset, dirset or filelist.
    +
     
     123   -
          */
    +
         /**
     124   -
         public void setRefid(Reference r) {
    -  125  0
             if (path != null) {
    -  126  0
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
    +
          * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere.
    +  125   +
          *
    +  126   +
          * @param r the reference to a path, fileset, dirset or filelist.
     127   -
             }
    -  128  0
             refid = r;
    -  129  0
         }
    -  130   -
     
    +
          */
    +  128   +
         public void setRefid(Reference r) {
    +  129  0
             if (path != null) {
    +  130  0
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
     131   -
         /**
    -  132   -
          * If this is a reference, this method will add the referenced resource collection to the collection of paths.
    -  133   -
          *
    -  134   -
          * @throws BuildException if the reference is not to a resource collection
    -  135   -
          */
    -  136   -
         private void dealWithReferences() throws BuildException {
    -  137  0
             if (isReference()) {
    -  138  0
                 final Object o = refid.getReferencedObject(getProject());
    -  139  0
                 if (!(o instanceof ResourceCollection)) {
    -  140  0
                     throw new BuildException("refid '" + refid.getRefId()
    -  141   -
                             + "' does not refer to a resource collection.");
    -  142   -
                 }
    -  143  0
                 getPath().add((ResourceCollection) o);
    -  144  
             }
    -  145  0
         }
    +  132  0
             refid = r;
    +  133  0
         }
    +  134   +
     
    +  135   +
         /**
    +  136   +
          * If this is a reference, this method will add the referenced resource collection to the collection of paths.
    +  137   +
          *
    +  138   +
          * @throws BuildException if the reference is not to a resource collection
    +  139   +
          */
    +  140   +
         private void dealWithReferences() throws BuildException {
    +  141  4
             if (isReference()) {
    +  142  0
                 final Object o = refid.getReferencedObject(getProject());
    +  143  0
                 if (!(o instanceof ResourceCollection)) {
    +  144  0
                     throw new BuildException("refid '" + refid.getRefId()
    +  145   +
                             + "' does not refer to a resource collection.");
     146   -
         // END COPY from org.apache.tools.ant.taskdefs
    -  147   -
         /**
    +
                 }
    +  147  0
                 getPath().add((ResourceCollection) o);
     148   -
          * The application name for the report.
    -  149   -
          */
    -  150  0
         private String applicationName = "Dependency-Check";
    +
             }
    +  149  4
         }
    +  150   +
         // END COPY from org.apache.tools.ant.taskdefs
     151   -
     
    +
         /**
     152   -
         /**
    +
          * The application name for the report.
     153   -
          * Get the value of applicationName.
    -  154   -
          *
    +
          */
    +  154  4
         private String applicationName = "Dependency-Check";
     155   -
          * @return the value of applicationName
    +
     
     156   -
          */
    +
         /**
     157   -
         public String getApplicationName() {
    +
          * Get the value of applicationName.
     158   -
             return applicationName;
    +
          *
     159   -
         }
    +
          * @return the value of applicationName
     160   -
     
    +
          */
     161   -
         /**
    +
         public String getApplicationName() {
     162   -
          * Set the value of applicationName.
    +
             return applicationName;
     163   -
          *
    +
         }
     164   -
          * @param applicationName new value of applicationName
    +
     
     165   -
          */
    +
         /**
     166   -
         public void setApplicationName(String applicationName) {
    +
          * Set the value of applicationName.
     167   -
             this.applicationName = applicationName;
    +
          *
     168   -
         }
    +
          * @param applicationName new value of applicationName
     169   -
         /**
    +
          */
     170   -
          * The location of the data directory that contains
    +
         public void setApplicationName(String applicationName) {
     171   -
          */
    -  172  0
         private String dataDirectory = null;
    +
             this.applicationName = applicationName;
    +  172   +
         }
     173   -
     
    +
         /**
     174   -
         /**
    +
          * The location of the data directory that contains
     175   -
          * Get the value of dataDirectory.
    -  176   -
          *
    +
          */
    +  176  4
         private String dataDirectory = null;
     177   -
          * @return the value of dataDirectory
    +
     
     178   -
          */
    +
         /**
     179   -
         public String getDataDirectory() {
    +
          * Get the value of dataDirectory.
     180   -
             return dataDirectory;
    +
          *
     181   -
         }
    +
          * @return the value of dataDirectory
     182   -
     
    +
          */
     183   -
         /**
    +
         public String getDataDirectory() {
     184   -
          * Set the value of dataDirectory.
    +
             return dataDirectory;
     185   -
          *
    +
         }
     186   -
          * @param dataDirectory new value of dataDirectory
    +
     
     187   -
          */
    +
         /**
     188   -
         public void setDataDirectory(String dataDirectory) {
    +
          * Set the value of dataDirectory.
     189   -
             this.dataDirectory = dataDirectory;
    +
          *
     190   -
         }
    +
          * @param dataDirectory new value of dataDirectory
     191   -
         /**
    +
          */
     192   -
          * Specifies the destination directory for the generated Dependency-Check report.
    +
         public void setDataDirectory(String dataDirectory) {
     193   -
          */
    -  194  0
         private String reportOutputDirectory = ".";
    +
             this.dataDirectory = dataDirectory;
    +  194   +
         }
     195   -
     
    +
         /**
     196   -
         /**
    +
          * Specifies the destination directory for the generated Dependency-Check report.
     197   -
          * Get the value of reportOutputDirectory.
    -  198   -
          *
    +
          */
    +  198  4
         private String reportOutputDirectory = ".";
     199   -
          * @return the value of reportOutputDirectory
    +
     
     200   -
          */
    +
         /**
     201   -
         public String getReportOutputDirectory() {
    +
          * Get the value of reportOutputDirectory.
     202   -
             return reportOutputDirectory;
    +
          *
     203   -
         }
    +
          * @return the value of reportOutputDirectory
     204   -
     
    +
          */
     205   -
         /**
    +
         public String getReportOutputDirectory() {
     206   -
          * Set the value of reportOutputDirectory.
    +
             return reportOutputDirectory;
     207   -
          *
    +
         }
     208   -
          * @param reportOutputDirectory new value of reportOutputDirectory
    +
     
     209   -
          */
    +
         /**
     210   -
         public void setReportOutputDirectory(String reportOutputDirectory) {
    +
          * Set the value of reportOutputDirectory.
     211   -
             this.reportOutputDirectory = reportOutputDirectory;
    +
          *
     212   -
         }
    +
          * @param reportOutputDirectory new value of reportOutputDirectory
     213   -
         /**
    +
          */
     214   -
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
    +
         public void setReportOutputDirectory(String reportOutputDirectory) {
     215   -
          * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11.
    +
             this.reportOutputDirectory = reportOutputDirectory;
     216   -
          * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail.
    +
         }
     217   -
          */
    -  218  0
         private float failBuildOnCVSS = 11;
    +
         /**
    +  218   +
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
     219   -
     
    +
          * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11.
     220   -
         /**
    +
          * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail.
     221   -
          * Get the value of failBuildOnCVSS.
    -  222   -
          *
    +
          */
    +  222  4
         private float failBuildOnCVSS = 11;
     223   -
          * @return the value of failBuildOnCVSS
    +
     
     224   -
          */
    +
         /**
     225   -
         public float getFailBuildOnCVSS() {
    +
          * Get the value of failBuildOnCVSS.
     226   -
             return failBuildOnCVSS;
    +
          *
     227   -
         }
    +
          * @return the value of failBuildOnCVSS
     228   -
     
    +
          */
     229   -
         /**
    +
         public float getFailBuildOnCVSS() {
     230   -
          * Set the value of failBuildOnCVSS.
    +
             return failBuildOnCVSS;
     231   -
          *
    +
         }
     232   -
          * @param failBuildOnCVSS new value of failBuildOnCVSS
    +
     
     233   -
          */
    +
         /**
     234   -
         public void setFailBuildOnCVSS(float failBuildOnCVSS) {
    +
          * Set the value of failBuildOnCVSS.
     235   -
             this.failBuildOnCVSS = failBuildOnCVSS;
    +
          *
     236   -
         }
    +
          * @param failBuildOnCVSS new value of failBuildOnCVSS
     237   -
         /**
    +
          */
     238   -
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
    +
         public void setFailBuildOnCVSS(float failBuildOnCVSS) {
     239   -
          * false. Default is true.
    +
             this.failBuildOnCVSS = failBuildOnCVSS;
     240   -
          */
    -  241  0
         private boolean autoUpdate = true;
    +
         }
    +  241   +
         /**
     242   -
     
    +
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
     243   -
         /**
    +
          * false. Default is true.
     244   -
          * Get the value of autoUpdate.
    -  245   -
          *
    +
          */
    +  245  4
         private boolean autoUpdate = true;
     246   -
          * @return the value of autoUpdate
    +
     
     247   -
          */
    +
         /**
     248   -
         public boolean isAutoUpdate() {
    +
          * Get the value of autoUpdate.
     249   -
             return autoUpdate;
    +
          *
     250   -
         }
    +
          * @return the value of autoUpdate
     251   -
     
    +
          */
     252   -
         /**
    +
         public boolean isAutoUpdate() {
     253   -
          * Set the value of autoUpdate.
    +
             return autoUpdate;
     254   -
          *
    +
         }
     255   -
          * @param autoUpdate new value of autoUpdate
    +
     
     256   -
          */
    +
         /**
     257   -
         public void setAutoUpdate(boolean autoUpdate) {
    +
          * Set the value of autoUpdate.
     258   -
             this.autoUpdate = autoUpdate;
    +
          *
     259   -
         }
    +
          * @param autoUpdate new value of autoUpdate
     260   -
         /**
    +
          */
     261   -
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
    +
         public void setAutoUpdate(boolean autoUpdate) {
     262   -
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
    +
             this.autoUpdate = autoUpdate;
     263   -
          */
    -  264  0
         private String reportFormat = "HTML";
    +
         }
    +  264   +
         /**
     265   -
     
    +
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
     266   -
         /**
    +
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
     267   -
          * Get the value of reportFormat.
    -  268   -
          *
    +
          */
    +  268  4
         private String reportFormat = "HTML";
     269   -
          * @return the value of reportFormat
    +
     
     270   -
          */
    +
         /**
     271   -
         public String getReportFormat() {
    +
          * Get the value of reportFormat.
     272   -
             return reportFormat;
    +
          *
     273   -
         }
    +
          * @return the value of reportFormat
     274   -
     
    +
          */
     275   -
         /**
    +
         public String getReportFormat() {
     276   -
          * Set the value of reportFormat.
    +
             return reportFormat;
     277   -
          *
    +
         }
     278   -
          * @param reportFormat new value of reportFormat
    +
     
     279   -
          */
    +
         /**
     280   -
         public void setReportFormat(ReportFormats reportFormat) {
    -  281  0
             this.reportFormat = reportFormat.getValue();
    -  282  0
         }
    +
          * Set the value of reportFormat.
    +  281   +
          *
    +  282   +
          * @param reportFormat new value of reportFormat
     283   -
         /**
    +
          */
     284   -
          * The Proxy URL.
    -  285   -
          */
    -  286   -
         private String proxyUrl;
    +
         public void setReportFormat(ReportFormats reportFormat) {
    +  285  4
             this.reportFormat = reportFormat.getValue();
    +  286  4
         }
     287   -
     
    +
         /**
     288   -
         /**
    +
          * The Proxy URL.
     289   -
          * Get the value of proxyUrl.
    +
          */
     290   -
          *
    +
         private String proxyUrl;
     291   -
          * @return the value of proxyUrl
    +
     
     292   -
          */
    +
         /**
     293   -
         public String getProxyUrl() {
    +
          * Get the value of proxyUrl.
     294   -
             return proxyUrl;
    +
          *
     295   -
         }
    +
          * @return the value of proxyUrl
     296   -
     
    +
          */
     297   -
         /**
    +
         public String getProxyUrl() {
     298   -
          * Set the value of proxyUrl.
    +
             return proxyUrl;
     299   -
          *
    +
         }
     300   -
          * @param proxyUrl new value of proxyUrl
    +
     
     301   -
          */
    +
         /**
     302   -
         public void setProxyUrl(String proxyUrl) {
    +
          * Set the value of proxyUrl.
     303   -
             this.proxyUrl = proxyUrl;
    +
          *
     304   -
         }
    +
          * @param proxyUrl new value of proxyUrl
     305   -
         /**
    +
          */
     306   -
          * The Proxy Port.
    +
         public void setProxyUrl(String proxyUrl) {
     307   -
          */
    +
             this.proxyUrl = proxyUrl;
     308   -
         private String proxyPort;
    +
         }
     309   -
     
    +
         /**
     310   -
         /**
    +
          * The Proxy Port.
     311   -
          * Get the value of proxyPort.
    +
          */
     312   -
          *
    +
         private String proxyPort;
     313   -
          * @return the value of proxyPort
    +
     
     314   -
          */
    +
         /**
     315   -
         public String getProxyPort() {
    +
          * Get the value of proxyPort.
     316   -
             return proxyPort;
    +
          *
     317   -
         }
    +
          * @return the value of proxyPort
     318   -
     
    +
          */
     319   -
         /**
    +
         public String getProxyPort() {
     320   -
          * Set the value of proxyPort.
    +
             return proxyPort;
     321   -
          *
    +
         }
     322   -
          * @param proxyPort new value of proxyPort
    +
     
     323   -
          */
    +
         /**
     324   -
         public void setProxyPort(String proxyPort) {
    +
          * Set the value of proxyPort.
     325   -
             this.proxyPort = proxyPort;
    +
          *
     326   -
         }
    +
          * @param proxyPort new value of proxyPort
     327   -
         /**
    +
          */
     328   -
          * The Proxy username.
    +
         public void setProxyPort(String proxyPort) {
     329   -
          */
    +
             this.proxyPort = proxyPort;
     330   -
         private String proxyUsername;
    +
         }
     331   -
     
    +
         /**
     332   -
         /**
    +
          * The Proxy username.
     333   -
          * Get the value of proxyUsername.
    +
          */
     334   -
          *
    +
         private String proxyUsername;
     335   -
          * @return the value of proxyUsername
    +
     
     336   -
          */
    +
         /**
     337   -
         public String getProxyUsername() {
    +
          * Get the value of proxyUsername.
     338   -
             return proxyUsername;
    +
          *
     339   -
         }
    +
          * @return the value of proxyUsername
     340   -
     
    +
          */
     341   -
         /**
    +
         public String getProxyUsername() {
     342   -
          * Set the value of proxyUsername.
    +
             return proxyUsername;
     343   -
          *
    +
         }
     344   -
          * @param proxyUsername new value of proxyUsername
    +
     
     345   -
          */
    +
         /**
     346   -
         public void setProxyUsername(String proxyUsername) {
    +
          * Set the value of proxyUsername.
     347   -
             this.proxyUsername = proxyUsername;
    +
          *
     348   -
         }
    +
          * @param proxyUsername new value of proxyUsername
     349   -
         /**
    +
          */
     350   -
          * The Proxy password.
    +
         public void setProxyUsername(String proxyUsername) {
     351   -
          */
    +
             this.proxyUsername = proxyUsername;
     352   -
         private String proxyPassword;
    +
         }
     353   -
     
    +
         /**
     354   -
         /**
    +
          * The Proxy password.
     355   -
          * Get the value of proxyPassword.
    +
          */
     356   -
          *
    +
         private String proxyPassword;
     357   -
          * @return the value of proxyPassword
    +
     
     358   -
          */
    +
         /**
     359   -
         public String getProxyPassword() {
    +
          * Get the value of proxyPassword.
     360   -
             return proxyPassword;
    +
          *
     361   -
         }
    +
          * @return the value of proxyPassword
     362   -
     
    +
          */
     363   -
         /**
    +
         public String getProxyPassword() {
     364   -
          * Set the value of proxyPassword.
    +
             return proxyPassword;
     365   -
          *
    +
         }
     366   -
          * @param proxyPassword new value of proxyPassword
    +
     
     367   -
          */
    +
         /**
     368   -
         public void setProxyPassword(String proxyPassword) {
    +
          * Set the value of proxyPassword.
     369   -
             this.proxyPassword = proxyPassword;
    +
          *
     370   -
         }
    +
          * @param proxyPassword new value of proxyPassword
     371   -
         /**
    +
          */
     372   -
          * The Connection Timeout.
    +
         public void setProxyPassword(String proxyPassword) {
     373   -
          */
    +
             this.proxyPassword = proxyPassword;
     374   -
         private String connectionTimeout;
    +
         }
     375   -
     
    +
         /**
     376   -
         /**
    +
          * The Connection Timeout.
     377   -
          * Get the value of connectionTimeout.
    +
          */
     378   -
          *
    +
         private String connectionTimeout;
     379   -
          * @return the value of connectionTimeout
    +
     
     380   -
          */
    +
         /**
     381   -
         public String getConnectionTimeout() {
    +
          * Get the value of connectionTimeout.
     382   -
             return connectionTimeout;
    +
          *
     383   -
         }
    +
          * @return the value of connectionTimeout
     384   -
     
    +
          */
     385   -
         /**
    +
         public String getConnectionTimeout() {
     386   -
          * Set the value of connectionTimeout.
    +
             return connectionTimeout;
     387   -
          *
    +
         }
     388   -
          * @param connectionTimeout new value of connectionTimeout
    +
     
     389   -
          */
    +
         /**
     390   -
         public void setConnectionTimeout(String connectionTimeout) {
    +
          * Set the value of connectionTimeout.
     391   -
             this.connectionTimeout = connectionTimeout;
    +
          *
     392   -
         }
    +
          * @param connectionTimeout new value of connectionTimeout
     393   -
         /**
    +
          */
     394   -
          * The file path used for verbose logging.
    +
         public void setConnectionTimeout(String connectionTimeout) {
     395   -
          */
    -  396  0
         private String logFile = null;
    +
             this.connectionTimeout = connectionTimeout;
    +  396   +
         }
     397   -
     
    +
         /**
     398   -
         /**
    +
          * The file path used for verbose logging.
     399   -
          * Get the value of logFile.
    -  400   -
          *
    +
          */
    +  400  4
         private String logFile = null;
     401   -
          * @return the value of logFile
    +
     
     402   -
          */
    +
         /**
     403   -
         public String getLogFile() {
    +
          * Get the value of logFile.
     404   -
             return logFile;
    +
          *
     405   -
         }
    +
          * @return the value of logFile
     406   -
     
    +
          */
     407   -
         /**
    +
         public String getLogFile() {
     408   -
          * Set the value of logFile.
    +
             return logFile;
     409   -
          *
    +
         }
     410   -
          * @param logFile new value of logFile
    +
     
     411   -
          */
    +
         /**
     412   -
         public void setLogFile(String logFile) {
    +
          * Set the value of logFile.
     413   -
             this.logFile = logFile;
    +
          *
     414   -
         }
    +
          * @param logFile new value of logFile
     415   -
         /**
    +
          */
     416   -
          * The path to the suppression file.
    +
         public void setLogFile(String logFile) {
     417   -
          */
    +
             this.logFile = logFile;
     418   -
         private String suppressionFile;
    +
         }
     419   -
     
    +
         /**
     420   -
         /**
    +
          * The path to the suppression file.
     421   -
          * Get the value of suppressionFile.
    +
          */
     422   -
          *
    +
         private String suppressionFile;
     423   -
          * @return the value of suppressionFile
    +
     
     424   -
          */
    +
         /**
     425   -
         public String getSuppressionFile() {
    +
          * Get the value of suppressionFile.
     426   -
             return suppressionFile;
    +
          *
     427   -
         }
    +
          * @return the value of suppressionFile
     428   -
     
    +
          */
     429   -
         /**
    +
         public String getSuppressionFile() {
     430   -
          * Set the value of suppressionFile.
    +
             return suppressionFile;
     431   -
          *
    +
         }
     432   -
          * @param suppressionFile new value of suppressionFile
    +
     
     433   -
          */
    +
         /**
     434   -
         public void setSuppressionFile(String suppressionFile) {
    +
          * Set the value of suppressionFile.
     435   -
             this.suppressionFile = suppressionFile;
    +
          *
     436   -
         }
    +
          * @param suppressionFile new value of suppressionFile
     437   -
         /**
    +
          */
     438   -
          * flag indicating whether or not to show a summary of findings.
    +
         public void setSuppressionFile(String suppressionFile) {
     439   -
          */
    -  440  0
         private boolean showSummary = true;
    +
             this.suppressionFile = suppressionFile;
    +  440   +
         }
     441   -
     
    +
         /**
     442   -
         /**
    +
          * flag indicating whether or not to show a summary of findings.
     443   -
          * Get the value of showSummary.
    -  444   -
          *
    +
          */
    +  444  4
         private boolean showSummary = true;
     445   -
          * @return the value of showSummary
    +
     
     446   -
          */
    +
         /**
     447   -
         public boolean isShowSummary() {
    +
          * Get the value of showSummary.
     448   -
             return showSummary;
    +
          *
     449   -
         }
    +
          * @return the value of showSummary
     450   -
     
    +
          */
     451   -
         /**
    +
         public boolean isShowSummary() {
     452   -
          * Set the value of showSummary.
    +
             return showSummary;
     453   -
          *
    +
         }
     454   -
          * @param showSummary new value of showSummary
    +
     
     455   -
          */
    +
         /**
     456   -
         public void setShowSummary(boolean showSummary) {
    +
          * Set the value of showSummary.
     457   -
             this.showSummary = showSummary;
    +
          *
     458   -
         }
    +
          * @param showSummary new value of showSummary
     459   -
     
    +
          */
     460   -
         /**
    +
         public void setShowSummary(boolean showSummary) {
     461   -
          * Sets whether or not the analyzer is enabled.
    +
             this.showSummary = showSummary;
     462   -
          *
    +
         }
     463   -
          * @param jarAnalyzerEnabled the value of the new setting
    +
     
     464   -
          */
    +
         /**
     465   -
         public void setJarAnalyzerEnabled(boolean jarAnalyzerEnabled) {
    +
          * Sets whether or not the analyzer is enabled.
     466   -
             this.jarAnalyzerEnabled = jarAnalyzerEnabled;
    +
          *
     467   -
         }
    +
          * @param jarAnalyzerEnabled the value of the new setting
     468   -
         /**
    +
          */
     469   -
          * Whether or not the Archive Analyzer is enabled.
    +
         public void setJarAnalyzerEnabled(boolean jarAnalyzerEnabled) {
     470   -
          */
    -  471  0
         private boolean archiveAnalyzerEnabled = true;
    +
             this.jarAnalyzerEnabled = jarAnalyzerEnabled;
    +  471   +
         }
     472   -
     
    +
         /**
     473   -
         /**
    +
          * Whether or not the Archive Analyzer is enabled.
     474   -
          * Returns whether or not the analyzer is enabled.
    -  475   -
          *
    +
          */
    +  475  4
         private boolean archiveAnalyzerEnabled = true;
     476   -
          * @return true if the analyzer is enabled
    +
     
     477   -
          */
    +
         /**
     478   -
         public boolean isArchiveAnalyzerEnabled() {
    +
          * Returns whether or not the analyzer is enabled.
     479   -
             return archiveAnalyzerEnabled;
    +
          *
     480   -
         }
    +
          * @return true if the analyzer is enabled
     481   -
         /**
    +
          */
     482   -
          * Whether or not the .NET Assembly Analyzer is enabled.
    +
         public boolean isArchiveAnalyzerEnabled() {
     483   -
          */
    -  484  0
         private boolean assemblyAnalyzerEnabled = true;
    +
             return archiveAnalyzerEnabled;
    +  484   +
         }
     485   -
     
    +
         /**
     486   -
         /**
    +
          * Whether or not the .NET Assembly Analyzer is enabled.
     487   -
          * Sets whether or not the analyzer is enabled.
    -  488   -
          *
    +
          */
    +  488  4
         private boolean assemblyAnalyzerEnabled = true;
     489   -
          * @param archiveAnalyzerEnabled the value of the new setting
    +
     
     490   -
          */
    +
         /**
     491   -
         public void setArchiveAnalyzerEnabled(boolean archiveAnalyzerEnabled) {
    +
          * Sets whether or not the analyzer is enabled.
     492   -
             this.archiveAnalyzerEnabled = archiveAnalyzerEnabled;
    +
          *
     493   -
         }
    +
          * @param archiveAnalyzerEnabled the value of the new setting
     494   -
     
    +
          */
     495   -
         /**
    +
         public void setArchiveAnalyzerEnabled(boolean archiveAnalyzerEnabled) {
     496   -
          * Returns whether or not the analyzer is enabled.
    +
             this.archiveAnalyzerEnabled = archiveAnalyzerEnabled;
     497   -
          *
    +
         }
     498   -
          * @return true if the analyzer is enabled
    +
     
     499   -
          */
    +
         /**
     500   -
         public boolean isAssemblyAnalyzerEnabled() {
    -  501   -
             return assemblyAnalyzerEnabled;
    -  502   -
         }
    -  503   -
     
    -  504   -
         /**
    -  505   -
          * Sets whether or not the analyzer is enabled.
    -  506   -
          *
    -  507   -
          * @param assemblyAnalyzerEnabled the value of the new setting
    -  508   -
          */
    -  509   -
         public void setAssemblyAnalyzerEnabled(boolean assemblyAnalyzerEnabled) {
    -  510   -
             this.assemblyAnalyzerEnabled = assemblyAnalyzerEnabled;
    -  511   -
         }
    -  512   -
         /**
    -  513   -
          * Whether or not the .NET Nuspec Analyzer is enabled.
    -  514   -
          */
    -  515  0
         private boolean nuspecAnalyzerEnabled = true;
    -  516   -
     
    -  517   -
         /**
    -  518  
          * Returns whether or not the analyzer is enabled.
    -  519   +  501  
          *
    -  520   +  502  
          * @return true if the analyzer is enabled
    -  521   +  503  
          */
    -  522   -
         public boolean isNuspecAnalyzerEnabled() {
    -  523   -
             return nuspecAnalyzerEnabled;
    -  524   +  504   +
         public boolean isAssemblyAnalyzerEnabled() {
    +  505   +
             return assemblyAnalyzerEnabled;
    +  506  
         }
    -  525   +  507  
     
    -  526   +  508  
         /**
    -  527   +  509  
          * Sets whether or not the analyzer is enabled.
    +  510   +
          *
    +  511   +
          * @param assemblyAnalyzerEnabled the value of the new setting
    +  512   +
          */
    +  513   +
         public void setAssemblyAnalyzerEnabled(boolean assemblyAnalyzerEnabled) {
    +  514   +
             this.assemblyAnalyzerEnabled = assemblyAnalyzerEnabled;
    +  515   +
         }
    +  516   +
         /**
    +  517   +
          * Whether or not the .NET Nuspec Analyzer is enabled.
    +  518   +
          */
    +  519  4
         private boolean nuspecAnalyzerEnabled = true;
    +  520   +
     
    +  521   +
         /**
    +  522   +
          * Returns whether or not the analyzer is enabled.
    +  523   +
          *
    +  524   +
          * @return true if the analyzer is enabled
    +  525   +
          */
    +  526   +
         public boolean isNuspecAnalyzerEnabled() {
    +  527   +
             return nuspecAnalyzerEnabled;
     528   -
          *
    +
         }
     529   -
          * @param nuspecAnalyzerEnabled the value of the new setting
    +
     
     530   -
          */
    +
         /**
     531   -
         public void setNuspecAnalyzerEnabled(boolean nuspecAnalyzerEnabled) {
    +
          * Sets whether or not the analyzer is enabled.
     532   -
             this.nuspecAnalyzerEnabled = nuspecAnalyzerEnabled;
    +
          *
     533   -
         }
    +
          * @param nuspecAnalyzerEnabled the value of the new setting
     534   -
     
    +
          */
     535   -
         /**
    +
         public void setNuspecAnalyzerEnabled(boolean nuspecAnalyzerEnabled) {
     536   -
          * Whether or not the nexus analyzer is enabled.
    +
             this.nuspecAnalyzerEnabled = nuspecAnalyzerEnabled;
     537   -
          */
    -  538  0
         private boolean nexusAnalyzerEnabled = true;
    +
         }
    +  538   +
     
     539   -
     
    +
         /**
     540   -
         /**
    +
          * Whether or not the nexus analyzer is enabled.
     541   -
          * Get the value of nexusAnalyzerEnabled.
    -  542   -
          *
    +
          */
    +  542  4
         private boolean nexusAnalyzerEnabled = true;
     543   -
          * @return the value of nexusAnalyzerEnabled
    +
     
     544   -
          */
    +
         /**
     545   -
         public boolean isNexusAnalyzerEnabled() {
    +
          * Get the value of nexusAnalyzerEnabled.
     546   -
             return nexusAnalyzerEnabled;
    +
          *
     547   -
         }
    +
          * @return the value of nexusAnalyzerEnabled
     548   -
     
    +
          */
     549   -
         /**
    +
         public boolean isNexusAnalyzerEnabled() {
     550   -
          * Set the value of nexusAnalyzerEnabled.
    +
             return nexusAnalyzerEnabled;
     551   -
          *
    +
         }
     552   -
          * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled
    +
     
     553   -
          */
    +
         /**
     554   -
         public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
    +
          * Set the value of nexusAnalyzerEnabled.
     555   -
             this.nexusAnalyzerEnabled = nexusAnalyzerEnabled;
    +
          *
     556   -
         }
    +
          * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled
     557   -
     
    +
          */
     558   -
         /**
    +
         public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
     559   -
          * The URL of the Nexus server.
    +
             this.nexusAnalyzerEnabled = nexusAnalyzerEnabled;
     560   -
          */
    +
         }
     561   -
         private String nexusUrl;
    +
     
     562   -
     
    +
         /**
     563   -
         /**
    +
          * The URL of the Nexus server.
     564   -
          * Get the value of nexusUrl.
    +
          */
     565   -
          *
    +
         private String nexusUrl;
     566   -
          * @return the value of nexusUrl
    +
     
     567   -
          */
    +
         /**
     568   -
         public String getNexusUrl() {
    +
          * Get the value of nexusUrl.
     569   -
             return nexusUrl;
    +
          *
     570   -
         }
    +
          * @return the value of nexusUrl
     571   -
     
    +
          */
     572   -
         /**
    +
         public String getNexusUrl() {
     573   -
          * Set the value of nexusUrl.
    +
             return nexusUrl;
     574   -
          *
    +
         }
     575   -
          * @param nexusUrl new value of nexusUrl
    +
     
     576   -
          */
    +
         /**
     577   -
         public void setNexusUrl(String nexusUrl) {
    +
          * Set the value of nexusUrl.
     578   -
             this.nexusUrl = nexusUrl;
    +
          *
     579   -
         }
    +
          * @param nexusUrl new value of nexusUrl
     580   -
         /**
    +
          */
     581   -
          * Whether or not the defined proxy should be used when connecting to Nexus.
    +
         public void setNexusUrl(String nexusUrl) {
     582   -
          */
    -  583  0
         private boolean nexusUsesProxy = true;
    +
             this.nexusUrl = nexusUrl;
    +  583   +
         }
     584   -
     
    +
         /**
     585   -
         /**
    +
          * Whether or not the defined proxy should be used when connecting to Nexus.
     586   -
          * Get the value of nexusUsesProxy.
    -  587   -
          *
    +
          */
    +  587  4
         private boolean nexusUsesProxy = true;
     588   -
          * @return the value of nexusUsesProxy
    +
     
     589   -
          */
    +
         /**
     590   -
         public boolean isNexusUsesProxy() {
    +
          * Get the value of nexusUsesProxy.
     591   -
             return nexusUsesProxy;
    +
          *
     592   -
         }
    +
          * @return the value of nexusUsesProxy
     593   -
     
    +
          */
     594   -
         /**
    +
         public boolean isNexusUsesProxy() {
     595   -
          * Set the value of nexusUsesProxy.
    +
             return nexusUsesProxy;
     596   -
          *
    +
         }
     597   -
          * @param nexusUsesProxy new value of nexusUsesProxy
    +
     
     598   -
          */
    +
         /**
     599   -
         public void setNexusUsesProxy(boolean nexusUsesProxy) {
    +
          * Set the value of nexusUsesProxy.
     600   -
             this.nexusUsesProxy = nexusUsesProxy;
    +
          *
     601   -
         }
    +
          * @param nexusUsesProxy new value of nexusUsesProxy
     602   -
     
    +
          */
     603   -
         /**
    +
         public void setNexusUsesProxy(boolean nexusUsesProxy) {
     604   -
          * The database driver name; such as org.h2.Driver.
    +
             this.nexusUsesProxy = nexusUsesProxy;
     605   -
          */
    +
         }
     606   -
         private String databaseDriverName;
    +
     
     607   -
     
    +
         /**
     608   -
         /**
    +
          * The database driver name; such as org.h2.Driver.
     609   -
          * Get the value of databaseDriverName.
    +
          */
     610   -
          *
    +
         private String databaseDriverName;
     611   -
          * @return the value of databaseDriverName
    +
     
     612   -
          */
    +
         /**
     613   -
         public String getDatabaseDriverName() {
    +
          * Get the value of databaseDriverName.
     614   -
             return databaseDriverName;
    +
          *
     615   -
         }
    +
          * @return the value of databaseDriverName
     616   -
     
    +
          */
     617   -
         /**
    +
         public String getDatabaseDriverName() {
     618   -
          * Set the value of databaseDriverName.
    +
             return databaseDriverName;
     619   -
          *
    +
         }
     620   -
          * @param databaseDriverName new value of databaseDriverName
    +
     
     621   -
          */
    +
         /**
     622   -
         public void setDatabaseDriverName(String databaseDriverName) {
    +
          * Set the value of databaseDriverName.
     623   -
             this.databaseDriverName = databaseDriverName;
    +
          *
     624   -
         }
    +
          * @param databaseDriverName new value of databaseDriverName
     625   -
     
    +
          */
     626   -
         /**
    +
         public void setDatabaseDriverName(String databaseDriverName) {
     627   -
          * The path to the database driver JAR file if it is not on the class path.
    +
             this.databaseDriverName = databaseDriverName;
     628   -
          */
    +
         }
     629   -
         private String databaseDriverPath;
    +
     
     630   -
     
    +
         /**
     631   -
         /**
    +
          * The path to the database driver JAR file if it is not on the class path.
     632   -
          * Get the value of databaseDriverPath.
    +
          */
     633   -
          *
    +
         private String databaseDriverPath;
     634   -
          * @return the value of databaseDriverPath
    +
     
     635   -
          */
    +
         /**
     636   -
         public String getDatabaseDriverPath() {
    +
          * Get the value of databaseDriverPath.
     637   -
             return databaseDriverPath;
    +
          *
     638   -
         }
    +
          * @return the value of databaseDriverPath
     639   -
     
    +
          */
     640   -
         /**
    +
         public String getDatabaseDriverPath() {
     641   -
          * Set the value of databaseDriverPath.
    +
             return databaseDriverPath;
     642   -
          *
    +
         }
     643   -
          * @param databaseDriverPath new value of databaseDriverPath
    +
     
     644   -
          */
    +
         /**
     645   -
         public void setDatabaseDriverPath(String databaseDriverPath) {
    +
          * Set the value of databaseDriverPath.
     646   -
             this.databaseDriverPath = databaseDriverPath;
    +
          *
     647   -
         }
    +
          * @param databaseDriverPath new value of databaseDriverPath
     648   -
         /**
    +
          */
     649   -
          * The database connection string.
    +
         public void setDatabaseDriverPath(String databaseDriverPath) {
     650   -
          */
    +
             this.databaseDriverPath = databaseDriverPath;
     651   -
         private String connectionString;
    +
         }
     652   -
     
    +
         /**
     653   -
         /**
    +
          * The database connection string.
     654   -
          * Get the value of connectionString.
    +
          */
     655   -
          *
    +
         private String connectionString;
     656   -
          * @return the value of connectionString
    +
     
     657   -
          */
    +
         /**
     658   -
         public String getConnectionString() {
    +
          * Get the value of connectionString.
     659   -
             return connectionString;
    +
          *
     660   -
         }
    +
          * @return the value of connectionString
     661   -
     
    +
          */
     662   -
         /**
    +
         public String getConnectionString() {
     663   -
          * Set the value of connectionString.
    +
             return connectionString;
     664   -
          *
    +
         }
     665   -
          * @param connectionString new value of connectionString
    +
     
     666   -
          */
    +
         /**
     667   -
         public void setConnectionString(String connectionString) {
    +
          * Set the value of connectionString.
     668   -
             this.connectionString = connectionString;
    +
          *
     669   -
         }
    +
          * @param connectionString new value of connectionString
     670   -
         /**
    +
          */
     671   -
          * The user name for connecting to the database.
    +
         public void setConnectionString(String connectionString) {
     672   -
          */
    +
             this.connectionString = connectionString;
     673   -
         private String databaseUser;
    +
         }
     674   -
     
    +
         /**
     675   -
         /**
    +
          * The user name for connecting to the database.
     676   -
          * Get the value of databaseUser.
    +
          */
     677   -
          *
    +
         private String databaseUser;
     678   -
          * @return the value of databaseUser
    +
     
     679   -
          */
    +
         /**
     680   -
         public String getDatabaseUser() {
    +
          * Get the value of databaseUser.
     681   -
             return databaseUser;
    +
          *
     682   -
         }
    +
          * @return the value of databaseUser
     683   -
     
    +
          */
     684   -
         /**
    +
         public String getDatabaseUser() {
     685   -
          * Set the value of databaseUser.
    +
             return databaseUser;
     686   -
          *
    +
         }
     687   -
          * @param databaseUser new value of databaseUser
    +
     
     688   -
          */
    +
         /**
     689   -
         public void setDatabaseUser(String databaseUser) {
    +
          * Set the value of databaseUser.
     690   -
             this.databaseUser = databaseUser;
    +
          *
     691   -
         }
    +
          * @param databaseUser new value of databaseUser
     692   -
     
    +
          */
     693   -
         /**
    +
         public void setDatabaseUser(String databaseUser) {
     694   -
          * The password to use when connecting to the database.
    +
             this.databaseUser = databaseUser;
     695   -
          */
    +
         }
     696   -
         private String databasePassword;
    +
     
     697   -
     
    +
         /**
     698   -
         /**
    +
          * The password to use when connecting to the database.
     699   -
          * Get the value of databasePassword.
    +
          */
     700   -
          *
    +
         private String databasePassword;
     701   -
          * @return the value of databasePassword
    +
     
     702   -
          */
    +
         /**
     703   -
         public String getDatabasePassword() {
    +
          * Get the value of databasePassword.
     704   -
             return databasePassword;
    +
          *
     705   -
         }
    +
          * @return the value of databasePassword
     706   -
     
    +
          */
     707   -
         /**
    +
         public String getDatabasePassword() {
     708   -
          * Set the value of databasePassword.
    +
             return databasePassword;
     709   -
          *
    +
         }
     710   -
          * @param databasePassword new value of databasePassword
    +
     
     711   -
          */
    +
         /**
     712   -
         public void setDatabasePassword(String databasePassword) {
    +
          * Set the value of databasePassword.
     713   -
             this.databasePassword = databasePassword;
    +
          *
     714   -
         }
    +
          * @param databasePassword new value of databasePassword
     715   -
     
    +
          */
     716   -
         /**
    +
         public void setDatabasePassword(String databasePassword) {
     717   -
          * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat
    +
             this.databasePassword = databasePassword;
     718   -
          * like ZIP files.
    +
         }
     719   -
          */
    +
     
     720   -
         private String zipExtensions;
    +
         /**
     721   -
     
    +
          * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat
     722   -
         /**
    +
          * like ZIP files.
     723   -
          * Get the value of zipExtensions.
    +
          */
     724   -
          *
    +
         private String zipExtensions;
     725   -
          * @return the value of zipExtensions
    +
     
     726   -
          */
    +
         /**
     727   -
         public String getZipExtensions() {
    +
          * Get the value of zipExtensions.
     728   -
             return zipExtensions;
    +
          *
     729   -
         }
    +
          * @return the value of zipExtensions
     730   -
     
    +
          */
     731   -
         /**
    +
         public String getZipExtensions() {
     732   -
          * Set the value of zipExtensions.
    +
             return zipExtensions;
     733   -
          *
    +
         }
     734   -
          * @param zipExtensions new value of zipExtensions
    +
     
     735   -
          */
    +
         /**
     736   -
         public void setZipExtensions(String zipExtensions) {
    +
          * Set the value of zipExtensions.
     737   -
             this.zipExtensions = zipExtensions;
    +
          *
     738   -
         }
    +
          * @param zipExtensions new value of zipExtensions
     739   -
     
    +
          */
     740   -
         /**
    +
         public void setZipExtensions(String zipExtensions) {
     741   -
          * The url for the modified NVD CVE (1.2 schema).
    +
             this.zipExtensions = zipExtensions;
     742   -
          */
    +
         }
     743   -
         private String cveUrl12Modified;
    +
     
     744   -
     
    +
         /**
     745   -
         /**
    +
          * The url for the modified NVD CVE (1.2 schema).
     746   -
          * Get the value of cveUrl12Modified.
    +
          */
     747   -
          *
    +
         private String cveUrl12Modified;
     748   -
          * @return the value of cveUrl12Modified
    +
     
     749   -
          */
    +
         /**
     750   -
         public String getCveUrl12Modified() {
    +
          * Get the value of cveUrl12Modified.
     751   -
             return cveUrl12Modified;
    +
          *
     752   -
         }
    +
          * @return the value of cveUrl12Modified
     753   -
     
    +
          */
     754   -
         /**
    +
         public String getCveUrl12Modified() {
     755   -
          * Set the value of cveUrl12Modified.
    +
             return cveUrl12Modified;
     756   -
          *
    +
         }
     757   -
          * @param cveUrl12Modified new value of cveUrl12Modified
    +
     
     758   -
          */
    +
         /**
     759   -
         public void setCveUrl12Modified(String cveUrl12Modified) {
    +
          * Set the value of cveUrl12Modified.
     760   -
             this.cveUrl12Modified = cveUrl12Modified;
    +
          *
     761   -
         }
    +
          * @param cveUrl12Modified new value of cveUrl12Modified
     762   -
     
    +
          */
     763   -
         /**
    +
         public void setCveUrl12Modified(String cveUrl12Modified) {
     764   -
          * The url for the modified NVD CVE (2.0 schema).
    +
             this.cveUrl12Modified = cveUrl12Modified;
     765   -
          */
    +
         }
     766   -
         private String cveUrl20Modified;
    +
     
     767   -
     
    +
         /**
     768   -
         /**
    +
          * The url for the modified NVD CVE (2.0 schema).
     769   -
          * Get the value of cveUrl20Modified.
    +
          */
     770   -
          *
    +
         private String cveUrl20Modified;
     771   -
          * @return the value of cveUrl20Modified
    +
     
     772   -
          */
    +
         /**
     773   -
         public String getCveUrl20Modified() {
    +
          * Get the value of cveUrl20Modified.
     774   -
             return cveUrl20Modified;
    +
          *
     775   -
         }
    +
          * @return the value of cveUrl20Modified
     776   -
     
    +
          */
     777   -
         /**
    +
         public String getCveUrl20Modified() {
     778   -
          * Set the value of cveUrl20Modified.
    +
             return cveUrl20Modified;
     779   -
          *
    +
         }
     780   -
          * @param cveUrl20Modified new value of cveUrl20Modified
    +
     
     781   -
          */
    +
         /**
     782   -
         public void setCveUrl20Modified(String cveUrl20Modified) {
    +
          * Set the value of cveUrl20Modified.
     783   -
             this.cveUrl20Modified = cveUrl20Modified;
    +
          *
     784   -
         }
    +
          * @param cveUrl20Modified new value of cveUrl20Modified
     785   -
     
    +
          */
     786   -
         /**
    +
         public void setCveUrl20Modified(String cveUrl20Modified) {
     787   -
          * Base Data Mirror URL for CVE 1.2.
    +
             this.cveUrl20Modified = cveUrl20Modified;
     788   -
          */
    +
         }
     789   -
         private String cveUrl12Base;
    +
     
     790   -
     
    +
         /**
     791   -
         /**
    +
          * Base Data Mirror URL for CVE 1.2.
     792   -
          * Get the value of cveUrl12Base.
    +
          */
     793   -
          *
    +
         private String cveUrl12Base;
     794   -
          * @return the value of cveUrl12Base
    +
     
     795   -
          */
    +
         /**
     796   -
         public String getCveUrl12Base() {
    +
          * Get the value of cveUrl12Base.
     797   -
             return cveUrl12Base;
    +
          *
     798   -
         }
    +
          * @return the value of cveUrl12Base
     799   -
     
    +
          */
     800   -
         /**
    +
         public String getCveUrl12Base() {
     801   -
          * Set the value of cveUrl12Base.
    +
             return cveUrl12Base;
     802   -
          *
    +
         }
     803   -
          * @param cveUrl12Base new value of cveUrl12Base
    +
     
     804   -
          */
    +
         /**
     805   -
         public void setCveUrl12Base(String cveUrl12Base) {
    +
          * Set the value of cveUrl12Base.
     806   -
             this.cveUrl12Base = cveUrl12Base;
    +
          *
     807   -
         }
    +
          * @param cveUrl12Base new value of cveUrl12Base
     808   -
     
    +
          */
     809   -
         /**
    +
         public void setCveUrl12Base(String cveUrl12Base) {
     810   -
          * Data Mirror URL for CVE 2.0.
    +
             this.cveUrl12Base = cveUrl12Base;
     811   -
          */
    +
         }
     812   -
         private String cveUrl20Base;
    +
     
     813   -
     
    +
         /**
     814   -
         /**
    +
          * Data Mirror URL for CVE 2.0.
     815   -
          * Get the value of cveUrl20Base.
    +
          */
     816   -
          *
    +
         private String cveUrl20Base;
     817   -
          * @return the value of cveUrl20Base
    +
     
     818   -
          */
    +
         /**
     819   -
         public String getCveUrl20Base() {
    +
          * Get the value of cveUrl20Base.
     820   -
             return cveUrl20Base;
    +
          *
     821   -
         }
    +
          * @return the value of cveUrl20Base
     822   -
     
    +
          */
     823   -
         /**
    +
         public String getCveUrl20Base() {
     824   -
          * Set the value of cveUrl20Base.
    +
             return cveUrl20Base;
     825   -
          *
    +
         }
     826   -
          * @param cveUrl20Base new value of cveUrl20Base
    +
     
     827   -
          */
    +
         /**
     828   -
         public void setCveUrl20Base(String cveUrl20Base) {
    +
          * Set the value of cveUrl20Base.
     829   -
             this.cveUrl20Base = cveUrl20Base;
    +
          *
     830   -
         }
    +
          * @param cveUrl20Base new value of cveUrl20Base
     831   -
         /**
    +
          */
     832   -
          * The path to Mono for .NET assembly analysis on non-windows systems.
    +
         public void setCveUrl20Base(String cveUrl20Base) {
     833   -
          */
    +
             this.cveUrl20Base = cveUrl20Base;
     834   -
         private String pathToMono;
    +
         }
     835   -
     
    +
         /**
     836   -
         /**
    +
          * The path to Mono for .NET assembly analysis on non-windows systems.
     837   -
          * Get the value of pathToMono.
    +
          */
     838   -
          *
    +
         private String pathToMono;
     839   -
          * @return the value of pathToMono
    +
     
     840   -
          */
    -  841   -
         public String getPathToMono() {
    -  842   -
             return pathToMono;
    -  843   -
         }
    -  844   -
     
    -  845  
         /**
    -  846   -
          * Set the value of pathToMono.
    -  847   +  841   +
          * Get the value of pathToMono.
    +  842  
          *
    -  848   -
          * @param pathToMono new value of pathToMono
    -  849   +  843   +
          * @return the value of pathToMono
    +  844  
          */
    -  850   -
         public void setPathToMono(String pathToMono) {
    -  851   -
             this.pathToMono = pathToMono;
    -  852   +  845   +
         public String getPathToMono() {
    +  846   +
             return pathToMono;
    +  847  
         }
    +  848   +
     
    +  849   +
         /**
    +  850   +
          * Set the value of pathToMono.
    +  851   +
          *
    +  852   +
          * @param pathToMono new value of pathToMono
     853   -
     
    +
          */
     854   -
         @Override
    +
         public void setPathToMono(String pathToMono) {
     855   -
         public void execute() throws BuildException {
    -  856  0
             final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  857  0
             LogUtils.prepareLogger(in, logFile);
    -  858   +
             this.pathToMono = pathToMono;
    +  856   +
         }
    +  857  
     
    -  859  0
             dealWithReferences();
    -  860  0
             validateConfiguration();
    -  861  0
             populateSettings();
    +  858   +
         @Override
    +  859   +
         public void execute() throws BuildException {
    +  860  4
             final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  861  4
             LogUtils.prepareLogger(in, logFile);
     862  
     
    -  863  0
             Engine engine = null;
    -  864   -
             try {
    -  865  0
                 engine = new Engine();
    +  863  4
             dealWithReferences();
    +  864  4
             validateConfiguration();
    +  865  3
             populateSettings();
     866  
     
    -  867  0
                 for (Resource resource : path) {
    -  868  0
                     final FileProvider provider = resource.as(FileProvider.class);
    -  869  0
                     if (provider != null) {
    -  870  0
                         final File file = provider.getFile();
    -  871  0
                         if (file != null && file.exists()) {
    -  872  0
                             engine.scan(file);
    -  873   -
                         }
    -  874   -
                     }
    -  875  0
                 }
    -  876   -
                 try {
    -  877  0
                     engine.analyzeDependencies();
    -  878  0
                     DatabaseProperties prop = null;
    -  879  0
                     CveDB cve = null;
    -  880   -
                     try {
    -  881  0
                         cve = new CveDB();
    -  882  0
                         cve.open();
    -  883  0
                         prop = cve.getDatabaseProperties();
    -  884  0
                     } catch (DatabaseException ex) {
    -  885  0
                         Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex);
    -  886   -
                     } finally {
    -  887  0
                         if (cve != null) {
    -  888  0
                             cve.close();
    -  889   -
                         }
    -  890   -
                     }
    -  891  0
                     final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
    -  892  0
                     reporter.generateReports(reportOutputDirectory, reportFormat);
    -  893   -
     
    -  894  0
                     if (this.failBuildOnCVSS <= 10) {
    -  895  0
                         checkForFailure(engine.getDependencies());
    -  896   -
                     }
    -  897  0
                     if (this.showSummary) {
    -  898  0
                         showSummary(engine.getDependencies());
    -  899   -
                     }
    -  900  0
                 } catch (IOException ex) {
    -  901  0
                     Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE,
    -  902   -
                             "Unable to generate dependency-check report", ex);
    -  903  0
                     throw new BuildException("Unable to generate dependency-check report", ex);
    -  904  0
                 } catch (Exception ex) {
    -  905  0
                     Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE,
    -  906   -
                             "An exception occurred; unable to continue task", ex);
    -  907  0
                     throw new BuildException("An exception occurred; unable to continue task", ex);
    -  908  0
                 }
    -  909  0
             } catch (DatabaseException ex) {
    -  910  0
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.SEVERE,
    -  911   -
                         "Unable to connect to the dependency-check database; analysis has stopped");
    -  912  0
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "", ex);
    -  913   -
             } finally {
    -  914  0
                 if (engine != null) {
    -  915  0
                     engine.cleanup();
    -  916   -
                 }
    -  917   -
             }
    -  918  0
         }
    -  919   -
     
    -  920   -
         /**
    -  921   -
          * Validate the configuration to ensure the parameters have been properly configured/initialized.
    -  922   -
          *
    -  923   -
          * @throws BuildException if the task was not configured correctly.
    -  924   -
          */
    -  925   -
         private void validateConfiguration() throws BuildException {
    -  926  0
             if (path == null) {
    -  927  0
                 throw new BuildException("No project dependencies have been defined to analyze.");
    -  928   -
             }
    -  929  0
             if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
    -  930  0
                 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");
    -  931   -
             }
    -  932  0
         }
    -  933   -
     
    -  934   -
         /**
    -  935   -
          * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system
    -  936   -
          * properties required to change the proxy url, port, and connection timeout.
    -  937   -
          */
    -  938   -
         private void populateSettings() {
    -  939  0
             InputStream taskProperties = null;
    -  940   +  867  3
             Engine engine = null;
    +  868  
             try {
    -  941  0
                 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  942  0
                 Settings.mergeProperties(taskProperties);
    -  943  0
             } catch (IOException ex) {
    -  944  0
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    -  945  0
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex);
    -  946   -
             } finally {
    -  947  0
                 if (taskProperties != null) {
    -  948   +  869  3
                 engine = new Engine();
    +  870   +
     
    +  871  3
                 for (Resource resource : path) {
    +  872  5
                     final FileProvider provider = resource.as(FileProvider.class);
    +  873  5
                     if (provider != null) {
    +  874  5
                         final File file = provider.getFile();
    +  875  5
                         if (file != null && file.exists()) {
    +  876  4
                             engine.scan(file);
    +  877   +
                         }
    +  878   +
                     }
    +  879  5
                 }
    +  880   +
                 try {
    +  881  3
                     engine.analyzeDependencies();
    +  882  3
                     DatabaseProperties prop = null;
    +  883  3
                     CveDB cve = null;
    +  884  
                     try {
    -  949  0
                         taskProperties.close();
    -  950  0
                     } catch (IOException ex) {
    -  951  0
                         Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex);
    -  952  0
                     }
    -  953   +  885  3
                         cve = new CveDB();
    +  886  3
                         cve.open();
    +  887  3
                         prop = cve.getDatabaseProperties();
    +  888  0
                     } catch (DatabaseException ex) {
    +  889  0
                         LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +  890   +
                     } finally {
    +  891  3
                         if (cve != null) {
    +  892  3
                             cve.close();
    +  893   +
                         }
    +  894   +
                     }
    +  895  3
                     final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
    +  896  3
                     reporter.generateReports(reportOutputDirectory, reportFormat);
    +  897   +
     
    +  898  3
                     if (this.failBuildOnCVSS <= 10) {
    +  899  0
                         checkForFailure(engine.getDependencies());
    +  900   +
                     }
    +  901  3
                     if (this.showSummary) {
    +  902  3
                         showSummary(engine.getDependencies());
    +  903   +
                     }
    +  904  0
                 } catch (IOException ex) {
    +  905  0
                     LOGGER.log(Level.FINE, "Unable to generate dependency-check report", ex);
    +  906  0
                     throw new BuildException("Unable to generate dependency-check report", ex);
    +  907  0
                 } catch (Exception ex) {
    +  908  0
                     LOGGER.log(Level.FINE, "An exception occurred; unable to continue task", ex);
    +  909  0
                     throw new BuildException("An exception occurred; unable to continue task", ex);
    +  910  3
                 }
    +  911  0
             } catch (DatabaseException ex) {
    +  912  0
                 LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
    +  913  0
                 LOGGER.log(Level.FINE, "", ex);
    +  914   +
             } finally {
    +  915  3
                 Settings.cleanup();
    +  916  3
                 if (engine != null) {
    +  917  3
                     engine.cleanup();
    +  918  
                 }
    -  954   +  919  
             }
    -  955  0
             if (dataDirectory != null) {
    -  956  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +  920  3
         }
    +  921   +
     
    +  922   +
         /**
    +  923   +
          * Validate the configuration to ensure the parameters have been properly configured/initialized.
    +  924   +
          *
    +  925   +
          * @throws BuildException if the task was not configured correctly.
    +  926   +
          */
    +  927   +
         private void validateConfiguration() throws BuildException {
    +  928  4
             if (path == null) {
    +  929  1
                 throw new BuildException("No project dependencies have been defined to analyze.");
    +  930   +
             }
    +  931  3
             if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
    +  932  0
                 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");
    +  933   +
             }
    +  934  3
         }
    +  935   +
     
    +  936   +
         /**
    +  937   +
          * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system
    +  938   +
          * properties required to change the proxy url, port, and connection timeout.
    +  939   +
          */
    +  940   +
         private void populateSettings() {
    +  941  3
             Settings.initialize();
    +  942  3
             InputStream taskProperties = null;
    +  943   +
             try {
    +  944  3
                 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  945  3
                 Settings.mergeProperties(taskProperties);
    +  946  0
             } catch (IOException ex) {
    +  947  0
                 LOGGER.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    +  948  0
                 LOGGER.log(Level.FINE, null, ex);
    +  949   +
             } finally {
    +  950  3
                 if (taskProperties != null) {
    +  951   +
                     try {
    +  952  3
                         taskProperties.close();
    +  953  0
                     } catch (IOException ex) {
    +  954  0
                         LOGGER.log(Level.FINEST, null, ex);
    +  955  3
                     }
    +  956   +
                 }
     957   +
             }
    +  958  3
             if (dataDirectory != null) {
    +  959  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +  960  
             } else {
    -  958  0
                 final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    -  959  0
                 final File base = jarPath.getParentFile();
    -  960  0
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    -  961  0
                 final File dataDir = new File(base, sub);
    -  962  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    -  963   -
             }
    -  964   -
     
    -  965  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  961  3
                 final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    +  962  3
                 final File base = jarPath.getParentFile();
    +  963  3
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    +  964  3
                 final File dataDir = new File(base, sub);
    +  965  3
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
     966   -
     
    -  967  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  968  0
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    -  969  
             }
    -  970  0
             if (proxyPort != null && !proxyPort.isEmpty()) {
    -  971  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    +  967   +
     
    +  968  3
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  969   +
     
    +  970  3
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  971  0
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
     972  
             }
    -  973  0
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    -  974  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    +  973  3
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  974  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
     975  
             }
    -  976  0
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    -  977  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    +  976  3
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    +  977  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
     978  
             }
    -  979  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  980  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  979  3
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    +  980  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
     981  
             }
    -  982  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  983  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    +  982  3
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  983  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
     984  
             }
    -  985   -
     
    -  986   -
             //File Type Analyzer Settings
    +  985  3
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  986  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
     987   -
             //JAR ANALYZER
    -  988  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
    -  989   -
             //NUSPEC ANALYZER
    -  990  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    -  991   -
             //NEXUS ANALYZER
    -  992  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    -  993  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    -  994  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    -  995  
             }
    -  996  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    -  997   -
             //ARCHIVE ANALYZER
    -  998  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    -  999  0
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    -  1000  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
    -  1001   -
             }
    -  1002   -
             //ASSEMBLY ANALYZER
    -  1003  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    -  1004  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    -  1005  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    -  1006   -
             }
    -  1007   +  988  
     
    -  1008  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    -  1009  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    -  1010   +  989   +
             //File Type Analyzer Settings
    +  990   +
             //JAR ANALYZER
    +  991  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
    +  992   +
             //NUSPEC ANALYZER
    +  993  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    +  994   +
             //NEXUS ANALYZER
    +  995  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    +  996  3
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  997  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  998  
             }
    -  1011  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    -  1012  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    +  999  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    +  1000   +
             //ARCHIVE ANALYZER
    +  1001  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    +  1002  3
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    +  1003  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
    +  1004   +
             }
    +  1005   +
             //ASSEMBLY ANALYZER
    +  1006  3
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    +  1007  3
             if (pathToMono != null && !pathToMono.isEmpty()) {
    +  1008  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    +  1009   +
             }
    +  1010   +
     
    +  1011  3
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  1012  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
     1013  
             }
    -  1014  0
             if (connectionString != null && !connectionString.isEmpty()) {
    -  1015  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    +  1014  3
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  1015  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
     1016  
             }
    -  1017  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    -  1018  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  1017  3
             if (connectionString != null && !connectionString.isEmpty()) {
    +  1018  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
     1019  
             }
    -  1020  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    -  1021  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    +  1020  3
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  1021  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
     1022  
             }
    -  1023  0
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    -  1024  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
    +  1023  3
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  1024  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
     1025  
             }
    -  1026  0
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    -  1027  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
    +  1026  3
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    +  1027  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
     1028  
             }
    -  1029  0
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    -  1030  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
    +  1029  3
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    +  1030  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
     1031  
             }
    -  1032  0
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    -  1033  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
    +  1032  3
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    +  1033  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
     1034  
             }
    -  1035  0
         }
    -  1036   -
     
    +  1035  3
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    +  1036  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
     1037   -
         /**
    -  1038   -
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    +
             }
    +  1038  3
         }
     1039   -
          * configuration.
    +
     
     1040   -
          *
    +
         /**
     1041   -
          * @param dependencies the list of dependency objects
    +
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
     1042   -
          * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set
    +
          * configuration.
     1043   -
          */
    +
          *
     1044   +
          * @param dependencies the list of dependency objects
    +  1045   +
          * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set
    +  1046   +
          */
    +  1047  
         private void checkForFailure(List<Dependency> dependencies) throws BuildException {
    -  1045  0
             final StringBuilder ids = new StringBuilder();
    -  1046  0
             for (Dependency d : dependencies) {
    -  1047  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1048  0
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    -  1049  0
                         if (ids.length() == 0) {
    -  1050  0
                             ids.append(v.getName());
    -  1051   -
                         } else {
    -  1052  0
                             ids.append(", ").append(v.getName());
    -  1053   -
                         }
    +  1048  0
             final StringBuilder ids = new StringBuilder();
    +  1049  0
             for (Dependency d : dependencies) {
    +  1050  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  1051  0
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    +  1052  0
                         if (ids.length() == 0) {
    +  1053  0
                             ids.append(v.getName());
     1054   -
                     }
    -  1055  0
                 }
    -  1056  0
             }
    -  1057  0
             if (ids.length() > 0) {
    -  1058  0
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    -  1059   -
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    -  1060   -
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    -  1061  0
                 throw new BuildException(msg);
    -  1062   -
             }
    -  1063  0
         }
    -  1064   -
     
    -  1065   -
         /**
    -  1066   -
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    -  1067   -
          *
    -  1068   -
          * @param dependencies a list of dependency objects
    -  1069   -
          */
    -  1070   -
         private void showSummary(List<Dependency> dependencies) {
    -  1071  0
             final StringBuilder summary = new StringBuilder();
    -  1072  0
             for (Dependency d : dependencies) {
    -  1073  0
                 boolean firstEntry = true;
    -  1074  0
                 final StringBuilder ids = new StringBuilder();
    -  1075  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1076  0
                     if (firstEntry) {
    -  1077  0
                         firstEntry = false;
    -  1078   -
                     } else {
    -  1079  0
                         ids.append(", ");
    -  1080   -
                     }
    -  1081  0
                     ids.append(v.getName());
    -  1082  0
                 }
    -  1083  0
                 if (ids.length() > 0) {
    -  1084  0
                     summary.append(d.getFileName()).append(" (");
    -  1085  0
                     firstEntry = true;
    -  1086  0
                     for (Identifier id : d.getIdentifiers()) {
    -  1087  0
                         if (firstEntry) {
    -  1088  0
                             firstEntry = false;
    -  1089  
                         } else {
    -  1090  0
                             summary.append(", ");
    -  1091   +  1055  0
                             ids.append(", ").append(v.getName());
    +  1056  
                         }
    -  1092  0
                         summary.append(id.getValue());
    -  1093  0
                     }
    -  1094  0
                     summary.append(") : ").append(ids).append(NEW_LINE);
    -  1095   -
                 }
    -  1096  0
             }
    -  1097  0
             if (summary.length() > 0) {
    -  1098  0
                 final String msg = String.format("%n%n"
    -  1099   -
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    -  1100   -
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    -  1101  0
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, msg);
    -  1102   +  1057   +
                     }
    +  1058  0
                 }
    +  1059  0
             }
    +  1060  0
             if (ids.length() > 0) {
    +  1061  0
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    +  1062   +
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    +  1063   +
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    +  1064  0
                 throw new BuildException(msg);
    +  1065  
             }
    -  1103  0
         }
    -  1104   +  1066  0
         }
    +  1067  
     
    -  1105   +  1068  
         /**
    -  1106   -
          * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
    -  1107   -
          */
    -  1108   -
         public static class ReportFormats extends EnumeratedAttribute {
    -  1109   -
     
    -  1110   -
             /**
    -  1111   -
              * Returns the list of values for the report format.
    -  1112   -
              *
    -  1113   -
              * @return the list of values for the report format
    -  1114   -
              */
    -  1115   -
             @Override
    -  1116   -
             public String[] getValues() {
    -  1117  0
                 int i = 0;
    -  1118  0
                 final Format[] formats = Format.values();
    -  1119  0
                 final String[] values = new String[formats.length];
    -  1120  0
                 for (Format format : formats) {
    -  1121  0
                     values[i++] = format.name();
    -  1122   -
                 }
    -  1123  0
                 return values;
    -  1124   -
             }
    -  1125   -
         }
    -  1126   -
     
    -  1127   -
         /**
    -  1128   -
          * Whether or not the Jar Analyzer is enabled.
    -  1129   -
          */
    -  1130  0
         private boolean jarAnalyzerEnabled = true;
    -  1131   -
     
    -  1132   -
         /**
    -  1133   -
          * Returns whether or not the analyzer is enabled.
    -  1134   +  1069   +
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    +  1070  
          *
    -  1135   -
          * @return true if the analyzer is enabled
    -  1136   +  1071   +
          * @param dependencies a list of dependency objects
    +  1072  
          */
    -  1137   -
         public boolean isJarAnalyzerEnabled() {
    -  1138   -
             return jarAnalyzerEnabled;
    -  1139   +  1073   +
         private void showSummary(List<Dependency> dependencies) {
    +  1074  3
             final StringBuilder summary = new StringBuilder();
    +  1075  3
             for (Dependency d : dependencies) {
    +  1076  5
                 boolean firstEntry = true;
    +  1077  5
                 final StringBuilder ids = new StringBuilder();
    +  1078  5
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  1079  20
                     if (firstEntry) {
    +  1080  4
                         firstEntry = false;
    +  1081   +
                     } else {
    +  1082  16
                         ids.append(", ");
    +  1083   +
                     }
    +  1084  20
                     ids.append(v.getName());
    +  1085  20
                 }
    +  1086  5
                 if (ids.length() > 0) {
    +  1087  4
                     summary.append(d.getFileName()).append(" (");
    +  1088  4
                     firstEntry = true;
    +  1089  4
                     for (Identifier id : d.getIdentifiers()) {
    +  1090  12
                         if (firstEntry) {
    +  1091  4
                             firstEntry = false;
    +  1092   +
                         } else {
    +  1093  8
                             summary.append(", ");
    +  1094   +
                         }
    +  1095  12
                         summary.append(id.getValue());
    +  1096  12
                     }
    +  1097  4
                     summary.append(") : ").append(ids).append(NEW_LINE);
    +  1098   +
                 }
    +  1099  5
             }
    +  1100  3
             if (summary.length() > 0) {
    +  1101  3
                 final String msg = String.format("%n%n"
    +  1102   +
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    +  1103   +
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    +  1104  3
                 LOGGER.log(Level.WARNING, msg);
    +  1105   +
             }
    +  1106  3
         }
    +  1107   +
     
    +  1108   +
         /**
    +  1109   +
          * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
    +  1110   +
          */
    +  1111   +
         public static class ReportFormats extends EnumeratedAttribute {
    +  1112   +
     
    +  1113   +
             /**
    +  1114   +
              * Returns the list of values for the report format.
    +  1115   +
              *
    +  1116   +
              * @return the list of values for the report format
    +  1117   +
              */
    +  1118   +
             @Override
    +  1119   +
             public String[] getValues() {
    +  1120  4
                 int i = 0;
    +  1121  4
                 final Format[] formats = Format.values();
    +  1122  4
                 final String[] values = new String[formats.length];
    +  1123  20
                 for (Format format : formats) {
    +  1124  16
                     values[i++] = format.name();
    +  1125   +
                 }
    +  1126  4
                 return values;
    +  1127   +
             }
    +  1128  
         }
    +  1129   +
     
    +  1130   +
         /**
    +  1131   +
          * Whether or not the Jar Analyzer is enabled.
    +  1132   +
          */
    +  1133  4
         private boolean jarAnalyzerEnabled = true;
    +  1134   +
     
    +  1135   +
         /**
    +  1136   +
          * Returns whether or not the analyzer is enabled.
    +  1137   +
          *
    +  1138   +
          * @return true if the analyzer is enabled
    +  1139   +
          */
     1140   +
         public boolean isJarAnalyzerEnabled() {
    +  1141   +
             return jarAnalyzerEnabled;
    +  1142   +
         }
    +  1143  
     }
    - + diff --git a/dependency-check-ant/configuration.html b/dependency-check-ant/configuration.html index 89406be34..a7929748c 100644 --- a/dependency-check-ant/configuration.html +++ b/dependency-check-ant/configuration.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Configuration @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/cpd.html b/dependency-check-ant/cpd.html index 183d57411..cf6025ae6 100644 --- a/dependency-check-ant/cpd.html +++ b/dependency-check-ant/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - CPD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/dependency-updates-report.html b/dependency-check-ant/dependency-updates-report.html index 6de340a27..8ea5edd91 100644 --- a/dependency-check-ant/dependency-updates-report.html +++ b/dependency-check-ant/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -327,7 +327,7 @@ org.owasp dependency-check-core -1.1.4 +1.2.0 compile jar @@ -436,7 +436,7 @@ dependency-check-core Current Version -1.1.4 +1.2.0 Scope compile diff --git a/dependency-check-ant/findbugs.html b/dependency-check-ant/findbugs.html index f5b3f8387..a1a5944cb 100644 --- a/dependency-check-ant/findbugs.html +++ b/dependency-check-ant/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-ant - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -286,7 +286,7 @@ Inconsistent synchronization of org.owasp.dependencycheck.taskdefs.DependencyCheckTask.path; locked 44% of time MT_CORRECTNESS IS2_INCONSISTENT_SYNC -125 +129 Medium diff --git a/dependency-check-ant/index.html b/dependency-check-ant/index.html index 890dd1d21..994f3000b 100644 --- a/dependency-check-ant/index.html +++ b/dependency-check-ant/index.html @@ -1,13 +1,13 @@ - + dependency-check-ant - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/installation.html b/dependency-check-ant/installation.html index 552ed25c7..32bb4ba05 100644 --- a/dependency-check-ant/installation.html +++ b/dependency-check-ant/installation.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Installation @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -160,7 +160,7 @@

    Installation

    -

    Download dependency-check-ant from bintray here. To install dependency-check-ant place the dependency-check-ant-1.1.4.jar into the lib directory of your Ant instalation directory. Once installed you can add the taskdef to you build.xml and add the task to a new or existing target.

    +

    Download dependency-check-ant from bintray here. To install dependency-check-ant place the dependency-check-ant-1.2.0.jar into the lib directory of your Ant instalation directory. Once installed you can add the taskdef to you build.xml and add the task to a new or existing target.

    It is important to understand that the first time this task is executed it may take 20 minutes or more as it downloads and processes the data from the National Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov

    After the first batch download, as long as the task is executed at least once every seven days the update will only take a few seconds.

    diff --git a/dependency-check-ant/license.html b/dependency-check-ant/license.html index 2338ac874..9d68db2a9 100644 --- a/dependency-check-ant/license.html +++ b/dependency-check-ant/license.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/plugin-updates-report.html b/dependency-check-ant/plugin-updates-report.html index dd284987b..bb21e3538 100644 --- a/dependency-check-ant/plugin-updates-report.html +++ b/dependency-check-ant/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/pmd.html b/dependency-check-ant/pmd.html index c249f92e3..38ce1b6c8 100644 --- a/dependency-check-ant/pmd.html +++ b/dependency-check-ant/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/project-info.html b/dependency-check-ant/project-info.html index b19eb6f7f..ea3be77c9 100644 --- a/dependency-check-ant/project-info.html +++ b/dependency-check-ant/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/project-reports.html b/dependency-check-ant/project-reports.html index fce124b4c..efa2f624e 100644 --- a/dependency-check-ant/project-reports.html +++ b/dependency-check-ant/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/project-summary.html b/dependency-check-ant/project-summary.html index 22e09f43a..848ac3b7f 100644 --- a/dependency-check-ant/project-summary.html +++ b/dependency-check-ant/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -225,7 +225,7 @@ dependency-check-ant Version -1.1.4 +1.2.0 Type jar diff --git a/dependency-check-ant/surefire-report.html b/dependency-check-ant/surefire-report.html index f3035ba15..8b724b1c7 100644 --- a/dependency-check-ant/surefire-report.html +++ b/dependency-check-ant/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -265,7 +265,8 @@ function toggleDisplay(elementId) {

    Surefire Report

    -

    Summary


    +

    Summary

    +

    [Summary] [Package List] [Test Cases]


    @@ -275,13 +276,77 @@ function toggleDisplay(elementId) { + - - -
    TestsSuccess Rate Time
    4 0 0 000%0

    +100% +67.84

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    +
    +

    Package List

    +

    [Summary] [Package List] [Test Cases]


    + + + + + + + + + + + + + + + + +
    PackageTestsErrors FailuresSkippedSuccess RateTime
    org.owasp.dependencycheck.taskdefs4000100%67.84

    +

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    +
    +

    org.owasp.dependencycheck.taskdefs

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    DependencyCheckTaskTest4000100%67.84

    +
    +

    Test Cases

    +

    [Summary] [Package List] [Test Cases]

    +
    +

    DependencyCheckTaskTest

    + + + + + + + + + + + + + + + + +
    testGetFailBuildOnCVSS3.353
    testAddDirSet23.562
    testAddFileSet20.811
    testAddFileList20.114

    diff --git a/dependency-check-ant/taglist.html b/dependency-check-ant/taglist.html index 10ef1a9f6..fdde6e468 100644 --- a/dependency-check-ant/taglist.html +++ b/dependency-check-ant/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/usage.html b/dependency-check-ant/usage.html index f6f072aae..56ebfb2b0 100644 --- a/dependency-check-ant/usage.html +++ b/dependency-check-ant/usage.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Usage @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-ant/xref-test/index.html b/dependency-check-ant/xref-test/index.html index 477f86fc3..8c3abdb04 100644 --- a/dependency-check-ant/xref-test/index.html +++ b/dependency-check-ant/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Ant Task 1.1.4 Reference + Dependency-Check Ant Task 1.2.0 Reference diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html index fd0a7de51..7c83f1191 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html @@ -26,108 +26,97 @@ 18 package org.owasp.dependencycheck.taskdefs; 19 20 import java.io.File; -21 import static junit.framework.TestCase.assertTrue; -22 import org.apache.tools.ant.BuildFileTest; -23 import org.junit.After; -24 import org.junit.AfterClass; -25 import org.junit.Before; -26 import org.junit.BeforeClass; -27 import org.junit.Test; -28 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; -29 -30 /** -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34 public class DependencyCheckTaskTest extends BuildFileTest { -35 -36 public DependencyCheckTaskTest() { -37 } -38 -39 @BeforeClass -40 public static void setUpClass() { +21 import org.apache.tools.ant.BuildFileTest; +22 import org.junit.After; +23 import org.junit.Before; +24 import org.junit.Test; +25 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; +26 import org.owasp.dependencycheck.utils.Settings; +27 +28 /** +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32 public class DependencyCheckTaskTest extends BuildFileTest { +33 +34 @Before +35 @Override +36 public void setUp() throws Exception { +37 Settings.initialize(); +38 BaseDBTestCase.ensureDBExists(); +39 final String buildFile = this.getClass().getClassLoader().getResource("build.xml").getPath(); +40 configureProject(buildFile); 41 } 42 -43 @AfterClass -44 public static void tearDownClass() { -45 } -46 -47 @Before -48 @Override -49 public void setUp() throws Exception { -50 BaseDBTestCase.ensureDBExists(); -51 final String buildFile = this.getClass().getClassLoader().getResource("build.xml").getPath(); -52 configureProject(buildFile); -53 } -54 -55 @After -56 @Override -57 public void tearDown() { -58 //no cleanup... -59 //executeTarget("cleanup"); -60 } -61 -62 /** -63 * Test of addFileSet method, of class DependencyCheckTask. -64 */ -65 @Test -66 public void testAddFileSet() throws Exception { -67 File report = new File("target/dependency-check-report.html"); -68 if (report.exists()) { -69 if (!report.delete()) { -70 throw new Exception("Unable to delete 'target/DependencyCheck-Report.html' prior to test."); -71 } -72 } -73 executeTarget("test.fileset"); -74 -75 assertTrue("DependencyCheck report was not generated", report.exists()); -76 -77 } -78 -79 /** -80 * Test of addFileList method, of class DependencyCheckTask. -81 * -82 * @throws Exception -83 */ -84 @Test -85 public void testAddFileList() throws Exception { -86 File report = new File("target/dependency-check-report.xml"); -87 if (report.exists()) { -88 if (!report.delete()) { -89 throw new Exception("Unable to delete 'target/DependencyCheck-Report.xml' prior to test."); -90 } -91 } -92 executeTarget("test.filelist"); -93 -94 assertTrue("DependencyCheck report was not generated", report.exists()); -95 } -96 -97 /** -98 * Test of addDirSet method, of class DependencyCheckTask. -99 * -100 * @throws Exception -101 */ -102 @Test -103 public void testAddDirSet() throws Exception { -104 File report = new File("target/dependency-check-vulnerability.html"); -105 if (report.exists()) { -106 if (!report.delete()) { -107 throw new Exception("Unable to delete 'target/DependencyCheck-Vulnerability.html' prior to test."); -108 } -109 } -110 executeTarget("test.dirset"); -111 assertTrue("DependencyCheck report was not generated", report.exists()); -112 } -113 -114 /** -115 * Test of getFailBuildOnCVSS method, of class DependencyCheckTask. -116 */ -117 @Test -118 public void testGetFailBuildOnCVSS() { -119 expectBuildException("failCVSS", "asdfasdfscore"); -120 System.out.println(this.getOutput()); -121 } -122 } +43 @After +44 @Override +45 public void tearDown() { +46 //no cleanup... +47 //executeTarget("cleanup"); +48 Settings.cleanup(); +49 } +50 +51 /** +52 * Test of addFileSet method, of class DependencyCheckTask. +53 */ +54 @Test +55 public void testAddFileSet() throws Exception { +56 File report = new File("target/dependency-check-report.html"); +57 if (report.exists()) { +58 if (!report.delete()) { +59 throw new Exception("Unable to delete 'target/DependencyCheck-Report.html' prior to test."); +60 } +61 } +62 executeTarget("test.fileset"); +63 +64 assertTrue("DependencyCheck report was not generated", report.exists()); +65 +66 } +67 +68 /** +69 * Test of addFileList method, of class DependencyCheckTask. +70 * +71 * @throws Exception +72 */ +73 @Test +74 public void testAddFileList() throws Exception { +75 File report = new File("target/dependency-check-report.xml"); +76 if (report.exists()) { +77 if (!report.delete()) { +78 throw new Exception("Unable to delete 'target/DependencyCheck-Report.xml' prior to test."); +79 } +80 } +81 executeTarget("test.filelist"); +82 +83 assertTrue("DependencyCheck report was not generated", report.exists()); +84 } +85 +86 /** +87 * Test of addDirSet method, of class DependencyCheckTask. +88 * +89 * @throws Exception +90 */ +91 @Test +92 public void testAddDirSet() throws Exception { +93 File report = new File("target/dependency-check-vulnerability.html"); +94 if (report.exists()) { +95 if (!report.delete()) { +96 throw new Exception("Unable to delete 'target/DependencyCheck-Vulnerability.html' prior to test."); +97 } +98 } +99 executeTarget("test.dirset"); +100 assertTrue("DependencyCheck report was not generated", report.exists()); +101 } +102 +103 /** +104 * Test of getFailBuildOnCVSS method, of class DependencyCheckTask. +105 */ +106 @Test +107 public void testGetFailBuildOnCVSS() { +108 expectBuildException("failCVSS", "asdfasdfscore"); +109 System.out.println(this.getOutput()); +110 } +111 }
    diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html index aad9ecb91..6d8725f22 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html index cfe4e7c21..9d295b8f6 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref-test/overview-frame.html b/dependency-check-ant/xref-test/overview-frame.html index 601132b09..377e72d38 100644 --- a/dependency-check-ant/xref-test/overview-frame.html +++ b/dependency-check-ant/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference + Dependency-Check Ant Task 1.2.0 Reference diff --git a/dependency-check-ant/xref-test/overview-summary.html b/dependency-check-ant/xref-test/overview-summary.html index 20803f01b..3485f867f 100644 --- a/dependency-check-ant/xref-test/overview-summary.html +++ b/dependency-check-ant/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference + Dependency-Check Ant Task 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Ant Task 1.1.4 Reference

    +

    Dependency-Check Ant Task 1.2.0 Reference

    diff --git a/dependency-check-ant/xref/index.html b/dependency-check-ant/xref/index.html index 477f86fc3..8c3abdb04 100644 --- a/dependency-check-ant/xref/index.html +++ b/dependency-check-ant/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Ant Task 1.1.4 Reference + Dependency-Check Ant Task 1.2.0 Reference diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html index 53028c1eb..56da81a43 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html @@ -70,1082 +70,1085 @@ 62 * System specific new line character.63 */64privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); -65 -66/** -67 * Construct a new DependencyCheckTask. -68 */ -69publicDependencyCheckTask() { -70super(); -71 } -72//The following code was copied Apache Ant PathConvert -73//BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert -74/** -75 * Path to be converted -76 */ -77private Resources path = null; +65/** +66 * The logger. +67 */ +68privatestaticfinal Logger LOGGER = Logger.getLogger(DependencyCheckTask.class.getName()); +69 +70/** +71 * Construct a new DependencyCheckTask. +72 */ +73publicDependencyCheckTask() { +74super(); +75 } +76//The following code was copied Apache Ant PathConvert +77//BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert78/** -79 * Reference to path/fileset to convert +79 * Path to be converted80 */ -81private Reference refid = null; -82 -83/** -84 * Add an arbitrary ResourceCollection. -85 * -86 * @param rc the ResourceCollection to add. -87 * @since Ant 1.7 -88 */ -89publicvoid add(ResourceCollection rc) { -90if (isReference()) { -91thrownew BuildException("Nested elements are not allowed when using the refid attribute."); -92 } -93 getPath().add(rc); -94 } -95 -96/** -97 * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the -98 * path object. -99 * -100 * @return the path -101 */ -102privatesynchronized Resources getPath() { -103if (path == null) { -104 path = new Resources(getProject()); -105 path.setCache(true); -106 } -107return path; -108 } -109 -110/** -111 * Learn whether the refid attribute of this element been set. -112 * -113 * @return true if refid is valid. -114 */ -115publicboolean isReference() { -116return refid != null; -117 } -118 -119/** -120 * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere. -121 * -122 * @param r the reference to a path, fileset, dirset or filelist. -123 */ -124publicvoid setRefid(Reference r) { -125if (path != null) { -126thrownew BuildException("Nested elements are not allowed when using the refid attribute."); -127 } -128 refid = r; -129 } -130 -131/** -132 * If this is a reference, this method will add the referenced resource collection to the collection of paths. -133 * -134 * @throws BuildException if the reference is not to a resource collection -135 */ -136privatevoid dealWithReferences() throws BuildException { -137if (isReference()) { -138final Object o = refid.getReferencedObject(getProject()); -139if (!(o instanceof ResourceCollection)) { -140thrownew BuildException("refid '" + refid.getRefId() -141 + "' does not refer to a resource collection."); -142 } -143 getPath().add((ResourceCollection) o); -144 } -145 } -146// END COPY from org.apache.tools.ant.taskdefs -147/** -148 * The application name for the report. -149 */ -150private String applicationName = "Dependency-Check"; -151 -152/** -153 * Get the value of applicationName. -154 * -155 * @return the value of applicationName -156 */ -157public String getApplicationName() { -158return applicationName; -159 } -160 -161/** -162 * Set the value of applicationName. -163 * -164 * @param applicationName new value of applicationName -165 */ -166publicvoid setApplicationName(String applicationName) { -167this.applicationName = applicationName; -168 } -169/** -170 * The location of the data directory that contains -171 */ -172private String dataDirectory = null; -173 -174/** -175 * Get the value of dataDirectory. -176 * -177 * @return the value of dataDirectory -178 */ -179public String getDataDirectory() { -180return dataDirectory; -181 } -182 -183/** -184 * Set the value of dataDirectory. -185 * -186 * @param dataDirectory new value of dataDirectory -187 */ -188publicvoid setDataDirectory(String dataDirectory) { -189this.dataDirectory = dataDirectory; -190 } -191/** -192 * Specifies the destination directory for the generated Dependency-Check report. -193 */ -194private String reportOutputDirectory = "."; -195 -196/** -197 * Get the value of reportOutputDirectory. -198 * -199 * @return the value of reportOutputDirectory -200 */ -201public String getReportOutputDirectory() { -202return reportOutputDirectory; -203 } -204 -205/** -206 * Set the value of reportOutputDirectory. -207 * -208 * @param reportOutputDirectory new value of reportOutputDirectory -209 */ -210publicvoid setReportOutputDirectory(String reportOutputDirectory) { -211this.reportOutputDirectory = reportOutputDirectory; -212 } -213/** -214 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 -215 * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11. -216 * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail. -217 */ -218privatefloat failBuildOnCVSS = 11; -219 -220/** -221 * Get the value of failBuildOnCVSS. -222 * -223 * @return the value of failBuildOnCVSS -224 */ -225publicfloat getFailBuildOnCVSS() { -226return failBuildOnCVSS; -227 } -228 -229/** -230 * Set the value of failBuildOnCVSS. -231 * -232 * @param failBuildOnCVSS new value of failBuildOnCVSS -233 */ -234publicvoid setFailBuildOnCVSS(float failBuildOnCVSS) { -235this.failBuildOnCVSS = failBuildOnCVSS; -236 } -237/** -238 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to -239 * false. Default is true. -240 */ -241privateboolean autoUpdate = true; -242 -243/** -244 * Get the value of autoUpdate. -245 * -246 * @return the value of autoUpdate -247 */ -248publicboolean isAutoUpdate() { -249return autoUpdate; -250 } -251 -252/** -253 * Set the value of autoUpdate. -254 * -255 * @param autoUpdate new value of autoUpdate -256 */ -257publicvoid setAutoUpdate(boolean autoUpdate) { -258this.autoUpdate = autoUpdate; -259 } -260/** -261 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this -262 * within the Site plugin unless the externalReport is set to true. Default is HTML. -263 */ -264private String reportFormat = "HTML"; -265 -266/** -267 * Get the value of reportFormat. -268 * -269 * @return the value of reportFormat -270 */ -271public String getReportFormat() { -272return reportFormat; -273 } -274 -275/** -276 * Set the value of reportFormat. -277 * -278 * @param reportFormat new value of reportFormat -279 */ -280publicvoid setReportFormat(ReportFormats reportFormat) { -281this.reportFormat = reportFormat.getValue(); -282 } -283/** -284 * The Proxy URL. -285 */ -286private String proxyUrl; -287 -288/** -289 * Get the value of proxyUrl. -290 * -291 * @return the value of proxyUrl -292 */ -293public String getProxyUrl() { -294return proxyUrl; -295 } -296 -297/** -298 * Set the value of proxyUrl. -299 * -300 * @param proxyUrl new value of proxyUrl -301 */ -302publicvoid setProxyUrl(String proxyUrl) { -303this.proxyUrl = proxyUrl; -304 } -305/** -306 * The Proxy Port. -307 */ -308private String proxyPort; -309 -310/** -311 * Get the value of proxyPort. -312 * -313 * @return the value of proxyPort -314 */ -315public String getProxyPort() { -316return proxyPort; -317 } -318 -319/** -320 * Set the value of proxyPort. -321 * -322 * @param proxyPort new value of proxyPort -323 */ -324publicvoid setProxyPort(String proxyPort) { -325this.proxyPort = proxyPort; -326 } -327/** -328 * The Proxy username. -329 */ -330private String proxyUsername; -331 -332/** -333 * Get the value of proxyUsername. -334 * -335 * @return the value of proxyUsername -336 */ -337public String getProxyUsername() { -338return proxyUsername; -339 } -340 -341/** -342 * Set the value of proxyUsername. -343 * -344 * @param proxyUsername new value of proxyUsername -345 */ -346publicvoid setProxyUsername(String proxyUsername) { -347this.proxyUsername = proxyUsername; -348 } -349/** -350 * The Proxy password. -351 */ -352private String proxyPassword; -353 -354/** -355 * Get the value of proxyPassword. -356 * -357 * @return the value of proxyPassword -358 */ -359public String getProxyPassword() { -360return proxyPassword; -361 } -362 -363/** -364 * Set the value of proxyPassword. -365 * -366 * @param proxyPassword new value of proxyPassword -367 */ -368publicvoid setProxyPassword(String proxyPassword) { -369this.proxyPassword = proxyPassword; -370 } -371/** -372 * The Connection Timeout. -373 */ -374private String connectionTimeout; -375 -376/** -377 * Get the value of connectionTimeout. -378 * -379 * @return the value of connectionTimeout -380 */ -381public String getConnectionTimeout() { -382return connectionTimeout; -383 } -384 -385/** -386 * Set the value of connectionTimeout. -387 * -388 * @param connectionTimeout new value of connectionTimeout -389 */ -390publicvoid setConnectionTimeout(String connectionTimeout) { -391this.connectionTimeout = connectionTimeout; -392 } -393/** -394 * The file path used for verbose logging. -395 */ -396private String logFile = null; -397 -398/** -399 * Get the value of logFile. -400 * -401 * @return the value of logFile -402 */ -403public String getLogFile() { -404return logFile; -405 } -406 -407/** -408 * Set the value of logFile. -409 * -410 * @param logFile new value of logFile -411 */ -412publicvoid setLogFile(String logFile) { -413this.logFile = logFile; -414 } -415/** -416 * The path to the suppression file. -417 */ -418private String suppressionFile; -419 -420/** -421 * Get the value of suppressionFile. -422 * -423 * @return the value of suppressionFile -424 */ -425public String getSuppressionFile() { -426return suppressionFile; -427 } -428 -429/** -430 * Set the value of suppressionFile. -431 * -432 * @param suppressionFile new value of suppressionFile -433 */ -434publicvoid setSuppressionFile(String suppressionFile) { -435this.suppressionFile = suppressionFile; -436 } -437/** -438 * flag indicating whether or not to show a summary of findings. -439 */ -440privateboolean showSummary = true; -441 -442/** -443 * Get the value of showSummary. -444 * -445 * @return the value of showSummary -446 */ -447publicboolean isShowSummary() { -448return showSummary; -449 } -450 -451/** -452 * Set the value of showSummary. -453 * -454 * @param showSummary new value of showSummary -455 */ -456publicvoid setShowSummary(boolean showSummary) { -457this.showSummary = showSummary; -458 } -459 -460/** -461 * Sets whether or not the analyzer is enabled. -462 * -463 * @param jarAnalyzerEnabled the value of the new setting -464 */ -465publicvoid setJarAnalyzerEnabled(boolean jarAnalyzerEnabled) { -466this.jarAnalyzerEnabled = jarAnalyzerEnabled; -467 } -468/** -469 * Whether or not the Archive Analyzer is enabled. -470 */ -471privateboolean archiveAnalyzerEnabled = true; -472 -473/** -474 * Returns whether or not the analyzer is enabled. -475 * -476 * @return true if the analyzer is enabled -477 */ -478publicboolean isArchiveAnalyzerEnabled() { -479return archiveAnalyzerEnabled; -480 } -481/** -482 * Whether or not the .NET Assembly Analyzer is enabled. -483 */ -484privateboolean assemblyAnalyzerEnabled = true; -485 -486/** -487 * Sets whether or not the analyzer is enabled. -488 * -489 * @param archiveAnalyzerEnabled the value of the new setting -490 */ -491publicvoid setArchiveAnalyzerEnabled(boolean archiveAnalyzerEnabled) { -492this.archiveAnalyzerEnabled = archiveAnalyzerEnabled; -493 } -494 -495/** -496 * Returns whether or not the analyzer is enabled. -497 * -498 * @return true if the analyzer is enabled -499 */ -500publicboolean isAssemblyAnalyzerEnabled() { -501return assemblyAnalyzerEnabled; -502 } -503 -504/** -505 * Sets whether or not the analyzer is enabled. -506 * -507 * @param assemblyAnalyzerEnabled the value of the new setting -508 */ -509publicvoid setAssemblyAnalyzerEnabled(boolean assemblyAnalyzerEnabled) { -510this.assemblyAnalyzerEnabled = assemblyAnalyzerEnabled; -511 } -512/** -513 * Whether or not the .NET Nuspec Analyzer is enabled. -514 */ -515privateboolean nuspecAnalyzerEnabled = true; -516 -517/** -518 * Returns whether or not the analyzer is enabled. -519 * -520 * @return true if the analyzer is enabled -521 */ -522publicboolean isNuspecAnalyzerEnabled() { -523return nuspecAnalyzerEnabled; -524 } -525 -526/** -527 * Sets whether or not the analyzer is enabled. -528 * -529 * @param nuspecAnalyzerEnabled the value of the new setting -530 */ -531publicvoid setNuspecAnalyzerEnabled(boolean nuspecAnalyzerEnabled) { -532this.nuspecAnalyzerEnabled = nuspecAnalyzerEnabled; -533 } -534 -535/** -536 * Whether or not the nexus analyzer is enabled. -537 */ -538privateboolean nexusAnalyzerEnabled = true; -539 -540/** -541 * Get the value of nexusAnalyzerEnabled. -542 * -543 * @return the value of nexusAnalyzerEnabled -544 */ -545publicboolean isNexusAnalyzerEnabled() { -546return nexusAnalyzerEnabled; -547 } -548 -549/** -550 * Set the value of nexusAnalyzerEnabled. -551 * -552 * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled -553 */ -554publicvoid setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) { -555this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; -556 } -557 -558/** -559 * The URL of the Nexus server. -560 */ -561private String nexusUrl; -562 -563/** -564 * Get the value of nexusUrl. -565 * -566 * @return the value of nexusUrl -567 */ -568public String getNexusUrl() { -569return nexusUrl; -570 } -571 -572/** -573 * Set the value of nexusUrl. -574 * -575 * @param nexusUrl new value of nexusUrl -576 */ -577publicvoid setNexusUrl(String nexusUrl) { -578this.nexusUrl = nexusUrl; -579 } -580/** -581 * Whether or not the defined proxy should be used when connecting to Nexus. -582 */ -583privateboolean nexusUsesProxy = true; -584 -585/** -586 * Get the value of nexusUsesProxy. -587 * -588 * @return the value of nexusUsesProxy -589 */ -590publicboolean isNexusUsesProxy() { -591return nexusUsesProxy; -592 } -593 -594/** -595 * Set the value of nexusUsesProxy. -596 * -597 * @param nexusUsesProxy new value of nexusUsesProxy -598 */ -599publicvoid setNexusUsesProxy(boolean nexusUsesProxy) { -600this.nexusUsesProxy = nexusUsesProxy; -601 } -602 -603/** -604 * The database driver name; such as org.h2.Driver. -605 */ -606private String databaseDriverName; -607 -608/** -609 * Get the value of databaseDriverName. -610 * -611 * @return the value of databaseDriverName -612 */ -613public String getDatabaseDriverName() { -614return databaseDriverName; -615 } -616 -617/** -618 * Set the value of databaseDriverName. -619 * -620 * @param databaseDriverName new value of databaseDriverName -621 */ -622publicvoid setDatabaseDriverName(String databaseDriverName) { -623this.databaseDriverName = databaseDriverName; -624 } -625 -626/** -627 * The path to the database driver JAR file if it is not on the class path. -628 */ -629private String databaseDriverPath; -630 -631/** -632 * Get the value of databaseDriverPath. -633 * -634 * @return the value of databaseDriverPath -635 */ -636public String getDatabaseDriverPath() { -637return databaseDriverPath; -638 } -639 -640/** -641 * Set the value of databaseDriverPath. -642 * -643 * @param databaseDriverPath new value of databaseDriverPath -644 */ -645publicvoid setDatabaseDriverPath(String databaseDriverPath) { -646this.databaseDriverPath = databaseDriverPath; -647 } -648/** -649 * The database connection string. -650 */ -651private String connectionString; -652 -653/** -654 * Get the value of connectionString. -655 * -656 * @return the value of connectionString -657 */ -658public String getConnectionString() { -659return connectionString; -660 } -661 -662/** -663 * Set the value of connectionString. -664 * -665 * @param connectionString new value of connectionString -666 */ -667publicvoid setConnectionString(String connectionString) { -668this.connectionString = connectionString; -669 } -670/** -671 * The user name for connecting to the database. -672 */ -673private String databaseUser; -674 -675/** -676 * Get the value of databaseUser. -677 * -678 * @return the value of databaseUser -679 */ -680public String getDatabaseUser() { -681return databaseUser; -682 } -683 -684/** -685 * Set the value of databaseUser. -686 * -687 * @param databaseUser new value of databaseUser -688 */ -689publicvoid setDatabaseUser(String databaseUser) { -690this.databaseUser = databaseUser; -691 } -692 -693/** -694 * The password to use when connecting to the database. -695 */ -696private String databasePassword; -697 -698/** -699 * Get the value of databasePassword. -700 * -701 * @return the value of databasePassword -702 */ -703public String getDatabasePassword() { -704return databasePassword; -705 } -706 -707/** -708 * Set the value of databasePassword. -709 * -710 * @param databasePassword new value of databasePassword -711 */ -712publicvoid setDatabasePassword(String databasePassword) { -713this.databasePassword = databasePassword; -714 } -715 -716/** -717 * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat -718 * like ZIP files. -719 */ -720private String zipExtensions; -721 -722/** -723 * Get the value of zipExtensions. -724 * -725 * @return the value of zipExtensions -726 */ -727public String getZipExtensions() { -728return zipExtensions; -729 } -730 -731/** -732 * Set the value of zipExtensions. -733 * -734 * @param zipExtensions new value of zipExtensions -735 */ -736publicvoid setZipExtensions(String zipExtensions) { -737this.zipExtensions = zipExtensions; -738 } -739 -740/** -741 * The url for the modified NVD CVE (1.2 schema). -742 */ -743private String cveUrl12Modified; -744 -745/** -746 * Get the value of cveUrl12Modified. -747 * -748 * @return the value of cveUrl12Modified -749 */ -750public String getCveUrl12Modified() { -751return cveUrl12Modified; -752 } -753 -754/** -755 * Set the value of cveUrl12Modified. -756 * -757 * @param cveUrl12Modified new value of cveUrl12Modified -758 */ -759publicvoid setCveUrl12Modified(String cveUrl12Modified) { -760this.cveUrl12Modified = cveUrl12Modified; -761 } -762 -763/** -764 * The url for the modified NVD CVE (2.0 schema). -765 */ -766private String cveUrl20Modified; -767 -768/** -769 * Get the value of cveUrl20Modified. -770 * -771 * @return the value of cveUrl20Modified -772 */ -773public String getCveUrl20Modified() { -774return cveUrl20Modified; -775 } -776 -777/** -778 * Set the value of cveUrl20Modified. -779 * -780 * @param cveUrl20Modified new value of cveUrl20Modified -781 */ -782publicvoid setCveUrl20Modified(String cveUrl20Modified) { -783this.cveUrl20Modified = cveUrl20Modified; -784 } -785 -786/** -787 * Base Data Mirror URL for CVE 1.2. -788 */ -789private String cveUrl12Base; -790 -791/** -792 * Get the value of cveUrl12Base. -793 * -794 * @return the value of cveUrl12Base -795 */ -796public String getCveUrl12Base() { -797return cveUrl12Base; -798 } -799 -800/** -801 * Set the value of cveUrl12Base. -802 * -803 * @param cveUrl12Base new value of cveUrl12Base -804 */ -805publicvoid setCveUrl12Base(String cveUrl12Base) { -806this.cveUrl12Base = cveUrl12Base; -807 } -808 -809/** -810 * Data Mirror URL for CVE 2.0. -811 */ -812private String cveUrl20Base; -813 -814/** -815 * Get the value of cveUrl20Base. -816 * -817 * @return the value of cveUrl20Base -818 */ -819public String getCveUrl20Base() { -820return cveUrl20Base; -821 } -822 -823/** -824 * Set the value of cveUrl20Base. -825 * -826 * @param cveUrl20Base new value of cveUrl20Base -827 */ -828publicvoid setCveUrl20Base(String cveUrl20Base) { -829this.cveUrl20Base = cveUrl20Base; -830 } -831/** -832 * The path to Mono for .NET assembly analysis on non-windows systems. -833 */ -834private String pathToMono; -835 -836/** -837 * Get the value of pathToMono. -838 * -839 * @return the value of pathToMono -840 */ -841public String getPathToMono() { -842return pathToMono; -843 } -844 -845/** -846 * Set the value of pathToMono. -847 * -848 * @param pathToMono new value of pathToMono -849 */ -850publicvoid setPathToMono(String pathToMono) { -851this.pathToMono = pathToMono; -852 } -853 -854 @Override -855publicvoid execute() throws BuildException { -856final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -857 LogUtils.prepareLogger(in, logFile); -858 -859 dealWithReferences(); -860 validateConfiguration(); -861 populateSettings(); +81private Resources path = null; +82/** +83 * Reference to path/fileset to convert +84 */ +85private Reference refid = null; +86 +87/** +88 * Add an arbitrary ResourceCollection. +89 * +90 * @param rc the ResourceCollection to add. +91 * @since Ant 1.7 +92 */ +93publicvoid add(ResourceCollection rc) { +94if (isReference()) { +95thrownew BuildException("Nested elements are not allowed when using the refid attribute."); +96 } +97 getPath().add(rc); +98 } +99 +100/** +101 * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the +102 * path object. +103 * +104 * @return the path +105 */ +106privatesynchronized Resources getPath() { +107if (path == null) { +108 path = new Resources(getProject()); +109 path.setCache(true); +110 } +111return path; +112 } +113 +114/** +115 * Learn whether the refid attribute of this element been set. +116 * +117 * @return true if refid is valid. +118 */ +119publicboolean isReference() { +120return refid != null; +121 } +122 +123/** +124 * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere. +125 * +126 * @param r the reference to a path, fileset, dirset or filelist. +127 */ +128publicvoid setRefid(Reference r) { +129if (path != null) { +130thrownew BuildException("Nested elements are not allowed when using the refid attribute."); +131 } +132 refid = r; +133 } +134 +135/** +136 * If this is a reference, this method will add the referenced resource collection to the collection of paths. +137 * +138 * @throws BuildException if the reference is not to a resource collection +139 */ +140privatevoid dealWithReferences() throws BuildException { +141if (isReference()) { +142final Object o = refid.getReferencedObject(getProject()); +143if (!(o instanceof ResourceCollection)) { +144thrownew BuildException("refid '" + refid.getRefId() +145 + "' does not refer to a resource collection."); +146 } +147 getPath().add((ResourceCollection) o); +148 } +149 } +150// END COPY from org.apache.tools.ant.taskdefs +151/** +152 * The application name for the report. +153 */ +154private String applicationName = "Dependency-Check"; +155 +156/** +157 * Get the value of applicationName. +158 * +159 * @return the value of applicationName +160 */ +161public String getApplicationName() { +162return applicationName; +163 } +164 +165/** +166 * Set the value of applicationName. +167 * +168 * @param applicationName new value of applicationName +169 */ +170publicvoid setApplicationName(String applicationName) { +171this.applicationName = applicationName; +172 } +173/** +174 * The location of the data directory that contains +175 */ +176private String dataDirectory = null; +177 +178/** +179 * Get the value of dataDirectory. +180 * +181 * @return the value of dataDirectory +182 */ +183public String getDataDirectory() { +184return dataDirectory; +185 } +186 +187/** +188 * Set the value of dataDirectory. +189 * +190 * @param dataDirectory new value of dataDirectory +191 */ +192publicvoid setDataDirectory(String dataDirectory) { +193this.dataDirectory = dataDirectory; +194 } +195/** +196 * Specifies the destination directory for the generated Dependency-Check report. +197 */ +198private String reportOutputDirectory = "."; +199 +200/** +201 * Get the value of reportOutputDirectory. +202 * +203 * @return the value of reportOutputDirectory +204 */ +205public String getReportOutputDirectory() { +206return reportOutputDirectory; +207 } +208 +209/** +210 * Set the value of reportOutputDirectory. +211 * +212 * @param reportOutputDirectory new value of reportOutputDirectory +213 */ +214publicvoid setReportOutputDirectory(String reportOutputDirectory) { +215this.reportOutputDirectory = reportOutputDirectory; +216 } +217/** +218 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 +219 * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11. +220 * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail. +221 */ +222privatefloat failBuildOnCVSS = 11; +223 +224/** +225 * Get the value of failBuildOnCVSS. +226 * +227 * @return the value of failBuildOnCVSS +228 */ +229publicfloat getFailBuildOnCVSS() { +230return failBuildOnCVSS; +231 } +232 +233/** +234 * Set the value of failBuildOnCVSS. +235 * +236 * @param failBuildOnCVSS new value of failBuildOnCVSS +237 */ +238publicvoid setFailBuildOnCVSS(float failBuildOnCVSS) { +239this.failBuildOnCVSS = failBuildOnCVSS; +240 } +241/** +242 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to +243 * false. Default is true. +244 */ +245privateboolean autoUpdate = true; +246 +247/** +248 * Get the value of autoUpdate. +249 * +250 * @return the value of autoUpdate +251 */ +252publicboolean isAutoUpdate() { +253return autoUpdate; +254 } +255 +256/** +257 * Set the value of autoUpdate. +258 * +259 * @param autoUpdate new value of autoUpdate +260 */ +261publicvoid setAutoUpdate(boolean autoUpdate) { +262this.autoUpdate = autoUpdate; +263 } +264/** +265 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this +266 * within the Site plugin unless the externalReport is set to true. Default is HTML. +267 */ +268private String reportFormat = "HTML"; +269 +270/** +271 * Get the value of reportFormat. +272 * +273 * @return the value of reportFormat +274 */ +275public String getReportFormat() { +276return reportFormat; +277 } +278 +279/** +280 * Set the value of reportFormat. +281 * +282 * @param reportFormat new value of reportFormat +283 */ +284publicvoid setReportFormat(ReportFormats reportFormat) { +285this.reportFormat = reportFormat.getValue(); +286 } +287/** +288 * The Proxy URL. +289 */ +290private String proxyUrl; +291 +292/** +293 * Get the value of proxyUrl. +294 * +295 * @return the value of proxyUrl +296 */ +297public String getProxyUrl() { +298return proxyUrl; +299 } +300 +301/** +302 * Set the value of proxyUrl. +303 * +304 * @param proxyUrl new value of proxyUrl +305 */ +306publicvoid setProxyUrl(String proxyUrl) { +307this.proxyUrl = proxyUrl; +308 } +309/** +310 * The Proxy Port. +311 */ +312private String proxyPort; +313 +314/** +315 * Get the value of proxyPort. +316 * +317 * @return the value of proxyPort +318 */ +319public String getProxyPort() { +320return proxyPort; +321 } +322 +323/** +324 * Set the value of proxyPort. +325 * +326 * @param proxyPort new value of proxyPort +327 */ +328publicvoid setProxyPort(String proxyPort) { +329this.proxyPort = proxyPort; +330 } +331/** +332 * The Proxy username. +333 */ +334private String proxyUsername; +335 +336/** +337 * Get the value of proxyUsername. +338 * +339 * @return the value of proxyUsername +340 */ +341public String getProxyUsername() { +342return proxyUsername; +343 } +344 +345/** +346 * Set the value of proxyUsername. +347 * +348 * @param proxyUsername new value of proxyUsername +349 */ +350publicvoid setProxyUsername(String proxyUsername) { +351this.proxyUsername = proxyUsername; +352 } +353/** +354 * The Proxy password. +355 */ +356private String proxyPassword; +357 +358/** +359 * Get the value of proxyPassword. +360 * +361 * @return the value of proxyPassword +362 */ +363public String getProxyPassword() { +364return proxyPassword; +365 } +366 +367/** +368 * Set the value of proxyPassword. +369 * +370 * @param proxyPassword new value of proxyPassword +371 */ +372publicvoid setProxyPassword(String proxyPassword) { +373this.proxyPassword = proxyPassword; +374 } +375/** +376 * The Connection Timeout. +377 */ +378private String connectionTimeout; +379 +380/** +381 * Get the value of connectionTimeout. +382 * +383 * @return the value of connectionTimeout +384 */ +385public String getConnectionTimeout() { +386return connectionTimeout; +387 } +388 +389/** +390 * Set the value of connectionTimeout. +391 * +392 * @param connectionTimeout new value of connectionTimeout +393 */ +394publicvoid setConnectionTimeout(String connectionTimeout) { +395this.connectionTimeout = connectionTimeout; +396 } +397/** +398 * The file path used for verbose logging. +399 */ +400private String logFile = null; +401 +402/** +403 * Get the value of logFile. +404 * +405 * @return the value of logFile +406 */ +407public String getLogFile() { +408return logFile; +409 } +410 +411/** +412 * Set the value of logFile. +413 * +414 * @param logFile new value of logFile +415 */ +416publicvoid setLogFile(String logFile) { +417this.logFile = logFile; +418 } +419/** +420 * The path to the suppression file. +421 */ +422private String suppressionFile; +423 +424/** +425 * Get the value of suppressionFile. +426 * +427 * @return the value of suppressionFile +428 */ +429public String getSuppressionFile() { +430return suppressionFile; +431 } +432 +433/** +434 * Set the value of suppressionFile. +435 * +436 * @param suppressionFile new value of suppressionFile +437 */ +438publicvoid setSuppressionFile(String suppressionFile) { +439this.suppressionFile = suppressionFile; +440 } +441/** +442 * flag indicating whether or not to show a summary of findings. +443 */ +444privateboolean showSummary = true; +445 +446/** +447 * Get the value of showSummary. +448 * +449 * @return the value of showSummary +450 */ +451publicboolean isShowSummary() { +452return showSummary; +453 } +454 +455/** +456 * Set the value of showSummary. +457 * +458 * @param showSummary new value of showSummary +459 */ +460publicvoid setShowSummary(boolean showSummary) { +461this.showSummary = showSummary; +462 } +463 +464/** +465 * Sets whether or not the analyzer is enabled. +466 * +467 * @param jarAnalyzerEnabled the value of the new setting +468 */ +469publicvoid setJarAnalyzerEnabled(boolean jarAnalyzerEnabled) { +470this.jarAnalyzerEnabled = jarAnalyzerEnabled; +471 } +472/** +473 * Whether or not the Archive Analyzer is enabled. +474 */ +475privateboolean archiveAnalyzerEnabled = true; +476 +477/** +478 * Returns whether or not the analyzer is enabled. +479 * +480 * @return true if the analyzer is enabled +481 */ +482publicboolean isArchiveAnalyzerEnabled() { +483return archiveAnalyzerEnabled; +484 } +485/** +486 * Whether or not the .NET Assembly Analyzer is enabled. +487 */ +488privateboolean assemblyAnalyzerEnabled = true; +489 +490/** +491 * Sets whether or not the analyzer is enabled. +492 * +493 * @param archiveAnalyzerEnabled the value of the new setting +494 */ +495publicvoid setArchiveAnalyzerEnabled(boolean archiveAnalyzerEnabled) { +496this.archiveAnalyzerEnabled = archiveAnalyzerEnabled; +497 } +498 +499/** +500 * Returns whether or not the analyzer is enabled. +501 * +502 * @return true if the analyzer is enabled +503 */ +504publicboolean isAssemblyAnalyzerEnabled() { +505return assemblyAnalyzerEnabled; +506 } +507 +508/** +509 * Sets whether or not the analyzer is enabled. +510 * +511 * @param assemblyAnalyzerEnabled the value of the new setting +512 */ +513publicvoid setAssemblyAnalyzerEnabled(boolean assemblyAnalyzerEnabled) { +514this.assemblyAnalyzerEnabled = assemblyAnalyzerEnabled; +515 } +516/** +517 * Whether or not the .NET Nuspec Analyzer is enabled. +518 */ +519privateboolean nuspecAnalyzerEnabled = true; +520 +521/** +522 * Returns whether or not the analyzer is enabled. +523 * +524 * @return true if the analyzer is enabled +525 */ +526publicboolean isNuspecAnalyzerEnabled() { +527return nuspecAnalyzerEnabled; +528 } +529 +530/** +531 * Sets whether or not the analyzer is enabled. +532 * +533 * @param nuspecAnalyzerEnabled the value of the new setting +534 */ +535publicvoid setNuspecAnalyzerEnabled(boolean nuspecAnalyzerEnabled) { +536this.nuspecAnalyzerEnabled = nuspecAnalyzerEnabled; +537 } +538 +539/** +540 * Whether or not the nexus analyzer is enabled. +541 */ +542privateboolean nexusAnalyzerEnabled = true; +543 +544/** +545 * Get the value of nexusAnalyzerEnabled. +546 * +547 * @return the value of nexusAnalyzerEnabled +548 */ +549publicboolean isNexusAnalyzerEnabled() { +550return nexusAnalyzerEnabled; +551 } +552 +553/** +554 * Set the value of nexusAnalyzerEnabled. +555 * +556 * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled +557 */ +558publicvoid setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) { +559this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; +560 } +561 +562/** +563 * The URL of the Nexus server. +564 */ +565private String nexusUrl; +566 +567/** +568 * Get the value of nexusUrl. +569 * +570 * @return the value of nexusUrl +571 */ +572public String getNexusUrl() { +573return nexusUrl; +574 } +575 +576/** +577 * Set the value of nexusUrl. +578 * +579 * @param nexusUrl new value of nexusUrl +580 */ +581publicvoid setNexusUrl(String nexusUrl) { +582this.nexusUrl = nexusUrl; +583 } +584/** +585 * Whether or not the defined proxy should be used when connecting to Nexus. +586 */ +587privateboolean nexusUsesProxy = true; +588 +589/** +590 * Get the value of nexusUsesProxy. +591 * +592 * @return the value of nexusUsesProxy +593 */ +594publicboolean isNexusUsesProxy() { +595return nexusUsesProxy; +596 } +597 +598/** +599 * Set the value of nexusUsesProxy. +600 * +601 * @param nexusUsesProxy new value of nexusUsesProxy +602 */ +603publicvoid setNexusUsesProxy(boolean nexusUsesProxy) { +604this.nexusUsesProxy = nexusUsesProxy; +605 } +606 +607/** +608 * The database driver name; such as org.h2.Driver. +609 */ +610private String databaseDriverName; +611 +612/** +613 * Get the value of databaseDriverName. +614 * +615 * @return the value of databaseDriverName +616 */ +617public String getDatabaseDriverName() { +618return databaseDriverName; +619 } +620 +621/** +622 * Set the value of databaseDriverName. +623 * +624 * @param databaseDriverName new value of databaseDriverName +625 */ +626publicvoid setDatabaseDriverName(String databaseDriverName) { +627this.databaseDriverName = databaseDriverName; +628 } +629 +630/** +631 * The path to the database driver JAR file if it is not on the class path. +632 */ +633private String databaseDriverPath; +634 +635/** +636 * Get the value of databaseDriverPath. +637 * +638 * @return the value of databaseDriverPath +639 */ +640public String getDatabaseDriverPath() { +641return databaseDriverPath; +642 } +643 +644/** +645 * Set the value of databaseDriverPath. +646 * +647 * @param databaseDriverPath new value of databaseDriverPath +648 */ +649publicvoid setDatabaseDriverPath(String databaseDriverPath) { +650this.databaseDriverPath = databaseDriverPath; +651 } +652/** +653 * The database connection string. +654 */ +655private String connectionString; +656 +657/** +658 * Get the value of connectionString. +659 * +660 * @return the value of connectionString +661 */ +662public String getConnectionString() { +663return connectionString; +664 } +665 +666/** +667 * Set the value of connectionString. +668 * +669 * @param connectionString new value of connectionString +670 */ +671publicvoid setConnectionString(String connectionString) { +672this.connectionString = connectionString; +673 } +674/** +675 * The user name for connecting to the database. +676 */ +677private String databaseUser; +678 +679/** +680 * Get the value of databaseUser. +681 * +682 * @return the value of databaseUser +683 */ +684public String getDatabaseUser() { +685return databaseUser; +686 } +687 +688/** +689 * Set the value of databaseUser. +690 * +691 * @param databaseUser new value of databaseUser +692 */ +693publicvoid setDatabaseUser(String databaseUser) { +694this.databaseUser = databaseUser; +695 } +696 +697/** +698 * The password to use when connecting to the database. +699 */ +700private String databasePassword; +701 +702/** +703 * Get the value of databasePassword. +704 * +705 * @return the value of databasePassword +706 */ +707public String getDatabasePassword() { +708return databasePassword; +709 } +710 +711/** +712 * Set the value of databasePassword. +713 * +714 * @param databasePassword new value of databasePassword +715 */ +716publicvoid setDatabasePassword(String databasePassword) { +717this.databasePassword = databasePassword; +718 } +719 +720/** +721 * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat +722 * like ZIP files. +723 */ +724private String zipExtensions; +725 +726/** +727 * Get the value of zipExtensions. +728 * +729 * @return the value of zipExtensions +730 */ +731public String getZipExtensions() { +732return zipExtensions; +733 } +734 +735/** +736 * Set the value of zipExtensions. +737 * +738 * @param zipExtensions new value of zipExtensions +739 */ +740publicvoid setZipExtensions(String zipExtensions) { +741this.zipExtensions = zipExtensions; +742 } +743 +744/** +745 * The url for the modified NVD CVE (1.2 schema). +746 */ +747private String cveUrl12Modified; +748 +749/** +750 * Get the value of cveUrl12Modified. +751 * +752 * @return the value of cveUrl12Modified +753 */ +754public String getCveUrl12Modified() { +755return cveUrl12Modified; +756 } +757 +758/** +759 * Set the value of cveUrl12Modified. +760 * +761 * @param cveUrl12Modified new value of cveUrl12Modified +762 */ +763publicvoid setCveUrl12Modified(String cveUrl12Modified) { +764this.cveUrl12Modified = cveUrl12Modified; +765 } +766 +767/** +768 * The url for the modified NVD CVE (2.0 schema). +769 */ +770private String cveUrl20Modified; +771 +772/** +773 * Get the value of cveUrl20Modified. +774 * +775 * @return the value of cveUrl20Modified +776 */ +777public String getCveUrl20Modified() { +778return cveUrl20Modified; +779 } +780 +781/** +782 * Set the value of cveUrl20Modified. +783 * +784 * @param cveUrl20Modified new value of cveUrl20Modified +785 */ +786publicvoid setCveUrl20Modified(String cveUrl20Modified) { +787this.cveUrl20Modified = cveUrl20Modified; +788 } +789 +790/** +791 * Base Data Mirror URL for CVE 1.2. +792 */ +793private String cveUrl12Base; +794 +795/** +796 * Get the value of cveUrl12Base. +797 * +798 * @return the value of cveUrl12Base +799 */ +800public String getCveUrl12Base() { +801return cveUrl12Base; +802 } +803 +804/** +805 * Set the value of cveUrl12Base. +806 * +807 * @param cveUrl12Base new value of cveUrl12Base +808 */ +809publicvoid setCveUrl12Base(String cveUrl12Base) { +810this.cveUrl12Base = cveUrl12Base; +811 } +812 +813/** +814 * Data Mirror URL for CVE 2.0. +815 */ +816private String cveUrl20Base; +817 +818/** +819 * Get the value of cveUrl20Base. +820 * +821 * @return the value of cveUrl20Base +822 */ +823public String getCveUrl20Base() { +824return cveUrl20Base; +825 } +826 +827/** +828 * Set the value of cveUrl20Base. +829 * +830 * @param cveUrl20Base new value of cveUrl20Base +831 */ +832publicvoid setCveUrl20Base(String cveUrl20Base) { +833this.cveUrl20Base = cveUrl20Base; +834 } +835/** +836 * The path to Mono for .NET assembly analysis on non-windows systems. +837 */ +838private String pathToMono; +839 +840/** +841 * Get the value of pathToMono. +842 * +843 * @return the value of pathToMono +844 */ +845public String getPathToMono() { +846return pathToMono; +847 } +848 +849/** +850 * Set the value of pathToMono. +851 * +852 * @param pathToMono new value of pathToMono +853 */ +854publicvoid setPathToMono(String pathToMono) { +855this.pathToMono = pathToMono; +856 } +857 +858 @Override +859publicvoid execute() throws BuildException { +860final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +861 LogUtils.prepareLogger(in, logFile); 862 -863 Engine engine = null; -864try { -865 engine = new Engine(); +863 dealWithReferences(); +864 validateConfiguration(); +865 populateSettings(); 866 -867for (Resource resource : path) { -868final FileProvider provider = resource.as(FileProvider.class); -869if (provider != null) { -870final File file = provider.getFile(); -871if (file != null && file.exists()) { -872 engine.scan(file); -873 } -874 } -875 } -876try { -877 engine.analyzeDependencies(); -878 DatabaseProperties prop = null; -879 CveDB cve = null; -880try { -881 cve = new CveDB(); -882 cve.open(); -883 prop = cve.getDatabaseProperties(); -884 } catch (DatabaseException ex) { -885 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); -886 } finally { -887if (cve != null) { -888 cve.close(); -889 } -890 } -891final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop); -892 reporter.generateReports(reportOutputDirectory, reportFormat); -893 -894if (this.failBuildOnCVSS <= 10) { -895 checkForFailure(engine.getDependencies()); -896 } -897if (this.showSummary) { -898 showSummary(engine.getDependencies()); -899 } -900 } catch (IOException ex) { -901 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, -902"Unable to generate dependency-check report", ex); -903thrownew BuildException("Unable to generate dependency-check report", ex); -904 } catch (Exception ex) { -905 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, -906"An exception occurred; unable to continue task", ex); -907thrownew BuildException("An exception occurred; unable to continue task", ex); -908 } -909 } catch (DatabaseException ex) { -910 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.SEVERE, -911"Unable to connect to the dependency-check database; analysis has stopped"); -912 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "", ex); -913 } finally { -914if (engine != null) { -915 engine.cleanup(); -916 } -917 } -918 } -919 -920/** -921 * Validate the configuration to ensure the parameters have been properly configured/initialized. -922 * -923 * @throws BuildException if the task was not configured correctly. -924 */ -925privatevoid validateConfiguration() throws BuildException { -926if (path == null) { -927thrownew BuildException("No project dependencies have been defined to analyze."); -928 } -929if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) { -930thrownew BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11."); -931 } -932 } -933 -934/** -935 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system -936 * properties required to change the proxy url, port, and connection timeout. -937 */ -938privatevoid populateSettings() { -939 InputStream taskProperties = null; -940try { -941 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -942 Settings.mergeProperties(taskProperties); -943 } catch (IOException ex) { -944 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); -945 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex); -946 } finally { -947if (taskProperties != null) { -948try { -949 taskProperties.close(); -950 } catch (IOException ex) { -951 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex); -952 } -953 } -954 } -955if (dataDirectory != null) { -956 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -957 } else { -958final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath()); -959final File base = jarPath.getParentFile(); -960final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); -961final File dataDir = new File(base, sub); -962 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -963 } -964 -965 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -966 -967if (proxyUrl != null && !proxyUrl.isEmpty()) { -968 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); -969 } -970if (proxyPort != null && !proxyPort.isEmpty()) { -971 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +867 Engine engine = null; +868try { +869 engine = new Engine(); +870 +871for (Resource resource : path) { +872final FileProvider provider = resource.as(FileProvider.class); +873if (provider != null) { +874final File file = provider.getFile(); +875if (file != null && file.exists()) { +876 engine.scan(file); +877 } +878 } +879 } +880try { +881 engine.analyzeDependencies(); +882 DatabaseProperties prop = null; +883 CveDB cve = null; +884try { +885 cve = new CveDB(); +886 cve.open(); +887 prop = cve.getDatabaseProperties(); +888 } catch (DatabaseException ex) { +889 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex); +890 } finally { +891if (cve != null) { +892 cve.close(); +893 } +894 } +895final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop); +896 reporter.generateReports(reportOutputDirectory, reportFormat); +897 +898if (this.failBuildOnCVSS <= 10) { +899 checkForFailure(engine.getDependencies()); +900 } +901if (this.showSummary) { +902 showSummary(engine.getDependencies()); +903 } +904 } catch (IOException ex) { +905 LOGGER.log(Level.FINE, "Unable to generate dependency-check report", ex); +906thrownew BuildException("Unable to generate dependency-check report", ex); +907 } catch (Exception ex) { +908 LOGGER.log(Level.FINE, "An exception occurred; unable to continue task", ex); +909thrownew BuildException("An exception occurred; unable to continue task", ex); +910 } +911 } catch (DatabaseException ex) { +912 LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped"); +913 LOGGER.log(Level.FINE, "", ex); +914 } finally { +915 Settings.cleanup(); +916if (engine != null) { +917 engine.cleanup(); +918 } +919 } +920 } +921 +922/** +923 * Validate the configuration to ensure the parameters have been properly configured/initialized. +924 * +925 * @throws BuildException if the task was not configured correctly. +926 */ +927privatevoid validateConfiguration() throws BuildException { +928if (path == null) { +929thrownew BuildException("No project dependencies have been defined to analyze."); +930 } +931if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) { +932thrownew BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11."); +933 } +934 } +935 +936/** +937 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system +938 * properties required to change the proxy url, port, and connection timeout. +939 */ +940privatevoid populateSettings() { +941 Settings.initialize(); +942 InputStream taskProperties = null; +943try { +944 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +945 Settings.mergeProperties(taskProperties); +946 } catch (IOException ex) { +947 LOGGER.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); +948 LOGGER.log(Level.FINE, null, ex); +949 } finally { +950if (taskProperties != null) { +951try { +952 taskProperties.close(); +953 } catch (IOException ex) { +954 LOGGER.log(Level.FINEST, null, ex); +955 } +956 } +957 } +958if (dataDirectory != null) { +959 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +960 } else { +961final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath()); +962final File base = jarPath.getParentFile(); +963final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); +964final File dataDir = new File(base, sub); +965 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +966 } +967 +968 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +969 +970if (proxyUrl != null && !proxyUrl.isEmpty()) { +971 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); 972 } -973if (proxyUsername != null && !proxyUsername.isEmpty()) { -974 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); +973if (proxyPort != null && !proxyPort.isEmpty()) { +974 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); 975 } -976if (proxyPassword != null && !proxyPassword.isEmpty()) { -977 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); +976if (proxyUsername != null && !proxyUsername.isEmpty()) { +977 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); 978 } -979if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -980 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +979if (proxyPassword != null && !proxyPassword.isEmpty()) { +980 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); 981 } -982if (suppressionFile != null && !suppressionFile.isEmpty()) { -983 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +982if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +983 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); 984 } -985 -986//File Type Analyzer Settings -987//JAR ANALYZER -988 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled); -989//NUSPEC ANALYZER -990 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled); -991//NEXUS ANALYZER -992 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); -993if (nexusUrl != null && !nexusUrl.isEmpty()) { -994 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); -995 } -996 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); -997//ARCHIVE ANALYZER -998 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled); -999if (zipExtensions != null && !zipExtensions.isEmpty()) { -1000 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); -1001 } -1002//ASSEMBLY ANALYZER -1003 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled); -1004if (pathToMono != null && !pathToMono.isEmpty()) { -1005 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); -1006 } -1007 -1008if (databaseDriverName != null && !databaseDriverName.isEmpty()) { -1009 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); -1010 } -1011if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { -1012 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +985if (suppressionFile != null && !suppressionFile.isEmpty()) { +986 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +987 } +988 +989//File Type Analyzer Settings +990//JAR ANALYZER +991 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled); +992//NUSPEC ANALYZER +993 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled); +994//NEXUS ANALYZER +995 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); +996if (nexusUrl != null && !nexusUrl.isEmpty()) { +997 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +998 } +999 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); +1000//ARCHIVE ANALYZER +1001 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled); +1002if (zipExtensions != null && !zipExtensions.isEmpty()) { +1003 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); +1004 } +1005//ASSEMBLY ANALYZER +1006 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled); +1007if (pathToMono != null && !pathToMono.isEmpty()) { +1008 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); +1009 } +1010 +1011if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +1012 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); 1013 } -1014if (connectionString != null && !connectionString.isEmpty()) { -1015 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +1014if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +1015 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); 1016 } -1017if (databaseUser != null && !databaseUser.isEmpty()) { -1018 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +1017if (connectionString != null && !connectionString.isEmpty()) { +1018 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); 1019 } -1020if (databasePassword != null && !databasePassword.isEmpty()) { -1021 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +1020if (databaseUser != null && !databaseUser.isEmpty()) { +1021 Settings.setString(Settings.KEYS.DB_USER, databaseUser); 1022 } -1023if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { -1024 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); +1023if (databasePassword != null && !databasePassword.isEmpty()) { +1024 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); 1025 } -1026if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { -1027 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); +1026if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { +1027 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); 1028 } -1029if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { -1030 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); +1029if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { +1030 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); 1031 } -1032if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { -1033 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); +1032if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { +1033 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); 1034 } -1035 } -1036 -1037/** -1038 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the -1039 * configuration. -1040 * -1041 * @param dependencies the list of dependency objects -1042 * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set -1043 */ -1044privatevoid checkForFailure(List<Dependency> dependencies) throws BuildException { -1045final StringBuilder ids = new StringBuilder(); -1046for (Dependency d : dependencies) { -1047for (Vulnerability v : d.getVulnerabilities()) { -1048if (v.getCvssScore() >= failBuildOnCVSS) { -1049if (ids.length() == 0) { -1050 ids.append(v.getName()); -1051 } else { -1052 ids.append(", ").append(v.getName()); -1053 } -1054 } -1055 } -1056 } -1057if (ids.length() > 0) { -1058final String msg = String.format("%n%nDependency-Check Failure:%n" -1059 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" -1060 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); -1061thrownew BuildException(msg); -1062 } -1063 } -1064 -1065/** -1066 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. -1067 * -1068 * @param dependencies a list of dependency objects -1069 */ -1070privatevoid showSummary(List<Dependency> dependencies) { -1071final StringBuilder summary = new StringBuilder(); -1072for (Dependency d : dependencies) { -1073boolean firstEntry = true; -1074final StringBuilder ids = new StringBuilder(); -1075for (Vulnerability v : d.getVulnerabilities()) { -1076if (firstEntry) { -1077 firstEntry = false; -1078 } else { -1079 ids.append(", "); -1080 } -1081 ids.append(v.getName()); -1082 } -1083if (ids.length() > 0) { -1084 summary.append(d.getFileName()).append(" ("); -1085 firstEntry = true; -1086for (Identifier id : d.getIdentifiers()) { -1087if (firstEntry) { -1088 firstEntry = false; -1089 } else { -1090 summary.append(", "); -1091 } -1092 summary.append(id.getValue()); -1093 } -1094 summary.append(") : ").append(ids).append(NEW_LINE); -1095 } -1096 } -1097if (summary.length() > 0) { -1098final String msg = String.format("%n%n" -1099 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" -1100 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); -1101 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, msg); -1102 } -1103 } -1104 -1105/** -1106 * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc.. -1107 */ -1108publicstaticclassReportFormatsextends EnumeratedAttribute { -1109 -1110/** -1111 * Returns the list of values for the report format. -1112 * -1113 * @return the list of values for the report format -1114 */ -1115 @Override -1116public String[] getValues() { -1117int i = 0; -1118final Format[] formats = Format.values(); -1119final String[] values = new String[formats.length]; -1120for (Format format : formats) { -1121 values[i++] = format.name(); -1122 } -1123return values; -1124 } -1125 } -1126 -1127/** -1128 * Whether or not the Jar Analyzer is enabled. -1129 */ -1130privateboolean jarAnalyzerEnabled = true; -1131 -1132/** -1133 * Returns whether or not the analyzer is enabled. -1134 * -1135 * @return true if the analyzer is enabled -1136 */ -1137publicboolean isJarAnalyzerEnabled() { -1138return jarAnalyzerEnabled; -1139 } -1140 } +1035if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { +1036 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); +1037 } +1038 } +1039 +1040/** +1041 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the +1042 * configuration. +1043 * +1044 * @param dependencies the list of dependency objects +1045 * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set +1046 */ +1047privatevoid checkForFailure(List<Dependency> dependencies) throws BuildException { +1048final StringBuilder ids = new StringBuilder(); +1049for (Dependency d : dependencies) { +1050for (Vulnerability v : d.getVulnerabilities()) { +1051if (v.getCvssScore() >= failBuildOnCVSS) { +1052if (ids.length() == 0) { +1053 ids.append(v.getName()); +1054 } else { +1055 ids.append(", ").append(v.getName()); +1056 } +1057 } +1058 } +1059 } +1060if (ids.length() > 0) { +1061final String msg = String.format("%n%nDependency-Check Failure:%n" +1062 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" +1063 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); +1064thrownew BuildException(msg); +1065 } +1066 } +1067 +1068/** +1069 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. +1070 * +1071 * @param dependencies a list of dependency objects +1072 */ +1073privatevoid showSummary(List<Dependency> dependencies) { +1074final StringBuilder summary = new StringBuilder(); +1075for (Dependency d : dependencies) { +1076boolean firstEntry = true; +1077final StringBuilder ids = new StringBuilder(); +1078for (Vulnerability v : d.getVulnerabilities()) { +1079if (firstEntry) { +1080 firstEntry = false; +1081 } else { +1082 ids.append(", "); +1083 } +1084 ids.append(v.getName()); +1085 } +1086if (ids.length() > 0) { +1087 summary.append(d.getFileName()).append(" ("); +1088 firstEntry = true; +1089for (Identifier id : d.getIdentifiers()) { +1090if (firstEntry) { +1091 firstEntry = false; +1092 } else { +1093 summary.append(", "); +1094 } +1095 summary.append(id.getValue()); +1096 } +1097 summary.append(") : ").append(ids).append(NEW_LINE); +1098 } +1099 } +1100if (summary.length() > 0) { +1101final String msg = String.format("%n%n" +1102 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" +1103 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); +1104 LOGGER.log(Level.WARNING, msg); +1105 } +1106 } +1107 +1108/** +1109 * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc.. +1110 */ +1111publicstaticclassReportFormatsextends EnumeratedAttribute { +1112 +1113/** +1114 * Returns the list of values for the report format. +1115 * +1116 * @return the list of values for the report format +1117 */ +1118 @Override +1119public String[] getValues() { +1120int i = 0; +1121final Format[] formats = Format.values(); +1122final String[] values = new String[formats.length]; +1123for (Format format : formats) { +1124 values[i++] = format.name(); +1125 } +1126return values; +1127 } +1128 } +1129 +1130/** +1131 * Whether or not the Jar Analyzer is enabled. +1132 */ +1133privateboolean jarAnalyzerEnabled = true; +1134 +1135/** +1136 * Returns whether or not the analyzer is enabled. +1137 * +1138 * @return true if the analyzer is enabled +1139 */ +1140publicboolean isJarAnalyzerEnabled() { +1141return jarAnalyzerEnabled; +1142 } +1143 }
    diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html index d36dd8664..e5d2840d1 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html index 0ad35c704..83ac45380 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.2.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref/overview-frame.html b/dependency-check-ant/xref/overview-frame.html index 601132b09..377e72d38 100644 --- a/dependency-check-ant/xref/overview-frame.html +++ b/dependency-check-ant/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference + Dependency-Check Ant Task 1.2.0 Reference diff --git a/dependency-check-ant/xref/overview-summary.html b/dependency-check-ant/xref/overview-summary.html index 20803f01b..3485f867f 100644 --- a/dependency-check-ant/xref/overview-summary.html +++ b/dependency-check-ant/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.1.4 Reference + Dependency-Check Ant Task 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Ant Task 1.1.4 Reference

    +

    Dependency-Check Ant Task 1.2.0 Reference

    diff --git a/dependency-check-cli/apidocs/allclasses-frame.html b/dependency-check-cli/apidocs/allclasses-frame.html index 0911e8b95..ee5ce0c9a 100644 --- a/dependency-check-cli/apidocs/allclasses-frame.html +++ b/dependency-check-cli/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Command Line 1.1.4 API) - +All Classes (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/allclasses-noframe.html b/dependency-check-cli/apidocs/allclasses-noframe.html index 6738571ea..57d0df867 100644 --- a/dependency-check-cli/apidocs/allclasses-noframe.html +++ b/dependency-check-cli/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Command Line 1.1.4 API) - +All Classes (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/constant-values.html b/dependency-check-cli/apidocs/constant-values.html index 1b06d4589..82c8c01b2 100644 --- a/dependency-check-cli/apidocs/constant-values.html +++ b/dependency-check-cli/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Command Line 1.1.4 API) - +Constant Field Values (Dependency-Check Command Line 1.2.0 API) + @@ -358,10 +358,10 @@ - - + diff --git a/dependency-check-cli/apidocs/deprecated-list.html b/dependency-check-cli/apidocs/deprecated-list.html index b52cad105..931ece1e2 100644 --- a/dependency-check-cli/apidocs/deprecated-list.html +++ b/dependency-check-cli/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Command Line 1.1.4 API) - +Deprecated List (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/help-doc.html b/dependency-check-cli/apidocs/help-doc.html index b84cc5801..d3d50d3a9 100644 --- a/dependency-check-cli/apidocs/help-doc.html +++ b/dependency-check-cli/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Command Line 1.1.4 API) - +API Help (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/index-all.html b/dependency-check-cli/apidocs/index-all.html index cbc733d4f..07389cd34 100644 --- a/dependency-check-cli/apidocs/index-all.html +++ b/dependency-check-cli/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Command Line 1.1.4 API) - +Index (Dependency-Check Command Line 1.2.0 API) + @@ -474,7 +474,7 @@
    The short CLI argument name specifying the directory/file to scan.
    -
    SUPPRESION_FILE - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    SUPPRESSION_FILE - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    The CLI argument name for setting the location of the suppression file.
    diff --git a/dependency-check-cli/apidocs/index.html b/dependency-check-cli/apidocs/index.html index 952c12412..4359686f2 100644 --- a/dependency-check-cli/apidocs/index.html +++ b/dependency-check-cli/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Command Line 1.1.4 API +Dependency-Check Command Line 1.2.0 API diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html index be460ccc7..3ea131be6 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.App (Dependency-Check Command Line 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.App (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html index a9f98a653..325ed607a 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html @@ -2,16 +2,16 @@ - + -CliParser.ArgumentName (Dependency-Check Command Line 1.1.4 API) - +CliParser.ArgumentName (Dependency-Check Command Line 1.2.0 API) + @@ -358,7 +358,7 @@ extends - @@ -752,15 +752,15 @@ extends See Also:
    Constant Field Values
    - + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html index 054e94b12..c4d76071e 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html @@ -2,16 +2,16 @@ - + -CliParser (Dependency-Check Command Line 1.1.4 API) - +CliParser (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html index 429cb0d16..68eb88420 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.cli.CliParser.ArgumentName (Dependency-Check Command Line 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.cli.CliParser.ArgumentName (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html index 0bf16e258..7bd9650db 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.cli.CliParser (Dependency-Check Command Line 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.cli.CliParser (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html index d6bb30f78..a1f91a19f 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.1.4 API) - +org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html index 25be94367..3a2805de8 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.1.4 API) - +org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html index a32c0c604..7d2cd9e0c 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.cli Class Hierarchy (Dependency-Check Command Line 1.1.4 API) - +org.owasp.dependencycheck.cli Class Hierarchy (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html index db4d3599d..a782f8ea9 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.1.4 API) - +Uses of Package org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html index 5379bdfef..dc4acc942 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck (Dependency-Check Command Line 1.1.4 API) - +org.owasp.dependencycheck (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html index 505af18af..22c8a03f7 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck (Dependency-Check Command Line 1.1.4 API) - +org.owasp.dependencycheck (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html index ebb7a59ce..fc8995399 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck Class Hierarchy (Dependency-Check Command Line 1.1.4 API) - +org.owasp.dependencycheck Class Hierarchy (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html index 9ab32b6b5..a195896ab 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck (Dependency-Check Command Line 1.1.4 API) - +Uses of Package org.owasp.dependencycheck (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/overview-frame.html b/dependency-check-cli/apidocs/overview-frame.html index d1b6bf57b..41ed0f333 100644 --- a/dependency-check-cli/apidocs/overview-frame.html +++ b/dependency-check-cli/apidocs/overview-frame.html @@ -2,10 +2,10 @@ - + -Overview List (Dependency-Check Command Line 1.1.4 API) - +Overview List (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/apidocs/overview-summary.html b/dependency-check-cli/apidocs/overview-summary.html index 5e407535e..1378a81a5 100644 --- a/dependency-check-cli/apidocs/overview-summary.html +++ b/dependency-check-cli/apidocs/overview-summary.html @@ -2,16 +2,16 @@ - + -Overview (Dependency-Check Command Line 1.1.4 API) - +Overview (Dependency-Check Command Line 1.2.0 API) + @@ -64,7 +64,7 @@
    -

    Dependency-Check Command Line 1.1.4 API

    +

    Dependency-Check Command Line 1.2.0 API

    "s"
    + public static final StringSUPPRESION_FILESUPPRESSION_FILE "suppression"
    static StringSUPPRESION_FILE +SUPPRESSION_FILE
    The CLI argument name for setting the location of the suppression file.
    diff --git a/dependency-check-cli/apidocs/overview-tree.html b/dependency-check-cli/apidocs/overview-tree.html index 6102d597d..10d0a0b5e 100644 --- a/dependency-check-cli/apidocs/overview-tree.html +++ b/dependency-check-cli/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Command Line 1.1.4 API) - +Class Hierarchy (Dependency-Check Command Line 1.2.0 API) + diff --git a/dependency-check-cli/arguments.html b/dependency-check-cli/arguments.html index 3e157b8a1..53cf9ddcb 100644 --- a/dependency-check-cli/arguments.html +++ b/dependency-check-cli/arguments.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Command Line Arguments @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -103,7 +103,7 @@ Project Information - +
  • diff --git a/dependency-check-cli/checkstyle.html b/dependency-check-cli/checkstyle.html index 3f14d1818..7d01089b1 100644 --- a/dependency-check-cli/checkstyle.html +++ b/dependency-check-cli/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Checkstyle Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -176,16 +176,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • diff --git a/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html b/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html index ac8ef5ddd..45a317b79 100644 --- a/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html +++ b/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.cli
  • - +
    CliParser (0%)CliParser (65%)
    diff --git a/dependency-check-cli/cobertura/frame-sourcefiles.html b/dependency-check-cli/cobertura/frame-sourcefiles.html index c854a9a55..df9a7066f 100644 --- a/dependency-check-cli/cobertura/frame-sourcefiles.html +++ b/dependency-check-cli/cobertura/frame-sourcefiles.html @@ -18,7 +18,7 @@ All Packages App (0%) -CliParser (0%) +CliParser (65%) diff --git a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html index cc6e891f6..2929c7d91 100644 --- a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html +++ b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.cli2
    0%
    0/124
    0%
    0/68
    1.829
    org.owasp.dependencycheck.cli2
    65%
    81/124
    39%
    27/68
    1.829
    - + diff --git a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html index 35047cec9..9a93c65b8 100644 --- a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html +++ b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck1
    0%
    0/134
    0%
    0/90
    12.5
    org.owasp.dependencycheck.cli2
    0%
    0/124
    0%
    0/68
    1.829
    org.owasp.dependencycheck1
    0%
    0/137
    0%
    0/90
    12.5
    org.owasp.dependencycheck.cli2
    65%
    81/124
    39%
    27/68
    1.829
    - + diff --git a/dependency-check-cli/cobertura/frame-summary.html b/dependency-check-cli/cobertura/frame-summary.html index 8e6809233..9cf8b8c7b 100644 --- a/dependency-check-cli/cobertura/frame-summary.html +++ b/dependency-check-cli/cobertura/frame-summary.html @@ -16,9 +16,9 @@ - - - + + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages3
    0%
    0/258
    0%
    0/158
    2.778
    org.owasp.dependencycheck1
    0%
    0/134
    0%
    0/90
    12.5
    org.owasp.dependencycheck.cli2
    0%
    0/124
    0%
    0/68
    1.829
    All Packages3
    31%
    81/261
    17%
    27/158
    2.778
    org.owasp.dependencycheck1
    0%
    0/137
    0%
    0/90
    12.5
    org.owasp.dependencycheck.cli2
    65%
    81/124
    39%
    27/68
    1.829
    - + diff --git a/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html b/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html index 147a0a05c..9054d639d 100644 --- a/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html +++ b/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    App
    0%
    0/134
    0%
    0/90
    12.5
    App
    0%
    0/137
    0%
    0/90
    12.5
     
    @@ -116,289 +116,302 @@  49  
         /**
     50   -
          * The main method for the application.
    +
          * The logger.
     51   -
          *
    -  52   -
          * @param args the command line arguments
    +
          */
    +  52  0
         private static final Logger LOGGER = Logger.getLogger(App.class.getName());
     53   -
          */
    +
     
     54   -
         public static void main(String[] args) {
    -  55  0
             final App app = new App();
    -  56  0
             app.run(args);
    -  57  0
         }
    -  58   -
     
    -  59  
         /**
    -  60   -
          * Main CLI entry-point into the application.
    -  61   +  55   +
          * The main method for the application.
    +  56  
          *
    -  62   +  57  
          * @param args the command line arguments
    +  58   +
          */
    +  59   +
         public static void main(String[] args) {
    +  60  0
             final App app = new App();
    +  61  0
             app.run(args);
    +  62  0
         }
     63   -
          */
    +
     
     64   -
         public void run(String[] args) {
    +
         /**
     65   -
     
    -  66  0
             final CliParser cli = new CliParser();
    +
          * Main CLI entry-point into the application.
    +  66   +
          *
     67   +
          * @param args the command line arguments
    +  68   +
          */
    +  69   +
         public void run(String[] args) {
    +  70   +
     
    +  71  0
             final CliParser cli = new CliParser();
    +  72  
             try {
    -  68  0
                 cli.parse(args);
    -  69  0
             } catch (FileNotFoundException ex) {
    -  70  0
                 System.err.println(ex.getMessage());
    -  71  0
                 cli.printHelp();
    -  72  0
                 return;
    -  73  0
             } catch (ParseException ex) {
    -  74  0
                 System.err.println(ex.getMessage());
    -  75  0
                 cli.printHelp();
    -  76  0
                 return;
    -  77  0
             }
    -  78   +  73  0
                 cli.parse(args);
    +  74  0
             } catch (FileNotFoundException ex) {
    +  75  0
                 System.err.println(ex.getMessage());
    +  76  0
                 cli.printHelp();
    +  77  0
                 return;
    +  78  0
             } catch (ParseException ex) {
    +  79  0
                 System.err.println(ex.getMessage());
    +  80  0
                 cli.printHelp();
    +  81  0
                 return;
    +  82  0
             }
    +  83  
     
    -  79  0
             final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  80  0
             LogUtils.prepareLogger(in, cli.getVerboseLog());
    -  81   -
     
    -  82  0
             if (cli.isGetVersion()) {
    -  83  0
                 cli.printVersionInfo();
    -  84  0
             } else if (cli.isRunScan()) {
    -  85  0
                 updateSettings(cli);
    -  86  0
                 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles());
    -  87   -
             } else {
    -  88  0
                 cli.printHelp();
    -  89   -
             }
    -  90  0
         }
    -  91   +  84  0
             final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  85  0
             LogUtils.prepareLogger(in, cli.getVerboseLog());
    +  86  
     
    +  87  0
             if (cli.isGetVersion()) {
    +  88  0
                 cli.printVersionInfo();
    +  89  0
             } else if (cli.isRunScan()) {
    +  90  0
                 populateSettings(cli);
    +  91  0
                 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles());
     92   -
         /**
    -  93   -
          * Scans the specified directories and writes the dependency reports to the reportDirectory.
    +
             } else {
    +  93  0
                 cli.printHelp();
     94   -
          *
    -  95   -
          * @param reportDirectory the path to the directory where the reports will be written
    +
             }
    +  95  0
         }
     96   -
          * @param outputFormat the output format of the report
    +
     
     97   -
          * @param applicationName the application name for the report
    -  98   -
          * @param files the files/directories to scan
    -  99   -
          */
    -  100   -
         private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) {
    -  101  0
             Engine scanner = null;
    -  102   -
             try {
    -  103  0
                 scanner = new Engine();
    -  104   -
     
    -  105  0
                 for (String file : files) {
    -  106  0
                     scanner.scan(file);
    -  107   -
                 }
    -  108   -
     
    -  109  0
                 scanner.analyzeDependencies();
    -  110  0
                 final List<Dependency> dependencies = scanner.getDependencies();
    -  111  0
                 DatabaseProperties prop = null;
    -  112  0
                 CveDB cve = null;
    -  113   -
                 try {
    -  114  0
                     cve = new CveDB();
    -  115  0
                     cve.open();
    -  116  0
                     prop = cve.getDatabaseProperties();
    -  117  0
                 } catch (DatabaseException ex) {
    -  118  0
                     Logger.getLogger(App.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex);
    -  119   -
                 } finally {
    -  120  0
                     if (cve != null) {
    -  121  0
                         cve.close();
    -  122   -
                     }
    -  123   -
                 }
    -  124  0
                 final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop);
    -  125   -
                 try {
    -  126  0
                     report.generateReports(reportDirectory, outputFormat);
    -  127  0
                 } catch (IOException ex) {
    -  128  0
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an IO error while attempting to generate the report.");
    -  129  0
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    -  130  0
                 } catch (Throwable ex) {
    -  131  0
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an error while attempting to generate the report.");
    -  132  0
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    -  133  0
                 }
    -  134  0
             } catch (DatabaseException ex) {
    -  135  0
                 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
    -  136  0
                 Logger.getLogger(App.class.getName()).log(Level.FINE, "", ex);
    -  137   -
             } finally {
    -  138  0
                 if (scanner != null) {
    -  139  0
                     scanner.cleanup();
    -  140   -
                 }
    -  141   -
             }
    -  142  0
         }
    -  143   -
     
    -  144  
         /**
    -  145   -
          * Updates the global Settings.
    -  146   +  98   +
          * Scans the specified directories and writes the dependency reports to the reportDirectory.
    +  99  
          *
    -  147   -
          * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding
    -  148   -
          * settings in the core engine.
    -  149   +  100   +
          * @param reportDirectory the path to the directory where the reports will be written
    +  101   +
          * @param outputFormat the output format of the report
    +  102   +
          * @param applicationName the application name for the report
    +  103   +
          * @param files the files/directories to scan
    +  104  
          */
    -  150   -
         private void updateSettings(CliParser cli) {
    -  151   +  105   +
         private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) {
    +  106  0
             Engine scanner = null;
    +  107   +
             try {
    +  108  0
                 scanner = new Engine();
    +  109  
     
    -  152  0
             final boolean autoUpdate = cli.isAutoUpdate();
    -  153  0
             final String connectionTimeout = cli.getConnectionTimeout();
    -  154  0
             final String proxyUrl = cli.getProxyUrl();
    -  155  0
             final String proxyPort = cli.getProxyPort();
    -  156  0
             final String proxyUser = cli.getProxyUsername();
    -  157  0
             final String proxyPass = cli.getProxyPassword();
    -  158  0
             final String dataDirectory = cli.getDataDirectory();
    -  159  0
             final File propertiesFile = cli.getPropertiesFile();
    -  160  0
             final String suppressionFile = cli.getSuppressionFile();
    -  161  0
             final boolean jarDisabled = cli.isJarDisabled();
    -  162  0
             final boolean archiveDisabled = cli.isArchiveDisabled();
    -  163  0
             final boolean assemblyDisabled = cli.isAssemblyDisabled();
    -  164  0
             final boolean nuspecDisabled = cli.isNuspecDisabled();
    -  165  0
             final boolean nexusDisabled = cli.isNexusDisabled();
    -  166  0
             final String nexusUrl = cli.getNexusUrl();
    -  167  0
             final String databaseDriverName = cli.getDatabaseDriverName();
    -  168  0
             final String databaseDriverPath = cli.getDatabaseDriverPath();
    -  169  0
             final String connectionString = cli.getConnectionString();
    -  170  0
             final String databaseUser = cli.getDatabaseUser();
    -  171  0
             final String databasePassword = cli.getDatabasePassword();
    -  172  0
             final String additionalZipExtensions = cli.getAdditionalZipExtensions();
    -  173  0
             final String pathToMono = cli.getPathToMono();
    -  174   +  110  0
                 for (String file : files) {
    +  111  0
                     scanner.scan(file);
    +  112   +
                 }
    +  113  
     
    -  175  0
             if (propertiesFile != null) {
    -  176   +  114  0
                 scanner.analyzeDependencies();
    +  115  0
                 final List<Dependency> dependencies = scanner.getDependencies();
    +  116  0
                 DatabaseProperties prop = null;
    +  117  0
                 CveDB cve = null;
    +  118  
                 try {
    -  177  0
                     Settings.mergeProperties(propertiesFile);
    -  178  0
                 } catch (FileNotFoundException ex) {
    -  179  0
                     final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath());
    -  180  0
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg);
    -  181  0
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    -  182  0
                 } catch (IOException ex) {
    -  183  0
                     final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath());
    -  184  0
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg);
    -  185  0
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    -  186  0
                 }
    -  187   +  119  0
                     cve = new CveDB();
    +  120  0
                     cve.open();
    +  121  0
                     prop = cve.getDatabaseProperties();
    +  122  0
                 } catch (DatabaseException ex) {
    +  123  0
                     LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +  124   +
                 } finally {
    +  125  0
                     if (cve != null) {
    +  126  0
                         cve.close();
    +  127   +
                     }
    +  128   +
                 }
    +  129  0
                 final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop);
    +  130   +
                 try {
    +  131  0
                     report.generateReports(reportDirectory, outputFormat);
    +  132  0
                 } catch (IOException ex) {
    +  133  0
                     LOGGER.log(Level.SEVERE, "There was an IO error while attempting to generate the report.");
    +  134  0
                     LOGGER.log(Level.FINE, null, ex);
    +  135  0
                 } catch (Throwable ex) {
    +  136  0
                     LOGGER.log(Level.SEVERE, "There was an error while attempting to generate the report.");
    +  137  0
                     LOGGER.log(Level.FINE, null, ex);
    +  138  0
                 }
    +  139  0
             } catch (DatabaseException ex) {
    +  140  0
                 LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
    +  141  0
                 LOGGER.log(Level.FINE, "", ex);
    +  142   +
             } finally {
    +  143  0
                 Settings.cleanup();
    +  144  0
                 if (scanner != null) {
    +  145  0
                     scanner.cleanup();
    +  146   +
                 }
    +  147  
             }
    -  188   +  148  0
         }
    +  149   +
     
    +  150   +
         /**
    +  151   +
          * Updates the global Settings.
    +  152   +
          *
    +  153   +
          * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding
    +  154   +
          * settings in the core engine.
    +  155   +
          */
    +  156   +
         private void populateSettings(CliParser cli) {
    +  157   +
     
    +  158  0
             Settings.initialize();
    +  159   +
     
    +  160  0
             final boolean autoUpdate = cli.isAutoUpdate();
    +  161  0
             final String connectionTimeout = cli.getConnectionTimeout();
    +  162  0
             final String proxyUrl = cli.getProxyUrl();
    +  163  0
             final String proxyPort = cli.getProxyPort();
    +  164  0
             final String proxyUser = cli.getProxyUsername();
    +  165  0
             final String proxyPass = cli.getProxyPassword();
    +  166  0
             final String dataDirectory = cli.getDataDirectory();
    +  167  0
             final File propertiesFile = cli.getPropertiesFile();
    +  168  0
             final String suppressionFile = cli.getSuppressionFile();
    +  169  0
             final boolean jarDisabled = cli.isJarDisabled();
    +  170  0
             final boolean archiveDisabled = cli.isArchiveDisabled();
    +  171  0
             final boolean assemblyDisabled = cli.isAssemblyDisabled();
    +  172  0
             final boolean nuspecDisabled = cli.isNuspecDisabled();
    +  173  0
             final boolean nexusDisabled = cli.isNexusDisabled();
    +  174  0
             final String nexusUrl = cli.getNexusUrl();
    +  175  0
             final String databaseDriverName = cli.getDatabaseDriverName();
    +  176  0
             final String databaseDriverPath = cli.getDatabaseDriverPath();
    +  177  0
             final String connectionString = cli.getConnectionString();
    +  178  0
             final String databaseUser = cli.getDatabaseUser();
    +  179  0
             final String databasePassword = cli.getDatabasePassword();
    +  180  0
             final String additionalZipExtensions = cli.getAdditionalZipExtensions();
    +  181  0
             final String pathToMono = cli.getPathToMono();
    +  182   +
     
    +  183  0
             if (propertiesFile != null) {
    +  184   +
                 try {
    +  185  0
                     Settings.mergeProperties(propertiesFile);
    +  186  0
                 } catch (FileNotFoundException ex) {
    +  187  0
                     final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath());
    +  188  0
                     LOGGER.log(Level.SEVERE, msg);
    +  189  0
                     LOGGER.log(Level.FINE, null, ex);
    +  190  0
                 } catch (IOException ex) {
    +  191  0
                     final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath());
    +  192  0
                     LOGGER.log(Level.SEVERE, msg);
    +  193  0
                     LOGGER.log(Level.FINE, null, ex);
    +  194  0
                 }
    +  195   +
             }
    +  196  
             // We have to wait until we've merged the properties before attempting to set whether we use
    -  189   +  197  
             // the proxy for Nexus since it could be disabled in the properties, but not explicitly stated
    -  190   +  198  
             // on the command line
    -  191  0
             final boolean nexusUsesProxy = cli.isNexusUsesProxy();
    -  192  0
             if (dataDirectory != null) {
    -  193  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    -  194  0
             } else if (System.getProperty("basedir") != null) {
    -  195  0
                 final File dataDir = new File(System.getProperty("basedir"), "data");
    -  196  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    -  197  0
             } else {
    -  198  0
                 final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    -  199  0
                 final File base = jarPath.getParentFile();
    -  200  0
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    -  201  0
                 final File dataDir = new File(base, sub);
    -  202  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    -  203   +  199  0
             final boolean nexusUsesProxy = cli.isNexusUsesProxy();
    +  200  0
             if (dataDirectory != null) {
    +  201  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +  202  0
             } else if (System.getProperty("basedir") != null) {
    +  203  0
                 final File dataDir = new File(System.getProperty("basedir"), "data");
    +  204  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    +  205  0
             } else {
    +  206  0
                 final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    +  207  0
                 final File base = jarPath.getParentFile();
    +  208  0
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    +  209  0
                 final File dataDir = new File(base, sub);
    +  210  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    +  211  
             }
    -  204  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    -  205  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  206  0
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    -  207   +  212  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  213  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  214  0
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    +  215  
             }
    -  208  0
             if (proxyPort != null && !proxyPort.isEmpty()) {
    -  209  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    -  210   +  216  0
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  217  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    +  218  
             }
    -  211  0
             if (proxyUser != null && !proxyUser.isEmpty()) {
    -  212  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser);
    -  213   +  219  0
             if (proxyUser != null && !proxyUser.isEmpty()) {
    +  220  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser);
    +  221  
             }
    -  214  0
             if (proxyPass != null && !proxyPass.isEmpty()) {
    -  215  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass);
    -  216   -
             }
    -  217  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  218  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    -  219   -
             }
    -  220  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  221  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    -  222   -
             }
    -  223   -
     
    +  222  0
             if (proxyPass != null && !proxyPass.isEmpty()) {
    +  223  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass);
     224   -
             //File Type Analyzer Settings
    -  225  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled);
    -  226  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled);
    -  227  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled);
    -  228  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled);
    -  229   +
             }
    +  225  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  226  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  227   +
             }
    +  228  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  229  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    +  230   +
             }
    +  231  
     
    -  230  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled);
    -  231  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    -  232  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    -  233   -
             }
    -  234  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    -  235  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    -  236  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  232   +
             //File Type Analyzer Settings
    +  233  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled);
    +  234  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled);
    +  235  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled);
    +  236  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled);
     237   +
     
    +  238  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled);
    +  239  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  240  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  241  
             }
    -  238  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    -  239  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    -  240   +  242  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    +  243  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  244  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  245  
             }
    -  241  0
             if (connectionString != null && !connectionString.isEmpty()) {
    -  242  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    -  243   +  246  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  247  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    +  248  
             }
    -  244  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    -  245  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    -  246   +  249  0
             if (connectionString != null && !connectionString.isEmpty()) {
    +  250  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    +  251  
             }
    -  247  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    -  248  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    -  249   +  252  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  253  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  254  
             }
    -  250  0
             if (additionalZipExtensions != null && !additionalZipExtensions.isEmpty()) {
    -  251  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions);
    -  252   -
             }
    -  253  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    -  254  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    -  255   -
             }
    -  256  0
         }
    +  255  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  256  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
     257   +
             }
    +  258  0
             if (additionalZipExtensions != null && !additionalZipExtensions.isEmpty()) {
    +  259  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions);
    +  260   +
             }
    +  261  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    +  262  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    +  263   +
             }
    +  264  0
         }
    +  265  
     }
    - + diff --git a/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html b/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html index 1e3f35849..4939b9f6f 100644 --- a/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html +++ b/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    CliParser
    0%
    0/124
    0%
    0/68
    1.829
    CliParser
    65%
    81/124
    39%
    27/68
    1.829
    CliParser$ArgumentName
    N/A
    N/A
    1.829
    @@ -134,14 +134,14 @@
          */
     58  
         public void parse(String[] args) throws FileNotFoundException, ParseException {
    -  59  0
             line = parseArgs(args);
    +  59  9
             line = parseArgs(args);
     60  
     
    -  61  0
             if (line != null) {
    -  62  0
                 validateArgs();
    +  61  8
             if (line != null) {
    +  62  8
                 validateArgs();
     63  
             }
    -  64  0
         }
    +  64  7
         }
     65  
     
     66   @@ -160,9 +160,9 @@
          */
     73  
         private CommandLine parseArgs(String[] args) throws ParseException {
    -  74  0
             final CommandLineParser parser = new PosixParser();
    -  75  0
             final Options options = createCommandLineOptions();
    -  76  0
             return parser.parse(options, args);
    +  74  9
             final CommandLineParser parser = new PosixParser();
    +  75  9
             final Options options = createCommandLineOptions();
    +  76  9
             return parser.parse(options, args);
     77  
         }
     78   @@ -183,18 +183,18 @@
          */
     86  
         private void validateArgs() throws FileNotFoundException, ParseException {
    -  87  0
             if (isRunScan()) {
    -  88  0
                 validatePathExists(getScanFiles(), ArgumentName.SCAN);
    -  89  0
                 validatePathExists(getReportDirectory(), ArgumentName.OUT);
    -  90  0
                 if (getPathToMono() != null) {
    +  87  8
             if (isRunScan()) {
    +  88  2
                 validatePathExists(getScanFiles(), ArgumentName.SCAN);
    +  89  1
                 validatePathExists(getReportDirectory(), ArgumentName.OUT);
    +  90  1
                 if (getPathToMono() != null) {
     91  0
                     validatePathExists(getPathToMono(), ArgumentName.PATH_TO_MONO);
     92  
                 }
    -  93  0
                 if (!line.hasOption(ArgumentName.APP_NAME)) {
    +  93  1
                 if (!line.hasOption(ArgumentName.APP_NAME)) {
     94  0
                     throw new ParseException("Missing 'app' argument; the scan cannot be run without the an application name.");
     95  
                 }
    -  96  0
                 if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) {
    +  96  1
                 if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) {
     97  0
                     final String format = line.getOptionValue(ArgumentName.OUTPUT_FORMAT);
     98  
                     try {
    @@ -209,7 +209,7 @@
                 }
     106  
             }
    -  107  0
         }
    +  107  7
         }
     108  
     
     109   @@ -230,11 +230,11 @@
          */
     117  
         private void validatePathExists(String[] paths, String optType) throws FileNotFoundException {
    -  118  0
             for (String path : paths) {
    -  119  0
                 validatePathExists(path, optType);
    +  118  3
             for (String path : paths) {
    +  119  2
                 validatePathExists(path, optType);
     120  
             }
    -  121  0
         }
    +  121  1
         }
     122  
     
     123   @@ -255,17 +255,17 @@
          */
     131  
         private void validatePathExists(String path, String argumentName) throws FileNotFoundException {
    -  132  0
             if (!path.contains("*.")) {
    -  133  0
                 final File f = new File(path);
    -  134  0
                 if (!f.exists()) {
    -  135  0
                     isValid = false;
    -  136  0
                     final String msg = String.format("Invalid '%s' argument: '%s'", argumentName, path);
    -  137  0
                     throw new FileNotFoundException(msg);
    +  132  3
             if (!path.contains("*.")) {
    +  133  3
                 final File f = new File(path);
    +  134  3
                 if (!f.exists()) {
    +  135  1
                     isValid = false;
    +  136  1
                     final String msg = String.format("Invalid '%s' argument: '%s'", argumentName, path);
    +  137  1
                     throw new FileNotFoundException(msg);
     138  
                 }
     139  
             } // else { // TODO add a validation for *.zip extensions rather then relying on the engine to validate it.
    -  140  0
         }
    +  140  2
         }
     141  
     
     142   @@ -284,12 +284,12 @@
         private Options createCommandLineOptions() {
     149  
     
    -  150  0
             final Options options = new Options();
    -  151  0
             addStandardOptions(options);
    -  152  0
             addAdvancedOptions(options);
    +  150  9
             final Options options = new Options();
    +  151  9
             addStandardOptions(options);
    +  152  9
             addAdvancedOptions(options);
     153  
     
    -  154  0
             return options;
    +  154  9
             return options;
     155  
         }
     156   @@ -310,34 +310,34 @@
         @SuppressWarnings("static-access")
     164  
         private void addStandardOptions(final Options options) throws IllegalArgumentException {
    -  165  0
             final Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false,
    +  165  11
             final Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false,
     166  
                     "Print this message.");
     167  
     
    -  168  0
             final Option advancedHelp = OptionBuilder.withLongOpt(ArgumentName.ADVANCED_HELP)
    +  168  11
             final Option advancedHelp = OptionBuilder.withLongOpt(ArgumentName.ADVANCED_HELP)
     169  
                     .withDescription("Print the advanced help message.").create();
     170  
     
    -  171  0
             final Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION,
    +  171  11
             final Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION,
     172  
                     false, "Print the version information.");
     173  
     
    -  174  0
             final Option noUpdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
    +  174  11
             final Option noUpdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
     175  
                     false, "Disables the automatic updating of the CPE data.");
     176  
     
    -  177  0
             final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APP_NAME)
    +  177  11
             final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APP_NAME)
     178  
                     .withDescription("The name of the application being scanned. This is a required argument.")
     179  
                     .create(ArgumentName.APP_NAME_SHORT);
     180  
     
    -  181  0
             final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
    +  181  11
             final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
     182  
                     .withDescription("The path to scan - this option can be specified multiple times. To limit the scan"
     183   @@ -346,35 +346,35 @@
                     .create(ArgumentName.SCAN_SHORT);
     185  
     
    -  186  0
             final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP)
    +  186  11
             final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP)
     187  
                     .withDescription("A property file to load.")
     188  
                     .create(ArgumentName.PROP_SHORT);
     189  
     
    -  190  0
             final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT)
    +  190  11
             final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT)
     191  
                     .withDescription("The folder to write reports to. This defaults to the current directory.")
     192  
                     .create(ArgumentName.OUT_SHORT);
     193  
     
    -  194  0
             final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT)
    +  194  11
             final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT)
     195  
                     .withDescription("The output format to write to (XML, HTML, VULN, ALL). The default is HTML.")
     196  
                     .create(ArgumentName.OUTPUT_FORMAT_SHORT);
     197  
     
    -  198  0
             final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.VERBOSE_LOG)
    +  198  11
             final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.VERBOSE_LOG)
     199  
                     .withDescription("The file path to write verbose logging information.")
     200  
                     .create(ArgumentName.VERBOSE_LOG_SHORT);
     201  
     
    -  202  0
             final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESION_FILE)
    +  202  11
             final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESSION_FILE)
     203  
                     .withDescription("The file path to the suppression XML file.")
     204   @@ -383,11 +383,11 @@
     
     206  
             //This is an option group because it can be specified more then once.
    -  207  0
             final OptionGroup og = new OptionGroup();
    -  208  0
             og.addOption(path);
    +  207  11
             final OptionGroup og = new OptionGroup();
    +  208  11
             og.addOption(path);
     209  
     
    -  210  0
             options.addOptionGroup(og)
    +  210  11
             options.addOptionGroup(og)
     211  
                     .addOption(out)
     212   @@ -408,7 +408,7 @@
                     .addOption(verboseLog)
     220  
                     .addOption(suppressionFile);
    -  221  0
         }
    +  221  11
         }
     222  
     
     223   @@ -431,145 +431,145 @@
         private void addAdvancedOptions(final Options options) throws IllegalArgumentException {
     232  
     
    -  233  0
             final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DATA_DIRECTORY)
    +  233  9
             final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DATA_DIRECTORY)
     234  
                     .withDescription("The location of the H2 Database file. This option should generally not be set.")
     235  
                     .create(ArgumentName.DATA_DIRECTORY_SHORT);
     236  
     
    -  237  0
             final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ArgumentName.CONNECTION_TIMEOUT)
    +  237  9
             final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ArgumentName.CONNECTION_TIMEOUT)
     238  
                     .withDescription("The connection timeout (in milliseconds) to use when downloading resources.")
     239  
                     .create(ArgumentName.CONNECTION_TIMEOUT_SHORT);
     240  
     
    -  241  0
             final Option proxyUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.PROXY_URL)
    +  241  9
             final Option proxyUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.PROXY_URL)
     242  
                     .withDescription("The proxy url to use when downloading resources.")
     243  
                     .create(ArgumentName.PROXY_URL_SHORT);
     244  
     
    -  245  0
             final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ArgumentName.PROXY_PORT)
    +  245  9
             final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ArgumentName.PROXY_PORT)
     246  
                     .withDescription("The proxy port to use when downloading resources.")
     247  
                     .create(ArgumentName.PROXY_PORT_SHORT);
     248  
     
    -  249  0
             final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.PROXY_USERNAME)
    +  249  9
             final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.PROXY_USERNAME)
     250  
                     .withDescription("The proxy username to use when downloading resources.")
     251  
                     .create();
     252  
     
    -  253  0
             final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ArgumentName.PROXY_PASSWORD)
    +  253  9
             final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ArgumentName.PROXY_PASSWORD)
     254  
                     .withDescription("The proxy password to use when downloading resources.")
     255  
                     .create();
     256  
     
    -  257  0
             final Option connectionString = OptionBuilder.withArgName("connStr").hasArg().withLongOpt(ArgumentName.CONNECTION_STRING)
    +  257  9
             final Option connectionString = OptionBuilder.withArgName("connStr").hasArg().withLongOpt(ArgumentName.CONNECTION_STRING)
     258  
                     .withDescription("The connection string to the database.")
     259  
                     .create();
     260  
     
    -  261  0
             final Option dbUser = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.DB_NAME)
    +  261  9
             final Option dbUser = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.DB_NAME)
     262  
                     .withDescription("The username used to connect to the database.")
     263  
                     .create();
     264  
     
    -  265  0
             final Option dbPassword = OptionBuilder.withArgName("password").hasArg().withLongOpt(ArgumentName.DB_PASSWORD)
    +  265  9
             final Option dbPassword = OptionBuilder.withArgName("password").hasArg().withLongOpt(ArgumentName.DB_PASSWORD)
     266  
                     .withDescription("The password for connecting to the database.")
     267  
                     .create();
     268  
     
    -  269  0
             final Option dbDriver = OptionBuilder.withArgName("driver").hasArg().withLongOpt(ArgumentName.DB_DRIVER)
    +  269  9
             final Option dbDriver = OptionBuilder.withArgName("driver").hasArg().withLongOpt(ArgumentName.DB_DRIVER)
     270  
                     .withDescription("The database driver name.")
     271  
                     .create();
     272  
     
    -  273  0
             final Option dbDriverPath = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DB_DRIVER_PATH)
    +  273  9
             final Option dbDriverPath = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DB_DRIVER_PATH)
     274  
                     .withDescription("The path to the database driver; note, this does not need to be set unless the JAR is outside of the classpath.")
     275  
                     .create();
     276  
     
    -  277  0
             final Option disableJarAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_JAR)
    +  277  9
             final Option disableJarAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_JAR)
     278  
                     .withDescription("Disable the Jar Analyzer.")
     279  
                     .create();
    -  280  0
             final Option disableArchiveAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_ARCHIVE)
    +  280  9
             final Option disableArchiveAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_ARCHIVE)
     281  
                     .withDescription("Disable the Archive Analyzer.")
     282  
                     .create();
    -  283  0
             final Option disableNuspecAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_NUSPEC)
    +  283  9
             final Option disableNuspecAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_NUSPEC)
     284  
                     .withDescription("Disable the Nuspec Analyzer.")
     285  
                     .create();
    -  286  0
             final Option disableAssemblyAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_ASSEMBLY)
    +  286  9
             final Option disableAssemblyAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_ASSEMBLY)
     287  
                     .withDescription("Disable the .NET Assembly Analyzer.")
     288  
                     .create();
     289  
     
    -  290  0
             final Option disableNexusAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_NEXUS)
    +  290  9
             final Option disableNexusAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_NEXUS)
     291  
                     .withDescription("Disable the Nexus Analyzer.")
     292  
                     .create();
     293  
     
    -  294  0
             final Option nexusUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.NEXUS_URL)
    +  294  9
             final Option nexusUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.NEXUS_URL)
     295  
                     .withDescription("The url to the Nexus Server.")
     296  
                     .create();
     297  
     
    -  298  0
             final Option nexusUsesProxy = OptionBuilder.withArgName("true/false").hasArg().withLongOpt(ArgumentName.NEXUS_USES_PROXY)
    +  298  9
             final Option nexusUsesProxy = OptionBuilder.withArgName("true/false").hasArg().withLongOpt(ArgumentName.NEXUS_USES_PROXY)
     299  
                     .withDescription("Whether or not the configured proxy should be used when connecting to Nexus.")
     300  
                     .create();
     301  
     
    -  302  0
             final Option additionalZipExtensions = OptionBuilder.withArgName("extensions").hasArg()
    +  302  9
             final Option additionalZipExtensions = OptionBuilder.withArgName("extensions").hasArg()
     303  
                     .withLongOpt(ArgumentName.ADDITIONAL_ZIP_EXTENSIONS)
     304   -
                     .withDescription("A comma seperated list of additional extensions to be scanned as ZIP files "
    +
                     .withDescription("A comma separated list of additional extensions to be scanned as ZIP files "
     305  
                             + "(ZIP, EAR, WAR are already treated as zip files)")
     306  
                     .create();
     307  
     
    -  308  0
             final Option pathToMono = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.PATH_TO_MONO)
    +  308  9
             final Option pathToMono = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.PATH_TO_MONO)
     309  
                     .withDescription("The path to Mono for .NET Assembly analysis on non-windows systems.")
     310  
                     .create();
     311  
     
    -  312  0
             options.addOption(proxyPort)
    +  312  9
             options.addOption(proxyPort)
     313  
                     .addOption(proxyUrl)
     314   @@ -608,7 +608,7 @@
                     .addOption(additionalZipExtensions)
     331  
                     .addOption(pathToMono);
    -  332  0
         }
    +  332  9
         }
     333  
     
     334   @@ -623,7 +623,7 @@
          */
     339  
         public boolean isGetVersion() {
    -  340  0
             return (line != null) && line.hasOption(ArgumentName.VERSION);
    +  340  7
             return (line != null) && line.hasOption(ArgumentName.VERSION);
     341  
         }
     342   @@ -640,7 +640,7 @@
          */
     348  
         public boolean isGetHelp() {
    -  349  0
             return (line != null) && line.hasOption(ArgumentName.HELP);
    +  349  7
             return (line != null) && line.hasOption(ArgumentName.HELP);
     350  
         }
     351   @@ -657,7 +657,7 @@
          */
     357  
         public boolean isRunScan() {
    -  358  0
             return (line != null) && isValid && line.hasOption(ArgumentName.SCAN);
    +  358  15
             return (line != null) && isValid && line.hasOption(ArgumentName.SCAN);
     359  
         }
     360   @@ -813,14 +813,14 @@
          */
     442  
         public void printHelp() {
    -  443  0
             final HelpFormatter formatter = new HelpFormatter();
    -  444  0
             final Options options = new Options();
    -  445  0
             addStandardOptions(options);
    -  446  0
             if (line != null && line.hasOption(ArgumentName.ADVANCED_HELP)) {
    +  443  2
             final HelpFormatter formatter = new HelpFormatter();
    +  444  2
             final Options options = new Options();
    +  445  2
             addStandardOptions(options);
    +  446  2
             if (line != null && line.hasOption(ArgumentName.ADVANCED_HELP)) {
     447  0
                 addAdvancedOptions(options);
     448  
             }
    -  449  0
             final String helpMsg = String.format("%n%s"
    +  449  2
             final String helpMsg = String.format("%n%s"
     450  
                     + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. "
     451   @@ -831,7 +831,7 @@
                     Settings.getString("application.name", "DependencyCheck"));
     454  
     
    -  455  0
             formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
    +  455  2
             formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
     456  
                     helpMsg,
     457   @@ -842,7 +842,7 @@
                     true);
     460  
     
    -  461  0
         }
    +  461  2
         }
     462  
     
     463   @@ -857,7 +857,7 @@
          */
     468  
         public String[] getScanFiles() {
    -  469  0
             return line.getOptionValues(ArgumentName.SCAN);
    +  469  3
             return line.getOptionValues(ArgumentName.SCAN);
     470  
         }
     471   @@ -874,7 +874,7 @@
          */
     477  
         public String getReportDirectory() {
    -  478  0
             return line.getOptionValue(ArgumentName.OUT, ".");
    +  478  1
             return line.getOptionValue(ArgumentName.OUT, ".");
     479  
         }
     480   @@ -891,7 +891,7 @@
          */
     486  
         public String getPathToMono() {
    -  487  0
             return line.getOptionValue(ArgumentName.PATH_TO_MONO);
    +  487  1
             return line.getOptionValue(ArgumentName.PATH_TO_MONO);
     488  
         }
     489   @@ -1083,7 +1083,7 @@
          */
     589  
         public String getSuppressionFile() {
    -  590  0
             return line.getOptionValue(ArgumentName.SUPPRESION_FILE);
    +  590  0
             return line.getOptionValue(ArgumentName.SUPPRESSION_FILE);
     591  
         }
     592   @@ -1102,13 +1102,13 @@
          */
     599  
         public void printVersionInfo() {
    -  600  0
             final String version = String.format("%s version %s",
    +  600  1
             final String version = String.format("%s version %s",
     601  
                     Settings.getString("application.name", "DependencyCheck"),
     602  
                     Settings.getString("application.version", "Unknown"));
    -  603  0
             System.out.println(version);
    -  604  0
         }
    +  603  1
             System.out.println(version);
    +  604  1
         }
     605  
     
     606   @@ -1481,7 +1481,7 @@  793  
              */
     794   -
             public static final String SUPPRESION_FILE = "suppression";
    +
             public static final String SUPPRESSION_FILE = "suppression";
     795  
             /**
     796   @@ -1600,6 +1600,6 @@
     }
    - + diff --git a/dependency-check-cli/dependency-updates-report.html b/dependency-check-cli/dependency-updates-report.html index db84e4ec8..6c0b925bd 100644 --- a/dependency-check-cli/dependency-updates-report.html +++ b/dependency-check-cli/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -176,16 +176,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • @@ -308,7 +301,7 @@ org.owasp dependency-check-core -1.1.4 +1.2.0 compile jar @@ -393,7 +386,7 @@ dependency-check-core Current Version -1.1.4 +1.2.0 Scope compile diff --git a/dependency-check-cli/findbugs.html b/dependency-check-cli/findbugs.html index ea7aaab90..0a6362007 100644 --- a/dependency-check-cli/findbugs.html +++ b/dependency-check-cli/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-cli - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -178,16 +178,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • diff --git a/dependency-check-cli/index.html b/dependency-check-cli/index.html index 6a3b8aa2a..1f171e1b1 100644 --- a/dependency-check-cli/index.html +++ b/dependency-check-cli/index.html @@ -1,13 +1,13 @@ - + dependency-check-cli - About @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -126,7 +126,7 @@ - +
  • diff --git a/dependency-check-cli/installation.html b/dependency-check-cli/installation.html index c8e66fe94..3b6afb41c 100644 --- a/dependency-check-cli/installation.html +++ b/dependency-check-cli/installation.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Installation & Usage @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -103,7 +103,7 @@ Project Information - +
  • @@ -153,7 +153,7 @@

    Installation & Usage

    -

    Download the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:

    +

    Download the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:

    $ chmod +777 dependency-check.sh
    diff --git a/dependency-check-cli/license.html b/dependency-check-cli/license.html
    index 2504c0b4b..12c267944 100644
    --- a/dependency-check-cli/license.html
    +++ b/dependency-check-cli/license.html
    @@ -1,13 +1,13 @@
     
     
     
       
         
         
    -    
    +    
         
         dependency-check-cli - Project License
         
    @@ -54,7 +54,7 @@
                     
                         
                                   
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -126,7 +126,7 @@
  • - +
  • @@ -181,210 +181,7 @@

    Project License

    The Apache Software License, Version 2.0

    -
    -
    -                                 Apache License
    -                           Version 2.0, January 2004
    -                        http://www.apache.org/licenses/
    -
    -   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
    -
    -   1. Definitions.
    -
    -      "License" shall mean the terms and conditions for use, reproduction,
    -      and distribution as defined by Sections 1 through 9 of this document.
    -
    -      "Licensor" shall mean the copyright owner or entity authorized by
    -      the copyright owner that is granting the License.
    -
    -      "Legal Entity" shall mean the union of the acting entity and all
    -      other entities that control, are controlled by, or are under common
    -      control with that entity. For the purposes of this definition,
    -      "control" means (i) the power, direct or indirect, to cause the
    -      direction or management of such entity, whether by contract or
    -      otherwise, or (ii) ownership of fifty percent (50%) or more of the
    -      outstanding shares, or (iii) beneficial ownership of such entity.
    -
    -      "You" (or "Your") shall mean an individual or Legal Entity
    -      exercising permissions granted by this License.
    -
    -      "Source" form shall mean the preferred form for making modifications,
    -      including but not limited to software source code, documentation
    -      source, and configuration files.
    -
    -      "Object" form shall mean any form resulting from mechanical
    -      transformation or translation of a Source form, including but
    -      not limited to compiled object code, generated documentation,
    -      and conversions to other media types.
    -
    -      "Work" shall mean the work of authorship, whether in Source or
    -      Object form, made available under the License, as indicated by a
    -      copyright notice that is included in or attached to the work
    -      (an example is provided in the Appendix below).
    -
    -      "Derivative Works" shall mean any work, whether in Source or Object
    -      form, that is based on (or derived from) the Work and for which the
    -      editorial revisions, annotations, elaborations, or other modifications
    -      represent, as a whole, an original work of authorship. For the purposes
    -      of this License, Derivative Works shall not include works that remain
    -      separable from, or merely link (or bind by name) to the interfaces of,
    -      the Work and Derivative Works thereof.
    -
    -      "Contribution" shall mean any work of authorship, including
    -      the original version of the Work and any modifications or additions
    -      to that Work or Derivative Works thereof, that is intentionally
    -      submitted to Licensor for inclusion in the Work by the copyright owner
    -      or by an individual or Legal Entity authorized to submit on behalf of
    -      the copyright owner. For the purposes of this definition, "submitted"
    -      means any form of electronic, verbal, or written communication sent
    -      to the Licensor or its representatives, including but not limited to
    -      communication on electronic mailing lists, source code control systems,
    -      and issue tracking systems that are managed by, or on behalf of, the
    -      Licensor for the purpose of discussing and improving the Work, but
    -      excluding communication that is conspicuously marked or otherwise
    -      designated in writing by the copyright owner as "Not a Contribution."
    -
    -      "Contributor" shall mean Licensor and any individual or Legal Entity
    -      on behalf of whom a Contribution has been received by Licensor and
    -      subsequently incorporated within the Work.
    -
    -   2. Grant of Copyright License. Subject to the terms and conditions of
    -      this License, each Contributor hereby grants to You a perpetual,
    -      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
    -      copyright license to reproduce, prepare Derivative Works of,
    -      publicly display, publicly perform, sublicense, and distribute the
    -      Work and such Derivative Works in Source or Object form.
    -
    -   3. Grant of Patent License. Subject to the terms and conditions of
    -      this License, each Contributor hereby grants to You a perpetual,
    -      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
    -      (except as stated in this section) patent license to make, have made,
    -      use, offer to sell, sell, import, and otherwise transfer the Work,
    -      where such license applies only to those patent claims licensable
    -      by such Contributor that are necessarily infringed by their
    -      Contribution(s) alone or by combination of their Contribution(s)
    -      with the Work to which such Contribution(s) was submitted. If You
    -      institute patent litigation against any entity (including a
    -      cross-claim or counterclaim in a lawsuit) alleging that the Work
    -      or a Contribution incorporated within the Work constitutes direct
    -      or contributory patent infringement, then any patent licenses
    -      granted to You under this License for that Work shall terminate
    -      as of the date such litigation is filed.
    -
    -   4. Redistribution. You may reproduce and distribute copies of the
    -      Work or Derivative Works thereof in any medium, with or without
    -      modifications, and in Source or Object form, provided that You
    -      meet the following conditions:
    -
    -      (a) You must give any other recipients of the Work or
    -          Derivative Works a copy of this License; and
    -
    -      (b) You must cause any modified files to carry prominent notices
    -          stating that You changed the files; and
    -
    -      (c) You must retain, in the Source form of any Derivative Works
    -          that You distribute, all copyright, patent, trademark, and
    -          attribution notices from the Source form of the Work,
    -          excluding those notices that do not pertain to any part of
    -          the Derivative Works; and
    -
    -      (d) If the Work includes a "NOTICE" text file as part of its
    -          distribution, then any Derivative Works that You distribute must
    -          include a readable copy of the attribution notices contained
    -          within such NOTICE file, excluding those notices that do not
    -          pertain to any part of the Derivative Works, in at least one
    -          of the following places: within a NOTICE text file distributed
    -          as part of the Derivative Works; within the Source form or
    -          documentation, if provided along with the Derivative Works; or,
    -          within a display generated by the Derivative Works, if and
    -          wherever such third-party notices normally appear. The contents
    -          of the NOTICE file are for informational purposes only and
    -          do not modify the License. You may add Your own attribution
    -          notices within Derivative Works that You distribute, alongside
    -          or as an addendum to the NOTICE text from the Work, provided
    -          that such additional attribution notices cannot be construed
    -          as modifying the License.
    -
    -      You may add Your own copyright statement to Your modifications and
    -      may provide additional or different license terms and conditions
    -      for use, reproduction, or distribution of Your modifications, or
    -      for any such Derivative Works as a whole, provided Your use,
    -      reproduction, and distribution of the Work otherwise complies with
    -      the conditions stated in this License.
    -
    -   5. Submission of Contributions. Unless You explicitly state otherwise,
    -      any Contribution intentionally submitted for inclusion in the Work
    -      by You to the Licensor shall be under the terms and conditions of
    -      this License, without any additional terms or conditions.
    -      Notwithstanding the above, nothing herein shall supersede or modify
    -      the terms of any separate license agreement you may have executed
    -      with Licensor regarding such Contributions.
    -
    -   6. Trademarks. This License does not grant permission to use the trade
    -      names, trademarks, service marks, or product names of the Licensor,
    -      except as required for reasonable and customary use in describing the
    -      origin of the Work and reproducing the content of the NOTICE file.
    -
    -   7. Disclaimer of Warranty. Unless required by applicable law or
    -      agreed to in writing, Licensor provides the Work (and each
    -      Contributor provides its Contributions) on an "AS IS" BASIS,
    -      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    -      implied, including, without limitation, any warranties or conditions
    -      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
    -      PARTICULAR PURPOSE. You are solely responsible for determining the
    -      appropriateness of using or redistributing the Work and assume any
    -      risks associated with Your exercise of permissions under this License.
    -
    -   8. Limitation of Liability. In no event and under no legal theory,
    -      whether in tort (including negligence), contract, or otherwise,
    -      unless required by applicable law (such as deliberate and grossly
    -      negligent acts) or agreed to in writing, shall any Contributor be
    -      liable to You for damages, including any direct, indirect, special,
    -      incidental, or consequential damages of any character arising as a
    -      result of this License or out of the use or inability to use the
    -      Work (including but not limited to damages for loss of goodwill,
    -      work stoppage, computer failure or malfunction, or any and all
    -      other commercial damages or losses), even if such Contributor
    -      has been advised of the possibility of such damages.
    -
    -   9. Accepting Warranty or Additional Liability. While redistributing
    -      the Work or Derivative Works thereof, You may choose to offer,
    -      and charge a fee for, acceptance of support, warranty, indemnity,
    -      or other liability obligations and/or rights consistent with this
    -      License. However, in accepting such obligations, You may act only
    -      on Your own behalf and on Your sole responsibility, not on behalf
    -      of any other Contributor, and only if You agree to indemnify,
    -      defend, and hold each Contributor harmless for any liability
    -      incurred by, or claims asserted against, such Contributor by reason
    -      of your accepting any such warranty or additional liability.
    -
    -   END OF TERMS AND CONDITIONS
    -
    -   APPENDIX: How to apply the Apache License to your work.
    -
    -      To apply the Apache License to your work, attach the following
    -      boilerplate notice, with the fields enclosed by brackets "[]"
    -      replaced with your own identifying information. (Don't include
    -      the brackets!)  The text should be enclosed in the appropriate
    -      comment syntax for the file format. We also recommend that a
    -      file or class name and description of purpose be included on the
    -      same "printed page" as the copyright notice for easier
    -      identification within third-party archives.
    -
    -   Copyright [yyyy] [name of copyright owner]
    -
    -   Licensed under the Apache License, Version 2.0 (the "License");
    -   you may not use this file except in compliance with the License.
    -   You may obtain a copy of the License at
    -
    -       http://www.apache.org/licenses/LICENSE-2.0
    -
    -   Unless required by applicable law or agreed to in writing, software
    -   distributed under the License is distributed on an "AS IS" BASIS,
    -   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    -   See the License for the specific language governing permissions and
    -   limitations under the License.
    -
    +

    Can't read the url [http://www.apache.org/licenses/LICENSE-2.0.txt] : connect timed out

    diff --git a/dependency-check-cli/plugin-updates-report.html b/dependency-check-cli/plugin-updates-report.html index 410d0e92e..02664a95a 100644 --- a/dependency-check-cli/plugin-updates-report.html +++ b/dependency-check-cli/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -176,16 +176,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • diff --git a/dependency-check-cli/pmd.html b/dependency-check-cli/pmd.html index 76f349c9e..3fcc2f40c 100644 --- a/dependency-check-cli/pmd.html +++ b/dependency-check-cli/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-cli - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -176,16 +176,9 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • -
  • - PMD Report + PMD
  • @@ -240,7 +233,7 @@

    PMD Results

    -

    The following document contains the results of PMD 5.0.2.

    +

    The following document contains the results of PMD 5.0.5.

    Files

    @@ -251,31 +244,31 @@ Line Useless parentheses. -340 +340 Useless parentheses. -349 +349 Useless parentheses. -358 +358 Useless parentheses. -367 +367 Useless parentheses. -376 +376 Useless parentheses. -385 +385 Useless parentheses. -394 +394 Useless parentheses. -403 +403 Useless parentheses. -613
    +613 diff --git a/dependency-check-cli/project-info.html b/dependency-check-cli/project-info.html index 292785d19..3f1bc8dd0 100644 --- a/dependency-check-cli/project-info.html +++ b/dependency-check-cli/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -126,7 +126,7 @@ - +
  • diff --git a/dependency-check-cli/project-reports.html b/dependency-check-cli/project-reports.html index d8849c3c8..014ed9264 100644 --- a/dependency-check-cli/project-reports.html +++ b/dependency-check-cli/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • Project Reports @@ -176,16 +176,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • @@ -275,12 +268,9 @@ Checkstyle Report on coding style conventions. -CPD Report -Duplicate code detection. - -PMD Report +PMD Verification of coding rules. - + FindBugs Report Generates a source code report with the FindBugs Library. diff --git a/dependency-check-cli/project-summary.html b/dependency-check-cli/project-summary.html index c2a475f8c..010b647bd 100644 --- a/dependency-check-cli/project-summary.html +++ b/dependency-check-cli/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -126,7 +126,7 @@ - +
  • @@ -218,7 +218,7 @@ dependency-check-cli Version -1.1.4 +1.2.0 Type jar diff --git a/dependency-check-cli/surefire-report.html b/dependency-check-cli/surefire-report.html index 6bf44fbd6..66f6c58d5 100644 --- a/dependency-check-cli/surefire-report.html +++ b/dependency-check-cli/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -176,16 +176,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • @@ -258,7 +251,8 @@ function toggleDisplay(elementId) {

    Surefire Report

    -

    Summary


    +

    Summary

    +

    [Summary] [Package List] [Test Cases]


    @@ -268,13 +262,97 @@ function toggleDisplay(elementId) { + - - -
    TestsSuccess Rate Time
    9 0 0 000%0

    +100% +0.039

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    +
    +

    Package List

    +

    [Summary] [Package List] [Test Cases]


    + + + + + + + + + + + + + + + + +
    PackageTestsErrors FailuresSkippedSuccess RateTime
    org.owasp.dependencycheck.cli9000100%0.039

    +

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    +
    +

    org.owasp.dependencycheck.cli

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    CliParserTest9000100%0.039

    +
    +

    Test Cases

    +

    [Summary] [Package List] [Test Cases]

    +
    +

    CliParserTest

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testParse_printHelp0.03
    testParse_printVersionInfo0.001
    testParse_help0.001
    testParse_scan0.001
    testParse0.001
    testParse_unknown0.001
    testParse_version0.001
    testParse_scan_unknownFile0.001
    testParse_scan_withFileExists0.002

    diff --git a/dependency-check-cli/taglist.html b/dependency-check-cli/taglist.html index a46aecc05..590a8eb1d 100644 --- a/dependency-check-cli/taglist.html +++ b/dependency-check-cli/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -176,16 +176,9 @@
  • - + - CPD Report -
  • - -
  • - - - - PMD Report + PMD
  • diff --git a/dependency-check-cli/xref-test/index.html b/dependency-check-cli/xref-test/index.html index 191524f0d..3239dc502 100644 --- a/dependency-check-cli/xref-test/index.html +++ b/dependency-check-cli/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Command Line 1.1.4 Reference + Dependency-Check Command Line 1.2.0 Reference diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html index e5982026e..61127e20c 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html @@ -37,244 +37,247 @@ 29 import org.junit.Before; 30 import org.junit.BeforeClass; 31 import org.junit.Test; -32 -33 /** -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37 public class CliParserTest { -38 -39 @BeforeClass -40 public static void setUpClass() throws Exception { -41 } -42 -43 @AfterClass -44 public static void tearDownClass() throws Exception { -45 } -46 -47 @Before -48 public void setUp() throws Exception { -49 } -50 -51 @After -52 public void tearDown() throws Exception { -53 } -54 -55 /** -56 * Test of parse method, of class CliParser. -57 * -58 * @throws Exception thrown when an exception occurs. -59 */ -60 @Test -61 public void testParse() throws Exception { -62 -63 String[] args = {}; -64 PrintStream out = System.out; +32 import org.owasp.dependencycheck.utils.Settings; +33 +34 /** +35 * +36 * @author Jeremy Long <jeremy.long@owasp.org> +37 */ +38 public class CliParserTest { +39 +40 @BeforeClass +41 public static void setUpClass() throws Exception { +42 Settings.initialize(); +43 } +44 +45 @AfterClass +46 public static void tearDownClass() throws Exception { +47 Settings.cleanup(); +48 } +49 +50 @Before +51 public void setUp() throws Exception { +52 } +53 +54 @After +55 public void tearDown() throws Exception { +56 } +57 +58 /** +59 * Test of parse method, of class CliParser. +60 * +61 * @throws Exception thrown when an exception occurs. +62 */ +63 @Test +64 public void testParse() throws Exception { 65 -66 ByteArrayOutputStream baos = new ByteArrayOutputStream(); -67 System.setOut(new PrintStream(baos)); +66 String[] args = {}; +67 PrintStream out = System.out; 68 -69 CliParser instance = new CliParser(); -70 instance.parse(args); +69 ByteArrayOutputStream baos = new ByteArrayOutputStream(); +70 System.setOut(new PrintStream(baos)); 71 -72 Assert.assertFalse(instance.isGetVersion()); -73 Assert.assertFalse(instance.isGetHelp()); -74 Assert.assertFalse(instance.isRunScan()); -75 } -76 -77 /** -78 * Test of parse method with help arg, of class CliParser. -79 * -80 * @throws Exception thrown when an exception occurs. -81 */ -82 @Test -83 public void testParse_help() throws Exception { -84 -85 String[] args = {"-help"}; -86 PrintStream out = System.out; +72 CliParser instance = new CliParser(); +73 instance.parse(args); +74 +75 Assert.assertFalse(instance.isGetVersion()); +76 Assert.assertFalse(instance.isGetHelp()); +77 Assert.assertFalse(instance.isRunScan()); +78 } +79 +80 /** +81 * Test of parse method with help arg, of class CliParser. +82 * +83 * @throws Exception thrown when an exception occurs. +84 */ +85 @Test +86 public void testParse_help() throws Exception { 87 -88 CliParser instance = new CliParser(); -89 instance.parse(args); +88 String[] args = {"-help"}; +89 PrintStream out = System.out; 90 -91 Assert.assertFalse(instance.isGetVersion()); -92 Assert.assertTrue(instance.isGetHelp()); -93 Assert.assertFalse(instance.isRunScan()); -94 } -95 -96 /** -97 * Test of parse method with version arg, of class CliParser. -98 * -99 * @throws Exception thrown when an exception occurs. -100 */ -101 @Test -102 public void testParse_version() throws Exception { -103 -104 String[] args = {"-version"}; -105 -106 CliParser instance = new CliParser(); -107 instance.parse(args); -108 Assert.assertTrue(instance.isGetVersion()); -109 Assert.assertFalse(instance.isGetHelp()); -110 Assert.assertFalse(instance.isRunScan()); -111 -112 } -113 -114 /** -115 * Test of parse method with jar and cpe args, of class CliParser. -116 * -117 * @throws Exception thrown when an exception occurs. -118 */ -119 @Test -120 public void testParse_unknown() throws Exception { -121 -122 String[] args = {"-unknown"}; -123 -124 PrintStream out = System.out; -125 PrintStream err = System.err; -126 ByteArrayOutputStream baos_out = new ByteArrayOutputStream(); -127 ByteArrayOutputStream baos_err = new ByteArrayOutputStream(); -128 System.setOut(new PrintStream(baos_out)); -129 System.setErr(new PrintStream(baos_err)); -130 -131 CliParser instance = new CliParser(); -132 -133 try { -134 instance.parse(args); -135 } catch (ParseException ex) { -136 Assert.assertTrue(ex.getMessage().contains("Unrecognized option")); -137 } -138 Assert.assertFalse(instance.isGetVersion()); -139 Assert.assertFalse(instance.isGetHelp()); -140 Assert.assertFalse(instance.isRunScan()); -141 } -142 -143 /** -144 * Test of parse method with scan arg, of class CliParser. -145 * -146 * @throws Exception thrown when an exception occurs. -147 */ -148 @Test -149 public void testParse_scan() throws Exception { -150 -151 String[] args = {"-scan"}; -152 -153 CliParser instance = new CliParser(); -154 -155 try { -156 instance.parse(args); -157 } catch (ParseException ex) { -158 Assert.assertTrue(ex.getMessage().contains("Missing argument")); -159 } -160 -161 Assert.assertFalse(instance.isGetVersion()); -162 Assert.assertFalse(instance.isGetHelp()); -163 Assert.assertFalse(instance.isRunScan()); -164 } -165 -166 /** -167 * Test of parse method with jar arg, of class CliParser. -168 * -169 * @throws Exception thrown when an exception occurs. -170 */ -171 @Test -172 public void testParse_scan_unknownFile() throws Exception { -173 -174 String[] args = {"-scan", "jar.that.does.not.exist", "-app", "test"}; -175 -176 CliParser instance = new CliParser(); -177 try { -178 instance.parse(args); -179 } catch (FileNotFoundException ex) { -180 Assert.assertTrue(ex.getMessage().contains("Invalid 'scan' argument")); -181 } -182 -183 Assert.assertFalse(instance.isGetVersion()); -184 Assert.assertFalse(instance.isGetHelp()); -185 Assert.assertFalse(instance.isRunScan()); -186 } -187 -188 /** -189 * Test of parse method with jar arg, of class CliParser. -190 * -191 * @throws Exception thrown when an exception occurs. -192 */ -193 @Test -194 public void testParse_scan_withFileExists() throws Exception { -195 File path = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); -196 String[] args = {"-scan", path.getCanonicalPath(), "-out", "./", "-app", "test"}; -197 -198 CliParser instance = new CliParser(); -199 instance.parse(args); +91 CliParser instance = new CliParser(); +92 instance.parse(args); +93 +94 Assert.assertFalse(instance.isGetVersion()); +95 Assert.assertTrue(instance.isGetHelp()); +96 Assert.assertFalse(instance.isRunScan()); +97 } +98 +99 /** +100 * Test of parse method with version arg, of class CliParser. +101 * +102 * @throws Exception thrown when an exception occurs. +103 */ +104 @Test +105 public void testParse_version() throws Exception { +106 +107 String[] args = {"-version"}; +108 +109 CliParser instance = new CliParser(); +110 instance.parse(args); +111 Assert.assertTrue(instance.isGetVersion()); +112 Assert.assertFalse(instance.isGetHelp()); +113 Assert.assertFalse(instance.isRunScan()); +114 +115 } +116 +117 /** +118 * Test of parse method with jar and cpe args, of class CliParser. +119 * +120 * @throws Exception thrown when an exception occurs. +121 */ +122 @Test +123 public void testParse_unknown() throws Exception { +124 +125 String[] args = {"-unknown"}; +126 +127 PrintStream out = System.out; +128 PrintStream err = System.err; +129 ByteArrayOutputStream baos_out = new ByteArrayOutputStream(); +130 ByteArrayOutputStream baos_err = new ByteArrayOutputStream(); +131 System.setOut(new PrintStream(baos_out)); +132 System.setErr(new PrintStream(baos_err)); +133 +134 CliParser instance = new CliParser(); +135 +136 try { +137 instance.parse(args); +138 } catch (ParseException ex) { +139 Assert.assertTrue(ex.getMessage().contains("Unrecognized option")); +140 } +141 Assert.assertFalse(instance.isGetVersion()); +142 Assert.assertFalse(instance.isGetHelp()); +143 Assert.assertFalse(instance.isRunScan()); +144 } +145 +146 /** +147 * Test of parse method with scan arg, of class CliParser. +148 * +149 * @throws Exception thrown when an exception occurs. +150 */ +151 @Test +152 public void testParse_scan() throws Exception { +153 +154 String[] args = {"-scan"}; +155 +156 CliParser instance = new CliParser(); +157 +158 try { +159 instance.parse(args); +160 } catch (ParseException ex) { +161 Assert.assertTrue(ex.getMessage().contains("Missing argument")); +162 } +163 +164 Assert.assertFalse(instance.isGetVersion()); +165 Assert.assertFalse(instance.isGetHelp()); +166 Assert.assertFalse(instance.isRunScan()); +167 } +168 +169 /** +170 * Test of parse method with jar arg, of class CliParser. +171 * +172 * @throws Exception thrown when an exception occurs. +173 */ +174 @Test +175 public void testParse_scan_unknownFile() throws Exception { +176 +177 String[] args = {"-scan", "jar.that.does.not.exist", "-app", "test"}; +178 +179 CliParser instance = new CliParser(); +180 try { +181 instance.parse(args); +182 } catch (FileNotFoundException ex) { +183 Assert.assertTrue(ex.getMessage().contains("Invalid 'scan' argument")); +184 } +185 +186 Assert.assertFalse(instance.isGetVersion()); +187 Assert.assertFalse(instance.isGetHelp()); +188 Assert.assertFalse(instance.isRunScan()); +189 } +190 +191 /** +192 * Test of parse method with jar arg, of class CliParser. +193 * +194 * @throws Exception thrown when an exception occurs. +195 */ +196 @Test +197 public void testParse_scan_withFileExists() throws Exception { +198 File path = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); +199 String[] args = {"-scan", path.getCanonicalPath(), "-out", "./", "-app", "test"}; 200 -201 Assert.assertEquals(path.getCanonicalPath(), instance.getScanFiles()[0]); -202 -203 Assert.assertFalse(instance.isGetVersion()); -204 Assert.assertFalse(instance.isGetHelp()); -205 Assert.assertTrue(instance.isRunScan()); -206 } -207 -208 /** -209 * Test of printVersionInfo, of class CliParser. -210 * -211 * @throws Exception thrown when an exception occurs. -212 */ -213 @Test -214 public void testParse_printVersionInfo() throws Exception { -215 -216 PrintStream out = System.out; -217 ByteArrayOutputStream baos = new ByteArrayOutputStream(); -218 System.setOut(new PrintStream(baos)); -219 -220 CliParser instance = new CliParser(); -221 instance.printVersionInfo(); -222 try { -223 baos.flush(); -224 String text = (new String(baos.toByteArray())).toLowerCase(); -225 String[] lines = text.split(System.getProperty("line.separator")); -226 Assert.assertEquals(1, lines.length); -227 Assert.assertTrue(text.contains("version")); -228 Assert.assertTrue(!text.contains("unknown")); -229 } catch (IOException ex) { -230 System.setOut(out); -231 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); -232 } finally { +201 CliParser instance = new CliParser(); +202 instance.parse(args); +203 +204 Assert.assertEquals(path.getCanonicalPath(), instance.getScanFiles()[0]); +205 +206 Assert.assertFalse(instance.isGetVersion()); +207 Assert.assertFalse(instance.isGetHelp()); +208 Assert.assertTrue(instance.isRunScan()); +209 } +210 +211 /** +212 * Test of printVersionInfo, of class CliParser. +213 * +214 * @throws Exception thrown when an exception occurs. +215 */ +216 @Test +217 public void testParse_printVersionInfo() throws Exception { +218 +219 PrintStream out = System.out; +220 ByteArrayOutputStream baos = new ByteArrayOutputStream(); +221 System.setOut(new PrintStream(baos)); +222 +223 CliParser instance = new CliParser(); +224 instance.printVersionInfo(); +225 try { +226 baos.flush(); +227 String text = (new String(baos.toByteArray())).toLowerCase(); +228 String[] lines = text.split(System.getProperty("line.separator")); +229 Assert.assertEquals(1, lines.length); +230 Assert.assertTrue(text.contains("version")); +231 Assert.assertTrue(!text.contains("unknown")); +232 } catch (IOException ex) { 233 System.setOut(out); -234 } -235 } -236 -237 /** -238 * Test of printHelp, of class CliParser. -239 * -240 * @throws Exception thrown when an exception occurs. -241 */ -242 @Test -243 public void testParse_printHelp() throws Exception { -244 -245 PrintStream out = System.out; -246 ByteArrayOutputStream baos = new ByteArrayOutputStream(); -247 System.setOut(new PrintStream(baos)); -248 -249 CliParser instance = new CliParser(); -250 String[] args = {"-h"}; -251 instance.parse(args); -252 instance.printHelp(); -253 args[0] = "-ah"; +234 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); +235 } finally { +236 System.setOut(out); +237 } +238 } +239 +240 /** +241 * Test of printHelp, of class CliParser. +242 * +243 * @throws Exception thrown when an exception occurs. +244 */ +245 @Test +246 public void testParse_printHelp() throws Exception { +247 +248 PrintStream out = System.out; +249 ByteArrayOutputStream baos = new ByteArrayOutputStream(); +250 System.setOut(new PrintStream(baos)); +251 +252 CliParser instance = new CliParser(); +253 String[] args = {"-h"}; 254 instance.parse(args); 255 instance.printHelp(); -256 try { -257 baos.flush(); -258 String text = (new String(baos.toByteArray())); -259 String[] lines = text.split(System.getProperty("line.separator")); -260 Assert.assertTrue(lines[0].startsWith("usage: ")); -261 Assert.assertTrue((lines.length > 2)); -262 } catch (IOException ex) { -263 System.setOut(out); -264 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); -265 } finally { +256 args[0] = "-ah"; +257 instance.parse(args); +258 instance.printHelp(); +259 try { +260 baos.flush(); +261 String text = (new String(baos.toByteArray())); +262 String[] lines = text.split(System.getProperty("line.separator")); +263 Assert.assertTrue(lines[0].startsWith("usage: ")); +264 Assert.assertTrue((lines.length > 2)); +265 } catch (IOException ex) { 266 System.setOut(out); -267 } -268 } -269 } +267 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); +268 } finally { +269 System.setOut(out); +270 } +271 } +272 }
    diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html index 4bf23faee..9df1cd81d 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html index 228fbe86b..e9b59d7ab 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref-test/overview-frame.html b/dependency-check-cli/xref-test/overview-frame.html index 23364daed..d111efebd 100644 --- a/dependency-check-cli/xref-test/overview-frame.html +++ b/dependency-check-cli/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference + Dependency-Check Command Line 1.2.0 Reference diff --git a/dependency-check-cli/xref-test/overview-summary.html b/dependency-check-cli/xref-test/overview-summary.html index 19038b198..35e70ab44 100644 --- a/dependency-check-cli/xref-test/overview-summary.html +++ b/dependency-check-cli/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference + Dependency-Check Command Line 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Command Line 1.1.4 Reference

    +

    Dependency-Check Command Line 1.2.0 Reference

    diff --git a/dependency-check-cli/xref/index.html b/dependency-check-cli/xref/index.html index 191524f0d..3239dc502 100644 --- a/dependency-check-cli/xref/index.html +++ b/dependency-check-cli/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Command Line 1.1.4 Reference + Dependency-Check Command Line 1.2.0 Reference diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/App.html b/dependency-check-cli/xref/org/owasp/dependencycheck/App.html index 1be7776f3..130d57593 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/App.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/App.html @@ -55,214 +55,222 @@ 47privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; 4849/** -50 * The main method for the application. -51 * -52 * @param args the command line arguments -53 */ -54publicstaticvoid main(String[] args) { -55finalApp app = newApp(); -56 app.run(args); -57 } -58 -59/** -60 * Main CLI entry-point into the application. -61 * -62 * @param args the command line arguments -63 */ -64publicvoid run(String[] args) { -65 -66finalCliParser cli = newCliParser(); -67try { -68 cli.parse(args); -69 } catch (FileNotFoundException ex) { -70 System.err.println(ex.getMessage()); -71 cli.printHelp(); -72return; -73 } catch (ParseException ex) { -74 System.err.println(ex.getMessage()); -75 cli.printHelp(); -76return; -77 } -78 -79final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -80 LogUtils.prepareLogger(in, cli.getVerboseLog()); -81 -82if (cli.isGetVersion()) { -83 cli.printVersionInfo(); -84 } elseif (cli.isRunScan()) { -85 updateSettings(cli); -86 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles()); -87 } else { -88 cli.printHelp(); -89 } -90 } -91 -92/** -93 * Scans the specified directories and writes the dependency reports to the reportDirectory. -94 * -95 * @param reportDirectory the path to the directory where the reports will be written -96 * @param outputFormat the output format of the report -97 * @param applicationName the application name for the report -98 * @param files the files/directories to scan -99 */ -100privatevoid runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) { -101 Engine scanner = null; -102try { -103 scanner = new Engine(); -104 -105for (String file : files) { -106 scanner.scan(file); -107 } -108 -109 scanner.analyzeDependencies(); -110final List<Dependency> dependencies = scanner.getDependencies(); -111 DatabaseProperties prop = null; -112 CveDB cve = null; -113try { -114 cve = new CveDB(); -115 cve.open(); -116 prop = cve.getDatabaseProperties(); -117 } catch (DatabaseException ex) { -118 Logger.getLogger(App.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); -119 } finally { -120if (cve != null) { -121 cve.close(); -122 } -123 } -124final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop); -125try { -126 report.generateReports(reportDirectory, outputFormat); -127 } catch (IOException ex) { -128 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an IO error while attempting to generate the report."); -129 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); -130 } catch (Throwable ex) { -131 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an error while attempting to generate the report."); -132 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); -133 } -134 } catch (DatabaseException ex) { -135 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped"); -136 Logger.getLogger(App.class.getName()).log(Level.FINE, "", ex); -137 } finally { -138if (scanner != null) { -139 scanner.cleanup(); -140 } -141 } -142 } -143 -144/** -145 * Updates the global Settings. -146 * -147 * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding -148 * settings in the core engine. -149 */ -150privatevoid updateSettings(CliParser cli) { -151 -152finalboolean autoUpdate = cli.isAutoUpdate(); -153final String connectionTimeout = cli.getConnectionTimeout(); -154final String proxyUrl = cli.getProxyUrl(); -155final String proxyPort = cli.getProxyPort(); -156final String proxyUser = cli.getProxyUsername(); -157final String proxyPass = cli.getProxyPassword(); -158final String dataDirectory = cli.getDataDirectory(); -159final File propertiesFile = cli.getPropertiesFile(); -160final String suppressionFile = cli.getSuppressionFile(); -161finalboolean jarDisabled = cli.isJarDisabled(); -162finalboolean archiveDisabled = cli.isArchiveDisabled(); -163finalboolean assemblyDisabled = cli.isAssemblyDisabled(); -164finalboolean nuspecDisabled = cli.isNuspecDisabled(); -165finalboolean nexusDisabled = cli.isNexusDisabled(); -166final String nexusUrl = cli.getNexusUrl(); -167final String databaseDriverName = cli.getDatabaseDriverName(); -168final String databaseDriverPath = cli.getDatabaseDriverPath(); -169final String connectionString = cli.getConnectionString(); -170final String databaseUser = cli.getDatabaseUser(); -171final String databasePassword = cli.getDatabasePassword(); -172final String additionalZipExtensions = cli.getAdditionalZipExtensions(); -173final String pathToMono = cli.getPathToMono(); -174 -175if (propertiesFile != null) { -176try { -177 Settings.mergeProperties(propertiesFile); -178 } catch (FileNotFoundException ex) { -179final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath()); -180 Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg); -181 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); -182 } catch (IOException ex) { -183final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath()); -184 Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg); -185 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); -186 } -187 } -188// We have to wait until we've merged the properties before attempting to set whether we use -189// the proxy for Nexus since it could be disabled in the properties, but not explicitly stated -190// on the command line -191finalboolean nexusUsesProxy = cli.isNexusUsesProxy(); -192if (dataDirectory != null) { -193 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -194 } elseif (System.getProperty("basedir") != null) { -195final File dataDir = new File(System.getProperty("basedir"), "data"); -196 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -197 } else { -198final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath()); -199final File base = jarPath.getParentFile(); -200final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); -201final File dataDir = new File(base, sub); -202 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -203 } -204 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -205if (proxyUrl != null && !proxyUrl.isEmpty()) { -206 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); -207 } -208if (proxyPort != null && !proxyPort.isEmpty()) { -209 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); -210 } -211if (proxyUser != null && !proxyUser.isEmpty()) { -212 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser); -213 } -214if (proxyPass != null && !proxyPass.isEmpty()) { -215 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass); -216 } -217if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -218 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); -219 } -220if (suppressionFile != null && !suppressionFile.isEmpty()) { -221 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -222 } -223 -224//File Type Analyzer Settings -225 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled); -226 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled); -227 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled); -228 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled); -229 -230 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled); -231if (nexusUrl != null && !nexusUrl.isEmpty()) { -232 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); -233 } -234 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); -235if (databaseDriverName != null && !databaseDriverName.isEmpty()) { -236 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); -237 } -238if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { -239 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); -240 } -241if (connectionString != null && !connectionString.isEmpty()) { -242 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); -243 } -244if (databaseUser != null && !databaseUser.isEmpty()) { -245 Settings.setString(Settings.KEYS.DB_USER, databaseUser); -246 } -247if (databasePassword != null && !databasePassword.isEmpty()) { -248 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); -249 } -250if (additionalZipExtensions != null && !additionalZipExtensions.isEmpty()) { -251 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions); -252 } -253if (pathToMono != null && !pathToMono.isEmpty()) { -254 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); -255 } -256 } -257 } +50 * The logger. +51 */ +52privatestaticfinal Logger LOGGER = Logger.getLogger(App.class.getName()); +53 +54/** +55 * The main method for the application. +56 * +57 * @param args the command line arguments +58 */ +59publicstaticvoid main(String[] args) { +60finalApp app = newApp(); +61 app.run(args); +62 } +63 +64/** +65 * Main CLI entry-point into the application. +66 * +67 * @param args the command line arguments +68 */ +69publicvoid run(String[] args) { +70 +71finalCliParser cli = newCliParser(); +72try { +73 cli.parse(args); +74 } catch (FileNotFoundException ex) { +75 System.err.println(ex.getMessage()); +76 cli.printHelp(); +77return; +78 } catch (ParseException ex) { +79 System.err.println(ex.getMessage()); +80 cli.printHelp(); +81return; +82 } +83 +84final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +85 LogUtils.prepareLogger(in, cli.getVerboseLog()); +86 +87if (cli.isGetVersion()) { +88 cli.printVersionInfo(); +89 } elseif (cli.isRunScan()) { +90 populateSettings(cli); +91 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles()); +92 } else { +93 cli.printHelp(); +94 } +95 } +96 +97/** +98 * Scans the specified directories and writes the dependency reports to the reportDirectory. +99 * +100 * @param reportDirectory the path to the directory where the reports will be written +101 * @param outputFormat the output format of the report +102 * @param applicationName the application name for the report +103 * @param files the files/directories to scan +104 */ +105privatevoid runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) { +106 Engine scanner = null; +107try { +108 scanner = new Engine(); +109 +110for (String file : files) { +111 scanner.scan(file); +112 } +113 +114 scanner.analyzeDependencies(); +115final List<Dependency> dependencies = scanner.getDependencies(); +116 DatabaseProperties prop = null; +117 CveDB cve = null; +118try { +119 cve = new CveDB(); +120 cve.open(); +121 prop = cve.getDatabaseProperties(); +122 } catch (DatabaseException ex) { +123 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex); +124 } finally { +125if (cve != null) { +126 cve.close(); +127 } +128 } +129final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop); +130try { +131 report.generateReports(reportDirectory, outputFormat); +132 } catch (IOException ex) { +133 LOGGER.log(Level.SEVERE, "There was an IO error while attempting to generate the report."); +134 LOGGER.log(Level.FINE, null, ex); +135 } catch (Throwable ex) { +136 LOGGER.log(Level.SEVERE, "There was an error while attempting to generate the report."); +137 LOGGER.log(Level.FINE, null, ex); +138 } +139 } catch (DatabaseException ex) { +140 LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped"); +141 LOGGER.log(Level.FINE, "", ex); +142 } finally { +143 Settings.cleanup(); +144if (scanner != null) { +145 scanner.cleanup(); +146 } +147 } +148 } +149 +150/** +151 * Updates the global Settings. +152 * +153 * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding +154 * settings in the core engine. +155 */ +156privatevoid populateSettings(CliParser cli) { +157 +158 Settings.initialize(); +159 +160finalboolean autoUpdate = cli.isAutoUpdate(); +161final String connectionTimeout = cli.getConnectionTimeout(); +162final String proxyUrl = cli.getProxyUrl(); +163final String proxyPort = cli.getProxyPort(); +164final String proxyUser = cli.getProxyUsername(); +165final String proxyPass = cli.getProxyPassword(); +166final String dataDirectory = cli.getDataDirectory(); +167final File propertiesFile = cli.getPropertiesFile(); +168final String suppressionFile = cli.getSuppressionFile(); +169finalboolean jarDisabled = cli.isJarDisabled(); +170finalboolean archiveDisabled = cli.isArchiveDisabled(); +171finalboolean assemblyDisabled = cli.isAssemblyDisabled(); +172finalboolean nuspecDisabled = cli.isNuspecDisabled(); +173finalboolean nexusDisabled = cli.isNexusDisabled(); +174final String nexusUrl = cli.getNexusUrl(); +175final String databaseDriverName = cli.getDatabaseDriverName(); +176final String databaseDriverPath = cli.getDatabaseDriverPath(); +177final String connectionString = cli.getConnectionString(); +178final String databaseUser = cli.getDatabaseUser(); +179final String databasePassword = cli.getDatabasePassword(); +180final String additionalZipExtensions = cli.getAdditionalZipExtensions(); +181final String pathToMono = cli.getPathToMono(); +182 +183if (propertiesFile != null) { +184try { +185 Settings.mergeProperties(propertiesFile); +186 } catch (FileNotFoundException ex) { +187final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath()); +188 LOGGER.log(Level.SEVERE, msg); +189 LOGGER.log(Level.FINE, null, ex); +190 } catch (IOException ex) { +191final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath()); +192 LOGGER.log(Level.SEVERE, msg); +193 LOGGER.log(Level.FINE, null, ex); +194 } +195 } +196// We have to wait until we've merged the properties before attempting to set whether we use +197// the proxy for Nexus since it could be disabled in the properties, but not explicitly stated +198// on the command line +199finalboolean nexusUsesProxy = cli.isNexusUsesProxy(); +200if (dataDirectory != null) { +201 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +202 } elseif (System.getProperty("basedir") != null) { +203final File dataDir = new File(System.getProperty("basedir"), "data"); +204 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +205 } else { +206final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath()); +207final File base = jarPath.getParentFile(); +208final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); +209final File dataDir = new File(base, sub); +210 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +211 } +212 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +213if (proxyUrl != null && !proxyUrl.isEmpty()) { +214 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +215 } +216if (proxyPort != null && !proxyPort.isEmpty()) { +217 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +218 } +219if (proxyUser != null && !proxyUser.isEmpty()) { +220 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser); +221 } +222if (proxyPass != null && !proxyPass.isEmpty()) { +223 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass); +224 } +225if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +226 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +227 } +228if (suppressionFile != null && !suppressionFile.isEmpty()) { +229 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +230 } +231 +232//File Type Analyzer Settings +233 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled); +234 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled); +235 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled); +236 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled); +237 +238 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled); +239if (nexusUrl != null && !nexusUrl.isEmpty()) { +240 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +241 } +242 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); +243if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +244 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +245 } +246if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +247 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +248 } +249if (connectionString != null && !connectionString.isEmpty()) { +250 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +251 } +252if (databaseUser != null && !databaseUser.isEmpty()) { +253 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +254 } +255if (databasePassword != null && !databasePassword.isEmpty()) { +256 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +257 } +258if (additionalZipExtensions != null && !additionalZipExtensions.isEmpty()) { +259 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions); +260 } +261if (pathToMono != null && !pathToMono.isEmpty()) { +262 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); +263 } +264 } +265 }
    diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html index 804cfb448..22f538776 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html @@ -207,7 +207,7 @@ 199 .withDescription("The file path to write verbose logging information.") 200 .create(ArgumentName.VERBOSE_LOG_SHORT); 201 -202final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESION_FILE) +202final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESSION_FILE) 203 .withDescription("The file path to the suppression XML file.") 204 .create(); 205 @@ -309,7 +309,7 @@ 301302final Option additionalZipExtensions = OptionBuilder.withArgName("extensions").hasArg() 303 .withLongOpt(ArgumentName.ADDITIONAL_ZIP_EXTENSIONS) -304 .withDescription("A comma seperated list of additional extensions to be scanned as ZIP files " +304 .withDescription("A comma separated list of additional extensions to be scanned as ZIP files "305 + "(ZIP, EAR, WAR are already treated as zip files)") 306 .create(); 307 @@ -595,7 +595,7 @@ 587 * @return the path to the suppression file588 */589public String getSuppressionFile() { -590return line.getOptionValue(ArgumentName.SUPPRESION_FILE); +590return line.getOptionValue(ArgumentName.SUPPRESSION_FILE); 591 } 592593/** @@ -799,7 +799,7 @@ 791/**792 * The CLI argument name for setting the location of the suppression file.793 */ -794publicstaticfinal String SUPPRESION_FILE = "suppression"; +794publicstaticfinal String SUPPRESSION_FILE = "suppression"; 795/**796 * Disables the Jar Analyzer.797 */ diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html index f9e52ff34..9e138a482 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html index f42739f19..645006bb0 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.2.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html b/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html index 61fab3396..a010b2d79 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference Package org.owasp.dependencycheck + Dependency-Check Command Line 1.2.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html b/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html index 57f8e830d..07cbdc251 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference Package org.owasp.dependencycheck + Dependency-Check Command Line 1.2.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-cli/xref/overview-frame.html b/dependency-check-cli/xref/overview-frame.html index 282ab9ab5..338860915 100644 --- a/dependency-check-cli/xref/overview-frame.html +++ b/dependency-check-cli/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference + Dependency-Check Command Line 1.2.0 Reference diff --git a/dependency-check-cli/xref/overview-summary.html b/dependency-check-cli/xref/overview-summary.html index 2b83b97ea..e018b4d4c 100644 --- a/dependency-check-cli/xref/overview-summary.html +++ b/dependency-check-cli/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.1.4 Reference + Dependency-Check Command Line 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Command Line 1.1.4 Reference

    +

    Dependency-Check Command Line 1.2.0 Reference

    diff --git a/dependency-check-core/apidocs/allclasses-frame.html b/dependency-check-core/apidocs/allclasses-frame.html index 668a41126..64b4d4ac9 100644 --- a/dependency-check-core/apidocs/allclasses-frame.html +++ b/dependency-check-core/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Core 1.1.4 API) - +All Classes (Dependency-Check Core 1.2.0 API) + @@ -78,6 +78,7 @@
  • DriverLoader
  • DriverLoadException
  • Engine
  • +
  • EscapeTool
  • Evidence
  • EvidenceCollection
  • Exclusion
  • diff --git a/dependency-check-core/apidocs/allclasses-noframe.html b/dependency-check-core/apidocs/allclasses-noframe.html index e8a1ce525..22295d092 100644 --- a/dependency-check-core/apidocs/allclasses-noframe.html +++ b/dependency-check-core/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Core 1.1.4 API) - +All Classes (Dependency-Check Core 1.2.0 API) + @@ -78,6 +78,7 @@
  • DriverLoader
  • DriverLoadException
  • Engine
  • +
  • EscapeTool
  • Evidence
  • EvidenceCollection
  • Exclusion
  • diff --git a/dependency-check-core/apidocs/constant-values.html b/dependency-check-core/apidocs/constant-values.html index 89d4a91ab..9f2975f4c 100644 --- a/dependency-check-core/apidocs/constant-values.html +++ b/dependency-check-core/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Core 1.1.4 API) - +Constant Field Values (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/deprecated-list.html b/dependency-check-core/apidocs/deprecated-list.html index 841712aa5..3f5dadec6 100644 --- a/dependency-check-core/apidocs/deprecated-list.html +++ b/dependency-check-core/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Core 1.1.4 API) - +Deprecated List (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/help-doc.html b/dependency-check-core/apidocs/help-doc.html index 3c714dc32..bdb5c49a7 100644 --- a/dependency-check-core/apidocs/help-doc.html +++ b/dependency-check-core/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Core 1.1.4 API) - +API Help (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/index-all.html b/dependency-check-core/apidocs/index-all.html index 8f61c7c7b..db05ab7a3 100644 --- a/dependency-check-core/apidocs/index-all.html +++ b/dependency-check-core/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Core 1.1.4 API) - +Index (Dependency-Check Core 1.2.0 API) + @@ -186,6 +186,14 @@
    address - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Notifier
     
    +
    addSuppressedIdentifier(Identifier) - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Adds an identifier to the list of suppressed identifiers.
    +
    +
    addSuppressedVulnerability(Vulnerability) - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Adds a vulnerability to the set of suppressed vulnerabilities.
    +
    addTerm() - Method in class org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter
    Adds a term, if one exists, from the tokens collection.
    @@ -362,7 +370,13 @@
    The properties key for whether the .NET Nuspec analyzer is enabled.
    AnalyzerService - Class in org.owasp.dependencycheck.analyzer
    -
     
    +
    +
    The Analyzer Service Loader.
    +
    +
    AnalyzerService(ClassLoader) - Constructor for class org.owasp.dependencycheck.analyzer.AnalyzerService
    +
    +
    Creates a new instance of AnalyzerService.
    +
    any - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Contributor.Properties
     
    any - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Developer.Properties
    @@ -550,7 +564,7 @@
    A callable object to download two files.
    -
    CallableDownloadTask(NvdCveInfo, ExecutorService, CveDB) - Constructor for class org.owasp.dependencycheck.data.update.task.CallableDownloadTask
    +
    CallableDownloadTask(NvdCveInfo, ExecutorService, CveDB, Settings) - Constructor for class org.owasp.dependencycheck.data.update.task.CallableDownloadTask
    Simple constructor for the callable download task.
    @@ -594,6 +608,10 @@
    Properly cleans up resources allocated during analysis.
    +
    cleanup() - Static method in class org.owasp.dependencycheck.utils.Settings
    +
    +
    Cleans up resources to prevent memory leaks.
    +
    cleanupDatabase() - Method in class org.owasp.dependencycheck.data.nvdcve.CveDB
    It is possible that orphaned rows may be generated during database updates.
    @@ -1536,7 +1554,7 @@
     
    endElement(String, String, String) - Method in class org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter
    -
    Indicatees the start of the document.
    +
    Indicates the start of the document.
    endElement(String, String, String) - Method in class org.owasp.dependencycheck.suppression.SuppressionHandler
    @@ -1550,6 +1568,10 @@
    Creates a new Engine.
    +
    Engine(ClassLoader) - Constructor for class org.owasp.dependencycheck.Engine
    +
    +
    Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services.
    +
    ENTRY - Static variable in class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element
    A node type in the NVD CVE Schema 1.2.
    @@ -1600,6 +1622,12 @@
    Escapes the text passed in so that it is treated as data instead of control characters.
    +
    EscapeTool - Class in org.owasp.dependencycheck.reporting
    +
    +
    An extremely simple wrapper around various escape utils to perform URL and HTML encoding within the reports.
    +
    +
    EscapeTool() - Constructor for class org.owasp.dependencycheck.reporting.EscapeTool
    +
     
    Evidence - Class in org.owasp.dependencycheck.dependency
    Evidence is a piece of information about a Dependency.
    @@ -2632,17 +2660,13 @@
    Gets the value of the inherited property.
    -
    getInstance() - Static method in class org.owasp.dependencycheck.analyzer.AnalyzerService
    -
    -
    Retrieve the singleton instance of AnalyzerService.
    -
    getInstance() - Static method in class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex
    Gets the singleton instance of the CpeMemoryIndex.
    -
    getInstance() - Static method in class org.owasp.dependencycheck.data.update.UpdateService
    +
    getInstance() - Static method in class org.owasp.dependencycheck.utils.Settings
    -
    Retrieve the singleton instance of UpdateService.
    +
    Gets the underlying instance of the Settings object.
    getInt(String) - Static method in class org.owasp.dependencycheck.utils.Settings
    @@ -3351,6 +3375,14 @@
    Returns the extensions for which this Analyzer runs.
    +
    getSuppressedIdentifiers() - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Get the value of suppressedIdentifiers.
    +
    +
    getSuppressedVulnerabilities() - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Get the value of suppressedVulnerabilities.
    +
    getSuppressionFile() - Method in class org.owasp.dependencycheck.agent.DependencyCheckScanAgent
    Get the value of suppressionFile.
    @@ -3735,6 +3767,10 @@
     
    HintAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.HintAnalyzer
     
    +
    html(String) - Method in class org.owasp.dependencycheck.reporting.EscapeTool
    +
    +
    HTML Encodes the provided text.
    +
    @@ -3862,6 +3898,10 @@
    Initializes the connection factory.
    +
    initialize() - Static method in class org.owasp.dependencycheck.utils.Settings
    +
    +
    Initializes the thread local settings object.
    +
    initializeFileTypeAnalyzer() - Method in class org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer
    Initializes the file type analyzer.
    @@ -5036,7 +5076,7 @@
    A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly.
    -
    ProcessTask(CveDB, CallableDownloadTask) - Constructor for class org.owasp.dependencycheck.data.update.task.ProcessTask
    +
    ProcessTask(CveDB, CallableDownloadTask, Settings) - Constructor for class org.owasp.dependencycheck.data.update.task.ProcessTask
    Constructs a new ProcessTask used to process an NVD CVE update.
    @@ -5970,6 +6010,10 @@
    Sets the value of the inherited property.
    +
    setInstance(Settings) - Static method in class org.owasp.dependencycheck.utils.Settings
    +
    +
    Sets the instance of the Settings object to use in this thread.
    +
    setIssueManagement(IssueManagement) - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Model
    Sets the value of the issueManagement property.
    @@ -6474,6 +6518,14 @@
    Sets the value of the subscribe property.
    +
    setSuppressedIdentifiers(Set<Identifier>) - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Set the value of suppressedIdentifiers.
    +
    +
    setSuppressedVulnerabilities(SortedSet<Vulnerability>) - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Set the value of suppressedVulnerabilities.
    +
    setSuppressionFile(String) - Method in class org.owasp.dependencycheck.agent.DependencyCheckScanAgent
    Set the value of suppressionFile.
    @@ -6970,7 +7022,13 @@
    updatePolicy - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy
     
    UpdateService - Class in org.owasp.dependencycheck.data.update
    -
     
    +
    +
    The CachedWebDataSource Service Loader.
    +
    +
    UpdateService(ClassLoader) - Constructor for class org.owasp.dependencycheck.data.update.UpdateService
    +
    +
    Creates a new instance of UpdateService.
    +
    updatesNeeded() - Method in class org.owasp.dependencycheck.data.update.StandardUpdate
    Determines if the index needs to be updated.
    @@ -7005,6 +7063,10 @@
     
    url - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Site
     
    +
    url(String) - Method in class org.owasp.dependencycheck.reporting.EscapeTool
    +
    +
    URL Encodes the provided text.
    +
    URLConnectionFactory - Class in org.owasp.dependencycheck.utils
    A URLConnection Factory to create new connections.
    @@ -7205,6 +7267,10 @@ the order they are declared.

    X

    +
    xml(String) - Method in class org.owasp.dependencycheck.reporting.EscapeTool
    +
    +
    XML Encodes the provided text.
    +
    XPathNuspecParser - Class in org.owasp.dependencycheck.data.nuget
    Parse a Nuspec file using XPath.
    diff --git a/dependency-check-core/apidocs/index.html b/dependency-check-core/apidocs/index.html index 2f7f72024..f918bfab2 100644 --- a/dependency-check-core/apidocs/index.html +++ b/dependency-check-core/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Core 1.1.4 API +Dependency-Check Core 1.2.0 API @@ -126,6 +126,11 @@ extends Creates a new Engine. +
    + +
    Engine(ClassLoader serviceClassLoader) +
    Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services.
    +
  • @@ -254,7 +259,7 @@ extends - diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html index 4771dc6b4..b9dfc1d14 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html @@ -2,16 +2,16 @@ - + -DependencyCheckScanAgent (Dependency-Check Core 1.1.4 API) - +DependencyCheckScanAgent (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html index 338b69d01..21119af53 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/class-use/DependencyCheckScanAgent.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.agent.DependencyCheckScanAgent (Dependency-Check Core 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.agent.DependencyCheckScanAgent (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html index 42fdec9a4..6e87cd26a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.agent (Dependency-Check Core 1.1.4 API) - +org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html index 494264fb5..47f18b9a3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.agent (Dependency-Check Core 1.1.4 API) - +org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html index a78567697..8009e8557 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.agent Class Hierarchy (Dependency-Check Core 1.1.4 API) - +org.owasp.dependencycheck.agent Class Hierarchy (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html index dd7e3bd42..489e1d695 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/agent/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.agent (Dependency-Check Core 1.1.4 API) - +Uses of Package org.owasp.dependencycheck.agent (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html index c23df9be6..dc9bde85c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractAnalyzer (Dependency-Check Core 1.1.4 API) - +AbstractAnalyzer (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html index 3220f0ddf..243f88fd2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractFileTypeAnalyzer (Dependency-Check Core 1.1.4 API) - +AbstractFileTypeAnalyzer (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html index d5c1c45c9..5a6e00523 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractSuppressionAnalyzer (Dependency-Check Core 1.1.4 API) - +AbstractSuppressionAnalyzer (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html index 43f06c16e..ac7b5b491 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html @@ -2,16 +2,16 @@ - + -AnalysisPhase (Dependency-Check Core 1.1.4 API) - +AnalysisPhase (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html index 297723a98..1ea6d0b49 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html @@ -2,16 +2,16 @@ - + -Analyzer (Dependency-Check Core 1.1.4 API) - +Analyzer (Dependency-Check Core 1.2.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html index b8095829e..d38673aff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html @@ -2,16 +2,16 @@ - + -AnalyzerService (Dependency-Check Core 1.1.4 API) - +AnalyzerService (Dependency-Check Core 1.2.0 API) + @@ -64,13 +64,13 @@
  • Summary: 
  • Nested | 
  • Field | 
  • -
  • Constr | 
  • +
  • Constr | 
  • Method
  • @@ -97,8 +97,10 @@


  • -
    public final class AnalyzerService
    +
    public class AnalyzerService
     extends Object
    +
    The Analyzer Service Loader. This class loads all services that implement + org.owasp.dependencycheck.analyzer.Analyzer.
    Author:
    Jeremy Long
  • @@ -107,6 +109,25 @@ extends - +
  • diff --git a/dependency-check-core/plugin-updates-report.html b/dependency-check-core/plugin-updates-report.html index 3931b37c6..62fcc3430 100644 --- a/dependency-check-core/plugin-updates-report.html +++ b/dependency-check-core/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -90,7 +90,7 @@ Project Information - +
  • @@ -145,6 +145,13 @@ Surefire Report
  • +
  • + + + + Failsafe Report +
  • +
  • @@ -161,16 +168,16 @@
  • - + - CPD Report + PMD
  • - + - PMD Report + CPD
  • diff --git a/dependency-check-core/pmd.html b/dependency-check-core/pmd.html index 4e27c2302..1f787f156 100644 --- a/dependency-check-core/pmd.html +++ b/dependency-check-core/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-core - PMD Results @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -90,7 +90,7 @@ Project Information - +
  • @@ -147,6 +147,13 @@ Surefire Report
  • +
  • + + + + Failsafe Report +
  • +
  • @@ -161,18 +168,18 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • -
  • - PMD Report + PMD
  • +
  • + + + + CPD +
  • +
  • @@ -232,7 +239,7 @@

    PMD Results

    -

    The following document contains the results of PMD 5.0.2.

    +

    The following document contains the results of PMD 5.0.5.

    Files

    @@ -243,25 +250,19 @@ Line These nested if statements could be combined -161 - 164 +320–323 These nested if statements could be combined -326 - 329 - -These nested if statements could be combined -340 - 343
    +334–337

    org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

    - + - - - -
    Violation Line
    Avoid unused local variables such as 'line'.233
    Avoid empty while statements234 - 236
    +233–235

    org/owasp/dependencycheck/analyzer/CPEAnalyzer.java

    @@ -270,16 +271,16 @@ - + - + - + -
    Line
    Useless parentheses.213
    216
    These nested if statements could be combined531 - 536
    534–539
    These nested if statements could be combined532 - 535
    535–538
    These nested if statements could be combined541 - 544
    +544–547

    org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java

    @@ -288,7 +289,7 @@ -
    Line
    These nested if statements could be combined223 - 225
    +228–230

    org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java

    @@ -297,7 +298,7 @@ -
    Line
    These nested if statements could be combined129 - 150
    +133–153

    org/owasp/dependencycheck/analyzer/JarAnalyzer.java

    @@ -306,22 +307,16 @@ - - - -
    Line
    Useless parentheses.374
    These nested if statements could be combined928 - 931
    +374

    org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

    - + - - - -
    Violation Line
    An empty statement (semicolon) not part of a loop110
    Avoid unused local variables such as 'extractComments'.113
    +113

    org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java

    @@ -330,7 +325,7 @@ -
    Line
    Useless parentheses.76
    +76

    org/owasp/dependencycheck/data/cpe/IndexEntry.java

    @@ -339,10 +334,10 @@ - + -
    Line
    Useless parentheses.172
    172
    Useless parentheses.175
    +175

    org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java

    @@ -351,7 +346,7 @@ -
    Line
    These nested if statements could be combined242 - 244
    +248–250

    org/owasp/dependencycheck/data/nvdcve/CveDB.java

    @@ -360,13 +355,13 @@ - + - + -
    Line
    Avoid unused private fields such as 'SELECT_PROPERTY'.247
    250
    Avoid unused private fields such as 'DELETE_PROPERTY'.259
    262
    Useless parentheses.737
    +740

    org/owasp/dependencycheck/data/nvdcve/DriverShim.java

    @@ -375,7 +370,7 @@ -
    Line
    Useless parentheses.188
    +192

    org/owasp/dependencycheck/data/update/StandardUpdate.java

    @@ -384,7 +379,7 @@ -
    Line
    Useless parentheses.114
    +118

    org/owasp/dependencycheck/dependency/Dependency.java

    @@ -393,28 +388,28 @@ - + - + - + - + - + - + - + -
    Line
    Useless parentheses.494
    563
    Useless parentheses.497
    566
    Useless parentheses.500
    569
    Useless parentheses.503
    572
    Useless parentheses.506
    575
    Useless parentheses.509
    578
    Useless parentheses.524
    593
    Useless parentheses.527
    +596

    org/owasp/dependencycheck/dependency/Evidence.java

    @@ -423,7 +418,7 @@ -
    Line
    Useless parentheses.202
    +202

    org/owasp/dependencycheck/dependency/Identifier.java

    @@ -432,10 +427,10 @@ - + -
    Line
    Useless parentheses.175
    175
    Useless parentheses.178
    +178

    org/owasp/dependencycheck/dependency/Reference.java

    @@ -444,13 +439,13 @@ - + - + -
    Line
    Useless parentheses.109
    109
    Useless parentheses.112
    112
    Useless parentheses.115
    +115

    org/owasp/dependencycheck/dependency/Vulnerability.java

    @@ -459,7 +454,7 @@ -
    Line
    Useless parentheses.373
    +373

    org/owasp/dependencycheck/dependency/VulnerableSoftware.java

    @@ -468,13 +463,13 @@ - + - + -
    Line
    Useless parentheses.139
    143
    Useless parentheses.178
    182
    Useless parentheses.183
    +187

    org/owasp/dependencycheck/suppression/PropertyType.java

    @@ -483,7 +478,7 @@ -
    Line
    Useless parentheses.161
    +161

    org/owasp/dependencycheck/utils/Checksum.java

    @@ -492,7 +487,7 @@ -
    Line
    Useless parentheses.109
    +113

    org/owasp/dependencycheck/utils/DependencyVersion.java

    @@ -501,19 +496,10 @@ - + -
    Line
    Useless parentheses.135
    135
    Useless parentheses.194
    -
    -

    org/owasp/dependencycheck/utils/FileUtils.java

    - - - - - - -
    ViolationLine
    These nested if statements could be combined107 - 109
    +194 diff --git a/dependency-check-core/project-info.html b/dependency-check-core/project-info.html index 18eb2ed95..82fa3943c 100644 --- a/dependency-check-core/project-info.html +++ b/dependency-check-core/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -111,7 +111,7 @@ - +
  • diff --git a/dependency-check-core/project-reports.html b/dependency-check-core/project-reports.html index c8b4f35cf..0cc9b8aa9 100644 --- a/dependency-check-core/project-reports.html +++ b/dependency-check-core/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-core - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -90,7 +90,7 @@ Project Information - +
  • Project Reports @@ -145,6 +145,13 @@ Surefire Report
  • +
  • + + + + Failsafe Report +
  • +
  • @@ -161,16 +168,16 @@
  • - + - CPD Report + PMD
  • - + - PMD Report + CPD
  • @@ -261,21 +268,24 @@ Surefire Report Report on the test results of the project. +Failsafe Report +Report on the integration test results of the project. + Tag List Report on various tags found in the code. - + Checkstyle Report on coding style conventions. - -CPD Report -Duplicate code detection. -PMD Report +PMD Verification of coding rules. +CPD +Duplicate code detection. + FindBugs Report Generates a source code report with the FindBugs Library. - + JavaNCSS Report Code metric analysis. diff --git a/dependency-check-core/project-summary.html b/dependency-check-core/project-summary.html index 10dee0583..d8b2bebd8 100644 --- a/dependency-check-core/project-summary.html +++ b/dependency-check-core/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -111,7 +111,7 @@ - +
  • @@ -203,7 +203,7 @@ dependency-check-core Version -1.1.4 +1.2.0 Type jar diff --git a/dependency-check-core/surefire-report.html b/dependency-check-core/surefire-report.html index 625a6e660..520dbdac4 100644 --- a/dependency-check-core/surefire-report.html +++ b/dependency-check-core/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -90,7 +90,7 @@ Project Information - +
  • @@ -145,6 +145,13 @@ Surefire Report
  • +
  • + + + + Failsafe Report +
  • +
  • @@ -161,16 +168,16 @@
  • - + - CPD Report + PMD
  • - + - PMD Report + CPD
  • @@ -250,7 +257,8 @@ function toggleDisplay(elementId) {

    Surefire Report

    -

    Summary


    +

    Summary

    +

    [Summary] [Package List] [Test Cases]


    @@ -260,13 +268,1388 @@ function toggleDisplay(elementId) { + - - - -
    TestsSuccess Rate Time
    165 0 0000%0

    +1 +99.394% +51.533

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    +
    +

    Package List

    +

    [Summary] [Package List] [Test Cases]


    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    PackageTestsErrors FailuresSkippedSuccess RateTime
    org.owasp.dependencycheck.data.cwe1000100%0
    org.owasp.dependencycheck.data.nuget3000100%0.117
    org.owasp.dependencycheck.data.nexus4000100%1.324
    org.owasp.dependencycheck.dependency23000100%0.041
    org.owasp.dependencycheck.utils29000100%0
    org.owasp.dependencycheck.data.update.xml2000100%0.185
    org.owasp.dependencycheck.analyzer4100197.561%48.277
    org.owasp.dependencycheck.data.update10000100%0.001
    org.owasp.dependencycheck.data.nvdcve6000100%0.597
    org.owasp.dependencycheck.suppression35000100%0.008
    org.owasp.dependencycheck.data.lucene10000100%0.983
    org.owasp.dependencycheck.data.cpe1000100%0

    +

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    +
    +

    org.owasp.dependencycheck.data.cwe

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    CweDBTest1000100%0
    +
    +

    org.owasp.dependencycheck.data.nuget

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    XPathNuspecParserTest3000100%0.117
    +
    +

    org.owasp.dependencycheck.data.nexus

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    NexusSearchTest4000100%1.324
    +
    +

    org.owasp.dependencycheck.dependency

    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    DependencyTest20000100%0.041
    VulnerableSoftwareTest3000100%0
    +
    +

    org.owasp.dependencycheck.utils

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    ChecksumTest6000100%0
    DependencyVersionTest7000100%0
    DependencyVersionUtilTest1000100%0
    DownloaderTest1000100%0
    FileUtilsTest2000100%0
    FilterTest2000100%0
    SettingsTest10000100%0
    +
    +

    org.owasp.dependencycheck.data.update.xml

    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    NvdCve_1_2_HandlerTest1000100%0.046
    NvdCve_2_0_HandlerTest1000100%0.139
    +
    +

    org.owasp.dependencycheck.analyzer

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    AbstractFileTypeAnalyzerTest1000100%0.009
    AbstractSuppressionAnalyzerTest3000100%0.919
    AnalyzerServiceTest1000100%0.778
    AssemblyAnalyzerTest500180%0.63
    DependencyBundlingAnalyzerTest4000100%0
    FalsePositiveAnalyzerTest3000100%0
    FileNameAnalyzerTest5000100%0
    HintAnalyzerTest3000100%40.635
    JarAnalyzerTest5000100%4.002
    JavaScriptAnalyzerTest7000100%1.304
    NuspecAnalyzerTest4000100%0
    +
    +

    org.owasp.dependencycheck.data.update

    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    NvdCveInfoTest5000100%0.001
    UpdateableNvdCveTest5000100%0
    +
    +

    org.owasp.dependencycheck.data.nvdcve

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    DriverLoaderTest6000100%0.597
    +
    +

    org.owasp.dependencycheck.suppression

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    PropertyTypeTest4000100%0
    SuppressionHandlerTest1000100%0.008
    SuppressionParserTest1000100%0
    SuppressionRuleTest29000100%0
    +
    +

    org.owasp.dependencycheck.data.lucene

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    FieldAnalyzerTest1000100%0.252
    LuceneUtilsTest4000100%0
    TokenPairConcatenatingFilterTest2000100%0.09
    UrlTokenizingFilterTest3000100%0.641
    +
    +

    org.owasp.dependencycheck.data.cpe

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    IndexEntryTest1000100%0

    +
    +

    Test Cases

    +

    [Summary] [Package List] [Test Cases]

    +
    +

    AbstractFileTypeAnalyzerTest

    + + + + +
    testNewHashSet0.009
    +
    +

    AbstractSuppressionAnalyzerTest

    + + + + + + + + + + + + +
    testGetRules0.887
    testInitialize0.029
    testGetSupportedExtensions0.003
    +
    +

    AnalyzerServiceTest

    + + + + +
    testGetAnalyzers0.778
    +
    +

    AssemblyAnalyzerTest

    + + + + + + + + + + + + + + + + + + + + + + + + +
    testGetName0.206
    testAnalysis0.116
    testWithSettingMono +0
    skipped
    testNonexistent0.092
    testLog4Net0.216
    +
    +

    DependencyBundlingAnalyzerTest

    + + + + + + + + + + + + + + + + +
    testAnalyze0
    testGetAnalysisPhase0
    testGetName0
    testIsCore0
    +
    +

    FalsePositiveAnalyzerTest

    + + + + + + + + + + + + +
    testAnalyze0
    testGetAnalysisPhase0
    testGetName0
    +
    +

    FileNameAnalyzerTest

    + + + + + + + + + + + + + + + + + + + + +
    testAnalyze0
    testClose0
    testGetAnalysisPhase0
    testGetName0
    testInitialize0
    +
    +

    HintAnalyzerTest

    + + + + + + + + + + + + +
    testAnalyze34.827
    testGetAnalysisPhase3.124
    testGetName2.684
    +
    +

    JarAnalyzerTest

    + + + + + + + + + + + + + + + + + + + + +
    testAnalyze3.072
    testGetName0.218
    testInterpolateString0.247
    testSupportsExtension0.23
    testGetSupportedExtensions0.235
    +
    +

    JavaScriptAnalyzerTest

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testAnalyze1.301
    testClose0
    testGetAnalysisPhase0
    testGetName0.001
    testInitialize0
    testSupportsExtension0
    testGetSupportedExtensions0.002
    +
    +

    NuspecAnalyzerTest

    + + + + + + + + + + + + + + + + +
    testGetAnalysisPhaze0
    testSupportsExtension0
    testGetAnalyzerName0
    testGetSupportedExtensions0
    +
    +

    IndexEntryTest

    + + + + +
    testSetName0
    +
    +

    CweDBTest

    + + + + +
    testGetCweName0
    +
    +

    FieldAnalyzerTest

    + + + + +
    testAnalyzers0.252
    +
    +

    LuceneUtilsTest

    + + + + + + + + + + + + + + + + +
    testAppendEscapedLuceneQuery0
    testEscapeLuceneQuery0
    testEscapeLuceneQuery_null0
    testAppendEscapedLuceneQuery_null0
    +
    +

    TokenPairConcatenatingFilterTest

    + + + + + + + + +
    testClear0.084
    testExamples0.006
    +
    +

    UrlTokenizingFilterTest

    + + + + + + + + + + + + +
    testRandomStrings0.625
    testExamples0.009
    testEmptyTerm0.007
    +
    +

    NexusSearchTest

    + + + + + + + + + + + + + + + + +
    testNullSha10.977
    testMalformedSha10.049
    testValidSha10.145
    testMissingSha10.153
    +
    +

    XPathNuspecParserTest

    + + + + + + + + + + + + +
    testGoodDocument0.009
    testMissingDocument0.079
    testNotNuspec0.029
    +
    +

    DriverLoaderTest

    + + + + + + + + + + + + + + + + + + + + + + + + +
    testLoad_String0
    testLoad_String_ex0
    testLoad_String_String_badClassName0.004
    testLoad_String_String_badPath0.001
    testLoad_String_String0.045
    testLoad_String_String_multiple_paths0.547
    +
    +

    NvdCveInfoTest

    + + + + + + + + + + + + + + + + + + + + +
    testSetGetTimestamp0
    testSetGetNeedsUpdate0
    testSetGetOldSchemaVersionUrl0
    testSetGetUrl0.001
    testSetGetId0
    +
    +

    UpdateableNvdCveTest

    + + + + + + + + + + + + + + + + + + + + +
    testClear0
    testAdd_3args0
    testAdd_4args0
    testIsUpdateNeeded0
    testIterator0
    +
    +

    NvdCve_1_2_HandlerTest

    + + + + +
    testParse0.046
    +
    +

    NvdCve_2_0_HandlerTest

    + + + + +
    testParse0.139
    +
    +

    DependencyTest

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testGetEvidenceUsed0
    testGetSha1sum0.013
    testGetProductEvidence0
    testGetActualFilePath0.001
    testSetFileExtension0
    testGetIdentifiers0
    testSetSha1sum0
    testAddIdentifier0
    testGetVendorEvidence0
    testSetFileName0.001
    testSetFilePath0
    testGetFileName0
    testGetFilePath0
    testGetFileExtension0
    testSetMd5sum0
    testGetMd5sum0.024
    testGetEvidence0
    testSetIdentifiers0
    testGetVersionEvidence0
    testSetActualFilePath0.002
    +
    +

    VulnerableSoftwareTest

    + + + + + + + + + + + + +
    testCompareTo0
    testHashCode0
    testEquals0
    +
    +

    PropertyTypeTest

    + + + + + + + + + + + + + + + + +
    testSetGetValue0
    testMatches0
    testIsRegex0
    testIsCaseSensitive0
    +
    +

    SuppressionHandlerTest

    + + + + +
    testHandler0.008
    +
    +

    SuppressionParserTest

    + + + + +
    testParseSuppressionRules0
    +
    +

    SuppressionRuleTest

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testCpeHasNoVersion0
    testCpe0
    testCve0
    testCwe0
    testSha10
    testCpeMatches0
    testHasCvssBelow0
    testProcess0
    testGetSha10
    testAddCvssBelow0
    testFilePath0
    testGetCvssBelow0
    testSetFilePath0
    testGetFilePath0
    testAddCpe0
    testAddCve0
    testAddCwe0
    testGetCpe0
    testGetCve0
    testGetCwe0
    testHasCpe0
    testHasCve0
    testHasCwe0
    testSetCvssBelow0
    testSetSha10
    testSetCpe0
    testSetCve0
    testSetCwe0
    testCountCharacter0
    +
    +

    ChecksumTest

    + + + + + + + + + + + + + + + + + + + + + + + + +
    testGetChecksum_NoSuchAlgorithm0
    testGetChecksum0
    testGetMD5Checksum0
    testGetChecksum_FileNotFound0
    testGetHex0
    testGetSHA1Checksum0
    +
    +

    DependencyVersionTest

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testMatchesAtLeastThreeLevels0
    testToString0
    testCompareTo0
    testParseVersion0
    testHashCode0
    testEquals0
    testIterator0
    +
    +

    DependencyVersionUtilTest

    + + + + +
    testParseVersionFromFileName0
    +
    +

    DownloaderTest

    + + + + +
    testGetLastModified_file0
    +
    +

    FileUtilsTest

    + + + + + + + + +
    testGetFileExtension0
    testDelete0
    +
    +

    FilterTest

    + + + + + + + + +
    testFilter_Iterable0
    testPasses0
    +
    +

    SettingsTest

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testMergeProperties_String0
    testGetDataFile0
    testGetLong0
    testGetBoolean0
    testRemoveProperty0
    testSetString0
    testGetInt0
    testGetString_String0
    testGetString0
    testGetString_String_String0

    +
    +

    Failure Details

    +

    [Summary] [Package List] [Test Cases]


    + + + + + + +
    testWithSettingMono
    skipped: skipped

    diff --git a/dependency-check-core/taglist.html b/dependency-check-core/taglist.html index 83b95cf31..8392c6e4f 100644 --- a/dependency-check-core/taglist.html +++ b/dependency-check-core/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-core - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -90,7 +90,7 @@ Project Information - +
  • @@ -147,6 +147,13 @@ Surefire Report
  • +
  • + + + + Failsafe Report +
  • +
  • Tag List @@ -161,16 +168,16 @@
  • - + - CPD Report + PMD
  • - + - PMD Report + CPD
  • @@ -252,58 +259,58 @@ Line - can we get more evidence from the parent? EAR contains module name, etc. analyze the dependency (i.e. extract files) if it is a supported type. -229 +223 org.owasp.dependencycheck.analyzer.CPEAnalyzer Line - likely need to change the split... not sure if this will work for CPE with special chars -442 +445 the following isn't quite right is it? need to think about this guessing game a bit more. -528 +531 -org.owasp.dependencycheck.analyzer.CPEAnalyzerTest +org.owasp.dependencycheck.analyzer.CPEAnalyzerIntegrationTest Line - yeah, not a very good test as the results are the same with or without weighting... -222 +198 fix this assert Assert.assertEquals(expResult, result.get(0).getName()); -230 +206 org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzerTest Line review the generated test code and remove the default call to fail. fail("The test case is a prototype."); -84 +62 org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer Line fix the version problem below -127 +131 - can we utilize the pom's groupid and artifactId to filter??? most of these are due to low quality data. Other idea would be to say any CPE found based on LOW confidence evidence should have a different CPE type? (this might be a better solution then just removing the URL for "best-guess" matches). -236 +239 -move this startswith expression to a configuration file? -245 +move this startsWith expression to a configuration file? +248 org.owasp.dependencycheck.analyzer.JarAnalyzer Line remove weighting -650 +647 change this to a regex? -769 +765 org.owasp.dependencycheck.analyzer.JavaScriptAnalyzerTest Line improve the assertions assertTrue(depJQ6.getEvidence().size() > 0); assertTrue(depJQ10.getEvidence().size() > 0); assertTrue(depJQ10min.getEvidence().size() > 0); -125 +103 org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer Line @@ -327,19 +334,19 @@ Line consider utilizing the matchThreeVersion method to get additional results. However, this might also introduce false positives. -747 +750 org.owasp.dependencycheck.data.update.StandardUpdateIntegrationTest Line make this an actual test -100 +78 org.owasp.dependencycheck.dependency.EvidenceCollection Line consider changing the regex to only compare alpha-numeric (i.e. strip everything else) -233 +237 org.owasp.dependencycheck.utils.DependencyVersion Line @@ -351,7 +358,7 @@ Line add the FTP protocol? -158 +163 diff --git a/dependency-check-core/xref-test/allclasses-frame.html b/dependency-check-core/xref-test/allclasses-frame.html index 11fcf00a9..c58b9c26c 100644 --- a/dependency-check-core/xref-test/allclasses-frame.html +++ b/dependency-check-core/xref-test/allclasses-frame.html @@ -27,7 +27,7 @@ AnalyzerServiceTest
  • - ArchiveAnalyzerTest + ArchiveAnalyzerIntegrationTest
  • AssemblyAnalyzerTest @@ -36,22 +36,25 @@ BaseDBTestCase
  • - CPEAnalyzerTest + BaseTest +
  • +
  • + CPEAnalyzerIntegrationTest
  • ChecksumTest
  • - CveDBMySQLTest + CveDBIntegrationTest
  • - CveDBTest + CveDBMySQLTest
  • CweDBTest
  • - DatabasePropertiesTest + DatabasePropertiesIntegrationTest
  • DependencyBundlingAnalyzerTest @@ -91,6 +94,9 @@
  • FilterTest +
  • +
  • + HintAnalyzerTest
  • IndexEntryTest @@ -126,7 +132,7 @@ PropertyTypeTest
  • - ReportGeneratorTest + ReportGeneratorIntegrationTest
  • SettingsTest @@ -153,7 +159,7 @@ UrlTokenizingFilterTest
  • - VulnerabilitySuppressionAnalyzerTest + VulnerabilitySuppressionAnalyzerIntegrationTest
  • VulnerableSoftwareTest diff --git a/dependency-check-core/xref-test/index.html b/dependency-check-core/xref-test/index.html index e68cdab66..617b8c267 100644 --- a/dependency-check-core/xref-test/index.html +++ b/dependency-check-core/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Core 1.1.4 Reference + Dependency-Check Core 1.2.0 Reference diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html index 3b21c63f5..09e9e88e1 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html @@ -26,82 +26,75 @@ 18 package org.owasp.dependencycheck; 19 20 import org.junit.After; -21 import org.junit.AfterClass; -22 import static org.junit.Assert.assertTrue; -23 import org.junit.Before; -24 import org.junit.BeforeClass; -25 import org.junit.Test; -26 import org.owasp.dependencycheck.data.nvdcve.CveDB; -27 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -28 import org.owasp.dependencycheck.dependency.Dependency; -29 import org.owasp.dependencycheck.reporting.ReportGenerator; -30 import org.owasp.dependencycheck.utils.Settings; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class EngineIntegrationTest { -37 -38 @BeforeClass -39 public static void setUpClass() throws Exception { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() throws Exception { -44 } -45 -46 @Before -47 public void setUp() throws Exception { -48 org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase.ensureDBExists(); -49 } -50 -51 @After -52 public void tearDown() { -53 } -54 -55 /** -56 * Test of scan method, of class Engine. -57 * -58 * @throws Exception is thrown when an exception occurs. -59 */ -60 @Test -61 public void testScan() throws Exception { -62 String testClasses = "target/test-classes/*.zip"; -63 boolean autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); -64 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); -65 Engine instance = new Engine(); -66 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -67 instance.scan(testClasses); -68 assertTrue(instance.getDependencies().size() > 0); -69 for (Dependency d : instance.getDependencies()) { -70 assertTrue("non-zip file collected " + d.getFileName(), d.getFileName().toLowerCase().endsWith(".zip")); -71 } -72 instance.cleanup(); -73 } -74 -75 /** -76 * Test running the entire engine. -77 * -78 * @throws Exception is thrown when an exception occurs. -79 */ -80 @Test -81 public void testEngine() throws Exception { -82 String testClasses = "target/test-classes"; -83 Engine instance = new Engine(); -84 instance.scan(testClasses); -85 assertTrue(instance.getDependencies().size() > 0); -86 instance.analyzeDependencies(); -87 CveDB cveDB = new CveDB(); -88 cveDB.open(); -89 DatabaseProperties dbProp = cveDB.getDatabaseProperties(); -90 cveDB.close(); -91 ReportGenerator rg = new ReportGenerator("DependencyCheck", -92 instance.getDependencies(), instance.getAnalyzers(), dbProp); -93 rg.generateReports("./target/", "ALL"); -94 instance.cleanup(); -95 } -96 } +21 import static org.junit.Assert.assertTrue; +22 import org.junit.Before; +23 import org.junit.Test; +24 import org.owasp.dependencycheck.data.nvdcve.CveDB; +25 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +26 import org.owasp.dependencycheck.dependency.Dependency; +27 import org.owasp.dependencycheck.reporting.ReportGenerator; +28 import org.owasp.dependencycheck.utils.Settings; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class EngineIntegrationTest extends BaseTest { +35 +36 @Before +37 public void setUp() throws Exception { +38 org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase.ensureDBExists(); +39 } +40 +41 @After +42 public void tearDown() { +43 } +44 +45 /** +46 * Test of scan method, of class Engine. +47 * +48 * @throws Exception is thrown when an exception occurs. +49 */ +50 @Test +51 public void testScan() throws Exception { +52 String testClasses = "target/test-classes/*.zip"; +53 boolean autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); +54 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +55 Engine instance = new Engine(); +56 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +57 instance.scan(testClasses); +58 assertTrue(instance.getDependencies().size() > 0); +59 for (Dependency d : instance.getDependencies()) { +60 assertTrue("non-zip file collected " + d.getFileName(), d.getFileName().toLowerCase().endsWith(".zip")); +61 } +62 instance.cleanup(); +63 } +64 +65 /** +66 * Test running the entire engine. +67 * +68 * @throws Exception is thrown when an exception occurs. +69 */ +70 @Test +71 public void testEngine() throws Exception { +72 String testClasses = "target/test-classes"; +73 // boolean autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); +74 // Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +75 Engine instance = new Engine(); +76 // Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +77 instance.scan(testClasses); +78 assertTrue(instance.getDependencies().size() > 0); +79 instance.analyzeDependencies(); +80 CveDB cveDB = new CveDB(); +81 cveDB.open(); +82 DatabaseProperties dbProp = cveDB.getDatabaseProperties(); +83 cveDB.close(); +84 ReportGenerator rg = new ReportGenerator("DependencyCheck", +85 instance.getDependencies(), instance.getAnalyzers(), dbProp); +86 rg.generateReports("./target/", "ALL"); +87 instance.cleanup(); +88 } +89 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzerTest.html index 39b4f0aed..efea6734a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzerTest.html @@ -26,50 +26,28 @@ 18 package org.owasp.dependencycheck.analyzer; 19 20 import java.util.Set; -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import static org.junit.Assert.assertEquals; -24 import static org.junit.Assert.assertTrue; -25 import org.junit.Before; -26 import org.junit.BeforeClass; -27 import org.junit.Test; -28 -29 /** -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public class AbstractFileTypeAnalyzerTest { -34 -35 public AbstractFileTypeAnalyzerTest() { -36 } -37 -38 @BeforeClass -39 public static void setUpClass() throws Exception { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() throws Exception { -44 } -45 -46 @Before -47 public void setUp() { -48 } -49 -50 @After -51 public void tearDown() { -52 } -53 -54 /** -55 * Test of newHashSet method, of class AbstractAnalyzer. -56 */ -57 @Test -58 public void testNewHashSet() { -59 Set result = AbstractFileTypeAnalyzer.newHashSet("one", "two"); -60 assertEquals(2, result.size()); -61 assertTrue(result.contains("one")); -62 assertTrue(result.contains("two")); -63 } -64 } +21 import static org.junit.Assert.assertEquals; +22 import static org.junit.Assert.assertTrue; +23 import org.junit.Test; +24 import org.owasp.dependencycheck.BaseTest; +25 +26 /** +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class AbstractFileTypeAnalyzerTest extends BaseTest { +31 +32 /** +33 * Test of newHashSet method, of class AbstractAnalyzer. +34 */ +35 @Test +36 public void testNewHashSet() { +37 Set result = AbstractFileTypeAnalyzer.newHashSet("one", "two"); +38 assertEquals(2, result.size()); +39 assertTrue(result.contains("one")); +40 assertTrue(result.contains("two")); +41 } +42 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html index d9f06300b..d813ef709 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html @@ -31,102 +31,85 @@ 23 import java.util.Set; 24 import java.util.logging.Level; 25 import java.util.logging.Logger; -26 import org.junit.After; -27 import org.junit.AfterClass; -28 import static org.junit.Assert.assertEquals; -29 import static org.junit.Assert.assertNull; -30 import org.junit.Before; -31 import org.junit.BeforeClass; -32 import org.junit.Test; -33 import org.owasp.dependencycheck.Engine; -34 import org.owasp.dependencycheck.analyzer.exception.AnalysisException; -35 import org.owasp.dependencycheck.dependency.Dependency; -36 import org.owasp.dependencycheck.suppression.SuppressionRule; -37 import org.owasp.dependencycheck.utils.Settings; -38 -39 /** -40 * -41 * @author Jeremy Long <jeremy.long@owasp.org> -42 */ -43 public class AbstractSuppressionAnalyzerTest { -44 -45 public AbstractSuppressionAnalyzerTest() { -46 } -47 -48 @BeforeClass -49 public static void setUpClass() { -50 } -51 -52 @AfterClass -53 public static void tearDownClass() { -54 } -55 -56 @Before -57 public void setUp() { -58 try { -59 final String uri = this.getClass().getClassLoader().getResource("suppressions.xml").toURI().toURL().toString(); -60 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, uri); -61 } catch (URISyntaxException ex) { -62 Logger.getLogger(AbstractSuppressionAnalyzerTest.class.getName()).log(Level.SEVERE, null, ex); -63 } catch (MalformedURLException ex) { -64 Logger.getLogger(AbstractSuppressionAnalyzerTest.class.getName()).log(Level.SEVERE, null, ex); -65 } -66 } -67 -68 @After -69 public void tearDown() { -70 } -71 -72 /** -73 * Test of getSupportedExtensions method, of class AbstractSuppressionAnalyzer. -74 */ -75 @Test -76 public void testGetSupportedExtensions() { -77 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl(); -78 Set<String> result = instance.getSupportedExtensions(); -79 assertNull(result); -80 } -81 -82 /** -83 * Test of initialize method, of class AbstractSuppressionAnalyzer. -84 */ -85 @Test -86 public void testInitialize() throws Exception { -87 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl(); -88 instance.initialize(); -89 } -90 -91 /** -92 * Test of getRules method, of class AbstractSuppressionAnalyzer. -93 */ -94 @Test -95 public void testGetRules() throws Exception { -96 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl(); -97 instance.initialize(); -98 int expCount = 5; -99 List<SuppressionRule> result = instance.getRules(); -100 assertEquals(expCount, result.size()); -101 } -102 -103 public class AbstractSuppressionAnalyzerImpl extends AbstractSuppressionAnalyzer { -104 -105 @Override -106 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -107 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -108 } -109 -110 @Override -111 public String getName() { -112 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -113 } -114 -115 @Override -116 public AnalysisPhase getAnalysisPhase() { -117 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -118 } -119 } -120 -121 } +26 import static org.junit.Assert.assertEquals; +27 import static org.junit.Assert.assertNull; +28 import org.junit.Before; +29 import org.junit.Test; +30 import org.owasp.dependencycheck.BaseTest; +31 import org.owasp.dependencycheck.Engine; +32 import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +33 import org.owasp.dependencycheck.dependency.Dependency; +34 import org.owasp.dependencycheck.suppression.SuppressionRule; +35 import org.owasp.dependencycheck.utils.Settings; +36 +37 /** +38 * +39 * @author Jeremy Long <jeremy.long@owasp.org> +40 */ +41 public class AbstractSuppressionAnalyzerTest extends BaseTest { +42 +43 @Before +44 public void setUp() throws Exception { +45 try { +46 final String uri = this.getClass().getClassLoader().getResource("suppressions.xml").toURI().toURL().toString(); +47 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, uri); +48 } catch (URISyntaxException ex) { +49 Logger.getLogger(AbstractSuppressionAnalyzerTest.class.getName()).log(Level.SEVERE, null, ex); +50 } catch (MalformedURLException ex) { +51 Logger.getLogger(AbstractSuppressionAnalyzerTest.class.getName()).log(Level.SEVERE, null, ex); +52 } +53 } +54 +55 /** +56 * Test of getSupportedExtensions method, of class AbstractSuppressionAnalyzer. +57 */ +58 @Test +59 public void testGetSupportedExtensions() { +60 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl(); +61 Set<String> result = instance.getSupportedExtensions(); +62 assertNull(result); +63 } +64 +65 /** +66 * Test of initialize method, of class AbstractSuppressionAnalyzer. +67 */ +68 @Test +69 public void testInitialize() throws Exception { +70 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl(); +71 instance.initialize(); +72 } +73 +74 /** +75 * Test of getRules method, of class AbstractSuppressionAnalyzer. +76 */ +77 @Test +78 public void testGetRules() throws Exception { +79 AbstractSuppressionAnalyzer instance = new AbstractSuppressionAnalyzerImpl(); +80 instance.initialize(); +81 int expCount = 5; +82 List<SuppressionRule> result = instance.getRules(); +83 assertEquals(expCount, result.size()); +84 } +85 +86 public class AbstractSuppressionAnalyzerImpl extends AbstractSuppressionAnalyzer { +87 +88 @Override +89 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +90 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +91 } +92 +93 @Override +94 public String getName() { +95 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +96 } +97 +98 @Override +99 public AnalysisPhase getAnalysisPhase() { +100 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +101 } +102 } +103 +104 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html index ad10b55a4..f7112af8a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html @@ -26,56 +26,34 @@ 18 package org.owasp.dependencycheck.analyzer; 19 20 import java.util.Iterator; -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import static org.junit.Assert.assertTrue; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.junit.Test; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class AnalyzerServiceTest { -33 -34 public AnalyzerServiceTest() { -35 } -36 -37 @BeforeClass -38 public static void setUpClass() throws Exception { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() throws Exception { -43 } -44 -45 @Before -46 public void setUp() { +21 import static org.junit.Assert.assertTrue; +22 import org.junit.Test; +23 import org.owasp.dependencycheck.BaseTest; +24 +25 /** +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29 public class AnalyzerServiceTest extends BaseTest { +30 +31 /** +32 * Test of getAnalyzers method, of class AnalyzerService. +33 */ +34 @Test +35 public void testGetAnalyzers() { +36 AnalyzerService instance = new AnalyzerService(Thread.currentThread().getContextClassLoader()); +37 Iterator<Analyzer> result = instance.getAnalyzers(); +38 +39 boolean found = false; +40 while (result.hasNext()) { +41 Analyzer a = result.next(); +42 if ("Jar Analyzer".equals(a.getName())) { +43 found = true; +44 } +45 } +46 assertTrue("JarAnalyzer loaded", found); 47 } -48 -49 @After -50 public void tearDown() { -51 } -52 -53 /** -54 * Test of getAnalyzers method, of class AnalyzerService. -55 */ -56 @Test -57 public void testGetAnalyzers() { -58 AnalyzerService instance = AnalyzerService.getInstance(); -59 Iterator<Analyzer> result = instance.getAnalyzers(); -60 -61 boolean found = false; -62 while (result.hasNext()) { -63 Analyzer a = result.next(); -64 if ("Jar Analyzer".equals(a.getName())) { -65 found = true; -66 } -67 } -68 assertTrue("JarAnalyzer loaded", found); -69 } -70 } +48 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.html index 5a964fa74..13eeeff5c 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.html @@ -25,162 +25,165 @@ 17 */ 18 package org.owasp.dependencycheck.analyzer; 19 -20 import static org.junit.Assert.assertEquals; -21 import static org.junit.Assert.assertTrue; -22 import static org.junit.Assert.fail; -23 import static org.junit.Assume.assumeFalse; -24 -25 import java.io.File; -26 import java.util.logging.Level; -27 import java.util.logging.Logger; -28 -29 import org.junit.After; -30 import org.junit.Assume; -31 import org.junit.Before; -32 import org.junit.Test; -33 import org.owasp.dependencycheck.analyzer.exception.AnalysisException; -34 import org.owasp.dependencycheck.dependency.Confidence; -35 import org.owasp.dependencycheck.dependency.Dependency; -36 import org.owasp.dependencycheck.dependency.Evidence; -37 import org.owasp.dependencycheck.utils.Settings; -38 -39 /** -40 * Tests for the AssemblyAnalyzer. -41 * -42 * @author colezlaw -43 * -44 */ -45 public class AssemblyAnalyzerTest { -46 -47 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzerTest.class.getName()); -48 -49 AssemblyAnalyzer analyzer; -50 -51 /** -52 * Sets up the analyzer. -53 * -54 * @throws Exception if anything goes sideways -55 */ -56 @Before -57 public void setUp() { -58 try { -59 analyzer = new AssemblyAnalyzer(); -60 analyzer.supportsExtension("dll"); -61 analyzer.initialize(); -62 } catch (Exception e) { -63 LOGGER.log(Level.WARNING, "Exception setting up AssemblyAnalyzer. Tests will be incomplete", e); -64 Assume.assumeNoException("Is mono installed? TESTS WILL BE INCOMPLETE", e); -65 } -66 } -67 -68 /** -69 * Tests to make sure the name is correct. -70 */ -71 @Test -72 public void testGetName() { -73 assertEquals("Assembly Analyzer", analyzer.getName()); -74 } -75 -76 @Test -77 public void testAnalysis() throws Exception { -78 File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("GrokAssembly.exe").getPath()); -79 Dependency d = new Dependency(f); -80 analyzer.analyze(d, null); -81 boolean foundVendor = false; -82 for (Evidence e : d.getVendorEvidence().getEvidence("grokassembly", "vendor")) { -83 if ("OWASP".equals(e.getValue())) { -84 foundVendor = true; -85 } -86 } -87 assertTrue(foundVendor); -88 -89 boolean foundProduct = false; -90 for (Evidence e : d.getProductEvidence().getEvidence("grokassembly", "product")) { -91 if ("GrokAssembly".equals(e.getValue())) { -92 foundProduct = true; -93 } -94 } -95 assertTrue(foundProduct); -96 } -97 -98 @Test -99 public void testLog4Net() throws Exception { -100 File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath()); -101 Dependency d = new Dependency(f); -102 analyzer.analyze(d, null); -103 assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly", "version", "1.2.13.0", Confidence.HIGHEST))); -104 assertTrue(d.getVendorEvidence().getEvidence().contains(new Evidence("grokassembly", "vendor", "The Apache Software Foundation", Confidence.HIGH))); -105 assertTrue(d.getProductEvidence().getEvidence().contains(new Evidence("grokassembly", "product", "log4net", Confidence.HIGH))); -106 } -107 -108 @Test -109 public void testNonexistent() { -110 Level oldLevel = Logger.getLogger(AssemblyAnalyzer.class.getName()).getLevel(); -111 Level oldDependency = Logger.getLogger(Dependency.class.getName()).getLevel(); -112 // Tweak the log level so the warning doesn't show in the console -113 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(Level.OFF); -114 Logger.getLogger(Dependency.class.getName()).setLevel(Level.OFF); -115 File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath()); -116 File test = new File(f.getParent(), "nonexistent.dll"); -117 Dependency d = new Dependency(test); -118 -119 try { -120 analyzer.analyze(d, null); -121 fail("Expected an AnalysisException"); -122 } catch (AnalysisException ae) { -123 assertEquals("File does not exist", ae.getMessage()); -124 } finally { -125 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(oldLevel); -126 Logger.getLogger(Dependency.class.getName()).setLevel(oldDependency); -127 } -128 } -129 -130 @Test -131 public void testWithSettingMono() throws Exception { +20 import java.io.File; +21 import java.util.logging.Level; +22 import java.util.logging.Logger; +23 import org.junit.After; +24 import static org.junit.Assert.assertEquals; +25 import static org.junit.Assert.assertTrue; +26 import static org.junit.Assert.fail; +27 import org.junit.Assume; +28 import static org.junit.Assume.assumeFalse; +29 import org.junit.Before; +30 import org.junit.Test; +31 import org.owasp.dependencycheck.BaseTest; +32 import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +33 import org.owasp.dependencycheck.dependency.Confidence; +34 import org.owasp.dependencycheck.dependency.Dependency; +35 import org.owasp.dependencycheck.dependency.Evidence; +36 import org.owasp.dependencycheck.utils.Settings; +37 +38 /** +39 * Tests for the AssemblyAnalyzer. +40 * +41 * @author colezlaw +42 * +43 */ +44 public class AssemblyAnalyzerTest extends BaseTest { +45 +46 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzerTest.class.getName()); +47 +48 AssemblyAnalyzer analyzer; +49 +50 /** +51 * Sets up the analyzer. +52 * +53 * @throws Exception if anything goes sideways +54 */ +55 @Before +56 public void setUp() throws Exception { +57 try { +58 analyzer = new AssemblyAnalyzer(); +59 analyzer.supportsExtension("dll"); +60 analyzer.initialize(); +61 } catch (Exception e) { +62 if (e.getMessage().contains("Could not execute .NET AssemblyAnalyzer")) { +63 LOGGER.log(Level.WARNING, "Exception setting up AssemblyAnalyzer. Tests will be incomplete"); +64 } else { +65 LOGGER.log(Level.WARNING, "Exception setting up AssemblyAnalyzer. Tests will be incomplete", e); +66 } +67 Assume.assumeNoException("Is mono installed? TESTS WILL BE INCOMPLETE", e); +68 } +69 } +70 +71 /** +72 * Tests to make sure the name is correct. +73 */ +74 @Test +75 public void testGetName() { +76 assertEquals("Assembly Analyzer", analyzer.getName()); +77 } +78 +79 @Test +80 public void testAnalysis() throws Exception { +81 File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("GrokAssembly.exe").getPath()); +82 Dependency d = new Dependency(f); +83 analyzer.analyze(d, null); +84 boolean foundVendor = false; +85 for (Evidence e : d.getVendorEvidence().getEvidence("grokassembly", "vendor")) { +86 if ("OWASP".equals(e.getValue())) { +87 foundVendor = true; +88 } +89 } +90 assertTrue(foundVendor); +91 +92 boolean foundProduct = false; +93 for (Evidence e : d.getProductEvidence().getEvidence("grokassembly", "product")) { +94 if ("GrokAssembly".equals(e.getValue())) { +95 foundProduct = true; +96 } +97 } +98 assertTrue(foundProduct); +99 } +100 +101 @Test +102 public void testLog4Net() throws Exception { +103 File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath()); +104 Dependency d = new Dependency(f); +105 analyzer.analyze(d, null); +106 assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly", "version", "1.2.13.0", Confidence.HIGHEST))); +107 assertTrue(d.getVendorEvidence().getEvidence().contains(new Evidence("grokassembly", "vendor", "The Apache Software Foundation", Confidence.HIGH))); +108 assertTrue(d.getProductEvidence().getEvidence().contains(new Evidence("grokassembly", "product", "log4net", Confidence.HIGH))); +109 } +110 +111 @Test +112 public void testNonexistent() { +113 Level oldLevel = Logger.getLogger(AssemblyAnalyzer.class.getName()).getLevel(); +114 Level oldDependency = Logger.getLogger(Dependency.class.getName()).getLevel(); +115 // Tweak the log level so the warning doesn't show in the console +116 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(Level.OFF); +117 Logger.getLogger(Dependency.class.getName()).setLevel(Level.OFF); +118 File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath()); +119 File test = new File(f.getParent(), "nonexistent.dll"); +120 Dependency d = new Dependency(test); +121 +122 try { +123 analyzer.analyze(d, null); +124 fail("Expected an AnalysisException"); +125 } catch (AnalysisException ae) { +126 assertEquals("File does not exist", ae.getMessage()); +127 } finally { +128 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(oldLevel); +129 Logger.getLogger(Dependency.class.getName()).setLevel(oldDependency); +130 } +131 } 132 -133 //This test doesn't work on Windows. -134 assumeFalse(System.getProperty("os.name").startsWith("Windows")); +133 @Test +134 public void testWithSettingMono() throws Exception { 135 -136 String oldValue = Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH); -137 // if oldValue is null, that means that neither the system property nor the setting has -138 // been set. If that's the case, then we have to make it such that when we recover, -139 // null still comes back. But you can't put a null value in a HashMap, so we have to set -140 // the system property rather than the setting. -141 if (oldValue == null) { -142 System.setProperty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono"); -143 } else { -144 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono"); -145 } -146 -147 Level oldLevel = Logger.getLogger(AssemblyAnalyzer.class.getName()).getLevel(); -148 try { -149 // Tweak the logging to swallow the warning when testing -150 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(Level.OFF); -151 // Have to make a NEW analyzer because during setUp, it would have gotten the correct one -152 AssemblyAnalyzer aanalyzer = new AssemblyAnalyzer(); -153 aanalyzer.supportsExtension("dll"); -154 aanalyzer.initialize(); -155 fail("Expected an AnalysisException"); -156 } catch (AnalysisException ae) { -157 assertEquals("An error occured with the .NET AssemblyAnalyzer", ae.getMessage()); -158 } finally { -159 // Recover the logger -160 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(oldLevel); -161 // Now recover the way we came in. If we had to set a System property, delete it. Otherwise, -162 // reset the old value -163 if (oldValue == null) { -164 System.getProperties().remove(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH); -165 } else { -166 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, oldValue); -167 } -168 } -169 } -170 -171 @After -172 public void tearDown() throws Exception { -173 analyzer.close(); -174 } -175 } +136 //This test doesn't work on Windows. +137 assumeFalse(System.getProperty("os.name").startsWith("Windows")); +138 +139 String oldValue = Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH); +140 // if oldValue is null, that means that neither the system property nor the setting has +141 // been set. If that's the case, then we have to make it such that when we recover, +142 // null still comes back. But you can't put a null value in a HashMap, so we have to set +143 // the system property rather than the setting. +144 if (oldValue == null) { +145 System.setProperty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono"); +146 } else { +147 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono"); +148 } +149 +150 Level oldLevel = Logger.getLogger(AssemblyAnalyzer.class.getName()).getLevel(); +151 try { +152 // Tweak the logging to swallow the warning when testing +153 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(Level.OFF); +154 // Have to make a NEW analyzer because during setUp, it would have gotten the correct one +155 AssemblyAnalyzer aanalyzer = new AssemblyAnalyzer(); +156 aanalyzer.supportsExtension("dll"); +157 aanalyzer.initialize(); +158 fail("Expected an AnalysisException"); +159 } catch (AnalysisException ae) { +160 assertEquals("An error occured with the .NET AssemblyAnalyzer", ae.getMessage()); +161 } finally { +162 // Recover the logger +163 Logger.getLogger(AssemblyAnalyzer.class.getName()).setLevel(oldLevel); +164 // Now recover the way we came in. If we had to set a System property, delete it. Otherwise, +165 // reset the old value +166 if (oldValue == null) { +167 System.getProperties().remove(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH); +168 } else { +169 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, oldValue); +170 } +171 } +172 } +173 +174 @After +175 public void tearDown() throws Exception { +176 analyzer.close(); +177 } +178 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html index 1e7f1efad..21c8f9093 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html @@ -25,98 +25,76 @@ 17 */ 18 package org.owasp.dependencycheck.analyzer; 19 -20 import org.junit.After; -21 import org.junit.AfterClass; -22 import static org.junit.Assert.assertEquals; -23 import org.junit.Before; -24 import org.junit.BeforeClass; -25 import org.junit.Test; -26 import org.owasp.dependencycheck.dependency.Dependency; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class DependencyBundlingAnalyzerTest { -33 -34 public DependencyBundlingAnalyzerTest() { -35 } -36 -37 @BeforeClass -38 public static void setUpClass() { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() { -43 } -44 -45 @Before -46 public void setUp() { -47 } -48 -49 @After -50 public void tearDown() { +20 import static org.junit.Assert.assertEquals; +21 import org.junit.Test; +22 import org.owasp.dependencycheck.BaseTest; +23 import org.owasp.dependencycheck.dependency.Dependency; +24 +25 /** +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29 public class DependencyBundlingAnalyzerTest extends BaseTest { +30 +31 /** +32 * Test of getName method, of class DependencyBundlingAnalyzer. +33 */ +34 @Test +35 public void testGetName() { +36 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); +37 String expResult = "Dependency Bundling Analyzer"; +38 String result = instance.getName(); +39 assertEquals(expResult, result); +40 } +41 +42 /** +43 * Test of getAnalysisPhase method, of class DependencyBundlingAnalyzer. +44 */ +45 @Test +46 public void testGetAnalysisPhase() { +47 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); +48 AnalysisPhase expResult = AnalysisPhase.PRE_FINDING_ANALYSIS; +49 AnalysisPhase result = instance.getAnalysisPhase(); +50 assertEquals(expResult, result); 51 } 52 53 /** -54 * Test of getName method, of class DependencyBundlingAnalyzer. +54 * Test of analyze method, of class DependencyBundlingAnalyzer. 55 */ 56 @Test -57 public void testGetName() { -58 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); -59 String expResult = "Dependency Bundling Analyzer"; -60 String result = instance.getName(); -61 assertEquals(expResult, result); -62 } -63 -64 /** -65 * Test of getAnalysisPhase method, of class DependencyBundlingAnalyzer. -66 */ -67 @Test -68 public void testGetAnalysisPhase() { -69 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); -70 AnalysisPhase expResult = AnalysisPhase.PRE_FINDING_ANALYSIS; -71 AnalysisPhase result = instance.getAnalysisPhase(); -72 assertEquals(expResult, result); -73 } -74 -75 /** -76 * Test of analyze method, of class DependencyBundlingAnalyzer. -77 */ -78 @Test -79 public void testAnalyze() throws Exception { -80 // Dependency ignore = null; -81 // Engine engine = null; -82 // DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); -83 // instance.analyze(ignore, engine); -84 // // TODO review the generated test code and remove the default call to fail. -85 // fail("The test case is a prototype."); -86 } -87 -88 /** -89 * Test of isCore method, of class DependencyBundlingAnalyzer. -90 */ -91 @Test -92 public void testIsCore() { -93 Dependency left = new Dependency(); -94 Dependency right = new Dependency(); -95 -96 left.setFileName("axis2-kernel-1.4.1.jar"); -97 right.setFileName("axis2-adb-1.4.1.jar"); -98 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); -99 boolean expResult = true; -100 boolean result = instance.isCore(left, right); -101 assertEquals(expResult, result); -102 -103 left.setFileName("struts-1.2.7.jar"); -104 right.setFileName("file.tar.gz\\file.tar\\struts.jar"); -105 -106 expResult = true; -107 result = instance.isCore(left, right); -108 assertEquals(expResult, result); -109 } -110 -111 } +57 public void testAnalyze() throws Exception { +58 // Dependency ignore = null; +59 // Engine engine = null; +60 // DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); +61 // instance.analyze(ignore, engine); +62 // // TODO review the generated test code and remove the default call to fail. +63 // fail("The test case is a prototype."); +64 } +65 +66 /** +67 * Test of isCore method, of class DependencyBundlingAnalyzer. +68 */ +69 @Test +70 public void testIsCore() { +71 Dependency left = new Dependency(); +72 Dependency right = new Dependency(); +73 +74 left.setFileName("axis2-kernel-1.4.1.jar"); +75 right.setFileName("axis2-adb-1.4.1.jar"); +76 DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer(); +77 boolean expResult = true; +78 boolean result = instance.isCore(left, right); +79 assertEquals(expResult, result); +80 +81 left.setFileName("struts-1.2.7.jar"); +82 right.setFileName("file.tar.gz\\file.tar\\struts.jar"); +83 +84 expResult = true; +85 result = instance.isCore(left, right); +86 assertEquals(expResult, result); +87 } +88 +89 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html index c3645d231..81ee03a6b 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html @@ -23,80 +23,57 @@ 15 */ 16 package org.owasp.dependencycheck.analyzer; 17 -18 import org.junit.After; -19 import org.junit.AfterClass; -20 import static org.junit.Assert.assertEquals; -21 import static org.junit.Assert.assertTrue; -22 import org.junit.Before; -23 import org.junit.BeforeClass; -24 import org.junit.Test; -25 import org.owasp.dependencycheck.Engine; -26 import org.owasp.dependencycheck.dependency.Dependency; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class FalsePositiveAnalyzerTest { -33 -34 public FalsePositiveAnalyzerTest() { -35 } -36 -37 @BeforeClass -38 public static void setUpClass() { +18 import static org.junit.Assert.assertEquals; +19 import static org.junit.Assert.assertTrue; +20 import org.junit.Test; +21 import org.owasp.dependencycheck.Engine; +22 import org.owasp.dependencycheck.dependency.Dependency; +23 +24 /** +25 * +26 * @author Jeremy Long <jeremy.long@owasp.org> +27 */ +28 public class FalsePositiveAnalyzerTest { +29 +30 /** +31 * Test of getName method, of class FalsePositiveAnalyzer. +32 */ +33 @Test +34 public void testGetName() { +35 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer(); +36 String expResult = "False Positive Analyzer"; +37 String result = instance.getName(); +38 assertEquals(expResult, result); 39 } 40 -41 @AfterClass -42 public static void tearDownClass() { -43 } -44 -45 @Before -46 public void setUp() { -47 } -48 -49 @After -50 public void tearDown() { -51 } -52 -53 /** -54 * Test of getName method, of class FalsePositiveAnalyzer. -55 */ -56 @Test -57 public void testGetName() { -58 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer(); -59 String expResult = "False Positive Analyzer"; -60 String result = instance.getName(); -61 assertEquals(expResult, result); -62 } -63 -64 /** -65 * Test of getAnalysisPhase method, of class FalsePositiveAnalyzer. -66 */ -67 @Test -68 public void testGetAnalysisPhase() { -69 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer(); -70 AnalysisPhase expResult = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; -71 AnalysisPhase result = instance.getAnalysisPhase(); -72 assertEquals(expResult, result); -73 } -74 -75 /** -76 * Test of analyze method, of class FalsePositiveAnalyzer. -77 */ -78 @Test -79 public void testAnalyze() throws Exception { -80 Dependency dependency = new Dependency(); -81 dependency.setFileName("pom.xml"); -82 dependency.addIdentifier("cpe", "cpe:/a:file:file:1.2.1", "http://some.org/url"); -83 Engine engine = null; -84 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer(); -85 int before = dependency.getIdentifiers().size(); -86 instance.analyze(dependency, engine); -87 int after = dependency.getIdentifiers().size(); -88 assertTrue(before > after); -89 } -90 -91 } +41 /** +42 * Test of getAnalysisPhase method, of class FalsePositiveAnalyzer. +43 */ +44 @Test +45 public void testGetAnalysisPhase() { +46 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer(); +47 AnalysisPhase expResult = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; +48 AnalysisPhase result = instance.getAnalysisPhase(); +49 assertEquals(expResult, result); +50 } +51 +52 /** +53 * Test of analyze method, of class FalsePositiveAnalyzer. +54 */ +55 @Test +56 public void testAnalyze() throws Exception { +57 Dependency dependency = new Dependency(); +58 dependency.setFileName("pom.xml"); +59 dependency.addIdentifier("cpe", "cpe:/a:file:file:1.2.1", "http://some.org/url"); +60 Engine engine = null; +61 FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer(); +62 int before = dependency.getIdentifiers().size(); +63 instance.analyze(dependency, engine); +64 int after = dependency.getIdentifiers().size(); +65 assertTrue(before > after); +66 } +67 +68 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html index 8152d5296..ad1279db5 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html @@ -26,100 +26,77 @@ 18 package org.owasp.dependencycheck.analyzer; 19 20 import java.io.File; -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import static org.junit.Assert.assertEquals; -24 import static org.junit.Assert.assertTrue; -25 import org.junit.Before; -26 import org.junit.BeforeClass; -27 import org.junit.Test; -28 import org.owasp.dependencycheck.dependency.Dependency; -29 -30 /** -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34 public class FileNameAnalyzerTest { -35 -36 public FileNameAnalyzerTest() { -37 } -38 -39 @BeforeClass -40 public static void setUpClass() throws Exception { +21 import static org.junit.Assert.assertEquals; +22 import static org.junit.Assert.assertTrue; +23 import org.junit.Test; +24 import org.owasp.dependencycheck.dependency.Dependency; +25 +26 /** +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class FileNameAnalyzerTest { +31 +32 /** +33 * Test of getName method, of class FileNameAnalyzer. +34 */ +35 @Test +36 public void testGetName() { +37 FileNameAnalyzer instance = new FileNameAnalyzer(); +38 String expResult = "File Name Analyzer"; +39 String result = instance.getName(); +40 assertEquals(expResult, result); 41 } 42 -43 @AfterClass -44 public static void tearDownClass() throws Exception { -45 } -46 -47 @Before -48 public void setUp() { -49 } -50 -51 @After -52 public void tearDown() { -53 } -54 -55 /** -56 * Test of getName method, of class FileNameAnalyzer. -57 */ -58 @Test -59 public void testGetName() { -60 FileNameAnalyzer instance = new FileNameAnalyzer(); -61 String expResult = "File Name Analyzer"; -62 String result = instance.getName(); -63 assertEquals(expResult, result); -64 } -65 -66 /** -67 * Test of getAnalysisPhase method, of class FileNameAnalyzer. -68 */ -69 @Test -70 public void testGetAnalysisPhase() { -71 FileNameAnalyzer instance = new FileNameAnalyzer(); -72 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION; -73 AnalysisPhase result = instance.getAnalysisPhase(); -74 assertEquals(expResult, result); -75 } -76 -77 /** -78 * Test of analyze method, of class FileNameAnalyzer. -79 */ -80 @Test -81 public void testAnalyze() throws Exception { -82 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -83 Dependency resultStruts = new Dependency(struts); -84 File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); -85 Dependency resultAxis = new Dependency(axis); -86 FileNameAnalyzer instance = new FileNameAnalyzer(); -87 instance.analyze(resultStruts, null); -88 assertTrue(resultStruts.getVendorEvidence().toString().toLowerCase().contains("struts")); -89 -90 instance.analyze(resultAxis, null); -91 assertTrue(resultStruts.getVersionEvidence().toString().toLowerCase().contains("2.1.2")); -92 -93 } -94 -95 /** -96 * Test of initialize method, of class FileNameAnalyzer. -97 */ -98 @Test -99 public void testInitialize() throws Exception { -100 FileNameAnalyzer instance = new FileNameAnalyzer(); -101 instance.initialize(); -102 assertTrue(true); //initialize does nothing. -103 } -104 -105 /** -106 * Test of close method, of class FileNameAnalyzer. -107 */ -108 @Test -109 public void testClose() throws Exception { -110 FileNameAnalyzer instance = new FileNameAnalyzer(); -111 instance.close(); -112 assertTrue(true); //close does nothing. -113 } -114 } +43 /** +44 * Test of getAnalysisPhase method, of class FileNameAnalyzer. +45 */ +46 @Test +47 public void testGetAnalysisPhase() { +48 FileNameAnalyzer instance = new FileNameAnalyzer(); +49 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION; +50 AnalysisPhase result = instance.getAnalysisPhase(); +51 assertEquals(expResult, result); +52 } +53 +54 /** +55 * Test of analyze method, of class FileNameAnalyzer. +56 */ +57 @Test +58 public void testAnalyze() throws Exception { +59 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +60 Dependency resultStruts = new Dependency(struts); +61 File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); +62 Dependency resultAxis = new Dependency(axis); +63 FileNameAnalyzer instance = new FileNameAnalyzer(); +64 instance.analyze(resultStruts, null); +65 assertTrue(resultStruts.getVendorEvidence().toString().toLowerCase().contains("struts")); +66 +67 instance.analyze(resultAxis, null); +68 assertTrue(resultStruts.getVersionEvidence().toString().toLowerCase().contains("2.1.2")); +69 +70 } +71 +72 /** +73 * Test of initialize method, of class FileNameAnalyzer. +74 */ +75 @Test +76 public void testInitialize() throws Exception { +77 FileNameAnalyzer instance = new FileNameAnalyzer(); +78 instance.initialize(); +79 assertTrue(true); //initialize does nothing. +80 } +81 +82 /** +83 * Test of close method, of class FileNameAnalyzer. +84 */ +85 @Test +86 public void testClose() throws Exception { +87 FileNameAnalyzer instance = new FileNameAnalyzer(); +88 instance.close(); +89 assertTrue(true); //close does nothing. +90 } +91 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html index 472251c72..f3a8d55fc 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html @@ -29,142 +29,120 @@ 21 import java.util.HashSet; 22 import java.util.Properties; 23 import java.util.Set; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import static org.junit.Assert.assertEquals; -27 import static org.junit.Assert.assertTrue; -28 import org.junit.Before; -29 import org.junit.BeforeClass; -30 import org.junit.Test; -31 import org.owasp.dependencycheck.dependency.Dependency; -32 import org.owasp.dependencycheck.dependency.Evidence; -33 -34 /** -35 * -36 * @author Jeremy Long <jeremy.long@owasp.org> -37 */ -38 public class JarAnalyzerTest { -39 -40 public JarAnalyzerTest() { -41 } -42 -43 @BeforeClass -44 public static void setUpClass() throws Exception { -45 } -46 -47 @AfterClass -48 public static void tearDownClass() throws Exception { -49 } +24 import static org.junit.Assert.assertEquals; +25 import static org.junit.Assert.assertTrue; +26 import org.junit.Test; +27 import org.owasp.dependencycheck.BaseTest; +28 import org.owasp.dependencycheck.dependency.Dependency; +29 import org.owasp.dependencycheck.dependency.Evidence; +30 +31 /** +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public class JarAnalyzerTest extends BaseTest { +36 +37 /** +38 * Test of inspect method, of class JarAnalyzer. +39 * +40 * @throws Exception is thrown when an exception occurs. +41 */ +42 @Test +43 public void testAnalyze() throws Exception { +44 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +45 Dependency result = new Dependency(file); +46 JarAnalyzer instance = new JarAnalyzer(); +47 instance.analyze(result, null); +48 assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache")); +49 assertTrue(result.getVendorEvidence().getWeighting().contains("apache")); 50 -51 @Before -52 public void setUp() { -53 } -54 -55 @After -56 public void tearDown() { -57 } -58 -59 /** -60 * Test of inspect method, of class JarAnalyzer. -61 * -62 * @throws Exception is thrown when an exception occurs. -63 */ -64 @Test -65 public void testAnalyze() throws Exception { -66 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -67 Dependency result = new Dependency(file); -68 JarAnalyzer instance = new JarAnalyzer(); -69 instance.analyze(result, null); -70 assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache")); -71 assertTrue(result.getVendorEvidence().getWeighting().contains("apache")); -72 -73 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); -74 result = new Dependency(file); -75 instance.analyze(result, null); -76 boolean found = false; -77 for (Evidence e : result.getProductEvidence()) { -78 if (e.getName().equalsIgnoreCase("package-title") -79 && e.getValue().equalsIgnoreCase("org.mortbay.http")) { -80 found = true; -81 break; -82 } -83 } -84 assertTrue("package-title of org.mortbay.http not found in org.mortbay.jetty.jar", found); -85 -86 found = false; -87 for (Evidence e : result.getVendorEvidence()) { -88 if (e.getName().equalsIgnoreCase("implementation-url") -89 && e.getValue().equalsIgnoreCase("http://jetty.mortbay.org")) { -90 found = true; -91 break; -92 } -93 } -94 assertTrue("implementation-url of http://jetty.mortbay.org not found in org.mortbay.jetty.jar", found); -95 -96 found = false; -97 for (Evidence e : result.getVersionEvidence()) { -98 if (e.getName().equalsIgnoreCase("Implementation-Version") -99 && e.getValue().equalsIgnoreCase("4.2.27")) { -100 found = true; -101 break; -102 } -103 } -104 assertTrue("implementation-version of 4.2.27 not found in org.mortbay.jetty.jar", found); -105 -106 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jmx.jar").getPath()); -107 result = new Dependency(file); -108 instance.analyze(result, null); -109 assertEquals("org.mortbar,jmx.jar has version evidence?", result.getVersionEvidence().size(), 0); -110 } -111 -112 /** -113 * Test of getSupportedExtensions method, of class JarAnalyzer. -114 */ -115 @Test -116 public void testGetSupportedExtensions() { -117 JarAnalyzer instance = new JarAnalyzer(); -118 Set expResult = new HashSet(); -119 expResult.add("jar"); -120 expResult.add("war"); -121 Set result = instance.getSupportedExtensions(); -122 assertEquals(expResult, result); -123 } -124 -125 /** -126 * Test of getName method, of class JarAnalyzer. -127 */ -128 @Test -129 public void testGetName() { -130 JarAnalyzer instance = new JarAnalyzer(); -131 String expResult = "Jar Analyzer"; -132 String result = instance.getName(); -133 assertEquals(expResult, result); -134 } -135 -136 /** -137 * Test of supportsExtension method, of class JarAnalyzer. -138 */ -139 @Test -140 public void testSupportsExtension() { -141 String extension = "jar"; -142 JarAnalyzer instance = new JarAnalyzer(); -143 boolean expResult = true; -144 boolean result = instance.supportsExtension(extension); -145 assertEquals(expResult, result); -146 } -147 -148 @Test -149 public void testInterpolateString() { -150 Properties prop = new Properties(); -151 prop.setProperty("key", "value"); -152 prop.setProperty("nested", "nested ${key}"); -153 String text = "This is a test of '${key}' '${nested}'"; -154 String expResults = "This is a test of 'value' 'nested value'"; -155 JarAnalyzer instance = new JarAnalyzer(); -156 String results = instance.interpolateString(text, prop); -157 assertEquals(expResults, results); -158 } -159 } +51 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); +52 result = new Dependency(file); +53 instance.analyze(result, null); +54 boolean found = false; +55 for (Evidence e : result.getProductEvidence()) { +56 if (e.getName().equalsIgnoreCase("package-title") +57 && e.getValue().equalsIgnoreCase("org.mortbay.http")) { +58 found = true; +59 break; +60 } +61 } +62 assertTrue("package-title of org.mortbay.http not found in org.mortbay.jetty.jar", found); +63 +64 found = false; +65 for (Evidence e : result.getVendorEvidence()) { +66 if (e.getName().equalsIgnoreCase("implementation-url") +67 && e.getValue().equalsIgnoreCase("http://jetty.mortbay.org")) { +68 found = true; +69 break; +70 } +71 } +72 assertTrue("implementation-url of http://jetty.mortbay.org not found in org.mortbay.jetty.jar", found); +73 +74 found = false; +75 for (Evidence e : result.getVersionEvidence()) { +76 if (e.getName().equalsIgnoreCase("Implementation-Version") +77 && e.getValue().equalsIgnoreCase("4.2.27")) { +78 found = true; +79 break; +80 } +81 } +82 assertTrue("implementation-version of 4.2.27 not found in org.mortbay.jetty.jar", found); +83 +84 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jmx.jar").getPath()); +85 result = new Dependency(file); +86 instance.analyze(result, null); +87 assertEquals("org.mortbar,jmx.jar has version evidence?", result.getVersionEvidence().size(), 0); +88 } +89 +90 /** +91 * Test of getSupportedExtensions method, of class JarAnalyzer. +92 */ +93 @Test +94 public void testGetSupportedExtensions() { +95 JarAnalyzer instance = new JarAnalyzer(); +96 Set expResult = new HashSet(); +97 expResult.add("jar"); +98 expResult.add("war"); +99 Set result = instance.getSupportedExtensions(); +100 assertEquals(expResult, result); +101 } +102 +103 /** +104 * Test of getName method, of class JarAnalyzer. +105 */ +106 @Test +107 public void testGetName() { +108 JarAnalyzer instance = new JarAnalyzer(); +109 String expResult = "Jar Analyzer"; +110 String result = instance.getName(); +111 assertEquals(expResult, result); +112 } +113 +114 /** +115 * Test of supportsExtension method, of class JarAnalyzer. +116 */ +117 @Test +118 public void testSupportsExtension() { +119 String extension = "jar"; +120 JarAnalyzer instance = new JarAnalyzer(); +121 boolean expResult = true; +122 boolean result = instance.supportsExtension(extension); +123 assertEquals(expResult, result); +124 } +125 +126 @Test +127 public void testInterpolateString() { +128 Properties prop = new Properties(); +129 prop.setProperty("key", "value"); +130 prop.setProperty("nested", "nested ${key}"); +131 String text = "This is a test of '${key}' '${nested}'"; +132 String expResults = "This is a test of 'value' 'nested value'"; +133 JarAnalyzer instance = new JarAnalyzer(); +134 String results = instance.interpolateString(text, prop); +135 assertEquals(expResults, results); +136 } +137 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzerTest.html index 995507a97..7ce034ce8 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzerTest.html @@ -28,129 +28,107 @@ 20 import java.io.File; 21 import java.util.HashSet; 22 import java.util.Set; -23 import org.junit.After; -24 import org.junit.AfterClass; -25 import static org.junit.Assert.assertEquals; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import org.owasp.dependencycheck.Engine; -30 import org.owasp.dependencycheck.dependency.Dependency; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class JavaScriptAnalyzerTest { -37 -38 public JavaScriptAnalyzerTest() { -39 } -40 -41 @BeforeClass -42 public static void setUpClass() { -43 } -44 -45 @AfterClass -46 public static void tearDownClass() { -47 } -48 -49 @Before -50 public void setUp() { -51 } -52 -53 @After -54 public void tearDown() { -55 } -56 -57 /** -58 * Test of getSupportedExtensions method, of class JavaScriptAnalyzer. -59 */ -60 @Test -61 public void testGetSupportedExtensions() { -62 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); -63 Set expResult = new HashSet<String>(); -64 expResult.add("js"); -65 Set result = instance.getSupportedExtensions(); -66 assertEquals(expResult, result); -67 } -68 -69 /** -70 * Test of getName method, of class JavaScriptAnalyzer. -71 */ -72 @Test -73 public void testGetName() { -74 System.out.println("getName"); -75 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); -76 String expResult = "JavaScript Analyzer"; -77 String result = instance.getName(); -78 assertEquals(expResult, result); -79 } -80 -81 /** -82 * Test of supportsExtension method, of class JavaScriptAnalyzer. -83 */ -84 @Test -85 public void testSupportsExtension() { -86 String extension = "js"; -87 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); -88 boolean expResult = true; -89 boolean result = instance.supportsExtension(extension); -90 assertEquals(expResult, result); -91 } -92 -93 /** -94 * Test of getAnalysisPhase method, of class JavaScriptAnalyzer. -95 */ -96 @Test -97 public void testGetAnalysisPhase() { -98 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); -99 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION; -100 AnalysisPhase result = instance.getAnalysisPhase(); -101 assertEquals(expResult, result); -102 } -103 -104 /** -105 * Test of analyze method, of class JavaScriptAnalyzer. -106 */ -107 @Test -108 public void testAnalyze() throws Exception { -109 File jq6 = new File(this.getClass().getClassLoader().getResource("jquery-1.6.2.min.js").getPath()); -110 File jq10 = new File(this.getClass().getClassLoader().getResource("jquery-1.10.2.js").getPath()); -111 File jq10min = new File(this.getClass().getClassLoader().getResource("jquery-1.10.2.min.js").getPath()); -112 Dependency depJQ6 = new Dependency(jq6); -113 Dependency depJQ10 = new Dependency(jq10); -114 Dependency depJQ10min = new Dependency(jq10min); -115 Engine engine = null; -116 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); -117 -118 // assertTrue(depJQ6.getEvidence().size() == 0); -119 // assertTrue(depJQ10.getEvidence().size() == 0); -120 // assertTrue(depJQ10min.getEvidence().size() == 0); -121 // -122 // instance.analyze(depJQ6, engine); -123 // instance.analyze(depJQ10, engine); -124 // instance.analyze(depJQ10min, engine); -125 // //TODO improve the assertions -126 // assertTrue(depJQ6.getEvidence().size() > 0); -127 // assertTrue(depJQ10.getEvidence().size() > 0); -128 // assertTrue(depJQ10min.getEvidence().size() > 0); -129 } -130 -131 /** -132 * Test of initialize method, of class JavaScriptAnalyzer. -133 */ -134 @Test -135 public void testInitialize() throws Exception { -136 } -137 -138 /** -139 * Test of close method, of class JavaScriptAnalyzer. -140 */ -141 @Test -142 public void testClose() throws Exception { -143 -144 } -145 } +23 import static org.junit.Assert.assertEquals; +24 import org.junit.Test; +25 import org.owasp.dependencycheck.BaseTest; +26 import org.owasp.dependencycheck.Engine; +27 import org.owasp.dependencycheck.dependency.Dependency; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class JavaScriptAnalyzerTest extends BaseTest { +34 +35 /** +36 * Test of getSupportedExtensions method, of class JavaScriptAnalyzer. +37 */ +38 @Test +39 public void testGetSupportedExtensions() { +40 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); +41 Set expResult = new HashSet<String>(); +42 expResult.add("js"); +43 Set result = instance.getSupportedExtensions(); +44 assertEquals(expResult, result); +45 } +46 +47 /** +48 * Test of getName method, of class JavaScriptAnalyzer. +49 */ +50 @Test +51 public void testGetName() { +52 System.out.println("getName"); +53 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); +54 String expResult = "JavaScript Analyzer"; +55 String result = instance.getName(); +56 assertEquals(expResult, result); +57 } +58 +59 /** +60 * Test of supportsExtension method, of class JavaScriptAnalyzer. +61 */ +62 @Test +63 public void testSupportsExtension() { +64 String extension = "js"; +65 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); +66 boolean expResult = true; +67 boolean result = instance.supportsExtension(extension); +68 assertEquals(expResult, result); +69 } +70 +71 /** +72 * Test of getAnalysisPhase method, of class JavaScriptAnalyzer. +73 */ +74 @Test +75 public void testGetAnalysisPhase() { +76 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); +77 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION; +78 AnalysisPhase result = instance.getAnalysisPhase(); +79 assertEquals(expResult, result); +80 } +81 +82 /** +83 * Test of analyze method, of class JavaScriptAnalyzer. +84 */ +85 @Test +86 public void testAnalyze() throws Exception { +87 File jq6 = new File(this.getClass().getClassLoader().getResource("jquery-1.6.2.min.js").getPath()); +88 File jq10 = new File(this.getClass().getClassLoader().getResource("jquery-1.10.2.js").getPath()); +89 File jq10min = new File(this.getClass().getClassLoader().getResource("jquery-1.10.2.min.js").getPath()); +90 Dependency depJQ6 = new Dependency(jq6); +91 Dependency depJQ10 = new Dependency(jq10); +92 Dependency depJQ10min = new Dependency(jq10min); +93 Engine engine = null; +94 JavaScriptAnalyzer instance = new JavaScriptAnalyzer(); +95 +96 // assertTrue(depJQ6.getEvidence().size() == 0); +97 // assertTrue(depJQ10.getEvidence().size() == 0); +98 // assertTrue(depJQ10min.getEvidence().size() == 0); +99 // +100 // instance.analyze(depJQ6, engine); +101 // instance.analyze(depJQ10, engine); +102 // instance.analyze(depJQ10min, engine); +103 // //TODO improve the assertions +104 // assertTrue(depJQ6.getEvidence().size() > 0); +105 // assertTrue(depJQ10.getEvidence().size() > 0); +106 // assertTrue(depJQ10min.getEvidence().size() > 0); +107 } +108 +109 /** +110 * Test of initialize method, of class JavaScriptAnalyzer. +111 */ +112 @Test +113 public void testInitialize() throws Exception { +114 } +115 +116 /** +117 * Test of close method, of class JavaScriptAnalyzer. +118 */ +119 @Test +120 public void testClose() throws Exception { +121 +122 } +123 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/NuspecAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/NuspecAnalyzerTest.html index 02b058ef3..001c52f32 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/NuspecAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/NuspecAnalyzerTest.html @@ -30,41 +30,42 @@ 22 import static org.junit.Assert.assertTrue; 23 import org.junit.Before; 24 import org.junit.Test; -25 -26 public class NuspecAnalyzerTest { -27 -28 private NuspecAnalyzer instance; -29 -30 @Before -31 public void setUp() { -32 instance = new NuspecAnalyzer(); -33 instance.setEnabled(true); -34 } -35 -36 @Test -37 public void testGetAnalyzerName() { -38 assertEquals("Nuspec Analyzer", instance.getName()); -39 } -40 -41 @Test -42 public void testGetSupportedExtensions() { -43 assertTrue(instance.getSupportedExtensions().contains("nuspec")); -44 assertFalse(instance.getSupportedExtensions().contains("nupkg")); -45 } -46 -47 @Test -48 public void testSupportsExtension() { -49 assertTrue(instance.supportsExtension("nuspec")); -50 assertFalse(instance.supportsExtension("nupkg")); -51 } -52 -53 @Test -54 public void testGetAnalysisPhaze() { -55 assertEquals(AnalysisPhase.INFORMATION_COLLECTION, instance.getAnalysisPhase()); -56 } -57 } -58 -59 // vim: cc=120:sw=4:ts=4:sts=4 +25 import org.owasp.dependencycheck.BaseTest; +26 +27 public class NuspecAnalyzerTest extends BaseTest { +28 +29 private NuspecAnalyzer instance; +30 +31 @Before +32 public void setUp() throws Exception { +33 instance = new NuspecAnalyzer(); +34 instance.setEnabled(true); +35 } +36 +37 @Test +38 public void testGetAnalyzerName() { +39 assertEquals("Nuspec Analyzer", instance.getName()); +40 } +41 +42 @Test +43 public void testGetSupportedExtensions() { +44 assertTrue(instance.getSupportedExtensions().contains("nuspec")); +45 assertFalse(instance.getSupportedExtensions().contains("nupkg")); +46 } +47 +48 @Test +49 public void testSupportsExtension() { +50 assertTrue(instance.supportsExtension("nuspec")); +51 assertFalse(instance.supportsExtension("nupkg")); +52 } +53 +54 @Test +55 public void testGetAnalysisPhaze() { +56 assertEquals(AnalysisPhase.INFORMATION_COLLECTION, instance.getAnalysisPhase()); +57 } +58 } +59 +60 // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html index 5ac0c139a..791201f0f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.analyzer @@ -28,13 +28,13 @@ AnalyzerServiceTest
  • - ArchiveAnalyzerTest + ArchiveAnalyzerIntegrationTest
  • AssemblyAnalyzerTest
  • - CPEAnalyzerTest + CPEAnalyzerIntegrationTest
  • DependencyBundlingAnalyzerTest @@ -44,6 +44,9 @@
  • FileNameAnalyzerTest +
  • +
  • + HintAnalyzerTest
  • JarAnalyzerTest @@ -55,7 +58,7 @@ NuspecAnalyzerTest
  • - VulnerabilitySuppressionAnalyzerTest + VulnerabilitySuppressionAnalyzerIntegrationTest
  • diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html index 9481a9ef9..b299601ad 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.analyzer @@ -57,7 +57,7 @@ - ArchiveAnalyzerTest + ArchiveAnalyzerIntegrationTest @@ -67,7 +67,7 @@ - CPEAnalyzerTest + CPEAnalyzerIntegrationTest @@ -84,6 +84,11 @@ FileNameAnalyzerTest + + + + HintAnalyzerTest + @@ -102,7 +107,7 @@ - VulnerabilitySuppressionAnalyzerTest + VulnerabilitySuppressionAnalyzerIntegrationTest diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html index fac6d587a..24c4ea538 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/AbstractDatabaseTestCase.html @@ -25,42 +25,24 @@ 17 */ 18 package org.owasp.dependencycheck.data.cpe; 19 -20 import junit.framework.TestCase; -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import org.junit.Before; -24 import org.junit.BeforeClass; -25 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; -26 -27 /** -28 * An abstract database test case that is used to ensure the H2 DB exists prior to performing tests that utilize the -29 * data contained within. -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public abstract class AbstractDatabaseTestCase extends TestCase { -34 -35 @BeforeClass -36 public static void setUpClass() throws Exception { -37 } -38 -39 @AfterClass -40 public static void tearDownClass() throws Exception { -41 } -42 -43 @Before -44 @Override -45 public void setUp() throws Exception { -46 BaseDBTestCase.ensureDBExists(); -47 super.setUp(); -48 } -49 -50 @After -51 @Override -52 public void tearDown() throws Exception { -53 super.tearDown(); -54 } -55 } +20 import org.junit.Before; +21 import org.owasp.dependencycheck.BaseTest; +22 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; +23 +24 /** +25 * An abstract database test case that is used to ensure the H2 DB exists prior to performing tests that utilize the +26 * data contained within. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public abstract class AbstractDatabaseTestCase extends BaseTest { +31 +32 @Before +33 public void setUp() throws Exception { +34 BaseDBTestCase.ensureDBExists(); +35 } +36 +37 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html index a5f2a6469..a844f8ec0 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html index c6de3d8dc..552016e03 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html index b23f13537..699f1efbf 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html index e8424addf..8974f4ab7 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html index e15a44399..01596947c 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html @@ -77,20 +77,22 @@ 69 70 /** 71 * Test of clear method, of class TokenPairConcatenatingFilter. -72 */ -73 @Test -74 public void testClear() throws IOException { -75 -76 TokenStream ts = new WhitespaceTokenizer(LuceneUtils.CURRENT_VERSION, new StringReader("one two three")); -77 TokenPairConcatenatingFilter filter = new TokenPairConcatenatingFilter(ts); -78 assertTokenStreamContents(filter, new String[]{"one", "onetwo", "two", "twothree", "three"}); -79 -80 assertNotNull(filter.getPreviousWord()); -81 filter.clear(); -82 assertNull(filter.getPreviousWord()); -83 assertTrue(filter.getWords().isEmpty()); -84 } -85 } +72 * +73 * @throws java.io.IOException +74 */ +75 @Test +76 public void testClear() throws IOException { +77 +78 TokenStream ts = new WhitespaceTokenizer(LuceneUtils.CURRENT_VERSION, new StringReader("one two three")); +79 TokenPairConcatenatingFilter filter = new TokenPairConcatenatingFilter(ts); +80 assertTokenStreamContents(filter, new String[]{"one", "onetwo", "two", "twothree", "three"}); +81 +82 assertNotNull(filter.getPreviousWord()); +83 filter.clear(); +84 assertNull(filter.getPreviousWord()); +85 assertTrue(filter.getWords().isEmpty()); +86 } +87 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html index f8e8b0ee5..de424c9a9 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html index 1df7adc4b..5f7f030d9 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html index 7f35b5337..a790d57ee 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html @@ -25,63 +25,62 @@ 17 */ 18 package org.owasp.dependencycheck.data.nexus; 19 -20 import static org.junit.Assert.assertEquals; -21 import static org.junit.Assert.assertNotNull; -22 -23 import java.io.FileNotFoundException; -24 import java.net.URL; -25 import java.util.logging.Logger; -26 -27 import org.junit.Assume; -28 import org.junit.Before; -29 import org.junit.Test; -30 import org.owasp.dependencycheck.utils.Settings; -31 -32 public class NexusSearchTest { -33 -34 private static final Logger LOGGER = Logger.getLogger(NexusSearchTest.class.getName()); -35 private NexusSearch searcher; -36 -37 @Before -38 public void setUp() throws Exception { -39 String nexusUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL); -40 LOGGER.fine(nexusUrl); -41 searcher = new NexusSearch(new URL(nexusUrl)); -42 Assume.assumeTrue(searcher.preflightRequest()); -43 } -44 -45 @Test(expected = IllegalArgumentException.class) -46 public void testNullSha1() throws Exception { -47 searcher.searchSha1(null); -48 } -49 -50 @Test(expected = IllegalArgumentException.class) -51 public void testMalformedSha1() throws Exception { -52 searcher.searchSha1("invalid"); -53 } -54 -55 // This test does generate network traffic and communicates with a host -56 // you may not be able to reach. Remove the @Ignore annotation if you want to -57 // test it anyway -58 @Test -59 public void testValidSha1() throws Exception { -60 MavenArtifact ma = searcher.searchSha1("9977a8d04e75609cf01badc4eb6a9c7198c4c5ea"); -61 assertEquals("Incorrect group", "org.apache.maven.plugins", ma.getGroupId()); -62 assertEquals("Incorrect artifact", "maven-compiler-plugin", ma.getArtifactId()); -63 assertEquals("Incorrect version", "3.1", ma.getVersion()); -64 assertNotNull("URL Should not be null", ma.getArtifactUrl()); -65 } -66 -67 // This test does generate network traffic and communicates with a host -68 // you may not be able to reach. Remove the @Ignore annotation if you want to -69 // test it anyway -70 @Test(expected = FileNotFoundException.class) -71 public void testMissingSha1() throws Exception { -72 searcher.searchSha1("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); -73 } -74 } -75 -76 // vim: cc=120:sw=4:ts=4:sts=4 +20 import java.io.FileNotFoundException; +21 import java.net.URL; +22 import java.util.logging.Logger; +23 import static org.junit.Assert.assertEquals; +24 import static org.junit.Assert.assertNotNull; +25 import org.junit.Assume; +26 import org.junit.Before; +27 import org.junit.Test; +28 import org.owasp.dependencycheck.BaseTest; +29 import org.owasp.dependencycheck.utils.Settings; +30 +31 public class NexusSearchTest extends BaseTest { +32 +33 private static final Logger LOGGER = Logger.getLogger(NexusSearchTest.class.getName()); +34 private NexusSearch searcher; +35 +36 @Before +37 public void setUp() throws Exception { +38 String nexusUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL); +39 LOGGER.fine(nexusUrl); +40 searcher = new NexusSearch(new URL(nexusUrl)); +41 Assume.assumeTrue(searcher.preflightRequest()); +42 } +43 +44 @Test(expected = IllegalArgumentException.class) +45 public void testNullSha1() throws Exception { +46 searcher.searchSha1(null); +47 } +48 +49 @Test(expected = IllegalArgumentException.class) +50 public void testMalformedSha1() throws Exception { +51 searcher.searchSha1("invalid"); +52 } +53 +54 // This test does generate network traffic and communicates with a host +55 // you may not be able to reach. Remove the @Ignore annotation if you want to +56 // test it anyway +57 @Test +58 public void testValidSha1() throws Exception { +59 MavenArtifact ma = searcher.searchSha1("9977a8d04e75609cf01badc4eb6a9c7198c4c5ea"); +60 assertEquals("Incorrect group", "org.apache.maven.plugins", ma.getGroupId()); +61 assertEquals("Incorrect artifact", "maven-compiler-plugin", ma.getArtifactId()); +62 assertEquals("Incorrect version", "3.1", ma.getVersion()); +63 assertNotNull("URL Should not be null", ma.getArtifactUrl()); +64 } +65 +66 // This test does generate network traffic and communicates with a host +67 // you may not be able to reach. Remove the @Ignore annotation if you want to +68 // test it anyway +69 @Test(expected = FileNotFoundException.class) +70 public void testMissingSha1() throws Exception { +71 searcher.searchSha1("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); +72 } +73 } +74 +75 // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html index 45c478667..376581767 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html index 520919e12..b3945b17a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/XPathNuspecParserTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/XPathNuspecParserTest.html index a1752edb3..920643f75 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/XPathNuspecParserTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/XPathNuspecParserTest.html @@ -25,60 +25,67 @@ 17 */ 18 package org.owasp.dependencycheck.data.nuget; 19 -20 import java.io.InputStream; -21 -22 import org.junit.Test; -23 import static org.junit.Assert.*; -24 -25 -26 /** -27 * -28 * @author colezlaw -29 * -30 */ -31 public class XPathNuspecParserTest { -32 /** -33 * Test all the valid components. -34 * -35 * @throws Exception if anything goes sideways. -36 */ -37 @Test -38 public void testGoodDocument() throws Exception { -39 NuspecParser parser = new XPathNuspecParser(); -40 InputStream is = XPathNuspecParserTest.class.getClassLoader().getResourceAsStream("log4net.2.0.3.nuspec"); -41 NugetPackage np = parser.parse(is); -42 assertEquals("log4net", np.getId()); -43 assertEquals("2.0.3", np.getVersion()); -44 assertEquals("log4net [1.2.13]", np.getTitle()); -45 assertEquals("Apache Software Foundation", np.getAuthors()); -46 assertEquals("Apache Software Foundation", np.getOwners()); -47 assertEquals("http://logging.apache.org/log4net/license.html", np.getLicenseUrl()); -48 } -49 -50 /** -51 * Expect a NuspecParseException when what we pass isn't even XML. -52 * -53 * @throws Exception we expect this. -54 */ -55 @Test(expected=NuspecParseException.class) -56 public void testMissingDocument() throws Exception { -57 NuspecParser parser = new XPathNuspecParser(); -58 InputStream is = XPathNuspecParserTest.class.getClassLoader().getResourceAsStream("dependencycheck.properties"); -59 NugetPackage np = parser.parse(is); -60 } -61 -62 /** -63 * Expect a NuspecParseException when it's valid XML, but not a Nuspec. -64 * -65 * @throws Exception we expect this. -66 */ -67 @Test(expected=NuspecParseException.class) -68 public void testNotNuspec() throws Exception { -69 NuspecParser parser = new XPathNuspecParser(); -70 InputStream is = XPathNuspecParserTest.class.getClassLoader().getResourceAsStream("suppressions.xml"); -71 NugetPackage np = parser.parse(is); -72 } -73 } +20 import java.io.ByteArrayOutputStream; +21 import java.io.InputStream; +22 import java.io.PrintStream; +23 import static org.junit.Assert.assertEquals; +24 import org.junit.Test; +25 import org.owasp.dependencycheck.BaseTest; +26 +27 /** +28 * +29 * @author colezlaw +30 * +31 */ +32 public class XPathNuspecParserTest extends BaseTest { +33 +34 /** +35 * Test all the valid components. +36 * +37 * @throws Exception if anything goes sideways. +38 */ +39 @Test +40 public void testGoodDocument() throws Exception { +41 NuspecParser parser = new XPathNuspecParser(); +42 InputStream is = XPathNuspecParserTest.class.getClassLoader().getResourceAsStream("log4net.2.0.3.nuspec"); +43 NugetPackage np = parser.parse(is); +44 assertEquals("log4net", np.getId()); +45 assertEquals("2.0.3", np.getVersion()); +46 assertEquals("log4net [1.2.13]", np.getTitle()); +47 assertEquals("Apache Software Foundation", np.getAuthors()); +48 assertEquals("Apache Software Foundation", np.getOwners()); +49 assertEquals("http://logging.apache.org/log4net/license.html", np.getLicenseUrl()); +50 } +51 +52 /** +53 * Expect a NuspecParseException when what we pass isn't even XML. +54 * +55 * @throws Exception we expect this. +56 */ +57 @Test(expected = NuspecParseException.class) +58 public void testMissingDocument() throws Exception { +59 NuspecParser parser = new XPathNuspecParser(); +60 InputStream is = XPathNuspecParserTest.class.getClassLoader().getResourceAsStream("dependencycheck.properties"); +61 +62 //hide the fatal message from the core parser +63 final ByteArrayOutputStream myOut = new ByteArrayOutputStream(); +64 System.setErr(new PrintStream(myOut)); +65 +66 NugetPackage np = parser.parse(is); +67 } +68 +69 /** +70 * Expect a NuspecParseException when it's valid XML, but not a Nuspec. +71 * +72 * @throws Exception we expect this. +73 */ +74 @Test(expected = NuspecParseException.class) +75 public void testNotNuspec() throws Exception { +76 NuspecParser parser = new XPathNuspecParser(); +77 InputStream is = XPathNuspecParserTest.class.getClassLoader().getResourceAsStream("suppressions.xml"); +78 NugetPackage np = parser.parse(is); +79 } +80 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html index 2578eb30e..88da2b8f6 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html index 7fce40efe..7eb8db84b 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nuget/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html index b2891a788..4a2c05530 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html @@ -34,20 +34,20 @@ 26 import java.util.logging.Logger; 27 import java.util.zip.ZipEntry; 28 import java.util.zip.ZipInputStream; -29 import junit.framework.TestCase; -30 import org.owasp.dependencycheck.utils.Settings; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public abstract class BaseDBTestCase extends TestCase { -37 -38 protected final static int BUFFER_SIZE = 2048; -39 -40 @Override -41 protected void setUp() throws Exception { -42 super.setUp(); +29 import org.junit.Before; +30 import org.owasp.dependencycheck.BaseTest; +31 import org.owasp.dependencycheck.utils.Settings; +32 +33 /** +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public abstract class BaseDBTestCase extends BaseTest { +38 +39 protected final static int BUFFER_SIZE = 2048; +40 +41 @Before +42 public void setUp() throws Exception { 43 ensureDBExists(); 44 } 45 diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html index d0a0dc24e..46b7df66f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nvdcve @@ -17,15 +17,15 @@ -

    Dependency-Check Core 1.1.4 Reference

    +

    Dependency-Check Core 1.2.0 Reference

    diff --git a/dependency-check-core/xref/allclasses-frame.html b/dependency-check-core/xref/allclasses-frame.html index 54c3f9ed5..f7b842ae4 100644 --- a/dependency-check-core/xref/allclasses-frame.html +++ b/dependency-check-core/xref/allclasses-frame.html @@ -181,6 +181,9 @@
  • Engine +
  • +
  • + EscapeTool
  • Evidence diff --git a/dependency-check-core/xref/index.html b/dependency-check-core/xref/index.html index e68cdab66..617b8c267 100644 --- a/dependency-check-core/xref/index.html +++ b/dependency-check-core/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Core 1.1.4 Reference + Dependency-Check Core 1.2.0 Reference diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html index 19ce1d4bd..3a81192bf 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html @@ -74,425 +74,443 @@ 66 * A Map of analyzers grouped by Analysis phase. 67 */ 68 private final Set<FileTypeAnalyzer> fileTypeAnalyzers; -69 -70 /** -71 * Creates a new Engine. -72 * -73 * @throws DatabaseException thrown if there is an error connecting to the database -74 */ -75 public Engine() throws DatabaseException { -76 this.dependencies = new ArrayList<Dependency>(); -77 this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class); -78 this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>(); -79 -80 ConnectionFactory.initialize(); -81 -82 boolean autoUpdate = true; -83 try { -84 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); -85 } catch (InvalidSettingException ex) { -86 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "Invalid setting for auto-update; using true."); -87 } -88 if (autoUpdate) { -89 doUpdates(); -90 } -91 loadAnalyzers(); -92 } -93 -94 /** -95 * Properly cleans up resources allocated during analysis. -96 */ -97 public void cleanup() { -98 ConnectionFactory.cleanup(); -99 } +69 /** +70 * The ClassLoader to use when dynamically loading Analyzer and Update services. +71 */ +72 private ClassLoader serviceClassLoader; +73 /** +74 * The Logger for use throughout the class. +75 */ +76 private static final Logger LOGGER = Logger.getLogger(Engine.class.getName()); +77 +78 /** +79 * Creates a new Engine. +80 * +81 * @throws DatabaseException thrown if there is an error connecting to the database +82 */ +83 public Engine() throws DatabaseException { +84 this(Thread.currentThread().getContextClassLoader()); +85 } +86 +87 /** +88 * Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services. +89 * +90 * @param serviceClassLoader the ClassLoader to use when dynamically loading Analyzer and Update services +91 * @throws DatabaseException thrown if there is an error connecting to the database +92 */ +93 public Engine(ClassLoader serviceClassLoader) throws DatabaseException { +94 this.dependencies = new ArrayList<Dependency>(); +95 this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class); +96 this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>(); +97 this.serviceClassLoader = serviceClassLoader; +98 +99 ConnectionFactory.initialize(); 100 -101 /** -102 * Loads the analyzers specified in the configuration file (or system properties). -103 */ -104 private void loadAnalyzers() { -105 -106 for (AnalysisPhase phase : AnalysisPhase.values()) { -107 analyzers.put(phase, new ArrayList<Analyzer>()); -108 } -109 -110 final AnalyzerService service = AnalyzerService.getInstance(); -111 final Iterator<Analyzer> iterator = service.getAnalyzers(); -112 while (iterator.hasNext()) { -113 final Analyzer a = iterator.next(); -114 analyzers.get(a.getAnalysisPhase()).add(a); -115 if (a instanceof FileTypeAnalyzer) { -116 this.fileTypeAnalyzers.add((FileTypeAnalyzer) a); -117 } -118 } -119 } -120 -121 /** -122 * Get the List of the analyzers for a specific phase of analysis. -123 * -124 * @param phase the phase to get the configured analyzers. -125 * @return the analyzers loaded -126 */ -127 public List<Analyzer> getAnalyzers(AnalysisPhase phase) { -128 return analyzers.get(phase); -129 } -130 -131 /** -132 * Get the dependencies identified. -133 * -134 * @return the dependencies identified -135 */ -136 public List<Dependency> getDependencies() { -137 return dependencies; +101 boolean autoUpdate = true; +102 try { +103 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); +104 } catch (InvalidSettingException ex) { +105 LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true."); +106 } +107 if (autoUpdate) { +108 doUpdates(); +109 } +110 loadAnalyzers(); +111 } +112 +113 /** +114 * Properly cleans up resources allocated during analysis. +115 */ +116 public void cleanup() { +117 ConnectionFactory.cleanup(); +118 } +119 +120 /** +121 * Loads the analyzers specified in the configuration file (or system properties). +122 */ +123 private void loadAnalyzers() { +124 +125 for (AnalysisPhase phase : AnalysisPhase.values()) { +126 analyzers.put(phase, new ArrayList<Analyzer>()); +127 } +128 +129 final AnalyzerService service = new AnalyzerService(serviceClassLoader); +130 final Iterator<Analyzer> iterator = service.getAnalyzers(); +131 while (iterator.hasNext()) { +132 final Analyzer a = iterator.next(); +133 analyzers.get(a.getAnalysisPhase()).add(a); +134 if (a instanceof FileTypeAnalyzer) { +135 this.fileTypeAnalyzers.add((FileTypeAnalyzer) a); +136 } +137 } 138 } 139 -140 public void setDependencies(List<Dependency> dependencies) { -141 this.dependencies = dependencies; -142 //for (Dependency dependency: dependencies) { -143 // dependencies.add(dependency); -144 //} -145 } -146 -147 /** -148 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any -149 * dependencies identified are added to the dependency collection. -150 * -151 * @since v0.3.2.5 +140 /** +141 * Get the List of the analyzers for a specific phase of analysis. +142 * +143 * @param phase the phase to get the configured analyzers. +144 * @return the analyzers loaded +145 */ +146 public List<Analyzer> getAnalyzers(AnalysisPhase phase) { +147 return analyzers.get(phase); +148 } +149 +150 /** +151 * Get the dependencies identified. 152 * -153 * @param paths an array of paths to files or directories to be analyzed. +153 * @return the dependencies identified 154 */ -155 public void scan(String[] paths) { -156 for (String path : paths) { -157 final File file = new File(path); -158 scan(file); -159 } -160 } -161 -162 /** -163 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies -164 * identified are added to the dependency collection. -165 * -166 * @param path the path to a file or directory to be analyzed. -167 */ -168 public void scan(String path) { -169 if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$")) { -170 final String[] parts = path.split("\\*\\."); -171 final String[] ext = new String[]{parts[parts.length - 1]}; -172 final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2)); -173 if (dir.isDirectory()) { -174 final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true); -175 scan(files); -176 } else { -177 final String msg = String.format("Invalid file path provided to scan '%s'", path); -178 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -179 } -180 } else { -181 final File file = new File(path); -182 scan(file); -183 } -184 } -185 -186 /** -187 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any -188 * dependencies identified are added to the dependency collection. -189 * -190 * @since v0.3.2.5 -191 * -192 * @param files an array of paths to files or directories to be analyzed. -193 */ -194 public void scan(File[] files) { -195 for (File file : files) { -196 scan(file); -197 } -198 } -199 -200 /** -201 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any -202 * dependencies identified are added to the dependency collection. -203 * -204 * @since v0.3.2.5 -205 * -206 * @param files a set of paths to files or directories to be analyzed. -207 */ -208 public void scan(Set<File> files) { -209 for (File file : files) { -210 scan(file); -211 } -212 } -213 -214 /** -215 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any -216 * dependencies identified are added to the dependency collection. -217 * -218 * @since v0.3.2.5 -219 * -220 * @param files a set of paths to files or directories to be analyzed. -221 */ -222 public void scan(List<File> files) { -223 for (File file : files) { -224 scan(file); -225 } -226 } -227 -228 /** -229 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies -230 * identified are added to the dependency collection. -231 * -232 * @since v0.3.2.4 -233 * -234 * @param file the path to a file or directory to be analyzed. -235 */ -236 public void scan(File file) { -237 if (file.exists()) { -238 if (file.isDirectory()) { -239 scanDirectory(file); -240 } else { -241 scanFile(file); -242 } -243 } -244 } -245 -246 /** -247 * Recursively scans files and directories. Any dependencies identified are added to the dependency collection. -248 * -249 * @param dir the directory to scan. -250 */ -251 protected void scanDirectory(File dir) { -252 final File[] files = dir.listFiles(); -253 if (files != null) { -254 for (File f : files) { -255 if (f.isDirectory()) { -256 scanDirectory(f); -257 } else { -258 scanFile(f); -259 } -260 } -261 } -262 } -263 -264 /** -265 * Scans a specified file. If a dependency is identified it is added to the dependency collection. -266 * -267 * @param file The file to scan. -268 */ -269 protected void scanFile(File file) { -270 if (!file.isFile()) { -271 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString()); -272 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -273 return; -274 } -275 final String fileName = file.getName(); -276 final String extension = FileUtils.getFileExtension(fileName); -277 if (extension != null) { -278 if (supportsExtension(extension)) { -279 final Dependency dependency = new Dependency(file); -280 dependencies.add(dependency); -281 } -282 } else { -283 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.", -284 file.toString()); -285 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, msg); -286 } -287 } -288 -289 /** -290 * Runs the analyzers against all of the dependencies. -291 */ -292 public void analyzeDependencies() { -293 //need to ensure that data exists -294 try { -295 ensureDataExists(); -296 } catch (NoDataException ex) { -297 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); -298 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -299 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); -300 return; -301 } catch (DatabaseException ex) { -302 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); -303 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -304 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); -305 return; -306 -307 } -308 -309 final String logHeader = String.format("%n" -310 + "----------------------------------------------------%n" -311 + "BEGIN ANALYSIS%n" -312 + "----------------------------------------------------"); -313 Logger.getLogger(Engine.class.getName()).log(Level.FINE, logHeader); -314 Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Starting"); -315 -316 // analysis phases -317 for (AnalysisPhase phase : AnalysisPhase.values()) { -318 final List<Analyzer> analyzerList = analyzers.get(phase); -319 -320 for (Analyzer a : analyzerList) { -321 initializeAnalyzer(a); -322 -323 /* need to create a copy of the collection because some of the -324 * analyzers may modify it. This prevents ConcurrentModificationExceptions. -325 * This is okay for adds/deletes because it happens per analyzer. -326 */ -327 final String msg = String.format("Begin Analyzer '%s'", a.getName()); -328 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -329 final Set<Dependency> dependencySet = new HashSet<Dependency>(); -330 dependencySet.addAll(dependencies); -331 for (Dependency d : dependencySet) { -332 boolean shouldAnalyze = true; -333 if (a instanceof FileTypeAnalyzer) { -334 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a; -335 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension()); -336 } -337 if (shouldAnalyze) { -338 final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath()); -339 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msgFile); -340 try { -341 a.analyze(d, this); -342 } catch (AnalysisException ex) { -343 final String exMsg = String.format("An error occured while analyzing '%s'.", d.getActualFilePath()); -344 Logger.getLogger(Engine.class.getName()).log(Level.WARNING, exMsg); -345 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "", ex); -346 } catch (Throwable ex) { -347 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath()); -348 //final AnalysisException ax = new AnalysisException(axMsg, ex); -349 Logger.getLogger(Engine.class.getName()).log(Level.WARNING, axMsg); -350 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "", ex); -351 } -352 } -353 } -354 } -355 } -356 for (AnalysisPhase phase : AnalysisPhase.values()) { -357 final List<Analyzer> analyzerList = analyzers.get(phase); -358 -359 for (Analyzer a : analyzerList) { -360 closeAnalyzer(a); -361 } -362 } -363 -364 final String logFooter = String.format("%n" -365 + "----------------------------------------------------%n" -366 + "END ANALYSIS%n" -367 + "----------------------------------------------------"); -368 Logger.getLogger(Engine.class.getName()).log(Level.FINE, logFooter); -369 Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Complete"); -370 } -371 -372 /** -373 * Initializes the given analyzer. -374 * -375 * @param analyzer the analyzer to initialize -376 */ -377 private void initializeAnalyzer(Analyzer analyzer) { -378 try { -379 final String msg = String.format("Initializing %s", analyzer.getName()); -380 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -381 analyzer.initialize(); -382 } catch (Throwable ex) { -383 final String msg = String.format("Exception occurred initializing %s.", analyzer.getName()); -384 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -385 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); -386 try { -387 analyzer.close(); -388 } catch (Throwable ex1) { -389 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex1); -390 } -391 } -392 } -393 -394 /** -395 * Closes the given analyzer. -396 * -397 * @param analyzer the analyzer to close -398 */ -399 private void closeAnalyzer(Analyzer analyzer) { -400 final String msg = String.format("Closing Analyzer '%s'", analyzer.getName()); -401 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -402 try { -403 analyzer.close(); -404 } catch (Throwable ex) { -405 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex); -406 } -407 } -408 -409 /** -410 * Cycles through the cached web data sources and calls update on all of them. -411 */ -412 private void doUpdates() { -413 final UpdateService service = UpdateService.getInstance(); -414 final Iterator<CachedWebDataSource> iterator = service.getDataSources(); -415 while (iterator.hasNext()) { -416 final CachedWebDataSource source = iterator.next(); -417 try { -418 source.update(); -419 } catch (UpdateException ex) { -420 Logger.getLogger(Engine.class.getName()).log(Level.WARNING, -421 "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities."); -422 Logger.getLogger(Engine.class.getName()).log(Level.FINE, -423 String.format("Unable to update details for %s", source.getClass().getName()), ex); -424 } +155 public List<Dependency> getDependencies() { +156 return dependencies; +157 } +158 +159 public void setDependencies(List<Dependency> dependencies) { +160 this.dependencies = dependencies; +161 //for (Dependency dependency: dependencies) { +162 // dependencies.add(dependency); +163 //} +164 } +165 +166 /** +167 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any +168 * dependencies identified are added to the dependency collection. +169 * +170 * @since v0.3.2.5 +171 * +172 * @param paths an array of paths to files or directories to be analyzed. +173 */ +174 public void scan(String[] paths) { +175 for (String path : paths) { +176 final File file = new File(path); +177 scan(file); +178 } +179 } +180 +181 /** +182 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies +183 * identified are added to the dependency collection. +184 * +185 * @param path the path to a file or directory to be analyzed. +186 */ +187 public void scan(String path) { +188 if (path.matches("^.*[\\/]\\*\\.[^\\/:*|?<>\"]+$")) { +189 final String[] parts = path.split("\\*\\."); +190 final String[] ext = new String[]{parts[parts.length - 1]}; +191 final File dir = new File(path.substring(0, path.length() - ext[0].length() - 2)); +192 if (dir.isDirectory()) { +193 final List<File> files = (List<File>) org.apache.commons.io.FileUtils.listFiles(dir, ext, true); +194 scan(files); +195 } else { +196 final String msg = String.format("Invalid file path provided to scan '%s'", path); +197 LOGGER.log(Level.SEVERE, msg); +198 } +199 } else { +200 final File file = new File(path); +201 scan(file); +202 } +203 } +204 +205 /** +206 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any +207 * dependencies identified are added to the dependency collection. +208 * +209 * @since v0.3.2.5 +210 * +211 * @param files an array of paths to files or directories to be analyzed. +212 */ +213 public void scan(File[] files) { +214 for (File file : files) { +215 scan(file); +216 } +217 } +218 +219 /** +220 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any +221 * dependencies identified are added to the dependency collection. +222 * +223 * @since v0.3.2.5 +224 * +225 * @param files a set of paths to files or directories to be analyzed. +226 */ +227 public void scan(Set<File> files) { +228 for (File file : files) { +229 scan(file); +230 } +231 } +232 +233 /** +234 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any +235 * dependencies identified are added to the dependency collection. +236 * +237 * @since v0.3.2.5 +238 * +239 * @param files a set of paths to files or directories to be analyzed. +240 */ +241 public void scan(List<File> files) { +242 for (File file : files) { +243 scan(file); +244 } +245 } +246 +247 /** +248 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies +249 * identified are added to the dependency collection. +250 * +251 * @since v0.3.2.4 +252 * +253 * @param file the path to a file or directory to be analyzed. +254 */ +255 public void scan(File file) { +256 if (file.exists()) { +257 if (file.isDirectory()) { +258 scanDirectory(file); +259 } else { +260 scanFile(file); +261 } +262 } +263 } +264 +265 /** +266 * Recursively scans files and directories. Any dependencies identified are added to the dependency collection. +267 * +268 * @param dir the directory to scan. +269 */ +270 protected void scanDirectory(File dir) { +271 final File[] files = dir.listFiles(); +272 if (files != null) { +273 for (File f : files) { +274 if (f.isDirectory()) { +275 scanDirectory(f); +276 } else { +277 scanFile(f); +278 } +279 } +280 } +281 } +282 +283 /** +284 * Scans a specified file. If a dependency is identified it is added to the dependency collection. +285 * +286 * @param file The file to scan. +287 */ +288 protected void scanFile(File file) { +289 if (!file.isFile()) { +290 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString()); +291 LOGGER.log(Level.FINE, msg); +292 return; +293 } +294 final String fileName = file.getName(); +295 final String extension = FileUtils.getFileExtension(fileName); +296 if (extension != null) { +297 if (supportsExtension(extension)) { +298 final Dependency dependency = new Dependency(file); +299 dependencies.add(dependency); +300 } +301 } else { +302 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.", +303 file.toString()); +304 LOGGER.log(Level.FINEST, msg); +305 } +306 } +307 +308 /** +309 * Runs the analyzers against all of the dependencies. +310 */ +311 public void analyzeDependencies() { +312 //need to ensure that data exists +313 try { +314 ensureDataExists(); +315 } catch (NoDataException ex) { +316 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); +317 LOGGER.log(Level.SEVERE, msg); +318 LOGGER.log(Level.FINE, null, ex); +319 return; +320 } catch (DatabaseException ex) { +321 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); +322 LOGGER.log(Level.SEVERE, msg); +323 LOGGER.log(Level.FINE, null, ex); +324 return; +325 +326 } +327 +328 final String logHeader = String.format("%n" +329 + "----------------------------------------------------%n" +330 + "BEGIN ANALYSIS%n" +331 + "----------------------------------------------------"); +332 LOGGER.log(Level.FINE, logHeader); +333 LOGGER.log(Level.INFO, "Analysis Starting"); +334 +335 // analysis phases +336 for (AnalysisPhase phase : AnalysisPhase.values()) { +337 final List<Analyzer> analyzerList = analyzers.get(phase); +338 +339 for (Analyzer a : analyzerList) { +340 initializeAnalyzer(a); +341 +342 /* need to create a copy of the collection because some of the +343 * analyzers may modify it. This prevents ConcurrentModificationExceptions. +344 * This is okay for adds/deletes because it happens per analyzer. +345 */ +346 final String msg = String.format("Begin Analyzer '%s'", a.getName()); +347 LOGGER.log(Level.FINE, msg); +348 final Set<Dependency> dependencySet = new HashSet<Dependency>(); +349 dependencySet.addAll(dependencies); +350 for (Dependency d : dependencySet) { +351 boolean shouldAnalyze = true; +352 if (a instanceof FileTypeAnalyzer) { +353 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a; +354 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension()); +355 } +356 if (shouldAnalyze) { +357 final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath()); +358 LOGGER.log(Level.FINE, msgFile); +359 try { +360 a.analyze(d, this); +361 } catch (AnalysisException ex) { +362 final String exMsg = String.format("An error occurred while analyzing '%s'.", d.getActualFilePath()); +363 LOGGER.log(Level.WARNING, exMsg); +364 LOGGER.log(Level.FINE, "", ex); +365 } catch (Throwable ex) { +366 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath()); +367 //final AnalysisException ax = new AnalysisException(axMsg, ex); +368 LOGGER.log(Level.WARNING, axMsg); +369 LOGGER.log(Level.FINE, "", ex); +370 } +371 } +372 } +373 } +374 } +375 for (AnalysisPhase phase : AnalysisPhase.values()) { +376 final List<Analyzer> analyzerList = analyzers.get(phase); +377 +378 for (Analyzer a : analyzerList) { +379 closeAnalyzer(a); +380 } +381 } +382 +383 final String logFooter = String.format("%n" +384 + "----------------------------------------------------%n" +385 + "END ANALYSIS%n" +386 + "----------------------------------------------------"); +387 LOGGER.log(Level.FINE, logFooter); +388 LOGGER.log(Level.INFO, "Analysis Complete"); +389 } +390 +391 /** +392 * Initializes the given analyzer. +393 * +394 * @param analyzer the analyzer to initialize +395 */ +396 private void initializeAnalyzer(Analyzer analyzer) { +397 try { +398 final String msg = String.format("Initializing %s", analyzer.getName()); +399 LOGGER.log(Level.FINE, msg); +400 analyzer.initialize(); +401 } catch (Throwable ex) { +402 final String msg = String.format("Exception occurred initializing %s.", analyzer.getName()); +403 LOGGER.log(Level.SEVERE, msg); +404 LOGGER.log(Level.FINE, null, ex); +405 try { +406 analyzer.close(); +407 } catch (Throwable ex1) { +408 LOGGER.log(Level.FINEST, null, ex1); +409 } +410 } +411 } +412 +413 /** +414 * Closes the given analyzer. +415 * +416 * @param analyzer the analyzer to close +417 */ +418 private void closeAnalyzer(Analyzer analyzer) { +419 final String msg = String.format("Closing Analyzer '%s'", analyzer.getName()); +420 LOGGER.log(Level.FINE, msg); +421 try { +422 analyzer.close(); +423 } catch (Throwable ex) { +424 LOGGER.log(Level.FINEST, null, ex); 425 } 426 } 427 428 /** -429 * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used. -430 * -431 * @return a list of Analyzers -432 */ -433 public List<Analyzer> getAnalyzers() { -434 final List<Analyzer> ret = new ArrayList<Analyzer>(); -435 for (AnalysisPhase phase : AnalysisPhase.values()) { -436 final List<Analyzer> analyzerList = analyzers.get(phase); -437 ret.addAll(analyzerList); -438 } -439 return ret; -440 } -441 -442 /** -443 * Checks all analyzers to see if an extension is supported. -444 * -445 * @param ext a file extension -446 * @return true or false depending on whether or not the file extension is supported -447 */ -448 public boolean supportsExtension(String ext) { -449 if (ext == null) { -450 return false; -451 } -452 boolean scan = false; -453 for (FileTypeAnalyzer a : this.fileTypeAnalyzers) { -454 /* note, we can't break early on this loop as the analyzers need to know if -455 they have files to work on prior to initialization */ -456 scan |= a.supportsExtension(ext); +429 * Cycles through the cached web data sources and calls update on all of them. +430 */ +431 private void doUpdates() { +432 final UpdateService service = new UpdateService(serviceClassLoader); +433 final Iterator<CachedWebDataSource> iterator = service.getDataSources(); +434 while (iterator.hasNext()) { +435 final CachedWebDataSource source = iterator.next(); +436 try { +437 source.update(); +438 } catch (UpdateException ex) { +439 LOGGER.log(Level.WARNING, +440 "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities."); +441 LOGGER.log(Level.FINE, +442 String.format("Unable to update details for %s", source.getClass().getName()), ex); +443 } +444 } +445 } +446 +447 /** +448 * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used. +449 * +450 * @return a list of Analyzers +451 */ +452 public List<Analyzer> getAnalyzers() { +453 final List<Analyzer> ret = new ArrayList<Analyzer>(); +454 for (AnalysisPhase phase : AnalysisPhase.values()) { +455 final List<Analyzer> analyzerList = analyzers.get(phase); +456 ret.addAll(analyzerList); 457 } -458 return scan; +458 return ret; 459 } 460 461 /** -462 * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown. +462 * Checks all analyzers to see if an extension is supported. 463 * -464 * @throws NoDataException thrown if no data exists in the CPE Index -465 * @throws DatabaseException thrown if there is an exception opening the database +464 * @param ext a file extension +465 * @return true or false depending on whether or not the file extension is supported 466 */ -467 private void ensureDataExists() throws NoDataException, DatabaseException { -468 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance(); -469 final CveDB cve = new CveDB(); -470 -471 try { -472 cve.open(); -473 cpe.open(cve); -474 } catch (IndexException ex) { -475 throw new NoDataException(ex.getMessage(), ex); -476 } catch (DatabaseException ex) { -477 throw new NoDataException(ex.getMessage(), ex); -478 } finally { -479 cve.close(); -480 } -481 if (cpe.numDocs() <= 0) { -482 cpe.close(); -483 throw new NoDataException("No documents exist"); -484 } -485 } -486 -487 } +467 public boolean supportsExtension(String ext) { +468 if (ext == null) { +469 return false; +470 } +471 boolean scan = false; +472 for (FileTypeAnalyzer a : this.fileTypeAnalyzers) { +473 /* note, we can't break early on this loop as the analyzers need to know if +474 they have files to work on prior to initialization */ +475 scan |= a.supportsExtension(ext); +476 } +477 return scan; +478 } +479 +480 /** +481 * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown. +482 * +483 * @throws NoDataException thrown if no data exists in the CPE Index +484 * @throws DatabaseException thrown if there is an exception opening the database +485 */ +486 private void ensureDataExists() throws NoDataException, DatabaseException { +487 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance(); +488 final CveDB cve = new CveDB(); +489 +490 try { +491 cve.open(); +492 cpe.open(cve); +493 } catch (IndexException ex) { +494 throw new NoDataException(ex.getMessage(), ex); +495 } catch (DatabaseException ex) { +496 throw new NoDataException(ex.getMessage(), ex); +497 } finally { +498 cve.close(); +499 } +500 if (cpe.numDocs() <= 0) { +501 cpe.close(); +502 throw new NoDataException("No documents exist"); +503 } +504 } +505 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html index 76ae2bdf3..8ccf9e7a8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html @@ -72,913 +72,911 @@ 64 * System specific new line character. 65 */ 66 private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern(); -67 -68 /** -69 * The application name for the report. -70 */ -71 private String applicationName = "Dependency-Check"; -72 -73 /** -74 * Get the value of applicationName. -75 * -76 * @return the value of applicationName -77 */ -78 public String getApplicationName() { -79 return applicationName; -80 } -81 -82 /** -83 * Set the value of applicationName. -84 * -85 * @param applicationName new value of applicationName -86 */ -87 public void setApplicationName(String applicationName) { -88 this.applicationName = applicationName; -89 } -90 -91 /** -92 * The pre-determined dependencies to scan -93 */ -94 private List<Dependency> dependencies; -95 -96 /** -97 * Returns a list of pre-determined dependencies. -98 * -99 * @return returns a list of dependencies -100 */ -101 public List<Dependency> getDependencies() { -102 return dependencies; -103 } -104 -105 /** -106 * Sets the list of dependencies to scan. -107 * -108 * @param dependencies new value of dependencies -109 */ -110 public void setDependencies(List<Dependency> dependencies) { -111 this.dependencies = dependencies; -112 } -113 -114 /** -115 * The location of the data directory that contains -116 */ -117 private String dataDirectory = null; -118 -119 /** -120 * Get the value of dataDirectory. -121 * -122 * @return the value of dataDirectory -123 */ -124 public String getDataDirectory() { -125 return dataDirectory; -126 } -127 -128 /** -129 * Set the value of dataDirectory. -130 * -131 * @param dataDirectory new value of dataDirectory -132 */ -133 public void setDataDirectory(String dataDirectory) { -134 this.dataDirectory = dataDirectory; -135 } -136 -137 /** -138 * Specifies the destination directory for the generated Dependency-Check report. -139 */ -140 private String reportOutputDirectory; -141 -142 /** -143 * Get the value of reportOutputDirectory. -144 * -145 * @return the value of reportOutputDirectory -146 */ -147 public String getReportOutputDirectory() { -148 return reportOutputDirectory; -149 } -150 -151 /** -152 * Set the value of reportOutputDirectory. -153 * -154 * @param reportOutputDirectory new value of reportOutputDirectory -155 */ -156 public void setReportOutputDirectory(String reportOutputDirectory) { -157 this.reportOutputDirectory = reportOutputDirectory; -158 } -159 -160 /** -161 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 -162 * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11. -163 * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail. -164 */ -165 private float failBuildOnCVSS = 11; -166 -167 /** -168 * Get the value of failBuildOnCVSS. -169 * -170 * @return the value of failBuildOnCVSS -171 */ -172 public float getFailBuildOnCVSS() { -173 return failBuildOnCVSS; -174 } -175 -176 /** -177 * Set the value of failBuildOnCVSS. -178 * -179 * @param failBuildOnCVSS new value of failBuildOnCVSS -180 */ -181 public void setFailBuildOnCVSS(float failBuildOnCVSS) { -182 this.failBuildOnCVSS = failBuildOnCVSS; -183 } -184 -185 /** -186 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to -187 * false. Default is true. -188 */ -189 private boolean autoUpdate = true; -190 -191 /** -192 * Get the value of autoUpdate. -193 * -194 * @return the value of autoUpdate -195 */ -196 public boolean isAutoUpdate() { -197 return autoUpdate; -198 } -199 -200 /** -201 * Set the value of autoUpdate. -202 * -203 * @param autoUpdate new value of autoUpdate -204 */ -205 public void setAutoUpdate(boolean autoUpdate) { -206 this.autoUpdate = autoUpdate; -207 } -208 -209 /** -210 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this -211 * within the Site plugin unless the externalReport is set to true. Default is HTML. -212 */ -213 private ReportGenerator.Format reportFormat = ReportGenerator.Format.HTML; -214 -215 /** -216 * Get the value of reportFormat. -217 * -218 * @return the value of reportFormat -219 */ -220 public ReportGenerator.Format getReportFormat() { -221 return reportFormat; -222 } -223 -224 /** -225 * Set the value of reportFormat. -226 * -227 * @param reportFormat new value of reportFormat -228 */ -229 public void setReportFormat(ReportGenerator.Format reportFormat) { -230 this.reportFormat = reportFormat; -231 } -232 -233 /** -234 * The Proxy URL. -235 */ -236 private String proxyUrl; -237 -238 /** -239 * Get the value of proxyUrl. -240 * -241 * @return the value of proxyUrl -242 */ -243 public String getProxyUrl() { -244 return proxyUrl; -245 } -246 -247 /** -248 * Set the value of proxyUrl. -249 * -250 * @param proxyUrl new value of proxyUrl -251 */ -252 public void setProxyUrl(String proxyUrl) { -253 this.proxyUrl = proxyUrl; -254 } -255 -256 /** -257 * The Proxy Port. -258 */ -259 private String proxyPort; -260 -261 /** -262 * Get the value of proxyPort. -263 * -264 * @return the value of proxyPort -265 */ -266 public String getProxyPort() { -267 return proxyPort; -268 } -269 -270 /** -271 * Set the value of proxyPort. -272 * -273 * @param proxyPort new value of proxyPort -274 */ -275 public void setProxyPort(String proxyPort) { -276 this.proxyPort = proxyPort; -277 } -278 -279 /** -280 * The Proxy username. -281 */ -282 private String proxyUsername; -283 -284 /** -285 * Get the value of proxyUsername. -286 * -287 * @return the value of proxyUsername -288 */ -289 public String getProxyUsername() { -290 return proxyUsername; -291 } -292 -293 /** -294 * Set the value of proxyUsername. -295 * -296 * @param proxyUsername new value of proxyUsername -297 */ -298 public void setProxyUsername(String proxyUsername) { -299 this.proxyUsername = proxyUsername; -300 } -301 -302 /** -303 * The Proxy password. -304 */ -305 private String proxyPassword; -306 -307 /** -308 * Get the value of proxyPassword. -309 * -310 * @return the value of proxyPassword -311 */ -312 public String getProxyPassword() { -313 return proxyPassword; -314 } -315 -316 /** -317 * Set the value of proxyPassword. -318 * -319 * @param proxyPassword new value of proxyPassword -320 */ -321 public void setProxyPassword(String proxyPassword) { -322 this.proxyPassword = proxyPassword; -323 } -324 -325 /** -326 * The Connection Timeout. -327 */ -328 private String connectionTimeout; -329 -330 /** -331 * Get the value of connectionTimeout. -332 * -333 * @return the value of connectionTimeout -334 */ -335 public String getConnectionTimeout() { -336 return connectionTimeout; -337 } -338 -339 /** -340 * Set the value of connectionTimeout. -341 * -342 * @param connectionTimeout new value of connectionTimeout -343 */ -344 public void setConnectionTimeout(String connectionTimeout) { -345 this.connectionTimeout = connectionTimeout; -346 } -347 -348 /** -349 * The file path used for verbose logging. -350 */ -351 private String logFile = null; -352 -353 /** -354 * Get the value of logFile. -355 * -356 * @return the value of logFile -357 */ -358 public String getLogFile() { -359 return logFile; -360 } -361 -362 /** -363 * Set the value of logFile. -364 * -365 * @param logFile new value of logFile -366 */ -367 public void setLogFile(String logFile) { -368 this.logFile = logFile; -369 } -370 -371 /** -372 * The path to the suppression file. -373 */ -374 private String suppressionFile; -375 -376 /** -377 * Get the value of suppressionFile. -378 * -379 * @return the value of suppressionFile -380 */ -381 public String getSuppressionFile() { -382 return suppressionFile; -383 } -384 -385 /** -386 * Set the value of suppressionFile. -387 * -388 * @param suppressionFile new value of suppressionFile -389 */ -390 public void setSuppressionFile(String suppressionFile) { -391 this.suppressionFile = suppressionFile; -392 } -393 -394 /** -395 * flag indicating whether or not to show a summary of findings. -396 */ -397 private boolean showSummary = true; -398 -399 /** -400 * Get the value of showSummary. -401 * -402 * @return the value of showSummary -403 */ -404 public boolean isShowSummary() { -405 return showSummary; -406 } -407 -408 /** -409 * Set the value of showSummary. -410 * -411 * @param showSummary new value of showSummary -412 */ -413 public void setShowSummary(boolean showSummary) { -414 this.showSummary = showSummary; -415 } -416 -417 /** -418 * Whether or not the nexus analyzer is enabled. -419 */ -420 private boolean nexusAnalyzerEnabled = true; -421 -422 /** -423 * Get the value of nexusAnalyzerEnabled. -424 * -425 * @return the value of nexusAnalyzerEnabled -426 */ -427 public boolean isNexusAnalyzerEnabled() { -428 return nexusAnalyzerEnabled; -429 } -430 -431 /** -432 * Set the value of nexusAnalyzerEnabled. -433 * -434 * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled -435 */ -436 public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) { -437 this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; -438 } -439 -440 /** -441 * The URL of the Nexus server. -442 */ -443 private String nexusUrl; -444 -445 /** -446 * Get the value of nexusUrl. -447 * -448 * @return the value of nexusUrl -449 */ -450 public String getNexusUrl() { -451 return nexusUrl; -452 } -453 -454 /** -455 * Set the value of nexusUrl. -456 * -457 * @param nexusUrl new value of nexusUrl -458 */ -459 public void setNexusUrl(String nexusUrl) { -460 this.nexusUrl = nexusUrl; -461 } -462 -463 /** -464 * Whether or not the defined proxy should be used when connecting to Nexus. -465 */ -466 private boolean nexusUsesProxy = true; -467 -468 /** -469 * Get the value of nexusUsesProxy. -470 * -471 * @return the value of nexusUsesProxy -472 */ -473 public boolean isNexusUsesProxy() { -474 return nexusUsesProxy; -475 } -476 -477 /** -478 * Set the value of nexusUsesProxy. -479 * -480 * @param nexusUsesProxy new value of nexusUsesProxy -481 */ -482 public void setNexusUsesProxy(boolean nexusUsesProxy) { -483 this.nexusUsesProxy = nexusUsesProxy; -484 } -485 -486 /** -487 * The database driver name; such as org.h2.Driver. -488 */ -489 private String databaseDriverName; -490 -491 /** -492 * Get the value of databaseDriverName. -493 * -494 * @return the value of databaseDriverName -495 */ -496 public String getDatabaseDriverName() { -497 return databaseDriverName; -498 } -499 -500 /** -501 * Set the value of databaseDriverName. -502 * -503 * @param databaseDriverName new value of databaseDriverName -504 */ -505 public void setDatabaseDriverName(String databaseDriverName) { -506 this.databaseDriverName = databaseDriverName; -507 } -508 -509 /** -510 * The path to the database driver JAR file if it is not on the class path. -511 */ -512 private String databaseDriverPath; -513 -514 /** -515 * Get the value of databaseDriverPath. -516 * -517 * @return the value of databaseDriverPath -518 */ -519 public String getDatabaseDriverPath() { -520 return databaseDriverPath; -521 } -522 -523 /** -524 * Set the value of databaseDriverPath. -525 * -526 * @param databaseDriverPath new value of databaseDriverPath -527 */ -528 public void setDatabaseDriverPath(String databaseDriverPath) { -529 this.databaseDriverPath = databaseDriverPath; -530 } -531 -532 /** -533 * The database connection string. -534 */ -535 private String connectionString; -536 -537 /** -538 * Get the value of connectionString. -539 * -540 * @return the value of connectionString -541 */ -542 public String getConnectionString() { -543 return connectionString; -544 } -545 -546 /** -547 * Set the value of connectionString. -548 * -549 * @param connectionString new value of connectionString -550 */ -551 public void setConnectionString(String connectionString) { -552 this.connectionString = connectionString; -553 } -554 -555 /** -556 * The user name for connecting to the database. -557 */ -558 private String databaseUser; -559 -560 /** -561 * Get the value of databaseUser. -562 * -563 * @return the value of databaseUser -564 */ -565 public String getDatabaseUser() { -566 return databaseUser; -567 } -568 -569 /** -570 * Set the value of databaseUser. -571 * -572 * @param databaseUser new value of databaseUser -573 */ -574 public void setDatabaseUser(String databaseUser) { -575 this.databaseUser = databaseUser; -576 } -577 -578 /** -579 * The password to use when connecting to the database. -580 */ -581 private String databasePassword; -582 -583 /** -584 * Get the value of databasePassword. -585 * -586 * @return the value of databasePassword -587 */ -588 public String getDatabasePassword() { -589 return databasePassword; -590 } -591 -592 /** -593 * Set the value of databasePassword. -594 * -595 * @param databasePassword new value of databasePassword -596 */ -597 public void setDatabasePassword(String databasePassword) { -598 this.databasePassword = databasePassword; -599 } -600 -601 /** -602 * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat -603 * like ZIP files. -604 */ -605 private String zipExtensions; -606 -607 /** -608 * Get the value of zipExtensions. -609 * -610 * @return the value of zipExtensions -611 */ -612 public String getZipExtensions() { -613 return zipExtensions; -614 } -615 -616 /** -617 * Set the value of zipExtensions. -618 * -619 * @param zipExtensions new value of zipExtensions -620 */ -621 public void setZipExtensions(String zipExtensions) { -622 this.zipExtensions = zipExtensions; -623 } -624 -625 /** -626 * The url for the modified NVD CVE (1.2 schema). -627 */ -628 private String cveUrl12Modified; -629 -630 /** -631 * Get the value of cveUrl12Modified. -632 * -633 * @return the value of cveUrl12Modified -634 */ -635 public String getCveUrl12Modified() { -636 return cveUrl12Modified; -637 } -638 -639 /** -640 * Set the value of cveUrl12Modified. -641 * -642 * @param cveUrl12Modified new value of cveUrl12Modified -643 */ -644 public void setCveUrl12Modified(String cveUrl12Modified) { -645 this.cveUrl12Modified = cveUrl12Modified; -646 } -647 -648 /** -649 * The url for the modified NVD CVE (2.0 schema). -650 */ -651 private String cveUrl20Modified; -652 -653 /** -654 * Get the value of cveUrl20Modified. -655 * -656 * @return the value of cveUrl20Modified -657 */ -658 public String getCveUrl20Modified() { -659 return cveUrl20Modified; -660 } -661 -662 /** -663 * Set the value of cveUrl20Modified. -664 * -665 * @param cveUrl20Modified new value of cveUrl20Modified -666 */ -667 public void setCveUrl20Modified(String cveUrl20Modified) { -668 this.cveUrl20Modified = cveUrl20Modified; -669 } -670 -671 /** -672 * Base Data Mirror URL for CVE 1.2. -673 */ -674 private String cveUrl12Base; -675 -676 /** -677 * Get the value of cveUrl12Base. -678 * -679 * @return the value of cveUrl12Base -680 */ -681 public String getCveUrl12Base() { -682 return cveUrl12Base; -683 } -684 -685 /** -686 * Set the value of cveUrl12Base. -687 * -688 * @param cveUrl12Base new value of cveUrl12Base -689 */ -690 public void setCveUrl12Base(String cveUrl12Base) { -691 this.cveUrl12Base = cveUrl12Base; -692 } -693 -694 /** -695 * Data Mirror URL for CVE 2.0. -696 */ -697 private String cveUrl20Base; -698 -699 /** -700 * Get the value of cveUrl20Base. -701 * -702 * @return the value of cveUrl20Base -703 */ -704 public String getCveUrl20Base() { -705 return cveUrl20Base; -706 } -707 -708 /** -709 * Set the value of cveUrl20Base. -710 * -711 * @param cveUrl20Base new value of cveUrl20Base -712 */ -713 public void setCveUrl20Base(String cveUrl20Base) { -714 this.cveUrl20Base = cveUrl20Base; -715 } -716 -717 /** -718 * The path to Mono for .NET assembly analysis on non-windows systems. -719 */ -720 private String pathToMono; -721 -722 /** -723 * Get the value of pathToMono. -724 * -725 * @return the value of pathToMono -726 */ -727 public String getPathToMono() { -728 return pathToMono; -729 } -730 -731 /** -732 * Set the value of pathToMono. -733 * -734 * @param pathToMono new value of pathToMono -735 */ -736 public void setPathToMono(String pathToMono) { -737 this.pathToMono = pathToMono; -738 } -739 -740 /** -741 * Executes the Dependency-Check on the dependent libraries. -742 * -743 * @return the Engine used to scan the dependencies. -744 * @throws org.owasp.dependencycheck.data.nvdcve.DatabaseException thrown if there is an exception connecting to the -745 * database -746 */ -747 private Engine executeDependencyCheck() throws DatabaseException { -748 populateSettings(); -749 Engine engine = null; -750 try { -751 engine = new Engine(); -752 engine.setDependencies(this.dependencies); -753 engine.analyzeDependencies(); -754 -755 } finally { -756 if (engine != null) { -757 engine.cleanup(); -758 } -759 } -760 return engine; -761 } -762 -763 /** -764 * Generates the reports for a given dependency-check engine. -765 * -766 * @param engine a dependency-check engine -767 * @param outDirectory the directory to write the reports to -768 */ -769 private void generateExternalReports(Engine engine, File outDirectory) { -770 DatabaseProperties prop = null; -771 CveDB cve = null; -772 try { -773 cve = new CveDB(); -774 cve.open(); -775 prop = cve.getDatabaseProperties(); -776 } catch (DatabaseException ex) { -777 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); -778 } finally { -779 if (cve != null) { -780 cve.close(); -781 } -782 } -783 final ReportGenerator r = new ReportGenerator(this.applicationName, engine.getDependencies(), engine.getAnalyzers(), prop); -784 try { -785 r.generateReports(outDirectory.getCanonicalPath(), this.reportFormat.name()); -786 } catch (IOException ex) { -787 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.SEVERE, +67 /** +68 * Logger for use throughout the class. +69 */ +70 private static final Logger LOGGER = Logger.getLogger(DependencyCheckScanAgent.class.getName()); +71 /** +72 * The application name for the report. +73 */ +74 private String applicationName = "Dependency-Check"; +75 +76 /** +77 * Get the value of applicationName. +78 * +79 * @return the value of applicationName +80 */ +81 public String getApplicationName() { +82 return applicationName; +83 } +84 +85 /** +86 * Set the value of applicationName. +87 * +88 * @param applicationName new value of applicationName +89 */ +90 public void setApplicationName(String applicationName) { +91 this.applicationName = applicationName; +92 } +93 +94 /** +95 * The pre-determined dependencies to scan +96 */ +97 private List<Dependency> dependencies; +98 +99 /** +100 * Returns a list of pre-determined dependencies. +101 * +102 * @return returns a list of dependencies +103 */ +104 public List<Dependency> getDependencies() { +105 return dependencies; +106 } +107 +108 /** +109 * Sets the list of dependencies to scan. +110 * +111 * @param dependencies new value of dependencies +112 */ +113 public void setDependencies(List<Dependency> dependencies) { +114 this.dependencies = dependencies; +115 } +116 +117 /** +118 * The location of the data directory that contains +119 */ +120 private String dataDirectory = null; +121 +122 /** +123 * Get the value of dataDirectory. +124 * +125 * @return the value of dataDirectory +126 */ +127 public String getDataDirectory() { +128 return dataDirectory; +129 } +130 +131 /** +132 * Set the value of dataDirectory. +133 * +134 * @param dataDirectory new value of dataDirectory +135 */ +136 public void setDataDirectory(String dataDirectory) { +137 this.dataDirectory = dataDirectory; +138 } +139 +140 /** +141 * Specifies the destination directory for the generated Dependency-Check report. +142 */ +143 private String reportOutputDirectory; +144 +145 /** +146 * Get the value of reportOutputDirectory. +147 * +148 * @return the value of reportOutputDirectory +149 */ +150 public String getReportOutputDirectory() { +151 return reportOutputDirectory; +152 } +153 +154 /** +155 * Set the value of reportOutputDirectory. +156 * +157 * @param reportOutputDirectory new value of reportOutputDirectory +158 */ +159 public void setReportOutputDirectory(String reportOutputDirectory) { +160 this.reportOutputDirectory = reportOutputDirectory; +161 } +162 +163 /** +164 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 +165 * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11. +166 * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail. +167 */ +168 private float failBuildOnCVSS = 11; +169 +170 /** +171 * Get the value of failBuildOnCVSS. +172 * +173 * @return the value of failBuildOnCVSS +174 */ +175 public float getFailBuildOnCVSS() { +176 return failBuildOnCVSS; +177 } +178 +179 /** +180 * Set the value of failBuildOnCVSS. +181 * +182 * @param failBuildOnCVSS new value of failBuildOnCVSS +183 */ +184 public void setFailBuildOnCVSS(float failBuildOnCVSS) { +185 this.failBuildOnCVSS = failBuildOnCVSS; +186 } +187 +188 /** +189 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to +190 * false. Default is true. +191 */ +192 private boolean autoUpdate = true; +193 +194 /** +195 * Get the value of autoUpdate. +196 * +197 * @return the value of autoUpdate +198 */ +199 public boolean isAutoUpdate() { +200 return autoUpdate; +201 } +202 +203 /** +204 * Set the value of autoUpdate. +205 * +206 * @param autoUpdate new value of autoUpdate +207 */ +208 public void setAutoUpdate(boolean autoUpdate) { +209 this.autoUpdate = autoUpdate; +210 } +211 +212 /** +213 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this +214 * within the Site plugin unless the externalReport is set to true. Default is HTML. +215 */ +216 private ReportGenerator.Format reportFormat = ReportGenerator.Format.HTML; +217 +218 /** +219 * Get the value of reportFormat. +220 * +221 * @return the value of reportFormat +222 */ +223 public ReportGenerator.Format getReportFormat() { +224 return reportFormat; +225 } +226 +227 /** +228 * Set the value of reportFormat. +229 * +230 * @param reportFormat new value of reportFormat +231 */ +232 public void setReportFormat(ReportGenerator.Format reportFormat) { +233 this.reportFormat = reportFormat; +234 } +235 +236 /** +237 * The Proxy URL. +238 */ +239 private String proxyUrl; +240 +241 /** +242 * Get the value of proxyUrl. +243 * +244 * @return the value of proxyUrl +245 */ +246 public String getProxyUrl() { +247 return proxyUrl; +248 } +249 +250 /** +251 * Set the value of proxyUrl. +252 * +253 * @param proxyUrl new value of proxyUrl +254 */ +255 public void setProxyUrl(String proxyUrl) { +256 this.proxyUrl = proxyUrl; +257 } +258 +259 /** +260 * The Proxy Port. +261 */ +262 private String proxyPort; +263 +264 /** +265 * Get the value of proxyPort. +266 * +267 * @return the value of proxyPort +268 */ +269 public String getProxyPort() { +270 return proxyPort; +271 } +272 +273 /** +274 * Set the value of proxyPort. +275 * +276 * @param proxyPort new value of proxyPort +277 */ +278 public void setProxyPort(String proxyPort) { +279 this.proxyPort = proxyPort; +280 } +281 +282 /** +283 * The Proxy username. +284 */ +285 private String proxyUsername; +286 +287 /** +288 * Get the value of proxyUsername. +289 * +290 * @return the value of proxyUsername +291 */ +292 public String getProxyUsername() { +293 return proxyUsername; +294 } +295 +296 /** +297 * Set the value of proxyUsername. +298 * +299 * @param proxyUsername new value of proxyUsername +300 */ +301 public void setProxyUsername(String proxyUsername) { +302 this.proxyUsername = proxyUsername; +303 } +304 +305 /** +306 * The Proxy password. +307 */ +308 private String proxyPassword; +309 +310 /** +311 * Get the value of proxyPassword. +312 * +313 * @return the value of proxyPassword +314 */ +315 public String getProxyPassword() { +316 return proxyPassword; +317 } +318 +319 /** +320 * Set the value of proxyPassword. +321 * +322 * @param proxyPassword new value of proxyPassword +323 */ +324 public void setProxyPassword(String proxyPassword) { +325 this.proxyPassword = proxyPassword; +326 } +327 +328 /** +329 * The Connection Timeout. +330 */ +331 private String connectionTimeout; +332 +333 /** +334 * Get the value of connectionTimeout. +335 * +336 * @return the value of connectionTimeout +337 */ +338 public String getConnectionTimeout() { +339 return connectionTimeout; +340 } +341 +342 /** +343 * Set the value of connectionTimeout. +344 * +345 * @param connectionTimeout new value of connectionTimeout +346 */ +347 public void setConnectionTimeout(String connectionTimeout) { +348 this.connectionTimeout = connectionTimeout; +349 } +350 +351 /** +352 * The file path used for verbose logging. +353 */ +354 private String logFile = null; +355 +356 /** +357 * Get the value of logFile. +358 * +359 * @return the value of logFile +360 */ +361 public String getLogFile() { +362 return logFile; +363 } +364 +365 /** +366 * Set the value of logFile. +367 * +368 * @param logFile new value of logFile +369 */ +370 public void setLogFile(String logFile) { +371 this.logFile = logFile; +372 } +373 +374 /** +375 * The path to the suppression file. +376 */ +377 private String suppressionFile; +378 +379 /** +380 * Get the value of suppressionFile. +381 * +382 * @return the value of suppressionFile +383 */ +384 public String getSuppressionFile() { +385 return suppressionFile; +386 } +387 +388 /** +389 * Set the value of suppressionFile. +390 * +391 * @param suppressionFile new value of suppressionFile +392 */ +393 public void setSuppressionFile(String suppressionFile) { +394 this.suppressionFile = suppressionFile; +395 } +396 +397 /** +398 * flag indicating whether or not to show a summary of findings. +399 */ +400 private boolean showSummary = true; +401 +402 /** +403 * Get the value of showSummary. +404 * +405 * @return the value of showSummary +406 */ +407 public boolean isShowSummary() { +408 return showSummary; +409 } +410 +411 /** +412 * Set the value of showSummary. +413 * +414 * @param showSummary new value of showSummary +415 */ +416 public void setShowSummary(boolean showSummary) { +417 this.showSummary = showSummary; +418 } +419 +420 /** +421 * Whether or not the nexus analyzer is enabled. +422 */ +423 private boolean nexusAnalyzerEnabled = true; +424 +425 /** +426 * Get the value of nexusAnalyzerEnabled. +427 * +428 * @return the value of nexusAnalyzerEnabled +429 */ +430 public boolean isNexusAnalyzerEnabled() { +431 return nexusAnalyzerEnabled; +432 } +433 +434 /** +435 * Set the value of nexusAnalyzerEnabled. +436 * +437 * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled +438 */ +439 public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) { +440 this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; +441 } +442 +443 /** +444 * The URL of the Nexus server. +445 */ +446 private String nexusUrl; +447 +448 /** +449 * Get the value of nexusUrl. +450 * +451 * @return the value of nexusUrl +452 */ +453 public String getNexusUrl() { +454 return nexusUrl; +455 } +456 +457 /** +458 * Set the value of nexusUrl. +459 * +460 * @param nexusUrl new value of nexusUrl +461 */ +462 public void setNexusUrl(String nexusUrl) { +463 this.nexusUrl = nexusUrl; +464 } +465 +466 /** +467 * Whether or not the defined proxy should be used when connecting to Nexus. +468 */ +469 private boolean nexusUsesProxy = true; +470 +471 /** +472 * Get the value of nexusUsesProxy. +473 * +474 * @return the value of nexusUsesProxy +475 */ +476 public boolean isNexusUsesProxy() { +477 return nexusUsesProxy; +478 } +479 +480 /** +481 * Set the value of nexusUsesProxy. +482 * +483 * @param nexusUsesProxy new value of nexusUsesProxy +484 */ +485 public void setNexusUsesProxy(boolean nexusUsesProxy) { +486 this.nexusUsesProxy = nexusUsesProxy; +487 } +488 +489 /** +490 * The database driver name; such as org.h2.Driver. +491 */ +492 private String databaseDriverName; +493 +494 /** +495 * Get the value of databaseDriverName. +496 * +497 * @return the value of databaseDriverName +498 */ +499 public String getDatabaseDriverName() { +500 return databaseDriverName; +501 } +502 +503 /** +504 * Set the value of databaseDriverName. +505 * +506 * @param databaseDriverName new value of databaseDriverName +507 */ +508 public void setDatabaseDriverName(String databaseDriverName) { +509 this.databaseDriverName = databaseDriverName; +510 } +511 +512 /** +513 * The path to the database driver JAR file if it is not on the class path. +514 */ +515 private String databaseDriverPath; +516 +517 /** +518 * Get the value of databaseDriverPath. +519 * +520 * @return the value of databaseDriverPath +521 */ +522 public String getDatabaseDriverPath() { +523 return databaseDriverPath; +524 } +525 +526 /** +527 * Set the value of databaseDriverPath. +528 * +529 * @param databaseDriverPath new value of databaseDriverPath +530 */ +531 public void setDatabaseDriverPath(String databaseDriverPath) { +532 this.databaseDriverPath = databaseDriverPath; +533 } +534 +535 /** +536 * The database connection string. +537 */ +538 private String connectionString; +539 +540 /** +541 * Get the value of connectionString. +542 * +543 * @return the value of connectionString +544 */ +545 public String getConnectionString() { +546 return connectionString; +547 } +548 +549 /** +550 * Set the value of connectionString. +551 * +552 * @param connectionString new value of connectionString +553 */ +554 public void setConnectionString(String connectionString) { +555 this.connectionString = connectionString; +556 } +557 +558 /** +559 * The user name for connecting to the database. +560 */ +561 private String databaseUser; +562 +563 /** +564 * Get the value of databaseUser. +565 * +566 * @return the value of databaseUser +567 */ +568 public String getDatabaseUser() { +569 return databaseUser; +570 } +571 +572 /** +573 * Set the value of databaseUser. +574 * +575 * @param databaseUser new value of databaseUser +576 */ +577 public void setDatabaseUser(String databaseUser) { +578 this.databaseUser = databaseUser; +579 } +580 +581 /** +582 * The password to use when connecting to the database. +583 */ +584 private String databasePassword; +585 +586 /** +587 * Get the value of databasePassword. +588 * +589 * @return the value of databasePassword +590 */ +591 public String getDatabasePassword() { +592 return databasePassword; +593 } +594 +595 /** +596 * Set the value of databasePassword. +597 * +598 * @param databasePassword new value of databasePassword +599 */ +600 public void setDatabasePassword(String databasePassword) { +601 this.databasePassword = databasePassword; +602 } +603 +604 /** +605 * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat +606 * like ZIP files. +607 */ +608 private String zipExtensions; +609 +610 /** +611 * Get the value of zipExtensions. +612 * +613 * @return the value of zipExtensions +614 */ +615 public String getZipExtensions() { +616 return zipExtensions; +617 } +618 +619 /** +620 * Set the value of zipExtensions. +621 * +622 * @param zipExtensions new value of zipExtensions +623 */ +624 public void setZipExtensions(String zipExtensions) { +625 this.zipExtensions = zipExtensions; +626 } +627 +628 /** +629 * The url for the modified NVD CVE (1.2 schema). +630 */ +631 private String cveUrl12Modified; +632 +633 /** +634 * Get the value of cveUrl12Modified. +635 * +636 * @return the value of cveUrl12Modified +637 */ +638 public String getCveUrl12Modified() { +639 return cveUrl12Modified; +640 } +641 +642 /** +643 * Set the value of cveUrl12Modified. +644 * +645 * @param cveUrl12Modified new value of cveUrl12Modified +646 */ +647 public void setCveUrl12Modified(String cveUrl12Modified) { +648 this.cveUrl12Modified = cveUrl12Modified; +649 } +650 +651 /** +652 * The url for the modified NVD CVE (2.0 schema). +653 */ +654 private String cveUrl20Modified; +655 +656 /** +657 * Get the value of cveUrl20Modified. +658 * +659 * @return the value of cveUrl20Modified +660 */ +661 public String getCveUrl20Modified() { +662 return cveUrl20Modified; +663 } +664 +665 /** +666 * Set the value of cveUrl20Modified. +667 * +668 * @param cveUrl20Modified new value of cveUrl20Modified +669 */ +670 public void setCveUrl20Modified(String cveUrl20Modified) { +671 this.cveUrl20Modified = cveUrl20Modified; +672 } +673 +674 /** +675 * Base Data Mirror URL for CVE 1.2. +676 */ +677 private String cveUrl12Base; +678 +679 /** +680 * Get the value of cveUrl12Base. +681 * +682 * @return the value of cveUrl12Base +683 */ +684 public String getCveUrl12Base() { +685 return cveUrl12Base; +686 } +687 +688 /** +689 * Set the value of cveUrl12Base. +690 * +691 * @param cveUrl12Base new value of cveUrl12Base +692 */ +693 public void setCveUrl12Base(String cveUrl12Base) { +694 this.cveUrl12Base = cveUrl12Base; +695 } +696 +697 /** +698 * Data Mirror URL for CVE 2.0. +699 */ +700 private String cveUrl20Base; +701 +702 /** +703 * Get the value of cveUrl20Base. +704 * +705 * @return the value of cveUrl20Base +706 */ +707 public String getCveUrl20Base() { +708 return cveUrl20Base; +709 } +710 +711 /** +712 * Set the value of cveUrl20Base. +713 * +714 * @param cveUrl20Base new value of cveUrl20Base +715 */ +716 public void setCveUrl20Base(String cveUrl20Base) { +717 this.cveUrl20Base = cveUrl20Base; +718 } +719 +720 /** +721 * The path to Mono for .NET assembly analysis on non-windows systems. +722 */ +723 private String pathToMono; +724 +725 /** +726 * Get the value of pathToMono. +727 * +728 * @return the value of pathToMono +729 */ +730 public String getPathToMono() { +731 return pathToMono; +732 } +733 +734 /** +735 * Set the value of pathToMono. +736 * +737 * @param pathToMono new value of pathToMono +738 */ +739 public void setPathToMono(String pathToMono) { +740 this.pathToMono = pathToMono; +741 } +742 +743 /** +744 * Executes the Dependency-Check on the dependent libraries. +745 * +746 * @return the Engine used to scan the dependencies. +747 * @throws org.owasp.dependencycheck.data.nvdcve.DatabaseException thrown if there is an exception connecting to the +748 * database +749 */ +750 private Engine executeDependencyCheck() throws DatabaseException { +751 populateSettings(); +752 Engine engine = null; +753 engine = new Engine(); +754 engine.setDependencies(this.dependencies); +755 engine.analyzeDependencies(); +756 return engine; +757 } +758 +759 /** +760 * Generates the reports for a given dependency-check engine. +761 * +762 * @param engine a dependency-check engine +763 * @param outDirectory the directory to write the reports to +764 */ +765 private void generateExternalReports(Engine engine, File outDirectory) { +766 DatabaseProperties prop = null; +767 CveDB cve = null; +768 try { +769 cve = new CveDB(); +770 cve.open(); +771 prop = cve.getDatabaseProperties(); +772 } catch (DatabaseException ex) { +773 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex); +774 } finally { +775 if (cve != null) { +776 cve.close(); +777 } +778 } +779 final ReportGenerator r = new ReportGenerator(this.applicationName, engine.getDependencies(), engine.getAnalyzers(), prop); +780 try { +781 r.generateReports(outDirectory.getCanonicalPath(), this.reportFormat.name()); +782 } catch (IOException ex) { +783 LOGGER.log(Level.SEVERE, +784 "Unexpected exception occurred during analysis; please see the verbose error log for more details."); +785 LOGGER.log(Level.FINE, null, ex); +786 } catch (Throwable ex) { +787 LOGGER.log(Level.SEVERE, 788 "Unexpected exception occurred during analysis; please see the verbose error log for more details."); -789 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.FINE, null, ex); -790 } catch (Throwable ex) { -791 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.SEVERE, -792 "Unexpected exception occurred during analysis; please see the verbose error log for more details."); -793 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.FINE, null, ex); -794 } -795 } -796 -797 /** -798 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system -799 * properties required to change the proxy url, port, and connection timeout. -800 */ -801 private void populateSettings() { -802 if (dataDirectory != null) { -803 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -804 } else { -805 final File jarPath = new File(DependencyCheckScanAgent.class.getProtectionDomain().getCodeSource().getLocation().getPath()); -806 final File base = jarPath.getParentFile(); -807 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); -808 final File dataDir = new File(base, sub); -809 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -810 } -811 -812 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -813 -814 if (proxyUrl != null && !proxyUrl.isEmpty()) { -815 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +789 LOGGER.log(Level.FINE, null, ex); +790 } +791 } +792 +793 /** +794 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system +795 * properties required to change the proxy url, port, and connection timeout. +796 */ +797 private void populateSettings() { +798 Settings.initialize(); +799 if (dataDirectory != null) { +800 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +801 } else { +802 final File jarPath = new File(DependencyCheckScanAgent.class.getProtectionDomain().getCodeSource().getLocation().getPath()); +803 final File base = jarPath.getParentFile(); +804 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); +805 final File dataDir = new File(base, sub); +806 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +807 } +808 +809 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +810 +811 if (proxyUrl != null && !proxyUrl.isEmpty()) { +812 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +813 } +814 if (proxyPort != null && !proxyPort.isEmpty()) { +815 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); 816 } -817 if (proxyPort != null && !proxyPort.isEmpty()) { -818 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +817 if (proxyUsername != null && !proxyUsername.isEmpty()) { +818 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); 819 } -820 if (proxyUsername != null && !proxyUsername.isEmpty()) { -821 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); +820 if (proxyPassword != null && !proxyPassword.isEmpty()) { +821 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); 822 } -823 if (proxyPassword != null && !proxyPassword.isEmpty()) { -824 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); +823 if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +824 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); 825 } -826 if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -827 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +826 if (suppressionFile != null && !suppressionFile.isEmpty()) { +827 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); 828 } -829 if (suppressionFile != null && !suppressionFile.isEmpty()) { -830 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -831 } -832 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); -833 if (nexusUrl != null && !nexusUrl.isEmpty()) { -834 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); -835 } -836 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); -837 if (databaseDriverName != null && !databaseDriverName.isEmpty()) { -838 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +829 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); +830 if (nexusUrl != null && !nexusUrl.isEmpty()) { +831 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +832 } +833 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); +834 if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +835 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +836 } +837 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +838 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); 839 } -840 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { -841 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +840 if (connectionString != null && !connectionString.isEmpty()) { +841 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); 842 } -843 if (connectionString != null && !connectionString.isEmpty()) { -844 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +843 if (databaseUser != null && !databaseUser.isEmpty()) { +844 Settings.setString(Settings.KEYS.DB_USER, databaseUser); 845 } -846 if (databaseUser != null && !databaseUser.isEmpty()) { -847 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +846 if (databasePassword != null && !databasePassword.isEmpty()) { +847 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); 848 } -849 if (databasePassword != null && !databasePassword.isEmpty()) { -850 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +849 if (zipExtensions != null && !zipExtensions.isEmpty()) { +850 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); 851 } -852 if (zipExtensions != null && !zipExtensions.isEmpty()) { -853 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); +852 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { +853 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); 854 } -855 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { -856 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); +855 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { +856 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); 857 } -858 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { -859 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); +858 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { +859 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); 860 } -861 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { -862 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); +861 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { +862 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); 863 } -864 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { -865 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); +864 if (pathToMono != null && !pathToMono.isEmpty()) { +865 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); 866 } -867 if (pathToMono != null && !pathToMono.isEmpty()) { -868 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); -869 } -870 } -871 -872 /** -873 * Executes the dependency-check and generates the report. -874 * -875 * @throws org.owasp.dependencycheck.exception.ScanAgentException thrown if there is an exception executing the -876 * scan. -877 */ -878 public void execute() throws ScanAgentException { -879 Engine engine = null; -880 try { -881 engine = executeDependencyCheck(); -882 generateExternalReports(engine, new File(this.reportOutputDirectory)); -883 if (this.showSummary) { -884 showSummary(engine.getDependencies()); +867 } +868 +869 /** +870 * Executes the dependency-check and generates the report. +871 * +872 * @throws org.owasp.dependencycheck.exception.ScanAgentException thrown if there is an exception executing the +873 * scan. +874 */ +875 public void execute() throws ScanAgentException { +876 Engine engine = null; +877 try { +878 engine = executeDependencyCheck(); +879 generateExternalReports(engine, new File(this.reportOutputDirectory)); +880 if (this.showSummary) { +881 showSummary(engine.getDependencies()); +882 } +883 if (this.failBuildOnCVSS <= 10) { +884 checkForFailure(engine.getDependencies()); 885 } -886 if (this.failBuildOnCVSS <= 10) { -887 checkForFailure(engine.getDependencies()); -888 } -889 } catch (DatabaseException ex) { -890 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.SEVERE, -891 "Unable to connect to the dependency-check database; analysis has stopped"); -892 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.FINE, "", ex); -893 } finally { -894 if (engine != null) { -895 engine.cleanup(); -896 } -897 } -898 } -899 -900 /** -901 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the -902 * configuration. -903 * -904 * @param dependencies the list of dependency objects -905 * @throws org.owasp.dependencycheck.exception.ScanAgentException thrown if there is an exception executing the -906 * scan. -907 */ -908 private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException { -909 final StringBuilder ids = new StringBuilder(); -910 for (Dependency d : dependencies) { -911 boolean addName = true; -912 for (Vulnerability v : d.getVulnerabilities()) { -913 if (v.getCvssScore() >= failBuildOnCVSS) { -914 if (addName) { -915 addName = false; -916 ids.append(NEW_LINE).append(d.getFileName()).append(": "); -917 ids.append(v.getName()); -918 } else { -919 ids.append(", ").append(v.getName()); -920 } -921 } -922 } -923 } -924 if (ids.length() > 0) { -925 final String msg = String.format("%n%nDependency-Check Failure:%n" -926 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" -927 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); -928 -929 throw new ScanAgentException(msg); -930 } -931 } -932 -933 /** -934 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. -935 * -936 * @param dependencies a list of dependency objects -937 */ -938 private void showSummary(List<Dependency> dependencies) { -939 final StringBuilder summary = new StringBuilder(); -940 for (Dependency d : dependencies) { -941 boolean firstEntry = true; -942 final StringBuilder ids = new StringBuilder(); -943 for (Vulnerability v : d.getVulnerabilities()) { -944 if (firstEntry) { -945 firstEntry = false; -946 } else { -947 ids.append(", "); -948 } -949 ids.append(v.getName()); -950 } -951 if (ids.length() > 0) { -952 summary.append(d.getFileName()).append(" ("); -953 firstEntry = true; -954 for (Identifier id : d.getIdentifiers()) { -955 if (firstEntry) { -956 firstEntry = false; -957 } else { -958 summary.append(", "); -959 } -960 summary.append(id.getValue()); -961 } -962 summary.append(") : ").append(ids).append(NEW_LINE); -963 } -964 } -965 if (summary.length() > 0) { -966 final String msg = String.format("%n%n" -967 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" -968 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); -969 Logger.getLogger(DependencyCheckScanAgent.class.getName()).log(Level.WARNING, msg); -970 } -971 } -972 -973 } +886 } catch (DatabaseException ex) { +887 LOGGER.log(Level.SEVERE, +888 "Unable to connect to the dependency-check database; analysis has stopped"); +889 LOGGER.log(Level.FINE, "", ex); +890 } finally { +891 Settings.cleanup(); +892 if (engine != null) { +893 engine.cleanup(); +894 } +895 } +896 } +897 +898 /** +899 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the +900 * configuration. +901 * +902 * @param dependencies the list of dependency objects +903 * @throws org.owasp.dependencycheck.exception.ScanAgentException thrown if there is an exception executing the +904 * scan. +905 */ +906 private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException { +907 final StringBuilder ids = new StringBuilder(); +908 for (Dependency d : dependencies) { +909 boolean addName = true; +910 for (Vulnerability v : d.getVulnerabilities()) { +911 if (v.getCvssScore() >= failBuildOnCVSS) { +912 if (addName) { +913 addName = false; +914 ids.append(NEW_LINE).append(d.getFileName()).append(": "); +915 ids.append(v.getName()); +916 } else { +917 ids.append(", ").append(v.getName()); +918 } +919 } +920 } +921 } +922 if (ids.length() > 0) { +923 final String msg = String.format("%n%nDependency-Check Failure:%n" +924 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" +925 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); +926 +927 throw new ScanAgentException(msg); +928 } +929 } +930 +931 /** +932 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. +933 * +934 * @param dependencies a list of dependency objects +935 */ +936 private void showSummary(List<Dependency> dependencies) { +937 final StringBuilder summary = new StringBuilder(); +938 for (Dependency d : dependencies) { +939 boolean firstEntry = true; +940 final StringBuilder ids = new StringBuilder(); +941 for (Vulnerability v : d.getVulnerabilities()) { +942 if (firstEntry) { +943 firstEntry = false; +944 } else { +945 ids.append(", "); +946 } +947 ids.append(v.getName()); +948 } +949 if (ids.length() > 0) { +950 summary.append(d.getFileName()).append(" ("); +951 firstEntry = true; +952 for (Identifier id : d.getIdentifiers()) { +953 if (firstEntry) { +954 firstEntry = false; +955 } else { +956 summary.append(", "); +957 } +958 summary.append(id.getValue()); +959 } +960 summary.append(") : ").append(ids).append(NEW_LINE); +961 } +962 } +963 if (summary.length() > 0) { +964 final String msg = String.format("%n%n" +965 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" +966 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); +967 LOGGER.log(Level.WARNING, msg); +968 } +969 } +970 +971 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html index fcdea48f6..e4cadd8e1 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.agent + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.agent diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html index 413ad0f46..a2b187df5 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.agent + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.agent diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html index 73e73a994..ac45a6f75 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractFileTypeAnalyzer.html @@ -53,7 +53,7 @@ 45 try { 46 enabled = Settings.getBoolean(key, true); 47 } catch (InvalidSettingException ex) { -48 String msg = String.format("Invalid settting for property '%s'", key); +48 String msg = String.format("Invalid setting for property '%s'", key); 49 LOGGER.log(Level.WARNING, msg); 50 LOGGER.log(Level.FINE, "", ex); 51 msg = String.format("%s has been disabled", getName()); @@ -62,7 +62,7 @@ 54 } 55 //</editor-fold> 56 -57 //<editor-fold defaultstate="collapsed" desc="Field defentitions"> +57 //<editor-fold defaultstate="collapsed" desc="Field definitions"> 58 /** 59 * The logger. 60 */ @@ -202,7 +202,7 @@ 194 if (ext == null) { 195 final String msg = String.format("The '%s' analyzer is misconfigured and does not have any file extensions;" 196 + " it will be disabled", getName()); -197 Logger.getLogger(AbstractFileTypeAnalyzer.class.getName()).log(Level.SEVERE, msg); +197 LOGGER.log(Level.SEVERE, msg); 198 return false; 199 } else { 200 final boolean match = ext.contains(extension); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html index c8ecbbce0..8699e0d33 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html @@ -27,134 +27,157 @@ 19 20 import java.io.File; 21 import java.io.IOException; -22 import java.net.MalformedURLException; -23 import java.net.URL; -24 import java.util.List; -25 import java.util.Set; -26 import java.util.logging.Level; -27 import java.util.logging.Logger; -28 import java.util.regex.Pattern; -29 import org.owasp.dependencycheck.suppression.SuppressionParseException; -30 import org.owasp.dependencycheck.suppression.SuppressionParser; -31 import org.owasp.dependencycheck.suppression.SuppressionRule; -32 import org.owasp.dependencycheck.utils.DownloadFailedException; -33 import org.owasp.dependencycheck.utils.Downloader; -34 import org.owasp.dependencycheck.utils.FileUtils; -35 import org.owasp.dependencycheck.utils.Settings; -36 -37 /** -38 * Abstract base suppression analyzer that contains methods for parsing the suppression xml file. -39 * -40 * @author Jeremy Long <jeremy.long@owasp.org> -41 */ -42 public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { -43 -44 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +22 import java.io.InputStream; +23 import java.net.MalformedURLException; +24 import java.net.URL; +25 import java.util.List; +26 import java.util.Set; +27 import java.util.logging.Level; +28 import java.util.logging.Logger; +29 import java.util.regex.Pattern; +30 import org.owasp.dependencycheck.suppression.SuppressionParseException; +31 import org.owasp.dependencycheck.suppression.SuppressionParser; +32 import org.owasp.dependencycheck.suppression.SuppressionRule; +33 import org.owasp.dependencycheck.utils.DownloadFailedException; +34 import org.owasp.dependencycheck.utils.Downloader; +35 import org.owasp.dependencycheck.utils.FileUtils; +36 import org.owasp.dependencycheck.utils.Settings; +37 +38 /** +39 * Abstract base suppression analyzer that contains methods for parsing the suppression xml file. +40 * +41 * @author Jeremy Long <jeremy.long@owasp.org> +42 */ +43 public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { +44 45 /** -46 * Returns a list of file EXTENSIONS supported by this analyzer. -47 * -48 * @return a list of file EXTENSIONS supported by this analyzer. -49 */ -50 public Set<String> getSupportedExtensions() { -51 return null; -52 } -53 -54 //</editor-fold> -55 /** -56 * The initialize method loads the suppression XML file. -57 * -58 * @throws Exception thrown if there is an exception -59 */ -60 @Override -61 public void initialize() throws Exception { -62 super.initialize(); -63 loadSuppressionData(); -64 } -65 /** -66 * The list of suppression rules -67 */ -68 private List<SuppressionRule> rules; -69 -70 /** -71 * Get the value of rules. -72 * -73 * @return the value of rules +46 * The Logger for use throughout the class +47 */ +48 private static final Logger LOGGER = Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()); +49 +50 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +51 /** +52 * Returns a list of file EXTENSIONS supported by this analyzer. +53 * +54 * @return a list of file EXTENSIONS supported by this analyzer. +55 */ +56 public Set<String> getSupportedExtensions() { +57 return null; +58 } +59 +60 //</editor-fold> +61 /** +62 * The initialize method loads the suppression XML file. +63 * +64 * @throws Exception thrown if there is an exception +65 */ +66 @Override +67 public void initialize() throws Exception { +68 super.initialize(); +69 loadSuppressionData(); +70 } +71 +72 /** +73 * The list of suppression rules 74 */ -75 public List<SuppressionRule> getRules() { -76 return rules; -77 } -78 -79 /** -80 * Set the value of rules. -81 * -82 * @param rules new value of rules -83 */ -84 public void setRules(List<SuppressionRule> rules) { -85 this.rules = rules; -86 } -87 -88 /** -89 * Loads the suppression rules file. -90 * -91 * @throws SuppressionParseException thrown if the XML cannot be parsed. -92 */ -93 private void loadSuppressionData() throws SuppressionParseException { -94 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE); -95 if (suppressionFilePath == null) { -96 return; -97 } -98 File file = null; -99 boolean deleteTempFile = false; -100 try { -101 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*", Pattern.CASE_INSENSITIVE); -102 if (uriRx.matcher(suppressionFilePath).matches()) { -103 deleteTempFile = true; -104 file = FileUtils.getTempFile("suppression", "xml"); -105 final URL url = new URL(suppressionFilePath); -106 try { -107 Downloader.fetchFile(url, file, false); -108 } catch (DownloadFailedException ex) { -109 Downloader.fetchFile(url, file, true); -110 } -111 } else { -112 file = new File(suppressionFilePath); -113 } -114 -115 if (file != null) { -116 final SuppressionParser parser = new SuppressionParser(); -117 try { -118 rules = parser.parseSuppressionRules(file); -119 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, rules.size() + " suppression rules were loaded."); -120 } catch (SuppressionParseException ex) { -121 final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath()); -122 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, msg); -123 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, ex.getMessage()); -124 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, "", ex); -125 throw ex; -126 } -127 } -128 } catch (DownloadFailedException ex) { -129 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, -130 "Unable to fetch the configured suppression file"); -131 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, "", ex); -132 throw new SuppressionParseException("Unable to fetch the configured suppression file", ex); -133 } catch (MalformedURLException ex) { -134 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, -135 "Configured suppression file has an invalid URL"); -136 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, "", ex); -137 throw new SuppressionParseException("Configured suppression file has an invalid URL", ex); -138 } catch (IOException ex) { -139 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, -140 "Unable to create temp file for suppressions"); -141 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, "", ex); -142 throw new SuppressionParseException("Unable to create temp file for suppressions", ex); -143 } finally { -144 if (deleteTempFile && file != null) { -145 FileUtils.delete(file); +75 private List<SuppressionRule> rules; +76 +77 /** +78 * Get the value of rules. +79 * +80 * @return the value of rules +81 */ +82 public List<SuppressionRule> getRules() { +83 return rules; +84 } +85 +86 /** +87 * Set the value of rules. +88 * +89 * @param rules new value of rules +90 */ +91 public void setRules(List<SuppressionRule> rules) { +92 this.rules = rules; +93 } +94 +95 /** +96 * Loads the suppression rules file. +97 * +98 * @throws SuppressionParseException thrown if the XML cannot be parsed. +99 */ +100 private void loadSuppressionData() throws SuppressionParseException { +101 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE); +102 if (suppressionFilePath == null) { +103 return; +104 } +105 File file = null; +106 boolean deleteTempFile = false; +107 try { +108 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*", Pattern.CASE_INSENSITIVE); +109 if (uriRx.matcher(suppressionFilePath).matches()) { +110 deleteTempFile = true; +111 file = FileUtils.getTempFile("suppression", "xml"); +112 final URL url = new URL(suppressionFilePath); +113 try { +114 Downloader.fetchFile(url, file, false); +115 } catch (DownloadFailedException ex) { +116 Downloader.fetchFile(url, file, true); +117 } +118 } else { +119 file = new File(suppressionFilePath); +120 if (!file.exists()) { +121 final InputStream suppressionsFromClasspath = this.getClass().getClassLoader().getResourceAsStream(suppressionFilePath); +122 if (suppressionsFromClasspath != null) { +123 deleteTempFile = true; +124 file = FileUtils.getTempFile("suppression", "xml"); +125 try { +126 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file); +127 } catch (IOException ex) { +128 throwSuppressionParseException("Unable to locate suppressions file in classpath", ex); +129 } +130 } +131 } +132 } +133 +134 if (file != null) { +135 final SuppressionParser parser = new SuppressionParser(); +136 try { +137 rules = parser.parseSuppressionRules(file); +138 LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded."); +139 } catch (SuppressionParseException ex) { +140 final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath()); +141 LOGGER.log(Level.WARNING, msg); +142 LOGGER.log(Level.WARNING, ex.getMessage()); +143 LOGGER.log(Level.FINE, "", ex); +144 throw ex; +145 } 146 } -147 } -148 } -149 } +147 } catch (DownloadFailedException ex) { +148 throwSuppressionParseException("Unable to fetch the configured suppression file", ex); +149 } catch (MalformedURLException ex) { +150 throwSuppressionParseException("Configured suppression file has an invalid URL", ex); +151 } catch (IOException ex) { +152 throwSuppressionParseException("Unable to create temp file for suppressions", ex); +153 } finally { +154 if (deleteTempFile && file != null) { +155 FileUtils.delete(file); +156 } +157 } +158 } +159 +160 /** +161 * Utility method to throw parse exceptions. +162 * +163 * @param message the exception message +164 * @param exception the cause of the exception +165 * @throws SuppressionParseException throws the generated SuppressionParseException +166 */ +167 private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException { +168 LOGGER.log(Level.WARNING, message); +169 LOGGER.log(Level.FINE, "", exception); +170 throw new SuppressionParseException(message, exception); +171 } +172 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html index 43a4823aa..95bdf8913 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html @@ -29,48 +29,36 @@ 21 import java.util.ServiceLoader; 22 23 /** -24 * -25 * @author Jeremy Long <jeremy.long@owasp.org> -26 */ -27 public final class AnalyzerService { -28 -29 /** -30 * The analyzer service singleton. -31 */ -32 private static AnalyzerService service; -33 /** -34 * The service loader for analyzers. -35 */ -36 private final ServiceLoader<Analyzer> loader; -37 -38 /** -39 * Creates a new instance of AnalyzerService. +24 * The Analyzer Service Loader. This class loads all services that implement +25 * org.owasp.dependencycheck.analyzer.Analyzer. +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29 public class AnalyzerService { +30 +31 /** +32 * The service loader for analyzers. +33 */ +34 private final ServiceLoader<Analyzer> loader; +35 +36 /** +37 * Creates a new instance of AnalyzerService. +38 * +39 * @param classLoader the ClassLoader to use when dynamically loading Analyzer and Update services 40 */ -41 private AnalyzerService() { -42 loader = ServiceLoader.load(Analyzer.class); +41 public AnalyzerService(ClassLoader classLoader) { +42 loader = ServiceLoader.load(Analyzer.class, classLoader); 43 } 44 45 /** -46 * Retrieve the singleton instance of AnalyzerService. +46 * Returns an Iterator for all instances of the Analyzer interface. 47 * -48 * @return a singleton AnalyzerService. +48 * @return an iterator of Analyzers. 49 */ -50 public static synchronized AnalyzerService getInstance() { -51 if (service == null) { -52 service = new AnalyzerService(); -53 } -54 return service; -55 } -56 -57 /** -58 * Returns an Iterator for all instances of the Analyzer interface. -59 * -60 * @return an iterator of Analyzers. -61 */ -62 public Iterator<Analyzer> getAnalyzers() { -63 return loader.iterator(); -64 } -65 } +50 public Iterator<Analyzer> getAnalyzers() { +51 return loader.iterator(); +52 } +53 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html index 7c873eb15..f36d4050e 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html @@ -100,7 +100,7 @@ 92 /** 93 * The set of things we can handle with Zip methods 94 */ -95 private static final Set<String> ZIPPABLES = newHashSet("zip", "ear", "war", "nupkg"); +95 private static final Set<String> ZIPPABLES = newHashSet("zip", "ear", "war", "jar", "sar", "apk", "nupkg"); 96 /** 97 * The set of file extensions supported by this analyzer. Note for developers, any additions to this list will need 98 * to be explicitly handled in extractFiles(). @@ -165,270 +165,261 @@ 157 @Override 158 public void initializeFileTypeAnalyzer() throws Exception { 159 final File baseDir = Settings.getTempDirectory(); -160 if (!baseDir.exists()) { -161 if (!baseDir.mkdirs()) { -162 final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath()); -163 throw new AnalysisException(msg); -164 } -165 } -166 tempFileLocation = File.createTempFile("check", "tmp", baseDir); -167 if (!tempFileLocation.delete()) { -168 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); -169 throw new AnalysisException(msg); -170 } -171 if (!tempFileLocation.mkdirs()) { -172 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); -173 throw new AnalysisException(msg); -174 } -175 } -176 -177 /** -178 * The close method deletes any temporary files and directories created during analysis. -179 * -180 * @throws Exception thrown if there is an exception deleting temporary files -181 */ -182 @Override -183 public void close() throws Exception { -184 if (tempFileLocation != null && tempFileLocation.exists()) { -185 LOGGER.log(Level.FINE, "Attempting to delete temporary files"); -186 final boolean success = FileUtils.delete(tempFileLocation); -187 if (!success) { -188 LOGGER.log(Level.WARNING, "Failed to delete some temporary files, see the log for more details"); -189 } -190 } -191 } -192 -193 /** -194 * Analyzes a given dependency. If the dependency is an archive, such as a WAR or EAR, the contents are extracted, -195 * scanned, and added to the list of dependencies within the engine. -196 * -197 * @param dependency the dependency to analyze -198 * @param engine the engine scanning -199 * @throws AnalysisException thrown if there is an analysis exception -200 */ -201 @Override -202 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException { -203 final File f = new File(dependency.getActualFilePath()); -204 final File tmpDir = getNextTempDirectory(); -205 extractFiles(f, tmpDir, engine); -206 -207 //make a copy -208 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies()); -209 engine.scan(tmpDir); -210 final List<Dependency> newDependencies = engine.getDependencies(); -211 if (dependencies.size() != newDependencies.size()) { -212 //get the new dependencies -213 final Set<Dependency> dependencySet = new HashSet<Dependency>(); -214 dependencySet.addAll(newDependencies); -215 dependencySet.removeAll(dependencies); -216 -217 for (Dependency d : dependencySet) { -218 //fix the dependency's display name and path -219 final String displayPath = String.format("%s%s", -220 dependency.getFilePath(), -221 d.getActualFilePath().substring(tmpDir.getAbsolutePath().length())); -222 final String displayName = String.format("%s%s%s", -223 dependency.getFileName(), -224 File.separator, -225 d.getFileName()); -226 d.setFilePath(displayPath); -227 d.setFileName(displayName); -228 -229 //TODO - can we get more evidence from the parent? EAR contains module name, etc. -230 //analyze the dependency (i.e. extract files) if it is a supported type. -231 if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) { -232 scanDepth += 1; -233 analyze(d, engine); -234 scanDepth -= 1; -235 } -236 } -237 } -238 Collections.sort(engine.getDependencies()); -239 } -240 -241 /** -242 * Retrieves the next temporary directory to extract an archive too. -243 * -244 * @return a directory -245 * @throws AnalysisException thrown if unable to create temporary directory -246 */ -247 private File getNextTempDirectory() throws AnalysisException { -248 dirCount += 1; -249 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); -250 //getting an exception for some directories not being able to be created; might be because the directory already exists? -251 if (directory.exists()) { -252 return getNextTempDirectory(); -253 } -254 if (!directory.mkdirs()) { -255 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); -256 throw new AnalysisException(msg); -257 } -258 return directory; -259 } -260 -261 /** -262 * Extracts the contents of an archive into the specified directory. -263 * -264 * @param archive an archive file such as a WAR or EAR -265 * @param destination a directory to extract the contents to -266 * @param engine the scanning engine -267 * @throws AnalysisException thrown if the archive is not found -268 */ -269 private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException { -270 if (archive == null || destination == null) { -271 return; -272 } -273 -274 FileInputStream fis = null; -275 try { -276 fis = new FileInputStream(archive); -277 } catch (FileNotFoundException ex) { -278 LOGGER.log(Level.FINE, null, ex); -279 throw new AnalysisException("Archive file was not found.", ex); -280 } -281 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase(); -282 try { -283 if (ZIPPABLES.contains(archiveExt)) { -284 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine); -285 } else if ("tar".equals(archiveExt)) { -286 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine); -287 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) { -288 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName()); -289 final String uncompressedExt = FileUtils.getFileExtension(uncompressedName).toLowerCase(); -290 if (engine.supportsExtension(uncompressedExt)) { -291 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName)); -292 } -293 } -294 } catch (ArchiveExtractionException ex) { -295 final String msg = String.format("Exception extracting archive '%s'.", archive.getName()); -296 LOGGER.log(Level.WARNING, msg); -297 LOGGER.log(Level.FINE, null, ex); -298 } catch (IOException ex) { -299 final String msg = String.format("Exception reading archive '%s'.", archive.getName()); -300 LOGGER.log(Level.WARNING, msg); -301 LOGGER.log(Level.FINE, null, ex); -302 } finally { -303 try { -304 fis.close(); -305 } catch (IOException ex) { -306 LOGGER.log(Level.FINEST, null, ex); -307 } -308 } -309 } -310 -311 /** -312 * Extracts files from an archive. -313 * -314 * @param input the archive to extract files from -315 * @param destination the location to write the files too -316 * @param engine the dependency-check engine -317 * @throws ArchiveExtractionException thrown if there is an exception extracting files from the archive -318 */ -319 private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException { -320 ArchiveEntry entry; -321 try { -322 while ((entry = input.getNextEntry()) != null) { -323 if (entry.isDirectory()) { -324 final File d = new File(destination, entry.getName()); -325 if (!d.exists()) { -326 if (!d.mkdirs()) { -327 final String msg = String.format("Unable to create directory '%s'.", d.getAbsolutePath()); -328 throw new AnalysisException(msg); -329 } -330 } -331 } else { -332 final File file = new File(destination, entry.getName()); -333 final String ext = FileUtils.getFileExtension(file.getName()); -334 if (engine.supportsExtension(ext)) { -335 BufferedOutputStream bos = null; -336 FileOutputStream fos; -337 try { -338 final File parent = file.getParentFile(); -339 if (!parent.isDirectory()) { -340 if (!parent.mkdirs()) { -341 final String msg = String.format("Unable to build directory '%s'.", parent.getAbsolutePath()); -342 throw new AnalysisException(msg); -343 } -344 } -345 fos = new FileOutputStream(file); -346 bos = new BufferedOutputStream(fos, BUFFER_SIZE); -347 int count; -348 final byte data[] = new byte[BUFFER_SIZE]; -349 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) { -350 bos.write(data, 0, count); -351 } -352 bos.flush(); -353 } catch (FileNotFoundException ex) { -354 Logger.getLogger(ArchiveAnalyzer.class -355 .getName()).log(Level.FINE, null, ex); -356 final String msg = String.format("Unable to find file '%s'.", file.getName()); -357 throw new AnalysisException(msg, ex); -358 } catch (IOException ex) { -359 Logger.getLogger(ArchiveAnalyzer.class -360 .getName()).log(Level.FINE, null, ex); -361 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); -362 throw new AnalysisException(msg, ex); -363 } finally { -364 if (bos != null) { -365 try { -366 bos.close(); -367 } catch (IOException ex) { -368 Logger.getLogger(ArchiveAnalyzer.class -369 .getName()).log(Level.FINEST, null, ex); -370 } -371 } -372 } -373 } -374 } -375 } -376 } catch (IOException ex) { -377 throw new ArchiveExtractionException(ex); -378 } catch (Throwable ex) { -379 throw new ArchiveExtractionException(ex); -380 } finally { -381 if (input != null) { -382 try { -383 input.close(); -384 } catch (IOException ex) { -385 LOGGER.log(Level.FINEST, null, ex); -386 } -387 } -388 } -389 } -390 -391 /** -392 * Decompresses a file. -393 * -394 * @param inputStream the compressed file -395 * @param outputFile the location to write the decompressed file -396 * @throws ArchiveExtractionException thrown if there is an exception decompressing the file -397 */ -398 private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException { -399 FileOutputStream out = null; -400 try { -401 out = new FileOutputStream(outputFile); -402 final byte[] buffer = new byte[BUFFER_SIZE]; -403 int n = 0; -404 while (-1 != (n = inputStream.read(buffer))) { -405 out.write(buffer, 0, n); -406 } -407 } catch (FileNotFoundException ex) { -408 LOGGER.log(Level.FINE, null, ex); -409 throw new ArchiveExtractionException(ex); -410 } catch (IOException ex) { -411 LOGGER.log(Level.FINE, null, ex); -412 throw new ArchiveExtractionException(ex); -413 } finally { -414 if (out != null) { -415 try { -416 out.close(); -417 } catch (IOException ex) { -418 LOGGER.log(Level.FINEST, null, ex); -419 } -420 } -421 } -422 } -423 } +160 tempFileLocation = File.createTempFile("check", "tmp", baseDir); +161 if (!tempFileLocation.delete()) { +162 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); +163 throw new AnalysisException(msg); +164 } +165 if (!tempFileLocation.mkdirs()) { +166 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); +167 throw new AnalysisException(msg); +168 } +169 } +170 +171 /** +172 * The close method deletes any temporary files and directories created during analysis. +173 * +174 * @throws Exception thrown if there is an exception deleting temporary files +175 */ +176 @Override +177 public void close() throws Exception { +178 if (tempFileLocation != null && tempFileLocation.exists()) { +179 LOGGER.log(Level.FINE, "Attempting to delete temporary files"); +180 final boolean success = FileUtils.delete(tempFileLocation); +181 if (!success) { +182 LOGGER.log(Level.WARNING, "Failed to delete some temporary files, see the log for more details"); +183 } +184 } +185 } +186 +187 /** +188 * Analyzes a given dependency. If the dependency is an archive, such as a WAR or EAR, the contents are extracted, +189 * scanned, and added to the list of dependencies within the engine. +190 * +191 * @param dependency the dependency to analyze +192 * @param engine the engine scanning +193 * @throws AnalysisException thrown if there is an analysis exception +194 */ +195 @Override +196 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException { +197 final File f = new File(dependency.getActualFilePath()); +198 final File tmpDir = getNextTempDirectory(); +199 extractFiles(f, tmpDir, engine); +200 +201 //make a copy +202 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies()); +203 engine.scan(tmpDir); +204 final List<Dependency> newDependencies = engine.getDependencies(); +205 if (dependencies.size() != newDependencies.size()) { +206 //get the new dependencies +207 final Set<Dependency> dependencySet = new HashSet<Dependency>(); +208 dependencySet.addAll(newDependencies); +209 dependencySet.removeAll(dependencies); +210 +211 for (Dependency d : dependencySet) { +212 //fix the dependency's display name and path +213 final String displayPath = String.format("%s%s", +214 dependency.getFilePath(), +215 d.getActualFilePath().substring(tmpDir.getAbsolutePath().length())); +216 final String displayName = String.format("%s%s%s", +217 dependency.getFileName(), +218 File.separator, +219 d.getFileName()); +220 d.setFilePath(displayPath); +221 d.setFileName(displayName); +222 +223 //TODO - can we get more evidence from the parent? EAR contains module name, etc. +224 //analyze the dependency (i.e. extract files) if it is a supported type. +225 if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) { +226 scanDepth += 1; +227 analyze(d, engine); +228 scanDepth -= 1; +229 } +230 } +231 } +232 Collections.sort(engine.getDependencies()); +233 } +234 +235 /** +236 * Retrieves the next temporary directory to extract an archive too. +237 * +238 * @return a directory +239 * @throws AnalysisException thrown if unable to create temporary directory +240 */ +241 private File getNextTempDirectory() throws AnalysisException { +242 dirCount += 1; +243 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); +244 //getting an exception for some directories not being able to be created; might be because the directory already exists? +245 if (directory.exists()) { +246 return getNextTempDirectory(); +247 } +248 if (!directory.mkdirs()) { +249 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); +250 throw new AnalysisException(msg); +251 } +252 return directory; +253 } +254 +255 /** +256 * Extracts the contents of an archive into the specified directory. +257 * +258 * @param archive an archive file such as a WAR or EAR +259 * @param destination a directory to extract the contents to +260 * @param engine the scanning engine +261 * @throws AnalysisException thrown if the archive is not found +262 */ +263 private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException { +264 if (archive == null || destination == null) { +265 return; +266 } +267 +268 FileInputStream fis = null; +269 try { +270 fis = new FileInputStream(archive); +271 } catch (FileNotFoundException ex) { +272 LOGGER.log(Level.FINE, null, ex); +273 throw new AnalysisException("Archive file was not found.", ex); +274 } +275 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase(); +276 try { +277 if (ZIPPABLES.contains(archiveExt)) { +278 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine); +279 } else if ("tar".equals(archiveExt)) { +280 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine); +281 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) { +282 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName()); +283 final String uncompressedExt = FileUtils.getFileExtension(uncompressedName).toLowerCase(); +284 if (engine.supportsExtension(uncompressedExt)) { +285 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName)); +286 } +287 } +288 } catch (ArchiveExtractionException ex) { +289 final String msg = String.format("Exception extracting archive '%s'.", archive.getName()); +290 LOGGER.log(Level.WARNING, msg); +291 LOGGER.log(Level.FINE, null, ex); +292 } catch (IOException ex) { +293 final String msg = String.format("Exception reading archive '%s'.", archive.getName()); +294 LOGGER.log(Level.WARNING, msg); +295 LOGGER.log(Level.FINE, null, ex); +296 } finally { +297 try { +298 fis.close(); +299 } catch (IOException ex) { +300 LOGGER.log(Level.FINEST, null, ex); +301 } +302 } +303 } +304 +305 /** +306 * Extracts files from an archive. +307 * +308 * @param input the archive to extract files from +309 * @param destination the location to write the files too +310 * @param engine the dependency-check engine +311 * @throws ArchiveExtractionException thrown if there is an exception extracting files from the archive +312 */ +313 private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException { +314 ArchiveEntry entry; +315 try { +316 while ((entry = input.getNextEntry()) != null) { +317 if (entry.isDirectory()) { +318 final File d = new File(destination, entry.getName()); +319 if (!d.exists()) { +320 if (!d.mkdirs()) { +321 final String msg = String.format("Unable to create directory '%s'.", d.getAbsolutePath()); +322 throw new AnalysisException(msg); +323 } +324 } +325 } else { +326 final File file = new File(destination, entry.getName()); +327 final String ext = FileUtils.getFileExtension(file.getName()); +328 if (engine.supportsExtension(ext)) { +329 BufferedOutputStream bos = null; +330 FileOutputStream fos; +331 try { +332 final File parent = file.getParentFile(); +333 if (!parent.isDirectory()) { +334 if (!parent.mkdirs()) { +335 final String msg = String.format("Unable to build directory '%s'.", parent.getAbsolutePath()); +336 throw new AnalysisException(msg); +337 } +338 } +339 fos = new FileOutputStream(file); +340 bos = new BufferedOutputStream(fos, BUFFER_SIZE); +341 int count; +342 final byte data[] = new byte[BUFFER_SIZE]; +343 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) { +344 bos.write(data, 0, count); +345 } +346 bos.flush(); +347 } catch (FileNotFoundException ex) { +348 LOGGER.log(Level.FINE, null, ex); +349 final String msg = String.format("Unable to find file '%s'.", file.getName()); +350 throw new AnalysisException(msg, ex); +351 } catch (IOException ex) { +352 LOGGER.log(Level.FINE, null, ex); +353 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); +354 throw new AnalysisException(msg, ex); +355 } finally { +356 if (bos != null) { +357 try { +358 bos.close(); +359 } catch (IOException ex) { +360 LOGGER.log(Level.FINEST, null, ex); +361 } +362 } +363 } +364 } +365 } +366 } +367 } catch (IOException ex) { +368 throw new ArchiveExtractionException(ex); +369 } catch (Throwable ex) { +370 throw new ArchiveExtractionException(ex); +371 } finally { +372 if (input != null) { +373 try { +374 input.close(); +375 } catch (IOException ex) { +376 LOGGER.log(Level.FINEST, null, ex); +377 } +378 } +379 } +380 } +381 +382 /** +383 * Decompresses a file. +384 * +385 * @param inputStream the compressed file +386 * @param outputFile the location to write the decompressed file +387 * @throws ArchiveExtractionException thrown if there is an exception decompressing the file +388 */ +389 private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException { +390 FileOutputStream out = null; +391 try { +392 out = new FileOutputStream(outputFile); +393 final byte[] buffer = new byte[BUFFER_SIZE]; +394 int n = 0; +395 while (-1 != (n = inputStream.read(buffer))) { +396 out.write(buffer, 0, n); +397 } +398 } catch (FileNotFoundException ex) { +399 LOGGER.log(Level.FINE, null, ex); +400 throw new ArchiveExtractionException(ex); +401 } catch (IOException ex) { +402 LOGGER.log(Level.FINE, null, ex); +403 throw new ArchiveExtractionException(ex); +404 } finally { +405 if (out != null) { +406 try { +407 out.close(); +408 } catch (IOException ex) { +409 LOGGER.log(Level.FINEST, null, ex); +410 } +411 } +412 } +413 } +414 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html index 8ea79e5aa..eb970d98f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.html @@ -69,7 +69,7 @@ 61 /** 62 * The list of supported extensions 63 */ -64 private static final Set<String> SUPORTED_EXTENSIONS = newHashSet("dll", "exe"); +64 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("dll", "exe"); 65 /** 66 * The temp value for GrokAssembly.exe 67 */ @@ -81,7 +81,7 @@ 73 /** 74 * Logger 75 */ -76 private static final Logger LOG = Logger.getLogger(AssemblyAnalyzer.class.getName()); +76 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzer.class.getName()); 77 78 /** 79 * Builds the beginnings of a List for ProcessBuilder @@ -114,7 +114,7 @@ 106 public void analyzeFileType(Dependency dependency, Engine engine) 107 throws AnalysisException { 108 if (grokAssemblyExe == null) { -109 LOG.warning("GrokAssembly didn't get deployed"); +109 LOGGER.warning("GrokAssembly didn't get deployed"); 110 return; 111 } 112 @@ -125,10 +125,10 @@ 117 try { 118 final Process proc = pb.start(); 119 // Try evacuating the error stream -120 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream())); +120 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8")); 121 String line = null; 122 while (rdr.ready() && (line = rdr.readLine()) != null) { -123 LOG.log(Level.WARNING, "Error from GrokAssembly: {0}", line); +123 LOGGER.log(Level.WARNING, "Error from GrokAssembly: {0}", line); 124 } 125 int rc = 0; 126 final Document doc = builder.parse(proc.getInputStream()); @@ -164,10 +164,10 @@ 156 return; 157 } 158 if (rc == 3) { -159 LOG.log(Level.INFO, "{0} is not a valid assembly", dependency.getActualFilePath()); +159 LOGGER.log(Level.INFO, "{0} is not a valid assembly", dependency.getActualFilePath()); 160 return; 161 } else if (rc != 0) { -162 LOG.log(Level.WARNING, "Return code {0} from GrokAssembly", rc); +162 LOGGER.log(Level.WARNING, "Return code {0} from GrokAssembly", rc); 163 } 164 165 } catch (IOException ioe) { @@ -182,7 +182,7 @@ 174 try { 175 rdr.close(); 176 } catch (IOException ex) { -177 Logger.getLogger(AssemblyAnalyzer.class.getName()).log(Level.FINEST, "ignore", ex); +177 LOGGER.log(Level.FINEST, "ignore", ex); 178 } 179 } 180 } @@ -209,23 +209,23 @@ 201 grokAssemblyExe = tempFile; 202 // Set the temp file to get deleted when we're done 203 grokAssemblyExe.deleteOnExit(); -204 LOG.log(Level.FINE, "Extracted GrokAssembly.exe to {0}", grokAssemblyExe.getPath()); +204 LOGGER.log(Level.FINE, "Extracted GrokAssembly.exe to {0}", grokAssemblyExe.getPath()); 205 } catch (IOException ioe) { -206 LOG.log(Level.WARNING, "Could not extract GrokAssembly.exe: {0}", ioe.getMessage()); +206 LOGGER.log(Level.WARNING, "Could not extract GrokAssembly.exe: {0}", ioe.getMessage()); 207 throw new AnalysisException("Could not extract GrokAssembly.exe", ioe); 208 } finally { 209 if (fos != null) { 210 try { 211 fos.close(); 212 } catch (Throwable e) { -213 LOG.fine("Error closing output stream"); +213 LOGGER.fine("Error closing output stream"); 214 } 215 } 216 if (is != null) { 217 try { 218 is.close(); 219 } catch (Throwable e) { -220 LOG.fine("Error closing input stream"); +220 LOGGER.fine("Error closing input stream"); 221 } 222 } 223 } @@ -237,90 +237,93 @@ 229 final ProcessBuilder pb = new ProcessBuilder(args); 230 final Process p = pb.start(); 231 // Try evacuating the error stream -232 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream())); -233 String line; -234 while (rdr.ready() && (line = rdr.readLine()) != null) { -235 // We expect this to complain -236 } -237 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream()); -238 final XPath xpath = XPathFactory.newInstance().newXPath(); -239 final String error = xpath.evaluate("/assembly/error", doc); -240 if (p.waitFor() != 1 || error == null || "".equals(error)) { -241 LOG.warning("An error occured with the .NET AssemblyAnalyzer, please see the log for more details."); -242 LOG.fine("GrokAssembly.exe is not working properly"); -243 grokAssemblyExe = null; -244 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer"); -245 } -246 } catch (Throwable e) { -247 LOG.warning("An error occured with the .NET AssemblyAnalyzer; " -248 + "this can be ignored unless you are scanning .NET dlls. Please see the log for more details."); -249 LOG.log(Level.FINE, "Could not execute GrokAssembly {0}", e.getMessage()); -250 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer", e); -251 } finally { -252 if (rdr != null) { -253 try { -254 rdr.close(); -255 } catch (IOException ex) { -256 Logger.getLogger(AssemblyAnalyzer.class.getName()).log(Level.FINEST, "ignore", ex); -257 } -258 } -259 } -260 -261 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); -262 } +232 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8")); +233 while (rdr.ready() && rdr.readLine() != null) { +234 // We expect this to complain +235 } +236 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream()); +237 final XPath xpath = XPathFactory.newInstance().newXPath(); +238 final String error = xpath.evaluate("/assembly/error", doc); +239 if (p.waitFor() != 1 || error == null || "".equals(error)) { +240 LOGGER.warning("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details."); +241 LOGGER.fine("GrokAssembly.exe is not working properly"); +242 grokAssemblyExe = null; +243 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer"); +244 } +245 } catch (Throwable e) { +246 if (e instanceof AnalysisException) { +247 throw (AnalysisException) e; +248 } else { +249 LOGGER.warning("An error occured with the .NET AssemblyAnalyzer; " +250 + "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details."); +251 LOGGER.log(Level.FINE, "Could not execute GrokAssembly {0}", e.getMessage()); +252 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer", e); +253 } +254 } finally { +255 if (rdr != null) { +256 try { +257 rdr.close(); +258 } catch (IOException ex) { +259 LOGGER.log(Level.FINEST, "ignore", ex); +260 } +261 } +262 } 263 -264 @Override -265 public void close() throws Exception { -266 super.close(); -267 try { -268 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) { -269 grokAssemblyExe.deleteOnExit(); -270 } -271 } catch (SecurityException se) { -272 LOG.fine("Can't delete temporary GrokAssembly.exe"); -273 } -274 } -275 -276 /** -277 * Gets the set of extensions supported by this analyzer. -278 * -279 * @return the list of supported extensions -280 */ -281 @Override -282 public Set<String> getSupportedExtensions() { -283 return SUPORTED_EXTENSIONS; -284 } -285 -286 /** -287 * Gets this analyzer's name. -288 * -289 * @return the analyzer name -290 */ -291 @Override -292 public String getName() { -293 return ANALYZER_NAME; -294 } -295 -296 /** -297 * Returns the phase this analyzer runs under. -298 * -299 * @return the phase this runs under -300 */ -301 @Override -302 public AnalysisPhase getAnalysisPhase() { -303 return ANALYSIS_PHASE; -304 } -305 -306 /** -307 * Returns the key used in the properties file to reference the analyzer's enabled property. -308 * -309 * @return the analyzer's enabled property setting key -310 */ -311 @Override -312 protected String getAnalyzerEnabledSettingKey() { -313 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED; -314 } -315 } +264 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); +265 } +266 +267 @Override +268 public void close() throws Exception { +269 super.close(); +270 try { +271 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) { +272 grokAssemblyExe.deleteOnExit(); +273 } +274 } catch (SecurityException se) { +275 LOGGER.fine("Can't delete temporary GrokAssembly.exe"); +276 } +277 } +278 +279 /** +280 * Gets the set of extensions supported by this analyzer. +281 * +282 * @return the list of supported extensions +283 */ +284 @Override +285 public Set<String> getSupportedExtensions() { +286 return SUPPORTED_EXTENSIONS; +287 } +288 +289 /** +290 * Gets this analyzer's name. +291 * +292 * @return the analyzer name +293 */ +294 @Override +295 public String getName() { +296 return ANALYZER_NAME; +297 } +298 +299 /** +300 * Returns the phase this analyzer runs under. +301 * +302 * @return the phase this runs under +303 */ +304 @Override +305 public AnalysisPhase getAnalysisPhase() { +306 return ANALYSIS_PHASE; +307 } +308 +309 /** +310 * Returns the key used in the properties file to reference the analyzer's enabled property. +311 * +312 * @return the analyzer's enabled property setting key +313 */ +314 @Override +315 protected String getAnalyzerEnabledSettingKey() { +316 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED; +317 } +318 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html index b973fce0b..a3ade5f9a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html @@ -65,696 +65,699 @@ 57 * @author Jeremy Long <jeremy.long@owasp.org> 58 */ 59 public class CPEAnalyzer implements Analyzer { -60 -61 /** -62 * The maximum number of query results to return. -63 */ -64 static final int MAX_QUERY_RESULTS = 25; -65 /** -66 * The weighting boost to give terms when constructing the Lucene query. -67 */ -68 static final String WEIGHTING_BOOST = "^5"; -69 /** -70 * A string representation of a regular expression defining characters utilized within the CPE Names. -71 */ -72 static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]"; -73 /** -74 * A string representation of a regular expression used to remove all but alpha characters. -75 */ -76 static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*"; -77 /** -78 * The additional size to add to a new StringBuilder to account for extra data that will be written into the string. -79 */ -80 static final int STRING_BUILDER_BUFFER = 20; -81 /** -82 * The CPE in memory index. -83 */ -84 private CpeMemoryIndex cpe; -85 /** -86 * The CVE Database. -87 */ -88 private CveDB cve; -89 -90 /** -91 * Returns the name of this analyzer. -92 * -93 * @return the name of this analyzer. -94 */ -95 @Override -96 public String getName() { -97 return "CPE Analyzer"; -98 } -99 -100 /** -101 * Returns the analysis phase that this analyzer should run in. -102 * -103 * @return the analysis phase that this analyzer should run in. -104 */ -105 @Override -106 public AnalysisPhase getAnalysisPhase() { -107 return AnalysisPhase.IDENTIFIER_ANALYSIS; -108 } -109 -110 /** -111 * Creates the CPE Lucene Index. -112 * -113 * @throws Exception is thrown if there is an issue opening the index. -114 */ -115 @Override -116 public void initialize() throws Exception { -117 this.open(); -118 } -119 -120 /** -121 * Opens the data source. -122 * -123 * @throws IOException when the Lucene directory to be queried does not exist or is corrupt. -124 * @throws DatabaseException when the database throws an exception. This usually occurs when the database is in use -125 * by another process. -126 */ -127 public void open() throws IOException, DatabaseException { -128 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Opening the CVE Database"); -129 cve = new CveDB(); -130 cve.open(); -131 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Creating the Lucene CPE Index"); -132 cpe = CpeMemoryIndex.getInstance(); -133 try { -134 cpe.open(cve); -135 } catch (IndexException ex) { -136 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "IndexException", ex); -137 throw new DatabaseException(ex); -138 } -139 } -140 -141 /** -142 * Closes the data sources. -143 */ -144 @Override -145 public void close() { -146 if (cpe != null) { -147 cpe.close(); -148 } -149 if (cve != null) { -150 cve.close(); +60 /** +61 * The Logger. +62 */ +63 private static final Logger LOGGER = Logger.getLogger(CPEAnalyzer.class.getName()); +64 /** +65 * The maximum number of query results to return. +66 */ +67 static final int MAX_QUERY_RESULTS = 25; +68 /** +69 * The weighting boost to give terms when constructing the Lucene query. +70 */ +71 static final String WEIGHTING_BOOST = "^5"; +72 /** +73 * A string representation of a regular expression defining characters utilized within the CPE Names. +74 */ +75 static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]"; +76 /** +77 * A string representation of a regular expression used to remove all but alpha characters. +78 */ +79 static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*"; +80 /** +81 * The additional size to add to a new StringBuilder to account for extra data that will be written into the string. +82 */ +83 static final int STRING_BUILDER_BUFFER = 20; +84 /** +85 * The CPE in memory index. +86 */ +87 private CpeMemoryIndex cpe; +88 /** +89 * The CVE Database. +90 */ +91 private CveDB cve; +92 +93 /** +94 * Returns the name of this analyzer. +95 * +96 * @return the name of this analyzer. +97 */ +98 @Override +99 public String getName() { +100 return "CPE Analyzer"; +101 } +102 +103 /** +104 * Returns the analysis phase that this analyzer should run in. +105 * +106 * @return the analysis phase that this analyzer should run in. +107 */ +108 @Override +109 public AnalysisPhase getAnalysisPhase() { +110 return AnalysisPhase.IDENTIFIER_ANALYSIS; +111 } +112 +113 /** +114 * Creates the CPE Lucene Index. +115 * +116 * @throws Exception is thrown if there is an issue opening the index. +117 */ +118 @Override +119 public void initialize() throws Exception { +120 this.open(); +121 } +122 +123 /** +124 * Opens the data source. +125 * +126 * @throws IOException when the Lucene directory to be queried does not exist or is corrupt. +127 * @throws DatabaseException when the database throws an exception. This usually occurs when the database is in use +128 * by another process. +129 */ +130 public void open() throws IOException, DatabaseException { +131 LOGGER.log(Level.FINE, "Opening the CVE Database"); +132 cve = new CveDB(); +133 cve.open(); +134 LOGGER.log(Level.FINE, "Creating the Lucene CPE Index"); +135 cpe = CpeMemoryIndex.getInstance(); +136 try { +137 cpe.open(cve); +138 } catch (IndexException ex) { +139 LOGGER.log(Level.FINE, "IndexException", ex); +140 throw new DatabaseException(ex); +141 } +142 } +143 +144 /** +145 * Closes the data sources. +146 */ +147 @Override +148 public void close() { +149 if (cpe != null) { +150 cpe.close(); 151 } -152 } -153 -154 /** -155 * Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence -156 * contained within. The dependency passed in is updated with any identified CPE values. -157 * -158 * @param dependency the dependency to search for CPE entries on. -159 * @throws CorruptIndexException is thrown when the Lucene index is corrupt. -160 * @throws IOException is thrown when an IOException occurs. -161 * @throws ParseException is thrown when the Lucene query cannot be parsed. -162 */ -163 protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException { -164 Confidence confidence = Confidence.HIGHEST; -165 -166 String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence); -167 String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence); -168 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no -169 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ -170 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); -171 -172 int ctr = 0; -173 do { -174 if (!vendors.isEmpty() && !products.isEmpty()) { -175 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(), -176 dependency.getVendorEvidence().getWeighting()); -177 -178 for (IndexEntry e : entries) { -179 if (verifyEntry(e, dependency)) { -180 final String vendor = e.getVendor(); -181 final String product = e.getProduct(); -182 determineIdentifiers(dependency, vendor, product); -183 } -184 } -185 } -186 confidence = reduceConfidence(confidence); -187 if (dependency.getVendorEvidence().contains(confidence)) { -188 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence); -189 } -190 if (dependency.getProductEvidence().contains(confidence)) { -191 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence); +152 if (cve != null) { +153 cve.close(); +154 } +155 } +156 +157 /** +158 * Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence +159 * contained within. The dependency passed in is updated with any identified CPE values. +160 * +161 * @param dependency the dependency to search for CPE entries on. +162 * @throws CorruptIndexException is thrown when the Lucene index is corrupt. +163 * @throws IOException is thrown when an IOException occurs. +164 * @throws ParseException is thrown when the Lucene query cannot be parsed. +165 */ +166 protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException { +167 Confidence confidence = Confidence.HIGHEST; +168 +169 String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence); +170 String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence); +171 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no +172 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ +173 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); +174 +175 int ctr = 0; +176 do { +177 if (!vendors.isEmpty() && !products.isEmpty()) { +178 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(), +179 dependency.getVendorEvidence().getWeighting()); +180 +181 for (IndexEntry e : entries) { +182 if (verifyEntry(e, dependency)) { +183 final String vendor = e.getVendor(); +184 final String product = e.getProduct(); +185 determineIdentifiers(dependency, vendor, product); +186 } +187 } +188 } +189 confidence = reduceConfidence(confidence); +190 if (dependency.getVendorEvidence().contains(confidence)) { +191 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence); 192 } -193 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no -194 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ -195 if (dependency.getVersionEvidence().contains(confidence)) { -196 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); -197 } -198 } while ((++ctr) < 4); -199 } -200 -201 /** -202 * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a -203 * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence -204 * is longer then 200 characters it will be truncated. -205 * -206 * @param text the base text. -207 * @param ec an EvidenceCollection -208 * @param confidenceFilter a Confidence level to filter the evidence by. -209 * @return the new evidence text -210 */ -211 private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) { -212 final String txt = (text == null) ? "" : text; -213 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size())); -214 sb.append(' ').append(txt).append(' '); -215 for (Evidence e : ec.iterator(confidenceFilter)) { -216 String value = e.getValue(); -217 -218 //hack to get around the fact that lucene does a really good job of recognizing domains and not -219 // splitting them. TODO - put together a better lucene analyzer specific to the domain. -220 if (value.startsWith("http://")) { -221 value = value.substring(7).replaceAll("\\.", " "); -222 } -223 if (value.startsWith("https://")) { -224 value = value.substring(8).replaceAll("\\.", " "); +193 if (dependency.getProductEvidence().contains(confidence)) { +194 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence); +195 } +196 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no +197 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ +198 if (dependency.getVersionEvidence().contains(confidence)) { +199 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); +200 } +201 } while ((++ctr) < 4); +202 } +203 +204 /** +205 * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a +206 * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence +207 * is longer then 200 characters it will be truncated. +208 * +209 * @param text the base text. +210 * @param ec an EvidenceCollection +211 * @param confidenceFilter a Confidence level to filter the evidence by. +212 * @return the new evidence text +213 */ +214 private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) { +215 final String txt = (text == null) ? "" : text; +216 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size())); +217 sb.append(' ').append(txt).append(' '); +218 for (Evidence e : ec.iterator(confidenceFilter)) { +219 String value = e.getValue(); +220 +221 //hack to get around the fact that lucene does a really good job of recognizing domains and not +222 // splitting them. TODO - put together a better lucene analyzer specific to the domain. +223 if (value.startsWith("http://")) { +224 value = value.substring(7).replaceAll("\\.", " "); 225 } -226 if (sb.indexOf(" " + value + " ") < 0) { -227 sb.append(value).append(' '); +226 if (value.startsWith("https://")) { +227 value = value.substring(8).replaceAll("\\.", " "); 228 } -229 } -230 return sb.toString().trim(); -231 } -232 -233 /** -234 * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH. -235 * -236 * @param c the confidence to reduce. -237 * @return One less then the confidence passed in. -238 */ -239 private Confidence reduceConfidence(final Confidence c) { -240 if (c == Confidence.HIGHEST) { -241 return Confidence.HIGH; -242 } else if (c == Confidence.HIGH) { -243 return Confidence.MEDIUM; -244 } else { -245 return Confidence.LOW; -246 } -247 } -248 -249 /** -250 * <p> -251 * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and -252 * version.</p> -253 * -254 * <p> -255 * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting -256 * factors to the search.</p> -257 * -258 * @param vendor the text used to search the vendor field -259 * @param product the text used to search the product field -260 * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field -261 * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search -262 * @return a list of possible CPE values -263 * @throws CorruptIndexException when the Lucene index is corrupt -264 * @throws IOException when the Lucene index is not found -265 * @throws ParseException when the generated query is not valid -266 */ -267 protected List<IndexEntry> searchCPE(String vendor, String product, -268 Set<String> vendorWeightings, Set<String> productWeightings) -269 throws CorruptIndexException, IOException, ParseException { -270 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS); -271 -272 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings); -273 if (searchString == null) { -274 return ret; -275 } -276 -277 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); -278 for (ScoreDoc d : docs.scoreDocs) { -279 if (d.score >= 0.08) { -280 final Document doc = cpe.getDocument(d.doc); -281 final IndexEntry entry = new IndexEntry(); -282 entry.setVendor(doc.get(Fields.VENDOR)); -283 entry.setProduct(doc.get(Fields.PRODUCT)); -284 // if (d.score < 0.08) { -285 // System.out.print(entry.getVendor()); -286 // System.out.print(":"); -287 // System.out.print(entry.getProduct()); -288 // System.out.print(":"); -289 // System.out.println(d.score); -290 // } -291 entry.setSearchScore(d.score); -292 if (!ret.contains(entry)) { -293 ret.add(entry); -294 } -295 } -296 } -297 return ret; -298 } -299 -300 /** -301 * <p> -302 * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p> -303 * +229 if (sb.indexOf(" " + value + " ") < 0) { +230 sb.append(value).append(' '); +231 } +232 } +233 return sb.toString().trim(); +234 } +235 +236 /** +237 * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH. +238 * +239 * @param c the confidence to reduce. +240 * @return One less then the confidence passed in. +241 */ +242 private Confidence reduceConfidence(final Confidence c) { +243 if (c == Confidence.HIGHEST) { +244 return Confidence.HIGH; +245 } else if (c == Confidence.HIGH) { +246 return Confidence.MEDIUM; +247 } else { +248 return Confidence.LOW; +249 } +250 } +251 +252 /** +253 * <p> +254 * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and +255 * version.</p> +256 * +257 * <p> +258 * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting +259 * factors to the search.</p> +260 * +261 * @param vendor the text used to search the vendor field +262 * @param product the text used to search the product field +263 * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field +264 * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search +265 * @return a list of possible CPE values +266 * @throws CorruptIndexException when the Lucene index is corrupt +267 * @throws IOException when the Lucene index is not found +268 * @throws ParseException when the generated query is not valid +269 */ +270 protected List<IndexEntry> searchCPE(String vendor, String product, +271 Set<String> vendorWeightings, Set<String> productWeightings) +272 throws CorruptIndexException, IOException, ParseException { +273 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS); +274 +275 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings); +276 if (searchString == null) { +277 return ret; +278 } +279 +280 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); +281 for (ScoreDoc d : docs.scoreDocs) { +282 if (d.score >= 0.08) { +283 final Document doc = cpe.getDocument(d.doc); +284 final IndexEntry entry = new IndexEntry(); +285 entry.setVendor(doc.get(Fields.VENDOR)); +286 entry.setProduct(doc.get(Fields.PRODUCT)); +287 // if (d.score < 0.08) { +288 // System.out.print(entry.getVendor()); +289 // System.out.print(":"); +290 // System.out.print(entry.getProduct()); +291 // System.out.print(":"); +292 // System.out.println(d.score); +293 // } +294 entry.setSearchScore(d.score); +295 if (!ret.contains(entry)) { +296 ret.add(entry); +297 } +298 } +299 } +300 return ret; +301 } +302 +303 /** 304 * <p> -305 * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting -306 * factors to the search string generated.</p> -307 * -308 * @param vendor text to search the vendor field -309 * @param product text to search the product field -310 * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight -311 * @param productWeightings a list of strings to apply to the product to boost the terms weight -312 * @return the Lucene query -313 */ -314 protected String buildSearch(String vendor, String product, -315 Set<String> vendorWeighting, Set<String> productWeightings) { -316 final String v = vendor; //.replaceAll("[^\\w\\d]", " "); -317 final String p = product; //.replaceAll("[^\\w\\d]", " "); -318 final StringBuilder sb = new StringBuilder(v.length() + p.length() -319 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); -320 -321 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) { -322 return null; -323 } -324 sb.append(" AND "); -325 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) { -326 return null; -327 } -328 return sb.toString(); -329 } -330 -331 /** -332 * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the -333 * word is within the list of weighted words then an additional weighting is applied to the term as it is appended -334 * into the query. -335 * -336 * @param sb a StringBuilder that the query text will be appended to. -337 * @param field the field within the Lucene index that the query is searching. -338 * @param searchText text used to construct the query. -339 * @param weightedText a list of terms that will be considered higher importance when searching. -340 * @return if the append was successful. -341 */ -342 private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) { -343 sb.append(" ").append(field).append(":( "); -344 -345 final String cleanText = cleanseText(searchText); -346 -347 if ("".equals(cleanText)) { -348 return false; -349 } -350 -351 if (weightedText == null || weightedText.isEmpty()) { -352 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText); -353 } else { -354 final StringTokenizer tokens = new StringTokenizer(cleanText); -355 while (tokens.hasMoreElements()) { -356 final String word = tokens.nextToken(); -357 String temp = null; -358 for (String weighted : weightedText) { -359 final String weightedStr = cleanseText(weighted); -360 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) { -361 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST; -362 if (!word.equalsIgnoreCase(weightedStr)) { -363 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST; -364 } -365 } -366 } -367 if (temp == null) { -368 temp = LuceneUtils.escapeLuceneQuery(word); +305 * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p> +306 * +307 * <p> +308 * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting +309 * factors to the search string generated.</p> +310 * +311 * @param vendor text to search the vendor field +312 * @param product text to search the product field +313 * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight +314 * @param productWeightings a list of strings to apply to the product to boost the terms weight +315 * @return the Lucene query +316 */ +317 protected String buildSearch(String vendor, String product, +318 Set<String> vendorWeighting, Set<String> productWeightings) { +319 final String v = vendor; //.replaceAll("[^\\w\\d]", " "); +320 final String p = product; //.replaceAll("[^\\w\\d]", " "); +321 final StringBuilder sb = new StringBuilder(v.length() + p.length() +322 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); +323 +324 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) { +325 return null; +326 } +327 sb.append(" AND "); +328 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) { +329 return null; +330 } +331 return sb.toString(); +332 } +333 +334 /** +335 * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the +336 * word is within the list of weighted words then an additional weighting is applied to the term as it is appended +337 * into the query. +338 * +339 * @param sb a StringBuilder that the query text will be appended to. +340 * @param field the field within the Lucene index that the query is searching. +341 * @param searchText text used to construct the query. +342 * @param weightedText a list of terms that will be considered higher importance when searching. +343 * @return if the append was successful. +344 */ +345 private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) { +346 sb.append(" ").append(field).append(":( "); +347 +348 final String cleanText = cleanseText(searchText); +349 +350 if ("".equals(cleanText)) { +351 return false; +352 } +353 +354 if (weightedText == null || weightedText.isEmpty()) { +355 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText); +356 } else { +357 final StringTokenizer tokens = new StringTokenizer(cleanText); +358 while (tokens.hasMoreElements()) { +359 final String word = tokens.nextToken(); +360 String temp = null; +361 for (String weighted : weightedText) { +362 final String weightedStr = cleanseText(weighted); +363 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) { +364 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST; +365 if (!word.equalsIgnoreCase(weightedStr)) { +366 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST; +367 } +368 } 369 } -370 sb.append(" ").append(temp); -371 } -372 } -373 sb.append(" ) "); -374 return true; -375 } -376 -377 /** -378 * Removes characters from the input text that are not used within the CPE index. -379 * -380 * @param text is the text to remove the characters from. -381 * @return the text having removed some characters. -382 */ -383 private String cleanseText(String text) { -384 return text.replaceAll(CLEANSE_CHARACTER_RX, " "); -385 } -386 -387 /** -388 * Compares two strings after lower casing them and removing the non-alpha characters. -389 * -390 * @param l string one to compare. -391 * @param r string two to compare. -392 * @return whether or not the two strings are similar. -393 */ -394 private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) { -395 if (l == null || r == null) { -396 return false; -397 } -398 -399 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, ""); -400 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, ""); -401 return left.equalsIgnoreCase(right); -402 } -403 -404 /** -405 * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version -406 * information for the CPE are contained within the dependencies evidence. -407 * -408 * @param entry a CPE entry. -409 * @param dependency the dependency that the CPE entries could be for. -410 * @return whether or not the entry is valid. -411 */ -412 private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) { -413 boolean isValid = false; -414 -415 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) -416 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { -417 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) -418 isValid = true; -419 } -420 return isValid; -421 } -422 -423 /** -424 * Used to determine if the EvidenceCollection contains a specific string. -425 * -426 * @param ec an EvidenceCollection -427 * @param text the text to search for -428 * @return whether or not the EvidenceCollection contains the string -429 */ -430 private boolean collectionContainsString(EvidenceCollection ec, String text) { -431 -432 //<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done"> -433 // String[] splitText = text.split("[\\s_-]"); -434 // -435 // for (String search : splitText) { -436 // //final String search = text.replaceAll("[\\s_-]", "").toLowerCase(); -437 // if (ec.containsUsedString(search)) { -438 // return true; -439 // } -440 // } -441 //</editor-fold> -442 //TODO - likely need to change the split... not sure if this will work for CPE with special chars -443 if (text == null) { -444 return false; -445 } -446 final String[] words = text.split("[\\s_-]"); -447 final List<String> list = new ArrayList<String>(); -448 String tempWord = null; -449 for (String word : words) { -450 /* -451 single letter words should be concatenated with the next word. -452 so { "m", "core", "sample" } -> { "mcore", "sample" } -453 */ -454 if (tempWord != null) { -455 list.add(tempWord + word); -456 tempWord = null; -457 } else if (word.length() <= 2) { -458 tempWord = word; -459 } else { -460 list.add(word); -461 } -462 } -463 if (tempWord != null && !list.isEmpty()) { -464 final String tmp = list.get(list.size() - 1) + tempWord; -465 list.add(tmp); -466 } -467 boolean contains = true; -468 for (String word : list) { -469 contains &= ec.containsUsedString(word); -470 } -471 return contains; -472 } -473 -474 /** -475 * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. -476 * -477 * @param dependency The Dependency to analyze. -478 * @param engine The analysis engine -479 * @throws AnalysisException is thrown if there is an issue analyzing the dependency. -480 */ -481 @Override -482 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -483 try { -484 determineCPE(dependency); -485 } catch (CorruptIndexException ex) { -486 throw new AnalysisException("CPE Index is corrupt.", ex); -487 } catch (IOException ex) { -488 throw new AnalysisException("Failure opening the CPE Index.", ex); -489 } catch (ParseException ex) { -490 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex); -491 } -492 } -493 -494 /** -495 * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then -496 * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a -497 * best effort "guess" based on the vendor, product, and version information. -498 * -499 * @param dependency the Dependency being analyzed -500 * @param vendor the vendor for the CPE being analyzed -501 * @param product the product for the CPE being analyzed -502 * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported -503 */ -504 private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException { -505 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product); -506 DependencyVersion bestGuess = new DependencyVersion("-"); -507 Confidence bestGuessConf = null; -508 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>(); -509 for (Confidence conf : Confidence.values()) { -510 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) { -511 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue()); -512 if (evVer == null) { -513 continue; -514 } -515 for (VulnerableSoftware vs : cpes) { -516 DependencyVersion dbVer; -517 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) { -518 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision()); -519 } else { -520 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion()); -521 } -522 if (dbVer == null //special case, no version specified - everything is vulnerable -523 || evVer.equals(dbVer)) { //yeah! exact match -524 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8")); -525 final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); -526 collected.add(match); -527 } else { -528 //TODO the following isn't quite right is it? need to think about this guessing game a bit more. -529 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size() -530 && evVer.matchesAtLeastThreeLevels(dbVer)) { -531 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { -532 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) { -533 bestGuess = dbVer; -534 bestGuessConf = conf; -535 } -536 } -537 } -538 } -539 } -540 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { -541 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) { -542 bestGuess = evVer; -543 bestGuessConf = conf; -544 } -545 } -546 } -547 } -548 final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString()); -549 final String url = null; //String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(cpeName, "UTF-8")); -550 if (bestGuessConf == null) { -551 bestGuessConf = Confidence.LOW; -552 } -553 final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf); -554 collected.add(match); -555 -556 Collections.sort(collected); -557 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence(); -558 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence(); -559 for (IdentifierMatch m : collected) { -560 if (bestIdentifierQuality.equals(m.getConfidence()) -561 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) { -562 final Identifier i = m.getIdentifier(); -563 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) { -564 i.setConfidence(Confidence.LOW); -565 } else { -566 i.setConfidence(bestEvidenceQuality); -567 } -568 dependency.addIdentifier(i); -569 } -570 } -571 } -572 -573 /** -574 * The confidence whether the identifier is an exact match, or a best guess. -575 */ -576 private enum IdentifierConfidence { -577 -578 /** -579 * An exact match for the CPE. -580 */ -581 EXACT_MATCH, -582 /** -583 * A best guess for the CPE. -584 */ -585 BEST_GUESS -586 } -587 -588 /** -589 * A simple object to hold an identifier and carry information about the confidence in the identifier. -590 */ -591 private static class IdentifierMatch implements Comparable<IdentifierMatch> { -592 -593 /** -594 * Constructs an IdentifierMatch. -595 * -596 * @param type the type of identifier (such as CPE) -597 * @param value the value of the identifier -598 * @param url the URL of the identifier -599 * @param identifierConfidence the confidence in the identifier: best guess or exact match -600 * @param evidenceConfidence the confidence of the evidence used to find the identifier -601 */ -602 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { -603 this.identifier = new Identifier(type, value, url); -604 this.confidence = identifierConfidence; -605 this.evidenceConfidence = evidenceConfidence; -606 } -607 //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier"> -608 /** -609 * The confidence in the evidence used to identify this match. -610 */ -611 private Confidence evidenceConfidence; -612 -613 /** -614 * Get the value of evidenceConfidence -615 * -616 * @return the value of evidenceConfidence -617 */ -618 public Confidence getEvidenceConfidence() { -619 return evidenceConfidence; -620 } -621 -622 /** -623 * Set the value of evidenceConfidence -624 * -625 * @param evidenceConfidence new value of evidenceConfidence -626 */ -627 public void setEvidenceConfidence(Confidence evidenceConfidence) { -628 this.evidenceConfidence = evidenceConfidence; -629 } -630 /** -631 * The confidence whether this is an exact match, or a best guess. -632 */ -633 private IdentifierConfidence confidence; -634 -635 /** -636 * Get the value of confidence. -637 * -638 * @return the value of confidence -639 */ -640 public IdentifierConfidence getConfidence() { -641 return confidence; -642 } -643 -644 /** -645 * Set the value of confidence. -646 * -647 * @param confidence new value of confidence -648 */ -649 public void setConfidence(IdentifierConfidence confidence) { -650 this.confidence = confidence; -651 } -652 /** -653 * The CPE identifier. -654 */ -655 private Identifier identifier; -656 -657 /** -658 * Get the value of identifier. -659 * -660 * @return the value of identifier -661 */ -662 public Identifier getIdentifier() { -663 return identifier; -664 } -665 -666 /** -667 * Set the value of identifier. -668 * -669 * @param identifier new value of identifier -670 */ -671 public void setIdentifier(Identifier identifier) { -672 this.identifier = identifier; -673 } -674 //</editor-fold> -675 //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals"> -676 -677 /** -678 * Standard toString() implementation. -679 * -680 * @return the string representation of the object -681 */ -682 @Override -683 public String toString() { -684 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence -685 + ", confidence=" + confidence + ", identifier=" + identifier + '}'; -686 } -687 -688 /** -689 * Standard hashCode() implementation. -690 * -691 * @return the hashCode -692 */ -693 @Override -694 public int hashCode() { -695 int hash = 5; -696 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0); -697 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); -698 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0); -699 return hash; -700 } -701 -702 /** -703 * Standard equals implementation. -704 * -705 * @param obj the object to compare -706 * @return true if the objects are equal, otherwise false -707 */ -708 @Override -709 public boolean equals(Object obj) { -710 if (obj == null) { -711 return false; -712 } -713 if (getClass() != obj.getClass()) { +370 if (temp == null) { +371 temp = LuceneUtils.escapeLuceneQuery(word); +372 } +373 sb.append(" ").append(temp); +374 } +375 } +376 sb.append(" ) "); +377 return true; +378 } +379 +380 /** +381 * Removes characters from the input text that are not used within the CPE index. +382 * +383 * @param text is the text to remove the characters from. +384 * @return the text having removed some characters. +385 */ +386 private String cleanseText(String text) { +387 return text.replaceAll(CLEANSE_CHARACTER_RX, " "); +388 } +389 +390 /** +391 * Compares two strings after lower casing them and removing the non-alpha characters. +392 * +393 * @param l string one to compare. +394 * @param r string two to compare. +395 * @return whether or not the two strings are similar. +396 */ +397 private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) { +398 if (l == null || r == null) { +399 return false; +400 } +401 +402 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, ""); +403 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, ""); +404 return left.equalsIgnoreCase(right); +405 } +406 +407 /** +408 * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version +409 * information for the CPE are contained within the dependencies evidence. +410 * +411 * @param entry a CPE entry. +412 * @param dependency the dependency that the CPE entries could be for. +413 * @return whether or not the entry is valid. +414 */ +415 private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) { +416 boolean isValid = false; +417 +418 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) +419 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { +420 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) +421 isValid = true; +422 } +423 return isValid; +424 } +425 +426 /** +427 * Used to determine if the EvidenceCollection contains a specific string. +428 * +429 * @param ec an EvidenceCollection +430 * @param text the text to search for +431 * @return whether or not the EvidenceCollection contains the string +432 */ +433 private boolean collectionContainsString(EvidenceCollection ec, String text) { +434 +435 //<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done"> +436 // String[] splitText = text.split("[\\s_-]"); +437 // +438 // for (String search : splitText) { +439 // //final String search = text.replaceAll("[\\s_-]", "").toLowerCase(); +440 // if (ec.containsUsedString(search)) { +441 // return true; +442 // } +443 // } +444 //</editor-fold> +445 //TODO - likely need to change the split... not sure if this will work for CPE with special chars +446 if (text == null) { +447 return false; +448 } +449 final String[] words = text.split("[\\s_-]"); +450 final List<String> list = new ArrayList<String>(); +451 String tempWord = null; +452 for (String word : words) { +453 /* +454 single letter words should be concatenated with the next word. +455 so { "m", "core", "sample" } -> { "mcore", "sample" } +456 */ +457 if (tempWord != null) { +458 list.add(tempWord + word); +459 tempWord = null; +460 } else if (word.length() <= 2) { +461 tempWord = word; +462 } else { +463 list.add(word); +464 } +465 } +466 if (tempWord != null && !list.isEmpty()) { +467 final String tmp = list.get(list.size() - 1) + tempWord; +468 list.add(tmp); +469 } +470 boolean contains = true; +471 for (String word : list) { +472 contains &= ec.containsUsedString(word); +473 } +474 return contains; +475 } +476 +477 /** +478 * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. +479 * +480 * @param dependency The Dependency to analyze. +481 * @param engine The analysis engine +482 * @throws AnalysisException is thrown if there is an issue analyzing the dependency. +483 */ +484 @Override +485 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +486 try { +487 determineCPE(dependency); +488 } catch (CorruptIndexException ex) { +489 throw new AnalysisException("CPE Index is corrupt.", ex); +490 } catch (IOException ex) { +491 throw new AnalysisException("Failure opening the CPE Index.", ex); +492 } catch (ParseException ex) { +493 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex); +494 } +495 } +496 +497 /** +498 * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then +499 * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a +500 * best effort "guess" based on the vendor, product, and version information. +501 * +502 * @param dependency the Dependency being analyzed +503 * @param vendor the vendor for the CPE being analyzed +504 * @param product the product for the CPE being analyzed +505 * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported +506 */ +507 private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException { +508 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product); +509 DependencyVersion bestGuess = new DependencyVersion("-"); +510 Confidence bestGuessConf = null; +511 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>(); +512 for (Confidence conf : Confidence.values()) { +513 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) { +514 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue()); +515 if (evVer == null) { +516 continue; +517 } +518 for (VulnerableSoftware vs : cpes) { +519 DependencyVersion dbVer; +520 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) { +521 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision()); +522 } else { +523 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion()); +524 } +525 if (dbVer == null //special case, no version specified - everything is vulnerable +526 || evVer.equals(dbVer)) { //yeah! exact match +527 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8")); +528 final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); +529 collected.add(match); +530 } else { +531 //TODO the following isn't quite right is it? need to think about this guessing game a bit more. +532 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size() +533 && evVer.matchesAtLeastThreeLevels(dbVer)) { +534 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { +535 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) { +536 bestGuess = dbVer; +537 bestGuessConf = conf; +538 } +539 } +540 } +541 } +542 } +543 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { +544 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) { +545 bestGuess = evVer; +546 bestGuessConf = conf; +547 } +548 } +549 } +550 } +551 final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString()); +552 final String url = null; //String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(cpeName, "UTF-8")); +553 if (bestGuessConf == null) { +554 bestGuessConf = Confidence.LOW; +555 } +556 final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf); +557 collected.add(match); +558 +559 Collections.sort(collected); +560 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence(); +561 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence(); +562 for (IdentifierMatch m : collected) { +563 if (bestIdentifierQuality.equals(m.getConfidence()) +564 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) { +565 final Identifier i = m.getIdentifier(); +566 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) { +567 i.setConfidence(Confidence.LOW); +568 } else { +569 i.setConfidence(bestEvidenceQuality); +570 } +571 dependency.addIdentifier(i); +572 } +573 } +574 } +575 +576 /** +577 * The confidence whether the identifier is an exact match, or a best guess. +578 */ +579 private enum IdentifierConfidence { +580 +581 /** +582 * An exact match for the CPE. +583 */ +584 EXACT_MATCH, +585 /** +586 * A best guess for the CPE. +587 */ +588 BEST_GUESS +589 } +590 +591 /** +592 * A simple object to hold an identifier and carry information about the confidence in the identifier. +593 */ +594 private static class IdentifierMatch implements Comparable<IdentifierMatch> { +595 +596 /** +597 * Constructs an IdentifierMatch. +598 * +599 * @param type the type of identifier (such as CPE) +600 * @param value the value of the identifier +601 * @param url the URL of the identifier +602 * @param identifierConfidence the confidence in the identifier: best guess or exact match +603 * @param evidenceConfidence the confidence of the evidence used to find the identifier +604 */ +605 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { +606 this.identifier = new Identifier(type, value, url); +607 this.confidence = identifierConfidence; +608 this.evidenceConfidence = evidenceConfidence; +609 } +610 //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier"> +611 /** +612 * The confidence in the evidence used to identify this match. +613 */ +614 private Confidence evidenceConfidence; +615 +616 /** +617 * Get the value of evidenceConfidence +618 * +619 * @return the value of evidenceConfidence +620 */ +621 public Confidence getEvidenceConfidence() { +622 return evidenceConfidence; +623 } +624 +625 /** +626 * Set the value of evidenceConfidence +627 * +628 * @param evidenceConfidence new value of evidenceConfidence +629 */ +630 public void setEvidenceConfidence(Confidence evidenceConfidence) { +631 this.evidenceConfidence = evidenceConfidence; +632 } +633 /** +634 * The confidence whether this is an exact match, or a best guess. +635 */ +636 private IdentifierConfidence confidence; +637 +638 /** +639 * Get the value of confidence. +640 * +641 * @return the value of confidence +642 */ +643 public IdentifierConfidence getConfidence() { +644 return confidence; +645 } +646 +647 /** +648 * Set the value of confidence. +649 * +650 * @param confidence new value of confidence +651 */ +652 public void setConfidence(IdentifierConfidence confidence) { +653 this.confidence = confidence; +654 } +655 /** +656 * The CPE identifier. +657 */ +658 private Identifier identifier; +659 +660 /** +661 * Get the value of identifier. +662 * +663 * @return the value of identifier +664 */ +665 public Identifier getIdentifier() { +666 return identifier; +667 } +668 +669 /** +670 * Set the value of identifier. +671 * +672 * @param identifier new value of identifier +673 */ +674 public void setIdentifier(Identifier identifier) { +675 this.identifier = identifier; +676 } +677 //</editor-fold> +678 //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals"> +679 +680 /** +681 * Standard toString() implementation. +682 * +683 * @return the string representation of the object +684 */ +685 @Override +686 public String toString() { +687 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence +688 + ", confidence=" + confidence + ", identifier=" + identifier + '}'; +689 } +690 +691 /** +692 * Standard hashCode() implementation. +693 * +694 * @return the hashCode +695 */ +696 @Override +697 public int hashCode() { +698 int hash = 5; +699 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0); +700 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); +701 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0); +702 return hash; +703 } +704 +705 /** +706 * Standard equals implementation. +707 * +708 * @param obj the object to compare +709 * @return true if the objects are equal, otherwise false +710 */ +711 @Override +712 public boolean equals(Object obj) { +713 if (obj == null) { 714 return false; 715 } -716 final IdentifierMatch other = (IdentifierMatch) obj; -717 if (this.evidenceConfidence != other.evidenceConfidence) { -718 return false; -719 } -720 if (this.confidence != other.confidence) { +716 if (getClass() != obj.getClass()) { +717 return false; +718 } +719 final IdentifierMatch other = (IdentifierMatch) obj; +720 if (this.evidenceConfidence != other.evidenceConfidence) { 721 return false; 722 } -723 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) { +723 if (this.confidence != other.confidence) { 724 return false; 725 } -726 return true; -727 } -728 //</editor-fold> -729 -730 /** -731 * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the -732 * identifier. -733 * -734 * @param o the IdentifierMatch to compare to -735 * @return the natural ordering of IdentifierMatch -736 */ -737 @Override -738 public int compareTo(IdentifierMatch o) { -739 int conf = this.confidence.compareTo(o.confidence); -740 if (conf == 0) { -741 conf = this.evidenceConfidence.compareTo(o.evidenceConfidence); -742 if (conf == 0) { -743 conf = identifier.compareTo(o.identifier); -744 } -745 } -746 return conf; -747 } -748 } -749 } +726 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) { +727 return false; +728 } +729 return true; +730 } +731 //</editor-fold> +732 +733 /** +734 * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the +735 * identifier. +736 * +737 * @param o the IdentifierMatch to compare to +738 * @return the natural ordering of IdentifierMatch +739 */ +740 @Override +741 public int compareTo(IdentifierMatch o) { +742 int conf = this.confidence.compareTo(o.confidence); +743 if (conf == 0) { +744 conf = this.evidenceConfidence.compareTo(o.evidenceConfidence); +745 if (conf == 0) { +746 conf = identifier.compareTo(o.identifier); +747 } +748 } +749 return conf; +750 } +751 } +752 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html index 2c6070d4d..8326c2fc4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html @@ -38,7 +38,7 @@ 30 */ 31 public class CpeSuppressionAnalyzer extends AbstractSuppressionAnalyzer { 32 -33 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +33 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> 34 /** 35 * The name of the analyzer. 36 */ diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html index 6385c3980..6d9281523 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html @@ -54,346 +54,351 @@ 46 */ 47 public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer { 48 -49 //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables"> -50 /** -51 * A pattern for obtaining the first part of a filename. -52 */ -53 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*"); -54 /** -55 * a flag indicating if this analyzer has run. This analyzer only runs once. -56 */ -57 private boolean analyzed = false; -58 //</editor-fold> -59 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> -60 /** -61 * The name of the analyzer. -62 */ -63 private static final String ANALYZER_NAME = "Dependency Bundling Analyzer"; -64 /** -65 * The phase that this analyzer is intended to run in. -66 */ -67 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS; -68 +49 /** +50 * The Logger. +51 */ +52 private static final Logger LOGGER = Logger.getLogger(DependencyBundlingAnalyzer.class.getName()); +53 +54 //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables"> +55 /** +56 * A pattern for obtaining the first part of a filename. +57 */ +58 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*"); +59 /** +60 * a flag indicating if this analyzer has run. This analyzer only runs once. +61 */ +62 private boolean analyzed = false; +63 //</editor-fold> +64 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +65 /** +66 * The name of the analyzer. +67 */ +68 private static final String ANALYZER_NAME = "Dependency Bundling Analyzer"; 69 /** -70 * Returns the name of the analyzer. -71 * -72 * @return the name of the analyzer. -73 */ -74 public String getName() { -75 return ANALYZER_NAME; -76 } -77 -78 /** -79 * Returns the phase that the analyzer is intended to run in. -80 * -81 * @return the phase that the analyzer is intended to run in. -82 */ -83 public AnalysisPhase getAnalysisPhase() { -84 return ANALYSIS_PHASE; -85 } -86 //</editor-fold> -87 -88 /** -89 * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of -90 * identifiers they are likely related. The related dependencies are bundled into a single reportable item. -91 * -92 * @param ignore this analyzer ignores the dependency being analyzed -93 * @param engine the engine that is scanning the dependencies -94 * @throws AnalysisException is thrown if there is an error reading the JAR file. -95 */ -96 @Override -97 public void analyze(Dependency ignore, Engine engine) throws AnalysisException { -98 if (!analyzed) { -99 analyzed = true; -100 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>(); -101 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator(); -102 //for (Dependency nextDependency : engine.getDependencies()) { -103 while (mainIterator.hasNext()) { -104 final Dependency dependency = mainIterator.next(); -105 if (mainIterator.hasNext()) { -106 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex()); -107 while (subIterator.hasNext()) { -108 final Dependency nextDependency = subIterator.next(); -109 if (isShadedJar(dependency, nextDependency)) { -110 if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) { -111 dependenciesToRemove.add(dependency); -112 } else { -113 dependenciesToRemove.add(nextDependency); -114 } -115 } else if (hashesMatch(dependency, nextDependency)) { -116 if (isCore(dependency, nextDependency)) { -117 mergeDependencies(dependency, nextDependency, dependenciesToRemove); -118 } else { -119 mergeDependencies(nextDependency, dependency, dependenciesToRemove); -120 } -121 } else if (cpeIdentifiersMatch(dependency, nextDependency) -122 && hasSameBasePath(dependency, nextDependency) -123 && fileNameMatch(dependency, nextDependency)) { -124 -125 if (isCore(dependency, nextDependency)) { -126 mergeDependencies(dependency, nextDependency, dependenciesToRemove); -127 } else { -128 mergeDependencies(nextDependency, dependency, dependenciesToRemove); -129 } -130 } -131 } -132 } -133 } -134 //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions -135 // was difficult because of the inner iterator. -136 for (Dependency d : dependenciesToRemove) { -137 engine.getDependencies().remove(d); +70 * The phase that this analyzer is intended to run in. +71 */ +72 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS; +73 +74 /** +75 * Returns the name of the analyzer. +76 * +77 * @return the name of the analyzer. +78 */ +79 public String getName() { +80 return ANALYZER_NAME; +81 } +82 +83 /** +84 * Returns the phase that the analyzer is intended to run in. +85 * +86 * @return the phase that the analyzer is intended to run in. +87 */ +88 public AnalysisPhase getAnalysisPhase() { +89 return ANALYSIS_PHASE; +90 } +91 //</editor-fold> +92 +93 /** +94 * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of +95 * identifiers they are likely related. The related dependencies are bundled into a single reportable item. +96 * +97 * @param ignore this analyzer ignores the dependency being analyzed +98 * @param engine the engine that is scanning the dependencies +99 * @throws AnalysisException is thrown if there is an error reading the JAR file. +100 */ +101 @Override +102 public void analyze(Dependency ignore, Engine engine) throws AnalysisException { +103 if (!analyzed) { +104 analyzed = true; +105 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>(); +106 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator(); +107 //for (Dependency nextDependency : engine.getDependencies()) { +108 while (mainIterator.hasNext()) { +109 final Dependency dependency = mainIterator.next(); +110 if (mainIterator.hasNext()) { +111 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex()); +112 while (subIterator.hasNext()) { +113 final Dependency nextDependency = subIterator.next(); +114 if (hashesMatch(dependency, nextDependency)) { +115 if (isCore(dependency, nextDependency)) { +116 mergeDependencies(dependency, nextDependency, dependenciesToRemove); +117 } else { +118 mergeDependencies(nextDependency, dependency, dependenciesToRemove); +119 } +120 } else if (isShadedJar(dependency, nextDependency)) { +121 if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) { +122 dependenciesToRemove.add(dependency); +123 } else { +124 dependenciesToRemove.add(nextDependency); +125 } +126 } else if (cpeIdentifiersMatch(dependency, nextDependency) +127 && hasSameBasePath(dependency, nextDependency) +128 && fileNameMatch(dependency, nextDependency)) { +129 +130 if (isCore(dependency, nextDependency)) { +131 mergeDependencies(dependency, nextDependency, dependenciesToRemove); +132 } else { +133 mergeDependencies(nextDependency, dependency, dependenciesToRemove); +134 } +135 } +136 } +137 } 138 } -139 } -140 } -141 -142 /** -143 * Adds the relatedDependency to the dependency's related dependencies. -144 * -145 * @param dependency the main dependency -146 * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the -147 * source of dependencies to remove -148 * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this -149 * function adds to this collection -150 */ -151 private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) { -152 dependency.addRelatedDependency(relatedDependency); -153 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator(); -154 while (i.hasNext()) { -155 dependency.addRelatedDependency(i.next()); -156 i.remove(); -157 } -158 dependenciesToRemove.add(relatedDependency); -159 } -160 -161 /** -162 * Attempts to trim a maven repo to a common base path. This is typically -163 * [drive]\[repo_location]\repository\[path1]\[path2]. -164 * -165 * @param path the path to trim -166 * @return a string representing the base path. -167 */ -168 private String getBaseRepoPath(final String path) { -169 int pos = path.indexOf("repository" + File.separator) + 11; -170 if (pos < 0) { -171 return path; -172 } -173 int tmp = path.indexOf(File.separator, pos); -174 if (tmp <= 0) { -175 return path; -176 } -177 if (tmp > 0) { -178 pos = tmp + 1; -179 } -180 tmp = path.indexOf(File.separator, pos); -181 if (tmp > 0) { -182 pos = tmp + 1; -183 } -184 return path.substring(0, pos); -185 } -186 -187 /** -188 * Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar. -189 * -190 * @param dependency1 a dependency2 to compare -191 * @param dependency2 a dependency2 to compare -192 * @return true if the identifiers in the two supplied dependencies are equal -193 */ -194 private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) { -195 if (dependency1 == null || dependency1.getFileName() == null -196 || dependency2 == null || dependency2.getFileName() == null) { -197 return false; -198 } -199 String fileName1 = dependency1.getFileName(); -200 String fileName2 = dependency2.getFileName(); -201 -202 //update to deal with archive analyzer, the starting name maybe the same -203 // as this is incorrectly looking at the starting path -204 final File one = new File(fileName1); -205 final File two = new File(fileName2); -206 final String oneParent = one.getParent(); -207 final String twoParent = two.getParent(); -208 if (oneParent != null) { -209 if (oneParent.equals(twoParent)) { -210 fileName1 = one.getName(); -211 fileName2 = two.getName(); -212 } else { -213 return false; -214 } -215 } else if (twoParent != null) { -216 return false; -217 } -218 -219 //version check -220 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1); -221 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2); -222 if (version1 != null && version2 != null) { -223 if (!version1.equals(version2)) { -224 return false; -225 } -226 } -227 -228 //filename check -229 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1); -230 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2); -231 if (match1.find() && match2.find()) { -232 return match1.group().equals(match2.group()); -233 } -234 -235 return false; -236 } -237 -238 /** -239 * Returns true if the CPE identifiers in the two supplied dependencies are equal. -240 * -241 * @param dependency1 a dependency2 to compare -242 * @param dependency2 a dependency2 to compare -243 * @return true if the identifiers in the two supplied dependencies are equal -244 */ -245 private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) { -246 if (dependency1 == null || dependency1.getIdentifiers() == null -247 || dependency2 == null || dependency2.getIdentifiers() == null) { -248 return false; -249 } -250 boolean matches = false; -251 int cpeCount1 = 0; -252 int cpeCount2 = 0; -253 for (Identifier i : dependency1.getIdentifiers()) { -254 if ("cpe".equals(i.getType())) { -255 cpeCount1 += 1; -256 } -257 } -258 for (Identifier i : dependency2.getIdentifiers()) { +139 //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions +140 // was difficult because of the inner iterator. +141 for (Dependency d : dependenciesToRemove) { +142 engine.getDependencies().remove(d); +143 } +144 } +145 } +146 +147 /** +148 * Adds the relatedDependency to the dependency's related dependencies. +149 * +150 * @param dependency the main dependency +151 * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the +152 * source of dependencies to remove +153 * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this +154 * function adds to this collection +155 */ +156 private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) { +157 dependency.addRelatedDependency(relatedDependency); +158 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator(); +159 while (i.hasNext()) { +160 dependency.addRelatedDependency(i.next()); +161 i.remove(); +162 } +163 dependenciesToRemove.add(relatedDependency); +164 } +165 +166 /** +167 * Attempts to trim a maven repo to a common base path. This is typically +168 * [drive]\[repo_location]\repository\[path1]\[path2]. +169 * +170 * @param path the path to trim +171 * @return a string representing the base path. +172 */ +173 private String getBaseRepoPath(final String path) { +174 int pos = path.indexOf("repository" + File.separator) + 11; +175 if (pos < 0) { +176 return path; +177 } +178 int tmp = path.indexOf(File.separator, pos); +179 if (tmp <= 0) { +180 return path; +181 } +182 if (tmp > 0) { +183 pos = tmp + 1; +184 } +185 tmp = path.indexOf(File.separator, pos); +186 if (tmp > 0) { +187 pos = tmp + 1; +188 } +189 return path.substring(0, pos); +190 } +191 +192 /** +193 * Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar. +194 * +195 * @param dependency1 a dependency2 to compare +196 * @param dependency2 a dependency2 to compare +197 * @return true if the identifiers in the two supplied dependencies are equal +198 */ +199 private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) { +200 if (dependency1 == null || dependency1.getFileName() == null +201 || dependency2 == null || dependency2.getFileName() == null) { +202 return false; +203 } +204 String fileName1 = dependency1.getFileName(); +205 String fileName2 = dependency2.getFileName(); +206 +207 //update to deal with archive analyzer, the starting name maybe the same +208 // as this is incorrectly looking at the starting path +209 final File one = new File(fileName1); +210 final File two = new File(fileName2); +211 final String oneParent = one.getParent(); +212 final String twoParent = two.getParent(); +213 if (oneParent != null) { +214 if (oneParent.equals(twoParent)) { +215 fileName1 = one.getName(); +216 fileName2 = two.getName(); +217 } else { +218 return false; +219 } +220 } else if (twoParent != null) { +221 return false; +222 } +223 +224 //version check +225 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1); +226 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2); +227 if (version1 != null && version2 != null) { +228 if (!version1.equals(version2)) { +229 return false; +230 } +231 } +232 +233 //filename check +234 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1); +235 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2); +236 if (match1.find() && match2.find()) { +237 return match1.group().equals(match2.group()); +238 } +239 +240 return false; +241 } +242 +243 /** +244 * Returns true if the CPE identifiers in the two supplied dependencies are equal. +245 * +246 * @param dependency1 a dependency2 to compare +247 * @param dependency2 a dependency2 to compare +248 * @return true if the identifiers in the two supplied dependencies are equal +249 */ +250 private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) { +251 if (dependency1 == null || dependency1.getIdentifiers() == null +252 || dependency2 == null || dependency2.getIdentifiers() == null) { +253 return false; +254 } +255 boolean matches = false; +256 int cpeCount1 = 0; +257 int cpeCount2 = 0; +258 for (Identifier i : dependency1.getIdentifiers()) { 259 if ("cpe".equals(i.getType())) { -260 cpeCount2 += 1; +260 cpeCount1 += 1; 261 } 262 } -263 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) { -264 for (Identifier i : dependency1.getIdentifiers()) { -265 matches |= dependency2.getIdentifiers().contains(i); -266 if (!matches) { -267 break; -268 } -269 } -270 } -271 if (LogUtils.isVerboseLoggingEnabled()) { -272 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName()); -273 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg); -274 } -275 return matches; -276 } -277 -278 /** -279 * Determines if the two dependencies have the same base path. -280 * -281 * @param dependency1 a Dependency object -282 * @param dependency2 a Dependency object -283 * @return true if the base paths of the dependencies are identical -284 */ -285 private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) { -286 if (dependency1 == null || dependency2 == null) { -287 return false; -288 } -289 final File lFile = new File(dependency1.getFilePath()); -290 String left = lFile.getParent(); -291 final File rFile = new File(dependency2.getFilePath()); -292 String right = rFile.getParent(); -293 if (left == null) { -294 return right == null; -295 } -296 if (left.equalsIgnoreCase(right)) { -297 return true; -298 } -299 if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) { -300 left = getBaseRepoPath(left); -301 right = getBaseRepoPath(right); -302 } -303 if (left.equalsIgnoreCase(right)) { -304 return true; -305 } -306 //new code -307 for (Dependency child : dependency2.getRelatedDependencies()) { -308 if (hasSameBasePath(dependency1, child)) { -309 return true; -310 } -311 } -312 return false; -313 } -314 -315 /** -316 * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison -317 * to the 'right' library. -318 * -319 * @param left the dependency to test -320 * @param right the dependency to test against -321 * @return a boolean indicating whether or not the left dependency should be considered the "core" version. -322 */ -323 boolean isCore(Dependency left, Dependency right) { -324 final String leftName = left.getFileName().toLowerCase(); -325 final String rightName = right.getFileName().toLowerCase(); -326 -327 final boolean returnVal; -328 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") -329 || rightName.contains("core") && !leftName.contains("core") -330 || rightName.contains("kernel") && !leftName.contains("kernel")) { -331 returnVal = false; -332 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") -333 || !rightName.contains("core") && leftName.contains("core") -334 || !rightName.contains("kernel") && leftName.contains("kernel")) { -335 returnVal = true; -336 } else { -337 /* -338 * considered splitting the names up and comparing the components, -339 * but decided that the file name length should be sufficient as the -340 * "core" component, if this follows a normal naming protocol should -341 * be shorter: -342 * axis2-saaj-1.4.1.jar -343 * axis2-1.4.1.jar <----- -344 * axis2-kernal-1.4.1.jar -345 */ -346 returnVal = leftName.length() <= rightName.length(); -347 } -348 if (LogUtils.isVerboseLoggingEnabled()) { -349 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName()); -350 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg); -351 } -352 return returnVal; -353 } -354 -355 /** -356 * Compares the SHA1 hashes of two dependencies to determine if they are equal. -357 * -358 * @param dependency1 a dependency object to compare -359 * @param dependency2 a dependency object to compare -360 * @return true if the sha1 hashes of the two dependencies match; otherwise false -361 */ -362 private boolean hashesMatch(Dependency dependency1, Dependency dependency2) { -363 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) { -364 return false; -365 } -366 return dependency1.getSha1sum().equals(dependency2.getSha1sum()); -367 } -368 -369 /** -370 * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml -371 * dependency should be removed. -372 * -373 * @param dependency a dependency to check -374 * @param nextDependency another dependency to check -375 * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match; -376 * otherwise false -377 */ -378 private boolean isShadedJar(Dependency dependency, Dependency nextDependency) { -379 final String mainName = dependency.getFileName().toLowerCase(); -380 final String nextName = nextDependency.getFileName().toLowerCase(); -381 if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) { -382 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers()); -383 } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) { -384 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers()); -385 } -386 return false; -387 } -388 } +263 for (Identifier i : dependency2.getIdentifiers()) { +264 if ("cpe".equals(i.getType())) { +265 cpeCount2 += 1; +266 } +267 } +268 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) { +269 for (Identifier i : dependency1.getIdentifiers()) { +270 matches |= dependency2.getIdentifiers().contains(i); +271 if (!matches) { +272 break; +273 } +274 } +275 } +276 if (LogUtils.isVerboseLoggingEnabled()) { +277 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName()); +278 LOGGER.log(Level.FINE, msg); +279 } +280 return matches; +281 } +282 +283 /** +284 * Determines if the two dependencies have the same base path. +285 * +286 * @param dependency1 a Dependency object +287 * @param dependency2 a Dependency object +288 * @return true if the base paths of the dependencies are identical +289 */ +290 private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) { +291 if (dependency1 == null || dependency2 == null) { +292 return false; +293 } +294 final File lFile = new File(dependency1.getFilePath()); +295 String left = lFile.getParent(); +296 final File rFile = new File(dependency2.getFilePath()); +297 String right = rFile.getParent(); +298 if (left == null) { +299 return right == null; +300 } +301 if (left.equalsIgnoreCase(right)) { +302 return true; +303 } +304 if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) { +305 left = getBaseRepoPath(left); +306 right = getBaseRepoPath(right); +307 } +308 if (left.equalsIgnoreCase(right)) { +309 return true; +310 } +311 //new code +312 for (Dependency child : dependency2.getRelatedDependencies()) { +313 if (hasSameBasePath(dependency1, child)) { +314 return true; +315 } +316 } +317 return false; +318 } +319 +320 /** +321 * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison +322 * to the 'right' library. +323 * +324 * @param left the dependency to test +325 * @param right the dependency to test against +326 * @return a boolean indicating whether or not the left dependency should be considered the "core" version. +327 */ +328 boolean isCore(Dependency left, Dependency right) { +329 final String leftName = left.getFileName().toLowerCase(); +330 final String rightName = right.getFileName().toLowerCase(); +331 +332 final boolean returnVal; +333 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") +334 || rightName.contains("core") && !leftName.contains("core") +335 || rightName.contains("kernel") && !leftName.contains("kernel")) { +336 returnVal = false; +337 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") +338 || !rightName.contains("core") && leftName.contains("core") +339 || !rightName.contains("kernel") && leftName.contains("kernel")) { +340 returnVal = true; +341 } else { +342 /* +343 * considered splitting the names up and comparing the components, +344 * but decided that the file name length should be sufficient as the +345 * "core" component, if this follows a normal naming protocol should +346 * be shorter: +347 * axis2-saaj-1.4.1.jar +348 * axis2-1.4.1.jar <----- +349 * axis2-kernel-1.4.1.jar +350 */ +351 returnVal = leftName.length() <= rightName.length(); +352 } +353 if (LogUtils.isVerboseLoggingEnabled()) { +354 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName()); +355 LOGGER.log(Level.FINE, msg); +356 } +357 return returnVal; +358 } +359 +360 /** +361 * Compares the SHA1 hashes of two dependencies to determine if they are equal. +362 * +363 * @param dependency1 a dependency object to compare +364 * @param dependency2 a dependency object to compare +365 * @return true if the sha1 hashes of the two dependencies match; otherwise false +366 */ +367 private boolean hashesMatch(Dependency dependency1, Dependency dependency2) { +368 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) { +369 return false; +370 } +371 return dependency1.getSha1sum().equals(dependency2.getSha1sum()); +372 } +373 +374 /** +375 * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml +376 * dependency should be removed. +377 * +378 * @param dependency a dependency to check +379 * @param nextDependency another dependency to check +380 * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match; +381 * otherwise false +382 */ +383 private boolean isShadedJar(Dependency dependency, Dependency nextDependency) { +384 final String mainName = dependency.getFileName().toLowerCase(); +385 final String nextName = nextDependency.getFileName().toLowerCase(); +386 if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) { +387 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers()); +388 } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) { +389 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers()); +390 } +391 return false; +392 } +393 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html index ada0c4d73..5719b4712 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html @@ -50,308 +50,310 @@ 42 */ 43 public class FalsePositiveAnalyzer extends AbstractAnalyzer { 44 -45 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> -46 /** -47 * The name of the analyzer. -48 */ -49 private static final String ANALYZER_NAME = "False Positive Analyzer"; +45 /** +46 * The Logger. +47 */ +48 private static final Logger LOGGER = Logger.getLogger(FalsePositiveAnalyzer.class.getName()); +49 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> 50 /** -51 * The phase that this analyzer is intended to run in. +51 * The name of the analyzer. 52 */ -53 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; -54 -55 /** -56 * Returns the name of the analyzer. -57 * -58 * @return the name of the analyzer. -59 */ -60 public String getName() { -61 return ANALYZER_NAME; -62 } -63 -64 /** -65 * Returns the phase that the analyzer is intended to run in. -66 * -67 * @return the phase that the analyzer is intended to run in. -68 */ -69 public AnalysisPhase getAnalysisPhase() { -70 return ANALYSIS_PHASE; -71 } -72 //</editor-fold> -73 -74 /** -75 * Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics. -76 * -77 * @param dependency the dependency to analyze. -78 * @param engine the engine that is scanning the dependencies -79 * @throws AnalysisException is thrown if there is an error reading the JAR file. -80 */ -81 @Override -82 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -83 removeJreEntries(dependency); -84 removeBadMatches(dependency); -85 removeWrongVersionMatches(dependency); -86 removeSpuriousCPE(dependency); -87 addFalseNegativeCPEs(dependency); -88 } -89 -90 /** -91 * <p> -92 * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p> -93 * <p> -94 * Example:</p> -95 * <code> -96 * cpe:/a:some-vendor:some-product -97 * cpe:/a:some-vendor:some-product:1.5 -98 * cpe:/a:some-vendor:some-product:1.5.2 -99 * </code> -100 * <p> -101 * Should be trimmed to:</p> -102 * <code> -103 * cpe:/a:some-vendor:some-product:1.5.2 -104 * </code> -105 * -106 * @param dependency the dependency being analyzed -107 */ -108 @SuppressWarnings("null") -109 private void removeSpuriousCPE(Dependency dependency) { -110 final List<Identifier> ids = new ArrayList<Identifier>(); -111 ids.addAll(dependency.getIdentifiers()); -112 Collections.sort(ids); -113 final ListIterator<Identifier> mainItr = ids.listIterator(); -114 while (mainItr.hasNext()) { -115 final Identifier currentId = mainItr.next(); -116 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue()); -117 if (currentCpe == null) { -118 continue; -119 } -120 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex()); -121 while (subItr.hasNext()) { -122 final Identifier nextId = subItr.next(); -123 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue()); -124 if (nextCpe == null) { -125 continue; -126 } -127 //TODO fix the version problem below -128 if (currentCpe.getVendor().equals(nextCpe.getVendor())) { -129 if (currentCpe.getProduct().equals(nextCpe.getProduct())) { -130 // see if one is contained in the other.. remove the contained one from dependency.getIdentifier -131 final String currentVersion = currentCpe.getVersion(); -132 final String nextVersion = nextCpe.getVersion(); -133 if (currentVersion == null && nextVersion == null) { -134 //how did we get here? -135 Logger.getLogger(FalsePositiveAnalyzer.class -136 .getName()).log(Level.FINE, "currentVersion and nextVersion are both null?"); -137 } else if (currentVersion == null && nextVersion != null) { -138 dependency.getIdentifiers().remove(currentId); -139 } else if (nextVersion == null && currentVersion != null) { -140 dependency.getIdentifiers().remove(nextId); -141 } else if (currentVersion.length() < nextVersion.length()) { -142 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) { -143 dependency.getIdentifiers().remove(currentId); -144 } -145 } else { -146 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) { -147 dependency.getIdentifiers().remove(nextId); -148 } -149 } -150 } -151 } -152 } -153 } -154 } -155 /** -156 * Regex to identify core java libraries and a few other commonly misidentified ones. -157 */ -158 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" -159 + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" -160 + "jdk|jre|jsf|jsse)($|:.*)"); -161 /** -162 * Regex to identify core java library files. This is currently incomplete. -163 */ -164 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); -165 -166 /** -167 * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar -168 * -169 * @param dependency the dependency to remove JRE CPEs from -170 */ -171 private void removeJreEntries(Dependency dependency) { -172 final Set<Identifier> identifiers = dependency.getIdentifiers(); -173 final Iterator<Identifier> itr = identifiers.iterator(); -174 while (itr.hasNext()) { -175 final Identifier i = itr.next(); -176 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue()); -177 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName()); -178 if (coreCPE.matches() && !coreFiles.matches()) { -179 itr.remove(); -180 } -181 -182 //replacecd with the regex above. -183 // if (("cpe:/a:sun:java".equals(i.getValue()) -184 // || "cpe:/a:oracle:java".equals(i.getValue()) -185 // || "cpe:/a:ibm:java".equals(i.getValue()) -186 // || "cpe:/a:sun:j2se".equals(i.getValue()) -187 // || "cpe:/a:oracle:j2se".equals(i.getValue()) -188 // || i.getValue().startsWith("cpe:/a:sun:java:") -189 // || i.getValue().startsWith("cpe:/a:sun:j2se:") -190 // || i.getValue().startsWith("cpe:/a:sun:java:jre") -191 // || i.getValue().startsWith("cpe:/a:sun:java:jdk") -192 // || i.getValue().startsWith("cpe:/a:sun:java_se") -193 // || i.getValue().startsWith("cpe:/a:oracle:java_se") -194 // || i.getValue().startsWith("cpe:/a:oracle:java:") -195 // || i.getValue().startsWith("cpe:/a:oracle:j2se:") -196 // || i.getValue().startsWith("cpe:/a:oracle:jre") -197 // || i.getValue().startsWith("cpe:/a:oracle:jdk") -198 // || i.getValue().startsWith("cpe:/a:ibm:java:")) -199 // && !dependency.getFileName().toLowerCase().endsWith("rt.jar")) { -200 // itr.remove(); -201 // } -202 } -203 } -204 -205 /** -206 * Parses a CPE string into an IndexEntry. -207 * -208 * @param type the type of identifier -209 * @param value the cpe identifier to parse -210 * @return an VulnerableSoftware object constructed from the identifier -211 */ -212 private VulnerableSoftware parseCpe(String type, String value) { -213 if (!"cpe".equals(type)) { -214 return null; -215 } -216 final VulnerableSoftware cpe = new VulnerableSoftware(); -217 try { -218 cpe.parseName(value); -219 } catch (UnsupportedEncodingException ex) { -220 Logger.getLogger(FalsePositiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); -221 return null; -222 } -223 return cpe; -224 } -225 -226 /** -227 * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific -228 * problems identified when testing this on a LARGE volume of jar files. -229 * -230 * @param dependency the dependency to analyze -231 */ -232 private void removeBadMatches(Dependency dependency) { -233 final Set<Identifier> identifiers = dependency.getIdentifiers(); -234 final Iterator<Identifier> itr = identifiers.iterator(); -235 -236 /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of -237 * these are due to low quality data. Other idea would be to say any CPE -238 * found based on LOW confidence evidence should have a different CPE type? (this -239 * might be a better solution then just removing the URL for "best-guess" matches). -240 */ -241 //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); -242 //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); -243 while (itr.hasNext()) { -244 final Identifier i = itr.next(); -245 //TODO move this startswith expression to a configuration file? -246 if ("cpe".equals(i.getType())) { -247 if ((i.getValue().matches(".*c\\+\\+.*") -248 || i.getValue().startsWith("cpe:/a:jquery:jquery") -249 || i.getValue().startsWith("cpe:/a:prototypejs:prototype") -250 || i.getValue().startsWith("cpe:/a:yahoo:yui") -251 || i.getValue().startsWith("cpe:/a:file:file") -252 || i.getValue().startsWith("cpe:/a:mozilla:mozilla") -253 || i.getValue().startsWith("cpe:/a:cvs:cvs") -254 || i.getValue().startsWith("cpe:/a:ftp:ftp") -255 || i.getValue().startsWith("cpe:/a:ssh:ssh")) -256 && (dependency.getFileName().toLowerCase().endsWith(".jar") -257 || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { -258 itr.remove(); -259 } else if (i.getValue().startsWith("cpe:/a:apache:maven") -260 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { +53 private static final String ANALYZER_NAME = "False Positive Analyzer"; +54 /** +55 * The phase that this analyzer is intended to run in. +56 */ +57 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; +58 +59 /** +60 * Returns the name of the analyzer. +61 * +62 * @return the name of the analyzer. +63 */ +64 public String getName() { +65 return ANALYZER_NAME; +66 } +67 +68 /** +69 * Returns the phase that the analyzer is intended to run in. +70 * +71 * @return the phase that the analyzer is intended to run in. +72 */ +73 public AnalysisPhase getAnalysisPhase() { +74 return ANALYSIS_PHASE; +75 } +76 //</editor-fold> +77 +78 /** +79 * Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics. +80 * +81 * @param dependency the dependency to analyze. +82 * @param engine the engine that is scanning the dependencies +83 * @throws AnalysisException is thrown if there is an error reading the JAR file. +84 */ +85 @Override +86 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +87 removeJreEntries(dependency); +88 removeBadMatches(dependency); +89 removeWrongVersionMatches(dependency); +90 removeSpuriousCPE(dependency); +91 addFalseNegativeCPEs(dependency); +92 } +93 +94 /** +95 * <p> +96 * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p> +97 * <p> +98 * Example:</p> +99 * <code> +100 * cpe:/a:some-vendor:some-product +101 * cpe:/a:some-vendor:some-product:1.5 +102 * cpe:/a:some-vendor:some-product:1.5.2 +103 * </code> +104 * <p> +105 * Should be trimmed to:</p> +106 * <code> +107 * cpe:/a:some-vendor:some-product:1.5.2 +108 * </code> +109 * +110 * @param dependency the dependency being analyzed +111 */ +112 @SuppressWarnings("null") +113 private void removeSpuriousCPE(Dependency dependency) { +114 final List<Identifier> ids = new ArrayList<Identifier>(); +115 ids.addAll(dependency.getIdentifiers()); +116 Collections.sort(ids); +117 final ListIterator<Identifier> mainItr = ids.listIterator(); +118 while (mainItr.hasNext()) { +119 final Identifier currentId = mainItr.next(); +120 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue()); +121 if (currentCpe == null) { +122 continue; +123 } +124 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex()); +125 while (subItr.hasNext()) { +126 final Identifier nextId = subItr.next(); +127 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue()); +128 if (nextCpe == null) { +129 continue; +130 } +131 //TODO fix the version problem below +132 if (currentCpe.getVendor().equals(nextCpe.getVendor())) { +133 if (currentCpe.getProduct().equals(nextCpe.getProduct())) { +134 // see if one is contained in the other.. remove the contained one from dependency.getIdentifier +135 final String currentVersion = currentCpe.getVersion(); +136 final String nextVersion = nextCpe.getVersion(); +137 if (currentVersion == null && nextVersion == null) { +138 //how did we get here? +139 LOGGER.log(Level.FINE, "currentVersion and nextVersion are both null?"); +140 } else if (currentVersion == null && nextVersion != null) { +141 dependency.getIdentifiers().remove(currentId); +142 } else if (nextVersion == null && currentVersion != null) { +143 dependency.getIdentifiers().remove(nextId); +144 } else if (currentVersion.length() < nextVersion.length()) { +145 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) { +146 dependency.getIdentifiers().remove(currentId); +147 } +148 } else { +149 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) { +150 dependency.getIdentifiers().remove(nextId); +151 } +152 } +153 } +154 } +155 } +156 } +157 } +158 /** +159 * Regex to identify core java libraries and a few other commonly misidentified ones. +160 */ +161 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" +162 + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" +163 + "jdk|jre|jsf|jsse)($|:.*)"); +164 /** +165 * Regex to identify core java library files. This is currently incomplete. +166 */ +167 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); +168 +169 /** +170 * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar +171 * +172 * @param dependency the dependency to remove JRE CPEs from +173 */ +174 private void removeJreEntries(Dependency dependency) { +175 final Set<Identifier> identifiers = dependency.getIdentifiers(); +176 final Iterator<Identifier> itr = identifiers.iterator(); +177 while (itr.hasNext()) { +178 final Identifier i = itr.next(); +179 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue()); +180 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName()); +181 if (coreCPE.matches() && !coreFiles.matches()) { +182 itr.remove(); +183 } +184 +185 //replaced with the regex above. +186 // if (("cpe:/a:sun:java".equals(i.getValue()) +187 // || "cpe:/a:oracle:java".equals(i.getValue()) +188 // || "cpe:/a:ibm:java".equals(i.getValue()) +189 // || "cpe:/a:sun:j2se".equals(i.getValue()) +190 // || "cpe:/a:oracle:j2se".equals(i.getValue()) +191 // || i.getValue().startsWith("cpe:/a:sun:java:") +192 // || i.getValue().startsWith("cpe:/a:sun:j2se:") +193 // || i.getValue().startsWith("cpe:/a:sun:java:jre") +194 // || i.getValue().startsWith("cpe:/a:sun:java:jdk") +195 // || i.getValue().startsWith("cpe:/a:sun:java_se") +196 // || i.getValue().startsWith("cpe:/a:oracle:java_se") +197 // || i.getValue().startsWith("cpe:/a:oracle:java:") +198 // || i.getValue().startsWith("cpe:/a:oracle:j2se:") +199 // || i.getValue().startsWith("cpe:/a:oracle:jre") +200 // || i.getValue().startsWith("cpe:/a:oracle:jdk") +201 // || i.getValue().startsWith("cpe:/a:ibm:java:")) +202 // && !dependency.getFileName().toLowerCase().endsWith("rt.jar")) { +203 // itr.remove(); +204 // } +205 } +206 } +207 +208 /** +209 * Parses a CPE string into an IndexEntry. +210 * +211 * @param type the type of identifier +212 * @param value the cpe identifier to parse +213 * @return an VulnerableSoftware object constructed from the identifier +214 */ +215 private VulnerableSoftware parseCpe(String type, String value) { +216 if (!"cpe".equals(type)) { +217 return null; +218 } +219 final VulnerableSoftware cpe = new VulnerableSoftware(); +220 try { +221 cpe.parseName(value); +222 } catch (UnsupportedEncodingException ex) { +223 LOGGER.log(Level.FINEST, null, ex); +224 return null; +225 } +226 return cpe; +227 } +228 +229 /** +230 * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific +231 * problems identified when testing this on a LARGE volume of jar files. +232 * +233 * @param dependency the dependency to analyze +234 */ +235 private void removeBadMatches(Dependency dependency) { +236 final Set<Identifier> identifiers = dependency.getIdentifiers(); +237 final Iterator<Identifier> itr = identifiers.iterator(); +238 +239 /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of +240 * these are due to low quality data. Other idea would be to say any CPE +241 * found based on LOW confidence evidence should have a different CPE type? (this +242 * might be a better solution then just removing the URL for "best-guess" matches). +243 */ +244 //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); +245 //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); +246 while (itr.hasNext()) { +247 final Identifier i = itr.next(); +248 //TODO move this startsWith expression to a configuration file? +249 if ("cpe".equals(i.getType())) { +250 if ((i.getValue().matches(".*c\\+\\+.*") +251 || i.getValue().startsWith("cpe:/a:jquery:jquery") +252 || i.getValue().startsWith("cpe:/a:prototypejs:prototype") +253 || i.getValue().startsWith("cpe:/a:yahoo:yui") +254 || i.getValue().startsWith("cpe:/a:file:file") +255 || i.getValue().startsWith("cpe:/a:mozilla:mozilla") +256 || i.getValue().startsWith("cpe:/a:cvs:cvs") +257 || i.getValue().startsWith("cpe:/a:ftp:ftp") +258 || i.getValue().startsWith("cpe:/a:ssh:ssh")) +259 && (dependency.getFileName().toLowerCase().endsWith(".jar") +260 || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { 261 itr.remove(); -262 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core") -263 && !dependency.getEvidenceUsed().containsUsedString("m-core")) { +262 } else if (i.getValue().startsWith("cpe:/a:apache:maven") +263 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { 264 itr.remove(); -265 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss") -266 && !dependency.getFileName().toLowerCase().matches("jboss-[\\d\\.]+(GA)?\\.jar")) { +265 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core") +266 && !dependency.getEvidenceUsed().containsUsedString("m-core")) { 267 itr.remove(); -268 } -269 } -270 } -271 } -272 -273 /** -274 * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. -275 * -276 * @param dependency the dependency to analyze -277 */ -278 private void removeWrongVersionMatches(Dependency dependency) { -279 final Set<Identifier> identifiers = dependency.getIdentifiers(); -280 final Iterator<Identifier> itr = identifiers.iterator(); -281 -282 final String fileName = dependency.getFileName(); -283 if (fileName != null && fileName.contains("axis2")) { -284 while (itr.hasNext()) { -285 final Identifier i = itr.next(); -286 if ("cpe".equals(i.getType())) { -287 final String cpe = i.getValue(); -288 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { -289 itr.remove(); -290 } -291 } -292 } -293 } else if (fileName != null && fileName.contains("axis")) { -294 while (itr.hasNext()) { -295 final Identifier i = itr.next(); -296 if ("cpe".equals(i.getType())) { -297 final String cpe = i.getValue(); -298 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { -299 itr.remove(); -300 } -301 } -302 } -303 } -304 } -305 -306 /** -307 * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and -308 * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete -309 * list of CVE entries. -310 * -311 * @param dependency the dependency being analyzed -312 */ -313 private void addFalseNegativeCPEs(Dependency dependency) { -314 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); -315 while (itr.hasNext()) { -316 final Identifier i = itr.next(); -317 if ("cpe".equals(i.getType()) && i.getValue() != null -318 && (i.getValue().startsWith("cpe:/a:oracle:opensso:") -319 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:") -320 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:") -321 || i.getValue().startsWith("cpe:/a:sun:opensso:"))) { -322 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22)); -323 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22)); -324 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22)); -325 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22)); -326 try { -327 dependency.addIdentifier("cpe", -328 newCpe, -329 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe, "UTF-8"))); +268 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss") +269 && !dependency.getFileName().toLowerCase().matches("jboss-[\\d\\.]+(GA)?\\.jar")) { +270 itr.remove(); +271 } +272 } +273 } +274 } +275 +276 /** +277 * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. +278 * +279 * @param dependency the dependency to analyze +280 */ +281 private void removeWrongVersionMatches(Dependency dependency) { +282 final Set<Identifier> identifiers = dependency.getIdentifiers(); +283 final Iterator<Identifier> itr = identifiers.iterator(); +284 +285 final String fileName = dependency.getFileName(); +286 if (fileName != null && fileName.contains("axis2")) { +287 while (itr.hasNext()) { +288 final Identifier i = itr.next(); +289 if ("cpe".equals(i.getType())) { +290 final String cpe = i.getValue(); +291 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { +292 itr.remove(); +293 } +294 } +295 } +296 } else if (fileName != null && fileName.contains("axis")) { +297 while (itr.hasNext()) { +298 final Identifier i = itr.next(); +299 if ("cpe".equals(i.getType())) { +300 final String cpe = i.getValue(); +301 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { +302 itr.remove(); +303 } +304 } +305 } +306 } +307 } +308 +309 /** +310 * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and +311 * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete +312 * list of CVE entries. +313 * +314 * @param dependency the dependency being analyzed +315 */ +316 private void addFalseNegativeCPEs(Dependency dependency) { +317 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +318 while (itr.hasNext()) { +319 final Identifier i = itr.next(); +320 if ("cpe".equals(i.getType()) && i.getValue() != null +321 && (i.getValue().startsWith("cpe:/a:oracle:opensso:") +322 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:") +323 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:") +324 || i.getValue().startsWith("cpe:/a:sun:opensso:"))) { +325 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22)); +326 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22)); +327 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22)); +328 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22)); +329 try { 330 dependency.addIdentifier("cpe", -331 newCpe2, -332 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe2, "UTF-8"))); +331 newCpe, +332 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe, "UTF-8"))); 333 dependency.addIdentifier("cpe", -334 newCpe3, -335 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe3, "UTF-8"))); +334 newCpe2, +335 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe2, "UTF-8"))); 336 dependency.addIdentifier("cpe", -337 newCpe4, -338 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe4, "UTF-8"))); -339 } catch (UnsupportedEncodingException ex) { -340 Logger.getLogger(FalsePositiveAnalyzer.class -341 .getName()).log(Level.FINE, null, ex); -342 } -343 } -344 } -345 } -346 } +337 newCpe3, +338 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe3, "UTF-8"))); +339 dependency.addIdentifier("cpe", +340 newCpe4, +341 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe4, "UTF-8"))); +342 } catch (UnsupportedEncodingException ex) { +343 LOGGER.log(Level.FINE, null, ex); +344 } +345 } +346 } +347 } +348 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html index 30099b545..67b9ee555 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html @@ -41,7 +41,7 @@ 33 */ 34 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer { 35 -36 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +36 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> 37 /** 38 * The name of the analyzer. 39 */ diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html index 1f598a589..c3676be6c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html @@ -40,7 +40,7 @@ 32 */ 33 public class HintAnalyzer extends AbstractAnalyzer implements Analyzer { 34 -35 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +35 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> 36 /** 37 * The name of the analyzer. 38 */ diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html index 3c2a3205d..74a4513e7 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html @@ -372,7 +372,7 @@ 364 * 365 * @param jar the JarFile to search 366 * @return a list of pom.xml entries -367 * @throws IOException thrown if there is an exception reading a JarEntryf +367 * @throws IOException thrown if there is an exception reading a JarEntry 368 */ 369 private List<String> retrievePomListing(final JarFile jar) throws IOException { 370 final List<String> pomEntries = new ArrayList<String>(); @@ -416,7 +416,7 @@ 408 bos.flush(); 409 dependency.setActualFilePath(file.getAbsolutePath()); 410 } catch (IOException ex) { -411 final String msg = String.format("An error occured reading '%s' from '%s'.", path, dependency.getFilePath()); +411 final String msg = String.format("An error occurred reading '%s' from '%s'.", path, dependency.getFilePath()); 412 LOGGER.warning(msg); 413 LOGGER.log(Level.SEVERE, "", ex); 414 } finally { @@ -504,891 +504,878 @@ 496 model = readPom(source); 497 } catch (SecurityException ex) { 498 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName()); -499 Logger -500 .getLogger(JarAnalyzer.class -501 .getName()).log(Level.WARNING, msg); -502 Logger.getLogger(JarAnalyzer.class -503 .getName()).log(Level.FINE, null, ex); -504 throw new AnalysisException(ex); -505 } catch (IOException ex) { -506 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName()); -507 LOGGER.log(Level.WARNING, msg); -508 LOGGER.log(Level.FINE, "", ex); -509 throw new AnalysisException(ex); -510 } catch (Throwable ex) { -511 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'", path, jar.getName()); -512 LOGGER.log(Level.WARNING, msg); -513 LOGGER.log(Level.FINE, "", ex); -514 throw new AnalysisException(ex); -515 } -516 } -517 return model; -518 } -519 -520 /** -521 * Retrieves the specified POM from a jar file and converts it to a Model. -522 * -523 * @param source the SAXSource input stream to read the POM from -524 * @return returns the POM object -525 * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM -526 * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object -527 */ -528 private Model readPom(SAXSource source) throws AnalysisException { -529 Model model = null; -530 try { -531 final XMLFilter filter = new MavenNamespaceFilter(); -532 final SAXParserFactory spf = SAXParserFactory.newInstance(); -533 final SAXParser sp = spf.newSAXParser(); -534 final XMLReader xr = sp.getXMLReader(); -535 filter.setParent(xr); -536 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class); -537 model = el.getValue(); -538 } catch (SecurityException ex) { -539 throw new AnalysisException(ex); -540 } catch (ParserConfigurationException ex) { -541 throw new AnalysisException(ex); -542 } catch (SAXException ex) { -543 throw new AnalysisException(ex); -544 } catch (JAXBException ex) { -545 throw new AnalysisException(ex); -546 } catch (Throwable ex) { -547 throw new AnalysisException(ex); -548 } -549 return model; -550 } -551 -552 /** -553 * Sets evidence from the pom on the supplied dependency. -554 * -555 * @param dependency the dependency to set data on -556 * @param pom the information from the pom -557 * @param pomProperties the pom properties file (null if none exists) -558 * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names -559 * within the JAR file being analyzed -560 * @return true if there was evidence within the pom that we could use; otherwise false -561 */ -562 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) { -563 boolean foundSomething = false; -564 if (pom == null) { -565 return foundSomething; -566 } -567 String groupid = interpolateString(pom.getGroupId(), pomProperties); -568 if (groupid != null && !groupid.isEmpty()) { -569 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { -570 groupid = groupid.substring(4); -571 } -572 foundSomething = true; -573 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); -574 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); -575 addMatchingValues(classes, groupid, dependency.getVendorEvidence()); -576 addMatchingValues(classes, groupid, dependency.getProductEvidence()); -577 } -578 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); -579 if (artifactid != null && !artifactid.isEmpty()) { -580 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { -581 artifactid = artifactid.substring(4); -582 } -583 foundSomething = true; -584 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); -585 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); -586 addMatchingValues(classes, artifactid, dependency.getVendorEvidence()); -587 addMatchingValues(classes, artifactid, dependency.getProductEvidence()); -588 } -589 //version -590 final String version = interpolateString(pom.getVersion(), pomProperties); -591 if (version != null && !version.isEmpty()) { -592 foundSomething = true; -593 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST); -594 } -595 // org name -596 final Organization org = pom.getOrganization(); -597 if (org != null && org.getName() != null) { -598 foundSomething = true; -599 final String orgName = interpolateString(org.getName(), pomProperties); -600 if (orgName != null && !orgName.isEmpty()) { -601 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH); -602 addMatchingValues(classes, orgName, dependency.getVendorEvidence()); -603 } -604 } -605 //pom name -606 final String pomName = interpolateString(pom.getName(), pomProperties); -607 if (pomName != null && !pomName.isEmpty()) { -608 foundSomething = true; -609 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); -610 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); -611 addMatchingValues(classes, pomName, dependency.getVendorEvidence()); -612 addMatchingValues(classes, pomName, dependency.getProductEvidence()); -613 } -614 -615 //Description -616 if (pom.getDescription() != null) { -617 foundSomething = true; -618 final String description = interpolateString(pom.getDescription(), pomProperties); -619 if (description != null && !description.isEmpty()) { -620 final String trimmedDescription = addDescription(dependency, description, "pom", "description"); -621 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence()); -622 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence()); -623 } -624 } -625 extractLicense(pom, pomProperties, dependency); -626 return foundSomething; -627 } -628 -629 /** -630 * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible -631 * vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets. -632 * -633 * @param classNames a list of class names -634 * @param dependency a dependency to analyze -635 * @param addPackagesAsEvidence a flag indicating whether or not package names should be added as evidence. -636 */ -637 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames, -638 Dependency dependency, boolean addPackagesAsEvidence) { -639 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>(); -640 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>(); -641 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers); -642 -643 final int classCount = classNames.size(); -644 final EvidenceCollection vendor = dependency.getVendorEvidence(); -645 final EvidenceCollection product = dependency.getProductEvidence(); -646 -647 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) { -648 final float ratio = entry.getValue() / (float) classCount; -649 if (ratio > 0.5) { -650 //TODO remove weighting -651 vendor.addWeighting(entry.getKey()); -652 if (addPackagesAsEvidence && entry.getKey().length() > 1) { -653 vendor.addEvidence("jar", "package", entry.getKey(), Confidence.LOW); -654 } -655 } -656 } -657 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) { -658 final float ratio = entry.getValue() / (float) classCount; -659 if (ratio > 0.5) { -660 product.addWeighting(entry.getKey()); -661 if (addPackagesAsEvidence && entry.getKey().length() > 1) { -662 product.addEvidence("jar", "package", entry.getKey(), Confidence.LOW); -663 } -664 } -665 } -666 } -667 -668 /** -669 * <p> -670 * Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:</p> -671 * <ul><li>Implementation Title</li> -672 * <li>Implementation Version</li> <li>Implementation Vendor</li> -673 * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle Version</li> <li>Bundle Vendor</li> <li>Bundle -674 * Description</li> <li>Main Class</li> </ul> -675 * However, all but a handful of specific entries are read in. -676 * -677 * @param dependency A reference to the dependency -678 * @param classInformation a collection of class information -679 * @return whether evidence was identified parsing the manifest -680 * @throws IOException if there is an issue reading the JAR file -681 */ -682 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException { -683 boolean foundSomething = false; -684 JarFile jar = null; -685 try { -686 jar = new JarFile(dependency.getActualFilePath()); -687 -688 final Manifest manifest = jar.getManifest(); -689 -690 if (manifest == null) { -691 //don't log this for javadoc or sources jar files -692 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar") -693 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar") -694 && !dependency.getFileName().toLowerCase().endsWith("-src.jar") -695 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) { -696 Logger.getLogger(JarAnalyzer.class -697 .getName()).log(Level.INFO, -698 String.format("Jar file '%s' does not contain a manifest.", -699 dependency.getFileName())); -700 } -701 return false; -702 } -703 final Attributes atts = manifest.getMainAttributes(); +499 LOGGER.log(Level.WARNING, msg); +500 LOGGER.log(Level.FINE, null, ex); +501 throw new AnalysisException(ex); +502 } catch (IOException ex) { +503 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName()); +504 LOGGER.log(Level.WARNING, msg); +505 LOGGER.log(Level.FINE, "", ex); +506 throw new AnalysisException(ex); +507 } catch (Throwable ex) { +508 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'", path, jar.getName()); +509 LOGGER.log(Level.WARNING, msg); +510 LOGGER.log(Level.FINE, "", ex); +511 throw new AnalysisException(ex); +512 } +513 } +514 return model; +515 } +516 +517 /** +518 * Retrieves the specified POM from a jar file and converts it to a Model. +519 * +520 * @param source the SAXSource input stream to read the POM from +521 * @return returns the POM object +522 * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM +523 * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object +524 */ +525 private Model readPom(SAXSource source) throws AnalysisException { +526 Model model = null; +527 try { +528 final XMLFilter filter = new MavenNamespaceFilter(); +529 final SAXParserFactory spf = SAXParserFactory.newInstance(); +530 final SAXParser sp = spf.newSAXParser(); +531 final XMLReader xr = sp.getXMLReader(); +532 filter.setParent(xr); +533 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class); +534 model = el.getValue(); +535 } catch (SecurityException ex) { +536 throw new AnalysisException(ex); +537 } catch (ParserConfigurationException ex) { +538 throw new AnalysisException(ex); +539 } catch (SAXException ex) { +540 throw new AnalysisException(ex); +541 } catch (JAXBException ex) { +542 throw new AnalysisException(ex); +543 } catch (Throwable ex) { +544 throw new AnalysisException(ex); +545 } +546 return model; +547 } +548 +549 /** +550 * Sets evidence from the pom on the supplied dependency. +551 * +552 * @param dependency the dependency to set data on +553 * @param pom the information from the pom +554 * @param pomProperties the pom properties file (null if none exists) +555 * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names +556 * within the JAR file being analyzed +557 * @return true if there was evidence within the pom that we could use; otherwise false +558 */ +559 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) { +560 boolean foundSomething = false; +561 if (pom == null) { +562 return foundSomething; +563 } +564 String groupid = interpolateString(pom.getGroupId(), pomProperties); +565 if (groupid != null && !groupid.isEmpty()) { +566 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { +567 groupid = groupid.substring(4); +568 } +569 foundSomething = true; +570 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); +571 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); +572 addMatchingValues(classes, groupid, dependency.getVendorEvidence()); +573 addMatchingValues(classes, groupid, dependency.getProductEvidence()); +574 } +575 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); +576 if (artifactid != null && !artifactid.isEmpty()) { +577 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { +578 artifactid = artifactid.substring(4); +579 } +580 foundSomething = true; +581 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); +582 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); +583 addMatchingValues(classes, artifactid, dependency.getVendorEvidence()); +584 addMatchingValues(classes, artifactid, dependency.getProductEvidence()); +585 } +586 //version +587 final String version = interpolateString(pom.getVersion(), pomProperties); +588 if (version != null && !version.isEmpty()) { +589 foundSomething = true; +590 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST); +591 } +592 // org name +593 final Organization org = pom.getOrganization(); +594 if (org != null && org.getName() != null) { +595 foundSomething = true; +596 final String orgName = interpolateString(org.getName(), pomProperties); +597 if (orgName != null && !orgName.isEmpty()) { +598 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH); +599 addMatchingValues(classes, orgName, dependency.getVendorEvidence()); +600 } +601 } +602 //pom name +603 final String pomName = interpolateString(pom.getName(), pomProperties); +604 if (pomName != null && !pomName.isEmpty()) { +605 foundSomething = true; +606 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +607 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +608 addMatchingValues(classes, pomName, dependency.getVendorEvidence()); +609 addMatchingValues(classes, pomName, dependency.getProductEvidence()); +610 } +611 +612 //Description +613 if (pom.getDescription() != null) { +614 foundSomething = true; +615 final String description = interpolateString(pom.getDescription(), pomProperties); +616 if (description != null && !description.isEmpty()) { +617 final String trimmedDescription = addDescription(dependency, description, "pom", "description"); +618 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence()); +619 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence()); +620 } +621 } +622 extractLicense(pom, pomProperties, dependency); +623 return foundSomething; +624 } +625 +626 /** +627 * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible +628 * vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets. +629 * +630 * @param classNames a list of class names +631 * @param dependency a dependency to analyze +632 * @param addPackagesAsEvidence a flag indicating whether or not package names should be added as evidence. +633 */ +634 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames, +635 Dependency dependency, boolean addPackagesAsEvidence) { +636 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>(); +637 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>(); +638 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers); +639 +640 final int classCount = classNames.size(); +641 final EvidenceCollection vendor = dependency.getVendorEvidence(); +642 final EvidenceCollection product = dependency.getProductEvidence(); +643 +644 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) { +645 final float ratio = entry.getValue() / (float) classCount; +646 if (ratio > 0.5) { +647 //TODO remove weighting +648 vendor.addWeighting(entry.getKey()); +649 if (addPackagesAsEvidence && entry.getKey().length() > 1) { +650 vendor.addEvidence("jar", "package", entry.getKey(), Confidence.LOW); +651 } +652 } +653 } +654 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) { +655 final float ratio = entry.getValue() / (float) classCount; +656 if (ratio > 0.5) { +657 product.addWeighting(entry.getKey()); +658 if (addPackagesAsEvidence && entry.getKey().length() > 1) { +659 product.addEvidence("jar", "package", entry.getKey(), Confidence.LOW); +660 } +661 } +662 } +663 } +664 +665 /** +666 * <p> +667 * Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:</p> +668 * <ul><li>Implementation Title</li> +669 * <li>Implementation Version</li> <li>Implementation Vendor</li> +670 * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle Version</li> <li>Bundle Vendor</li> <li>Bundle +671 * Description</li> <li>Main Class</li> </ul> +672 * However, all but a handful of specific entries are read in. +673 * +674 * @param dependency A reference to the dependency +675 * @param classInformation a collection of class information +676 * @return whether evidence was identified parsing the manifest +677 * @throws IOException if there is an issue reading the JAR file +678 */ +679 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException { +680 boolean foundSomething = false; +681 JarFile jar = null; +682 try { +683 jar = new JarFile(dependency.getActualFilePath()); +684 +685 final Manifest manifest = jar.getManifest(); +686 +687 if (manifest == null) { +688 //don't log this for javadoc or sources jar files +689 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar") +690 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar") +691 && !dependency.getFileName().toLowerCase().endsWith("-src.jar") +692 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) { +693 LOGGER.log(Level.INFO, +694 String.format("Jar file '%s' does not contain a manifest.", +695 dependency.getFileName())); +696 } +697 return false; +698 } +699 final Attributes atts = manifest.getMainAttributes(); +700 +701 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence(); +702 final EvidenceCollection productEvidence = dependency.getProductEvidence(); +703 final EvidenceCollection versionEvidence = dependency.getVersionEvidence(); 704 -705 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence(); -706 final EvidenceCollection productEvidence = dependency.getProductEvidence(); -707 final EvidenceCollection versionEvidence = dependency.getVersionEvidence(); -708 -709 final String source = "Manifest"; -710 -711 for (Entry<Object, Object> entry : atts.entrySet()) { -712 String key = entry.getKey().toString(); -713 String value = atts.getValue(key); -714 if (HTML_DETECTION_PATTERN.matcher(value).find()) { -715 value = Jsoup.parse(value).text(); -716 } -717 if (IGNORE_VALUES.contains(value)) { -718 continue; -719 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) { +705 final String source = "Manifest"; +706 +707 for (Entry<Object, Object> entry : atts.entrySet()) { +708 String key = entry.getKey().toString(); +709 String value = atts.getValue(key); +710 if (HTML_DETECTION_PATTERN.matcher(value).find()) { +711 value = Jsoup.parse(value).text(); +712 } +713 if (IGNORE_VALUES.contains(value)) { +714 continue; +715 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) { +716 foundSomething = true; +717 productEvidence.addEvidence(source, key, value, Confidence.HIGH); +718 addMatchingValues(classInformation, value, productEvidence); +719 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) { 720 foundSomething = true; -721 productEvidence.addEvidence(source, key, value, Confidence.HIGH); -722 addMatchingValues(classInformation, value, productEvidence); -723 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) { -724 foundSomething = true; -725 versionEvidence.addEvidence(source, key, value, Confidence.HIGH); -726 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) { +721 versionEvidence.addEvidence(source, key, value, Confidence.HIGH); +722 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) { +723 foundSomething = true; +724 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH); +725 addMatchingValues(classInformation, value, vendorEvidence); +726 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) { 727 foundSomething = true; -728 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH); +728 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); 729 addMatchingValues(classInformation, value, vendorEvidence); -730 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) { +730 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) { 731 foundSomething = true; -732 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -733 addMatchingValues(classInformation, value, vendorEvidence); -734 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) { -735 foundSomething = true; -736 addDescription(dependency, value, "manifest", key); -737 //productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +732 addDescription(dependency, value, "manifest", key); +733 //productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +734 addMatchingValues(classInformation, value, productEvidence); +735 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) { +736 foundSomething = true; +737 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); 738 addMatchingValues(classInformation, value, productEvidence); -739 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) { +739 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) { 740 foundSomething = true; -741 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -742 addMatchingValues(classInformation, value, productEvidence); -743 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) { +741 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH); +742 addMatchingValues(classInformation, value, vendorEvidence); +743 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) { 744 foundSomething = true; -745 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH); -746 addMatchingValues(classInformation, value, vendorEvidence); -747 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) { -748 foundSomething = true; -749 versionEvidence.addEvidence(source, key, value, Confidence.HIGH); -750 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) { -751 continue; -752 //skipping main class as if this has important information to add -753 // it will be added during class name analysis... if other fields -754 // have the information from the class name then they will get added... -755 // foundSomething = true; -756 // productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -757 // vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -758 // addMatchingValues(classInformation, value, vendorEvidence); -759 // addMatchingValues(classInformation, value, productEvidence); -760 } else { -761 key = key.toLowerCase(); -762 -763 if (!IGNORE_KEYS.contains(key) -764 && !key.endsWith("jdk") -765 && !key.contains("lastmodified") -766 && !key.endsWith("package") -767 && !key.endsWith("classpath") -768 && !key.endsWith("class-path") -769 && !key.endsWith("-scm") //todo change this to a regex? -770 && !key.startsWith("scm-") -771 && !isImportPackage(key, value) -772 && !isPackage(key, value)) { -773 -774 foundSomething = true; -775 if (key.contains("version")) { -776 if (key.contains("specification")) { -777 versionEvidence.addEvidence(source, key, value, Confidence.LOW); -778 } else { -779 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -780 } -781 } else if ("build-id".equals(key)) { -782 int pos = value.indexOf('('); +745 versionEvidence.addEvidence(source, key, value, Confidence.HIGH); +746 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) { +747 continue; +748 //skipping main class as if this has important information to add +749 // it will be added during class name analysis... if other fields +750 // have the information from the class name then they will get added... +751 // foundSomething = true; +752 // productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +753 // vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +754 // addMatchingValues(classInformation, value, vendorEvidence); +755 // addMatchingValues(classInformation, value, productEvidence); +756 } else { +757 key = key.toLowerCase(); +758 +759 if (!IGNORE_KEYS.contains(key) +760 && !key.endsWith("jdk") +761 && !key.contains("lastmodified") +762 && !key.endsWith("package") +763 && !key.endsWith("classpath") +764 && !key.endsWith("class-path") +765 && !key.endsWith("-scm") //todo change this to a regex? +766 && !key.startsWith("scm-") +767 && !isImportPackage(key, value) +768 && !isPackage(key, value)) { +769 +770 foundSomething = true; +771 if (key.contains("version")) { +772 if (key.contains("specification")) { +773 versionEvidence.addEvidence(source, key, value, Confidence.LOW); +774 } else { +775 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +776 } +777 } else if ("build-id".equals(key)) { +778 int pos = value.indexOf('('); +779 if (pos >= 0) { +780 value = value.substring(0, pos - 1); +781 } +782 pos = value.indexOf('['); 783 if (pos >= 0) { 784 value = value.substring(0, pos - 1); 785 } -786 pos = value.indexOf('['); -787 if (pos >= 0) { -788 value = value.substring(0, pos - 1); -789 } -790 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -791 } else if (key.contains("title")) { -792 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -793 addMatchingValues(classInformation, value, productEvidence); -794 } else if (key.contains("vendor")) { -795 if (key.contains("specification")) { -796 vendorEvidence.addEvidence(source, key, value, Confidence.LOW); -797 } else { -798 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -799 addMatchingValues(classInformation, value, vendorEvidence); -800 } -801 } else if (key.contains("name")) { -802 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -803 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); -804 addMatchingValues(classInformation, value, vendorEvidence); -805 addMatchingValues(classInformation, value, productEvidence); -806 } else if (key.contains("license")) { -807 addLicense(dependency, value); -808 } else { -809 if (key.contains("description")) { -810 addDescription(dependency, value, "manifest", key); -811 } else { -812 productEvidence.addEvidence(source, key, value, Confidence.LOW); -813 vendorEvidence.addEvidence(source, key, value, Confidence.LOW); -814 addMatchingValues(classInformation, value, vendorEvidence); -815 addMatchingValues(classInformation, value, productEvidence); -816 if (value.matches(".*\\d.*")) { -817 final StringTokenizer tokenizer = new StringTokenizer(value, " "); -818 while (tokenizer.hasMoreElements()) { -819 final String s = tokenizer.nextToken(); -820 if (s.matches("^[0-9.]+$")) { -821 versionEvidence.addEvidence(source, key, s, Confidence.LOW); -822 } -823 } -824 } -825 } -826 } -827 } -828 } +786 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +787 } else if (key.contains("title")) { +788 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +789 addMatchingValues(classInformation, value, productEvidence); +790 } else if (key.contains("vendor")) { +791 if (key.contains("specification")) { +792 vendorEvidence.addEvidence(source, key, value, Confidence.LOW); +793 } else { +794 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +795 addMatchingValues(classInformation, value, vendorEvidence); +796 } +797 } else if (key.contains("name")) { +798 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +799 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +800 addMatchingValues(classInformation, value, vendorEvidence); +801 addMatchingValues(classInformation, value, productEvidence); +802 } else if (key.contains("license")) { +803 addLicense(dependency, value); +804 } else { +805 if (key.contains("description")) { +806 addDescription(dependency, value, "manifest", key); +807 } else { +808 productEvidence.addEvidence(source, key, value, Confidence.LOW); +809 vendorEvidence.addEvidence(source, key, value, Confidence.LOW); +810 addMatchingValues(classInformation, value, vendorEvidence); +811 addMatchingValues(classInformation, value, productEvidence); +812 if (value.matches(".*\\d.*")) { +813 final StringTokenizer tokenizer = new StringTokenizer(value, " "); +814 while (tokenizer.hasMoreElements()) { +815 final String s = tokenizer.nextToken(); +816 if (s.matches("^[0-9.]+$")) { +817 versionEvidence.addEvidence(source, key, s, Confidence.LOW); +818 } +819 } +820 } +821 } +822 } +823 } +824 } +825 } +826 } finally { +827 if (jar != null) { +828 jar.close(); 829 } -830 } finally { -831 if (jar != null) { -832 jar.close(); -833 } -834 } -835 return foundSomething; -836 } -837 -838 /** -839 * Adds a description to the given dependency. If the description contains one of the following strings beyond 100 -840 * characters, then the description used will be trimmed to that position: -841 * <ul><li>"such as"</li><li>"like "</li><li>"will use "</li><li>"* uses "</li></ul> -842 * -843 * @param dependency a dependency -844 * @param description the description -845 * @param source the source of the evidence -846 * @param key the "name" of the evidence -847 * @return if the description is trimmed, the trimmed version is returned; otherwise the original description is -848 * returned -849 */ -850 private String addDescription(Dependency dependency, String description, String source, String key) { -851 if (dependency.getDescription() == null) { -852 dependency.setDescription(description); -853 } -854 String desc; -855 if (HTML_DETECTION_PATTERN.matcher(description).find()) { -856 desc = Jsoup.parse(description).text(); -857 } else { -858 desc = description; -859 } -860 dependency.setDescription(desc); -861 if (desc.length() > 100) { -862 desc = desc.replaceAll("\\s\\s+", " "); -863 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100); -864 final int posLike = desc.toLowerCase().indexOf("like ", 100); -865 final int posWillUse = desc.toLowerCase().indexOf("will use ", 100); -866 final int posUses = desc.toLowerCase().indexOf(" uses ", 100); -867 int pos = -1; -868 pos = Math.max(pos, posSuchAs); -869 if (pos >= 0 && posLike >= 0) { -870 pos = Math.min(pos, posLike); -871 } else { -872 pos = Math.max(pos, posLike); -873 } -874 if (pos >= 0 && posWillUse >= 0) { -875 pos = Math.min(pos, posWillUse); -876 } else { -877 pos = Math.max(pos, posWillUse); -878 } -879 if (pos >= 0 && posUses >= 0) { -880 pos = Math.min(pos, posUses); -881 } else { -882 pos = Math.max(pos, posUses); -883 } -884 -885 if (pos > 0) { -886 final StringBuilder sb = new StringBuilder(pos + 3); -887 sb.append(desc.substring(0, pos)); -888 sb.append("..."); -889 desc = sb.toString(); -890 } -891 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW); -892 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW); -893 } else { -894 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM); -895 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM); -896 } -897 return desc; -898 } -899 -900 /** -901 * Adds a license to the given dependency. -902 * -903 * @param d a dependency -904 * @param license the license -905 */ -906 private void addLicense(Dependency d, String license) { -907 if (d.getLicense() == null) { -908 d.setLicense(license); -909 } else if (!d.getLicense().contains(license)) { -910 d.setLicense(d.getLicense() + NEWLINE + license); -911 } -912 } -913 -914 /** -915 * The parent directory for the individual directories per archive. -916 */ -917 private File tempFileLocation = null; -918 -919 /** -920 * Initializes the JarAnalyzer. -921 * -922 * @throws Exception is thrown if there is an exception creating a temporary directory -923 */ -924 @Override -925 public void initializeFileTypeAnalyzer() throws Exception { -926 final File baseDir = Settings.getTempDirectory(); -927 if (!baseDir.exists()) { -928 if (!baseDir.mkdirs()) { -929 final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath()); -930 throw new AnalysisException(msg); -931 } -932 } -933 tempFileLocation = File.createTempFile("check", "tmp", baseDir); -934 if (!tempFileLocation.delete()) { -935 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); -936 throw new AnalysisException(msg); -937 } -938 if (!tempFileLocation.mkdirs()) { -939 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); -940 throw new AnalysisException(msg); -941 } -942 } -943 -944 /** -945 * Deletes any files extracted from the JAR during analysis. -946 */ -947 @Override -948 public void close() { -949 if (tempFileLocation != null && tempFileLocation.exists()) { -950 LOGGER.log(Level.FINE, "Attempting to delete temporary files"); -951 final boolean success = FileUtils.delete(tempFileLocation); -952 if (!success) { -953 LOGGER.log(Level.WARNING, -954 "Failed to delete some temporary files, see the log for more details"); -955 } -956 } -957 } -958 -959 /** -960 * <p> -961 * A utility function that will interpolate strings based on values given in the properties file. It will also -962 * interpolate the strings contained within the properties file so that properties can reference other -963 * properties.</p> -964 * <p> -965 * <b>Note:</b> if there is no property found the reference will be removed. In other words, if the interpolated -966 * string will be replaced with an empty string. -967 * </p> -968 * <p> -969 * Example:</p> -970 * <code> -971 * Properties p = new Properties(); -972 * p.setProperty("key", "value"); -973 * String s = interpolateString("'${key}' and '${nothing}'", p); -974 * System.out.println(s); -975 * </code> -976 * <p> -977 * Will result in:</p> -978 * <code> -979 * 'value' and '' -980 * </code> -981 * -982 * @param text the string that contains references to properties. -983 * @param properties a collection of properties that may be referenced within the text. -984 * @return the interpolated text. -985 */ -986 protected String interpolateString(String text, Properties properties) { -987 Properties props = properties; -988 if (text == null) { -989 return text; -990 } -991 if (props == null) { -992 props = new Properties(); -993 } -994 -995 final int pos = text.indexOf("${"); -996 if (pos < 0) { -997 return text; +830 } +831 return foundSomething; +832 } +833 +834 /** +835 * Adds a description to the given dependency. If the description contains one of the following strings beyond 100 +836 * characters, then the description used will be trimmed to that position: +837 * <ul><li>"such as"</li><li>"like "</li><li>"will use "</li><li>"* uses "</li></ul> +838 * +839 * @param dependency a dependency +840 * @param description the description +841 * @param source the source of the evidence +842 * @param key the "name" of the evidence +843 * @return if the description is trimmed, the trimmed version is returned; otherwise the original description is +844 * returned +845 */ +846 private String addDescription(Dependency dependency, String description, String source, String key) { +847 if (dependency.getDescription() == null) { +848 dependency.setDescription(description); +849 } +850 String desc; +851 if (HTML_DETECTION_PATTERN.matcher(description).find()) { +852 desc = Jsoup.parse(description).text(); +853 } else { +854 desc = description; +855 } +856 dependency.setDescription(desc); +857 if (desc.length() > 100) { +858 desc = desc.replaceAll("\\s\\s+", " "); +859 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100); +860 final int posLike = desc.toLowerCase().indexOf("like ", 100); +861 final int posWillUse = desc.toLowerCase().indexOf("will use ", 100); +862 final int posUses = desc.toLowerCase().indexOf(" uses ", 100); +863 int pos = -1; +864 pos = Math.max(pos, posSuchAs); +865 if (pos >= 0 && posLike >= 0) { +866 pos = Math.min(pos, posLike); +867 } else { +868 pos = Math.max(pos, posLike); +869 } +870 if (pos >= 0 && posWillUse >= 0) { +871 pos = Math.min(pos, posWillUse); +872 } else { +873 pos = Math.max(pos, posWillUse); +874 } +875 if (pos >= 0 && posUses >= 0) { +876 pos = Math.min(pos, posUses); +877 } else { +878 pos = Math.max(pos, posUses); +879 } +880 +881 if (pos > 0) { +882 final StringBuilder sb = new StringBuilder(pos + 3); +883 sb.append(desc.substring(0, pos)); +884 sb.append("..."); +885 desc = sb.toString(); +886 } +887 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW); +888 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW); +889 } else { +890 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM); +891 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM); +892 } +893 return desc; +894 } +895 +896 /** +897 * Adds a license to the given dependency. +898 * +899 * @param d a dependency +900 * @param license the license +901 */ +902 private void addLicense(Dependency d, String license) { +903 if (d.getLicense() == null) { +904 d.setLicense(license); +905 } else if (!d.getLicense().contains(license)) { +906 d.setLicense(d.getLicense() + NEWLINE + license); +907 } +908 } +909 +910 /** +911 * The parent directory for the individual directories per archive. +912 */ +913 private File tempFileLocation = null; +914 +915 /** +916 * Initializes the JarAnalyzer. +917 * +918 * @throws Exception is thrown if there is an exception creating a temporary directory +919 */ +920 @Override +921 public void initializeFileTypeAnalyzer() throws Exception { +922 final File baseDir = Settings.getTempDirectory(); +923 tempFileLocation = File.createTempFile("check", "tmp", baseDir); +924 if (!tempFileLocation.delete()) { +925 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); +926 throw new AnalysisException(msg); +927 } +928 if (!tempFileLocation.mkdirs()) { +929 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); +930 throw new AnalysisException(msg); +931 } +932 } +933 +934 /** +935 * Deletes any files extracted from the JAR during analysis. +936 */ +937 @Override +938 public void close() { +939 if (tempFileLocation != null && tempFileLocation.exists()) { +940 LOGGER.log(Level.FINE, "Attempting to delete temporary files"); +941 final boolean success = FileUtils.delete(tempFileLocation); +942 if (!success) { +943 LOGGER.log(Level.WARNING, +944 "Failed to delete some temporary files, see the log for more details"); +945 } +946 } +947 } +948 +949 /** +950 * <p> +951 * A utility function that will interpolate strings based on values given in the properties file. It will also +952 * interpolate the strings contained within the properties file so that properties can reference other +953 * properties.</p> +954 * <p> +955 * <b>Note:</b> if there is no property found the reference will be removed. In other words, if the interpolated +956 * string will be replaced with an empty string. +957 * </p> +958 * <p> +959 * Example:</p> +960 * <code> +961 * Properties p = new Properties(); +962 * p.setProperty("key", "value"); +963 * String s = interpolateString("'${key}' and '${nothing}'", p); +964 * System.out.println(s); +965 * </code> +966 * <p> +967 * Will result in:</p> +968 * <code> +969 * 'value' and '' +970 * </code> +971 * +972 * @param text the string that contains references to properties. +973 * @param properties a collection of properties that may be referenced within the text. +974 * @return the interpolated text. +975 */ +976 protected String interpolateString(String text, Properties properties) { +977 Properties props = properties; +978 if (text == null) { +979 return text; +980 } +981 if (props == null) { +982 props = new Properties(); +983 } +984 +985 final int pos = text.indexOf("${"); +986 if (pos < 0) { +987 return text; +988 } +989 final int end = text.indexOf("}"); +990 if (end < pos) { +991 return text; +992 } +993 +994 final String propName = text.substring(pos + 2, end); +995 String propValue = interpolateString(props.getProperty(propName), props); +996 if (propValue == null) { +997 propValue = ""; 998 } -999 final int end = text.indexOf("}"); -1000 if (end < pos) { -1001 return text; -1002 } -1003 -1004 final String propName = text.substring(pos + 2, end); -1005 String propValue = interpolateString(props.getProperty(propName), props); -1006 if (propValue == null) { -1007 propValue = ""; -1008 } -1009 final StringBuilder sb = new StringBuilder(propValue.length() + text.length()); -1010 sb.append(text.subSequence(0, pos)); -1011 sb.append(propValue); -1012 sb.append(text.substring(end + 1)); -1013 return interpolateString(sb.toString(), props); //yes yes, this should be a loop... -1014 } -1015 -1016 /** -1017 * Determines if the key value pair from the manifest is for an "import" type entry for package names. -1018 * -1019 * @param key the key from the manifest -1020 * @param value the value from the manifest -1021 * @return true or false depending on if it is believed the entry is an "import" entry -1022 */ -1023 private boolean isImportPackage(String key, String value) { -1024 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$"); -1025 final boolean matches = packageRx.matcher(value).matches(); -1026 return matches && (key.contains("import") || key.contains("include") || value.length() > 10); -1027 } -1028 -1029 /** -1030 * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class -1031 * names. This does not include core Java package names (i.e. java.* or javax.*). -1032 * -1033 * @param dependency the dependency being analyzed -1034 * @return an list of fully qualified class names -1035 */ -1036 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) { -1037 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>(); -1038 JarFile jar = null; -1039 try { -1040 jar = new JarFile(dependency.getActualFilePath()); -1041 final Enumeration entries = jar.entries(); -1042 while (entries.hasMoreElements()) { -1043 final JarEntry entry = (JarEntry) entries.nextElement(); -1044 final String name = entry.getName().toLowerCase(); -1045 //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs. -1046 if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) { -1047 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6)); -1048 classNames.add(className); -1049 } -1050 } -1051 } catch (IOException ex) { -1052 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName()); -1053 Logger -1054 .getLogger(JarAnalyzer.class -1055 .getName()).log(Level.WARNING, msg); -1056 Logger.getLogger(JarAnalyzer.class -1057 .getName()).log(Level.FINE, null, ex); -1058 } finally { -1059 if (jar != null) { -1060 try { -1061 jar.close(); -1062 } catch (IOException ex) { -1063 LOGGER.log(Level.FINEST, null, ex); -1064 } -1065 } -1066 } -1067 return classNames; -1068 } -1069 -1070 /** -1071 * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and -1072 * product. This is helpful when analyzing vendor/product as many times this is included in the package name. -1073 * -1074 * @param classNames a list of class names -1075 * @param vendor HashMap of possible vendor names from package names (e.g. owasp) -1076 * @param product HashMap of possible product names from package names (e.g. dependencycheck) -1077 */ -1078 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames, -1079 HashMap<String, Integer> vendor, HashMap<String, Integer> product) { -1080 for (ClassNameInformation entry : classNames) { -1081 final ArrayList<String> list = entry.getPackageStructure(); -1082 addEntry(vendor, list.get(0)); -1083 -1084 if (list.size() == 2) { -1085 addEntry(product, list.get(1)); -1086 } -1087 if (list.size() == 3) { -1088 addEntry(vendor, list.get(1)); -1089 addEntry(product, list.get(1)); -1090 addEntry(product, list.get(2)); -1091 } -1092 if (list.size() >= 4) { -1093 addEntry(vendor, list.get(1)); -1094 addEntry(vendor, list.get(2)); -1095 addEntry(product, list.get(1)); -1096 addEntry(product, list.get(2)); -1097 addEntry(product, list.get(3)); -1098 } -1099 } -1100 } -1101 -1102 /** -1103 * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists -1104 * in the collection then the Integer is incremented by 1. -1105 * -1106 * @param collection a collection of strings and their occurrence count -1107 * @param key the key to add to the collection -1108 */ -1109 private void addEntry(HashMap<String, Integer> collection, String key) { -1110 if (collection.containsKey(key)) { -1111 collection.put(key, collection.get(key) + 1); -1112 } else { -1113 collection.put(key, 1); -1114 } -1115 } -1116 -1117 /** -1118 * Cycles through the collection of class name information to see if parts of the package names are contained in the -1119 * provided value. If found, it will be added as the HIGHEST confidence evidence because we have more then one -1120 * source corroborating the value. -1121 * -1122 * @param classes a collection of class name information -1123 * @param value the value to check to see if it contains a package name -1124 * @param evidence the evidence collection to add new entries too -1125 */ -1126 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) { -1127 if (value == null || value.isEmpty()) { -1128 return; -1129 } -1130 final String text = value.toLowerCase(); -1131 for (ClassNameInformation cni : classes) { -1132 for (String key : cni.getPackageStructure()) { -1133 if (text.contains(key)) { //note, package structure elements are already lowercase. -1134 evidence.addEvidence("jar", "package name", key, Confidence.HIGHEST); -1135 } -1136 } -1137 } -1138 } -1139 -1140 /** -1141 * Simple check to see if the attribute from a manifest is just a package name. -1142 * -1143 * @param key the key of the value to check -1144 * @param value the value to check -1145 * @return true if the value looks like a java package name, otherwise false -1146 */ -1147 private boolean isPackage(String key, String value) { -1148 -1149 return !key.matches(".*(version|title|vendor|name|license|description).*") -1150 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$"); -1151 -1152 } -1153 -1154 /** -1155 * Adds evidence from the POM to the dependency. This includes the GAV and in some situations the parent GAV if -1156 * specified. -1157 * -1158 * @param dependency the dependency being analyzed -1159 * @param pom the POM data -1160 * @param pomProperties the properties file associated with the pom -1161 */ -1162 private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) { -1163 if (pom == null) { -1164 return; -1165 } -1166 String groupid = interpolateString(pom.getGroupId(), pomProperties); -1167 if (groupid != null && !groupid.isEmpty()) { -1168 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { -1169 groupid = groupid.substring(4); -1170 } -1171 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); -1172 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); -1173 } -1174 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); -1175 if (artifactid != null && !artifactid.isEmpty()) { -1176 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { -1177 artifactid = artifactid.substring(4); -1178 } -1179 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); -1180 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); -1181 } -1182 final String version = interpolateString(pom.getVersion(), pomProperties); -1183 if (version != null && !version.isEmpty()) { -1184 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST); -1185 } -1186 -1187 final Parent parent = pom.getParent(); //grab parent GAV -1188 if (parent != null) { -1189 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties); -1190 if (parentGroupId != null && !parentGroupId.isEmpty()) { -1191 if (groupid == null || groupid.isEmpty()) { -1192 dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.HIGH); -1193 } else { -1194 dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.MEDIUM); -1195 } -1196 dependency.getProductEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.LOW); -1197 } -1198 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties); -1199 if (parentArtifactId != null && !parentArtifactId.isEmpty()) { -1200 if (artifactid == null || artifactid.isEmpty()) { -1201 dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.HIGH); -1202 } else { -1203 dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.MEDIUM); -1204 } -1205 dependency.getVendorEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.LOW); -1206 } -1207 final String parentVersion = interpolateString(parent.getVersion(), pomProperties); -1208 if (parentVersion != null && !parentVersion.isEmpty()) { -1209 if (version == null || version.isEmpty()) { -1210 dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.HIGH); -1211 } else { -1212 dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.LOW); -1213 } -1214 } -1215 } -1216 // org name -1217 final Organization org = pom.getOrganization(); -1218 if (org != null && org.getName() != null) { -1219 final String orgName = interpolateString(org.getName(), pomProperties); -1220 if (orgName != null && !orgName.isEmpty()) { -1221 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH); -1222 } -1223 } -1224 //pom name -1225 final String pomName = interpolateString(pom.getName(), pomProperties); -1226 if (pomName != null && !pomName.isEmpty()) { -1227 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); -1228 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); -1229 } -1230 -1231 //Description -1232 if (pom.getDescription() != null) { -1233 final String description = interpolateString(pom.getDescription(), pomProperties); -1234 if (description != null && !description.isEmpty()) { -1235 addDescription(dependency, description, "pom", "description"); -1236 } -1237 } -1238 extractLicense(pom, pomProperties, dependency); -1239 } -1240 -1241 /** -1242 * Extracts the license information from the pom and adds it to the dependency. -1243 * -1244 * @param pom the pom object -1245 * @param pomProperties the properties, used for string interpolation -1246 * @param dependency the dependency to add license information too -1247 */ -1248 private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) { -1249 //license -1250 if (pom.getLicenses() != null) { -1251 String license = null; -1252 for (License lic : pom.getLicenses().getLicense()) { -1253 String tmp = null; -1254 if (lic.getName() != null) { -1255 tmp = interpolateString(lic.getName(), pomProperties); +999 final StringBuilder sb = new StringBuilder(propValue.length() + text.length()); +1000 sb.append(text.subSequence(0, pos)); +1001 sb.append(propValue); +1002 sb.append(text.substring(end + 1)); +1003 return interpolateString(sb.toString(), props); //yes yes, this should be a loop... +1004 } +1005 +1006 /** +1007 * Determines if the key value pair from the manifest is for an "import" type entry for package names. +1008 * +1009 * @param key the key from the manifest +1010 * @param value the value from the manifest +1011 * @return true or false depending on if it is believed the entry is an "import" entry +1012 */ +1013 private boolean isImportPackage(String key, String value) { +1014 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$"); +1015 final boolean matches = packageRx.matcher(value).matches(); +1016 return matches && (key.contains("import") || key.contains("include") || value.length() > 10); +1017 } +1018 +1019 /** +1020 * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class +1021 * names. This does not include core Java package names (i.e. java.* or javax.*). +1022 * +1023 * @param dependency the dependency being analyzed +1024 * @return an list of fully qualified class names +1025 */ +1026 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) { +1027 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>(); +1028 JarFile jar = null; +1029 try { +1030 jar = new JarFile(dependency.getActualFilePath()); +1031 final Enumeration entries = jar.entries(); +1032 while (entries.hasMoreElements()) { +1033 final JarEntry entry = (JarEntry) entries.nextElement(); +1034 final String name = entry.getName().toLowerCase(); +1035 //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs. +1036 if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) { +1037 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6)); +1038 classNames.add(className); +1039 } +1040 } +1041 } catch (IOException ex) { +1042 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName()); +1043 LOGGER.log(Level.WARNING, msg); +1044 LOGGER.log(Level.FINE, null, ex); +1045 } finally { +1046 if (jar != null) { +1047 try { +1048 jar.close(); +1049 } catch (IOException ex) { +1050 LOGGER.log(Level.FINEST, null, ex); +1051 } +1052 } +1053 } +1054 return classNames; +1055 } +1056 +1057 /** +1058 * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and +1059 * product. This is helpful when analyzing vendor/product as many times this is included in the package name. +1060 * +1061 * @param classNames a list of class names +1062 * @param vendor HashMap of possible vendor names from package names (e.g. owasp) +1063 * @param product HashMap of possible product names from package names (e.g. dependencycheck) +1064 */ +1065 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames, +1066 HashMap<String, Integer> vendor, HashMap<String, Integer> product) { +1067 for (ClassNameInformation entry : classNames) { +1068 final ArrayList<String> list = entry.getPackageStructure(); +1069 addEntry(vendor, list.get(0)); +1070 +1071 if (list.size() == 2) { +1072 addEntry(product, list.get(1)); +1073 } +1074 if (list.size() == 3) { +1075 addEntry(vendor, list.get(1)); +1076 addEntry(product, list.get(1)); +1077 addEntry(product, list.get(2)); +1078 } +1079 if (list.size() >= 4) { +1080 addEntry(vendor, list.get(1)); +1081 addEntry(vendor, list.get(2)); +1082 addEntry(product, list.get(1)); +1083 addEntry(product, list.get(2)); +1084 addEntry(product, list.get(3)); +1085 } +1086 } +1087 } +1088 +1089 /** +1090 * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists +1091 * in the collection then the Integer is incremented by 1. +1092 * +1093 * @param collection a collection of strings and their occurrence count +1094 * @param key the key to add to the collection +1095 */ +1096 private void addEntry(HashMap<String, Integer> collection, String key) { +1097 if (collection.containsKey(key)) { +1098 collection.put(key, collection.get(key) + 1); +1099 } else { +1100 collection.put(key, 1); +1101 } +1102 } +1103 +1104 /** +1105 * Cycles through the collection of class name information to see if parts of the package names are contained in the +1106 * provided value. If found, it will be added as the HIGHEST confidence evidence because we have more then one +1107 * source corroborating the value. +1108 * +1109 * @param classes a collection of class name information +1110 * @param value the value to check to see if it contains a package name +1111 * @param evidence the evidence collection to add new entries too +1112 */ +1113 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) { +1114 if (value == null || value.isEmpty()) { +1115 return; +1116 } +1117 final String text = value.toLowerCase(); +1118 for (ClassNameInformation cni : classes) { +1119 for (String key : cni.getPackageStructure()) { +1120 if (text.contains(key)) { //note, package structure elements are already lowercase. +1121 evidence.addEvidence("jar", "package name", key, Confidence.HIGHEST); +1122 } +1123 } +1124 } +1125 } +1126 +1127 /** +1128 * Simple check to see if the attribute from a manifest is just a package name. +1129 * +1130 * @param key the key of the value to check +1131 * @param value the value to check +1132 * @return true if the value looks like a java package name, otherwise false +1133 */ +1134 private boolean isPackage(String key, String value) { +1135 +1136 return !key.matches(".*(version|title|vendor|name|license|description).*") +1137 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$"); +1138 +1139 } +1140 +1141 /** +1142 * Adds evidence from the POM to the dependency. This includes the GAV and in some situations the parent GAV if +1143 * specified. +1144 * +1145 * @param dependency the dependency being analyzed +1146 * @param pom the POM data +1147 * @param pomProperties the properties file associated with the pom +1148 */ +1149 private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) { +1150 if (pom == null) { +1151 return; +1152 } +1153 String groupid = interpolateString(pom.getGroupId(), pomProperties); +1154 if (groupid != null && !groupid.isEmpty()) { +1155 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { +1156 groupid = groupid.substring(4); +1157 } +1158 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); +1159 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); +1160 } +1161 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); +1162 if (artifactid != null && !artifactid.isEmpty()) { +1163 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { +1164 artifactid = artifactid.substring(4); +1165 } +1166 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); +1167 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); +1168 } +1169 final String version = interpolateString(pom.getVersion(), pomProperties); +1170 if (version != null && !version.isEmpty()) { +1171 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST); +1172 } +1173 +1174 final Parent parent = pom.getParent(); //grab parent GAV +1175 if (parent != null) { +1176 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties); +1177 if (parentGroupId != null && !parentGroupId.isEmpty()) { +1178 if (groupid == null || groupid.isEmpty()) { +1179 dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.HIGH); +1180 } else { +1181 dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.MEDIUM); +1182 } +1183 dependency.getProductEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.LOW); +1184 } +1185 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties); +1186 if (parentArtifactId != null && !parentArtifactId.isEmpty()) { +1187 if (artifactid == null || artifactid.isEmpty()) { +1188 dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.HIGH); +1189 } else { +1190 dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.MEDIUM); +1191 } +1192 dependency.getVendorEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.LOW); +1193 } +1194 final String parentVersion = interpolateString(parent.getVersion(), pomProperties); +1195 if (parentVersion != null && !parentVersion.isEmpty()) { +1196 if (version == null || version.isEmpty()) { +1197 dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.HIGH); +1198 } else { +1199 dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.LOW); +1200 } +1201 } +1202 } +1203 // org name +1204 final Organization org = pom.getOrganization(); +1205 if (org != null && org.getName() != null) { +1206 final String orgName = interpolateString(org.getName(), pomProperties); +1207 if (orgName != null && !orgName.isEmpty()) { +1208 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH); +1209 } +1210 } +1211 //pom name +1212 final String pomName = interpolateString(pom.getName(), pomProperties); +1213 if (pomName != null && !pomName.isEmpty()) { +1214 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +1215 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +1216 } +1217 +1218 //Description +1219 if (pom.getDescription() != null) { +1220 final String description = interpolateString(pom.getDescription(), pomProperties); +1221 if (description != null && !description.isEmpty()) { +1222 addDescription(dependency, description, "pom", "description"); +1223 } +1224 } +1225 extractLicense(pom, pomProperties, dependency); +1226 } +1227 +1228 /** +1229 * Extracts the license information from the pom and adds it to the dependency. +1230 * +1231 * @param pom the pom object +1232 * @param pomProperties the properties, used for string interpolation +1233 * @param dependency the dependency to add license information too +1234 */ +1235 private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) { +1236 //license +1237 if (pom.getLicenses() != null) { +1238 String license = null; +1239 for (License lic : pom.getLicenses().getLicense()) { +1240 String tmp = null; +1241 if (lic.getName() != null) { +1242 tmp = interpolateString(lic.getName(), pomProperties); +1243 } +1244 if (lic.getUrl() != null) { +1245 if (tmp == null) { +1246 tmp = interpolateString(lic.getUrl(), pomProperties); +1247 } else { +1248 tmp += ": " + interpolateString(lic.getUrl(), pomProperties); +1249 } +1250 } +1251 if (tmp == null) { +1252 continue; +1253 } +1254 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) { +1255 tmp = Jsoup.parse(tmp).text(); 1256 } -1257 if (lic.getUrl() != null) { -1258 if (tmp == null) { -1259 tmp = interpolateString(lic.getUrl(), pomProperties); -1260 } else { -1261 tmp += ": " + interpolateString(lic.getUrl(), pomProperties); -1262 } -1263 } -1264 if (tmp == null) { -1265 continue; -1266 } -1267 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) { -1268 tmp = Jsoup.parse(tmp).text(); -1269 } -1270 if (license == null) { -1271 license = tmp; -1272 } else { -1273 license += "\n" + tmp; -1274 } -1275 } -1276 if (license != null) { -1277 dependency.setLicense(license); -1278 } -1279 } -1280 } -1281 -1282 /** -1283 * Stores information about a class name. -1284 */ -1285 protected static class ClassNameInformation { -1286 -1287 /** -1288 * <p> -1289 * Stores information about a given class name. This class will keep the fully qualified class name and a list -1290 * of the important parts of the package structure. Up to the first four levels of the package structure are -1291 * stored, excluding a leading "org" or "com". Example:</p> -1292 * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer"); -1293 * System.out.println(obj.getName()); -1294 * for (String p : obj.getPackageStructure()) -1295 * System.out.println(p); -1296 * </code> -1297 * <p> -1298 * Would result in:</p> -1299 * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer -1300 * owasp -1301 * dependencycheck -1302 * analyzer -1303 * jaranalyzer</code> -1304 * -1305 * @param className a fully qualified class name -1306 */ -1307 ClassNameInformation(String className) { -1308 name = className; -1309 if (name.contains("/")) { -1310 final String[] tmp = className.toLowerCase().split("/"); -1311 int start = 0; -1312 int end = 3; -1313 if ("com".equals(tmp[0]) || "org".equals(tmp[0])) { -1314 start = 1; -1315 end = 4; -1316 } -1317 if (tmp.length <= end) { -1318 end = tmp.length - 1; -1319 } -1320 for (int i = start; i <= end; i++) { -1321 packageStructure.add(tmp[i]); -1322 } -1323 } else { -1324 packageStructure.add(name); -1325 } +1257 if (license == null) { +1258 license = tmp; +1259 } else { +1260 license += "\n" + tmp; +1261 } +1262 } +1263 if (license != null) { +1264 dependency.setLicense(license); +1265 } +1266 } +1267 } +1268 +1269 /** +1270 * Stores information about a class name. +1271 */ +1272 protected static class ClassNameInformation { +1273 +1274 /** +1275 * <p> +1276 * Stores information about a given class name. This class will keep the fully qualified class name and a list +1277 * of the important parts of the package structure. Up to the first four levels of the package structure are +1278 * stored, excluding a leading "org" or "com". Example:</p> +1279 * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer"); +1280 * System.out.println(obj.getName()); +1281 * for (String p : obj.getPackageStructure()) +1282 * System.out.println(p); +1283 * </code> +1284 * <p> +1285 * Would result in:</p> +1286 * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer +1287 * owasp +1288 * dependencycheck +1289 * analyzer +1290 * jaranalyzer</code> +1291 * +1292 * @param className a fully qualified class name +1293 */ +1294 ClassNameInformation(String className) { +1295 name = className; +1296 if (name.contains("/")) { +1297 final String[] tmp = className.toLowerCase().split("/"); +1298 int start = 0; +1299 int end = 3; +1300 if ("com".equals(tmp[0]) || "org".equals(tmp[0])) { +1301 start = 1; +1302 end = 4; +1303 } +1304 if (tmp.length <= end) { +1305 end = tmp.length - 1; +1306 } +1307 for (int i = start; i <= end; i++) { +1308 packageStructure.add(tmp[i]); +1309 } +1310 } else { +1311 packageStructure.add(name); +1312 } +1313 } +1314 /** +1315 * The fully qualified class name. +1316 */ +1317 private String name; +1318 +1319 /** +1320 * Get the value of name +1321 * +1322 * @return the value of name +1323 */ +1324 public String getName() { +1325 return name; 1326 } -1327 /** -1328 * The fully qualified class name. -1329 */ -1330 private String name; -1331 -1332 /** -1333 * Get the value of name -1334 * -1335 * @return the value of name -1336 */ -1337 public String getName() { -1338 return name; -1339 } +1327 +1328 /** +1329 * Set the value of name +1330 * +1331 * @param name new value of name +1332 */ +1333 public void setName(String name) { +1334 this.name = name; +1335 } +1336 /** +1337 * Up to the first four levels of the package structure, excluding a leading "org" or "com". +1338 */ +1339 private final ArrayList<String> packageStructure = new ArrayList<String>(); 1340 1341 /** -1342 * Set the value of name +1342 * Get the value of packageStructure 1343 * -1344 * @param name new value of name +1344 * @return the value of packageStructure 1345 */ -1346 public void setName(String name) { -1347 this.name = name; +1346 public ArrayList<String> getPackageStructure() { +1347 return packageStructure; 1348 } -1349 /** -1350 * Up to the first four levels of the package structure, excluding a leading "org" or "com". -1351 */ -1352 private final ArrayList<String> packageStructure = new ArrayList<String>(); -1353 -1354 /** -1355 * Get the value of packageStructure -1356 * -1357 * @return the value of packageStructure -1358 */ -1359 public ArrayList<String> getPackageStructure() { -1360 return packageStructure; -1361 } -1362 } -1363 -1364 /** -1365 * Retrieves the next temporary directory to extract an archive too. -1366 * -1367 * @return a directory -1368 * @throws AnalysisException thrown if unable to create temporary directory -1369 */ -1370 private File getNextTempDirectory() throws AnalysisException { -1371 dirCount += 1; -1372 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); -1373 //getting an exception for some directories not being able to be created; might be because the directory already exists? -1374 if (directory.exists()) { -1375 return getNextTempDirectory(); -1376 } -1377 if (!directory.mkdirs()) { -1378 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); -1379 throw new AnalysisException(msg); -1380 } -1381 return directory; -1382 } -1383 } +1349 } +1350 +1351 /** +1352 * Retrieves the next temporary directory to extract an archive too. +1353 * +1354 * @return a directory +1355 * @throws AnalysisException thrown if unable to create temporary directory +1356 */ +1357 private File getNextTempDirectory() throws AnalysisException { +1358 dirCount += 1; +1359 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); +1360 //getting an exception for some directories not being able to be created; might be because the directory already exists? +1361 if (directory.exists()) { +1362 return getNextTempDirectory(); +1363 } +1364 if (!directory.mkdirs()) { +1365 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); +1366 throw new AnalysisException(msg); +1367 } +1368 return directory; +1369 } +1370 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html index 882cd69d4..fb9807d4c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html @@ -52,7 +52,7 @@ 44 */ 45 private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class.getName()); 46 -47 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +47 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> 48 /** 49 * The name of the analyzer. 50 */ @@ -115,7 +115,7 @@ 107 */ 108 @Override 109 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException { -110 BufferedReader fin = null;; +110 BufferedReader fin = null; 111 try { 112 // /\*([^\*][^/]|[\r\n\f])+?\*/ 113 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)", Pattern.MULTILINE); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html index 819504a89..dcff3b708 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html @@ -176,7 +176,7 @@ 168 LOGGER.info(String.format("invalid sha-1 hash on %s", dependency.getFileName())); 169 } catch (FileNotFoundException fnfe) { 170 //dependency.addAnalysisException(new AnalysisException("Artifact not found on repository")); -171 LOGGER.fine(String.format("Artificat not found in repository '%s'", dependency.getFileName())); +171 LOGGER.fine(String.format("Artifact not found in repository '%s'", dependency.getFileName())); 172 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe); 173 } catch (IOException ioe) { 174 //dependency.addAnalysisException(new AnalysisException("Could not connect to repository", ioe)); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html index c95329854..801a475ca 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html @@ -117,38 +117,49 @@ 109 } 110 } 111 } -112 } -113 -114 /** -115 * Returns the name of this analyzer. -116 * -117 * @return the name of this analyzer. -118 */ -119 @Override -120 public String getName() { -121 return "NVD CVE Analyzer"; -122 } -123 -124 /** -125 * Returns the analysis phase that this analyzer should run in. -126 * -127 * @return the analysis phase that this analyzer should run in. -128 */ -129 @Override -130 public AnalysisPhase getAnalysisPhase() { -131 return AnalysisPhase.FINDING_ANALYSIS; -132 } -133 -134 /** -135 * Opens the database used to gather NVD CVE data. -136 * -137 * @throws Exception is thrown if there is an issue opening the index. -138 */ -139 @Override -140 public void initialize() throws Exception { -141 this.open(); -142 } -143 } +112 for (Identifier id : dependency.getSuppressedIdentifiers()) { +113 if ("cpe".equals(id.getType())) { +114 try { +115 final String value = id.getValue(); +116 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value); +117 dependency.getSuppressedVulnerabilities().addAll(vulns); +118 } catch (DatabaseException ex) { +119 throw new AnalysisException(ex); +120 } +121 } +122 } +123 } +124 +125 /** +126 * Returns the name of this analyzer. +127 * +128 * @return the name of this analyzer. +129 */ +130 @Override +131 public String getName() { +132 return "NVD CVE Analyzer"; +133 } +134 +135 /** +136 * Returns the analysis phase that this analyzer should run in. +137 * +138 * @return the analysis phase that this analyzer should run in. +139 */ +140 @Override +141 public AnalysisPhase getAnalysisPhase() { +142 return AnalysisPhase.FINDING_ANALYSIS; +143 } +144 +145 /** +146 * Opens the database used to gather NVD CVE data. +147 * +148 * @throws Exception is thrown if there is an issue opening the index. +149 */ +150 @Override +151 public void initialize() throws Exception { +152 this.open(); +153 } +154 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html index 5ce658a44..2406407b5 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer.exception + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.analyzer.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html index 1fbe7cc98..a20c46512 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer.exception + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.analyzer.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html index 87e4c72fa..845667461 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html index 3766e6d54..45d6ad511 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html index 76a752c52..de28934f3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html @@ -62,274 +62,277 @@ 54 * @author Jeremy Long <jeremy.long@owasp.org> 55 */ 56 public final class CpeMemoryIndex { -57 -58 /** -59 * singleton instance. -60 */ -61 private static CpeMemoryIndex instance = new CpeMemoryIndex(); -62 -63 /** -64 * private constructor for singleton. -65 */ -66 private CpeMemoryIndex() { -67 } -68 -69 /** -70 * Gets the singleton instance of the CpeMemoryIndex. -71 * -72 * @return the instance of the CpeMemoryIndex -73 */ -74 public static CpeMemoryIndex getInstance() { -75 return instance; -76 } -77 /** -78 * The in memory Lucene index. -79 */ -80 private RAMDirectory index; -81 /** -82 * The Lucene IndexReader. -83 */ -84 private IndexReader indexReader; -85 /** -86 * The Lucene IndexSearcher. -87 */ -88 private IndexSearcher indexSearcher; -89 /** -90 * The Lucene Analyzer used for Searching. -91 */ -92 private Analyzer searchingAnalyzer; -93 /** -94 * The Lucene QueryParser used for Searching. -95 */ -96 private QueryParser queryParser; -97 /** -98 * The search field analyzer for the product field. -99 */ -100 private SearchFieldAnalyzer productSearchFieldAnalyzer; -101 /** -102 * The search field analyzer for the vendor field. -103 */ -104 private SearchFieldAnalyzer vendorSearchFieldAnalyzer; -105 -106 /** -107 * Creates and loads data into an in memory index. -108 * -109 * @param cve the data source to retrieve the cpe data -110 * @throws IndexException thrown if there is an error creating the index -111 */ -112 public void open(CveDB cve) throws IndexException { -113 if (!openState) { -114 index = new RAMDirectory(); -115 buildIndex(cve); -116 try { -117 indexReader = DirectoryReader.open(index); -118 } catch (IOException ex) { -119 throw new IndexException(ex); -120 } -121 indexSearcher = new IndexSearcher(indexReader); -122 searchingAnalyzer = createSearchingAnalyzer(); -123 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer); -124 openState = true; -125 } -126 } -127 /** -128 * A flag indicating whether or not the index is open. -129 */ -130 private boolean openState = false; -131 -132 /** -133 * returns whether or not the index is open. -134 * -135 * @return whether or not the index is open -136 */ -137 public boolean isOpen() { -138 return openState; -139 } -140 -141 /** -142 * Creates the indexing analyzer for the CPE Index. -143 * -144 * @return the CPE Analyzer. -145 */ -146 @SuppressWarnings("unchecked") -147 private Analyzer createIndexingAnalyzer() { -148 final Map fieldAnalyzers = new HashMap(); -149 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); -150 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); -151 } -152 -153 /** -154 * Creates an Analyzer for searching the CPE Index. -155 * -156 * @return the CPE Analyzer. -157 */ -158 @SuppressWarnings("unchecked") -159 private Analyzer createSearchingAnalyzer() { -160 final Map fieldAnalyzers = new HashMap(); -161 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); -162 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -163 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -164 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer); -165 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer); -166 -167 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); -168 } +57 /** +58 * The logger. +59 */ +60 private static final Logger LOGGER = Logger.getLogger(CpeMemoryIndex.class.getName()); +61 /** +62 * singleton instance. +63 */ +64 private static CpeMemoryIndex instance = new CpeMemoryIndex(); +65 +66 /** +67 * private constructor for singleton. +68 */ +69 private CpeMemoryIndex() { +70 } +71 +72 /** +73 * Gets the singleton instance of the CpeMemoryIndex. +74 * +75 * @return the instance of the CpeMemoryIndex +76 */ +77 public static CpeMemoryIndex getInstance() { +78 return instance; +79 } +80 /** +81 * The in memory Lucene index. +82 */ +83 private RAMDirectory index; +84 /** +85 * The Lucene IndexReader. +86 */ +87 private IndexReader indexReader; +88 /** +89 * The Lucene IndexSearcher. +90 */ +91 private IndexSearcher indexSearcher; +92 /** +93 * The Lucene Analyzer used for Searching. +94 */ +95 private Analyzer searchingAnalyzer; +96 /** +97 * The Lucene QueryParser used for Searching. +98 */ +99 private QueryParser queryParser; +100 /** +101 * The search field analyzer for the product field. +102 */ +103 private SearchFieldAnalyzer productSearchFieldAnalyzer; +104 /** +105 * The search field analyzer for the vendor field. +106 */ +107 private SearchFieldAnalyzer vendorSearchFieldAnalyzer; +108 +109 /** +110 * Creates and loads data into an in memory index. +111 * +112 * @param cve the data source to retrieve the cpe data +113 * @throws IndexException thrown if there is an error creating the index +114 */ +115 public void open(CveDB cve) throws IndexException { +116 if (!openState) { +117 index = new RAMDirectory(); +118 buildIndex(cve); +119 try { +120 indexReader = DirectoryReader.open(index); +121 } catch (IOException ex) { +122 throw new IndexException(ex); +123 } +124 indexSearcher = new IndexSearcher(indexReader); +125 searchingAnalyzer = createSearchingAnalyzer(); +126 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer); +127 openState = true; +128 } +129 } +130 /** +131 * A flag indicating whether or not the index is open. +132 */ +133 private boolean openState = false; +134 +135 /** +136 * returns whether or not the index is open. +137 * +138 * @return whether or not the index is open +139 */ +140 public boolean isOpen() { +141 return openState; +142 } +143 +144 /** +145 * Creates the indexing analyzer for the CPE Index. +146 * +147 * @return the CPE Analyzer. +148 */ +149 @SuppressWarnings("unchecked") +150 private Analyzer createIndexingAnalyzer() { +151 final Map fieldAnalyzers = new HashMap(); +152 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); +153 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); +154 } +155 +156 /** +157 * Creates an Analyzer for searching the CPE Index. +158 * +159 * @return the CPE Analyzer. +160 */ +161 @SuppressWarnings("unchecked") +162 private Analyzer createSearchingAnalyzer() { +163 final Map fieldAnalyzers = new HashMap(); +164 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); +165 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +166 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +167 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer); +168 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer); 169 -170 /** -171 * Saves a CPE IndexEntry into the Lucene index. -172 * -173 * @param vendor the vendor to index -174 * @param product the product to index -175 * @param indexWriter the index writer to write the entry into -176 * @throws CorruptIndexException is thrown if the index is corrupt -177 * @throws IOException is thrown if an IOException occurs -178 */ -179 public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException { -180 final Document doc = new Document(); -181 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES); -182 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES); -183 doc.add(v); -184 doc.add(p); -185 indexWriter.addDocument(doc); -186 } -187 -188 /** -189 * Closes the CPE Index. -190 */ -191 public void close() { -192 if (searchingAnalyzer != null) { -193 searchingAnalyzer.close(); -194 searchingAnalyzer = null; -195 } -196 if (indexReader != null) { -197 try { -198 indexReader.close(); -199 } catch (IOException ex) { -200 Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINEST, null, ex); -201 } -202 indexReader = null; -203 } -204 queryParser = null; -205 indexSearcher = null; -206 if (index != null) { -207 index.close(); -208 index = null; -209 } -210 openState = false; -211 } -212 -213 /** -214 * Builds the CPE Lucene Index based off of the data within the CveDB. -215 * -216 * @param cve the data base containing the CPE data -217 * @throws IndexException thrown if there is an issue creating the index -218 */ -219 private void buildIndex(CveDB cve) throws IndexException { -220 Analyzer analyzer = null; -221 IndexWriter indexWriter = null; -222 try { -223 analyzer = createIndexingAnalyzer(); -224 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer); -225 indexWriter = new IndexWriter(index, conf); -226 try { -227 final Set<Pair<String, String>> data = cve.getVendorProductList(); -228 for (Pair<String, String> pair : data) { -229 saveEntry(pair.getLeft(), pair.getRight(), indexWriter); -230 } -231 } catch (DatabaseException ex) { -232 Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINE, null, ex); -233 throw new IndexException("Error reading CPE data", ex); -234 } -235 } catch (CorruptIndexException ex) { -236 throw new IndexException("Unable to close an in-memory index", ex); -237 } catch (IOException ex) { -238 throw new IndexException("Unable to close an in-memory index", ex); -239 } finally { -240 if (indexWriter != null) { -241 try { -242 try { -243 indexWriter.commit(); -244 } finally { -245 indexWriter.close(true); -246 } -247 } catch (CorruptIndexException ex) { -248 throw new IndexException("Unable to close an in-memory index", ex); -249 } catch (IOException ex) { -250 throw new IndexException("Unable to close an in-memory index", ex); -251 } -252 if (analyzer != null) { -253 analyzer.close(); +170 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); +171 } +172 +173 /** +174 * Saves a CPE IndexEntry into the Lucene index. +175 * +176 * @param vendor the vendor to index +177 * @param product the product to index +178 * @param indexWriter the index writer to write the entry into +179 * @throws CorruptIndexException is thrown if the index is corrupt +180 * @throws IOException is thrown if an IOException occurs +181 */ +182 public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException { +183 final Document doc = new Document(); +184 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES); +185 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES); +186 doc.add(v); +187 doc.add(p); +188 indexWriter.addDocument(doc); +189 } +190 +191 /** +192 * Closes the CPE Index. +193 */ +194 public void close() { +195 if (searchingAnalyzer != null) { +196 searchingAnalyzer.close(); +197 searchingAnalyzer = null; +198 } +199 if (indexReader != null) { +200 try { +201 indexReader.close(); +202 } catch (IOException ex) { +203 LOGGER.log(Level.FINEST, null, ex); +204 } +205 indexReader = null; +206 } +207 queryParser = null; +208 indexSearcher = null; +209 if (index != null) { +210 index.close(); +211 index = null; +212 } +213 openState = false; +214 } +215 +216 /** +217 * Builds the CPE Lucene Index based off of the data within the CveDB. +218 * +219 * @param cve the data base containing the CPE data +220 * @throws IndexException thrown if there is an issue creating the index +221 */ +222 private void buildIndex(CveDB cve) throws IndexException { +223 Analyzer analyzer = null; +224 IndexWriter indexWriter = null; +225 try { +226 analyzer = createIndexingAnalyzer(); +227 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer); +228 indexWriter = new IndexWriter(index, conf); +229 try { +230 final Set<Pair<String, String>> data = cve.getVendorProductList(); +231 for (Pair<String, String> pair : data) { +232 saveEntry(pair.getLeft(), pair.getRight(), indexWriter); +233 } +234 } catch (DatabaseException ex) { +235 LOGGER.log(Level.FINE, null, ex); +236 throw new IndexException("Error reading CPE data", ex); +237 } +238 } catch (CorruptIndexException ex) { +239 throw new IndexException("Unable to close an in-memory index", ex); +240 } catch (IOException ex) { +241 throw new IndexException("Unable to close an in-memory index", ex); +242 } finally { +243 if (indexWriter != null) { +244 try { +245 try { +246 indexWriter.commit(); +247 } finally { +248 indexWriter.close(true); +249 } +250 } catch (CorruptIndexException ex) { +251 throw new IndexException("Unable to close an in-memory index", ex); +252 } catch (IOException ex) { +253 throw new IndexException("Unable to close an in-memory index", ex); 254 } -255 } -256 } -257 } -258 -259 /** -260 * Resets the searching analyzers -261 */ -262 private void resetSearchingAnalyzer() { -263 if (productSearchFieldAnalyzer != null) { -264 productSearchFieldAnalyzer.clear(); -265 } -266 if (vendorSearchFieldAnalyzer != null) { -267 vendorSearchFieldAnalyzer.clear(); +255 if (analyzer != null) { +256 analyzer.close(); +257 } +258 } +259 } +260 } +261 +262 /** +263 * Resets the searching analyzers +264 */ +265 private void resetSearchingAnalyzer() { +266 if (productSearchFieldAnalyzer != null) { +267 productSearchFieldAnalyzer.clear(); 268 } -269 } -270 -271 /** -272 * Searches the index using the given search string. -273 * -274 * @param searchString the query text -275 * @param maxQueryResults the maximum number of documents to return -276 * @return the TopDocs found by the search -277 * @throws ParseException thrown when the searchString is invalid -278 * @throws IOException is thrown if there is an issue with the underlying Index -279 */ -280 public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException { -281 if (searchString == null || searchString.trim().isEmpty()) { -282 throw new ParseException("Query is null or empty"); -283 } -284 final Query query = queryParser.parse(searchString); -285 return indexSearcher.search(query, maxQueryResults); -286 } -287 -288 /** -289 * Searches the index using the given query. -290 * -291 * @param query the query used to search the index -292 * @param maxQueryResults the max number of results to return -293 * @return the TopDocs found be the query -294 * @throws CorruptIndexException thrown if the Index is corrupt -295 * @throws IOException thrown if there is an IOException -296 */ -297 public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException { -298 resetSearchingAnalyzer(); -299 return indexSearcher.search(query, maxQueryResults); -300 } -301 -302 /** -303 * Retrieves a document from the Index. -304 * -305 * @param documentId the id of the document to retrieve -306 * @return the Document -307 * @throws IOException thrown if there is an IOException -308 */ -309 public Document getDocument(int documentId) throws IOException { -310 return indexSearcher.doc(documentId); -311 } -312 -313 /** -314 * Returns the number of CPE entries stored in the index. -315 * -316 * @return the number of CPE entries stored in the index -317 */ -318 public int numDocs() { -319 if (indexReader == null) { -320 return -1; -321 } -322 return indexReader.numDocs(); -323 } -324 } +269 if (vendorSearchFieldAnalyzer != null) { +270 vendorSearchFieldAnalyzer.clear(); +271 } +272 } +273 +274 /** +275 * Searches the index using the given search string. +276 * +277 * @param searchString the query text +278 * @param maxQueryResults the maximum number of documents to return +279 * @return the TopDocs found by the search +280 * @throws ParseException thrown when the searchString is invalid +281 * @throws IOException is thrown if there is an issue with the underlying Index +282 */ +283 public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException { +284 if (searchString == null || searchString.trim().isEmpty()) { +285 throw new ParseException("Query is null or empty"); +286 } +287 final Query query = queryParser.parse(searchString); +288 return indexSearcher.search(query, maxQueryResults); +289 } +290 +291 /** +292 * Searches the index using the given query. +293 * +294 * @param query the query used to search the index +295 * @param maxQueryResults the max number of results to return +296 * @return the TopDocs found be the query +297 * @throws CorruptIndexException thrown if the Index is corrupt +298 * @throws IOException thrown if there is an IOException +299 */ +300 public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException { +301 resetSearchingAnalyzer(); +302 return indexSearcher.search(query, maxQueryResults); +303 } +304 +305 /** +306 * Retrieves a document from the Index. +307 * +308 * @param documentId the id of the document to retrieve +309 * @return the Document +310 * @throws IOException thrown if there is an IOException +311 */ +312 public Document getDocument(int documentId) throws IOException { +313 return indexSearcher.doc(documentId); +314 } +315 +316 /** +317 * Returns the number of CPE entries stored in the index. +318 * +319 * @return the number of CPE entries stored in the index +320 */ +321 public int numDocs() { +322 if (indexReader == null) { +323 return -1; +324 } +325 return indexReader.numDocs(); +326 } +327 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html index 7b19902cb..cb96446fc 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html index 56a19409a..df9dd8425 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html index e1b73f806..0024a7b18 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html @@ -37,62 +37,65 @@ 29 * @author Jeremy Long <jeremy.long@owasp.org> 30 */ 31 public final class CweDB { -32 -33 /** -34 * Empty private constructor as this is a utility class. -35 */ -36 private CweDB() { -37 //empty -38 } -39 /** -40 * A HashMap of the CWE data. -41 */ -42 private static final HashMap<String, String> CWE = loadData(); -43 -44 /** -45 * Loads a HashMap containing the CWE data from a resource found in the jar. -46 * -47 * @return a HashMap of CWE data -48 */ -49 private static HashMap<String, String> loadData() { -50 ObjectInputStream oin = null; -51 try { -52 final String filePath = "data/cwe.hashmap.serialized"; -53 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath); -54 oin = new ObjectInputStream(input); -55 return (HashMap<String, String>) oin.readObject(); -56 } catch (ClassNotFoundException ex) { -57 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data. This should not be an issue."); -58 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex); -59 } catch (IOException ex) { -60 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data due to an IO Error. This should not be an issue."); -61 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex); -62 } finally { -63 if (oin != null) { -64 try { -65 oin.close(); -66 } catch (IOException ex) { -67 Logger.getLogger(CweDB.class.getName()).log(Level.FINEST, null, ex); -68 } -69 } -70 } -71 return null; -72 } -73 -74 /** -75 * <p> -76 * Returns the full CWE name from the CWE ID.</p> -77 * -78 * @param cweId the CWE ID -79 * @return the full name of the CWE -80 */ -81 public static String getCweName(String cweId) { -82 if (cweId != null) { -83 return CWE.get(cweId); -84 } -85 return null; -86 } -87 } +32 /** +33 * The Logger. +34 */ +35 private static final Logger LOGGER = Logger.getLogger(CweDB.class.getName()); +36 /** +37 * Empty private constructor as this is a utility class. +38 */ +39 private CweDB() { +40 //empty +41 } +42 /** +43 * A HashMap of the CWE data. +44 */ +45 private static final HashMap<String, String> CWE = loadData(); +46 +47 /** +48 * Loads a HashMap containing the CWE data from a resource found in the jar. +49 * +50 * @return a HashMap of CWE data +51 */ +52 private static HashMap<String, String> loadData() { +53 ObjectInputStream oin = null; +54 try { +55 final String filePath = "data/cwe.hashmap.serialized"; +56 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath); +57 oin = new ObjectInputStream(input); +58 return (HashMap<String, String>) oin.readObject(); +59 } catch (ClassNotFoundException ex) { +60 LOGGER.log(Level.WARNING, "Unable to load CWE data. This should not be an issue."); +61 LOGGER.log(Level.FINE, null, ex); +62 } catch (IOException ex) { +63 LOGGER.log(Level.WARNING, "Unable to load CWE data due to an IO Error. This should not be an issue."); +64 LOGGER.log(Level.FINE, null, ex); +65 } finally { +66 if (oin != null) { +67 try { +68 oin.close(); +69 } catch (IOException ex) { +70 LOGGER.log(Level.FINEST, null, ex); +71 } +72 } +73 } +74 return null; +75 } +76 +77 /** +78 * <p> +79 * Returns the full CWE name from the CWE ID.</p> +80 * +81 * @param cweId the CWE ID +82 * @return the full name of the CWE +83 */ +84 public static String getCweName(String cweId) { +85 if (cweId != null) { +86 return CWE.get(cweId); +87 } +88 return null; +89 } +90 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html index b58fa7b2b..b8b04c426 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html index e5d26bea5..182e15d93 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html index a2676ed20..aba056737 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html @@ -44,51 +44,54 @@ 36 * @author Jeremy Long <jeremy.long@owasp.org> 37 */ 38 public final class UrlTokenizingFilter extends AbstractTokenizingFilter { -39 -40 /** -41 * Constructs a new VersionTokenizingFilter. -42 * -43 * @param stream the TokenStream that this filter will process -44 */ -45 public UrlTokenizingFilter(TokenStream stream) { -46 super(stream); -47 } -48 -49 /** -50 * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by -51 * concatenating tokens with the previous token. -52 * -53 * @return whether or not we have hit the end of the TokenStream -54 * @throws IOException is thrown when an IOException occurs -55 */ -56 @Override -57 public boolean incrementToken() throws IOException { -58 final LinkedList<String> tokens = getTokens(); -59 final CharTermAttribute termAtt = getTermAtt(); -60 if (tokens.size() == 0 && input.incrementToken()) { -61 final String text = new String(termAtt.buffer(), 0, termAtt.length()); -62 if (UrlStringUtils.containsUrl(text)) { -63 final String[] parts = text.split("\\s"); -64 for (String part : parts) { -65 if (UrlStringUtils.isUrl(part)) { -66 try { -67 final List<String> data = UrlStringUtils.extractImportantUrlData(part); -68 tokens.addAll(data); -69 } catch (MalformedURLException ex) { -70 Logger.getLogger(UrlTokenizingFilter.class.getName()).log(Level.FINE, "error parsing " + part, ex); -71 tokens.add(part); -72 } -73 } else { -74 tokens.add(part); -75 } -76 } -77 } else { -78 tokens.add(text); -79 } -80 } -81 return addTerm(); -82 } -83 } +39 /** +40 * The logger. +41 */ +42 private static final Logger LOGGER = Logger.getLogger(UrlTokenizingFilter.class.getName()); +43 /** +44 * Constructs a new VersionTokenizingFilter. +45 * +46 * @param stream the TokenStream that this filter will process +47 */ +48 public UrlTokenizingFilter(TokenStream stream) { +49 super(stream); +50 } +51 +52 /** +53 * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by +54 * concatenating tokens with the previous token. +55 * +56 * @return whether or not we have hit the end of the TokenStream +57 * @throws IOException is thrown when an IOException occurs +58 */ +59 @Override +60 public boolean incrementToken() throws IOException { +61 final LinkedList<String> tokens = getTokens(); +62 final CharTermAttribute termAtt = getTermAtt(); +63 if (tokens.size() == 0 && input.incrementToken()) { +64 final String text = new String(termAtt.buffer(), 0, termAtt.length()); +65 if (UrlStringUtils.containsUrl(text)) { +66 final String[] parts = text.split("\\s"); +67 for (String part : parts) { +68 if (UrlStringUtils.isUrl(part)) { +69 try { +70 final List<String> data = UrlStringUtils.extractImportantUrlData(part); +71 tokens.addAll(data); +72 } catch (MalformedURLException ex) { +73 LOGGER.log(Level.FINE, "error parsing " + part, ex); +74 tokens.add(part); +75 } +76 } else { +77 tokens.add(part); +78 } +79 } +80 } else { +81 tokens.add(text); +82 } +83 } +84 return addTerm(); +85 } +86 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html index f4c976c9c..2c50b56fe 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html index 76ee10a3d..f31687f25 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html index a07bc2e10..e025ceb21 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html @@ -29,159 +29,161 @@ 21 import java.io.IOException; 22 import java.net.HttpURLConnection; 23 import java.net.URL; -24 import java.net.URLConnection; -25 import java.util.logging.Level; -26 import java.util.logging.Logger; -27 import javax.xml.parsers.DocumentBuilder; -28 import javax.xml.parsers.DocumentBuilderFactory; -29 import javax.xml.xpath.XPath; -30 import javax.xml.xpath.XPathFactory; -31 import org.owasp.dependencycheck.utils.InvalidSettingException; -32 import org.owasp.dependencycheck.utils.Settings; -33 import org.owasp.dependencycheck.utils.URLConnectionFactory; -34 import org.w3c.dom.Document; -35 -36 /** -37 * Class of methods to search Nexus repositories. -38 * -39 * @author colezlaw -40 */ -41 public class NexusSearch { -42 -43 /** -44 * The root URL for the Nexus repository service -45 */ -46 private final URL rootURL; -47 -48 /** -49 * Whether to use the Proxy when making requests -50 */ -51 private boolean useProxy; -52 -53 /** -54 * Used for logging. -55 */ -56 private static final Logger LOGGER = Logger.getLogger(NexusSearch.class -57 .getName()); -58 -59 /** -60 * Creates a NexusSearch for the given repository URL. -61 * -62 * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated -63 * relative to this URL, so it should end with a / -64 */ -65 public NexusSearch(URL rootURL) { -66 this.rootURL = rootURL; -67 try { -68 if (null != Settings.getString(Settings.KEYS.PROXY_URL) -69 && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) { -70 useProxy = true; -71 LOGGER.fine("Using proxy"); -72 } else { -73 useProxy = false; -74 LOGGER.fine("Not using proxy"); -75 } -76 } catch (InvalidSettingException ise) { -77 useProxy = false; -78 } -79 } -80 -81 /** -82 * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a -83 * <code>MavenArtifact</code> is populated with the coordinate information. -84 * -85 * @param sha1 The SHA-1 hash string for which to search -86 * @return the populated Maven coordinates -87 * @throws IOException if it's unable to connect to the specified repositor or if the specified artifact is not -88 * found. -89 */ -90 public MavenArtifact searchSha1(String sha1) throws IOException { -91 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) { -92 throw new IllegalArgumentException("Invalid SHA1 format"); -93 } -94 -95 final URL url = new URL(rootURL, String.format("identify/sha1/%s", -96 sha1.toLowerCase())); -97 -98 LOGGER.fine(String.format("Searching Nexus url %s", url.toString())); -99 -100 // Determine if we need to use a proxy. The rules: -101 // 1) If the proxy is set, AND the setting is set to true, use the proxy -102 // 2) Otherwise, don't use the proxy (either the proxy isn't configured, -103 // or proxy is specifically -104 // set to false -105 URLConnection conn = null; -106 conn = URLConnectionFactory.createHttpURLConnection(url, useProxy); +24 import java.util.logging.Level; +25 import java.util.logging.Logger; +26 import javax.xml.parsers.DocumentBuilder; +27 import javax.xml.parsers.DocumentBuilderFactory; +28 import javax.xml.xpath.XPath; +29 import javax.xml.xpath.XPathFactory; +30 import org.owasp.dependencycheck.utils.InvalidSettingException; +31 import org.owasp.dependencycheck.utils.Settings; +32 import org.owasp.dependencycheck.utils.URLConnectionFactory; +33 import org.w3c.dom.Document; +34 +35 /** +36 * Class of methods to search Nexus repositories. +37 * +38 * @author colezlaw +39 */ +40 public class NexusSearch { +41 +42 /** +43 * The root URL for the Nexus repository service +44 */ +45 private final URL rootURL; +46 +47 /** +48 * Whether to use the Proxy when making requests +49 */ +50 private boolean useProxy; +51 +52 /** +53 * Used for logging. +54 */ +55 private static final Logger LOGGER = Logger.getLogger(NexusSearch.class +56 .getName()); +57 +58 /** +59 * Creates a NexusSearch for the given repository URL. +60 * +61 * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated +62 * relative to this URL, so it should end with a / +63 */ +64 public NexusSearch(URL rootURL) { +65 this.rootURL = rootURL; +66 try { +67 if (null != Settings.getString(Settings.KEYS.PROXY_URL) +68 && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) { +69 useProxy = true; +70 LOGGER.fine("Using proxy"); +71 } else { +72 useProxy = false; +73 LOGGER.fine("Not using proxy"); +74 } +75 } catch (InvalidSettingException ise) { +76 useProxy = false; +77 } +78 } +79 +80 /** +81 * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a +82 * <code>MavenArtifact</code> is populated with the coordinate information. +83 * +84 * @param sha1 The SHA-1 hash string for which to search +85 * @return the populated Maven coordinates +86 * @throws IOException if it's unable to connect to the specified repository or if the specified artifact is not +87 * found. +88 */ +89 public MavenArtifact searchSha1(String sha1) throws IOException { +90 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) { +91 throw new IllegalArgumentException("Invalid SHA1 format"); +92 } +93 +94 final URL url = new URL(rootURL, String.format("identify/sha1/%s", +95 sha1.toLowerCase())); +96 +97 LOGGER.fine(String.format("Searching Nexus url %s", url.toString())); +98 +99 // Determine if we need to use a proxy. The rules: +100 // 1) If the proxy is set, AND the setting is set to true, use the proxy +101 // 2) Otherwise, don't use the proxy (either the proxy isn't configured, +102 // or proxy is specifically +103 // set to false +104 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy); +105 +106 conn.setDoOutput(true); 107 -108 conn.setDoOutput(true); -109 -110 // JSON would be more elegant, but there's not currently a dependency -111 // on JSON, so don't want to add one just for this -112 conn.addRequestProperty("Accept", "application/xml"); -113 conn.connect(); -114 -115 try { -116 final DocumentBuilder builder = DocumentBuilderFactory -117 .newInstance().newDocumentBuilder(); -118 final Document doc = builder.parse(conn.getInputStream()); -119 final XPath xpath = XPathFactory.newInstance().newXPath(); -120 final String groupId = xpath -121 .evaluate( -122 "/org.sonatype.nexus.rest.model.NexusArtifact/groupId", -123 doc); -124 final String artifactId = xpath.evaluate( -125 "/org.sonatype.nexus.rest.model.NexusArtifact/artifactId", -126 doc); -127 final String version = xpath -128 .evaluate( -129 "/org.sonatype.nexus.rest.model.NexusArtifact/version", -130 doc); -131 final String link = xpath -132 .evaluate( -133 "/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink", -134 doc); -135 return new MavenArtifact(groupId, artifactId, version, link); -136 } catch (FileNotFoundException fnfe) { -137 /* This is what we get when the SHA1 they sent doesn't exist in -138 * Nexus. This is useful upstream for recovery, so we just re-throw it -139 */ -140 throw fnfe; -141 } catch (Throwable e) { -142 // Anything else is jacked-up XML stuff that we really can't recover -143 // from well -144 throw new IOException(e.getMessage(), e); -145 } -146 } -147 -148 /** -149 * Do a preflight request to see if the repository is actually working. -150 * -151 * @return whether the repository is listening and returns the /status URL correctly -152 */ -153 public boolean preflightRequest() { -154 try { -155 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status"), useProxy); -156 conn.addRequestProperty("Accept", "application/xml"); -157 conn.connect(); -158 if (conn.getResponseCode() != 200) { -159 LOGGER.log(Level.WARNING, "Expected 200 result from Nexus, got {0}", conn.getResponseCode()); -160 return false; -161 } -162 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); -163 final Document doc = builder.parse(conn.getInputStream()); -164 if (!"status".equals(doc.getDocumentElement().getNodeName())) { -165 LOGGER.log(Level.WARNING, "Expected root node name of status, got {0}", doc.getDocumentElement().getNodeName()); -166 return false; -167 } -168 } catch (Throwable e) { -169 return false; -170 } -171 -172 return true; -173 } -174 } -175 -176 // vim: cc=120:sw=4:ts=4:sts=4 +108 // JSON would be more elegant, but there's not currently a dependency +109 // on JSON, so don't want to add one just for this +110 conn.addRequestProperty("Accept", "application/xml"); +111 conn.connect(); +112 +113 if (conn.getResponseCode() == 200) { +114 try { +115 final DocumentBuilder builder = DocumentBuilderFactory +116 .newInstance().newDocumentBuilder(); +117 final Document doc = builder.parse(conn.getInputStream()); +118 final XPath xpath = XPathFactory.newInstance().newXPath(); +119 final String groupId = xpath +120 .evaluate( +121 "/org.sonatype.nexus.rest.model.NexusArtifact/groupId", +122 doc); +123 final String artifactId = xpath.evaluate( +124 "/org.sonatype.nexus.rest.model.NexusArtifact/artifactId", +125 doc); +126 final String version = xpath +127 .evaluate( +128 "/org.sonatype.nexus.rest.model.NexusArtifact/version", +129 doc); +130 final String link = xpath +131 .evaluate( +132 "/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink", +133 doc); +134 return new MavenArtifact(groupId, artifactId, version, link); +135 } catch (Throwable e) { +136 // Anything else is jacked-up XML stuff that we really can't recover +137 // from well +138 throw new IOException(e.getMessage(), e); +139 } +140 } else if (conn.getResponseCode() == 404) { +141 throw new FileNotFoundException("Artifact not found in Nexus"); +142 } else { +143 final String msg = String.format("Could not connect to Nexus received response code: %d %s", +144 conn.getResponseCode(), conn.getResponseMessage()); +145 LOGGER.fine(msg); +146 throw new IOException(msg); +147 } +148 } +149 +150 /** +151 * Do a preflight request to see if the repository is actually working. +152 * +153 * @return whether the repository is listening and returns the /status URL correctly +154 */ +155 public boolean preflightRequest() { +156 try { +157 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status"), useProxy); +158 conn.addRequestProperty("Accept", "application/xml"); +159 conn.connect(); +160 if (conn.getResponseCode() != 200) { +161 LOGGER.log(Level.WARNING, "Expected 200 result from Nexus, got {0}", conn.getResponseCode()); +162 return false; +163 } +164 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); +165 final Document doc = builder.parse(conn.getInputStream()); +166 if (!"status".equals(doc.getDocumentElement().getNodeName())) { +167 LOGGER.log(Level.WARNING, "Expected root node name of status, got {0}", doc.getDocumentElement().getNodeName()); +168 return false; +169 } +170 } catch (Throwable e) { +171 return false; +172 } +173 +174 return true; +175 } +176 } +177 +178 // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html index 611b0bb44..0567b3eb4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html index 5b6cd8f07..4e2eb1759 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/NuspecParseException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/NuspecParseException.html index d2750b5b2..5577e2f1a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/NuspecParseException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/NuspecParseException.html @@ -64,7 +64,7 @@ 56 * Note that the detail message associated with <code>cause</code> is <em>not</em> 57 * automatically incorporated in this exception's detail message. 58 * -59 * @param message the detail message (whcih is saved for later retrieval by the +59 * @param message the detail message (which is saved for later retrieval by the 60 * {@link java.lang.Throwable#getMessage()} method. 61 * @param cause the cause (which is saved for later retrieval by the {@link java.lang.Throwable#getCause()} method). 62 * (A <code>null</code> value is permitted, and indicates that the cause is nonexistent or unknown). diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html index 051cf781f..47a487b56 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html index fb1beca9c..37f307e4f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nuget/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nuget + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nuget diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html index 8ca183633..ad23c22ee 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html @@ -50,295 +50,301 @@ 42 * @author Jeremy Long <jeremy.long@owasp.org> 43 */ 44 public final class ConnectionFactory { -45 -46 /** -47 * The version of the current DB Schema. -48 */ -49 public static final String DB_SCHEMA_VERSION = "2.9"; -50 /** -51 * Resource location for SQL file used to create the database schema. -52 */ -53 public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql"; -54 /** -55 * The database driver used to connect to the database. -56 */ -57 private static Driver driver = null; -58 /** -59 * The database connection string. -60 */ -61 private static String connectionString = null; -62 /** -63 * The username to connect to the database. -64 */ -65 private static String userName = null; -66 /** -67 * The password for the database. -68 */ -69 private static String password = null; -70 -71 /** -72 * Private constructor for this factory class; no instance is ever needed. -73 */ -74 private ConnectionFactory() { -75 } -76 -77 /** -78 * Initializes the connection factory. Ensuring that the appropriate drivers are loaded and that a connection can be -79 * made successfully. -80 * -81 * @throws DatabaseException thrown if we are unable to connect to the database -82 */ -83 public static synchronized void initialize() throws DatabaseException { -84 //this only needs to be called once. -85 if (connectionString != null) { -86 return; -87 } -88 Connection conn = null; -89 try { -90 //load the driver if necessary -91 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, ""); -92 if (!driverName.isEmpty()) { //likely need to load the correct driver -93 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver: {0}", driverName); -94 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, ""); -95 try { -96 if (!driverPath.isEmpty()) { -97 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver from: {0}", driverPath); -98 driver = DriverLoader.load(driverName, driverPath); -99 } else { -100 driver = DriverLoader.load(driverName); -101 } -102 } catch (DriverLoadException ex) { -103 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Unable to load database driver", ex); -104 throw new DatabaseException("Unable to load database driver"); -105 } -106 } -107 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser"); -108 //yes, yes - hard-coded password - only if there isn't one in the properties file. -109 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); -110 try { -111 connectionString = getConnectionString(); -112 } catch (IOException ex) { -113 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, -114 "Unable to retrieve the database connection string", ex); -115 throw new DatabaseException("Unable to retrieve the database connection string"); -116 } -117 boolean shouldCreateSchema = false; -118 try { -119 if (connectionString.startsWith("jdbc:h2:file:")) { //H2 -120 shouldCreateSchema = !dbSchemaExists(); -121 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Need to create DB Structure: {0}", shouldCreateSchema); -122 } -123 } catch (IOException ioex) { -124 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Unable to verify database exists", ioex); -125 throw new DatabaseException("Unable to verify database exists"); -126 } -127 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading database connection"); -128 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Connection String: {0}", connectionString); -129 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Database User: {0}", userName); -130 -131 try { -132 conn = DriverManager.getConnection(connectionString, userName, password); -133 } catch (SQLException ex) { -134 if (ex.getMessage().contains("java.net.UnknownHostException") && connectionString.contains("AUTO_SERVER=TRUE;")) { -135 connectionString = connectionString.replace("AUTO_SERVER=TRUE;", ""); -136 try { -137 conn = DriverManager.getConnection(connectionString, userName, password); -138 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); -139 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, -140 "Unable to start the database in server mode; reverting to single user mode"); -141 } catch (SQLException sqlex) { -142 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Unable to connect to the database", ex); -143 throw new DatabaseException("Unable to connect to the database"); -144 } -145 } else { -146 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Unable to connect to the database", ex); -147 throw new DatabaseException("Unable to connect to the database"); -148 } -149 } -150 -151 if (shouldCreateSchema) { -152 try { -153 createTables(conn); -154 } catch (DatabaseException dex) { -155 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, dex); -156 throw new DatabaseException("Unable to create the database structure"); -157 } -158 } else { -159 try { -160 ensureSchemaVersion(conn); -161 } catch (DatabaseException dex) { -162 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, dex); -163 throw new DatabaseException("Database schema does not match this version of dependency-check"); -164 } -165 } -166 } finally { -167 if (conn != null) { -168 try { -169 conn.close(); -170 } catch (SQLException ex) { -171 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "An error occured closing the connection", ex); -172 } -173 } -174 } -175 } -176 -177 /** -178 * Cleans up resources and unloads any registered database drivers. This needs to be called to ensure the driver is -179 * unregistered prior to the finalize method being called as during shutdown the class loader used to load the -180 * driver may be unloaded prior to the driver being de-registered. -181 */ -182 public static synchronized void cleanup() { -183 if (driver != null) { -184 try { -185 DriverManager.deregisterDriver(driver); -186 } catch (SQLException ex) { -187 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "An error occured unloading the databse driver", ex); -188 } -189 driver = null; -190 } -191 connectionString = null; -192 userName = null; -193 password = null; -194 } -195 -196 /** -197 * Constructs a new database connection object per the database configuration. -198 * -199 * @return a database connection object -200 * @throws DatabaseException thrown if there is an exception loading the database connection -201 */ -202 public static Connection getConnection() throws DatabaseException { -203 initialize(); -204 Connection conn = null; -205 try { -206 conn = DriverManager.getConnection(connectionString, userName, password); -207 } catch (SQLException ex) { -208 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -209 throw new DatabaseException("Unable to connect to the database"); -210 } -211 return conn; -212 } -213 -214 /** -215 * Returns the configured connection string. If using the embedded H2 database this function will also ensure the -216 * data directory exists and if not create it. -217 * -218 * @return the connection string -219 * @throws IOException thrown the data directory cannot be created -220 */ -221 private static String getConnectionString() throws IOException { -222 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE"); -223 if (connStr.contains("%s")) { -224 final String directory = getDataDirectory().getCanonicalPath(); -225 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION); -226 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, String.format("File path for H2 file: '%s'", dataFile.toString())); -227 return String.format(connStr, dataFile.getAbsolutePath()); -228 } -229 return connStr; -230 } -231 -232 /** -233 * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory -234 * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private. -235 * -236 * @return the data directory to store data files -237 * @throws IOException is thrown if an IOException occurs of course... -238 */ -239 public static File getDataDirectory() throws IOException { -240 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); -241 if (!path.exists()) { -242 if (!path.mkdirs()) { -243 throw new IOException("Unable to create NVD CVE Data directory"); -244 } -245 } -246 return path; -247 } -248 -249 /** -250 * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created. -251 * -252 * @return true if the H2 database file does not exist; otherwise false -253 * @throws IOException thrown if the data directory does not exist and cannot be created -254 */ -255 private static boolean dbSchemaExists() throws IOException { -256 final File dir = getDataDirectory(); -257 final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION); -258 final File file = new File(dir, name); -259 return file.exists(); -260 } -261 -262 /** -263 * Creates the database structure (tables and indexes) to store the CVE data. -264 * -265 * @param conn the database connection -266 * @throws DatabaseException thrown if there is a Database Exception -267 */ -268 private static void createTables(Connection conn) throws DatabaseException { -269 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Creating database structure"); -270 InputStream is; -271 InputStreamReader reader; -272 BufferedReader in = null; -273 try { -274 is = ConnectionFactory.class.getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE); -275 reader = new InputStreamReader(is, "UTF-8"); -276 in = new BufferedReader(reader); -277 final StringBuilder sb = new StringBuilder(2110); -278 String tmp; -279 while ((tmp = in.readLine()) != null) { -280 sb.append(tmp); -281 } -282 Statement statement = null; -283 try { -284 statement = conn.createStatement(); -285 statement.execute(sb.toString()); -286 } catch (SQLException ex) { -287 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -288 throw new DatabaseException("Unable to create database statement", ex); -289 } finally { -290 DBUtils.closeStatement(statement); -291 } -292 } catch (IOException ex) { -293 throw new DatabaseException("Unable to create database schema", ex); -294 } finally { -295 if (in != null) { -296 try { -297 in.close(); -298 } catch (IOException ex) { -299 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINEST, null, ex); -300 } -301 } -302 } -303 } -304 -305 /** -306 * Uses the provided connection to check the specified schema version within the database. -307 * -308 * @param conn the database connection object -309 * @throws DatabaseException thrown if the schema version is not compatible with this version of dependency-check -310 */ -311 private static void ensureSchemaVersion(Connection conn) throws DatabaseException { -312 ResultSet rs = null; -313 CallableStatement cs = null; -314 try { -315 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'"); -316 rs = cs.executeQuery(); -317 if (rs.next()) { -318 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1)); -319 if (isWrongSchema) { -320 throw new DatabaseException("Incorrect database schema; unable to continue"); -321 } -322 } else { -323 throw new DatabaseException("Database schema is missing"); -324 } -325 } catch (SQLException ex) { -326 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -327 throw new DatabaseException("Unable to check the database schema version"); -328 } finally { -329 DBUtils.closeResultSet(rs); -330 DBUtils.closeStatement(cs); -331 } -332 } -333 } +45 /** +46 * The Logger. +47 */ +48 private static final Logger LOGGER = Logger.getLogger(ConnectionFactory.class.getName()); +49 /** +50 * The version of the current DB Schema. +51 */ +52 public static final String DB_SCHEMA_VERSION = "2.9"; +53 /** +54 * Resource location for SQL file used to create the database schema. +55 */ +56 public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql"; +57 /** +58 * The database driver used to connect to the database. +59 */ +60 private static Driver driver = null; +61 /** +62 * The database connection string. +63 */ +64 private static String connectionString = null; +65 /** +66 * The username to connect to the database. +67 */ +68 private static String userName = null; +69 /** +70 * The password for the database. +71 */ +72 private static String password = null; +73 +74 /** +75 * Private constructor for this factory class; no instance is ever needed. +76 */ +77 private ConnectionFactory() { +78 } +79 +80 /** +81 * Initializes the connection factory. Ensuring that the appropriate drivers are loaded and that a connection can be +82 * made successfully. +83 * +84 * @throws DatabaseException thrown if we are unable to connect to the database +85 */ +86 public static synchronized void initialize() throws DatabaseException { +87 //this only needs to be called once. +88 if (connectionString != null) { +89 return; +90 } +91 Connection conn = null; +92 try { +93 //load the driver if necessary +94 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, ""); +95 if (!driverName.isEmpty()) { //likely need to load the correct driver +96 LOGGER.log(Level.FINE, "Loading driver: {0}", driverName); +97 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, ""); +98 try { +99 if (!driverPath.isEmpty()) { +100 LOGGER.log(Level.FINE, "Loading driver from: {0}", driverPath); +101 driver = DriverLoader.load(driverName, driverPath); +102 } else { +103 driver = DriverLoader.load(driverName); +104 } +105 } catch (DriverLoadException ex) { +106 LOGGER.log(Level.FINE, "Unable to load database driver", ex); +107 throw new DatabaseException("Unable to load database driver"); +108 } +109 } +110 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser"); +111 //yes, yes - hard-coded password - only if there isn't one in the properties file. +112 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); +113 try { +114 connectionString = getConnectionString(); +115 } catch (IOException ex) { +116 LOGGER.log(Level.FINE, +117 "Unable to retrieve the database connection string", ex); +118 throw new DatabaseException("Unable to retrieve the database connection string"); +119 } +120 boolean shouldCreateSchema = false; +121 try { +122 if (connectionString.startsWith("jdbc:h2:file:")) { //H2 +123 shouldCreateSchema = !dbSchemaExists(); +124 LOGGER.log(Level.FINE, "Need to create DB Structure: {0}", shouldCreateSchema); +125 } +126 } catch (IOException ioex) { +127 LOGGER.log(Level.FINE, "Unable to verify database exists", ioex); +128 throw new DatabaseException("Unable to verify database exists"); +129 } +130 LOGGER.log(Level.FINE, "Loading database connection"); +131 LOGGER.log(Level.FINE, "Connection String: {0}", connectionString); +132 LOGGER.log(Level.FINE, "Database User: {0}", userName); +133 +134 try { +135 conn = DriverManager.getConnection(connectionString, userName, password); +136 } catch (SQLException ex) { +137 if (ex.getMessage().contains("java.net.UnknownHostException") && connectionString.contains("AUTO_SERVER=TRUE;")) { +138 connectionString = connectionString.replace("AUTO_SERVER=TRUE;", ""); +139 try { +140 conn = DriverManager.getConnection(connectionString, userName, password); +141 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +142 LOGGER.log(Level.FINE, +143 "Unable to start the database in server mode; reverting to single user mode"); +144 } catch (SQLException sqlex) { +145 LOGGER.log(Level.FINE, "Unable to connect to the database", ex); +146 throw new DatabaseException("Unable to connect to the database"); +147 } +148 } else { +149 LOGGER.log(Level.FINE, "Unable to connect to the database", ex); +150 throw new DatabaseException("Unable to connect to the database"); +151 } +152 } +153 +154 if (shouldCreateSchema) { +155 try { +156 createTables(conn); +157 } catch (DatabaseException dex) { +158 LOGGER.log(Level.FINE, null, dex); +159 throw new DatabaseException("Unable to create the database structure"); +160 } +161 } else { +162 try { +163 ensureSchemaVersion(conn); +164 } catch (DatabaseException dex) { +165 LOGGER.log(Level.FINE, null, dex); +166 throw new DatabaseException("Database schema does not match this version of dependency-check"); +167 } +168 } +169 } finally { +170 if (conn != null) { +171 try { +172 conn.close(); +173 } catch (SQLException ex) { +174 LOGGER.log(Level.FINE, "An error occurred closing the connection", ex); +175 } +176 } +177 } +178 } +179 +180 /** +181 * Cleans up resources and unloads any registered database drivers. This needs to be called to ensure the driver is +182 * unregistered prior to the finalize method being called as during shutdown the class loader used to load the +183 * driver may be unloaded prior to the driver being de-registered. +184 */ +185 public static synchronized void cleanup() { +186 if (driver != null) { +187 try { +188 DriverManager.deregisterDriver(driver); +189 } catch (SQLException ex) { +190 LOGGER.log(Level.FINE, "An error occurred unloading the database driver", ex); +191 } catch (Throwable unexpected) { +192 LOGGER.log(Level.FINE, +193 "An unexpected throwable occurred unloading the database driver", unexpected); +194 } +195 driver = null; +196 } +197 connectionString = null; +198 userName = null; +199 password = null; +200 } +201 +202 /** +203 * Constructs a new database connection object per the database configuration. +204 * +205 * @return a database connection object +206 * @throws DatabaseException thrown if there is an exception loading the database connection +207 */ +208 public static Connection getConnection() throws DatabaseException { +209 initialize(); +210 Connection conn = null; +211 try { +212 conn = DriverManager.getConnection(connectionString, userName, password); +213 } catch (SQLException ex) { +214 LOGGER.log(Level.FINE, null, ex); +215 throw new DatabaseException("Unable to connect to the database"); +216 } +217 return conn; +218 } +219 +220 /** +221 * Returns the configured connection string. If using the embedded H2 database this function will also ensure the +222 * data directory exists and if not create it. +223 * +224 * @return the connection string +225 * @throws IOException thrown the data directory cannot be created +226 */ +227 private static String getConnectionString() throws IOException { +228 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE"); +229 if (connStr.contains("%s")) { +230 final String directory = getDataDirectory().getCanonicalPath(); +231 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION); +232 LOGGER.log(Level.FINE, String.format("File path for H2 file: '%s'", dataFile.toString())); +233 return String.format(connStr, dataFile.getAbsolutePath()); +234 } +235 return connStr; +236 } +237 +238 /** +239 * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory +240 * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private. +241 * +242 * @return the data directory to store data files +243 * @throws IOException is thrown if an IOException occurs of course... +244 */ +245 public static File getDataDirectory() throws IOException { +246 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); +247 if (!path.exists()) { +248 if (!path.mkdirs()) { +249 throw new IOException("Unable to create NVD CVE Data directory"); +250 } +251 } +252 return path; +253 } +254 +255 /** +256 * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created. +257 * +258 * @return true if the H2 database file does not exist; otherwise false +259 * @throws IOException thrown if the data directory does not exist and cannot be created +260 */ +261 private static boolean dbSchemaExists() throws IOException { +262 final File dir = getDataDirectory(); +263 final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION); +264 final File file = new File(dir, name); +265 return file.exists(); +266 } +267 +268 /** +269 * Creates the database structure (tables and indexes) to store the CVE data. +270 * +271 * @param conn the database connection +272 * @throws DatabaseException thrown if there is a Database Exception +273 */ +274 private static void createTables(Connection conn) throws DatabaseException { +275 LOGGER.log(Level.FINE, "Creating database structure"); +276 InputStream is; +277 InputStreamReader reader; +278 BufferedReader in = null; +279 try { +280 is = ConnectionFactory.class.getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE); +281 reader = new InputStreamReader(is, "UTF-8"); +282 in = new BufferedReader(reader); +283 final StringBuilder sb = new StringBuilder(2110); +284 String tmp; +285 while ((tmp = in.readLine()) != null) { +286 sb.append(tmp); +287 } +288 Statement statement = null; +289 try { +290 statement = conn.createStatement(); +291 statement.execute(sb.toString()); +292 } catch (SQLException ex) { +293 LOGGER.log(Level.FINE, null, ex); +294 throw new DatabaseException("Unable to create database statement", ex); +295 } finally { +296 DBUtils.closeStatement(statement); +297 } +298 } catch (IOException ex) { +299 throw new DatabaseException("Unable to create database schema", ex); +300 } finally { +301 if (in != null) { +302 try { +303 in.close(); +304 } catch (IOException ex) { +305 LOGGER.log(Level.FINEST, null, ex); +306 } +307 } +308 } +309 } +310 +311 /** +312 * Uses the provided connection to check the specified schema version within the database. +313 * +314 * @param conn the database connection object +315 * @throws DatabaseException thrown if the schema version is not compatible with this version of dependency-check +316 */ +317 private static void ensureSchemaVersion(Connection conn) throws DatabaseException { +318 ResultSet rs = null; +319 CallableStatement cs = null; +320 try { +321 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'"); +322 rs = cs.executeQuery(); +323 if (rs.next()) { +324 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1)); +325 if (isWrongSchema) { +326 throw new DatabaseException("Incorrect database schema; unable to continue"); +327 } +328 } else { +329 throw new DatabaseException("Database schema is missing"); +330 } +331 } catch (SQLException ex) { +332 LOGGER.log(Level.FINE, null, ex); +333 throw new DatabaseException("Unable to check the database schema version"); +334 } finally { +335 DBUtils.closeResultSet(rs); +336 DBUtils.closeStatement(cs); +337 } +338 } +339 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html index baebac15f..9fa7629d9 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html @@ -54,750 +54,753 @@ 46 * @author Jeremy Long <jeremy.long@owasp.org> 47 */ 48 public class CveDB { -49 -50 /** -51 * Database connection -52 */ -53 private Connection conn; -54 -55 /** -56 * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller -57 * by calling the close method. -58 * -59 * @throws DatabaseException thrown if there is an exception opening the database. -60 */ -61 public CveDB() throws DatabaseException { -62 super(); -63 try { -64 open(); -65 databaseProperties = new DatabaseProperties(this); -66 } catch (DatabaseException ex) { -67 throw ex; -68 } -69 } -70 -71 /** -72 * Returns the database connection. -73 * -74 * @return the database connection -75 */ -76 protected Connection getConnection() { -77 return conn; -78 } -79 -80 /** -81 * Opens the database connection. If the database does not exist, it will create a new one. -82 * -83 * @throws DatabaseException thrown if there is an error opening the database connection -84 */ -85 public final void open() throws DatabaseException { -86 conn = ConnectionFactory.getConnection(); -87 } -88 -89 /** -90 * Closes the DB4O database. Close should be called on this object when it is done being used. -91 */ -92 public void close() { -93 if (conn != null) { -94 try { -95 conn.close(); -96 } catch (SQLException ex) { -97 final String msg = "There was an error attempting to close the CveDB, see the log for more details."; -98 Logger.getLogger(DBUtils.class.getName()).log(Level.SEVERE, msg); -99 Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, null, ex); -100 } catch (Throwable ex) { -101 final String msg = "There was an exception attempting to close the CveDB, see the log for more details."; -102 Logger.getLogger(DBUtils.class.getName()).log(Level.SEVERE, msg); -103 Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, null, ex); -104 } -105 conn = null; -106 } -107 } -108 -109 /** -110 * Returns whether the database connection is open or closed. -111 * -112 * @return whether the database connection is open or closed -113 */ -114 public boolean isOpen() { -115 return conn != null; -116 } -117 -118 /** -119 * Commits all completed transactions. -120 * -121 * @throws SQLException thrown if a SQL Exception occurs -122 */ -123 public void commit() throws SQLException { -124 //temporary remove this as autocommit is on. -125 //if (conn != null) { -126 // conn.commit(); -127 //} -128 } -129 -130 /** -131 * Cleans up the object and ensures that "close" has been called. -132 * -133 * @throws Throwable thrown if there is a problem -134 */ -135 @Override -136 @SuppressWarnings("FinalizeDeclaration") -137 protected void finalize() throws Throwable { -138 Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, "Entering finalize"); -139 close(); -140 super.finalize(); -141 } -142 /** -143 * Database properties object containing the 'properties' from the database table. -144 */ -145 private DatabaseProperties databaseProperties; -146 -147 /** -148 * Get the value of databaseProperties. -149 * -150 * @return the value of databaseProperties -151 */ -152 public DatabaseProperties getDatabaseProperties() { -153 return databaseProperties; -154 } -155 //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database"> -156 /** -157 * SQL Statement to delete references by vulnerability ID. -158 */ -159 private static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?"; -160 /** -161 * SQL Statement to delete software by vulnerability ID. -162 */ -163 private static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?"; -164 /** -165 * SQL Statement to delete a vulnerability by CVE. -166 */ -167 private static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE id = ?"; -168 /** -169 * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works -170 * well to keep the data file size down a bit. -171 */ -172 private static final String CLEANUP_ORPHANS = "DELETE FROM CpeEntry WHERE id not in (SELECT CPEEntryId FROM Software); "; -173 /** -174 * SQL Statement to insert a new reference. -175 */ -176 private static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)"; -177 /** -178 * SQL Statement to insert a new software. -179 */ -180 private static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpeEntryId, previousVersion) VALUES (?, ?, ?)"; -181 /** -182 * SQL Statement to insert a new cpe. -183 */ -184 private static final String INSERT_CPE = "INSERT INTO cpeEntry (cpe, vendor, product) VALUES (?, ?, ?)"; -185 /** -186 * SQL Statement to get a CPEProductID. -187 */ -188 private static final String SELECT_CPE_ID = "SELECT id FROM cpeEntry WHERE cpe = ?"; -189 /** -190 * SQL Statement to insert a new vulnerability. -191 */ -192 private static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cve, description, cwe, cvssScore, cvssAccessVector, " -193 + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) " -194 + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; -195 /** -196 * SQL Statement to update a vulnerability. -197 */ -198 private static final String UPDATE_VULNERABILITY = "UPDATE vulnerability SET description=?, cwe=?, cvssScore=?, cvssAccessVector=?, " -199 + "cvssAccessComplexity=?, cvssAuthentication=?, cvssConfidentialityImpact=?, cvssIntegrityImpact=?, cvssAvailabilityImpact=? " -200 + "WHERE id=?"; -201 /** -202 * SQL Statement to find CVE entries based on CPE data. -203 */ -204 private static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cve, cpe, previousVersion " -205 + "FROM software INNER JOIN vulnerability ON vulnerability.id = software.cveId " -206 + "INNER JOIN cpeEntry ON cpeEntry.id = software.cpeEntryId " -207 + "WHERE vendor = ? AND product = ?"; -208 //unfortunately, the version info is too complicated to do in a select. Need to filter this afterwards -209 // + " AND (version = '-' OR previousVersion IS NOT NULL OR version=?)"; -210 // -211 /** -212 * SQL Statement to find the CPE entry based on the vendor and product. -213 */ -214 private static final String SELECT_CPE_ENTRIES = "SELECT cpe FROM cpeEntry WHERE vendor = ? AND product = ?"; -215 /** -216 * SQL Statement to select references by CVEID. -217 */ -218 private static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?"; -219 /** -220 * SQL Statement to select vendor and product for lucene index. -221 */ -222 private static final String SELECT_VENDOR_PRODUCT_LIST = "SELECT vendor, product FROM cpeEntry GROUP BY vendor, product"; -223 /** -224 * SQL Statement to select software by CVEID. -225 */ -226 private static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion " -227 + "FROM software INNER JOIN cpeEntry ON software.cpeEntryId = cpeEntry.id WHERE cveid = ?"; -228 // public static final String SELECT_SOFTWARE = "SELECT part, vendor, product, version, revision, previousVersion " -229 // + "FROM software INNER JOIN cpeProduct ON cpeProduct.id = software.cpeProductId LEFT JOIN cpeVersion ON " -230 // + "software.cpeVersionId = cpeVersion.id LEFT JOIN Version ON cpeVersion.versionId = version.id WHERE cveid = ?"; -231 /** -232 * SQL Statement to select a vulnerability by CVEID. -233 */ -234 private static final String SELECT_VULNERABILITY = "SELECT id, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, " -235 + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cve = ?"; -236 /** -237 * SQL Statement to select a vulnerability's primary key. -238 */ -239 private static final String SELECT_VULNERABILITY_ID = "SELECT id FROM vulnerability WHERE cve = ?"; -240 /** -241 * SQL Statement to retrieve the properties from the database. -242 */ -243 private static final String SELECT_PROPERTIES = "SELECT id, value FROM properties"; -244 /** -245 * SQL Statement to retrieve a property from the database. -246 */ -247 private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?"; -248 /** -249 * SQL Statement to insert a new property. -250 */ -251 private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)"; -252 /** -253 * SQL Statement to update a property. -254 */ -255 private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?"; -256 /** -257 * SQL Statement to delete a property. -258 */ -259 private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?"; -260 -261 //</editor-fold> -262 /** -263 * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination. -264 * The returned list will include all versions of the product that are registered in the NVD CVE data. -265 * -266 * @param vendor the identified vendor name of the dependency being analyzed -267 * @param product the identified name of the product of the dependency being analyzed -268 * @return a set of vulnerable software -269 */ -270 public Set<VulnerableSoftware> getCPEs(String vendor, String product) { -271 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>(); -272 ResultSet rs = null; -273 PreparedStatement ps = null; -274 try { -275 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES); -276 ps.setString(1, vendor); -277 ps.setString(2, product); -278 rs = ps.executeQuery(); -279 -280 while (rs.next()) { -281 final VulnerableSoftware vs = new VulnerableSoftware(); -282 vs.setCpe(rs.getString(1)); -283 cpe.add(vs); -284 } -285 } catch (SQLException ex) { -286 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -287 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -288 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -289 } finally { -290 DBUtils.closeResultSet(rs); -291 DBUtils.closeStatement(ps); -292 } -293 return cpe; -294 } -295 -296 /** -297 * Returns the entire list of vendor/product combinations. -298 * -299 * @return the entire list of vendor/product combinations -300 * @throws DatabaseException thrown when there is an error retrieving the data from the DB -301 */ -302 public Set<Pair<String, String>> getVendorProductList() throws DatabaseException { -303 final HashSet data = new HashSet<Pair<String, String>>(); -304 ResultSet rs = null; -305 PreparedStatement ps = null; -306 try { -307 ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST); -308 rs = ps.executeQuery(); -309 while (rs.next()) { -310 data.add(new Pair(rs.getString(1), rs.getString(2))); -311 } -312 } catch (SQLException ex) { -313 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -314 throw new DatabaseException(msg, ex); -315 } finally { -316 DBUtils.closeResultSet(rs); -317 DBUtils.closeStatement(ps); -318 } -319 return data; -320 } -321 -322 /** -323 * Returns a set of properties. -324 * -325 * @return the properties from the database -326 */ -327 Properties getProperties() { -328 final Properties prop = new Properties(); -329 PreparedStatement ps = null; -330 ResultSet rs = null; -331 try { -332 ps = getConnection().prepareStatement(SELECT_PROPERTIES); -333 rs = ps.executeQuery(); -334 while (rs.next()) { -335 prop.setProperty(rs.getString(1), rs.getString(2)); -336 } -337 } catch (SQLException ex) { -338 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -339 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -340 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -341 } finally { -342 DBUtils.closeStatement(ps); -343 DBUtils.closeResultSet(rs); -344 } -345 return prop; -346 } -347 -348 /** -349 * Saves a set of properties to the database. -350 * -351 * @param props a collection of properties -352 */ -353 void saveProperties(Properties props) { -354 PreparedStatement updateProperty = null; -355 PreparedStatement insertProperty = null; -356 try { -357 try { -358 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); -359 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); -360 } catch (SQLException ex) { -361 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); -362 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); -363 return; -364 } -365 for (Entry<Object, Object> entry : props.entrySet()) { -366 final String key = entry.getKey().toString(); -367 final String value = entry.getValue().toString(); -368 try { -369 updateProperty.setString(1, value); -370 updateProperty.setString(2, key); -371 if (updateProperty.executeUpdate() == 0) { -372 insertProperty.setString(1, key); -373 insertProperty.setString(2, value); -374 } -375 } catch (SQLException ex) { -376 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); -377 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg); -378 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -379 } -380 } -381 } finally { -382 DBUtils.closeStatement(updateProperty); -383 DBUtils.closeStatement(insertProperty); -384 } -385 } -386 -387 /** -388 * Saves a property to the database. -389 * -390 * @param key the property key -391 * @param value the property value -392 */ -393 void saveProperty(String key, String value) { -394 PreparedStatement updateProperty = null; -395 PreparedStatement insertProperty = null; -396 try { -397 try { -398 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); -399 } catch (SQLException ex) { -400 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); -401 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); -402 return; -403 } -404 try { -405 updateProperty.setString(1, value); -406 updateProperty.setString(2, key); -407 if (updateProperty.executeUpdate() == 0) { -408 try { -409 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); -410 } catch (SQLException ex) { -411 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); -412 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); -413 return; -414 } -415 insertProperty.setString(1, key); -416 insertProperty.setString(2, value); -417 insertProperty.execute(); -418 } -419 } catch (SQLException ex) { -420 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); -421 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg); -422 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -423 } -424 } finally { -425 DBUtils.closeStatement(updateProperty); -426 DBUtils.closeStatement(insertProperty); -427 } -428 } -429 -430 /** -431 * Retrieves the vulnerabilities associated with the specified CPE. -432 * -433 * @param cpeStr the CPE name -434 * @return a list of Vulnerabilities -435 * @throws DatabaseException thrown if there is an exception retrieving data -436 */ -437 public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException { -438 ResultSet rs = null; -439 final VulnerableSoftware cpe = new VulnerableSoftware(); -440 try { -441 cpe.parseName(cpeStr); -442 } catch (UnsupportedEncodingException ex) { -443 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex); -444 } -445 final DependencyVersion detectedVersion = parseDependencyVersion(cpe); -446 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>(); -447 -448 PreparedStatement ps; -449 final HashSet<String> cveEntries = new HashSet<String>(); -450 try { -451 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE); -452 ps.setString(1, cpe.getVendor()); -453 ps.setString(2, cpe.getProduct()); -454 rs = ps.executeQuery(); -455 while (rs.next()) { -456 final String cveId = rs.getString(1); -457 final String cpeId = rs.getString(2); -458 final String previous = rs.getString(3); -459 if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) { -460 cveEntries.add(cveId); -461 final Vulnerability v = getVulnerability(cveId); -462 v.setMatchedCPE(cpeId, previous); -463 vulnerabilities.add(v); -464 } -465 } -466 DBUtils.closeResultSet(rs); -467 DBUtils.closeStatement(ps); -468 // for (String cve : cveEntries) { -469 // final Vulnerability v = getVulnerability(cve); -470 // vulnerabilities.add(v); -471 // } -472 -473 } catch (SQLException ex) { -474 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex); -475 } finally { -476 DBUtils.closeResultSet(rs); -477 } -478 return vulnerabilities; -479 } -480 -481 /** -482 * Gets a vulnerability for the provided CVE. -483 * -484 * @param cve the CVE to lookup -485 * @return a vulnerability object -486 * @throws DatabaseException if an exception occurs -487 */ -488 private Vulnerability getVulnerability(String cve) throws DatabaseException { -489 PreparedStatement psV = null; -490 PreparedStatement psR = null; -491 PreparedStatement psS = null; -492 ResultSet rsV = null; -493 ResultSet rsR = null; -494 ResultSet rsS = null; -495 Vulnerability vuln = null; -496 try { -497 psV = getConnection().prepareStatement(SELECT_VULNERABILITY); -498 psV.setString(1, cve); -499 rsV = psV.executeQuery(); -500 if (rsV.next()) { -501 vuln = new Vulnerability(); -502 vuln.setName(cve); -503 vuln.setDescription(rsV.getString(2)); -504 String cwe = rsV.getString(3); -505 if (cwe != null) { -506 final String name = CweDB.getCweName(cwe); -507 if (name != null) { -508 cwe += " " + name; -509 } -510 } -511 final int cveId = rsV.getInt(1); -512 vuln.setCwe(cwe); -513 vuln.setCvssScore(rsV.getFloat(4)); -514 vuln.setCvssAccessVector(rsV.getString(5)); -515 vuln.setCvssAccessComplexity(rsV.getString(6)); -516 vuln.setCvssAuthentication(rsV.getString(7)); -517 vuln.setCvssConfidentialityImpact(rsV.getString(8)); -518 vuln.setCvssIntegrityImpact(rsV.getString(9)); -519 vuln.setCvssAvailabilityImpact(rsV.getString(10)); -520 -521 psR = getConnection().prepareStatement(SELECT_REFERENCE); -522 psR.setInt(1, cveId); -523 rsR = psR.executeQuery(); -524 while (rsR.next()) { -525 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3)); -526 } -527 psS = getConnection().prepareStatement(SELECT_SOFTWARE); -528 psS.setInt(1, cveId); -529 rsS = psS.executeQuery(); -530 while (rsS.next()) { -531 final String cpe = rsS.getString(1); -532 final String prevVersion = rsS.getString(2); -533 if (prevVersion == null) { -534 vuln.addVulnerableSoftware(cpe); -535 } else { -536 vuln.addVulnerableSoftware(cpe, prevVersion); -537 } -538 } -539 } -540 } catch (SQLException ex) { -541 throw new DatabaseException("Error retrieving " + cve, ex); -542 } finally { -543 DBUtils.closeResultSet(rsV); -544 DBUtils.closeResultSet(rsR); -545 DBUtils.closeResultSet(rsS); -546 DBUtils.closeStatement(psV); -547 DBUtils.closeStatement(psR); -548 DBUtils.closeStatement(psS); -549 } -550 return vuln; -551 } -552 -553 /** -554 * Updates the vulnerability within the database. If the vulnerability does not exist it will be added. -555 * -556 * @param vuln the vulnerability to add to the database -557 * @throws DatabaseException is thrown if the database -558 */ -559 public void updateVulnerability(Vulnerability vuln) throws DatabaseException { -560 PreparedStatement selectVulnerabilityId = null; -561 PreparedStatement deleteVulnerability = null; -562 PreparedStatement deleteReferences = null; -563 PreparedStatement deleteSoftware = null; -564 PreparedStatement updateVulnerability = null; -565 PreparedStatement insertVulnerability = null; -566 PreparedStatement insertReference = null; -567 PreparedStatement selectCpeId = null; -568 PreparedStatement insertCpe = null; -569 PreparedStatement insertSoftware = null; -570 -571 try { -572 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID); -573 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY); -574 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE); -575 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE); -576 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY); -577 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS); -578 insertReference = getConnection().prepareStatement(INSERT_REFERENCE); -579 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID); -580 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS); -581 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE); -582 int vulnerabilityId = 0; -583 selectVulnerabilityId.setString(1, vuln.getName()); -584 ResultSet rs = selectVulnerabilityId.executeQuery(); -585 if (rs.next()) { -586 vulnerabilityId = rs.getInt(1); -587 // first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier. -588 deleteReferences.setInt(1, vulnerabilityId); -589 deleteReferences.execute(); -590 deleteSoftware.setInt(1, vulnerabilityId); -591 deleteSoftware.execute(); -592 } -593 DBUtils.closeResultSet(rs); -594 rs = null; -595 if (vulnerabilityId != 0) { -596 if (vuln.getDescription().contains("** REJECT **")) { -597 deleteVulnerability.setInt(1, vulnerabilityId); -598 deleteVulnerability.executeUpdate(); -599 } else { -600 updateVulnerability.setString(1, vuln.getDescription()); -601 updateVulnerability.setString(2, vuln.getCwe()); -602 updateVulnerability.setFloat(3, vuln.getCvssScore()); -603 updateVulnerability.setString(4, vuln.getCvssAccessVector()); -604 updateVulnerability.setString(5, vuln.getCvssAccessComplexity()); -605 updateVulnerability.setString(6, vuln.getCvssAuthentication()); -606 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact()); -607 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact()); -608 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact()); -609 updateVulnerability.setInt(10, vulnerabilityId); -610 updateVulnerability.executeUpdate(); -611 } -612 } else { -613 insertVulnerability.setString(1, vuln.getName()); -614 insertVulnerability.setString(2, vuln.getDescription()); -615 insertVulnerability.setString(3, vuln.getCwe()); -616 insertVulnerability.setFloat(4, vuln.getCvssScore()); -617 insertVulnerability.setString(5, vuln.getCvssAccessVector()); -618 insertVulnerability.setString(6, vuln.getCvssAccessComplexity()); -619 insertVulnerability.setString(7, vuln.getCvssAuthentication()); -620 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact()); -621 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact()); -622 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact()); -623 insertVulnerability.execute(); -624 try { -625 rs = insertVulnerability.getGeneratedKeys(); -626 rs.next(); -627 vulnerabilityId = rs.getInt(1); -628 } catch (SQLException ex) { -629 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName()); -630 throw new DatabaseException(msg, ex); -631 } finally { -632 DBUtils.closeResultSet(rs); -633 rs = null; -634 } -635 } -636 insertReference.setInt(1, vulnerabilityId); -637 for (Reference r : vuln.getReferences()) { -638 insertReference.setString(2, r.getName()); -639 insertReference.setString(3, r.getUrl()); -640 insertReference.setString(4, r.getSource()); -641 insertReference.execute(); -642 } -643 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) { -644 int cpeProductId = 0; -645 selectCpeId.setString(1, s.getName()); -646 try { -647 rs = selectCpeId.executeQuery(); -648 if (rs.next()) { -649 cpeProductId = rs.getInt(1); -650 } -651 } catch (SQLException ex) { -652 throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex); -653 } finally { -654 DBUtils.closeResultSet(rs); -655 rs = null; -656 } -657 -658 if (cpeProductId == 0) { -659 insertCpe.setString(1, s.getName()); -660 insertCpe.setString(2, s.getVendor()); -661 insertCpe.setString(3, s.getProduct()); -662 insertCpe.executeUpdate(); -663 cpeProductId = DBUtils.getGeneratedKey(insertCpe); -664 } -665 if (cpeProductId == 0) { -666 throw new DatabaseException("Unable to retrieve cpeProductId - no data returned"); +49 /** +50 * The logger. +51 */ +52 private static final Logger LOGGER = Logger.getLogger(CveDB.class.getName()); +53 /** +54 * Database connection +55 */ +56 private Connection conn; +57 +58 /** +59 * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller +60 * by calling the close method. +61 * +62 * @throws DatabaseException thrown if there is an exception opening the database. +63 */ +64 public CveDB() throws DatabaseException { +65 super(); +66 try { +67 open(); +68 databaseProperties = new DatabaseProperties(this); +69 } catch (DatabaseException ex) { +70 throw ex; +71 } +72 } +73 +74 /** +75 * Returns the database connection. +76 * +77 * @return the database connection +78 */ +79 protected Connection getConnection() { +80 return conn; +81 } +82 +83 /** +84 * Opens the database connection. If the database does not exist, it will create a new one. +85 * +86 * @throws DatabaseException thrown if there is an error opening the database connection +87 */ +88 public final void open() throws DatabaseException { +89 conn = ConnectionFactory.getConnection(); +90 } +91 +92 /** +93 * Closes the DB4O database. Close should be called on this object when it is done being used. +94 */ +95 public void close() { +96 if (conn != null) { +97 try { +98 conn.close(); +99 } catch (SQLException ex) { +100 final String msg = "There was an error attempting to close the CveDB, see the log for more details."; +101 LOGGER.log(Level.SEVERE, msg); +102 LOGGER.log(Level.FINE, null, ex); +103 } catch (Throwable ex) { +104 final String msg = "There was an exception attempting to close the CveDB, see the log for more details."; +105 LOGGER.log(Level.SEVERE, msg); +106 LOGGER.log(Level.FINE, null, ex); +107 } +108 conn = null; +109 } +110 } +111 +112 /** +113 * Returns whether the database connection is open or closed. +114 * +115 * @return whether the database connection is open or closed +116 */ +117 public boolean isOpen() { +118 return conn != null; +119 } +120 +121 /** +122 * Commits all completed transactions. +123 * +124 * @throws SQLException thrown if a SQL Exception occurs +125 */ +126 public void commit() throws SQLException { +127 //temporary remove this as autocommit is on. +128 //if (conn != null) { +129 // conn.commit(); +130 //} +131 } +132 +133 /** +134 * Cleans up the object and ensures that "close" has been called. +135 * +136 * @throws Throwable thrown if there is a problem +137 */ +138 @Override +139 @SuppressWarnings("FinalizeDeclaration") +140 protected void finalize() throws Throwable { +141 LOGGER.log(Level.FINE, "Entering finalize"); +142 close(); +143 super.finalize(); +144 } +145 /** +146 * Database properties object containing the 'properties' from the database table. +147 */ +148 private DatabaseProperties databaseProperties; +149 +150 /** +151 * Get the value of databaseProperties. +152 * +153 * @return the value of databaseProperties +154 */ +155 public DatabaseProperties getDatabaseProperties() { +156 return databaseProperties; +157 } +158 //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database"> +159 /** +160 * SQL Statement to delete references by vulnerability ID. +161 */ +162 private static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?"; +163 /** +164 * SQL Statement to delete software by vulnerability ID. +165 */ +166 private static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?"; +167 /** +168 * SQL Statement to delete a vulnerability by CVE. +169 */ +170 private static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE id = ?"; +171 /** +172 * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works +173 * well to keep the data file size down a bit. +174 */ +175 private static final String CLEANUP_ORPHANS = "DELETE FROM CpeEntry WHERE id not in (SELECT CPEEntryId FROM Software); "; +176 /** +177 * SQL Statement to insert a new reference. +178 */ +179 private static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)"; +180 /** +181 * SQL Statement to insert a new software. +182 */ +183 private static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpeEntryId, previousVersion) VALUES (?, ?, ?)"; +184 /** +185 * SQL Statement to insert a new cpe. +186 */ +187 private static final String INSERT_CPE = "INSERT INTO cpeEntry (cpe, vendor, product) VALUES (?, ?, ?)"; +188 /** +189 * SQL Statement to get a CPEProductID. +190 */ +191 private static final String SELECT_CPE_ID = "SELECT id FROM cpeEntry WHERE cpe = ?"; +192 /** +193 * SQL Statement to insert a new vulnerability. +194 */ +195 private static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cve, description, cwe, cvssScore, cvssAccessVector, " +196 + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) " +197 + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; +198 /** +199 * SQL Statement to update a vulnerability. +200 */ +201 private static final String UPDATE_VULNERABILITY = "UPDATE vulnerability SET description=?, cwe=?, cvssScore=?, cvssAccessVector=?, " +202 + "cvssAccessComplexity=?, cvssAuthentication=?, cvssConfidentialityImpact=?, cvssIntegrityImpact=?, cvssAvailabilityImpact=? " +203 + "WHERE id=?"; +204 /** +205 * SQL Statement to find CVE entries based on CPE data. +206 */ +207 private static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cve, cpe, previousVersion " +208 + "FROM software INNER JOIN vulnerability ON vulnerability.id = software.cveId " +209 + "INNER JOIN cpeEntry ON cpeEntry.id = software.cpeEntryId " +210 + "WHERE vendor = ? AND product = ?"; +211 //unfortunately, the version info is too complicated to do in a select. Need to filter this afterwards +212 // + " AND (version = '-' OR previousVersion IS NOT NULL OR version=?)"; +213 // +214 /** +215 * SQL Statement to find the CPE entry based on the vendor and product. +216 */ +217 private static final String SELECT_CPE_ENTRIES = "SELECT cpe FROM cpeEntry WHERE vendor = ? AND product = ?"; +218 /** +219 * SQL Statement to select references by CVEID. +220 */ +221 private static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?"; +222 /** +223 * SQL Statement to select vendor and product for lucene index. +224 */ +225 private static final String SELECT_VENDOR_PRODUCT_LIST = "SELECT vendor, product FROM cpeEntry GROUP BY vendor, product"; +226 /** +227 * SQL Statement to select software by CVEID. +228 */ +229 private static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion " +230 + "FROM software INNER JOIN cpeEntry ON software.cpeEntryId = cpeEntry.id WHERE cveid = ?"; +231 // public static final String SELECT_SOFTWARE = "SELECT part, vendor, product, version, revision, previousVersion " +232 // + "FROM software INNER JOIN cpeProduct ON cpeProduct.id = software.cpeProductId LEFT JOIN cpeVersion ON " +233 // + "software.cpeVersionId = cpeVersion.id LEFT JOIN Version ON cpeVersion.versionId = version.id WHERE cveid = ?"; +234 /** +235 * SQL Statement to select a vulnerability by CVEID. +236 */ +237 private static final String SELECT_VULNERABILITY = "SELECT id, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, " +238 + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cve = ?"; +239 /** +240 * SQL Statement to select a vulnerability's primary key. +241 */ +242 private static final String SELECT_VULNERABILITY_ID = "SELECT id FROM vulnerability WHERE cve = ?"; +243 /** +244 * SQL Statement to retrieve the properties from the database. +245 */ +246 private static final String SELECT_PROPERTIES = "SELECT id, value FROM properties"; +247 /** +248 * SQL Statement to retrieve a property from the database. +249 */ +250 private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?"; +251 /** +252 * SQL Statement to insert a new property. +253 */ +254 private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)"; +255 /** +256 * SQL Statement to update a property. +257 */ +258 private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?"; +259 /** +260 * SQL Statement to delete a property. +261 */ +262 private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?"; +263 +264 //</editor-fold> +265 /** +266 * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination. +267 * The returned list will include all versions of the product that are registered in the NVD CVE data. +268 * +269 * @param vendor the identified vendor name of the dependency being analyzed +270 * @param product the identified name of the product of the dependency being analyzed +271 * @return a set of vulnerable software +272 */ +273 public Set<VulnerableSoftware> getCPEs(String vendor, String product) { +274 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>(); +275 ResultSet rs = null; +276 PreparedStatement ps = null; +277 try { +278 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES); +279 ps.setString(1, vendor); +280 ps.setString(2, product); +281 rs = ps.executeQuery(); +282 +283 while (rs.next()) { +284 final VulnerableSoftware vs = new VulnerableSoftware(); +285 vs.setCpe(rs.getString(1)); +286 cpe.add(vs); +287 } +288 } catch (SQLException ex) { +289 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +290 LOGGER.log(Level.SEVERE, msg); +291 LOGGER.log(Level.FINE, null, ex); +292 } finally { +293 DBUtils.closeResultSet(rs); +294 DBUtils.closeStatement(ps); +295 } +296 return cpe; +297 } +298 +299 /** +300 * Returns the entire list of vendor/product combinations. +301 * +302 * @return the entire list of vendor/product combinations +303 * @throws DatabaseException thrown when there is an error retrieving the data from the DB +304 */ +305 public Set<Pair<String, String>> getVendorProductList() throws DatabaseException { +306 final HashSet data = new HashSet<Pair<String, String>>(); +307 ResultSet rs = null; +308 PreparedStatement ps = null; +309 try { +310 ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST); +311 rs = ps.executeQuery(); +312 while (rs.next()) { +313 data.add(new Pair(rs.getString(1), rs.getString(2))); +314 } +315 } catch (SQLException ex) { +316 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +317 throw new DatabaseException(msg, ex); +318 } finally { +319 DBUtils.closeResultSet(rs); +320 DBUtils.closeStatement(ps); +321 } +322 return data; +323 } +324 +325 /** +326 * Returns a set of properties. +327 * +328 * @return the properties from the database +329 */ +330 Properties getProperties() { +331 final Properties prop = new Properties(); +332 PreparedStatement ps = null; +333 ResultSet rs = null; +334 try { +335 ps = getConnection().prepareStatement(SELECT_PROPERTIES); +336 rs = ps.executeQuery(); +337 while (rs.next()) { +338 prop.setProperty(rs.getString(1), rs.getString(2)); +339 } +340 } catch (SQLException ex) { +341 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +342 LOGGER.log(Level.SEVERE, msg); +343 LOGGER.log(Level.FINE, null, ex); +344 } finally { +345 DBUtils.closeStatement(ps); +346 DBUtils.closeResultSet(rs); +347 } +348 return prop; +349 } +350 +351 /** +352 * Saves a set of properties to the database. +353 * +354 * @param props a collection of properties +355 */ +356 void saveProperties(Properties props) { +357 PreparedStatement updateProperty = null; +358 PreparedStatement insertProperty = null; +359 try { +360 try { +361 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); +362 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); +363 } catch (SQLException ex) { +364 LOGGER.log(Level.WARNING, "Unable to save properties to the database"); +365 LOGGER.log(Level.FINE, "Unable to save properties to the database", ex); +366 return; +367 } +368 for (Entry<Object, Object> entry : props.entrySet()) { +369 final String key = entry.getKey().toString(); +370 final String value = entry.getValue().toString(); +371 try { +372 updateProperty.setString(1, value); +373 updateProperty.setString(2, key); +374 if (updateProperty.executeUpdate() == 0) { +375 insertProperty.setString(1, key); +376 insertProperty.setString(2, value); +377 } +378 } catch (SQLException ex) { +379 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); +380 LOGGER.log(Level.WARNING, msg); +381 LOGGER.log(Level.FINE, null, ex); +382 } +383 } +384 } finally { +385 DBUtils.closeStatement(updateProperty); +386 DBUtils.closeStatement(insertProperty); +387 } +388 } +389 +390 /** +391 * Saves a property to the database. +392 * +393 * @param key the property key +394 * @param value the property value +395 */ +396 void saveProperty(String key, String value) { +397 PreparedStatement updateProperty = null; +398 PreparedStatement insertProperty = null; +399 try { +400 try { +401 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); +402 } catch (SQLException ex) { +403 LOGGER.log(Level.WARNING, "Unable to save properties to the database"); +404 LOGGER.log(Level.FINE, "Unable to save properties to the database", ex); +405 return; +406 } +407 try { +408 updateProperty.setString(1, value); +409 updateProperty.setString(2, key); +410 if (updateProperty.executeUpdate() == 0) { +411 try { +412 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); +413 } catch (SQLException ex) { +414 LOGGER.log(Level.WARNING, "Unable to save properties to the database"); +415 LOGGER.log(Level.FINE, "Unable to save properties to the database", ex); +416 return; +417 } +418 insertProperty.setString(1, key); +419 insertProperty.setString(2, value); +420 insertProperty.execute(); +421 } +422 } catch (SQLException ex) { +423 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); +424 LOGGER.log(Level.WARNING, msg); +425 LOGGER.log(Level.FINE, null, ex); +426 } +427 } finally { +428 DBUtils.closeStatement(updateProperty); +429 DBUtils.closeStatement(insertProperty); +430 } +431 } +432 +433 /** +434 * Retrieves the vulnerabilities associated with the specified CPE. +435 * +436 * @param cpeStr the CPE name +437 * @return a list of Vulnerabilities +438 * @throws DatabaseException thrown if there is an exception retrieving data +439 */ +440 public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException { +441 ResultSet rs = null; +442 final VulnerableSoftware cpe = new VulnerableSoftware(); +443 try { +444 cpe.parseName(cpeStr); +445 } catch (UnsupportedEncodingException ex) { +446 LOGGER.log(Level.FINEST, null, ex); +447 } +448 final DependencyVersion detectedVersion = parseDependencyVersion(cpe); +449 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>(); +450 +451 PreparedStatement ps; +452 final HashSet<String> cveEntries = new HashSet<String>(); +453 try { +454 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE); +455 ps.setString(1, cpe.getVendor()); +456 ps.setString(2, cpe.getProduct()); +457 rs = ps.executeQuery(); +458 while (rs.next()) { +459 final String cveId = rs.getString(1); +460 final String cpeId = rs.getString(2); +461 final String previous = rs.getString(3); +462 if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) { +463 cveEntries.add(cveId); +464 final Vulnerability v = getVulnerability(cveId); +465 v.setMatchedCPE(cpeId, previous); +466 vulnerabilities.add(v); +467 } +468 } +469 DBUtils.closeResultSet(rs); +470 DBUtils.closeStatement(ps); +471 // for (String cve : cveEntries) { +472 // final Vulnerability v = getVulnerability(cve); +473 // vulnerabilities.add(v); +474 // } +475 +476 } catch (SQLException ex) { +477 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex); +478 } finally { +479 DBUtils.closeResultSet(rs); +480 } +481 return vulnerabilities; +482 } +483 +484 /** +485 * Gets a vulnerability for the provided CVE. +486 * +487 * @param cve the CVE to lookup +488 * @return a vulnerability object +489 * @throws DatabaseException if an exception occurs +490 */ +491 private Vulnerability getVulnerability(String cve) throws DatabaseException { +492 PreparedStatement psV = null; +493 PreparedStatement psR = null; +494 PreparedStatement psS = null; +495 ResultSet rsV = null; +496 ResultSet rsR = null; +497 ResultSet rsS = null; +498 Vulnerability vuln = null; +499 try { +500 psV = getConnection().prepareStatement(SELECT_VULNERABILITY); +501 psV.setString(1, cve); +502 rsV = psV.executeQuery(); +503 if (rsV.next()) { +504 vuln = new Vulnerability(); +505 vuln.setName(cve); +506 vuln.setDescription(rsV.getString(2)); +507 String cwe = rsV.getString(3); +508 if (cwe != null) { +509 final String name = CweDB.getCweName(cwe); +510 if (name != null) { +511 cwe += " " + name; +512 } +513 } +514 final int cveId = rsV.getInt(1); +515 vuln.setCwe(cwe); +516 vuln.setCvssScore(rsV.getFloat(4)); +517 vuln.setCvssAccessVector(rsV.getString(5)); +518 vuln.setCvssAccessComplexity(rsV.getString(6)); +519 vuln.setCvssAuthentication(rsV.getString(7)); +520 vuln.setCvssConfidentialityImpact(rsV.getString(8)); +521 vuln.setCvssIntegrityImpact(rsV.getString(9)); +522 vuln.setCvssAvailabilityImpact(rsV.getString(10)); +523 +524 psR = getConnection().prepareStatement(SELECT_REFERENCE); +525 psR.setInt(1, cveId); +526 rsR = psR.executeQuery(); +527 while (rsR.next()) { +528 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3)); +529 } +530 psS = getConnection().prepareStatement(SELECT_SOFTWARE); +531 psS.setInt(1, cveId); +532 rsS = psS.executeQuery(); +533 while (rsS.next()) { +534 final String cpe = rsS.getString(1); +535 final String prevVersion = rsS.getString(2); +536 if (prevVersion == null) { +537 vuln.addVulnerableSoftware(cpe); +538 } else { +539 vuln.addVulnerableSoftware(cpe, prevVersion); +540 } +541 } +542 } +543 } catch (SQLException ex) { +544 throw new DatabaseException("Error retrieving " + cve, ex); +545 } finally { +546 DBUtils.closeResultSet(rsV); +547 DBUtils.closeResultSet(rsR); +548 DBUtils.closeResultSet(rsS); +549 DBUtils.closeStatement(psV); +550 DBUtils.closeStatement(psR); +551 DBUtils.closeStatement(psS); +552 } +553 return vuln; +554 } +555 +556 /** +557 * Updates the vulnerability within the database. If the vulnerability does not exist it will be added. +558 * +559 * @param vuln the vulnerability to add to the database +560 * @throws DatabaseException is thrown if the database +561 */ +562 public void updateVulnerability(Vulnerability vuln) throws DatabaseException { +563 PreparedStatement selectVulnerabilityId = null; +564 PreparedStatement deleteVulnerability = null; +565 PreparedStatement deleteReferences = null; +566 PreparedStatement deleteSoftware = null; +567 PreparedStatement updateVulnerability = null; +568 PreparedStatement insertVulnerability = null; +569 PreparedStatement insertReference = null; +570 PreparedStatement selectCpeId = null; +571 PreparedStatement insertCpe = null; +572 PreparedStatement insertSoftware = null; +573 +574 try { +575 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID); +576 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY); +577 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE); +578 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE); +579 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY); +580 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS); +581 insertReference = getConnection().prepareStatement(INSERT_REFERENCE); +582 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID); +583 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS); +584 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE); +585 int vulnerabilityId = 0; +586 selectVulnerabilityId.setString(1, vuln.getName()); +587 ResultSet rs = selectVulnerabilityId.executeQuery(); +588 if (rs.next()) { +589 vulnerabilityId = rs.getInt(1); +590 // first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier. +591 deleteReferences.setInt(1, vulnerabilityId); +592 deleteReferences.execute(); +593 deleteSoftware.setInt(1, vulnerabilityId); +594 deleteSoftware.execute(); +595 } +596 DBUtils.closeResultSet(rs); +597 rs = null; +598 if (vulnerabilityId != 0) { +599 if (vuln.getDescription().contains("** REJECT **")) { +600 deleteVulnerability.setInt(1, vulnerabilityId); +601 deleteVulnerability.executeUpdate(); +602 } else { +603 updateVulnerability.setString(1, vuln.getDescription()); +604 updateVulnerability.setString(2, vuln.getCwe()); +605 updateVulnerability.setFloat(3, vuln.getCvssScore()); +606 updateVulnerability.setString(4, vuln.getCvssAccessVector()); +607 updateVulnerability.setString(5, vuln.getCvssAccessComplexity()); +608 updateVulnerability.setString(6, vuln.getCvssAuthentication()); +609 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact()); +610 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact()); +611 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact()); +612 updateVulnerability.setInt(10, vulnerabilityId); +613 updateVulnerability.executeUpdate(); +614 } +615 } else { +616 insertVulnerability.setString(1, vuln.getName()); +617 insertVulnerability.setString(2, vuln.getDescription()); +618 insertVulnerability.setString(3, vuln.getCwe()); +619 insertVulnerability.setFloat(4, vuln.getCvssScore()); +620 insertVulnerability.setString(5, vuln.getCvssAccessVector()); +621 insertVulnerability.setString(6, vuln.getCvssAccessComplexity()); +622 insertVulnerability.setString(7, vuln.getCvssAuthentication()); +623 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact()); +624 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact()); +625 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact()); +626 insertVulnerability.execute(); +627 try { +628 rs = insertVulnerability.getGeneratedKeys(); +629 rs.next(); +630 vulnerabilityId = rs.getInt(1); +631 } catch (SQLException ex) { +632 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName()); +633 throw new DatabaseException(msg, ex); +634 } finally { +635 DBUtils.closeResultSet(rs); +636 rs = null; +637 } +638 } +639 insertReference.setInt(1, vulnerabilityId); +640 for (Reference r : vuln.getReferences()) { +641 insertReference.setString(2, r.getName()); +642 insertReference.setString(3, r.getUrl()); +643 insertReference.setString(4, r.getSource()); +644 insertReference.execute(); +645 } +646 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) { +647 int cpeProductId = 0; +648 selectCpeId.setString(1, s.getName()); +649 try { +650 rs = selectCpeId.executeQuery(); +651 if (rs.next()) { +652 cpeProductId = rs.getInt(1); +653 } +654 } catch (SQLException ex) { +655 throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex); +656 } finally { +657 DBUtils.closeResultSet(rs); +658 rs = null; +659 } +660 +661 if (cpeProductId == 0) { +662 insertCpe.setString(1, s.getName()); +663 insertCpe.setString(2, s.getVendor()); +664 insertCpe.setString(3, s.getProduct()); +665 insertCpe.executeUpdate(); +666 cpeProductId = DBUtils.getGeneratedKey(insertCpe); 667 } -668 -669 insertSoftware.setInt(1, vulnerabilityId); -670 insertSoftware.setInt(2, cpeProductId); -671 if (s.getPreviousVersion() == null) { -672 insertSoftware.setNull(3, java.sql.Types.VARCHAR); -673 } else { -674 insertSoftware.setString(3, s.getPreviousVersion()); -675 } -676 insertSoftware.execute(); -677 } -678 -679 } catch (SQLException ex) { -680 final String msg = String.format("Error updating '%s'", vuln.getName()); -681 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -682 throw new DatabaseException(msg, ex); -683 } finally { -684 DBUtils.closeStatement(selectVulnerabilityId); -685 DBUtils.closeStatement(deleteReferences); -686 DBUtils.closeStatement(deleteSoftware); -687 DBUtils.closeStatement(updateVulnerability); -688 DBUtils.closeStatement(deleteVulnerability); -689 DBUtils.closeStatement(insertVulnerability); -690 DBUtils.closeStatement(insertReference); -691 DBUtils.closeStatement(selectCpeId); -692 DBUtils.closeStatement(insertCpe); -693 DBUtils.closeStatement(insertSoftware); -694 } -695 } -696 -697 /** -698 * It is possible that orphaned rows may be generated during database updates. This should be called after all -699 * updates have been completed to ensure orphan entries are removed. -700 */ -701 public void cleanupDatabase() { -702 PreparedStatement ps = null; -703 try { -704 ps = getConnection().prepareStatement(CLEANUP_ORPHANS); -705 if (ps != null) { -706 ps.executeUpdate(); -707 } -708 } catch (SQLException ex) { -709 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -710 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -711 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -712 } finally { -713 DBUtils.closeStatement(ps); -714 } -715 } -716 -717 /** -718 * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null, -719 * non-empty string passed to the previous version argument indicates that all previous versions are affected. -720 * -721 * @param vendor the vendor of the dependency being analyzed -722 * @param product the product name of the dependency being analyzed -723 * @param identifiedVersion the identified version of the dependency being analyzed -724 * @param cpeId the cpe identifier of software that has a known vulnerability -725 * @param previous a flag indicating if previous versions of the product are vulnerable -726 * @return true if the identified version is affected, otherwise false -727 */ -728 private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) { -729 boolean affected = false; -730 final boolean isStruts = "apache".equals(vendor) && "struts".equals(product); -731 final DependencyVersion v = parseDependencyVersion(cpeId); -732 final boolean prevAffected = previous != null && !previous.isEmpty(); -733 if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) { -734 if (v == null || "-".equals(v.toString())) { -735 affected = true; -736 } -737 } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) { -738 if (isStruts) { //struts 2 vulns don't affect struts 1 -739 if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) { -740 affected = true; -741 } -742 } else { -743 affected = true; -744 } -745 } -746 /* -747 * TODO consider utilizing the matchThreeVersion method to get additional results. However, this -748 * might also introduce false positives. -749 */ -750 return affected; -751 } -752 -753 /** -754 * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is -755 * returned. -756 * -757 * @param cpeStr a cpe identifier -758 * @return a dependency version -759 */ -760 private DependencyVersion parseDependencyVersion(String cpeStr) { -761 final VulnerableSoftware cpe = new VulnerableSoftware(); -762 try { -763 cpe.parseName(cpeStr); -764 } catch (UnsupportedEncodingException ex) { -765 //never going to happen. -766 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex); -767 } -768 return parseDependencyVersion(cpe); -769 } -770 -771 /** -772 * Takes a CPE and parses out the version number. If no version is identified then a '-' is returned. -773 * -774 * @param cpe a cpe object -775 * @return a dependency version -776 */ -777 private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) { -778 DependencyVersion cpeVersion; -779 if (cpe.getVersion() != null && cpe.getVersion().length() > 0) { -780 String versionText; -781 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) { -782 versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision()); -783 } else { -784 versionText = cpe.getVersion(); -785 } -786 cpeVersion = DependencyVersionUtil.parseVersion(versionText); -787 } else { -788 cpeVersion = new DependencyVersion("-"); -789 } -790 return cpeVersion; -791 } -792 } +668 if (cpeProductId == 0) { +669 throw new DatabaseException("Unable to retrieve cpeProductId - no data returned"); +670 } +671 +672 insertSoftware.setInt(1, vulnerabilityId); +673 insertSoftware.setInt(2, cpeProductId); +674 if (s.getPreviousVersion() == null) { +675 insertSoftware.setNull(3, java.sql.Types.VARCHAR); +676 } else { +677 insertSoftware.setString(3, s.getPreviousVersion()); +678 } +679 insertSoftware.execute(); +680 } +681 +682 } catch (SQLException ex) { +683 final String msg = String.format("Error updating '%s'", vuln.getName()); +684 LOGGER.log(Level.FINE, null, ex); +685 throw new DatabaseException(msg, ex); +686 } finally { +687 DBUtils.closeStatement(selectVulnerabilityId); +688 DBUtils.closeStatement(deleteReferences); +689 DBUtils.closeStatement(deleteSoftware); +690 DBUtils.closeStatement(updateVulnerability); +691 DBUtils.closeStatement(deleteVulnerability); +692 DBUtils.closeStatement(insertVulnerability); +693 DBUtils.closeStatement(insertReference); +694 DBUtils.closeStatement(selectCpeId); +695 DBUtils.closeStatement(insertCpe); +696 DBUtils.closeStatement(insertSoftware); +697 } +698 } +699 +700 /** +701 * It is possible that orphaned rows may be generated during database updates. This should be called after all +702 * updates have been completed to ensure orphan entries are removed. +703 */ +704 public void cleanupDatabase() { +705 PreparedStatement ps = null; +706 try { +707 ps = getConnection().prepareStatement(CLEANUP_ORPHANS); +708 if (ps != null) { +709 ps.executeUpdate(); +710 } +711 } catch (SQLException ex) { +712 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +713 LOGGER.log(Level.SEVERE, msg); +714 LOGGER.log(Level.FINE, null, ex); +715 } finally { +716 DBUtils.closeStatement(ps); +717 } +718 } +719 +720 /** +721 * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null, +722 * non-empty string passed to the previous version argument indicates that all previous versions are affected. +723 * +724 * @param vendor the vendor of the dependency being analyzed +725 * @param product the product name of the dependency being analyzed +726 * @param identifiedVersion the identified version of the dependency being analyzed +727 * @param cpeId the cpe identifier of software that has a known vulnerability +728 * @param previous a flag indicating if previous versions of the product are vulnerable +729 * @return true if the identified version is affected, otherwise false +730 */ +731 private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) { +732 boolean affected = false; +733 final boolean isStruts = "apache".equals(vendor) && "struts".equals(product); +734 final DependencyVersion v = parseDependencyVersion(cpeId); +735 final boolean prevAffected = previous != null && !previous.isEmpty(); +736 if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) { +737 if (v == null || "-".equals(v.toString())) { +738 affected = true; +739 } +740 } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) { +741 if (isStruts) { //struts 2 vulns don't affect struts 1 +742 if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) { +743 affected = true; +744 } +745 } else { +746 affected = true; +747 } +748 } +749 /* +750 * TODO consider utilizing the matchThreeVersion method to get additional results. However, this +751 * might also introduce false positives. +752 */ +753 return affected; +754 } +755 +756 /** +757 * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is +758 * returned. +759 * +760 * @param cpeStr a cpe identifier +761 * @return a dependency version +762 */ +763 private DependencyVersion parseDependencyVersion(String cpeStr) { +764 final VulnerableSoftware cpe = new VulnerableSoftware(); +765 try { +766 cpe.parseName(cpeStr); +767 } catch (UnsupportedEncodingException ex) { +768 //never going to happen. +769 LOGGER.log(Level.FINEST, null, ex); +770 } +771 return parseDependencyVersion(cpe); +772 } +773 +774 /** +775 * Takes a CPE and parses out the version number. If no version is identified then a '-' is returned. +776 * +777 * @param cpe a cpe object +778 * @return a dependency version +779 */ +780 private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) { +781 DependencyVersion cpeVersion; +782 if (cpe.getVersion() != null && cpe.getVersion().length() > 0) { +783 String versionText; +784 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) { +785 versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision()); +786 } else { +787 versionText = cpe.getVersion(); +788 } +789 cpeVersion = DependencyVersionUtil.parseVersion(versionText); +790 } else { +791 cpeVersion = new DependencyVersion("-"); +792 } +793 return cpeVersion; +794 } +795 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html index 70c67924c..468564d11 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html @@ -25,15 +25,15 @@ 17 */ 18 package org.owasp.dependencycheck.data.nvdcve; 19 -20 import com.hazelcast.logging.Logger; -21 import java.text.DateFormat; -22 import java.text.SimpleDateFormat; -23 import java.util.Date; -24 import java.util.Map; -25 import java.util.Map.Entry; -26 import java.util.Properties; -27 import java.util.TreeMap; -28 import java.util.logging.Level; +20 import java.text.DateFormat; +21 import java.text.SimpleDateFormat; +22 import java.util.Date; +23 import java.util.Map; +24 import java.util.Map.Entry; +25 import java.util.Properties; +26 import java.util.TreeMap; +27 import java.util.logging.Level; +28 import java.util.logging.Logger; 29 import org.owasp.dependencycheck.data.update.NvdCveInfo; 30 import org.owasp.dependencycheck.data.update.exception.UpdateException; 31 @@ -45,131 +45,135 @@ 37 public class DatabaseProperties { 38 39 /** -40 * Modified key word, used as a key to store information about the modified file (i.e. the containing the last 8 -41 * days of updates).. -42 */ -43 public static final String MODIFIED = "Modified"; -44 /** -45 * The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE -46 * xml file. -47 */ -48 public static final String LAST_UPDATED = "NVD CVE Modified"; -49 /** -50 * Stores the last updated time for each of the NVD CVE files. These timestamps should be updated if we process the -51 * modified file within 7 days of the last update. -52 */ -53 public static final String LAST_UPDATED_BASE = "NVD CVE "; -54 /** -55 * A collection of properties about the data. +40 * The Logger. +41 */ +42 private static final Logger LOGGER = Logger.getLogger(DatabaseProperties.class.getName()); +43 /** +44 * Modified key word, used as a key to store information about the modified file (i.e. the containing the last 8 +45 * days of updates).. +46 */ +47 public static final String MODIFIED = "Modified"; +48 /** +49 * The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE +50 * xml file. +51 */ +52 public static final String LAST_UPDATED = "NVD CVE Modified"; +53 /** +54 * Stores the last updated time for each of the NVD CVE files. These timestamps should be updated if we process the +55 * modified file within 7 days of the last update. 56 */ -57 private Properties properties; +57 public static final String LAST_UPDATED_BASE = "NVD CVE "; 58 /** -59 * A reference to the database. +59 * A collection of properties about the data. 60 */ -61 private CveDB cveDB; -62 -63 /** -64 * Constructs a new data properties object. -65 * -66 * @param cveDB the database object holding the properties -67 */ -68 DatabaseProperties(CveDB cveDB) { -69 this.cveDB = cveDB; -70 loadProperties(); -71 } -72 -73 /** -74 * Loads the properties from the database. -75 */ -76 private void loadProperties() { -77 this.properties = cveDB.getProperties(); -78 } -79 -80 /** -81 * Returns whether or not any properties are set. -82 * -83 * @return whether or not any properties are set -84 */ -85 public boolean isEmpty() { -86 return properties == null || properties.isEmpty(); -87 } -88 -89 /** -90 * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory. -91 * -92 * @param updatedValue the updated NVD CVE entry -93 * @throws UpdateException is thrown if there is an update exception -94 */ -95 public void save(NvdCveInfo updatedValue) throws UpdateException { -96 if (updatedValue == null) { -97 return; -98 } -99 properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); -100 cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); -101 } -102 -103 /** -104 * Returns the property value for the given key. If the key is not contained in the underlying properties null is -105 * returned. -106 * -107 * @param key the property key -108 * @return the value of the property -109 */ -110 public String getProperty(String key) { -111 return properties.getProperty(key); -112 } -113 -114 /** -115 * Returns the property value for the given key. If the key is not contained in the underlying properties the -116 * default value is returned. -117 * -118 * @param key the property key -119 * @param defaultValue the default value -120 * @return the value of the property -121 */ -122 public String getProperty(String key, String defaultValue) { -123 return properties.getProperty(key, defaultValue); -124 } -125 -126 /** -127 * Returns the collection of Database Properties as a properties collection. -128 * -129 * @return the collection of Database Properties -130 */ -131 public Properties getProperties() { -132 return properties; -133 } -134 -135 /** -136 * Returns a map of the meta data from the database properties. This primarily contains timestamps of when the NVD -137 * CVE information was last updated. -138 * -139 * @return a map of the database meta data -140 */ -141 public Map getMetaData() { -142 final TreeMap map = new TreeMap(); -143 for (Entry<Object, Object> entry : properties.entrySet()) { -144 final String key = (String) entry.getKey(); -145 if (!"version".equals(key)) { -146 if (key.startsWith("NVD CVE ")) { -147 try { -148 final long epoch = Long.parseLong((String) entry.getValue()); -149 final Date date = new Date(epoch); -150 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss"); -151 final String formatted = format.format(date); -152 map.put(key, formatted); -153 } catch (Throwable ex) { //deliberatly being broad in this catch clause -154 Logger.getLogger(DatabaseProperties.class.getName()).log(Level.FINE, "Unable to parse timestamp from DB", ex); -155 map.put(key, entry.getValue()); -156 } -157 } else { -158 map.put(key, entry.getValue()); -159 } -160 } -161 } -162 return map; -163 } -164 } +61 private Properties properties; +62 /** +63 * A reference to the database. +64 */ +65 private CveDB cveDB; +66 +67 /** +68 * Constructs a new data properties object. +69 * +70 * @param cveDB the database object holding the properties +71 */ +72 DatabaseProperties(CveDB cveDB) { +73 this.cveDB = cveDB; +74 loadProperties(); +75 } +76 +77 /** +78 * Loads the properties from the database. +79 */ +80 private void loadProperties() { +81 this.properties = cveDB.getProperties(); +82 } +83 +84 /** +85 * Returns whether or not any properties are set. +86 * +87 * @return whether or not any properties are set +88 */ +89 public boolean isEmpty() { +90 return properties == null || properties.isEmpty(); +91 } +92 +93 /** +94 * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory. +95 * +96 * @param updatedValue the updated NVD CVE entry +97 * @throws UpdateException is thrown if there is an update exception +98 */ +99 public void save(NvdCveInfo updatedValue) throws UpdateException { +100 if (updatedValue == null) { +101 return; +102 } +103 properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); +104 cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); +105 } +106 +107 /** +108 * Returns the property value for the given key. If the key is not contained in the underlying properties null is +109 * returned. +110 * +111 * @param key the property key +112 * @return the value of the property +113 */ +114 public String getProperty(String key) { +115 return properties.getProperty(key); +116 } +117 +118 /** +119 * Returns the property value for the given key. If the key is not contained in the underlying properties the +120 * default value is returned. +121 * +122 * @param key the property key +123 * @param defaultValue the default value +124 * @return the value of the property +125 */ +126 public String getProperty(String key, String defaultValue) { +127 return properties.getProperty(key, defaultValue); +128 } +129 +130 /** +131 * Returns the collection of Database Properties as a properties collection. +132 * +133 * @return the collection of Database Properties +134 */ +135 public Properties getProperties() { +136 return properties; +137 } +138 +139 /** +140 * Returns a map of the meta data from the database properties. This primarily contains timestamps of when the NVD +141 * CVE information was last updated. +142 * +143 * @return a map of the database meta data +144 */ +145 public Map getMetaData() { +146 final TreeMap map = new TreeMap(); +147 for (Entry<Object, Object> entry : properties.entrySet()) { +148 final String key = (String) entry.getKey(); +149 if (!"version".equals(key)) { +150 if (key.startsWith("NVD CVE ")) { +151 try { +152 final long epoch = Long.parseLong((String) entry.getValue()); +153 final Date date = new Date(epoch); +154 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss"); +155 final String formatted = format.format(date); +156 map.put(key, formatted); +157 } catch (Throwable ex) { //deliberately being broad in this catch clause +158 LOGGER.log(Level.FINE, "Unable to parse timestamp from DB", ex); +159 map.put(key, entry.getValue()); +160 } +161 } else { +162 map.put(key, entry.getValue()); +163 } +164 } +165 } +166 return map; +167 } +168 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html index 7a2813f17..0ac8d26a8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html @@ -46,112 +46,117 @@ 38 public final class DriverLoader { 39 40 /** -41 * Private constructor for a utility class. +41 * The logger. 42 */ -43 private DriverLoader() { -44 } -45 -46 /** -47 * Loads the specified class using the system class loader and registers the driver with the driver manager. -48 * -49 * @param className the fully qualified name of the desired class -50 * @return the loaded Driver -51 * @throws DriverLoadException thrown if the driver cannot be loaded -52 */ -53 public static Driver load(String className) throws DriverLoadException { -54 final ClassLoader loader = DriverLoader.class.getClassLoader(); //ClassLoader.getSystemClassLoader(); -55 return load(className, loader); -56 } -57 -58 /** -59 * Loads the specified class by registering the supplied paths to the class loader and then registers the driver -60 * with the driver manager. The pathToDriver argument is added to the class loader so that an external driver can be -61 * loaded. Note, the pathTodriver can contain a semi-colon separated list of paths so any dependencies can be added -62 * as needed. If a path in the pathToDriver argument is a directory all files in the directory are added to the -63 * class path. -64 * -65 * @param className the fully qualified name of the desired class -66 * @param pathToDriver the path to the JAR file containing the driver; note, this can be a semi-colon separated list -67 * of paths -68 * @return the loaded Driver -69 * @throws DriverLoadException thrown if the driver cannot be loaded -70 */ -71 public static Driver load(String className, String pathToDriver) throws DriverLoadException { -72 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader(); -73 final ArrayList<URL> urls = new ArrayList<URL>(); -74 final String[] paths = pathToDriver.split(File.pathSeparator); -75 for (String path : paths) { -76 final File file = new File(path); -77 if (file.isDirectory()) { -78 final File[] files = file.listFiles(); -79 -80 for (File f : files) { -81 try { -82 urls.add(f.toURI().toURL()); -83 } catch (MalformedURLException ex) { -84 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", -85 className, f.getAbsoluteFile()); -86 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -87 throw new DriverLoadException(msg, ex); -88 } -89 } -90 } else if (file.exists()) { -91 try { -92 urls.add(file.toURI().toURL()); -93 } catch (MalformedURLException ex) { -94 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", -95 className, file.getAbsoluteFile()); -96 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -97 throw new DriverLoadException(msg, ex); -98 } -99 } -100 } -101 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() { -102 @Override -103 public URLClassLoader run() { -104 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent); -105 } -106 }); -107 -108 return load(className, loader); -109 } -110 -111 /** -112 * Loads the specified class using the supplied class loader and registers the driver with the driver manager. -113 * -114 * @param className the fully qualified name of the desired class -115 * @param loader the class loader to use when loading the driver -116 * @return the loaded Driver -117 * @throws DriverLoadException thrown if the driver cannot be loaded -118 */ -119 private static Driver load(String className, ClassLoader loader) throws DriverLoadException { -120 try { -121 final Class c = Class.forName(className, true, loader); -122 //final Class c = loader.loadClass(className); -123 final Driver driver = (Driver) c.newInstance(); -124 final Driver shim = new DriverShim(driver); -125 //using the DriverShim to get around the fact that the DriverManager won't register a driver not in the base class path -126 DriverManager.registerDriver(shim); -127 return shim; -128 } catch (ClassNotFoundException ex) { -129 final String msg = String.format("Unable to load database driver '%s'", className); -130 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -131 throw new DriverLoadException(msg, ex); -132 } catch (InstantiationException ex) { -133 final String msg = String.format("Unable to load database driver '%s'", className); -134 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -135 throw new DriverLoadException(msg, ex); -136 } catch (IllegalAccessException ex) { -137 final String msg = String.format("Unable to load database driver '%s'", className); -138 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -139 throw new DriverLoadException(msg, ex); -140 } catch (SQLException ex) { -141 final String msg = String.format("Unable to load database driver '%s'", className); -142 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -143 throw new DriverLoadException(msg, ex); -144 } -145 } -146 } +43 private static final Logger LOGGER = Logger.getLogger(DriverLoader.class.getName()); +44 +45 /** +46 * Private constructor for a utility class. +47 */ +48 private DriverLoader() { +49 } +50 +51 /** +52 * Loads the specified class using the system class loader and registers the driver with the driver manager. +53 * +54 * @param className the fully qualified name of the desired class +55 * @return the loaded Driver +56 * @throws DriverLoadException thrown if the driver cannot be loaded +57 */ +58 public static Driver load(String className) throws DriverLoadException { +59 final ClassLoader loader = DriverLoader.class.getClassLoader(); //ClassLoader.getSystemClassLoader(); +60 return load(className, loader); +61 } +62 +63 /** +64 * Loads the specified class by registering the supplied paths to the class loader and then registers the driver +65 * with the driver manager. The pathToDriver argument is added to the class loader so that an external driver can be +66 * loaded. Note, the pathToDriver can contain a semi-colon separated list of paths so any dependencies can be added +67 * as needed. If a path in the pathToDriver argument is a directory all files in the directory are added to the +68 * class path. +69 * +70 * @param className the fully qualified name of the desired class +71 * @param pathToDriver the path to the JAR file containing the driver; note, this can be a semi-colon separated list +72 * of paths +73 * @return the loaded Driver +74 * @throws DriverLoadException thrown if the driver cannot be loaded +75 */ +76 public static Driver load(String className, String pathToDriver) throws DriverLoadException { +77 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader(); +78 final ArrayList<URL> urls = new ArrayList<URL>(); +79 final String[] paths = pathToDriver.split(File.pathSeparator); +80 for (String path : paths) { +81 final File file = new File(path); +82 if (file.isDirectory()) { +83 final File[] files = file.listFiles(); +84 +85 for (File f : files) { +86 try { +87 urls.add(f.toURI().toURL()); +88 } catch (MalformedURLException ex) { +89 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", +90 className, f.getAbsoluteFile()); +91 LOGGER.log(Level.FINE, msg, ex); +92 throw new DriverLoadException(msg, ex); +93 } +94 } +95 } else if (file.exists()) { +96 try { +97 urls.add(file.toURI().toURL()); +98 } catch (MalformedURLException ex) { +99 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", +100 className, file.getAbsoluteFile()); +101 LOGGER.log(Level.FINE, msg, ex); +102 throw new DriverLoadException(msg, ex); +103 } +104 } +105 } +106 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() { +107 @Override +108 public URLClassLoader run() { +109 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent); +110 } +111 }); +112 +113 return load(className, loader); +114 } +115 +116 /** +117 * Loads the specified class using the supplied class loader and registers the driver with the driver manager. +118 * +119 * @param className the fully qualified name of the desired class +120 * @param loader the class loader to use when loading the driver +121 * @return the loaded Driver +122 * @throws DriverLoadException thrown if the driver cannot be loaded +123 */ +124 private static Driver load(String className, ClassLoader loader) throws DriverLoadException { +125 try { +126 final Class c = Class.forName(className, true, loader); +127 //final Class c = loader.loadClass(className); +128 final Driver driver = (Driver) c.newInstance(); +129 final Driver shim = new DriverShim(driver); +130 //using the DriverShim to get around the fact that the DriverManager won't register a driver not in the base class path +131 DriverManager.registerDriver(shim); +132 return shim; +133 } catch (ClassNotFoundException ex) { +134 final String msg = String.format("Unable to load database driver '%s'", className); +135 LOGGER.log(Level.FINE, msg, ex); +136 throw new DriverLoadException(msg, ex); +137 } catch (InstantiationException ex) { +138 final String msg = String.format("Unable to load database driver '%s'", className); +139 LOGGER.log(Level.FINE, msg, ex); +140 throw new DriverLoadException(msg, ex); +141 } catch (IllegalAccessException ex) { +142 final String msg = String.format("Unable to load database driver '%s'", className); +143 LOGGER.log(Level.FINE, msg, ex); +144 throw new DriverLoadException(msg, ex); +145 } catch (SQLException ex) { +146 final String msg = String.format("Unable to load database driver '%s'", className); +147 LOGGER.log(Level.FINE, msg, ex); +148 throw new DriverLoadException(msg, ex); +149 } +150 } +151 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html index 3884be655..b299c8496 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html @@ -48,164 +48,168 @@ 40 class DriverShim implements Driver { 41 42 /** -43 * The database driver being wrapped. +43 * The logger. 44 */ -45 private final Driver driver; -46 -47 /** -48 * Constructs a new wrapper around a Driver. -49 * -50 * @param driver the database driver to wrap -51 */ -52 DriverShim(Driver driver) { -53 this.driver = driver; -54 } -55 -56 /** -57 * Wraps the underlying driver's call to acceptsURL. Returns whether or not the driver can open a connection to the -58 * given URL. -59 * -60 * @param url the URL of the database -61 * @return true if the wrapped driver can connect to the specified URL -62 * @throws SQLException thrown if there is an error connecting to the database -63 * @see java.sql.Driver#acceptsURL(java.lang.String) -64 */ -65 @Override -66 public boolean acceptsURL(String url) throws SQLException { -67 return this.driver.acceptsURL(url); -68 } -69 -70 /** -71 * Wraps the call to the underlying driver's connect method. -72 * -73 * @param url the URL of the database -74 * @param info a collection of string/value pairs -75 * @return a Connection object -76 * @throws SQLException thrown if there is an error connecting to the database -77 * @see java.sql.Driver#connect(java.lang.String, java.util.Properties) -78 */ -79 @Override -80 public Connection connect(String url, Properties info) throws SQLException { -81 return this.driver.connect(url, info); -82 } -83 -84 /** -85 * Returns the wrapped driver's major version number. -86 * -87 * @return the wrapped driver's major version number -88 * @see java.sql.Driver#getMajorVersion() -89 */ -90 @Override -91 public int getMajorVersion() { -92 return this.driver.getMajorVersion(); -93 } -94 -95 /** -96 * Returns the wrapped driver's minor version number. -97 * -98 * @return the wrapped driver's minor version number -99 * @see java.sql.Driver#getMinorVersion() -100 */ -101 @Override -102 public int getMinorVersion() { -103 return this.driver.getMinorVersion(); -104 } -105 -106 /** -107 * Wraps the call to the underlying driver's getParentLogger method. -108 * -109 * @return the parent's Logger -110 * @throws SQLFeatureNotSupportedException thrown if the feature is not supported -111 * @see java.sql.Driver#getParentLogger() -112 */ -113 //@Override -114 public Logger getParentLogger() throws SQLFeatureNotSupportedException { -115 //return driver.getParentLogger(); -116 Method m = null; -117 try { -118 m = driver.getClass().getMethod("getParentLogger"); -119 } catch (Throwable e) { -120 throw new SQLFeatureNotSupportedException(); -121 } -122 if (m != null) { -123 try { -124 return (Logger) m.invoke(m); -125 } catch (IllegalAccessException ex) { -126 Logger.getLogger(DriverShim.class.getName()).log(Level.FINER, null, ex); -127 } catch (IllegalArgumentException ex) { -128 Logger.getLogger(DriverShim.class.getName()).log(Level.FINER, null, ex); -129 } catch (InvocationTargetException ex) { -130 Logger.getLogger(DriverShim.class.getName()).log(Level.FINER, null, ex); -131 } -132 } -133 throw new SQLFeatureNotSupportedException(); -134 } -135 -136 /** -137 * Wraps the call to the underlying driver's getPropertyInfo method. -138 * -139 * @param url the URL of the database -140 * @param info a collection of string/value pairs -141 * @return an array of DriverPropertyInfo objects -142 * @throws SQLException thrown if there is an error accessing the database -143 * @see java.sql.Driver#getPropertyInfo(java.lang.String, java.util.Properties) -144 */ -145 @Override -146 public DriverPropertyInfo[] getPropertyInfo(String url, Properties info) throws SQLException { -147 return this.driver.getPropertyInfo(url, info); -148 } -149 -150 /** -151 * Returns whether or not the wrapped driver is jdbcCompliant. -152 * -153 * @return true if the wrapped driver is JDBC compliant; otherwise false -154 * @see java.sql.Driver#jdbcCompliant() -155 */ -156 @Override -157 public boolean jdbcCompliant() { -158 return this.driver.jdbcCompliant(); -159 } -160 -161 /** -162 * Standard implementation of hashCode. -163 * -164 * @return the hashCode of the object -165 */ -166 @Override -167 public int hashCode() { -168 int hash = 7; -169 hash = 97 * hash + (this.driver != null ? this.driver.hashCode() : 0); -170 return hash; -171 } -172 -173 /** -174 * Standard implementation of equals. -175 * -176 * @param obj the object to compare -177 * @return returns true if the objects are equal; otherwise false -178 */ -179 @Override -180 public boolean equals(Object obj) { -181 if (obj == null) { -182 return false; -183 } -184 if (getClass() != obj.getClass()) { -185 return false; -186 } -187 final DriverShim other = (DriverShim) obj; -188 return this.driver == other.driver || (this.driver != null && this.driver.equals(other.driver)); -189 } -190 -191 /** -192 * Standard implementation of toString(). -193 * -194 * @return the String representation of the object -195 */ -196 @Override -197 public String toString() { -198 return "DriverShim{" + "driver=" + driver + '}'; -199 } -200 } +45 private static final Logger LOGGER = Logger.getLogger(DriverShim.class.getName()); +46 /** +47 * The database driver being wrapped. +48 */ +49 private final Driver driver; +50 +51 /** +52 * Constructs a new wrapper around a Driver. +53 * +54 * @param driver the database driver to wrap +55 */ +56 DriverShim(Driver driver) { +57 this.driver = driver; +58 } +59 +60 /** +61 * Wraps the underlying driver's call to acceptsURL. Returns whether or not the driver can open a connection to the +62 * given URL. +63 * +64 * @param url the URL of the database +65 * @return true if the wrapped driver can connect to the specified URL +66 * @throws SQLException thrown if there is an error connecting to the database +67 * @see java.sql.Driver#acceptsURL(java.lang.String) +68 */ +69 @Override +70 public boolean acceptsURL(String url) throws SQLException { +71 return this.driver.acceptsURL(url); +72 } +73 +74 /** +75 * Wraps the call to the underlying driver's connect method. +76 * +77 * @param url the URL of the database +78 * @param info a collection of string/value pairs +79 * @return a Connection object +80 * @throws SQLException thrown if there is an error connecting to the database +81 * @see java.sql.Driver#connect(java.lang.String, java.util.Properties) +82 */ +83 @Override +84 public Connection connect(String url, Properties info) throws SQLException { +85 return this.driver.connect(url, info); +86 } +87 +88 /** +89 * Returns the wrapped driver's major version number. +90 * +91 * @return the wrapped driver's major version number +92 * @see java.sql.Driver#getMajorVersion() +93 */ +94 @Override +95 public int getMajorVersion() { +96 return this.driver.getMajorVersion(); +97 } +98 +99 /** +100 * Returns the wrapped driver's minor version number. +101 * +102 * @return the wrapped driver's minor version number +103 * @see java.sql.Driver#getMinorVersion() +104 */ +105 @Override +106 public int getMinorVersion() { +107 return this.driver.getMinorVersion(); +108 } +109 +110 /** +111 * Wraps the call to the underlying driver's getParentLogger method. +112 * +113 * @return the parent's Logger +114 * @throws SQLFeatureNotSupportedException thrown if the feature is not supported +115 * @see java.sql.Driver#getParentLogger() +116 */ +117 //@Override +118 public Logger getParentLogger() throws SQLFeatureNotSupportedException { +119 //return driver.getParentLogger(); +120 Method m = null; +121 try { +122 m = driver.getClass().getMethod("getParentLogger"); +123 } catch (Throwable e) { +124 throw new SQLFeatureNotSupportedException(); +125 } +126 if (m != null) { +127 try { +128 return (Logger) m.invoke(m); +129 } catch (IllegalAccessException ex) { +130 LOGGER.log(Level.FINER, null, ex); +131 } catch (IllegalArgumentException ex) { +132 LOGGER.log(Level.FINER, null, ex); +133 } catch (InvocationTargetException ex) { +134 LOGGER.log(Level.FINER, null, ex); +135 } +136 } +137 throw new SQLFeatureNotSupportedException(); +138 } +139 +140 /** +141 * Wraps the call to the underlying driver's getPropertyInfo method. +142 * +143 * @param url the URL of the database +144 * @param info a collection of string/value pairs +145 * @return an array of DriverPropertyInfo objects +146 * @throws SQLException thrown if there is an error accessing the database +147 * @see java.sql.Driver#getPropertyInfo(java.lang.String, java.util.Properties) +148 */ +149 @Override +150 public DriverPropertyInfo[] getPropertyInfo(String url, Properties info) throws SQLException { +151 return this.driver.getPropertyInfo(url, info); +152 } +153 +154 /** +155 * Returns whether or not the wrapped driver is jdbcCompliant. +156 * +157 * @return true if the wrapped driver is JDBC compliant; otherwise false +158 * @see java.sql.Driver#jdbcCompliant() +159 */ +160 @Override +161 public boolean jdbcCompliant() { +162 return this.driver.jdbcCompliant(); +163 } +164 +165 /** +166 * Standard implementation of hashCode. +167 * +168 * @return the hashCode of the object +169 */ +170 @Override +171 public int hashCode() { +172 int hash = 7; +173 hash = 97 * hash + (this.driver != null ? this.driver.hashCode() : 0); +174 return hash; +175 } +176 +177 /** +178 * Standard implementation of equals. +179 * +180 * @param obj the object to compare +181 * @return returns true if the objects are equal; otherwise false +182 */ +183 @Override +184 public boolean equals(Object obj) { +185 if (obj == null) { +186 return false; +187 } +188 if (getClass() != obj.getClass()) { +189 return false; +190 } +191 final DriverShim other = (DriverShim) obj; +192 return this.driver == other.driver || (this.driver != null && this.driver.equals(other.driver)); +193 } +194 +195 /** +196 * Standard implementation of toString(). +197 * +198 * @return the String representation of the object +199 */ +200 @Override +201 public String toString() { +202 return "DriverShim{" + "driver=" + driver + '}'; +203 } +204 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html index fbfe2b77c..90a6097b4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html index db33e3890..9508dbacd 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html index 03e7579b7..3f68e7de4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html @@ -39,29 +39,34 @@ 31 public class NvdCveUpdater implements CachedWebDataSource { 32 33 /** -34 * <p> -35 * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p> -36 * -37 * @throws UpdateException is thrown if there is an error updating the database -38 */ -39 @Override -40 public void update() throws UpdateException { -41 try { -42 final StandardUpdate task = new StandardUpdate(); -43 if (task.isUpdateNeeded()) { -44 task.update(); -45 } -46 } catch (MalformedURLException ex) { -47 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING, -48 "NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data."); -49 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex); -50 } catch (DownloadFailedException ex) { -51 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING, -52 "Unable to download the NVD CVE data, unable to update the data to use the most current data."); -53 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex); -54 } -55 } -56 } +34 * The logger +35 */ +36 private static final Logger LOGGER = Logger.getLogger(NvdCveUpdater.class.getName()); +37 +38 /** +39 * <p> +40 * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p> +41 * +42 * @throws UpdateException is thrown if there is an error updating the database +43 */ +44 @Override +45 public void update() throws UpdateException { +46 try { +47 final StandardUpdate task = new StandardUpdate(); +48 if (task.isUpdateNeeded()) { +49 task.update(); +50 } +51 } catch (MalformedURLException ex) { +52 LOGGER.log(Level.WARNING, +53 "NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data."); +54 LOGGER.log(Level.FINE, null, ex); +55 } catch (DownloadFailedException ex) { +56 LOGGER.log(Level.WARNING, +57 "Unable to download the NVD CVE data, unable to update the data to use the most current data."); +58 LOGGER.log(Level.FINE, null, ex); +59 } +60 } +61 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html index 18e8e2d7f..15d243d76 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html @@ -56,287 +56,289 @@ 48 public class StandardUpdate { 49 50 /** -51 * The max thread pool size to use when downloading files. +51 * Static logger. 52 */ -53 public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3); +53 private static final Logger LOGGER = Logger.getLogger(StandardUpdate.class.getName()); 54 /** -55 * Information about the timestamps and URLs for data that needs to be updated. +55 * The max thread pool size to use when downloading files. 56 */ -57 private DatabaseProperties properties; +57 public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3); 58 /** -59 * A collection of updateable NVD CVE items. +59 * Information about the timestamps and URLs for data that needs to be updated. 60 */ -61 private UpdateableNvdCve updateable; +61 private DatabaseProperties properties; 62 /** -63 * Reference to the Cve Database. +63 * A collection of updateable NVD CVE items. 64 */ -65 private CveDB cveDB = null; -66 -67 /** -68 * Gets whether or not an update is needed. -69 * -70 * @return true or false depending on whether an update is needed -71 */ -72 public boolean isUpdateNeeded() { -73 return updateable.isUpdateNeeded(); -74 } -75 -76 /** -77 * Constructs a new Standard Update Task. -78 * -79 * @throws MalformedURLException thrown if a configured URL is malformed -80 * @throws DownloadFailedException thrown if a timestamp cannot be checked on a configured URL -81 * @throws UpdateException thrown if there is an exception generating the update task -82 */ -83 public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException { -84 openDataStores(); -85 properties = cveDB.getDatabaseProperties(); -86 updateable = updatesNeeded(); -87 } -88 -89 /** -90 * <p> -91 * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p> -92 * -93 * @throws UpdateException is thrown if there is an error updating the database -94 */ -95 public void update() throws UpdateException { -96 int maxUpdates = 0; -97 try { -98 for (NvdCveInfo cve : updateable) { -99 if (cve.getNeedsUpdate()) { -100 maxUpdates += 1; -101 } -102 } -103 if (maxUpdates <= 0) { -104 return; -105 } -106 if (maxUpdates > 3) { -107 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, -108 "NVD CVE requires several updates; this could take a couple of minutes."); +65 private UpdateableNvdCve updateable; +66 /** +67 * Reference to the Cve Database. +68 */ +69 private CveDB cveDB = null; +70 +71 /** +72 * Gets whether or not an update is needed. +73 * +74 * @return true or false depending on whether an update is needed +75 */ +76 public boolean isUpdateNeeded() { +77 return updateable.isUpdateNeeded(); +78 } +79 +80 /** +81 * Constructs a new Standard Update Task. +82 * +83 * @throws MalformedURLException thrown if a configured URL is malformed +84 * @throws DownloadFailedException thrown if a timestamp cannot be checked on a configured URL +85 * @throws UpdateException thrown if there is an exception generating the update task +86 */ +87 public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException { +88 openDataStores(); +89 properties = cveDB.getDatabaseProperties(); +90 updateable = updatesNeeded(); +91 } +92 +93 /** +94 * <p> +95 * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p> +96 * +97 * @throws UpdateException is thrown if there is an error updating the database +98 */ +99 public void update() throws UpdateException { +100 int maxUpdates = 0; +101 try { +102 for (NvdCveInfo cve : updateable) { +103 if (cve.getNeedsUpdate()) { +104 maxUpdates += 1; +105 } +106 } +107 if (maxUpdates <= 0) { +108 return; 109 } -110 if (maxUpdates > 0) { -111 openDataStores(); -112 } -113 -114 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates; -115 -116 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize); -117 final ExecutorService processExecutor = Executors.newSingleThreadExecutor(); -118 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates); -119 for (NvdCveInfo cve : updateable) { -120 if (cve.getNeedsUpdate()) { -121 final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB); -122 downloadFutures.add(downloadExecutors.submit(call)); -123 } -124 } -125 downloadExecutors.shutdown(); -126 -127 //next, move the future future processTasks to just future processTasks -128 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates); -129 for (Future<Future<ProcessTask>> future : downloadFutures) { -130 Future<ProcessTask> task = null; -131 try { -132 task = future.get(); -133 } catch (InterruptedException ex) { -134 downloadExecutors.shutdownNow(); -135 processExecutor.shutdownNow(); -136 -137 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interrupted during download", ex); -138 throw new UpdateException("The download was interrupted", ex); -139 } catch (ExecutionException ex) { -140 downloadExecutors.shutdownNow(); -141 processExecutor.shutdownNow(); -142 -143 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interrupted during download execution", ex); -144 throw new UpdateException("The execution of the download was interrupted", ex); -145 } -146 if (task == null) { -147 downloadExecutors.shutdownNow(); -148 processExecutor.shutdownNow(); -149 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interrupted during download"); -150 throw new UpdateException("The download was interrupted; unable to complete the update"); -151 } else { -152 processFutures.add(task); -153 } -154 } -155 -156 for (Future<ProcessTask> future : processFutures) { -157 try { -158 final ProcessTask task = future.get(); -159 if (task.getException() != null) { -160 throw task.getException(); -161 } -162 } catch (InterruptedException ex) { -163 processExecutor.shutdownNow(); -164 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interrupted during processing", ex); -165 throw new UpdateException(ex); -166 } catch (ExecutionException ex) { +110 if (maxUpdates > 3) { +111 LOGGER.log(Level.INFO, +112 "NVD CVE requires several updates; this could take a couple of minutes."); +113 } +114 if (maxUpdates > 0) { +115 openDataStores(); +116 } +117 +118 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates; +119 +120 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize); +121 final ExecutorService processExecutor = Executors.newSingleThreadExecutor(); +122 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates); +123 for (NvdCveInfo cve : updateable) { +124 if (cve.getNeedsUpdate()) { +125 final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB, Settings.getInstance()); +126 downloadFutures.add(downloadExecutors.submit(call)); +127 } +128 } +129 downloadExecutors.shutdown(); +130 +131 //next, move the future future processTasks to just future processTasks +132 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates); +133 for (Future<Future<ProcessTask>> future : downloadFutures) { +134 Future<ProcessTask> task = null; +135 try { +136 task = future.get(); +137 } catch (InterruptedException ex) { +138 downloadExecutors.shutdownNow(); +139 processExecutor.shutdownNow(); +140 +141 LOGGER.log(Level.FINE, "Thread was interrupted during download", ex); +142 throw new UpdateException("The download was interrupted", ex); +143 } catch (ExecutionException ex) { +144 downloadExecutors.shutdownNow(); +145 processExecutor.shutdownNow(); +146 +147 LOGGER.log(Level.FINE, "Thread was interrupted during download execution", ex); +148 throw new UpdateException("The execution of the download was interrupted", ex); +149 } +150 if (task == null) { +151 downloadExecutors.shutdownNow(); +152 processExecutor.shutdownNow(); +153 LOGGER.log(Level.FINE, "Thread was interrupted during download"); +154 throw new UpdateException("The download was interrupted; unable to complete the update"); +155 } else { +156 processFutures.add(task); +157 } +158 } +159 +160 for (Future<ProcessTask> future : processFutures) { +161 try { +162 final ProcessTask task = future.get(); +163 if (task.getException() != null) { +164 throw task.getException(); +165 } +166 } catch (InterruptedException ex) { 167 processExecutor.shutdownNow(); -168 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Execution Exception during process", ex); +168 LOGGER.log(Level.FINE, "Thread was interrupted during processing", ex); 169 throw new UpdateException(ex); -170 } finally { -171 processExecutor.shutdown(); -172 } -173 } -174 -175 if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it) -176 properties.save(updateable.get(MODIFIED)); -177 cveDB.cleanupDatabase(); -178 } -179 } finally { -180 closeDataStores(); -181 } -182 } -183 -184 /** -185 * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last -186 * update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to -187 * be updated. -188 * -189 * @return the collection of files that need to be updated -190 * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta data is incorrect -191 * @throws DownloadFailedException is thrown if there is an error. downloading the NVD CVE download data file -192 * @throws UpdateException Is thrown if there is an issue with the last updated properties file -193 */ -194 protected final UpdateableNvdCve updatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException { -195 UpdateableNvdCve updates = null; -196 try { -197 updates = retrieveCurrentTimestampsFromWeb(); -198 } catch (InvalidDataException ex) { -199 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page"; -200 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, msg, ex); -201 throw new DownloadFailedException(msg, ex); -202 } catch (InvalidSettingException ex) { -203 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Invalid setting found when retrieving timestamps", ex); -204 throw new DownloadFailedException("Invalid settings", ex); -205 } -206 -207 if (updates == null) { -208 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data"); +170 } catch (ExecutionException ex) { +171 processExecutor.shutdownNow(); +172 LOGGER.log(Level.FINE, "Execution Exception during process", ex); +173 throw new UpdateException(ex); +174 } finally { +175 processExecutor.shutdown(); +176 } +177 } +178 +179 if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it) +180 properties.save(updateable.get(MODIFIED)); +181 cveDB.cleanupDatabase(); +182 } +183 } finally { +184 closeDataStores(); +185 } +186 } +187 +188 /** +189 * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last +190 * update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to +191 * be updated. +192 * +193 * @return the collection of files that need to be updated +194 * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta data is incorrect +195 * @throws DownloadFailedException is thrown if there is an error. downloading the NVD CVE download data file +196 * @throws UpdateException Is thrown if there is an issue with the last updated properties file +197 */ +198 protected final UpdateableNvdCve updatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException { +199 UpdateableNvdCve updates = null; +200 try { +201 updates = retrieveCurrentTimestampsFromWeb(); +202 } catch (InvalidDataException ex) { +203 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page"; +204 LOGGER.log(Level.FINE, msg, ex); +205 throw new DownloadFailedException(msg, ex); +206 } catch (InvalidSettingException ex) { +207 LOGGER.log(Level.FINE, "Invalid setting found when retrieving timestamps", ex); +208 throw new DownloadFailedException("Invalid settings", ex); 209 } -210 if (!properties.isEmpty()) { -211 try { -212 final long lastUpdated = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED, "0")); -213 final Date now = new Date(); -214 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7); -215 if (lastUpdated == updates.getTimeStamp(MODIFIED)) { -216 updates.clear(); //we don't need to update anything. -217 } else if (withinRange(lastUpdated, now.getTime(), days)) { -218 for (NvdCveInfo entry : updates) { -219 if (MODIFIED.equals(entry.getId())) { -220 entry.setNeedsUpdate(true); -221 } else { -222 entry.setNeedsUpdate(false); -223 } -224 } -225 } else { //we figure out which of the several XML files need to be downloaded. -226 for (NvdCveInfo entry : updates) { -227 if (MODIFIED.equals(entry.getId())) { -228 entry.setNeedsUpdate(true); -229 } else { -230 long currentTimestamp = 0; -231 try { -232 currentTimestamp = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + entry.getId(), "0")); -233 } catch (NumberFormatException ex) { -234 final String msg = String.format("Error parsing '%s' '%s' from nvdcve.lastupdated", -235 DatabaseProperties.LAST_UPDATED_BASE, entry.getId()); -236 Logger -237 .getLogger(StandardUpdate.class -238 .getName()).log(Level.FINE, msg, ex); -239 } -240 if (currentTimestamp == entry.getTimestamp()) { -241 entry.setNeedsUpdate(false); -242 } -243 } -244 } -245 } -246 } catch (NumberFormatException ex) { -247 final String msg = "An invalid schema version or timestamp exists in the data.properties file."; -248 Logger.getLogger(StandardUpdate.class.getName()).log(Level.WARNING, msg); -249 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "", ex); -250 } -251 } -252 return updates; -253 } -254 -255 /** -256 * Retrieves the timestamps from the NVD CVE meta data file. -257 * -258 * @return the timestamp from the currently published nvdcve downloads page -259 * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data is incorrect. -260 * @throws DownloadFailedException thrown if there is an error downloading the nvd cve meta data file -261 * @throws InvalidDataException thrown if there is an exception parsing the timestamps -262 * @throws InvalidSettingException thrown if the settings are invalid -263 */ -264 private UpdateableNvdCve retrieveCurrentTimestampsFromWeb() -265 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException { -266 -267 final UpdateableNvdCve updates = new UpdateableNvdCve(); -268 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL), -269 Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL), -270 false); -271 -272 final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR); -273 final int end = Calendar.getInstance().get(Calendar.YEAR); -274 final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0); -275 final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2); -276 for (int i = start; i <= end; i++) { -277 updates.add(Integer.toString(i), String.format(baseUrl20, i), -278 String.format(baseUrl12, i), -279 true); -280 } -281 -282 return updates; -283 } -284 -285 /** -286 * Closes the CVE and CPE data stores. -287 */ -288 protected void closeDataStores() { -289 if (cveDB != null) { -290 try { -291 cveDB.close(); -292 } catch (Throwable ignore) { -293 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINEST, "Error closing the cveDB", ignore); -294 } -295 } -296 } -297 -298 /** -299 * Opens the CVE and CPE data stores. -300 * -301 * @throws UpdateException thrown if a data store cannot be opened -302 */ -303 protected final void openDataStores() throws UpdateException { -304 if (cveDB != null) { -305 return; -306 } -307 try { -308 cveDB = new CveDB(); -309 cveDB.open(); -310 } catch (DatabaseException ex) { -311 closeDataStores(); -312 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Database Exception opening databases", ex); -313 throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details."); -314 } -315 } -316 -317 /** -318 * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the -319 * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date -320 * is considered valid. -321 * -322 * @param date the date to be checked. -323 * @param compareTo the date to compare to. -324 * @param range the range in days to be considered valid. -325 * @return whether or not the date is within the range. -326 */ -327 protected boolean withinRange(long date, long compareTo, int range) { -328 final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0; -329 return differenceInDays < range; -330 } -331 } +210 +211 if (updates == null) { +212 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data"); +213 } +214 if (!properties.isEmpty()) { +215 try { +216 final long lastUpdated = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED, "0")); +217 final Date now = new Date(); +218 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7); +219 if (lastUpdated == updates.getTimeStamp(MODIFIED)) { +220 updates.clear(); //we don't need to update anything. +221 } else if (withinRange(lastUpdated, now.getTime(), days)) { +222 for (NvdCveInfo entry : updates) { +223 if (MODIFIED.equals(entry.getId())) { +224 entry.setNeedsUpdate(true); +225 } else { +226 entry.setNeedsUpdate(false); +227 } +228 } +229 } else { //we figure out which of the several XML files need to be downloaded. +230 for (NvdCveInfo entry : updates) { +231 if (MODIFIED.equals(entry.getId())) { +232 entry.setNeedsUpdate(true); +233 } else { +234 long currentTimestamp = 0; +235 try { +236 currentTimestamp = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + entry.getId(), "0")); +237 } catch (NumberFormatException ex) { +238 final String msg = String.format("Error parsing '%s' '%s' from nvdcve.lastupdated", +239 DatabaseProperties.LAST_UPDATED_BASE, entry.getId()); +240 LOGGER.log(Level.FINE, msg, ex); +241 } +242 if (currentTimestamp == entry.getTimestamp()) { +243 entry.setNeedsUpdate(false); +244 } +245 } +246 } +247 } +248 } catch (NumberFormatException ex) { +249 final String msg = "An invalid schema version or timestamp exists in the data.properties file."; +250 LOGGER.log(Level.WARNING, msg); +251 LOGGER.log(Level.FINE, "", ex); +252 } +253 } +254 return updates; +255 } +256 +257 /** +258 * Retrieves the timestamps from the NVD CVE meta data file. +259 * +260 * @return the timestamp from the currently published nvdcve downloads page +261 * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data is incorrect. +262 * @throws DownloadFailedException thrown if there is an error downloading the nvd cve meta data file +263 * @throws InvalidDataException thrown if there is an exception parsing the timestamps +264 * @throws InvalidSettingException thrown if the settings are invalid +265 */ +266 private UpdateableNvdCve retrieveCurrentTimestampsFromWeb() +267 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException { +268 +269 final UpdateableNvdCve updates = new UpdateableNvdCve(); +270 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL), +271 Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL), +272 false); +273 +274 final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR); +275 final int end = Calendar.getInstance().get(Calendar.YEAR); +276 final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0); +277 final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2); +278 for (int i = start; i <= end; i++) { +279 updates.add(Integer.toString(i), String.format(baseUrl20, i), +280 String.format(baseUrl12, i), +281 true); +282 } +283 +284 return updates; +285 } +286 +287 /** +288 * Closes the CVE and CPE data stores. +289 */ +290 protected void closeDataStores() { +291 if (cveDB != null) { +292 try { +293 cveDB.close(); +294 } catch (Throwable ignore) { +295 LOGGER.log(Level.FINEST, "Error closing the cveDB", ignore); +296 } +297 } +298 } +299 +300 /** +301 * Opens the CVE and CPE data stores. +302 * +303 * @throws UpdateException thrown if a data store cannot be opened +304 */ +305 protected final void openDataStores() throws UpdateException { +306 if (cveDB != null) { +307 return; +308 } +309 try { +310 cveDB = new CveDB(); +311 cveDB.open(); +312 } catch (DatabaseException ex) { +313 closeDataStores(); +314 LOGGER.log(Level.FINE, "Database Exception opening databases", ex); +315 throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details."); +316 } +317 } +318 +319 /** +320 * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the +321 * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date +322 * is considered valid. +323 * +324 * @param date the date to be checked. +325 * @param compareTo the date to compare to. +326 * @param range the range in days to be considered valid. +327 * @return whether or not the date is within the range. +328 */ +329 protected boolean withinRange(long date, long compareTo, int range) { +330 final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0; +331 return differenceInDays < range; +332 } +333 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html index aee3bd95f..1edbd3047 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html @@ -29,48 +29,36 @@ 21 import java.util.ServiceLoader; 22 23 /** -24 * -25 * @author Jeremy Long <jeremy.long@owasp.org> -26 */ -27 public final class UpdateService { -28 -29 /** -30 * the singleton reference to the service. -31 */ -32 private static UpdateService service; -33 /** -34 * the service loader for CachedWebDataSource. -35 */ -36 private final ServiceLoader<CachedWebDataSource> loader; -37 -38 /** -39 * Creates a new instance of UpdateService +24 * The CachedWebDataSource Service Loader. This class loads all services that implement +25 * org.owasp.dependencycheck.data.update.CachedWebDataSource. +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29 public class UpdateService { +30 +31 /** +32 * the service loader for CachedWebDataSource. +33 */ +34 private final ServiceLoader<CachedWebDataSource> loader; +35 +36 /** +37 * Creates a new instance of UpdateService. +38 * +39 * @param classLoader the ClassLoader to use when dynamically loading Analyzer and Update services 40 */ -41 private UpdateService() { -42 loader = ServiceLoader.load(CachedWebDataSource.class); +41 public UpdateService(ClassLoader classLoader) { +42 loader = ServiceLoader.load(CachedWebDataSource.class, classLoader); 43 } 44 45 /** -46 * Retrieve the singleton instance of UpdateService. +46 * Returns an Iterator for all instances of the CachedWebDataSource interface. 47 * -48 * @return a singleton UpdateService. +48 * @return an iterator of CachedWebDataSource. 49 */ -50 public static synchronized UpdateService getInstance() { -51 if (service == null) { -52 service = new UpdateService(); -53 } -54 return service; -55 } -56 -57 /** -58 * Returns an Iterator for all instances of the CachedWebDataSource interface. -59 * -60 * @return an iterator of CachedWebDataSource. -61 */ -62 public Iterator<CachedWebDataSource> getDataSources() { -63 return loader.iterator(); -64 } -65 } +50 public Iterator<CachedWebDataSource> getDataSources() { +51 return loader.iterator(); +52 } +53 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html index f6badb097..eb38a7bd5 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.exception + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html index cc2214d90..d100f79c2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.exception + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html index 0136c26c0..ffd161f44 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html index 734c89e39..2647c6d9d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html index 5b6ecbab9..b82a06387 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html @@ -35,196 +35,213 @@ 27 import java.util.logging.Logger; 28 import org.owasp.dependencycheck.data.nvdcve.CveDB; 29 import org.owasp.dependencycheck.data.update.NvdCveInfo; -30 import org.owasp.dependencycheck.utils.DownloadFailedException; -31 import org.owasp.dependencycheck.utils.Downloader; -32 import org.owasp.dependencycheck.utils.Settings; -33 -34 /** -35 * A callable object to download two files. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class CallableDownloadTask implements Callable<Future<ProcessTask>> { -40 -41 /** -42 * Simple constructor for the callable download task. -43 * -44 * @param nvdCveInfo the NVD CVE info -45 * @param processor the processor service to submit the downloaded files to -46 * @param cveDB the CVE DB to use to store the vulnerability data -47 */ -48 public CallableDownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB) { -49 this.nvdCveInfo = nvdCveInfo; -50 this.processorService = processor; -51 this.cveDB = cveDB; -52 -53 final File file1; -54 final File file2; -55 -56 try { -57 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml", Settings.getTempDirectory()); -58 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml", Settings.getTempDirectory()); -59 } catch (IOException ex) { -60 return; -61 } -62 this.first = file1; -63 this.second = file2; -64 -65 } -66 /** -67 * The CVE DB to use when processing the files. -68 */ -69 private CveDB cveDB; -70 /** -71 * The processor service to pass the results of the download to. -72 */ -73 private ExecutorService processorService; -74 /** -75 * The NVD CVE Meta Data. -76 */ -77 private NvdCveInfo nvdCveInfo; -78 -79 /** -80 * Get the value of nvdCveInfo. -81 * -82 * @return the value of nvdCveInfo -83 */ -84 public NvdCveInfo getNvdCveInfo() { -85 return nvdCveInfo; -86 } -87 +30 import org.owasp.dependencycheck.data.update.exception.UpdateException; +31 import org.owasp.dependencycheck.utils.DownloadFailedException; +32 import org.owasp.dependencycheck.utils.Downloader; +33 import org.owasp.dependencycheck.utils.Settings; +34 +35 /** +36 * A callable object to download two files. +37 * +38 * @author Jeremy Long <jeremy.long@owasp.org> +39 */ +40 public class CallableDownloadTask implements Callable<Future<ProcessTask>> { +41 +42 /** +43 * The Logger. +44 */ +45 private static final Logger LOGGER = Logger.getLogger(CallableDownloadTask.class.getName()); +46 +47 /** +48 * Simple constructor for the callable download task. +49 * +50 * @param nvdCveInfo the NVD CVE info +51 * @param processor the processor service to submit the downloaded files to +52 * @param cveDB the CVE DB to use to store the vulnerability data +53 * @param settings a reference to the global settings object; this is necessary so that when the thread is started +54 * the dependencies have a correct reference to the global settings. +55 * @throws UpdateException thrown if temporary files could not be created +56 */ +57 public CallableDownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB, Settings settings) throws UpdateException { +58 this.nvdCveInfo = nvdCveInfo; +59 this.processorService = processor; +60 this.cveDB = cveDB; +61 this.settings = settings; +62 +63 final File file1; +64 final File file2; +65 +66 try { +67 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml", Settings.getTempDirectory()); +68 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml", Settings.getTempDirectory()); +69 } catch (IOException ex) { +70 throw new UpdateException("Unable to create temporary files", ex); +71 } +72 this.first = file1; +73 this.second = file2; +74 +75 } +76 /** +77 * The CVE DB to use when processing the files. +78 */ +79 private CveDB cveDB; +80 /** +81 * The processor service to pass the results of the download to. +82 */ +83 private ExecutorService processorService; +84 /** +85 * The NVD CVE Meta Data. +86 */ +87 private NvdCveInfo nvdCveInfo; 88 /** -89 * Set the value of nvdCveInfo. -90 * -91 * @param nvdCveInfo new value of nvdCveInfo -92 */ -93 public void setNvdCveInfo(NvdCveInfo nvdCveInfo) { -94 this.nvdCveInfo = nvdCveInfo; -95 } -96 /** -97 * a file. -98 */ -99 private File first; -100 -101 /** -102 * Get the value of first. -103 * -104 * @return the value of first -105 */ -106 public File getFirst() { -107 return first; -108 } -109 +89 * A reference to the global settings object. +90 */ +91 private Settings settings; +92 +93 /** +94 * Get the value of nvdCveInfo. +95 * +96 * @return the value of nvdCveInfo +97 */ +98 public NvdCveInfo getNvdCveInfo() { +99 return nvdCveInfo; +100 } +101 +102 /** +103 * Set the value of nvdCveInfo. +104 * +105 * @param nvdCveInfo new value of nvdCveInfo +106 */ +107 public void setNvdCveInfo(NvdCveInfo nvdCveInfo) { +108 this.nvdCveInfo = nvdCveInfo; +109 } 110 /** -111 * Set the value of first. -112 * -113 * @param first new value of first -114 */ -115 public void setFirst(File first) { -116 this.first = first; -117 } -118 /** -119 * a file. -120 */ -121 private File second; -122 -123 /** -124 * Get the value of second. -125 * -126 * @return the value of second -127 */ -128 public File getSecond() { -129 return second; -130 } -131 +111 * a file. +112 */ +113 private File first; +114 +115 /** +116 * Get the value of first. +117 * +118 * @return the value of first +119 */ +120 public File getFirst() { +121 return first; +122 } +123 +124 /** +125 * Set the value of first. +126 * +127 * @param first new value of first +128 */ +129 public void setFirst(File first) { +130 this.first = first; +131 } 132 /** -133 * Set the value of second. -134 * -135 * @param second new value of second -136 */ -137 public void setSecond(File second) { -138 this.second = second; -139 } -140 /** -141 * A placeholder for an exception. -142 */ -143 private Exception exception = null; -144 -145 /** -146 * Get the value of exception. -147 * -148 * @return the value of exception -149 */ -150 public Exception getException() { -151 return exception; -152 } -153 +133 * a file. +134 */ +135 private File second; +136 +137 /** +138 * Get the value of second. +139 * +140 * @return the value of second +141 */ +142 public File getSecond() { +143 return second; +144 } +145 +146 /** +147 * Set the value of second. +148 * +149 * @param second new value of second +150 */ +151 public void setSecond(File second) { +152 this.second = second; +153 } 154 /** -155 * returns whether or not an exception occurred during download. -156 * -157 * @return whether or not an exception occurred during download -158 */ -159 public boolean hasException() { -160 return exception != null; -161 } -162 -163 @Override -164 public Future<ProcessTask> call() throws Exception { -165 try { -166 final URL url1 = new URL(nvdCveInfo.getUrl()); -167 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl()); -168 String msg = String.format("Download Started for NVD CVE - %s", nvdCveInfo.getId()); -169 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg); -170 try { -171 Downloader.fetchFile(url1, first); -172 Downloader.fetchFile(url2, second); -173 } catch (DownloadFailedException ex) { -174 msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); -175 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg); -176 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, null, ex); -177 return null; -178 } -179 -180 msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId()); -181 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg); -182 -183 final ProcessTask task = new ProcessTask(cveDB, this); -184 return this.processorService.submit(task); -185 -186 } catch (Throwable ex) { -187 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); -188 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg); -189 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, "Download Task Failed", ex); -190 } -191 return null; -192 } -193 -194 /** -195 * Attempts to delete the files that were downloaded. -196 */ -197 public void cleanup() { -198 boolean deleted = false; -199 try { -200 if (first != null && first.exists()) { -201 deleted = first.delete(); -202 } -203 } finally { -204 if (first != null && (first.exists() || !deleted)) { -205 first.deleteOnExit(); -206 } +155 * A placeholder for an exception. +156 */ +157 private Exception exception = null; +158 +159 /** +160 * Get the value of exception. +161 * +162 * @return the value of exception +163 */ +164 public Exception getException() { +165 return exception; +166 } +167 +168 /** +169 * returns whether or not an exception occurred during download. +170 * +171 * @return whether or not an exception occurred during download +172 */ +173 public boolean hasException() { +174 return exception != null; +175 } +176 +177 @Override +178 public Future<ProcessTask> call() throws Exception { +179 try { +180 Settings.setInstance(settings); +181 final URL url1 = new URL(nvdCveInfo.getUrl()); +182 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl()); +183 String msg = String.format("Download Started for NVD CVE - %s", nvdCveInfo.getId()); +184 LOGGER.log(Level.INFO, msg); +185 try { +186 Downloader.fetchFile(url1, first); +187 Downloader.fetchFile(url2, second); +188 } catch (DownloadFailedException ex) { +189 msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); +190 LOGGER.log(Level.WARNING, msg); +191 LOGGER.log(Level.FINE, null, ex); +192 return null; +193 } +194 +195 msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId()); +196 LOGGER.log(Level.INFO, msg); +197 +198 final ProcessTask task = new ProcessTask(cveDB, this, settings); +199 return this.processorService.submit(task); +200 +201 } catch (Throwable ex) { +202 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); +203 LOGGER.log(Level.WARNING, msg); +204 LOGGER.log(Level.FINE, "Download Task Failed", ex); +205 } finally { +206 Settings.cleanup(); 207 } -208 try { -209 deleted = false; -210 if (second != null && second.exists()) { -211 deleted = second.delete(); -212 } -213 } finally { -214 if (second != null && (second.exists() || !deleted)) { -215 second.deleteOnExit(); -216 } -217 } -218 } -219 } +208 return null; +209 } +210 +211 /** +212 * Attempts to delete the files that were downloaded. +213 */ +214 public void cleanup() { +215 boolean deleted = false; +216 try { +217 if (first != null && first.exists()) { +218 deleted = first.delete(); +219 } +220 } finally { +221 if (first != null && (first.exists() || !deleted)) { +222 first.deleteOnExit(); +223 } +224 } +225 try { +226 deleted = false; +227 if (second != null && second.exists()) { +228 deleted = second.delete(); +229 } +230 } finally { +231 if (second != null && (second.exists() || !deleted)) { +232 second.deleteOnExit(); +233 } +234 } +235 } +236 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html index ec7c48bf2..8e797dc09 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html @@ -40,11 +40,11 @@ 32 import org.owasp.dependencycheck.data.nvdcve.CveDB; 33 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; 34 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -35 import org.owasp.dependencycheck.data.update.StandardUpdate; -36 import org.owasp.dependencycheck.data.update.exception.UpdateException; -37 import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; -38 import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; -39 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +35 import org.owasp.dependencycheck.data.update.exception.UpdateException; +36 import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; +37 import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; +38 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +39 import org.owasp.dependencycheck.utils.Settings; 40 import org.xml.sax.SAXException; 41 42 /** @@ -55,130 +55,144 @@ 47 public class ProcessTask implements Callable<ProcessTask> { 48 49 /** -50 * A field to store any update exceptions that occur during the "call". +50 * The logger. 51 */ -52 private UpdateException exception = null; -53 -54 /** -55 * Get the value of exception. -56 * -57 * @return the value of exception -58 */ -59 public UpdateException getException() { -60 return exception; -61 } -62 -63 /** -64 * Set the value of exception. -65 * -66 * @param exception new value of exception -67 */ -68 public void setException(UpdateException exception) { -69 this.exception = exception; -70 } -71 /** -72 * A reference to the CveDB. -73 */ -74 private final CveDB cveDB; +52 private static final Logger LOGGER = Logger.getLogger(ProcessTask.class.getName()); +53 /** +54 * A field to store any update exceptions that occur during the "call". +55 */ +56 private UpdateException exception = null; +57 +58 /** +59 * Get the value of exception. +60 * +61 * @return the value of exception +62 */ +63 public UpdateException getException() { +64 return exception; +65 } +66 +67 /** +68 * Set the value of exception. +69 * +70 * @param exception new value of exception +71 */ +72 public void setException(UpdateException exception) { +73 this.exception = exception; +74 } 75 /** -76 * A reference to the callable download task. +76 * A reference to the CveDB. 77 */ -78 private final CallableDownloadTask filePair; +78 private final CveDB cveDB; 79 /** -80 * A reference to the properties. +80 * A reference to the callable download task. 81 */ -82 private final DatabaseProperties properties; -83 -84 /** -85 * Constructs a new ProcessTask used to process an NVD CVE update. -86 * -87 * @param cveDB the data store object -88 * @param filePair the download task that contains the URL references to download +82 private final CallableDownloadTask filePair; +83 /** +84 * A reference to the properties. +85 */ +86 private final DatabaseProperties properties; +87 /** +88 * A reference to the global settings object. 89 */ -90 public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair) { -91 this.cveDB = cveDB; -92 this.filePair = filePair; -93 this.properties = cveDB.getDatabaseProperties(); -94 } -95 -96 /** -97 * Implements the callable interface. -98 * -99 * @return this object -100 * @throws Exception thrown if there is an exception; note that any UpdateExceptions are simply added to the tasks -101 * exception collection -102 */ -103 @Override -104 public ProcessTask call() throws Exception { -105 try { -106 processFiles(); -107 } catch (UpdateException ex) { -108 this.exception = ex; -109 } -110 return this; -111 } -112 -113 /** -114 * Imports the NVD CVE XML File into the Lucene Index. -115 * -116 * @param file the file containing the NVD CVE XML -117 * @param oldVersion contains the file containing the NVD CVE XML 1.2 -118 * @throws ParserConfigurationException is thrown if there is a parser configuration exception -119 * @throws SAXException is thrown if there is a SAXException -120 * @throws IOException is thrown if there is a IO Exception -121 * @throws SQLException is thrown if there is a SQL exception -122 * @throws DatabaseException is thrown if there is a database exception -123 * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded -124 */ -125 protected void importXML(File file, File oldVersion) throws ParserConfigurationException, -126 SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException { -127 -128 final SAXParserFactory factory = SAXParserFactory.newInstance(); -129 final SAXParser saxParser = factory.newSAXParser(); -130 -131 final NvdCve12Handler cve12Handler = new NvdCve12Handler(); -132 saxParser.parse(oldVersion, cve12Handler); -133 final Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities(); -134 -135 final NvdCve20Handler cve20Handler = new NvdCve20Handler(); -136 cve20Handler.setCveDB(cveDB); -137 cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap); -138 saxParser.parse(file, cve20Handler); -139 } -140 -141 /** -142 * Processes the NVD CVE XML file and imports the data into the DB. -143 * -144 * @throws UpdateException thrown if there is an error loading the data into the database -145 */ -146 private void processFiles() throws UpdateException { -147 String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId()); -148 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg); -149 try { -150 importXML(filePair.getFirst(), filePair.getSecond()); -151 cveDB.commit(); -152 properties.save(filePair.getNvdCveInfo()); -153 } catch (FileNotFoundException ex) { -154 throw new UpdateException(ex); -155 } catch (ParserConfigurationException ex) { -156 throw new UpdateException(ex); -157 } catch (SAXException ex) { -158 throw new UpdateException(ex); -159 } catch (IOException ex) { -160 throw new UpdateException(ex); -161 } catch (SQLException ex) { -162 throw new UpdateException(ex); -163 } catch (DatabaseException ex) { -164 throw new UpdateException(ex); -165 } catch (ClassNotFoundException ex) { -166 throw new UpdateException(ex); -167 } finally { -168 filePair.cleanup(); -169 } -170 msg = String.format("Processing Complete for NVD CVE - %s", filePair.getNvdCveInfo().getId()); -171 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg); -172 } -173 } +90 private Settings settings; +91 +92 /** +93 * Constructs a new ProcessTask used to process an NVD CVE update. +94 * +95 * @param cveDB the data store object +96 * @param filePair the download task that contains the URL references to download +97 * @param settings a reference to the global settings object; this is necessary so that when the thread is started +98 * the dependencies have a correct reference to the global settings. +99 */ +100 public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair, Settings settings) { +101 this.cveDB = cveDB; +102 this.filePair = filePair; +103 this.properties = cveDB.getDatabaseProperties(); +104 this.settings = settings; +105 } +106 +107 /** +108 * Implements the callable interface. +109 * +110 * @return this object +111 * @throws Exception thrown if there is an exception; note that any UpdateExceptions are simply added to the tasks +112 * exception collection +113 */ +114 @Override +115 public ProcessTask call() throws Exception { +116 try { +117 Settings.setInstance(settings); +118 processFiles(); +119 } catch (UpdateException ex) { +120 this.exception = ex; +121 } finally { +122 Settings.cleanup(); +123 } +124 return this; +125 } +126 +127 /** +128 * Imports the NVD CVE XML File into the Lucene Index. +129 * +130 * @param file the file containing the NVD CVE XML +131 * @param oldVersion contains the file containing the NVD CVE XML 1.2 +132 * @throws ParserConfigurationException is thrown if there is a parser configuration exception +133 * @throws SAXException is thrown if there is a SAXException +134 * @throws IOException is thrown if there is a IO Exception +135 * @throws SQLException is thrown if there is a SQL exception +136 * @throws DatabaseException is thrown if there is a database exception +137 * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded +138 */ +139 protected void importXML(File file, File oldVersion) throws ParserConfigurationException, +140 SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException { +141 +142 final SAXParserFactory factory = SAXParserFactory.newInstance(); +143 final SAXParser saxParser = factory.newSAXParser(); +144 +145 final NvdCve12Handler cve12Handler = new NvdCve12Handler(); +146 saxParser.parse(oldVersion, cve12Handler); +147 final Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities(); +148 +149 final NvdCve20Handler cve20Handler = new NvdCve20Handler(); +150 cve20Handler.setCveDB(cveDB); +151 cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap); +152 saxParser.parse(file, cve20Handler); +153 } +154 +155 /** +156 * Processes the NVD CVE XML file and imports the data into the DB. +157 * +158 * @throws UpdateException thrown if there is an error loading the data into the database +159 */ +160 private void processFiles() throws UpdateException { +161 String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId()); +162 LOGGER.log(Level.INFO, msg); +163 try { +164 importXML(filePair.getFirst(), filePair.getSecond()); +165 cveDB.commit(); +166 properties.save(filePair.getNvdCveInfo()); +167 } catch (FileNotFoundException ex) { +168 throw new UpdateException(ex); +169 } catch (ParserConfigurationException ex) { +170 throw new UpdateException(ex); +171 } catch (SAXException ex) { +172 throw new UpdateException(ex); +173 } catch (IOException ex) { +174 throw new UpdateException(ex); +175 } catch (SQLException ex) { +176 throw new UpdateException(ex); +177 } catch (DatabaseException ex) { +178 throw new UpdateException(ex); +179 } catch (ClassNotFoundException ex) { +180 throw new UpdateException(ex); +181 } finally { +182 filePair.cleanup(); +183 } +184 msg = String.format("Processing Complete for NVD CVE - %s", filePair.getNvdCveInfo().getId()); +185 LOGGER.log(Level.INFO, msg); +186 } +187 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html index 5d58c8e68..6aaf68495 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.task + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update.task diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html index ec2c05722..799e81578 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.task + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update.task diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html index fe761212b..0b221d415 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html @@ -49,454 +49,458 @@ 41 public class NvdCve20Handler extends DefaultHandler { 42 43 /** -44 * the current supported schema version. +44 * The logger. 45 */ -46 private static final String CURRENT_SCHEMA_VERSION = "2.0"; +46 private static final Logger LOGGER = Logger.getLogger(NvdCve20Handler.class.getName()); 47 /** -48 * the current element. +48 * the current supported schema version. 49 */ -50 private final Element current = new Element(); +50 private static final String CURRENT_SCHEMA_VERSION = "2.0"; 51 /** -52 * the text of the node. +52 * the current element. 53 */ -54 private StringBuilder nodeText; +54 private final Element current = new Element(); 55 /** -56 * the vulnerability. +56 * the text of the node. 57 */ -58 private Vulnerability vulnerability; +58 private StringBuilder nodeText; 59 /** -60 * a reference for the cve. +60 * the vulnerability. 61 */ -62 private Reference reference; +62 private Vulnerability vulnerability; 63 /** -64 * flag indicating whether the application has a cpe. +64 * a reference for the cve. 65 */ -66 private boolean hasApplicationCpe = false; +66 private Reference reference; 67 /** -68 * The total number of entries parsed. +68 * flag indicating whether the application has a cpe. 69 */ -70 private int totalNumberOfEntries; -71 -72 /** -73 * Get the value of totalNumberOfEntries. -74 * -75 * @return the value of totalNumberOfEntries -76 */ -77 public int getTotalNumberOfEntries() { -78 return totalNumberOfEntries; -79 } -80 /** -81 * The total number of application entries parsed. -82 */ -83 private int totalNumberOfApplicationEntries; -84 -85 /** -86 * Get the value of totalNumberOfApplicationEntries. -87 * -88 * @return the value of totalNumberOfApplicationEntries -89 */ -90 public int getTotalNumberOfApplicationEntries() { -91 return totalNumberOfApplicationEntries; -92 } -93 -94 @Override -95 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { -96 current.setNode(qName); -97 if (current.isEntryNode()) { -98 hasApplicationCpe = false; -99 vulnerability = new Vulnerability(); -100 vulnerability.setName(attributes.getValue("id")); -101 } else if (current.isVulnProductNode()) { -102 nodeText = new StringBuilder(100); -103 } else if (current.isVulnReferencesNode()) { -104 final String lang = attributes.getValue("xml:lang"); -105 if ("en".equals(lang)) { -106 reference = new Reference(); -107 } else { -108 reference = null; -109 } -110 } else if (reference != null && current.isVulnReferenceNode()) { -111 reference.setUrl(attributes.getValue("href")); -112 nodeText = new StringBuilder(130); -113 } else if (reference != null && current.isVulnSourceNode()) { -114 nodeText = new StringBuilder(30); -115 } else if (current.isVulnSummaryNode()) { -116 nodeText = new StringBuilder(500); -117 } else if (current.isNVDNode()) { -118 final String nvdVer = attributes.getValue("nvd_xml_version"); -119 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { -120 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); -121 } -122 } else if (current.isVulnCWENode()) { -123 vulnerability.setCwe(attributes.getValue("id")); -124 } else if (current.isCVSSScoreNode()) { -125 nodeText = new StringBuilder(5); -126 } else if (current.isCVSSAccessVectorNode()) { -127 nodeText = new StringBuilder(20); -128 } else if (current.isCVSSAccessComplexityNode()) { -129 nodeText = new StringBuilder(20); -130 } else if (current.isCVSSAuthenticationNode()) { +70 private boolean hasApplicationCpe = false; +71 /** +72 * The total number of entries parsed. +73 */ +74 private int totalNumberOfEntries; +75 +76 /** +77 * Get the value of totalNumberOfEntries. +78 * +79 * @return the value of totalNumberOfEntries +80 */ +81 public int getTotalNumberOfEntries() { +82 return totalNumberOfEntries; +83 } +84 /** +85 * The total number of application entries parsed. +86 */ +87 private int totalNumberOfApplicationEntries; +88 +89 /** +90 * Get the value of totalNumberOfApplicationEntries. +91 * +92 * @return the value of totalNumberOfApplicationEntries +93 */ +94 public int getTotalNumberOfApplicationEntries() { +95 return totalNumberOfApplicationEntries; +96 } +97 +98 @Override +99 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { +100 current.setNode(qName); +101 if (current.isEntryNode()) { +102 hasApplicationCpe = false; +103 vulnerability = new Vulnerability(); +104 vulnerability.setName(attributes.getValue("id")); +105 } else if (current.isVulnProductNode()) { +106 nodeText = new StringBuilder(100); +107 } else if (current.isVulnReferencesNode()) { +108 final String lang = attributes.getValue("xml:lang"); +109 if ("en".equals(lang)) { +110 reference = new Reference(); +111 } else { +112 reference = null; +113 } +114 } else if (reference != null && current.isVulnReferenceNode()) { +115 reference.setUrl(attributes.getValue("href")); +116 nodeText = new StringBuilder(130); +117 } else if (reference != null && current.isVulnSourceNode()) { +118 nodeText = new StringBuilder(30); +119 } else if (current.isVulnSummaryNode()) { +120 nodeText = new StringBuilder(500); +121 } else if (current.isNVDNode()) { +122 final String nvdVer = attributes.getValue("nvd_xml_version"); +123 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { +124 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); +125 } +126 } else if (current.isVulnCWENode()) { +127 vulnerability.setCwe(attributes.getValue("id")); +128 } else if (current.isCVSSScoreNode()) { +129 nodeText = new StringBuilder(5); +130 } else if (current.isCVSSAccessVectorNode()) { 131 nodeText = new StringBuilder(20); -132 } else if (current.isCVSSAvailabilityImpactNode()) { +132 } else if (current.isCVSSAccessComplexityNode()) { 133 nodeText = new StringBuilder(20); -134 } else if (current.isCVSSConfidentialityImpactNode()) { +134 } else if (current.isCVSSAuthenticationNode()) { 135 nodeText = new StringBuilder(20); -136 } else if (current.isCVSSIntegrityImpactNode()) { +136 } else if (current.isCVSSAvailabilityImpactNode()) { 137 nodeText = new StringBuilder(20); -138 } -139 } -140 -141 @Override -142 public void characters(char[] ch, int start, int length) throws SAXException { -143 if (nodeText != null) { -144 nodeText.append(ch, start, length); -145 } -146 } -147 -148 @Override -149 public void endElement(String uri, String localName, String qName) throws SAXException { -150 current.setNode(qName); -151 if (current.isEntryNode()) { -152 totalNumberOfEntries += 1; -153 if (hasApplicationCpe) { -154 totalNumberOfApplicationEntries += 1; -155 try { -156 saveEntry(vulnerability); -157 } catch (DatabaseException ex) { -158 throw new SAXException(ex); -159 } catch (CorruptIndexException ex) { -160 throw new SAXException(ex); -161 } catch (IOException ex) { +138 } else if (current.isCVSSConfidentialityImpactNode()) { +139 nodeText = new StringBuilder(20); +140 } else if (current.isCVSSIntegrityImpactNode()) { +141 nodeText = new StringBuilder(20); +142 } +143 } +144 +145 @Override +146 public void characters(char[] ch, int start, int length) throws SAXException { +147 if (nodeText != null) { +148 nodeText.append(ch, start, length); +149 } +150 } +151 +152 @Override +153 public void endElement(String uri, String localName, String qName) throws SAXException { +154 current.setNode(qName); +155 if (current.isEntryNode()) { +156 totalNumberOfEntries += 1; +157 if (hasApplicationCpe) { +158 totalNumberOfApplicationEntries += 1; +159 try { +160 saveEntry(vulnerability); +161 } catch (DatabaseException ex) { 162 throw new SAXException(ex); -163 } -164 } -165 vulnerability = null; -166 } else if (current.isCVSSScoreNode()) { -167 try { -168 final float score = Float.parseFloat(nodeText.toString()); -169 vulnerability.setCvssScore(score); -170 } catch (NumberFormatException ex) { -171 Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.SEVERE, "Error parsing CVSS Score."); -172 Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.FINE, null, ex); -173 } -174 nodeText = null; -175 } else if (current.isCVSSAccessVectorNode()) { -176 vulnerability.setCvssAccessVector(nodeText.toString()); -177 nodeText = null; -178 } else if (current.isCVSSAccessComplexityNode()) { -179 vulnerability.setCvssAccessComplexity(nodeText.toString()); -180 nodeText = null; -181 } else if (current.isCVSSAuthenticationNode()) { -182 vulnerability.setCvssAuthentication(nodeText.toString()); -183 nodeText = null; -184 } else if (current.isCVSSAvailabilityImpactNode()) { -185 vulnerability.setCvssAvailabilityImpact(nodeText.toString()); -186 nodeText = null; -187 } else if (current.isCVSSConfidentialityImpactNode()) { -188 vulnerability.setCvssConfidentialityImpact(nodeText.toString()); -189 nodeText = null; -190 } else if (current.isCVSSIntegrityImpactNode()) { -191 vulnerability.setCvssIntegrityImpact(nodeText.toString()); -192 nodeText = null; -193 } else if (current.isVulnProductNode()) { -194 final String cpe = nodeText.toString(); -195 if (cpe.startsWith("cpe:/a:")) { -196 hasApplicationCpe = true; -197 vulnerability.addVulnerableSoftware(cpe); -198 } -199 nodeText = null; -200 } else if (reference != null && current.isVulnReferencesNode()) { -201 vulnerability.addReference(reference); -202 reference = null; -203 } else if (reference != null && current.isVulnReferenceNode()) { -204 reference.setName(nodeText.toString()); -205 nodeText = null; -206 } else if (reference != null && current.isVulnSourceNode()) { -207 reference.setSource(nodeText.toString()); -208 nodeText = null; -209 } else if (current.isVulnSummaryNode()) { -210 vulnerability.setDescription(nodeText.toString()); -211 if (nodeText.indexOf("** REJECT **") >= 0) { -212 hasApplicationCpe = true; //ensure we process this to delete the vuln -213 } -214 nodeText = null; -215 } -216 } -217 /** -218 * the cve database. -219 */ -220 private CveDB cveDB; -221 -222 /** -223 * Sets the cveDB. -224 * -225 * @param db a reference to the CveDB -226 */ -227 public void setCveDB(CveDB db) { -228 cveDB = db; -229 } -230 /** -231 * A list of CVE entries and associated VulnerableSoftware entries that contain previous entries. -232 */ -233 private Map<String, List<VulnerableSoftware>> prevVersionVulnMap; -234 -235 /** -236 * Sets the prevVersionVulnMap. -237 * -238 * @param map the map of vulnerable software with previous versions being vulnerable -239 */ -240 public void setPrevVersionVulnMap(Map<String, List<VulnerableSoftware>> map) { -241 prevVersionVulnMap = map; -242 } -243 -244 /** -245 * Saves a vulnerability to the CVE Database. -246 * -247 * @param vuln the vulnerability to store in the database -248 * @throws DatabaseException thrown if there is an error writing to the database -249 * @throws CorruptIndexException is thrown if the CPE Index is corrupt -250 * @throws IOException thrown if there is an IOException with the CPE Index -251 */ -252 private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException { -253 if (cveDB == null) { -254 return; -255 } -256 final String cveName = vuln.getName(); -257 if (prevVersionVulnMap.containsKey(cveName)) { -258 final List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName); -259 for (VulnerableSoftware vs : vulnSoftware) { -260 vuln.updateVulnerableSoftware(vs); -261 } -262 } -263 cveDB.updateVulnerability(vuln); -264 } -265 -266 // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node"> -267 /** -268 * A simple class to maintain information about the current element while parsing the NVD CVE XML. -269 */ -270 protected static class Element { -271 -272 /** -273 * A node type in the NVD CVE Schema 2.0 -274 */ -275 public static final String NVD = "nvd"; +163 } catch (CorruptIndexException ex) { +164 throw new SAXException(ex); +165 } catch (IOException ex) { +166 throw new SAXException(ex); +167 } +168 } +169 vulnerability = null; +170 } else if (current.isCVSSScoreNode()) { +171 try { +172 final float score = Float.parseFloat(nodeText.toString()); +173 vulnerability.setCvssScore(score); +174 } catch (NumberFormatException ex) { +175 LOGGER.log(Level.SEVERE, "Error parsing CVSS Score."); +176 LOGGER.log(Level.FINE, null, ex); +177 } +178 nodeText = null; +179 } else if (current.isCVSSAccessVectorNode()) { +180 vulnerability.setCvssAccessVector(nodeText.toString()); +181 nodeText = null; +182 } else if (current.isCVSSAccessComplexityNode()) { +183 vulnerability.setCvssAccessComplexity(nodeText.toString()); +184 nodeText = null; +185 } else if (current.isCVSSAuthenticationNode()) { +186 vulnerability.setCvssAuthentication(nodeText.toString()); +187 nodeText = null; +188 } else if (current.isCVSSAvailabilityImpactNode()) { +189 vulnerability.setCvssAvailabilityImpact(nodeText.toString()); +190 nodeText = null; +191 } else if (current.isCVSSConfidentialityImpactNode()) { +192 vulnerability.setCvssConfidentialityImpact(nodeText.toString()); +193 nodeText = null; +194 } else if (current.isCVSSIntegrityImpactNode()) { +195 vulnerability.setCvssIntegrityImpact(nodeText.toString()); +196 nodeText = null; +197 } else if (current.isVulnProductNode()) { +198 final String cpe = nodeText.toString(); +199 if (cpe.startsWith("cpe:/a:")) { +200 hasApplicationCpe = true; +201 vulnerability.addVulnerableSoftware(cpe); +202 } +203 nodeText = null; +204 } else if (reference != null && current.isVulnReferencesNode()) { +205 vulnerability.addReference(reference); +206 reference = null; +207 } else if (reference != null && current.isVulnReferenceNode()) { +208 reference.setName(nodeText.toString()); +209 nodeText = null; +210 } else if (reference != null && current.isVulnSourceNode()) { +211 reference.setSource(nodeText.toString()); +212 nodeText = null; +213 } else if (current.isVulnSummaryNode()) { +214 vulnerability.setDescription(nodeText.toString()); +215 if (nodeText.indexOf("** REJECT **") >= 0) { +216 hasApplicationCpe = true; //ensure we process this to delete the vuln +217 } +218 nodeText = null; +219 } +220 } +221 /** +222 * the cve database. +223 */ +224 private CveDB cveDB; +225 +226 /** +227 * Sets the cveDB. +228 * +229 * @param db a reference to the CveDB +230 */ +231 public void setCveDB(CveDB db) { +232 cveDB = db; +233 } +234 /** +235 * A list of CVE entries and associated VulnerableSoftware entries that contain previous entries. +236 */ +237 private Map<String, List<VulnerableSoftware>> prevVersionVulnMap; +238 +239 /** +240 * Sets the prevVersionVulnMap. +241 * +242 * @param map the map of vulnerable software with previous versions being vulnerable +243 */ +244 public void setPrevVersionVulnMap(Map<String, List<VulnerableSoftware>> map) { +245 prevVersionVulnMap = map; +246 } +247 +248 /** +249 * Saves a vulnerability to the CVE Database. +250 * +251 * @param vuln the vulnerability to store in the database +252 * @throws DatabaseException thrown if there is an error writing to the database +253 * @throws CorruptIndexException is thrown if the CPE Index is corrupt +254 * @throws IOException thrown if there is an IOException with the CPE Index +255 */ +256 private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException { +257 if (cveDB == null) { +258 return; +259 } +260 final String cveName = vuln.getName(); +261 if (prevVersionVulnMap.containsKey(cveName)) { +262 final List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName); +263 for (VulnerableSoftware vs : vulnSoftware) { +264 vuln.updateVulnerableSoftware(vs); +265 } +266 } +267 cveDB.updateVulnerability(vuln); +268 } +269 +270 // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node"> +271 /** +272 * A simple class to maintain information about the current element while parsing the NVD CVE XML. +273 */ +274 protected static class Element { +275 276 /** 277 * A node type in the NVD CVE Schema 2.0 278 */ -279 public static final String ENTRY = "entry"; +279 public static final String NVD = "nvd"; 280 /** 281 * A node type in the NVD CVE Schema 2.0 282 */ -283 public static final String VULN_PRODUCT = "vuln:product"; +283 public static final String ENTRY = "entry"; 284 /** 285 * A node type in the NVD CVE Schema 2.0 286 */ -287 public static final String VULN_REFERENCES = "vuln:references"; +287 public static final String VULN_PRODUCT = "vuln:product"; 288 /** 289 * A node type in the NVD CVE Schema 2.0 290 */ -291 public static final String VULN_SOURCE = "vuln:source"; +291 public static final String VULN_REFERENCES = "vuln:references"; 292 /** 293 * A node type in the NVD CVE Schema 2.0 294 */ -295 public static final String VULN_REFERENCE = "vuln:reference"; +295 public static final String VULN_SOURCE = "vuln:source"; 296 /** 297 * A node type in the NVD CVE Schema 2.0 298 */ -299 public static final String VULN_SUMMARY = "vuln:summary"; +299 public static final String VULN_REFERENCE = "vuln:reference"; 300 /** 301 * A node type in the NVD CVE Schema 2.0 302 */ -303 public static final String VULN_CWE = "vuln:cwe"; +303 public static final String VULN_SUMMARY = "vuln:summary"; 304 /** 305 * A node type in the NVD CVE Schema 2.0 306 */ -307 public static final String CVSS_SCORE = "cvss:score"; +307 public static final String VULN_CWE = "vuln:cwe"; 308 /** 309 * A node type in the NVD CVE Schema 2.0 310 */ -311 public static final String CVSS_ACCESS_VECTOR = "cvss:access-vector"; +311 public static final String CVSS_SCORE = "cvss:score"; 312 /** 313 * A node type in the NVD CVE Schema 2.0 314 */ -315 public static final String CVSS_ACCESS_COMPLEXITY = "cvss:access-complexity"; +315 public static final String CVSS_ACCESS_VECTOR = "cvss:access-vector"; 316 /** 317 * A node type in the NVD CVE Schema 2.0 318 */ -319 public static final String CVSS_AUTHENTICATION = "cvss:authentication"; +319 public static final String CVSS_ACCESS_COMPLEXITY = "cvss:access-complexity"; 320 /** 321 * A node type in the NVD CVE Schema 2.0 322 */ -323 public static final String CVSS_CONFIDENTIALITY_IMPACT = "cvss:confidentiality-impact"; +323 public static final String CVSS_AUTHENTICATION = "cvss:authentication"; 324 /** 325 * A node type in the NVD CVE Schema 2.0 326 */ -327 public static final String CVSS_INTEGRITY_IMPACT = "cvss:integrity-impact"; +327 public static final String CVSS_CONFIDENTIALITY_IMPACT = "cvss:confidentiality-impact"; 328 /** 329 * A node type in the NVD CVE Schema 2.0 330 */ -331 public static final String CVSS_AVAILABILITY_IMPACT = "cvss:availability-impact"; +331 public static final String CVSS_INTEGRITY_IMPACT = "cvss:integrity-impact"; 332 /** -333 * The current node. +333 * A node type in the NVD CVE Schema 2.0 334 */ -335 private String node; -336 -337 /** -338 * Gets the value of node. -339 * -340 * @return the value of node -341 */ -342 public String getNode() { -343 return this.node; -344 } -345 -346 /** -347 * Sets the value of node. -348 * -349 * @param node new value of node -350 */ -351 public void setNode(String node) { -352 this.node = node; -353 } -354 -355 /** -356 * Checks if the handler is at the NVD node. -357 * -358 * @return true or false -359 */ -360 public boolean isNVDNode() { -361 return NVD.equals(node); -362 } -363 -364 /** -365 * Checks if the handler is at the ENTRY node. -366 * -367 * @return true or false -368 */ -369 public boolean isEntryNode() { -370 return ENTRY.equals(node); -371 } -372 -373 /** -374 * Checks if the handler is at the VULN_PRODUCT node. -375 * -376 * @return true or false -377 */ -378 public boolean isVulnProductNode() { -379 return VULN_PRODUCT.equals(node); -380 } -381 -382 /** -383 * Checks if the handler is at the REFERENCES node. -384 * -385 * @return true or false -386 */ -387 public boolean isVulnReferencesNode() { -388 return VULN_REFERENCES.equals(node); -389 } -390 -391 /** -392 * Checks if the handler is at the REFERENCE node. -393 * -394 * @return true or false -395 */ -396 public boolean isVulnReferenceNode() { -397 return VULN_REFERENCE.equals(node); -398 } -399 -400 /** -401 * Checks if the handler is at the VULN_SOURCE node. -402 * -403 * @return true or false -404 */ -405 public boolean isVulnSourceNode() { -406 return VULN_SOURCE.equals(node); -407 } -408 -409 /** -410 * Checks if the handler is at the VULN_SUMMARY node. -411 * -412 * @return true or false -413 */ -414 public boolean isVulnSummaryNode() { -415 return VULN_SUMMARY.equals(node); -416 } -417 -418 /** -419 * Checks if the handler is at the VULN_CWE node. -420 * -421 * @return true or false -422 */ -423 public boolean isVulnCWENode() { -424 return VULN_CWE.equals(node); -425 } -426 -427 /** -428 * Checks if the handler is at the CVSS_SCORE node. -429 * -430 * @return true or false -431 */ -432 public boolean isCVSSScoreNode() { -433 return CVSS_SCORE.equals(node); -434 } -435 -436 /** -437 * Checks if the handler is at the CVSS_ACCESS_VECTOR node. -438 * -439 * @return true or false -440 */ -441 public boolean isCVSSAccessVectorNode() { -442 return CVSS_ACCESS_VECTOR.equals(node); -443 } -444 -445 /** -446 * Checks if the handler is at the CVSS_ACCESS_COMPLEXITY node. -447 * -448 * @return true or false -449 */ -450 public boolean isCVSSAccessComplexityNode() { -451 return CVSS_ACCESS_COMPLEXITY.equals(node); -452 } -453 -454 /** -455 * Checks if the handler is at the CVSS_AUTHENTICATION node. -456 * -457 * @return true or false -458 */ -459 public boolean isCVSSAuthenticationNode() { -460 return CVSS_AUTHENTICATION.equals(node); -461 } -462 -463 /** -464 * Checks if the handler is at the CVSS_CONFIDENTIALITY_IMPACT node. -465 * -466 * @return true or false -467 */ -468 public boolean isCVSSConfidentialityImpactNode() { -469 return CVSS_CONFIDENTIALITY_IMPACT.equals(node); -470 } -471 -472 /** -473 * Checks if the handler is at the CVSS_INTEGRITY_IMPACT node. -474 * -475 * @return true or false -476 */ -477 public boolean isCVSSIntegrityImpactNode() { -478 return CVSS_INTEGRITY_IMPACT.equals(node); -479 } -480 -481 /** -482 * Checks if the handler is at the CVSS_AVAILABILITY_IMPACT node. -483 * -484 * @return true or false -485 */ -486 public boolean isCVSSAvailabilityImpactNode() { -487 return CVSS_AVAILABILITY_IMPACT.equals(node); -488 } -489 } -490 // </editor-fold> -491 } +335 public static final String CVSS_AVAILABILITY_IMPACT = "cvss:availability-impact"; +336 /** +337 * The current node. +338 */ +339 private String node; +340 +341 /** +342 * Gets the value of node. +343 * +344 * @return the value of node +345 */ +346 public String getNode() { +347 return this.node; +348 } +349 +350 /** +351 * Sets the value of node. +352 * +353 * @param node new value of node +354 */ +355 public void setNode(String node) { +356 this.node = node; +357 } +358 +359 /** +360 * Checks if the handler is at the NVD node. +361 * +362 * @return true or false +363 */ +364 public boolean isNVDNode() { +365 return NVD.equals(node); +366 } +367 +368 /** +369 * Checks if the handler is at the ENTRY node. +370 * +371 * @return true or false +372 */ +373 public boolean isEntryNode() { +374 return ENTRY.equals(node); +375 } +376 +377 /** +378 * Checks if the handler is at the VULN_PRODUCT node. +379 * +380 * @return true or false +381 */ +382 public boolean isVulnProductNode() { +383 return VULN_PRODUCT.equals(node); +384 } +385 +386 /** +387 * Checks if the handler is at the REFERENCES node. +388 * +389 * @return true or false +390 */ +391 public boolean isVulnReferencesNode() { +392 return VULN_REFERENCES.equals(node); +393 } +394 +395 /** +396 * Checks if the handler is at the REFERENCE node. +397 * +398 * @return true or false +399 */ +400 public boolean isVulnReferenceNode() { +401 return VULN_REFERENCE.equals(node); +402 } +403 +404 /** +405 * Checks if the handler is at the VULN_SOURCE node. +406 * +407 * @return true or false +408 */ +409 public boolean isVulnSourceNode() { +410 return VULN_SOURCE.equals(node); +411 } +412 +413 /** +414 * Checks if the handler is at the VULN_SUMMARY node. +415 * +416 * @return true or false +417 */ +418 public boolean isVulnSummaryNode() { +419 return VULN_SUMMARY.equals(node); +420 } +421 +422 /** +423 * Checks if the handler is at the VULN_CWE node. +424 * +425 * @return true or false +426 */ +427 public boolean isVulnCWENode() { +428 return VULN_CWE.equals(node); +429 } +430 +431 /** +432 * Checks if the handler is at the CVSS_SCORE node. +433 * +434 * @return true or false +435 */ +436 public boolean isCVSSScoreNode() { +437 return CVSS_SCORE.equals(node); +438 } +439 +440 /** +441 * Checks if the handler is at the CVSS_ACCESS_VECTOR node. +442 * +443 * @return true or false +444 */ +445 public boolean isCVSSAccessVectorNode() { +446 return CVSS_ACCESS_VECTOR.equals(node); +447 } +448 +449 /** +450 * Checks if the handler is at the CVSS_ACCESS_COMPLEXITY node. +451 * +452 * @return true or false +453 */ +454 public boolean isCVSSAccessComplexityNode() { +455 return CVSS_ACCESS_COMPLEXITY.equals(node); +456 } +457 +458 /** +459 * Checks if the handler is at the CVSS_AUTHENTICATION node. +460 * +461 * @return true or false +462 */ +463 public boolean isCVSSAuthenticationNode() { +464 return CVSS_AUTHENTICATION.equals(node); +465 } +466 +467 /** +468 * Checks if the handler is at the CVSS_CONFIDENTIALITY_IMPACT node. +469 * +470 * @return true or false +471 */ +472 public boolean isCVSSConfidentialityImpactNode() { +473 return CVSS_CONFIDENTIALITY_IMPACT.equals(node); +474 } +475 +476 /** +477 * Checks if the handler is at the CVSS_INTEGRITY_IMPACT node. +478 * +479 * @return true or false +480 */ +481 public boolean isCVSSIntegrityImpactNode() { +482 return CVSS_INTEGRITY_IMPACT.equals(node); +483 } +484 +485 /** +486 * Checks if the handler is at the CVSS_AVAILABILITY_IMPACT node. +487 * +488 * @return true or false +489 */ +490 public boolean isCVSSAvailabilityImpactNode() { +491 return CVSS_AVAILABILITY_IMPACT.equals(node); +492 } +493 } +494 // </editor-fold> +495 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html index e297195c9..7b131d4e1 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html index d300fcd86..687215e2a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html index 40ab6e9da..5c3429ad2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html @@ -46,540 +46,609 @@ 38 public class Dependency implements Comparable<Dependency> { 39 40 /** -41 * The actual file path of the dependency on disk. +41 * The logger. 42 */ -43 private String actualFilePath; +43 private static final Logger LOGGER = Logger.getLogger(Dependency.class.getName()); 44 /** -45 * The file path to display. +45 * The actual file path of the dependency on disk. 46 */ -47 private String filePath; +47 private String actualFilePath; 48 /** -49 * The file name of the dependency. +49 * The file path to display. 50 */ -51 private String fileName; +51 private String filePath; 52 /** -53 * The file extension of the dependency. +53 * The file name of the dependency. 54 */ -55 private String fileExtension; +55 private String fileName; 56 /** -57 * The md5 hash of the dependency. +57 * The file extension of the dependency. 58 */ -59 private String md5sum; +59 private String fileExtension; 60 /** -61 * The SHA1 hash of the dependency. +61 * The md5 hash of the dependency. 62 */ -63 private String sha1sum; +63 private String md5sum; 64 /** -65 * A list of Identifiers. +65 * The SHA1 hash of the dependency. 66 */ -67 private Set<Identifier> identifiers; +67 private String sha1sum; 68 /** -69 * A collection of vendor evidence. +69 * A list of Identifiers. 70 */ -71 private final EvidenceCollection vendorEvidence; +71 private Set<Identifier> identifiers; 72 /** -73 * A collection of product evidence. +73 * A collection of vendor evidence. 74 */ -75 private final EvidenceCollection productEvidence; +75 private final EvidenceCollection vendorEvidence; 76 /** -77 * A collection of version evidence. +77 * A collection of product evidence. 78 */ -79 private final EvidenceCollection versionEvidence; -80 -81 /** -82 * Constructs a new Dependency object. -83 */ -84 public Dependency() { -85 vendorEvidence = new EvidenceCollection(); -86 productEvidence = new EvidenceCollection(); -87 versionEvidence = new EvidenceCollection(); -88 identifiers = new TreeSet<Identifier>(); -89 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator()); -90 } -91 -92 /** -93 * Constructs a new Dependency object. -94 * -95 * @param file the File to create the dependency object from. -96 */ -97 public Dependency(File file) { -98 this(); -99 this.actualFilePath = file.getPath(); -100 this.filePath = this.actualFilePath; -101 this.fileName = file.getName(); -102 this.fileExtension = FileUtils.getFileExtension(fileName); -103 determineHashes(file); -104 } -105 -106 /** -107 * Returns the file name of the dependency. -108 * -109 * @return the file name of the dependency -110 */ -111 public String getFileName() { -112 return this.fileName; -113 } -114 -115 /** -116 * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack -117 * as I could not get the replace to work in the template itself. -118 * -119 * @return the file name of the dependency with the backslash escaped for use in JavaScript -120 */ -121 public String getFileNameForJavaScript() { -122 return this.fileName.replace("\\", "\\\\"); -123 } -124 -125 /** -126 * Sets the file name of the dependency. -127 * -128 * @param fileName the file name of the dependency -129 */ -130 public void setFileName(String fileName) { -131 this.fileName = fileName; -132 } -133 -134 /** -135 * Sets the actual file path of the dependency on disk. -136 * -137 * @param actualFilePath the file path of the dependency -138 */ -139 public void setActualFilePath(String actualFilePath) { -140 this.actualFilePath = actualFilePath; -141 if (this.sha1sum == null) { -142 final File file = new File(this.actualFilePath); -143 determineHashes(file); -144 } -145 } -146 -147 /** -148 * Gets the file path of the dependency. -149 * -150 * @return the file path of the dependency -151 */ -152 public String getActualFilePath() { -153 return this.actualFilePath; -154 } -155 -156 /** -157 * Gets a reference to the File object. -158 * -159 * @return the File object -160 */ -161 public File getActualFile() { -162 return new File(this.actualFilePath); -163 } -164 -165 /** -166 * Sets the file path of the dependency. -167 * -168 * @param filePath the file path of the dependency -169 */ -170 public void setFilePath(String filePath) { -171 this.filePath = filePath; -172 } -173 -174 /** -175 * <p> -176 * Gets the file path of the dependency.</p> -177 * <p> -178 * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be -179 * obtained via the getActualFilePath().</p> -180 * -181 * @return the file path of the dependency -182 */ -183 public String getFilePath() { -184 return this.filePath; -185 } -186 -187 /** -188 * Sets the file name of the dependency. -189 * -190 * @param fileExtension the file name of the dependency -191 */ -192 public void setFileExtension(String fileExtension) { -193 this.fileExtension = fileExtension; -194 } -195 -196 /** -197 * Gets the file extension of the dependency. -198 * -199 * @return the file extension of the dependency -200 */ -201 public String getFileExtension() { -202 return this.fileExtension; -203 } -204 -205 /** -206 * Returns the MD5 Checksum of the dependency file. -207 * -208 * @return the MD5 Checksum -209 */ -210 public String getMd5sum() { -211 return this.md5sum; -212 } -213 -214 /** -215 * Sets the MD5 Checksum of the dependency. -216 * -217 * @param md5sum the MD5 Checksum -218 */ -219 public void setMd5sum(String md5sum) { -220 this.md5sum = md5sum; -221 } -222 -223 /** -224 * Returns the SHA1 Checksum of the dependency. -225 * -226 * @return the SHA1 Checksum -227 */ -228 public String getSha1sum() { -229 return this.sha1sum; -230 } -231 -232 /** -233 * Sets the SHA1 Checksum of the dependency. -234 * -235 * @param sha1sum the SHA1 Checksum -236 */ -237 public void setSha1sum(String sha1sum) { -238 this.sha1sum = sha1sum; -239 } -240 -241 /** -242 * Returns a List of Identifiers. -243 * -244 * @return an ArrayList of Identifiers -245 */ -246 public Set<Identifier> getIdentifiers() { -247 return this.identifiers; -248 } -249 -250 /** -251 * Sets a List of Identifiers. -252 * -253 * @param identifiers A list of Identifiers -254 */ -255 public void setIdentifiers(Set<Identifier> identifiers) { -256 this.identifiers = identifiers; -257 } -258 -259 /** -260 * Adds an entry to the list of detected Identifiers for the dependency file. -261 * -262 * @param type the type of identifier (such as CPE) -263 * @param value the value of the identifier -264 * @param url the URL of the identifier -265 */ -266 public void addIdentifier(String type, String value, String url) { -267 final Identifier i = new Identifier(type, value, url); -268 this.identifiers.add(i); -269 } -270 -271 /** -272 * Adds an entry to the list of detected Identifiers for the dependency file. -273 * -274 * @param type the type of identifier (such as CPE) -275 * @param value the value of the identifier -276 * @param url the URL of the identifier -277 * @param confidence the confidence in the Identifier being accurate -278 */ -279 public void addIdentifier(String type, String value, String url, Confidence confidence) { -280 final Identifier i = new Identifier(type, value, url); -281 i.setConfidence(confidence); -282 this.identifiers.add(i); -283 } -284 -285 /** -286 * Adds an entry to the list of detected Identifiers for the dependency file. -287 * -288 * @param identifier the identifier to add -289 */ -290 public void addIdentifier(Identifier identifier) { -291 this.identifiers.add(identifier); -292 } -293 -294 /** -295 * Returns the evidence used to identify this dependency. -296 * -297 * @return an EvidenceCollection. -298 */ -299 public EvidenceCollection getEvidence() { -300 return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); -301 } -302 -303 /** -304 * Returns the evidence used to identify this dependency. -305 * -306 * @return an EvidenceCollection. -307 */ -308 public EvidenceCollection getEvidenceUsed() { -309 return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence); -310 } -311 -312 /** -313 * Gets the Vendor Evidence. -314 * -315 * @return an EvidenceCollection. -316 */ -317 public EvidenceCollection getVendorEvidence() { -318 return this.vendorEvidence; -319 } -320 -321 /** -322 * Gets the Product Evidence. -323 * -324 * @return an EvidenceCollection. -325 */ -326 public EvidenceCollection getProductEvidence() { -327 return this.productEvidence; -328 } -329 -330 /** -331 * Gets the Version Evidence. -332 * -333 * @return an EvidenceCollection. -334 */ -335 public EvidenceCollection getVersionEvidence() { -336 return this.versionEvidence; -337 } -338 /** -339 * The description of the JAR file. +79 private final EvidenceCollection productEvidence; +80 /** +81 * A collection of version evidence. +82 */ +83 private final EvidenceCollection versionEvidence; +84 +85 /** +86 * Constructs a new Dependency object. +87 */ +88 public Dependency() { +89 vendorEvidence = new EvidenceCollection(); +90 productEvidence = new EvidenceCollection(); +91 versionEvidence = new EvidenceCollection(); +92 identifiers = new TreeSet<Identifier>(); +93 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator()); +94 suppressedIdentifiers = new TreeSet<Identifier>(); +95 suppressedVulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator()); +96 } +97 +98 /** +99 * Constructs a new Dependency object. +100 * +101 * @param file the File to create the dependency object from. +102 */ +103 public Dependency(File file) { +104 this(); +105 this.actualFilePath = file.getPath(); +106 this.filePath = this.actualFilePath; +107 this.fileName = file.getName(); +108 this.fileExtension = FileUtils.getFileExtension(fileName); +109 determineHashes(file); +110 } +111 +112 /** +113 * Returns the file name of the dependency. +114 * +115 * @return the file name of the dependency +116 */ +117 public String getFileName() { +118 return this.fileName; +119 } +120 +121 /** +122 * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack +123 * as I could not get the replace to work in the template itself. +124 * +125 * @return the file name of the dependency with the backslash escaped for use in JavaScript +126 */ +127 public String getFileNameForJavaScript() { +128 return this.fileName.replace("\\", "\\\\"); +129 } +130 +131 /** +132 * Sets the file name of the dependency. +133 * +134 * @param fileName the file name of the dependency +135 */ +136 public void setFileName(String fileName) { +137 this.fileName = fileName; +138 } +139 +140 /** +141 * Sets the actual file path of the dependency on disk. +142 * +143 * @param actualFilePath the file path of the dependency +144 */ +145 public void setActualFilePath(String actualFilePath) { +146 this.actualFilePath = actualFilePath; +147 if (this.sha1sum == null) { +148 final File file = new File(this.actualFilePath); +149 determineHashes(file); +150 } +151 } +152 +153 /** +154 * Gets the file path of the dependency. +155 * +156 * @return the file path of the dependency +157 */ +158 public String getActualFilePath() { +159 return this.actualFilePath; +160 } +161 +162 /** +163 * Gets a reference to the File object. +164 * +165 * @return the File object +166 */ +167 public File getActualFile() { +168 return new File(this.actualFilePath); +169 } +170 +171 /** +172 * Sets the file path of the dependency. +173 * +174 * @param filePath the file path of the dependency +175 */ +176 public void setFilePath(String filePath) { +177 this.filePath = filePath; +178 } +179 +180 /** +181 * <p> +182 * Gets the file path of the dependency.</p> +183 * <p> +184 * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be +185 * obtained via the getActualFilePath().</p> +186 * +187 * @return the file path of the dependency +188 */ +189 public String getFilePath() { +190 return this.filePath; +191 } +192 +193 /** +194 * Sets the file name of the dependency. +195 * +196 * @param fileExtension the file name of the dependency +197 */ +198 public void setFileExtension(String fileExtension) { +199 this.fileExtension = fileExtension; +200 } +201 +202 /** +203 * Gets the file extension of the dependency. +204 * +205 * @return the file extension of the dependency +206 */ +207 public String getFileExtension() { +208 return this.fileExtension; +209 } +210 +211 /** +212 * Returns the MD5 Checksum of the dependency file. +213 * +214 * @return the MD5 Checksum +215 */ +216 public String getMd5sum() { +217 return this.md5sum; +218 } +219 +220 /** +221 * Sets the MD5 Checksum of the dependency. +222 * +223 * @param md5sum the MD5 Checksum +224 */ +225 public void setMd5sum(String md5sum) { +226 this.md5sum = md5sum; +227 } +228 +229 /** +230 * Returns the SHA1 Checksum of the dependency. +231 * +232 * @return the SHA1 Checksum +233 */ +234 public String getSha1sum() { +235 return this.sha1sum; +236 } +237 +238 /** +239 * Sets the SHA1 Checksum of the dependency. +240 * +241 * @param sha1sum the SHA1 Checksum +242 */ +243 public void setSha1sum(String sha1sum) { +244 this.sha1sum = sha1sum; +245 } +246 +247 /** +248 * Returns a List of Identifiers. +249 * +250 * @return an ArrayList of Identifiers +251 */ +252 public Set<Identifier> getIdentifiers() { +253 return this.identifiers; +254 } +255 +256 /** +257 * Sets a List of Identifiers. +258 * +259 * @param identifiers A list of Identifiers +260 */ +261 public void setIdentifiers(Set<Identifier> identifiers) { +262 this.identifiers = identifiers; +263 } +264 +265 /** +266 * Adds an entry to the list of detected Identifiers for the dependency file. +267 * +268 * @param type the type of identifier (such as CPE) +269 * @param value the value of the identifier +270 * @param url the URL of the identifier +271 */ +272 public void addIdentifier(String type, String value, String url) { +273 final Identifier i = new Identifier(type, value, url); +274 this.identifiers.add(i); +275 } +276 +277 /** +278 * Adds an entry to the list of detected Identifiers for the dependency file. +279 * +280 * @param type the type of identifier (such as CPE) +281 * @param value the value of the identifier +282 * @param url the URL of the identifier +283 * @param confidence the confidence in the Identifier being accurate +284 */ +285 public void addIdentifier(String type, String value, String url, Confidence confidence) { +286 final Identifier i = new Identifier(type, value, url); +287 i.setConfidence(confidence); +288 this.identifiers.add(i); +289 } +290 +291 /** +292 * Adds an entry to the list of detected Identifiers for the dependency file. +293 * +294 * @param identifier the identifier to add +295 */ +296 public void addIdentifier(Identifier identifier) { +297 this.identifiers.add(identifier); +298 } +299 /** +300 * A set of identifiers that have been suppressed. +301 */ +302 private Set<Identifier> suppressedIdentifiers; +303 +304 /** +305 * Get the value of suppressedIdentifiers. +306 * +307 * @return the value of suppressedIdentifiers +308 */ +309 public Set<Identifier> getSuppressedIdentifiers() { +310 return suppressedIdentifiers; +311 } +312 +313 /** +314 * Set the value of suppressedIdentifiers. +315 * +316 * @param suppressedIdentifiers new value of suppressedIdentifiers +317 */ +318 public void setSuppressedIdentifiers(Set<Identifier> suppressedIdentifiers) { +319 this.suppressedIdentifiers = suppressedIdentifiers; +320 } +321 +322 /** +323 * Adds an identifier to the list of suppressed identifiers. +324 * +325 * @param identifier an identifier that was suppressed. +326 */ +327 public void addSuppressedIdentifier(Identifier identifier) { +328 this.suppressedIdentifiers.add(identifier); +329 } +330 +331 /** +332 * A set of vulnerabilities that have been suppressed. +333 */ +334 private SortedSet<Vulnerability> suppressedVulnerabilities; +335 +336 /** +337 * Get the value of suppressedVulnerabilities. +338 * +339 * @return the value of suppressedVulnerabilities 340 */ -341 private String description; -342 -343 /** -344 * Get the value of description. -345 * -346 * @return the value of description -347 */ -348 public String getDescription() { -349 return description; -350 } -351 -352 /** -353 * Set the value of description. -354 * -355 * @param description new value of description -356 */ -357 public void setDescription(String description) { -358 this.description = description; -359 } -360 /** -361 * The license that this dependency uses. -362 */ -363 private String license; -364 -365 /** -366 * Get the value of license. -367 * -368 * @return the value of license -369 */ -370 public String getLicense() { -371 return license; -372 } -373 -374 /** -375 * Set the value of license. -376 * -377 * @param license new value of license -378 */ -379 public void setLicense(String license) { -380 this.license = license; -381 } -382 /** -383 * A list of vulnerabilities for this dependency. -384 */ -385 private SortedSet<Vulnerability> vulnerabilities; -386 -387 /** -388 * Get the list of vulnerabilities. -389 * -390 * @return the list of vulnerabilities -391 */ -392 public SortedSet<Vulnerability> getVulnerabilities() { -393 return vulnerabilities; -394 } -395 -396 /** -397 * Set the value of vulnerabilities. -398 * -399 * @param vulnerabilities new value of vulnerabilities -400 */ -401 public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) { -402 this.vulnerabilities = vulnerabilities; -403 } -404 -405 /** -406 * Determines the sha1 and md5 sum for the given file. -407 * -408 * @param file the file to create checksums for +341 public SortedSet<Vulnerability> getSuppressedVulnerabilities() { +342 return suppressedVulnerabilities; +343 } +344 +345 /** +346 * Set the value of suppressedVulnerabilities. +347 * +348 * @param suppressedVulnerabilities new value of suppressedVulnerabilities +349 */ +350 public void setSuppressedVulnerabilities(SortedSet<Vulnerability> suppressedVulnerabilities) { +351 this.suppressedVulnerabilities = suppressedVulnerabilities; +352 } +353 +354 /** +355 * Adds a vulnerability to the set of suppressed vulnerabilities. +356 * +357 * @param vulnerability the vulnerability that was suppressed +358 */ +359 public void addSuppressedVulnerability(Vulnerability vulnerability) { +360 this.suppressedVulnerabilities.add(vulnerability); +361 } +362 +363 /** +364 * Returns the evidence used to identify this dependency. +365 * +366 * @return an EvidenceCollection. +367 */ +368 public EvidenceCollection getEvidence() { +369 return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); +370 } +371 +372 /** +373 * Returns the evidence used to identify this dependency. +374 * +375 * @return an EvidenceCollection. +376 */ +377 public EvidenceCollection getEvidenceUsed() { +378 return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence); +379 } +380 +381 /** +382 * Gets the Vendor Evidence. +383 * +384 * @return an EvidenceCollection. +385 */ +386 public EvidenceCollection getVendorEvidence() { +387 return this.vendorEvidence; +388 } +389 +390 /** +391 * Gets the Product Evidence. +392 * +393 * @return an EvidenceCollection. +394 */ +395 public EvidenceCollection getProductEvidence() { +396 return this.productEvidence; +397 } +398 +399 /** +400 * Gets the Version Evidence. +401 * +402 * @return an EvidenceCollection. +403 */ +404 public EvidenceCollection getVersionEvidence() { +405 return this.versionEvidence; +406 } +407 /** +408 * The description of the JAR file. 409 */ -410 private void determineHashes(File file) { -411 String md5 = null; -412 String sha1 = null; -413 try { -414 md5 = Checksum.getMD5Checksum(file); -415 sha1 = Checksum.getSHA1Checksum(file); -416 } catch (IOException ex) { -417 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName()); -418 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg); -419 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex); -420 } catch (NoSuchAlgorithmException ex) { -421 final String msg = "Unable to use MD5 of SHA1 checksums."; -422 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg); -423 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex); -424 } -425 this.setMd5sum(md5); -426 this.setSha1sum(sha1); -427 } -428 +410 private String description; +411 +412 /** +413 * Get the value of description. +414 * +415 * @return the value of description +416 */ +417 public String getDescription() { +418 return description; +419 } +420 +421 /** +422 * Set the value of description. +423 * +424 * @param description new value of description +425 */ +426 public void setDescription(String description) { +427 this.description = description; +428 } 429 /** -430 * Adds a vulnerability to the dependency. -431 * -432 * @param vulnerability a vulnerability outlining a vulnerability. -433 */ -434 public void addVulnerability(Vulnerability vulnerability) { -435 this.vulnerabilities.add(vulnerability); -436 } -437 /** -438 * A collection of related dependencies. -439 */ -440 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>(); -441 -442 /** -443 * Get the value of relatedDependencies. -444 * -445 * @return the value of relatedDependencies -446 */ -447 public Set<Dependency> getRelatedDependencies() { -448 return relatedDependencies; -449 } -450 +430 * The license that this dependency uses. +431 */ +432 private String license; +433 +434 /** +435 * Get the value of license. +436 * +437 * @return the value of license +438 */ +439 public String getLicense() { +440 return license; +441 } +442 +443 /** +444 * Set the value of license. +445 * +446 * @param license new value of license +447 */ +448 public void setLicense(String license) { +449 this.license = license; +450 } 451 /** -452 * Set the value of relatedDependencies. -453 * -454 * @param relatedDependencies new value of relatedDependencies -455 */ -456 public void setRelatedDependencies(Set<Dependency> relatedDependencies) { -457 this.relatedDependencies = relatedDependencies; -458 } -459 -460 /** -461 * Adds a related dependency. -462 * -463 * @param dependency a reference to the related dependency -464 */ -465 public void addRelatedDependency(Dependency dependency) { -466 relatedDependencies.add(dependency); -467 } -468 -469 /** -470 * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name. -471 * -472 * @param o a dependency to compare -473 * @return an integer representing the natural ordering -474 */ -475 public int compareTo(Dependency o) { -476 return this.getFileName().compareToIgnoreCase(o.getFileName()); -477 } -478 -479 /** -480 * Implementation of the equals method. -481 * -482 * @param obj the object to compare -483 * @return true if the objects are equal, otherwise false -484 */ -485 @Override -486 public boolean equals(Object obj) { -487 if (obj == null) { -488 return false; -489 } -490 if (getClass() != obj.getClass()) { -491 return false; -492 } -493 final Dependency other = (Dependency) obj; -494 if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) { -495 return false; -496 } -497 if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) { -498 return false; -499 } -500 if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) { -501 return false; -502 } -503 if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) { -504 return false; -505 } -506 if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) { -507 return false; -508 } -509 if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) { -510 return false; -511 } -512 if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) { -513 return false; -514 } -515 if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) { -516 return false; -517 } -518 if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) { -519 return false; -520 } -521 if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) { -522 return false; -523 } -524 if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) { -525 return false; -526 } -527 if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) { -528 return false; -529 } -530 if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) { -531 return false; -532 } -533 if (this.relatedDependencies != other.relatedDependencies -534 && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) { -535 return false; -536 } -537 return true; -538 } -539 -540 /** -541 * Generates the HashCode. -542 * -543 * @return the HashCode -544 */ -545 @Override -546 public int hashCode() { -547 int hash = 3; -548 hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0); -549 hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0); -550 hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0); -551 hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0); -552 hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0); -553 hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0); -554 hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0); -555 hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0); -556 hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0); -557 hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0); -558 hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0); -559 hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0); -560 hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0); -561 hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0); -562 return hash; -563 } -564 -565 /** -566 * Standard toString() implementation showing the filename, actualFilePath, and filePath. -567 * -568 * @return the string representation of the file -569 */ -570 @Override -571 public String toString() { -572 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}"; -573 } -574 } +452 * A list of vulnerabilities for this dependency. +453 */ +454 private SortedSet<Vulnerability> vulnerabilities; +455 +456 /** +457 * Get the list of vulnerabilities. +458 * +459 * @return the list of vulnerabilities +460 */ +461 public SortedSet<Vulnerability> getVulnerabilities() { +462 return vulnerabilities; +463 } +464 +465 /** +466 * Set the value of vulnerabilities. +467 * +468 * @param vulnerabilities new value of vulnerabilities +469 */ +470 public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) { +471 this.vulnerabilities = vulnerabilities; +472 } +473 +474 /** +475 * Determines the sha1 and md5 sum for the given file. +476 * +477 * @param file the file to create checksums for +478 */ +479 private void determineHashes(File file) { +480 String md5 = null; +481 String sha1 = null; +482 try { +483 md5 = Checksum.getMD5Checksum(file); +484 sha1 = Checksum.getSHA1Checksum(file); +485 } catch (IOException ex) { +486 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName()); +487 LOGGER.log(Level.WARNING, msg); +488 LOGGER.log(Level.FINE, null, ex); +489 } catch (NoSuchAlgorithmException ex) { +490 final String msg = "Unable to use MD5 of SHA1 checksums."; +491 LOGGER.log(Level.WARNING, msg); +492 LOGGER.log(Level.FINE, null, ex); +493 } +494 this.setMd5sum(md5); +495 this.setSha1sum(sha1); +496 } +497 +498 /** +499 * Adds a vulnerability to the dependency. +500 * +501 * @param vulnerability a vulnerability outlining a vulnerability. +502 */ +503 public void addVulnerability(Vulnerability vulnerability) { +504 this.vulnerabilities.add(vulnerability); +505 } +506 /** +507 * A collection of related dependencies. +508 */ +509 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>(); +510 +511 /** +512 * Get the value of relatedDependencies. +513 * +514 * @return the value of relatedDependencies +515 */ +516 public Set<Dependency> getRelatedDependencies() { +517 return relatedDependencies; +518 } +519 +520 /** +521 * Set the value of relatedDependencies. +522 * +523 * @param relatedDependencies new value of relatedDependencies +524 */ +525 public void setRelatedDependencies(Set<Dependency> relatedDependencies) { +526 this.relatedDependencies = relatedDependencies; +527 } +528 +529 /** +530 * Adds a related dependency. +531 * +532 * @param dependency a reference to the related dependency +533 */ +534 public void addRelatedDependency(Dependency dependency) { +535 relatedDependencies.add(dependency); +536 } +537 +538 /** +539 * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name. +540 * +541 * @param o a dependency to compare +542 * @return an integer representing the natural ordering +543 */ +544 public int compareTo(Dependency o) { +545 return this.getFileName().compareToIgnoreCase(o.getFileName()); +546 } +547 +548 /** +549 * Implementation of the equals method. +550 * +551 * @param obj the object to compare +552 * @return true if the objects are equal, otherwise false +553 */ +554 @Override +555 public boolean equals(Object obj) { +556 if (obj == null) { +557 return false; +558 } +559 if (getClass() != obj.getClass()) { +560 return false; +561 } +562 final Dependency other = (Dependency) obj; +563 if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) { +564 return false; +565 } +566 if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) { +567 return false; +568 } +569 if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) { +570 return false; +571 } +572 if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) { +573 return false; +574 } +575 if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) { +576 return false; +577 } +578 if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) { +579 return false; +580 } +581 if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) { +582 return false; +583 } +584 if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) { +585 return false; +586 } +587 if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) { +588 return false; +589 } +590 if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) { +591 return false; +592 } +593 if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) { +594 return false; +595 } +596 if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) { +597 return false; +598 } +599 if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) { +600 return false; +601 } +602 if (this.relatedDependencies != other.relatedDependencies +603 && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) { +604 return false; +605 } +606 return true; +607 } +608 +609 /** +610 * Generates the HashCode. +611 * +612 * @return the HashCode +613 */ +614 @Override +615 public int hashCode() { +616 int hash = 3; +617 hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0); +618 hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0); +619 hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0); +620 hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0); +621 hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0); +622 hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0); +623 hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0); +624 hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0); +625 hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0); +626 hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0); +627 hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0); +628 hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0); +629 hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0); +630 hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0); +631 return hash; +632 } +633 +634 /** +635 * Standard toString() implementation showing the filename, actualFilePath, and filePath. +636 * +637 * @return the string representation of the file +638 */ +639 @Override +640 public String toString() { +641 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}"; +642 } +643 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html index b9b01dcbe..fcaffdda9 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html @@ -47,337 +47,341 @@ 39 public class EvidenceCollection implements Iterable<Evidence> { 40 41 /** -42 * Used to iterate over highest confidence evidence contained in the collection. +42 * The logger. 43 */ -44 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() { -45 public boolean passes(Evidence evidence) { -46 return evidence.getConfidence() == Confidence.HIGHEST; -47 } -48 }; -49 /** -50 * Used to iterate over high confidence evidence contained in the collection. -51 */ -52 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() { -53 public boolean passes(Evidence evidence) { -54 return evidence.getConfidence() == Confidence.HIGH; -55 } -56 }; -57 /** -58 * Used to iterate over medium confidence evidence contained in the collection. -59 */ -60 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() { -61 public boolean passes(Evidence evidence) { -62 return evidence.getConfidence() == Confidence.MEDIUM; -63 } -64 }; -65 /** -66 * Used to iterate over low confidence evidence contained in the collection. -67 */ -68 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() { -69 public boolean passes(Evidence evidence) { -70 return evidence.getConfidence() == Confidence.LOW; -71 } -72 }; -73 /** -74 * Used to iterate over evidence that has was used (aka read) from the collection. -75 */ -76 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() { -77 public boolean passes(Evidence evidence) { -78 return evidence.isUsed(); -79 } -80 }; -81 -82 /** -83 * Used to iterate over evidence of the specified confidence. -84 * -85 * @param confidence the confidence level for the evidence to be iterated over. -86 * @return Iterable<Evidence> an iterable collection of evidence -87 */ -88 public final Iterable<Evidence> iterator(Confidence confidence) { -89 if (confidence == Confidence.HIGHEST) { -90 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list); -91 } else if (confidence == Confidence.HIGH) { -92 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list); -93 } else if (confidence == Confidence.MEDIUM) { -94 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list); -95 } else { -96 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list); -97 } -98 } -99 /** -100 * A collection of evidence. -101 */ -102 private final Set<Evidence> list; +44 private static final Logger LOGGER = Logger.getLogger(EvidenceCollection.class.getName()); +45 /** +46 * Used to iterate over highest confidence evidence contained in the collection. +47 */ +48 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() { +49 public boolean passes(Evidence evidence) { +50 return evidence.getConfidence() == Confidence.HIGHEST; +51 } +52 }; +53 /** +54 * Used to iterate over high confidence evidence contained in the collection. +55 */ +56 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() { +57 public boolean passes(Evidence evidence) { +58 return evidence.getConfidence() == Confidence.HIGH; +59 } +60 }; +61 /** +62 * Used to iterate over medium confidence evidence contained in the collection. +63 */ +64 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() { +65 public boolean passes(Evidence evidence) { +66 return evidence.getConfidence() == Confidence.MEDIUM; +67 } +68 }; +69 /** +70 * Used to iterate over low confidence evidence contained in the collection. +71 */ +72 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() { +73 public boolean passes(Evidence evidence) { +74 return evidence.getConfidence() == Confidence.LOW; +75 } +76 }; +77 /** +78 * Used to iterate over evidence that has was used (aka read) from the collection. +79 */ +80 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() { +81 public boolean passes(Evidence evidence) { +82 return evidence.isUsed(); +83 } +84 }; +85 +86 /** +87 * Used to iterate over evidence of the specified confidence. +88 * +89 * @param confidence the confidence level for the evidence to be iterated over. +90 * @return Iterable<Evidence> an iterable collection of evidence +91 */ +92 public final Iterable<Evidence> iterator(Confidence confidence) { +93 if (confidence == Confidence.HIGHEST) { +94 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list); +95 } else if (confidence == Confidence.HIGH) { +96 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list); +97 } else if (confidence == Confidence.MEDIUM) { +98 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list); +99 } else { +100 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list); +101 } +102 } 103 /** -104 * A collection of strings used to adjust Lucene's term weighting. +104 * A collection of evidence. 105 */ -106 private final Set<String> weightedStrings; -107 -108 /** -109 * Creates a new EvidenceCollection. -110 */ -111 public EvidenceCollection() { -112 list = new TreeSet<Evidence>(); -113 weightedStrings = new HashSet<String>(); -114 } -115 -116 /** -117 * Adds evidence to the collection. -118 * -119 * @param e Evidence. -120 */ -121 public void addEvidence(Evidence e) { -122 list.add(e); -123 } -124 -125 /** -126 * Creates an Evidence object from the parameters and adds the resulting object to the collection. -127 * -128 * @param source the source of the Evidence. -129 * @param name the name of the Evidence. -130 * @param value the value of the Evidence. -131 * @param confidence the confidence of the Evidence. -132 */ -133 public void addEvidence(String source, String name, String value, Confidence confidence) { -134 final Evidence e = new Evidence(source, name, value, confidence); -135 addEvidence(e); -136 } -137 -138 /** -139 * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. -140 * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. -141 * -142 * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the -143 * package names within the JAR file we may add these package names to the "weighted" strings collection to boost -144 * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the -145 * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache. -146 * -147 * @param str to add to the weighting collection. -148 */ -149 public void addWeighting(String str) { -150 weightedStrings.add(str); -151 } -152 -153 /** -154 * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in -155 * another location. -156 * -157 * @return Set<String> -158 */ -159 public Set<String> getWeighting() { -160 return weightedStrings; -161 } -162 -163 /** -164 * Returns the set of evidence. -165 * -166 * @return the set of evidence. -167 */ -168 public Set<Evidence> getEvidence() { -169 return list; -170 } -171 -172 /** -173 * Returns the set of evidence from a given source. -174 * -175 * @param source the source of the evidence -176 * @return the set of evidence. -177 */ -178 public Set<Evidence> getEvidence(String source) { -179 if (source == null) { -180 return null; -181 } -182 final Set<Evidence> ret = new HashSet<Evidence>(); -183 for (Evidence e : list) { -184 if (source.equals(e.getSource())) { -185 ret.add(e); -186 } -187 } -188 return ret; -189 } -190 -191 /** -192 * Returns the set of evidence from a given source and name. -193 * -194 * @param source the source of the evidence -195 * @param name the name of the evidence to return -196 * @return the set of evidence. -197 */ -198 public Set<Evidence> getEvidence(String source, String name) { -199 if (source == null || name == null) { -200 return null; -201 } -202 final Set<Evidence> ret = new HashSet<Evidence>(); -203 for (Evidence e : list) { -204 if (source.equals(e.getSource()) && name.equals(e.getName())) { -205 ret.add(e); -206 } -207 } -208 return ret; -209 } -210 -211 /** -212 * Implements the iterator interface for the Evidence Collection. -213 * -214 * @return an Iterator<Evidence>. -215 */ -216 public Iterator<Evidence> iterator() { -217 return list.iterator(); -218 } -219 -220 /** -221 * Used to determine if a given string was used (aka read). -222 * -223 * @param text the string to search for. -224 * @return whether or not the string was used. -225 */ -226 public boolean containsUsedString(String text) { -227 if (text == null) { -228 return false; -229 } -230 final String textToTest = text.toLowerCase(); -231 -232 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { -233 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else) -234 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", ""); -235 if (value.contains(textToTest)) { -236 return true; -237 } -238 } -239 return false; -240 } -241 -242 /** -243 * Used to determine if a given version was used (aka read) from the EvidenceCollection. -244 * -245 * @param version the version to search for within the collected evidence. -246 * @return whether or not the string was used. -247 */ -248 public boolean containsUsedVersion(DependencyVersion version) { -249 if (version == null) { -250 return false; -251 } -252 -253 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { -254 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue()); -255 if (value != null && value.matchesAtLeastThreeLevels(version)) { -256 return true; -257 } -258 } -259 return false; -260 } -261 -262 /** -263 * Returns whether or not the collection contains evidence of a specified Confidence. -264 * -265 * @param confidence A Confidence value. -266 * @return boolean. -267 */ -268 public boolean contains(Confidence confidence) { -269 for (Evidence e : list) { -270 if (e.getConfidence().equals(confidence)) { -271 return true; -272 } -273 } -274 return false; -275 } -276 -277 /** -278 * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection. -279 * -280 * @param ec One or more EvidenceCollections. -281 * @return a new EvidenceCollection containing the used evidence. -282 */ -283 public static EvidenceCollection mergeUsed(EvidenceCollection... ec) { -284 final EvidenceCollection ret = new EvidenceCollection(); -285 for (EvidenceCollection col : ec) { -286 for (Evidence e : col.list) { -287 if (e.isUsed()) { -288 ret.addEvidence(e); -289 } -290 } -291 } -292 return ret; -293 } -294 -295 /** -296 * Merges multiple EvidenceCollections together. -297 * -298 * @param ec One or more EvidenceCollections. -299 * @return a new EvidenceCollection. -300 */ -301 public static EvidenceCollection merge(EvidenceCollection... ec) { -302 final EvidenceCollection ret = new EvidenceCollection(); -303 for (EvidenceCollection col : ec) { -304 ret.list.addAll(col.list); -305 ret.weightedStrings.addAll(col.weightedStrings); -306 } -307 return ret; -308 } -309 -310 /** -311 * Returns a string of evidence 'values'. -312 * -313 * @return a string containing the evidence. -314 */ -315 @Override -316 public String toString() { -317 final StringBuilder sb = new StringBuilder(); -318 for (Evidence e : this.list) { -319 sb.append(e.getValue()).append(' '); -320 } -321 return sb.toString(); -322 } -323 -324 /** -325 * Returns the number of elements in the EvidenceCollection. -326 * -327 * @return the number of elements in the collection. -328 */ -329 public int size() { -330 return list.size(); -331 } -332 -333 /** -334 * <p> -335 * Takes a string that may contain a fully qualified domain and it will return the string having removed the query -336 * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p> -337 * <p> -338 * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file -339 * extension, etc. may produce false positives. -340 * +106 private final Set<Evidence> list; +107 /** +108 * A collection of strings used to adjust Lucene's term weighting. +109 */ +110 private final Set<String> weightedStrings; +111 +112 /** +113 * Creates a new EvidenceCollection. +114 */ +115 public EvidenceCollection() { +116 list = new TreeSet<Evidence>(); +117 weightedStrings = new HashSet<String>(); +118 } +119 +120 /** +121 * Adds evidence to the collection. +122 * +123 * @param e Evidence. +124 */ +125 public void addEvidence(Evidence e) { +126 list.add(e); +127 } +128 +129 /** +130 * Creates an Evidence object from the parameters and adds the resulting object to the collection. +131 * +132 * @param source the source of the Evidence. +133 * @param name the name of the Evidence. +134 * @param value the value of the Evidence. +135 * @param confidence the confidence of the Evidence. +136 */ +137 public void addEvidence(String source, String name, String value, Confidence confidence) { +138 final Evidence e = new Evidence(source, name, value, confidence); +139 addEvidence(e); +140 } +141 +142 /** +143 * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. +144 * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. +145 * +146 * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the +147 * package names within the JAR file we may add these package names to the "weighted" strings collection to boost +148 * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the +149 * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache. +150 * +151 * @param str to add to the weighting collection. +152 */ +153 public void addWeighting(String str) { +154 weightedStrings.add(str); +155 } +156 +157 /** +158 * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in +159 * another location. +160 * +161 * @return Set<String> +162 */ +163 public Set<String> getWeighting() { +164 return weightedStrings; +165 } +166 +167 /** +168 * Returns the set of evidence. +169 * +170 * @return the set of evidence. +171 */ +172 public Set<Evidence> getEvidence() { +173 return list; +174 } +175 +176 /** +177 * Returns the set of evidence from a given source. +178 * +179 * @param source the source of the evidence +180 * @return the set of evidence. +181 */ +182 public Set<Evidence> getEvidence(String source) { +183 if (source == null) { +184 return null; +185 } +186 final Set<Evidence> ret = new HashSet<Evidence>(); +187 for (Evidence e : list) { +188 if (source.equals(e.getSource())) { +189 ret.add(e); +190 } +191 } +192 return ret; +193 } +194 +195 /** +196 * Returns the set of evidence from a given source and name. +197 * +198 * @param source the source of the evidence +199 * @param name the name of the evidence to return +200 * @return the set of evidence. +201 */ +202 public Set<Evidence> getEvidence(String source, String name) { +203 if (source == null || name == null) { +204 return null; +205 } +206 final Set<Evidence> ret = new HashSet<Evidence>(); +207 for (Evidence e : list) { +208 if (source.equals(e.getSource()) && name.equals(e.getName())) { +209 ret.add(e); +210 } +211 } +212 return ret; +213 } +214 +215 /** +216 * Implements the iterator interface for the Evidence Collection. +217 * +218 * @return an Iterator<Evidence>. +219 */ +220 public Iterator<Evidence> iterator() { +221 return list.iterator(); +222 } +223 +224 /** +225 * Used to determine if a given string was used (aka read). +226 * +227 * @param text the string to search for. +228 * @return whether or not the string was used. +229 */ +230 public boolean containsUsedString(String text) { +231 if (text == null) { +232 return false; +233 } +234 final String textToTest = text.toLowerCase(); +235 +236 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { +237 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else) +238 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", ""); +239 if (value.contains(textToTest)) { +240 return true; +241 } +242 } +243 return false; +244 } +245 +246 /** +247 * Used to determine if a given version was used (aka read) from the EvidenceCollection. +248 * +249 * @param version the version to search for within the collected evidence. +250 * @return whether or not the string was used. +251 */ +252 public boolean containsUsedVersion(DependencyVersion version) { +253 if (version == null) { +254 return false; +255 } +256 +257 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { +258 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue()); +259 if (value != null && value.matchesAtLeastThreeLevels(version)) { +260 return true; +261 } +262 } +263 return false; +264 } +265 +266 /** +267 * Returns whether or not the collection contains evidence of a specified Confidence. +268 * +269 * @param confidence A Confidence value. +270 * @return boolean. +271 */ +272 public boolean contains(Confidence confidence) { +273 for (Evidence e : list) { +274 if (e.getConfidence().equals(confidence)) { +275 return true; +276 } +277 } +278 return false; +279 } +280 +281 /** +282 * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection. +283 * +284 * @param ec One or more EvidenceCollections. +285 * @return a new EvidenceCollection containing the used evidence. +286 */ +287 public static EvidenceCollection mergeUsed(EvidenceCollection... ec) { +288 final EvidenceCollection ret = new EvidenceCollection(); +289 for (EvidenceCollection col : ec) { +290 for (Evidence e : col.list) { +291 if (e.isUsed()) { +292 ret.addEvidence(e); +293 } +294 } +295 } +296 return ret; +297 } +298 +299 /** +300 * Merges multiple EvidenceCollections together. +301 * +302 * @param ec One or more EvidenceCollections. +303 * @return a new EvidenceCollection. +304 */ +305 public static EvidenceCollection merge(EvidenceCollection... ec) { +306 final EvidenceCollection ret = new EvidenceCollection(); +307 for (EvidenceCollection col : ec) { +308 ret.list.addAll(col.list); +309 ret.weightedStrings.addAll(col.weightedStrings); +310 } +311 return ret; +312 } +313 +314 /** +315 * Returns a string of evidence 'values'. +316 * +317 * @return a string containing the evidence. +318 */ +319 @Override +320 public String toString() { +321 final StringBuilder sb = new StringBuilder(); +322 for (Evidence e : this.list) { +323 sb.append(e.getValue()).append(' '); +324 } +325 return sb.toString(); +326 } +327 +328 /** +329 * Returns the number of elements in the EvidenceCollection. +330 * +331 * @return the number of elements in the collection. +332 */ +333 public int size() { +334 return list.size(); +335 } +336 +337 /** +338 * <p> +339 * Takes a string that may contain a fully qualified domain and it will return the string having removed the query +340 * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p> 341 * <p> -342 * Example, given the following input:</p> -343 * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code> -344 * <p> -345 * The function would return:</p> -346 * <code>'Please visit somedomain path1 path2 file'</code> -347 * -348 * @param value the value that may contain a url -349 * @return the modified string -350 */ -351 private String urlCorrection(String value) { -352 if (value == null || !UrlStringUtils.containsUrl(value)) { -353 return value; -354 } -355 final StringBuilder sb = new StringBuilder(value.length()); -356 final String[] parts = value.split("\\s"); -357 for (String part : parts) { -358 if (UrlStringUtils.isUrl(part)) { -359 try { -360 final List<String> data = UrlStringUtils.extractImportantUrlData(part); -361 sb.append(' ').append(StringUtils.join(data, ' ')); -362 } catch (MalformedURLException ex) { -363 Logger.getLogger(EvidenceCollection.class.getName()).log(Level.FINE, "error parsing " + part, ex); -364 sb.append(' ').append(part); -365 } -366 } else { -367 sb.append(' ').append(part); -368 } -369 } -370 return sb.toString().trim(); -371 } -372 } +342 * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file +343 * extension, etc. may produce false positives. +344 * +345 * <p> +346 * Example, given the following input:</p> +347 * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code> +348 * <p> +349 * The function would return:</p> +350 * <code>'Please visit somedomain path1 path2 file'</code> +351 * +352 * @param value the value that may contain a url +353 * @return the modified string +354 */ +355 private String urlCorrection(String value) { +356 if (value == null || !UrlStringUtils.containsUrl(value)) { +357 return value; +358 } +359 final StringBuilder sb = new StringBuilder(value.length()); +360 final String[] parts = value.split("\\s"); +361 for (String part : parts) { +362 if (UrlStringUtils.isUrl(part)) { +363 try { +364 final List<String> data = UrlStringUtils.extractImportantUrlData(part); +365 sb.append(' ').append(StringUtils.join(data, ' ')); +366 } catch (MalformedURLException ex) { +367 LOGGER.log(Level.FINE, "error parsing " + part, ex); +368 sb.append(' ').append(part); +369 } +370 } else { +371 sb.append(' ').append(part); +372 } +373 } +374 return sb.toString().trim(); +375 } +376 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html index db54f0eb0..44d9d0924 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html @@ -40,312 +40,316 @@ 32 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> { 33 34 /** -35 * The serial version UID. +35 * The logger. 36 */ -37 private static final long serialVersionUID = 307319490326651052L; -38 -39 /** -40 * Parse a CPE entry from the cpe string representation. -41 * -42 * @param cpe a cpe entry (e.g. cpe:/a:vendor:software:version) -43 */ -44 public void setCpe(String cpe) { -45 try { -46 parseName(cpe); -47 } catch (UnsupportedEncodingException ex) { -48 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe); -49 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.WARNING, msg); -50 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.FINE, null, ex); -51 setName(cpe); -52 } -53 } -54 -55 /** -56 * <p> -57 * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, -58 * revision.</p> -59 * <p> -60 * Example:</p> -61 * <code>&nbsp;&nbsp;&nbsp;cpe:/a:apache:struts:1.1:rc2</code> -62 * +37 private static final Logger LOGGER = Logger.getLogger(VulnerableSoftware.class.getName()); +38 /** +39 * The serial version UID. +40 */ +41 private static final long serialVersionUID = 307319490326651052L; +42 +43 /** +44 * Parse a CPE entry from the cpe string representation. +45 * +46 * @param cpe a cpe entry (e.g. cpe:/a:vendor:software:version) +47 */ +48 public void setCpe(String cpe) { +49 try { +50 parseName(cpe); +51 } catch (UnsupportedEncodingException ex) { +52 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe); +53 LOGGER.log(Level.WARNING, msg); +54 LOGGER.log(Level.FINE, null, ex); +55 setName(cpe); +56 } +57 } +58 +59 /** +60 * <p> +61 * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, +62 * revision.</p> 63 * <p> -64 * Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li> -65 * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul> +64 * Example:</p> +65 * <code>&nbsp;&nbsp;&nbsp;cpe:/a:apache:struts:1.1:rc2</code> 66 * -67 * @param cpeName the cpe name -68 * @throws UnsupportedEncodingException should never be thrown... -69 */ -70 @Override -71 public void parseName(String cpeName) throws UnsupportedEncodingException { -72 this.name = cpeName; -73 if (cpeName != null && cpeName.length() > 7) { -74 final String[] data = cpeName.substring(7).split(":"); -75 if (data.length >= 1) { -76 this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8")); -77 } -78 if (data.length >= 2) { -79 this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8")); -80 } -81 if (data.length >= 3) { -82 version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8"); -83 } -84 if (data.length >= 4) { -85 revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8"); -86 } -87 if (data.length >= 5) { -88 edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8"); -89 } -90 } -91 } -92 /** -93 * If present, indicates that previous version are vulnerable. -94 */ -95 private String previousVersion; -96 -97 /** -98 * Indicates if previous versions of this software are vulnerable. -99 * -100 * @return if previous versions of this software are vulnerable -101 */ -102 public boolean hasPreviousVersion() { -103 return previousVersion != null; -104 } -105 -106 /** -107 * Get the value of previousVersion. -108 * -109 * @return the value of previousVersion -110 */ -111 public String getPreviousVersion() { -112 return previousVersion; -113 } -114 -115 /** -116 * Set the value of previousVersion. -117 * -118 * @param previousVersion new value of previousVersion -119 */ -120 public void setPreviousVersion(String previousVersion) { -121 this.previousVersion = previousVersion; -122 } -123 -124 /** -125 * Standard equals implementation to compare this VulnerableSoftware to another object. -126 * -127 * @param obj the object to compare -128 * @return whether or not the objects are equal -129 */ -130 @Override -131 public boolean equals(Object obj) { -132 if (obj == null) { -133 return false; -134 } -135 if (getClass() != obj.getClass()) { -136 return false; -137 } -138 final VulnerableSoftware other = (VulnerableSoftware) obj; -139 if ((this.getName() == null) ? (other.getName() != null) : !this.getName().equals(other.getName())) { +67 * <p> +68 * Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li> +69 * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul> +70 * +71 * @param cpeName the cpe name +72 * @throws UnsupportedEncodingException should never be thrown... +73 */ +74 @Override +75 public void parseName(String cpeName) throws UnsupportedEncodingException { +76 this.name = cpeName; +77 if (cpeName != null && cpeName.length() > 7) { +78 final String[] data = cpeName.substring(7).split(":"); +79 if (data.length >= 1) { +80 this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8")); +81 } +82 if (data.length >= 2) { +83 this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8")); +84 } +85 if (data.length >= 3) { +86 version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8"); +87 } +88 if (data.length >= 4) { +89 revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8"); +90 } +91 if (data.length >= 5) { +92 edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8"); +93 } +94 } +95 } +96 /** +97 * If present, indicates that previous version are vulnerable. +98 */ +99 private String previousVersion; +100 +101 /** +102 * Indicates if previous versions of this software are vulnerable. +103 * +104 * @return if previous versions of this software are vulnerable +105 */ +106 public boolean hasPreviousVersion() { +107 return previousVersion != null; +108 } +109 +110 /** +111 * Get the value of previousVersion. +112 * +113 * @return the value of previousVersion +114 */ +115 public String getPreviousVersion() { +116 return previousVersion; +117 } +118 +119 /** +120 * Set the value of previousVersion. +121 * +122 * @param previousVersion new value of previousVersion +123 */ +124 public void setPreviousVersion(String previousVersion) { +125 this.previousVersion = previousVersion; +126 } +127 +128 /** +129 * Standard equals implementation to compare this VulnerableSoftware to another object. +130 * +131 * @param obj the object to compare +132 * @return whether or not the objects are equal +133 */ +134 @Override +135 public boolean equals(Object obj) { +136 if (obj == null) { +137 return false; +138 } +139 if (getClass() != obj.getClass()) { 140 return false; 141 } -142 return true; -143 } -144 -145 /** -146 * Standard implementation of hashCode. -147 * -148 * @return the hashCode for the object -149 */ -150 @Override -151 public int hashCode() { -152 int hash = 7; -153 hash = 83 * hash + (this.getName() != null ? this.getName().hashCode() : 0); -154 return hash; -155 } -156 -157 /** -158 * Standard toString() implementation display the name and whether or not previous versions are also affected. -159 * -160 * @return a string representation of the object -161 */ -162 @Override -163 public String toString() { -164 return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}'; -165 } -166 -167 /** -168 * Implementation of the comparable interface. -169 * -170 * @param vs the VulnerableSoftware to compare -171 * @return an integer indicating the ordering of the two objects -172 */ -173 @Override -174 public int compareTo(VulnerableSoftware vs) { -175 int result = 0; -176 final String[] left = this.getName().split(":"); -177 final String[] right = vs.getName().split(":"); -178 final int max = (left.length <= right.length) ? left.length : right.length; -179 if (max > 0) { -180 for (int i = 0; result == 0 && i < max; i++) { -181 final String[] subLeft = left[i].split("\\."); -182 final String[] subRight = right[i].split("\\."); -183 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length; -184 if (subMax > 0) { -185 for (int x = 0; result == 0 && x < subMax; x++) { -186 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) { -187 try { -188 result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x])); -189 // final long iLeft = Long.parseLong(subLeft[x]); -190 // final long iRight = Long.parseLong(subRight[x]); -191 // if (iLeft != iRight) { -192 // if (iLeft > iRight) { -193 // result = 2; -194 // } else { -195 // result = -2; -196 // } -197 // } -198 } catch (NumberFormatException ex) { -199 //ignore the exception - they obviously aren't numbers -200 if (!subLeft[x].equalsIgnoreCase(subRight[x])) { -201 result = subLeft[x].compareToIgnoreCase(subRight[x]); -202 } -203 } -204 } else { -205 result = subLeft[x].compareToIgnoreCase(subRight[x]); -206 } -207 } -208 if (result == 0) { -209 if (subLeft.length > subRight.length) { -210 result = 2; -211 } -212 if (subRight.length > subLeft.length) { -213 result = -2; -214 } -215 } -216 } else { -217 result = left[i].compareToIgnoreCase(right[i]); -218 } -219 } -220 if (result == 0) { -221 if (left.length > right.length) { -222 result = 2; -223 } -224 if (right.length > left.length) { -225 result = -2; -226 } -227 } -228 } else { -229 result = this.getName().compareToIgnoreCase(vs.getName()); -230 } -231 return result; -232 } -233 -234 /** -235 * Determines if the string passed in is a positive integer. -236 * -237 * @param str the string to test -238 * @return true if the string only contains 0-9, otherwise false. -239 */ -240 private static boolean isPositiveInteger(final String str) { -241 if (str == null || str.isEmpty()) { -242 return false; -243 } -244 for (int i = 0; i < str.length(); i++) { -245 final char c = str.charAt(i); -246 if (c < '0' || c > '9') { -247 return false; -248 } -249 } -250 return true; -251 } -252 /** -253 * The name of the cpe. -254 */ -255 private String name; -256 -257 /** -258 * Get the value of name. -259 * -260 * @return the value of name -261 */ -262 public String getName() { -263 return name; -264 } -265 -266 /** -267 * Set the value of name. -268 * -269 * @param name new value of name -270 */ -271 public void setName(String name) { -272 this.name = name; -273 } -274 /** -275 * The product version number. -276 */ -277 private String version; -278 -279 /** -280 * Get the value of version. -281 * -282 * @return the value of version -283 */ -284 public String getVersion() { -285 return version; -286 } -287 -288 /** -289 * Set the value of version. -290 * -291 * @param version new value of version -292 */ -293 public void setVersion(String version) { -294 this.version = version; -295 } -296 /** -297 * The product revision version. -298 */ -299 private String revision; -300 -301 /** -302 * Get the value of revision. -303 * -304 * @return the value of revision -305 */ -306 public String getRevision() { -307 return revision; -308 } -309 -310 /** -311 * Set the value of revision. -312 * -313 * @param revision new value of revision -314 */ -315 public void setRevision(String revision) { -316 this.revision = revision; -317 } -318 /** -319 * The product edition. -320 */ -321 private String edition; -322 -323 /** -324 * Get the value of edition. -325 * -326 * @return the value of edition -327 */ -328 public String getEdition() { -329 return edition; -330 } -331 -332 /** -333 * Set the value of edition. -334 * -335 * @param edition new value of edition -336 */ -337 public void setEdition(String edition) { -338 this.edition = edition; -339 } -340 } +142 final VulnerableSoftware other = (VulnerableSoftware) obj; +143 if ((this.getName() == null) ? (other.getName() != null) : !this.getName().equals(other.getName())) { +144 return false; +145 } +146 return true; +147 } +148 +149 /** +150 * Standard implementation of hashCode. +151 * +152 * @return the hashCode for the object +153 */ +154 @Override +155 public int hashCode() { +156 int hash = 7; +157 hash = 83 * hash + (this.getName() != null ? this.getName().hashCode() : 0); +158 return hash; +159 } +160 +161 /** +162 * Standard toString() implementation display the name and whether or not previous versions are also affected. +163 * +164 * @return a string representation of the object +165 */ +166 @Override +167 public String toString() { +168 return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}'; +169 } +170 +171 /** +172 * Implementation of the comparable interface. +173 * +174 * @param vs the VulnerableSoftware to compare +175 * @return an integer indicating the ordering of the two objects +176 */ +177 @Override +178 public int compareTo(VulnerableSoftware vs) { +179 int result = 0; +180 final String[] left = this.getName().split(":"); +181 final String[] right = vs.getName().split(":"); +182 final int max = (left.length <= right.length) ? left.length : right.length; +183 if (max > 0) { +184 for (int i = 0; result == 0 && i < max; i++) { +185 final String[] subLeft = left[i].split("\\."); +186 final String[] subRight = right[i].split("\\."); +187 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length; +188 if (subMax > 0) { +189 for (int x = 0; result == 0 && x < subMax; x++) { +190 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) { +191 try { +192 result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x])); +193 // final long iLeft = Long.parseLong(subLeft[x]); +194 // final long iRight = Long.parseLong(subRight[x]); +195 // if (iLeft != iRight) { +196 // if (iLeft > iRight) { +197 // result = 2; +198 // } else { +199 // result = -2; +200 // } +201 // } +202 } catch (NumberFormatException ex) { +203 //ignore the exception - they obviously aren't numbers +204 if (!subLeft[x].equalsIgnoreCase(subRight[x])) { +205 result = subLeft[x].compareToIgnoreCase(subRight[x]); +206 } +207 } +208 } else { +209 result = subLeft[x].compareToIgnoreCase(subRight[x]); +210 } +211 } +212 if (result == 0) { +213 if (subLeft.length > subRight.length) { +214 result = 2; +215 } +216 if (subRight.length > subLeft.length) { +217 result = -2; +218 } +219 } +220 } else { +221 result = left[i].compareToIgnoreCase(right[i]); +222 } +223 } +224 if (result == 0) { +225 if (left.length > right.length) { +226 result = 2; +227 } +228 if (right.length > left.length) { +229 result = -2; +230 } +231 } +232 } else { +233 result = this.getName().compareToIgnoreCase(vs.getName()); +234 } +235 return result; +236 } +237 +238 /** +239 * Determines if the string passed in is a positive integer. +240 * +241 * @param str the string to test +242 * @return true if the string only contains 0-9, otherwise false. +243 */ +244 private static boolean isPositiveInteger(final String str) { +245 if (str == null || str.isEmpty()) { +246 return false; +247 } +248 for (int i = 0; i < str.length(); i++) { +249 final char c = str.charAt(i); +250 if (c < '0' || c > '9') { +251 return false; +252 } +253 } +254 return true; +255 } +256 /** +257 * The name of the cpe. +258 */ +259 private String name; +260 +261 /** +262 * Get the value of name. +263 * +264 * @return the value of name +265 */ +266 public String getName() { +267 return name; +268 } +269 +270 /** +271 * Set the value of name. +272 * +273 * @param name new value of name +274 */ +275 public void setName(String name) { +276 this.name = name; +277 } +278 /** +279 * The product version number. +280 */ +281 private String version; +282 +283 /** +284 * Get the value of version. +285 * +286 * @return the value of version +287 */ +288 public String getVersion() { +289 return version; +290 } +291 +292 /** +293 * Set the value of version. +294 * +295 * @param version new value of version +296 */ +297 public void setVersion(String version) { +298 this.version = version; +299 } +300 /** +301 * The product revision version. +302 */ +303 private String revision; +304 +305 /** +306 * Get the value of revision. +307 * +308 * @return the value of revision +309 */ +310 public String getRevision() { +311 return revision; +312 } +313 +314 /** +315 * Set the value of revision. +316 * +317 * @param revision new value of revision +318 */ +319 public void setRevision(String revision) { +320 this.revision = revision; +321 } +322 /** +323 * The product edition. +324 */ +325 private String edition; +326 +327 /** +328 * Get the value of edition. +329 * +330 * @return the value of edition +331 */ +332 public String getEdition() { +333 return edition; +334 } +335 +336 /** +337 * Set the value of edition. +338 * +339 * @param edition new value of edition +340 */ +341 public void setEdition(String edition) { +342 this.edition = edition; +343 } +344 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html index dd644018d..327f522ae 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html index 050652cc0..1f8457260 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html index b4af04836..d801b73b5 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.exception + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html index 342a78035..08aa52ef5 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.exception + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html index 7759d18e6..2da785950 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html @@ -64,16 +64,16 @@ 56 * @param uri the uri 57 * @param localName the localName 58 * @param qName the qualified name -59 * @param atts the attributes +59 * @param attributes the attributes 60 * @throws SAXException thrown if there is a SAXException 61 */ 62 @Override -63 public void startElement(String uri, String localName, String qName, Attributes atts) throws SAXException { -64 super.startElement(NAMESPACE, localName, qName, atts); +63 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { +64 super.startElement(NAMESPACE, localName, qName, attributes); 65 } 66 67 /** -68 * Indicatees the start of the document. +68 * Indicates the start of the document. 69 * 70 * @param uri the uri 71 * @param localName the localName diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html index 85a9a3600..e5660e0c9 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom.generated + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.jaxb.pom.generated diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html index c3b2bf8c5..758464e19 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom.generated + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.jaxb.pom.generated diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html index b83315002..5c8ce4367 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.jaxb.pom diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html index 1743f75f8..0fbd55a6f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.jaxb.pom + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.jaxb.pom diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html index 17f723a17..86370f423 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html index 376ffda5b..c2e0071cb 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html index 472b4f32d..123aa5590 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html @@ -34,230 +34,237 @@ 26 import java.io.InputStreamReader; 27 import java.io.OutputStream; 28 import java.io.OutputStreamWriter; -29 import java.util.List; -30 import java.util.logging.Level; -31 import java.util.logging.Logger; -32 import org.apache.velocity.app.VelocityEngine; -33 import org.apache.velocity.context.Context; -34 import org.apache.velocity.runtime.RuntimeConstants; -35 import org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader; -36 import org.apache.velocity.tools.ToolManager; -37 import org.apache.velocity.tools.config.EasyFactoryConfiguration; -38 import org.owasp.dependencycheck.analyzer.Analyzer; -39 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -40 import org.owasp.dependencycheck.dependency.Dependency; -41 import org.owasp.dependencycheck.utils.Settings; -42 -43 /** -44 * The ReportGenerator is used to, as the name implies, generate reports. Internally the generator uses the Velocity -45 * Templating Engine. The ReportGenerator exposes a list of Dependencies to the template when generating the report. -46 * -47 * @author Jeremy Long <jeremy.long@owasp.org> -48 */ -49 public class ReportGenerator { -50 -51 /** -52 * An enumeration of the report formats. -53 */ -54 public enum Format { -55 -56 /** -57 * Generate all reports. -58 */ -59 ALL, -60 /** -61 * Generate XML report. -62 */ -63 XML, -64 /** -65 * Generate HTML report. -66 */ -67 HTML, -68 /** -69 * Generate HTML Vulnerability report. -70 */ -71 VULN -72 } -73 /** -74 * The Velocity Engine. -75 */ -76 private final VelocityEngine engine; -77 /** -78 * The Velocity Engine Context. -79 */ -80 private final Context context; -81 -82 /** -83 * Constructs a new ReportGenerator. -84 * -85 * @param applicationName the application name being analyzed -86 * @param dependencies the list of dependencies -87 * @param analyzers the list of analyzers used -88 * @param properties the database properties (containing timestamps of the NVD CVE data) -89 */ -90 public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) { -91 engine = createVelocityEngine(); -92 context = createContext(); -93 -94 engine.init(); -95 -96 context.put("applicationName", applicationName); -97 context.put("dependencies", dependencies); -98 context.put("analyzers", analyzers); -99 context.put("properties", properties); -100 context.put("version", Settings.getString("application.version", "Unknown")); -101 } -102 -103 /** -104 * Creates a new Velocity Engine. -105 * -106 * @return a velocity engine. -107 */ -108 private VelocityEngine createVelocityEngine() { -109 final VelocityEngine ve = new VelocityEngine(); -110 ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class.getName()); -111 ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath"); -112 ve.setProperty("classpath.resource.loader.class", ClasspathResourceLoader.class.getName()); -113 return ve; -114 } -115 -116 /** -117 * Creates a new Velocity Context initialized with escape and date tools. -118 * -119 * @return a Velocity Context. -120 */ -121 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "RV_RETURN_VALUE_IGNORED_INFERRED", -122 justification = "No plan to fix this style issue") -123 private Context createContext() { -124 final ToolManager manager = new ToolManager(); -125 final Context c = manager.createContext(); -126 final EasyFactoryConfiguration config = new EasyFactoryConfiguration(); -127 config.addDefaultTools(); -128 config.toolbox("application").tool("esc", "org.apache.velocity.tools.generic.EscapeTool").tool("org.apache.velocity.tools.generic.DateTool"); -129 manager.configure(config); -130 return c; -131 } -132 -133 /** -134 * Generates the Dependency Reports for the identified dependencies. -135 * -136 * @param outputDir the path where the reports should be written -137 * @param format the format the report should be written in -138 * @throws IOException is thrown when the template file does not exist -139 * @throws Exception is thrown if there is an error writing out the reports. -140 */ -141 public void generateReports(String outputDir, Format format) throws IOException, Exception { -142 if (format == Format.XML || format == Format.ALL) { -143 generateReport("XmlReport", outputDir + File.separator + "dependency-check-report.xml"); -144 } -145 if (format == Format.HTML || format == Format.ALL) { -146 generateReport("HtmlReport", outputDir + File.separator + "dependency-check-report.html"); -147 } -148 if (format == Format.VULN || format == Format.ALL) { -149 generateReport("VulnerabilityReport", outputDir + File.separator + "dependency-check-vulnerability.html"); -150 } -151 } -152 -153 /** -154 * Generates the Dependency Reports for the identified dependencies. -155 * -156 * @param outputDir the path where the reports should be written -157 * @param outputFormat the format the report should be written in (XML, HTML, ALL) -158 * @throws IOException is thrown when the template file does not exist -159 * @throws Exception is thrown if there is an error writing out the reports. -160 */ -161 public void generateReports(String outputDir, String outputFormat) throws IOException, Exception { -162 final String format = outputFormat.toUpperCase(); -163 if (format.matches("^(XML|HTML|VULN|ALL)$")) { -164 if ("XML".equalsIgnoreCase(format)) { -165 generateReports(outputDir, Format.XML); -166 } -167 if ("HTML".equalsIgnoreCase(format)) { -168 generateReports(outputDir, Format.HTML); -169 } -170 if ("VULN".equalsIgnoreCase(format)) { -171 generateReports(outputDir, Format.VULN); -172 } -173 if ("ALL".equalsIgnoreCase(format)) { -174 generateReports(outputDir, Format.ALL); -175 } -176 } -177 } -178 -179 /** -180 * Generates a report from a given Velocity Template. The template name provided can be the name of a template -181 * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a -182 * template file. -183 * -184 * @param templateName the name of the template to load. -185 * @param outFileName the filename and path to write the report to. -186 * @throws IOException is thrown when the template file does not exist. -187 * @throws Exception is thrown when an exception occurs. -188 */ -189 protected void generateReport(String templateName, String outFileName) throws IOException, Exception { -190 InputStream input = null; -191 String templatePath = null; -192 final File f = new File(templateName); -193 if (f.exists() && f.isFile()) { -194 try { -195 templatePath = templateName; -196 input = new FileInputStream(f); -197 } catch (FileNotFoundException ex) { -198 final String msg = "Unable to generate the report, the report template file could not be found."; -199 Logger.getLogger(ReportGenerator.class.getName()).log(Level.SEVERE, msg); -200 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINE, null, ex); -201 } -202 } else { -203 templatePath = "templates/" + templateName + ".vsl"; -204 input = this.getClass().getClassLoader().getResourceAsStream(templatePath); -205 } -206 if (input == null) { -207 throw new IOException("Template file doesn't exist"); -208 } -209 -210 final InputStreamReader reader = new InputStreamReader(input, "UTF-8"); -211 OutputStreamWriter writer = null; -212 OutputStream outputStream = null; -213 -214 try { -215 final File outDir = new File(outFileName).getParentFile(); -216 if (!outDir.exists()) { -217 final boolean created = outDir.mkdirs(); -218 if (!created) { -219 throw new Exception("Unable to create directory '" + outDir.getAbsolutePath() + "'."); -220 } -221 } -222 -223 outputStream = new FileOutputStream(outFileName); -224 writer = new OutputStreamWriter(outputStream, "UTF-8"); -225 -226 if (!engine.evaluate(context, writer, templatePath, reader)) { -227 throw new Exception("Failed to convert the template into html."); +29 import java.text.DateFormat; +30 import java.text.SimpleDateFormat; +31 import java.util.Date; +32 import java.util.List; +33 import java.util.logging.Level; +34 import java.util.logging.Logger; +35 import org.apache.velocity.VelocityContext; +36 import org.apache.velocity.app.VelocityEngine; +37 import org.apache.velocity.context.Context; +38 import org.apache.velocity.runtime.RuntimeConstants; +39 import org.owasp.dependencycheck.analyzer.Analyzer; +40 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +41 import org.owasp.dependencycheck.dependency.Dependency; +42 import org.owasp.dependencycheck.utils.Settings; +43 +44 /** +45 * The ReportGenerator is used to, as the name implies, generate reports. Internally the generator uses the Velocity +46 * Templating Engine. The ReportGenerator exposes a list of Dependencies to the template when generating the report. +47 * +48 * @author Jeremy Long <jeremy.long@owasp.org> +49 */ +50 public class ReportGenerator { +51 +52 /** +53 * The logger. +54 */ +55 private static final Logger LOGGER = Logger.getLogger(ReportGenerator.class.getName()); +56 +57 /** +58 * An enumeration of the report formats. +59 */ +60 public enum Format { +61 +62 /** +63 * Generate all reports. +64 */ +65 ALL, +66 /** +67 * Generate XML report. +68 */ +69 XML, +70 /** +71 * Generate HTML report. +72 */ +73 HTML, +74 /** +75 * Generate HTML Vulnerability report. +76 */ +77 VULN +78 } +79 /** +80 * The Velocity Engine. +81 */ +82 private final VelocityEngine engine; +83 /** +84 * The Velocity Engine Context. +85 */ +86 private final Context context; +87 +88 /** +89 * Constructs a new ReportGenerator. +90 * +91 * @param applicationName the application name being analyzed +92 * @param dependencies the list of dependencies +93 * @param analyzers the list of analyzers used +94 * @param properties the database properties (containing timestamps of the NVD CVE data) +95 */ +96 public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) { +97 engine = createVelocityEngine(); +98 context = createContext(); +99 +100 engine.init(); +101 +102 final DateFormat dateFormat = new SimpleDateFormat("MMM d, yyyy 'at' HH:mm:ss z"); +103 final DateFormat dateFormatXML = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSZ"); +104 final Date d = new Date(); +105 final String scanDate = dateFormat.format(d); +106 final String scanDateXML = dateFormatXML.format(d); +107 final EscapeTool enc = new EscapeTool(); +108 +109 context.put("applicationName", applicationName); +110 context.put("dependencies", dependencies); +111 context.put("analyzers", analyzers); +112 context.put("properties", properties); +113 context.put("scanDate", scanDate); +114 context.put("scanDateXML", scanDateXML); +115 context.put("enc", enc); +116 context.put("version", Settings.getString("application.version", "Unknown")); +117 } +118 +119 /** +120 * Creates a new Velocity Engine. +121 * +122 * @return a velocity engine. +123 */ +124 private VelocityEngine createVelocityEngine() { +125 final VelocityEngine engine = new VelocityEngine(); +126 // Logging redirection for Velocity - Required by Jenkins and other server applications +127 engine.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class.getName()); +128 return engine; +129 } +130 +131 /** +132 * Creates a new Velocity Context. +133 * +134 * @return a Velocity Context. +135 */ +136 private Context createContext() { +137 return new VelocityContext(); +138 } +139 +140 /** +141 * Generates the Dependency Reports for the identified dependencies. +142 * +143 * @param outputDir the path where the reports should be written +144 * @param format the format the report should be written in +145 * @throws IOException is thrown when the template file does not exist +146 * @throws Exception is thrown if there is an error writing out the reports. +147 */ +148 public void generateReports(String outputDir, Format format) throws IOException, Exception { +149 if (format == Format.XML || format == Format.ALL) { +150 generateReport("XmlReport", outputDir + File.separator + "dependency-check-report.xml"); +151 } +152 if (format == Format.HTML || format == Format.ALL) { +153 generateReport("HtmlReport", outputDir + File.separator + "dependency-check-report.html"); +154 } +155 if (format == Format.VULN || format == Format.ALL) { +156 generateReport("VulnerabilityReport", outputDir + File.separator + "dependency-check-vulnerability.html"); +157 } +158 } +159 +160 /** +161 * Generates the Dependency Reports for the identified dependencies. +162 * +163 * @param outputDir the path where the reports should be written +164 * @param outputFormat the format the report should be written in (XML, HTML, ALL) +165 * @throws IOException is thrown when the template file does not exist +166 * @throws Exception is thrown if there is an error writing out the reports. +167 */ +168 public void generateReports(String outputDir, String outputFormat) throws IOException, Exception { +169 final String format = outputFormat.toUpperCase(); +170 if (format.matches("^(XML|HTML|VULN|ALL)$")) { +171 if ("XML".equalsIgnoreCase(format)) { +172 generateReports(outputDir, Format.XML); +173 } +174 if ("HTML".equalsIgnoreCase(format)) { +175 generateReports(outputDir, Format.HTML); +176 } +177 if ("VULN".equalsIgnoreCase(format)) { +178 generateReports(outputDir, Format.VULN); +179 } +180 if ("ALL".equalsIgnoreCase(format)) { +181 generateReports(outputDir, Format.ALL); +182 } +183 } +184 } +185 +186 /** +187 * Generates a report from a given Velocity Template. The template name provided can be the name of a template +188 * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a +189 * template file. +190 * +191 * @param templateName the name of the template to load. +192 * @param outFileName the filename and path to write the report to. +193 * @throws IOException is thrown when the template file does not exist. +194 * @throws Exception is thrown when an exception occurs. +195 */ +196 protected void generateReport(String templateName, String outFileName) throws IOException, Exception { +197 InputStream input = null; +198 String templatePath = null; +199 final File f = new File(templateName); +200 if (f.exists() && f.isFile()) { +201 try { +202 templatePath = templateName; +203 input = new FileInputStream(f); +204 } catch (FileNotFoundException ex) { +205 final String msg = "Unable to generate the report, the report template file could not be found."; +206 LOGGER.log(Level.SEVERE, msg); +207 LOGGER.log(Level.FINE, null, ex); +208 } +209 } else { +210 templatePath = "templates/" + templateName + ".vsl"; +211 input = this.getClass().getClassLoader().getResourceAsStream(templatePath); +212 } +213 if (input == null) { +214 throw new IOException("Template file doesn't exist"); +215 } +216 +217 final InputStreamReader reader = new InputStreamReader(input, "UTF-8"); +218 OutputStreamWriter writer = null; +219 OutputStream outputStream = null; +220 +221 try { +222 final File outDir = new File(outFileName).getParentFile(); +223 if (!outDir.exists()) { +224 final boolean created = outDir.mkdirs(); +225 if (!created) { +226 throw new Exception("Unable to create directory '" + outDir.getAbsolutePath() + "'."); +227 } 228 } -229 writer.flush(); -230 } finally { -231 if (writer != null) { -232 try { -233 writer.close(); -234 } catch (IOException ex) { -235 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex); -236 } -237 } -238 if (outputStream != null) { +229 +230 outputStream = new FileOutputStream(outFileName); +231 writer = new OutputStreamWriter(outputStream, "UTF-8"); +232 +233 if (!engine.evaluate(context, writer, templatePath, reader)) { +234 throw new Exception("Failed to convert the template into html."); +235 } +236 writer.flush(); +237 } finally { +238 if (writer != null) { 239 try { -240 outputStream.close(); +240 writer.close(); 241 } catch (IOException ex) { -242 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex); +242 LOGGER.log(Level.FINEST, null, ex); 243 } 244 } -245 try { -246 reader.close(); -247 } catch (IOException ex) { -248 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex); -249 } -250 } -251 } -252 } +245 if (outputStream != null) { +246 try { +247 outputStream.close(); +248 } catch (IOException ex) { +249 LOGGER.log(Level.FINEST, null, ex); +250 } +251 } +252 try { +253 reader.close(); +254 } catch (IOException ex) { +255 LOGGER.log(Level.FINEST, null, ex); +256 } +257 } +258 } +259 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html index 8722b4893..1e4ae8c8e 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html @@ -27,89 +27,93 @@ 19 20 import java.util.logging.Level; 21 import java.util.logging.Logger; -22 import org.apache.velocity.app.Velocity; -23 import org.apache.velocity.runtime.RuntimeServices; -24 import org.apache.velocity.runtime.log.LogChute; -25 -26 /** -27 * <p> -28 * DependencyCheck uses {@link java.util.logging.Logger} as a logging framework, and Apache Velocity uses a custom -29 * logging implementation that outputs to a file named velocity.log by default. This class is an implementation of a -30 * custom Velocity logger that redirects all velocity logging to the Java Logger class. -31 * </p><p> -32 * This class was written to address permission issues when using Dependency-Check in a server environment (such as the -33 * Jenkins plugin). In some circumstances, Velocity would attempt to create velocity.log in an un-writable -34 * directory.</p> -35 * -36 * @author Steve Springett <steve.springett@owasp.org> -37 */ -38 public class VelocityLoggerRedirect implements LogChute { -39 -40 /** -41 * This will be invoked once by the LogManager. -42 * -43 * @param rsvc the RuntimeServices -44 */ -45 public void init(RuntimeServices rsvc) { -46 // do nothing -47 } -48 -49 /** -50 * Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified -51 * values. -52 * -53 * @param level the logging level -54 * @param message the message to be logged -55 */ -56 public void log(int level, String message) { -57 Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message); -58 } -59 -60 /** -61 * Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the -62 * specified values. -63 * -64 * @param level the logging level -65 * @param message the message to be logged -66 * @param t a throwable to log -67 */ -68 public void log(int level, String message, Throwable t) { -69 Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message, t); -70 } -71 -72 /** -73 * Will always return true. The property file will decide what level to log. -74 * -75 * @param level the logging level -76 * @return true -77 */ -78 public boolean isLevelEnabled(int level) { -79 return true; -80 } -81 -82 /** -83 * Maps Velocity log levels to {@link Logger} values. -84 * -85 * @param velocityLevel the logging level -86 * @return the logging level -87 */ -88 private Level getLevel(int velocityLevel) { -89 switch (velocityLevel) { -90 case TRACE_ID: -91 return Level.ALL; -92 case DEBUG_ID: -93 return Level.FINE; -94 case INFO_ID: -95 return Level.INFO; -96 case WARN_ID: -97 return Level.WARNING; -98 case ERROR_ID: -99 return Level.SEVERE; -100 default: -101 return Level.INFO; -102 } -103 } -104 } +22 import org.apache.velocity.runtime.RuntimeServices; +23 import org.apache.velocity.runtime.log.LogChute; +24 +25 /** +26 * <p> +27 * DependencyCheck uses {@link java.util.logging.Logger} as a logging framework, and Apache Velocity uses a custom +28 * logging implementation that outputs to a file named velocity.log by default. This class is an implementation of a +29 * custom Velocity logger that redirects all velocity logging to the Java Logger class. +30 * </p><p> +31 * This class was written to address permission issues when using Dependency-Check in a server environment (such as the +32 * Jenkins plugin). In some circumstances, Velocity would attempt to create velocity.log in an un-writable +33 * directory.</p> +34 * +35 * @author Steve Springett <steve.springett@owasp.org> +36 */ +37 public class VelocityLoggerRedirect implements LogChute { +38 +39 /** +40 * The Logger. +41 */ +42 private static final Logger LOGGER = Logger.getLogger(VelocityLoggerRedirect.class.getName()); +43 +44 /** +45 * This will be invoked once by the LogManager. +46 * +47 * @param rsvc the RuntimeServices +48 */ +49 public void init(RuntimeServices rsvc) { +50 // do nothing +51 } +52 +53 /** +54 * Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified +55 * values. +56 * +57 * @param level the logging level +58 * @param message the message to be logged +59 */ +60 public void log(int level, String message) { +61 LOGGER.log(getLevel(level), message); +62 } +63 +64 /** +65 * Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the +66 * specified values. +67 * +68 * @param level the logging level +69 * @param message the message to be logged +70 * @param t a throwable to log +71 */ +72 public void log(int level, String message, Throwable t) { +73 LOGGER.log(getLevel(level), message, t); +74 } +75 +76 /** +77 * Will always return true. The property file will decide what level to log. +78 * +79 * @param level the logging level +80 * @return true +81 */ +82 public boolean isLevelEnabled(int level) { +83 return true; +84 } +85 +86 /** +87 * Maps Velocity log levels to {@link Logger} values. +88 * +89 * @param velocityLevel the logging level +90 * @return the logging level +91 */ +92 private Level getLevel(int velocityLevel) { +93 switch (velocityLevel) { +94 case TRACE_ID: +95 return Level.ALL; +96 case DEBUG_ID: +97 return Level.FINE; +98 case INFO_ID: +99 return Level.INFO; +100 case WARN_ID: +101 return Level.WARNING; +102 case ERROR_ID: +103 return Level.SEVERE; +104 default: +105 return Level.INFO; +106 } +107 } +108 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html index 2f9df700b..bdb615acd 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.reporting @@ -16,6 +16,9 @@
  • + + + diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html index 4ba714c43..a61ca22cf 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html @@ -39,65 +39,70 @@ 31publicclassSuppressionErrorHandlerimplements ErrorHandler { 3233/** -34 * Builds a prettier exception message. -35 * -36 * @param ex the SAXParseException -37 * @return an easier to read exception message -38 */ -39private String getPrettyParseExceptionInfo(SAXParseException ex) { -40 -41final StringBuilder sb = new StringBuilder(); -42 -43if (ex.getSystemId() != null) { -44 sb.append("systemId=").append(ex.getSystemId()).append(", "); -45 } -46if (ex.getPublicId() != null) { -47 sb.append("publicId=").append(ex.getPublicId()).append(", "); -48 } -49if (ex.getLineNumber() > 0) { -50 sb.append("Line=").append(ex.getLineNumber()); -51 } -52if (ex.getColumnNumber() > 0) { -53 sb.append(", Column=").append(ex.getColumnNumber()); -54 } -55 sb.append(": ").append(ex.getMessage()); -56 -57return sb.toString(); -58 } -59 -60/** -61 * Logs warnings. -62 * -63 * @param ex the warning to log -64 * @throws SAXException is never thrown -65 */ -66 @Override -67publicvoid warning(SAXParseException ex) throws SAXException { -68 Logger.getLogger(SuppressionErrorHandler.class.getName()).log(Level.FINE, null, ex); -69 } -70 -71/** -72 * Handles errors. -73 * -74 * @param ex the error to handle -75 * @throws SAXException is always thrown -76 */ -77 @Override -78publicvoid error(SAXParseException ex) throws SAXException { -79thrownew SAXException(getPrettyParseExceptionInfo(ex)); -80 } -81 -82/** -83 * Handles fatal exceptions. -84 * -85 * @param ex a fatal exception -86 * @throws SAXException is always -87 */ -88 @Override -89publicvoid fatalError(SAXParseException ex) throws SAXException { -90thrownew SAXException(getPrettyParseExceptionInfo(ex)); -91 } -92 } +34 * The logger. +35 */ +36privatestaticfinal Logger LOGGER = Logger.getLogger(SuppressionErrorHandler.class.getName()); +37 +38/** +39 * Builds a prettier exception message. +40 * +41 * @param ex the SAXParseException +42 * @return an easier to read exception message +43 */ +44private String getPrettyParseExceptionInfo(SAXParseException ex) { +45 +46final StringBuilder sb = new StringBuilder(); +47 +48if (ex.getSystemId() != null) { +49 sb.append("systemId=").append(ex.getSystemId()).append(", "); +50 } +51if (ex.getPublicId() != null) { +52 sb.append("publicId=").append(ex.getPublicId()).append(", "); +53 } +54if (ex.getLineNumber() > 0) { +55 sb.append("Line=").append(ex.getLineNumber()); +56 } +57if (ex.getColumnNumber() > 0) { +58 sb.append(", Column=").append(ex.getColumnNumber()); +59 } +60 sb.append(": ").append(ex.getMessage()); +61 +62return sb.toString(); +63 } +64 +65/** +66 * Logs warnings. +67 * +68 * @param ex the warning to log +69 * @throws SAXException is never thrown +70 */ +71 @Override +72publicvoid warning(SAXParseException ex) throws SAXException { +73 LOGGER.log(Level.FINE, null, ex); +74 } +75 +76/** +77 * Handles errors. +78 * +79 * @param ex the error to handle +80 * @throws SAXException is always thrown +81 */ +82 @Override +83publicvoid error(SAXParseException ex) throws SAXException { +84thrownew SAXException(getPrettyParseExceptionInfo(ex)); +85 } +86 +87/** +88 * Handles fatal exceptions. +89 * +90 * @param ex a fatal exception +91 * @throws SAXException is always +92 */ +93 @Override +94publicvoid fatalError(SAXParseException ex) throws SAXException { +95thrownew SAXException(getPrettyParseExceptionInfo(ex)); +96 } +97 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html index dce67bb91..e5c6b5509 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html @@ -172,7 +172,7 @@ 164 pt.setRegex(Boolean.parseBoolean(regex)); 165 } 166final String caseSensitive = currentAttributes.getValue("caseSensitive"); -167if (regex != null) { +167if (caseSensitive != null) { 168 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive)); 169 } 170 } diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html index a78c848e3..246b48491 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html @@ -50,63 +50,67 @@ 42publicclassSuppressionParser { 4344/** -45 * JAXP Schema Language. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +45 * The logger.46 */ -47publicstaticfinal String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage"; +47privatestaticfinal Logger LOGGER = Logger.getLogger(SuppressionParser.class.getName()); 48/** -49 * W3C XML Schema. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +49 * JAXP Schema Language. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html50 */ -51publicstaticfinal String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema"; +51publicstaticfinal String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage"; 52/** -53 * JAXP Schema Source. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +53 * W3C XML Schema. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html54 */ -55publicstaticfinal String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource"; -56 -57/** -58 * Parses the given xml file and returns a list of the suppression rules contained. -59 * -60 * @param file an xml file containing suppression rules -61 * @return a list of suppression rules -62 * @throws SuppressionParseException thrown if the xml file cannot be parsed -63 */ -64public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException { -65try { -66final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd"); -67finalSuppressionHandler handler = newSuppressionHandler(); -68 -69final SAXParserFactory factory = SAXParserFactory.newInstance(); -70 factory.setNamespaceAware(true); -71 factory.setValidating(true); -72final SAXParser saxParser = factory.newSAXParser(); -73 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA); -74 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream)); -75final XMLReader xmlReader = saxParser.getXMLReader(); -76 xmlReader.setErrorHandler(newSuppressionErrorHandler()); -77 xmlReader.setContentHandler(handler); -78 -79final InputStream inputStream = new FileInputStream(file); -80final Reader reader = new InputStreamReader(inputStream, "UTF-8"); -81final InputSource in = new InputSource(reader); -82//in.setEncoding("UTF-8"); -83 -84 xmlReader.parse(in); -85 -86return handler.getSuppressionRules(); -87 } catch (ParserConfigurationException ex) { -88 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -89thrownewSuppressionParseException(ex); -90 } catch (SAXException ex) { -91 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -92thrownewSuppressionParseException(ex); -93 } catch (FileNotFoundException ex) { -94 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -95thrownewSuppressionParseException(ex); -96 } catch (IOException ex) { -97 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -98thrownewSuppressionParseException(ex); -99 } -100 } -101 } +55publicstaticfinal String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema"; +56/** +57 * JAXP Schema Source. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +58 */ +59publicstaticfinal String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource"; +60 +61/** +62 * Parses the given xml file and returns a list of the suppression rules contained. +63 * +64 * @param file an xml file containing suppression rules +65 * @return a list of suppression rules +66 * @throws SuppressionParseException thrown if the xml file cannot be parsed +67 */ +68public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException { +69try { +70final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd"); +71finalSuppressionHandler handler = newSuppressionHandler(); +72 +73final SAXParserFactory factory = SAXParserFactory.newInstance(); +74 factory.setNamespaceAware(true); +75 factory.setValidating(true); +76final SAXParser saxParser = factory.newSAXParser(); +77 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA); +78 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream)); +79final XMLReader xmlReader = saxParser.getXMLReader(); +80 xmlReader.setErrorHandler(newSuppressionErrorHandler()); +81 xmlReader.setContentHandler(handler); +82 +83final InputStream inputStream = new FileInputStream(file); +84final Reader reader = new InputStreamReader(inputStream, "UTF-8"); +85final InputSource in = new InputSource(reader); +86//in.setEncoding("UTF-8"); +87 +88 xmlReader.parse(in); +89 +90return handler.getSuppressionRules(); +91 } catch (ParserConfigurationException ex) { +92 LOGGER.log(Level.FINE, null, ex); +93thrownewSuppressionParseException(ex); +94 } catch (SAXException ex) { +95 LOGGER.log(Level.FINE, null, ex); +96thrownewSuppressionParseException(ex); +97 } catch (FileNotFoundException ex) { +98 LOGGER.log(Level.FINE, null, ex); +99thrownewSuppressionParseException(ex); +100 } catch (IOException ex) { +101 LOGGER.log(Level.FINE, null, ex); +102thrownewSuppressionParseException(ex); +103 } +104 } +105 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html index 14341b4ab..373b21de4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html @@ -262,109 +262,111 @@ 254finalIdentifier i = itr.next(); 255for (PropertyType c : this.cpe) { 256if (cpeMatches(c, i)) { -257 itr.remove(); -258break; -259 } -260 } -261 } -262 } -263if (hasCve() || hasCwe() || hasCvssBelow()) { -264final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator(); -265while (itr.hasNext()) { -266boolean remove = false; -267finalVulnerability v = itr.next(); -268for (String entry : this.cve) { -269if (entry.equalsIgnoreCase(v.getName())) { -270 remove = true; -271break; -272 } -273 } -274if (!remove) { -275for (String entry : this.cwe) { -276if (v.getCwe() != null) { -277final String toMatch = String.format("CWE-%s ", entry); -278final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase(); -279if (toTest.equals(toMatch)) { -280 remove = true; -281break; -282 } -283 } -284 } -285 } -286if (!remove) { -287for (float cvss : this.cvssBelow) { -288if (v.getCvssScore() < cvss) { -289 remove = true; -290break; -291 } -292 } -293 } -294if (remove) { -295 itr.remove(); -296 } -297 } -298 } -299 } -300 -301/** -302 * Identifies if the cpe specified by the cpe suppression rule does not specify a version. -303 * -304 * @param c a suppression rule identifier -305 * @return true if the property type does not specify a version; otherwise false -306 */ -307boolean cpeHasNoVersion(PropertyType c) { -308if (c.isRegex()) { -309return false; -310 } // cpe:/a:jboss:jboss:1.0.0: -311if (countCharacter(c.getValue(), ':') == 3) { -312returntrue; -313 } -314return false; -315 } -316 -317/** -318 * Counts the number of occurrences of the character found within the string. -319 * -320 * @param str the string to check -321 * @param c the character to count -322 * @return the number of times the character is found in the string -323 */ -324int countCharacter(String str, char c) { -325int count = 0; -326int pos = str.indexOf(c) + 1; -327while (pos > 0) { -328 count += 1; -329 pos = str.indexOf(c, pos) + 1; -330 } -331return count; -332 } -333 -334/** -335 * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. -336 * -337 * @param cpeEntry a suppression rule entry -338 * @param identifier a CPE identifier to check -339 * @return true if the entry matches; otherwise false -340 */ -341boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) { -342if (cpeEntry.matches(identifier.getValue())) { -343returntrue; -344 } elseif (cpeHasNoVersion(cpeEntry)) { -345if (cpeEntry.isCaseSensitive()) { -346if (identifier.getValue().startsWith(cpeEntry.getValue())) { -347returntrue; -348 } -349 } else { -350final String id = identifier.getValue().toLowerCase(); -351final String check = cpeEntry.getValue().toLowerCase(); -352if (id.startsWith(check)) { -353returntrue; -354 } -355 } -356 } -357return false; -358 } -359 } +257 dependency.addSuppressedIdentifier(i); +258 itr.remove(); +259break; +260 } +261 } +262 } +263 } +264if (hasCve() || hasCwe() || hasCvssBelow()) { +265final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator(); +266while (itr.hasNext()) { +267boolean remove = false; +268finalVulnerability v = itr.next(); +269for (String entry : this.cve) { +270if (entry.equalsIgnoreCase(v.getName())) { +271 remove = true; +272break; +273 } +274 } +275if (!remove) { +276for (String entry : this.cwe) { +277if (v.getCwe() != null) { +278final String toMatch = String.format("CWE-%s ", entry); +279final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase(); +280if (toTest.equals(toMatch)) { +281 remove = true; +282break; +283 } +284 } +285 } +286 } +287if (!remove) { +288for (float cvss : this.cvssBelow) { +289if (v.getCvssScore() < cvss) { +290 remove = true; +291break; +292 } +293 } +294 } +295if (remove) { +296 dependency.addSuppressedVulnerability(v); +297 itr.remove(); +298 } +299 } +300 } +301 } +302 +303/** +304 * Identifies if the cpe specified by the cpe suppression rule does not specify a version. +305 * +306 * @param c a suppression rule identifier +307 * @return true if the property type does not specify a version; otherwise false +308 */ +309boolean cpeHasNoVersion(PropertyType c) { +310if (c.isRegex()) { +311return false; +312 } // cpe:/a:jboss:jboss:1.0.0: +313if (countCharacter(c.getValue(), ':') == 3) { +314returntrue; +315 } +316return false; +317 } +318 +319/** +320 * Counts the number of occurrences of the character found within the string. +321 * +322 * @param str the string to check +323 * @param c the character to count +324 * @return the number of times the character is found in the string +325 */ +326int countCharacter(String str, char c) { +327int count = 0; +328int pos = str.indexOf(c) + 1; +329while (pos > 0) { +330 count += 1; +331 pos = str.indexOf(c, pos) + 1; +332 } +333return count; +334 } +335 +336/** +337 * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. +338 * +339 * @param cpeEntry a suppression rule entry +340 * @param identifier a CPE identifier to check +341 * @return true if the entry matches; otherwise false +342 */ +343boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) { +344if (cpeEntry.matches(identifier.getValue())) { +345returntrue; +346 } elseif (cpeHasNoVersion(cpeEntry)) { +347if (cpeEntry.isCaseSensitive()) { +348if (identifier.getValue().startsWith(cpeEntry.getValue())) { +349returntrue; +350 } +351 } else { +352final String id = identifier.getValue().toLowerCase(); +353final String check = cpeEntry.getValue().toLowerCase(); +354if (id.startsWith(check)) { +355returntrue; +356 } +357 } +358 } +359return false; +360 } +361 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html index 75c0cc187..82fd6fdb0 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html index bab3b485d..dd8b66666 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Checksum.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Checksum.html index bd576dd03..079a68484 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Checksum.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Checksum.html @@ -28,97 +28,101 @@ 20 *21 */22publicfinalclassChecksum { -23 +2324/** -25 * Private constructor for a utility class. +25 * The logger.26 */ -27privateChecksum() { -28 } -29 -30/** -31 * <p>Creates the cryptographic checksum of a given file using the specified -32 * algorithm.</p> <p>This algorithm was copied and heavily modified from -33 * Real's How To: http://www.rgagnon.com/javadetails/java-0416.html</p>; -34 * -35 * @param algorithm the algorithm to use to calculate the checksum -36 * @param file the file to calculate the checksum for -37 * @return the checksum -38 * @throws IOException when the file does not exist -39 * @throws NoSuchAlgorithmException when an algorithm is specified that does -40 * not exist -41 */ -42publicstatic byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException { -43 InputStream fis = null; -44 byte[] buffer = new byte[1024]; -45 MessageDigest complete = MessageDigest.getInstance(algorithm); -46int numRead; -47try { -48 fis = new FileInputStream(file); -49do { -50 numRead = fis.read(buffer); -51if (numRead > 0) { -52 complete.update(buffer, 0, numRead); -53 } -54 } while (numRead != -1); -55 } finally { -56if (fis != null) { -57try { -58 fis.close(); -59 } catch (IOException ex) { -60 Logger.getLogger(Checksum.class.getName()).log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex); -61 } -62 } -63 } -64return complete.digest(); -65 } -66 -67/** -68 * Calculates the MD5 checksum of a specified file. -69 * -70 * @param file the file to generate the MD5 checksum -71 * @return the hex representation of the MD5 hash -72 * @throws IOException when the file passed in does not exist -73 * @throws NoSuchAlgorithmException when the MD5 algorithm is not available -74 */ -75publicstatic String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException { -76 byte[] b = getChecksum("MD5", file); -77return getHex(b); -78 } -79 -80/** -81 * Calculates the SHA1 checksum of a specified file. -82 * -83 * @param file the file to generate the MD5 checksum -84 * @return the hex representation of the SHA1 hash -85 * @throws IOException when the file passed in does not exist -86 * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available -87 */ -88publicstatic String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException { -89 byte[] b = getChecksum("SHA1", file); -90return getHex(b); -91 } -92privatestaticfinal String HEXES = "0123456789ABCDEF"; -93 -94/** -95 * <p>Converts a byte array into a hex string.</p> -96 * -97 * <p>This method was copied from <a -98 * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p> -99 * -100 * @param raw a byte array -101 * @return the hex representation of the byte array -102 */ -103publicstatic String getHex(byte[] raw) { -104if (raw == null) { -105returnnull; -106 } -107final StringBuilder hex = new StringBuilder(2 * raw.length); -108for (final byte b : raw) { -109 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F))); +27privatestaticfinal Logger LOGGER = Logger.getLogger(Checksum.class.getName()); +28/** +29 * Private constructor for a utility class. +30 */ +31privateChecksum() { +32 } +33 +34/** +35 * <p>Creates the cryptographic checksum of a given file using the specified +36 * algorithm.</p> <p>This algorithm was copied and heavily modified from +37 * Real's How To: http://www.rgagnon.com/javadetails/java-0416.html</p>; +38 * +39 * @param algorithm the algorithm to use to calculate the checksum +40 * @param file the file to calculate the checksum for +41 * @return the checksum +42 * @throws IOException when the file does not exist +43 * @throws NoSuchAlgorithmException when an algorithm is specified that does +44 * not exist +45 */ +46publicstatic byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException { +47 InputStream fis = null; +48 byte[] buffer = new byte[1024]; +49 MessageDigest complete = MessageDigest.getInstance(algorithm); +50int numRead; +51try { +52 fis = new FileInputStream(file); +53do { +54 numRead = fis.read(buffer); +55if (numRead > 0) { +56 complete.update(buffer, 0, numRead); +57 } +58 } while (numRead != -1); +59 } finally { +60if (fis != null) { +61try { +62 fis.close(); +63 } catch (IOException ex) { +64 LOGGER.log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex); +65 } +66 } +67 } +68return complete.digest(); +69 } +70 +71/** +72 * Calculates the MD5 checksum of a specified file. +73 * +74 * @param file the file to generate the MD5 checksum +75 * @return the hex representation of the MD5 hash +76 * @throws IOException when the file passed in does not exist +77 * @throws NoSuchAlgorithmException when the MD5 algorithm is not available +78 */ +79publicstatic String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException { +80 byte[] b = getChecksum("MD5", file); +81return getHex(b); +82 } +83 +84/** +85 * Calculates the SHA1 checksum of a specified file. +86 * +87 * @param file the file to generate the MD5 checksum +88 * @return the hex representation of the SHA1 hash +89 * @throws IOException when the file passed in does not exist +90 * @throws NoSuchAlgorithmException when the SHA1 algorithm is not available +91 */ +92publicstatic String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException { +93 byte[] b = getChecksum("SHA1", file); +94return getHex(b); +95 } +96privatestaticfinal String HEXES = "0123456789ABCDEF"; +97 +98/** +99 * <p>Converts a byte array into a hex string.</p> +100 * +101 * <p>This method was copied from <a +102 * href="http://www.rgagnon.com/javadetails/java-0596.html">http://www.rgagnon.com/javadetails/java-0596.html</a></p> +103 * +104 * @param raw a byte array +105 * @return the hex representation of the byte array +106 */ +107publicstatic String getHex(byte[] raw) { +108if (raw == null) { +109returnnull; 110 } -111return hex.toString(); -112 } -113 } +111final StringBuilder hex = new StringBuilder(2 * raw.length); +112for (final byte b : raw) { +113 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F))); +114 } +115return hex.toString(); +116 } +117 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html index b7575ea98..fdaf8071d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html @@ -31,75 +31,77 @@ 23import java.sql.Statement; 24import java.util.logging.Level; 25import java.util.logging.Logger; -26import org.owasp.dependencycheck.data.nvdcve.CveDB; -27import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -28 -29/** -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33publicfinalclassDBUtils { -34 -35/** -36 * Private constructor for a utility class. -37 */ -38privateDBUtils() { -39 } -40 -41/** -42 * Returns the generated integer primary key for a newly inserted row. -43 * -44 * @param statement a prepared statement that just executed an insert -45 * @return a primary key -46 * @throws DatabaseException thrown if there is an exception obtaining the key -47 */ -48publicstaticint getGeneratedKey(PreparedStatement statement) throws DatabaseException { -49 ResultSet rs = null; -50int id = 0; -51try { -52 rs = statement.getGeneratedKeys(); -53 rs.next(); -54 id = rs.getInt(1); -55 } catch (SQLException ex) { -56thrownewDatabaseException("Unable to get primary key for inserted row"); -57 } finally { -58 closeResultSet(rs); -59 } -60return id; -61 } -62 -63/** -64 * Closes the given statement object ignoring any exceptions that occur. -65 * -66 * @param statement a Statement object -67 */ -68publicstaticvoid closeStatement(Statement statement) { -69if (statement != null) { -70try { -71 statement.close(); -72 } catch (SQLException ex) { -73 Logger.getLogger(CveDB.class -74 .getName()).log(Level.FINEST, statement.toString(), ex); -75 } -76 } -77 } -78 -79/** -80 * Closes the result set capturing and ignoring any SQLExceptions that occur. -81 * -82 * @param rs a ResultSet to close -83 */ -84publicstaticvoid closeResultSet(ResultSet rs) { -85if (rs != null) { -86try { -87 rs.close(); -88 } catch (SQLException ex) { -89 Logger.getLogger(CveDB.class -90 .getName()).log(Level.FINEST, rs.toString(), ex); -91 } -92 } -93 } -94 } +26import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +27 +28/** +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32publicfinalclassDBUtils { +33 +34/** +35 * The logger. +36 */ +37privatestaticfinal Logger LOGGER = Logger.getLogger(DBUtils.class.getName()); +38 +39/** +40 * Private constructor for a utility class. +41 */ +42privateDBUtils() { +43 } +44 +45/** +46 * Returns the generated integer primary key for a newly inserted row. +47 * +48 * @param statement a prepared statement that just executed an insert +49 * @return a primary key +50 * @throws DatabaseException thrown if there is an exception obtaining the key +51 */ +52publicstaticint getGeneratedKey(PreparedStatement statement) throws DatabaseException { +53 ResultSet rs = null; +54int id = 0; +55try { +56 rs = statement.getGeneratedKeys(); +57 rs.next(); +58 id = rs.getInt(1); +59 } catch (SQLException ex) { +60thrownewDatabaseException("Unable to get primary key for inserted row"); +61 } finally { +62 closeResultSet(rs); +63 } +64return id; +65 } +66 +67/** +68 * Closes the given statement object ignoring any exceptions that occur. +69 * +70 * @param statement a Statement object +71 */ +72publicstaticvoid closeStatement(Statement statement) { +73if (statement != null) { +74try { +75 statement.close(); +76 } catch (SQLException ex) { +77 LOGGER.log(Level.FINEST, statement.toString(), ex); +78 } +79 } +80 } +81 +82/** +83 * Closes the result set capturing and ignoring any SQLExceptions that occur. +84 * +85 * @param rs a ResultSet to close +86 */ +87publicstaticvoid closeResultSet(ResultSet rs) { +88if (rs != null) { +89try { +90 rs.close(); +91 } catch (SQLException ex) { +92 LOGGER.log(Level.FINEST, rs.toString(), ex); +93 } +94 } +95 } +96 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html index 04802b2bd..9ad1ade57 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html @@ -55,10 +55,10 @@ 4748/**49 * Constructor for a DependencyVersion that will parse a version string. -50 * <b>Note</b>, this should only be used when the version passed in is already known to be a well formated version +50 * <b>Note</b>, this should only be used when the version passed in is already known to be a well formatted version51 * number. Otherwise, DependencyVersionUtil.parseVersion() should be used instead.52 * -53 * @param version the well formated version number to parse +53 * @param version the well formatted version number to parse54 */55publicDependencyVersion(String version) { 56 parseVersion(version); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html index 7589a994d..620d7953f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html @@ -46,157 +46,162 @@ 38publicfinalclassDownloader { 3940/** -41 * Private constructor for utility class. +41 * The logger.42 */ -43privateDownloader() { -44 } -45 -46/** -47 * Retrieves a file from a given URL and saves it to the outputPath. -48 * -49 * @param url the URL of the file to download -50 * @param outputPath the path to the save the file to -51 * @throws DownloadFailedException is thrown if there is an error downloading the file -52 */ -53publicstaticvoid fetchFile(URL url, File outputPath) throws DownloadFailedException { -54 fetchFile(url, outputPath, true); -55 } -56 -57/** -58 * Retrieves a file from a given URL and saves it to the outputPath. -59 * -60 * @param url the URL of the file to download -61 * @param outputPath the path to the save the file to -62 * @param useProxy whether to use the configured proxy when downloading files -63 * @throws DownloadFailedException is thrown if there is an error downloading the file -64 */ -65publicstaticvoid fetchFile(URL url, File outputPath, boolean useProxy) throws DownloadFailedException { -66if ("file".equalsIgnoreCase(url.getProtocol())) { -67 File file; -68try { -69 file = new File(url.toURI()); -70 } catch (URISyntaxException ex) { -71final String msg = String.format("Download failed, unable to locate '%s'", url.toString()); -72thrownewDownloadFailedException(msg); -73 } -74if (file.exists()) { -75try { -76 org.apache.commons.io.FileUtils.copyFile(file, outputPath); -77 } catch (IOException ex) { -78final String msg = String.format("Download failed, unable to copy '%s'", url.toString()); -79thrownewDownloadFailedException(msg); -80 } -81 } else { -82final String msg = String.format("Download failed, file does not exist '%s'", url.toString()); -83thrownewDownloadFailedException(msg); -84 } -85 } else { -86 HttpURLConnection conn = null; -87try { -88 conn = URLConnectionFactory.createHttpURLConnection(url, useProxy); -89 conn.setRequestProperty("Accept-Encoding", "gzip, deflate"); -90 conn.connect(); -91 } catch (IOException ex) { -92try { -93if (conn != null) { -94 conn.disconnect(); -95 } -96 } finally { -97 conn = null; -98 } -99thrownewDownloadFailedException("Error downloading file.", ex); -100 } -101final String encoding = conn.getContentEncoding(); -102 -103 BufferedOutputStream writer = null; -104 InputStream reader = null; -105try { -106if (encoding != null && "gzip".equalsIgnoreCase(encoding)) { -107 reader = new GZIPInputStream(conn.getInputStream()); -108 } elseif (encoding != null && "deflate".equalsIgnoreCase(encoding)) { -109 reader = new InflaterInputStream(conn.getInputStream()); -110 } else { -111 reader = conn.getInputStream(); -112 } -113 -114 writer = new BufferedOutputStream(new FileOutputStream(outputPath)); -115final byte[] buffer = new byte[4096]; -116int bytesRead; -117while ((bytesRead = reader.read(buffer)) > 0) { -118 writer.write(buffer, 0, bytesRead); -119 } -120 } catch (Throwable ex) { -121thrownewDownloadFailedException("Error saving downloaded file.", ex); -122 } finally { -123if (writer != null) { -124try { -125 writer.close(); -126 } catch (Throwable ex) { -127 Logger.getLogger(Downloader.class.getName()).log(Level.FINEST, -128"Error closing the writer in Downloader.", ex); -129 } -130 } -131if (reader != null) { -132try { -133 reader.close(); -134 } catch (Throwable ex) { -135 Logger.getLogger(Downloader.class.getName()).log(Level.FINEST, -136"Error closing the reader in Downloader.", ex); -137 } -138 } -139try { -140 conn.disconnect(); -141 } finally { -142 conn = null; +43privatestaticfinal Logger LOGGER = Logger.getLogger(Downloader.class.getName()); +44 +45/** +46 * Private constructor for utility class. +47 */ +48privateDownloader() { +49 } +50 +51/** +52 * Retrieves a file from a given URL and saves it to the outputPath. +53 * +54 * @param url the URL of the file to download +55 * @param outputPath the path to the save the file to +56 * @throws DownloadFailedException is thrown if there is an error downloading the file +57 */ +58publicstaticvoid fetchFile(URL url, File outputPath) throws DownloadFailedException { +59 fetchFile(url, outputPath, true); +60 } +61 +62/** +63 * Retrieves a file from a given URL and saves it to the outputPath. +64 * +65 * @param url the URL of the file to download +66 * @param outputPath the path to the save the file to +67 * @param useProxy whether to use the configured proxy when downloading files +68 * @throws DownloadFailedException is thrown if there is an error downloading the file +69 */ +70publicstaticvoid fetchFile(URL url, File outputPath, boolean useProxy) throws DownloadFailedException { +71if ("file".equalsIgnoreCase(url.getProtocol())) { +72 File file; +73try { +74 file = new File(url.toURI()); +75 } catch (URISyntaxException ex) { +76final String msg = String.format("Download failed, unable to locate '%s'", url.toString()); +77thrownewDownloadFailedException(msg); +78 } +79if (file.exists()) { +80try { +81 org.apache.commons.io.FileUtils.copyFile(file, outputPath); +82 } catch (IOException ex) { +83final String msg = String.format("Download failed, unable to copy '%s'", url.toString()); +84thrownewDownloadFailedException(msg); +85 } +86 } else { +87final String msg = String.format("Download failed, file does not exist '%s'", url.toString()); +88thrownewDownloadFailedException(msg); +89 } +90 } else { +91 HttpURLConnection conn = null; +92try { +93 conn = URLConnectionFactory.createHttpURLConnection(url, useProxy); +94 conn.setRequestProperty("Accept-Encoding", "gzip, deflate"); +95 conn.connect(); +96 } catch (IOException ex) { +97try { +98if (conn != null) { +99 conn.disconnect(); +100 } +101 } finally { +102 conn = null; +103 } +104thrownewDownloadFailedException("Error downloading file.", ex); +105 } +106final String encoding = conn.getContentEncoding(); +107 +108 BufferedOutputStream writer = null; +109 InputStream reader = null; +110try { +111if (encoding != null && "gzip".equalsIgnoreCase(encoding)) { +112 reader = new GZIPInputStream(conn.getInputStream()); +113 } elseif (encoding != null && "deflate".equalsIgnoreCase(encoding)) { +114 reader = new InflaterInputStream(conn.getInputStream()); +115 } else { +116 reader = conn.getInputStream(); +117 } +118 +119 writer = new BufferedOutputStream(new FileOutputStream(outputPath)); +120final byte[] buffer = new byte[4096]; +121int bytesRead; +122while ((bytesRead = reader.read(buffer)) > 0) { +123 writer.write(buffer, 0, bytesRead); +124 } +125 } catch (Throwable ex) { +126thrownewDownloadFailedException("Error saving downloaded file.", ex); +127 } finally { +128if (writer != null) { +129try { +130 writer.close(); +131 } catch (Throwable ex) { +132 LOGGER.log(Level.FINEST, +133"Error closing the writer in Downloader.", ex); +134 } +135 } +136if (reader != null) { +137try { +138 reader.close(); +139 } catch (Throwable ex) { +140 LOGGER.log(Level.FINEST, +141"Error closing the reader in Downloader.", ex); +142 } 143 } -144 } -145 } -146 } -147 -148/** -149 * Makes an HTTP Head request to retrieve the last modified date of the given URL. If the file:// protocol is -150 * specified, then the lastTimestamp of the file is returned. -151 * -152 * @param url the URL to retrieve the timestamp from -153 * @return an epoch timestamp -154 * @throws DownloadFailedException is thrown if an exception occurs making the HTTP request -155 */ -156publicstaticlong getLastModified(URL url) throws DownloadFailedException { -157long timestamp = 0; -158//TODO add the FTP protocol? -159if ("file".equalsIgnoreCase(url.getProtocol())) { -160 File lastModifiedFile; -161try { -162 lastModifiedFile = new File(url.toURI()); -163 } catch (URISyntaxException ex) { -164final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?", url.toString()); -165thrownewDownloadFailedException(msg); -166 } -167 timestamp = lastModifiedFile.lastModified(); -168 } else { -169 HttpURLConnection conn = null; -170try { -171 conn = URLConnectionFactory.createHttpURLConnection(url); -172 conn.setRequestMethod("HEAD"); -173 conn.connect(); -174 timestamp = conn.getLastModified(); -175 } catch (URLConnectionFailureException ex) { -176thrownewDownloadFailedException("Error creating URL Connection for HTTP HEAD request.", ex); -177 } catch (IOException ex) { -178thrownewDownloadFailedException("Error making HTTP HEAD request.", ex); -179 } finally { -180if (conn != null) { -181try { -182 conn.disconnect(); -183 } finally { -184 conn = null; -185 } -186 } -187 } -188 } -189return timestamp; -190 } -191 } +144try { +145 conn.disconnect(); +146 } finally { +147 conn = null; +148 } +149 } +150 } +151 } +152 +153/** +154 * Makes an HTTP Head request to retrieve the last modified date of the given URL. If the file:// protocol is +155 * specified, then the lastTimestamp of the file is returned. +156 * +157 * @param url the URL to retrieve the timestamp from +158 * @return an epoch timestamp +159 * @throws DownloadFailedException is thrown if an exception occurs making the HTTP request +160 */ +161publicstaticlong getLastModified(URL url) throws DownloadFailedException { +162long timestamp = 0; +163//TODO add the FTP protocol? +164if ("file".equalsIgnoreCase(url.getProtocol())) { +165 File lastModifiedFile; +166try { +167 lastModifiedFile = new File(url.toURI()); +168 } catch (URISyntaxException ex) { +169final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?", url.toString()); +170thrownewDownloadFailedException(msg); +171 } +172 timestamp = lastModifiedFile.lastModified(); +173 } else { +174 HttpURLConnection conn = null; +175try { +176 conn = URLConnectionFactory.createHttpURLConnection(url); +177 conn.setRequestMethod("HEAD"); +178 conn.connect(); +179 timestamp = conn.getLastModified(); +180 } catch (URLConnectionFailureException ex) { +181thrownewDownloadFailedException("Error creating URL Connection for HTTP HEAD request.", ex); +182 } catch (IOException ex) { +183thrownewDownloadFailedException("Error making HTTP HEAD request.", ex); +184 } finally { +185if (conn != null) { +186try { +187 conn.disconnect(); +188 } finally { +189 conn = null; +190 } +191 } +192 } +193 } +194return timestamp; +195 } +196 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html index ea1cb8813..e66895fa9 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html @@ -49,227 +49,226 @@ 41publicfinalclassFileUtils { 4243/** -44 * Bit bucket for non-Windows systems +44 * The logger.45 */ -46privatestaticfinal String BIT_BUCKET_UNIX = "/dev/null"; -47 -48/** -49 * Bit bucket for Windows systems (yes, only one 'L') -50 */ -51privatestaticfinal String BIT_BUCKET_WIN = "NUL"; -52 -53/** -54 * The buffer size to use when extracting files from the archive. -55 */ -56privatestaticfinalint BUFFER_SIZE = 4096; -57 -58/** -59 * Private constructor for a utility class. -60 */ -61privateFileUtils() { -62 } -63 -64/** -65 * Returns the (lowercase) file extension for a specified file. -66 * -67 * @param fileName the file name to retrieve the file extension from. -68 * @return the file extension. -69 */ -70publicstatic String getFileExtension(String fileName) { -71 String ret = null; -72finalint pos = fileName.lastIndexOf("."); -73if (pos >= 0) { -74 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase(); -75 } -76return ret; -77 } -78 -79/** -80 * Deletes a file. If the File is a directory it will recursively delete the contents. -81 * -82 * @param file the File to delete -83 * @return true if the file was deleted successfully, otherwise false -84 */ -85publicstaticboolean delete(File file) { -86boolean success = true; -87if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) { -88 success = false; -89final String msg = String.format("Failed to delete file: %s; attempting to delete on exit.", file.getPath()); -90 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, msg); -91 file.deleteOnExit(); -92 } -93return success; -94 } -95 -96/** -97 * Generates a new temporary file name that is guaranteed to be unique. -98 * -99 * @param prefix the prefix for the file name to generate -100 * @param extension the extension of the generated file name -101 * @return a temporary File -102 * @throws java.io.IOException thrown if the temporary folder could not be created -103 */ -104publicstatic File getTempFile(String prefix, String extension) throws IOException { -105final File dir = Settings.getTempDirectory(); -106if (!dir.exists()) { -107if (!dir.mkdirs()) { -108thrownew IOException("Unable to create temporary folder"); -109 } -110 } -111final String tempFileName = String.format("%s%s.%s", prefix, UUID.randomUUID().toString(), extension); -112final File tempFile = new File(dir, tempFileName); -113if (tempFile.exists()) { -114return getTempFile(prefix, extension); -115 } -116return tempFile; -117 } -118 -119/** -120 * Returns the data directory. If a path was specified in dependencycheck.properties or was specified using the -121 * Settings object, and the path exists, that path will be returned as a File object. If it does not exist, then a -122 * File object will be created based on the file location of the JAR containing the specified class. -123 * -124 * @param configuredFilePath the configured relative or absolute path -125 * @param clazz the class to resolve the path -126 * @return a File object -127 * @throws IOException is thrown if the path could not be decoded -128 * @deprecated This method should no longer be used. See the implementation in dependency-check-cli/App.java to see -129 * how the data directory should be set. -130 */ -131 @java.lang.Deprecated -132publicstatic File getDataDirectory(String configuredFilePath, Class clazz) throws IOException { -133final File file = new File(configuredFilePath); -134if (file.isDirectory() && file.canWrite()) { -135returnnew File(file.getCanonicalPath()); -136 } else { -137final File exePath = getPathToJar(clazz); -138returnnew File(exePath, configuredFilePath); -139 } -140 } -141 -142/** -143 * Retrieves the physical path to the parent directory containing the provided class. For example, if a JAR file -144 * contained a class org.something.clazz this method would return the parent directory of the JAR file. -145 * -146 * @param clazz the class to determine the parent directory of -147 * @return the parent directory of the file containing the specified class. -148 * @throws UnsupportedEncodingException thrown if UTF-8 is not supported. -149 * @deprecated this should no longer be used. -150 */ -151 @java.lang.Deprecated -152publicstatic File getPathToJar(Class clazz) throws UnsupportedEncodingException { -153final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath(); -154final String decodedPath = URLDecoder.decode(filePath, "UTF-8"); -155final File jarPath = new File(decodedPath); -156return jarPath.getParentFile(); -157 } -158 -159/** -160 * Extracts the contents of an archive into the specified directory. -161 * -162 * @param archive an archive file such as a WAR or EAR -163 * @param extractTo a directory to extract the contents to -164 * @throws ExtractionException thrown if an exception occurs while extracting the files -165 */ -166publicstaticvoid extractFiles(File archive, File extractTo) throws ExtractionException { -167 extractFiles(archive, extractTo, null); -168 } -169 -170/** -171 * Extracts the contents of an archive into the specified directory. The files are only extracted if they are -172 * supported by the analyzers loaded into the specified engine. If the engine is specified as null then all files -173 * are extracted. -174 * -175 * @param archive an archive file such as a WAR or EAR -176 * @param extractTo a directory to extract the contents to -177 * @param engine the scanning engine -178 * @throws ExtractionException thrown if there is an error extracting the files -179 */ -180publicstaticvoid extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException { -181if (archive == null || extractTo == null) { -182return; -183 } -184 -185 FileInputStream fis = null; -186 ZipInputStream zis = null; -187 -188try { -189 fis = new FileInputStream(archive); -190 } catch (FileNotFoundException ex) { -191 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); -192thrownewExtractionException("Archive file was not found.", ex); -193 } -194 zis = new ZipInputStream(new BufferedInputStream(fis)); -195 ZipEntry entry; -196try { -197while ((entry = zis.getNextEntry()) != null) { -198if (entry.isDirectory()) { -199final File d = new File(extractTo, entry.getName()); -200if (!d.exists() && !d.mkdirs()) { -201final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath()); -202thrownewExtractionException(msg); -203 } -204 } else { -205final File file = new File(extractTo, entry.getName()); -206final String ext = getFileExtension(file.getName()); -207if (engine == null || engine.supportsExtension(ext)) { -208 BufferedOutputStream bos = null; -209 FileOutputStream fos; -210try { -211 fos = new FileOutputStream(file); -212 bos = new BufferedOutputStream(fos, BUFFER_SIZE); -213int count; -214final byte data[] = new byte[BUFFER_SIZE]; -215while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) { -216 bos.write(data, 0, count); -217 } -218 bos.flush(); -219 } catch (FileNotFoundException ex) { -220 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); -221final String msg = String.format("Unable to find file '%s'.", file.getName()); -222thrownewExtractionException(msg, ex); -223 } catch (IOException ex) { -224 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); -225final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); -226thrownewExtractionException(msg, ex); -227 } finally { -228if (bos != null) { -229try { -230 bos.close(); -231 } catch (IOException ex) { -232 Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex); -233 } -234 } -235 } -236 } -237 } -238 } -239 } catch (IOException ex) { -240final String msg = String.format("Exception reading archive '%s'.", archive.getName()); -241 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, msg, ex); -242thrownewExtractionException(msg, ex); -243 } finally { -244try { -245 zis.close(); -246 } catch (IOException ex) { -247 Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex); -248 } -249 } -250 } -251 -252/** -253 * Return the bit bucket for the OS. '/dev/null' for Unix and 'NUL' for Windows -254 * -255 * @return a String containing the bit bucket -256 */ -257publicstatic String getBitBucket() { -258if (System.getProperty("os.name").startsWith("Windows")) { -259return BIT_BUCKET_WIN; -260 } else { -261return BIT_BUCKET_UNIX; -262 } -263 } -264 } +46privatestaticfinal Logger LOGGER = Logger.getLogger(FileUtils.class.getName()); +47/** +48 * Bit bucket for non-Windows systems +49 */ +50privatestaticfinal String BIT_BUCKET_UNIX = "/dev/null"; +51 +52/** +53 * Bit bucket for Windows systems (yes, only one 'L') +54 */ +55privatestaticfinal String BIT_BUCKET_WIN = "NUL"; +56 +57/** +58 * The buffer size to use when extracting files from the archive. +59 */ +60privatestaticfinalint BUFFER_SIZE = 4096; +61 +62/** +63 * Private constructor for a utility class. +64 */ +65privateFileUtils() { +66 } +67 +68/** +69 * Returns the (lowercase) file extension for a specified file. +70 * +71 * @param fileName the file name to retrieve the file extension from. +72 * @return the file extension. +73 */ +74publicstatic String getFileExtension(String fileName) { +75 String ret = null; +76finalint pos = fileName.lastIndexOf("."); +77if (pos >= 0) { +78 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase(); +79 } +80return ret; +81 } +82 +83/** +84 * Deletes a file. If the File is a directory it will recursively delete the contents. +85 * +86 * @param file the File to delete +87 * @return true if the file was deleted successfully, otherwise false +88 */ +89publicstaticboolean delete(File file) { +90boolean success = true; +91if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) { +92 success = false; +93final String msg = String.format("Failed to delete file: %s; attempting to delete on exit.", file.getPath()); +94 LOGGER.log(Level.FINE, msg); +95 file.deleteOnExit(); +96 } +97return success; +98 } +99 +100/** +101 * Generates a new temporary file name that is guaranteed to be unique. +102 * +103 * @param prefix the prefix for the file name to generate +104 * @param extension the extension of the generated file name +105 * @return a temporary File +106 * @throws java.io.IOException thrown if the temporary folder could not be created +107 */ +108publicstatic File getTempFile(String prefix, String extension) throws IOException { +109final File dir = Settings.getTempDirectory(); +110final String tempFileName = String.format("%s%s.%s", prefix, UUID.randomUUID().toString(), extension); +111final File tempFile = new File(dir, tempFileName); +112if (tempFile.exists()) { +113return getTempFile(prefix, extension); +114 } +115return tempFile; +116 } +117 +118/** +119 * Returns the data directory. If a path was specified in dependencycheck.properties or was specified using the +120 * Settings object, and the path exists, that path will be returned as a File object. If it does not exist, then a +121 * File object will be created based on the file location of the JAR containing the specified class. +122 * +123 * @param configuredFilePath the configured relative or absolute path +124 * @param clazz the class to resolve the path +125 * @return a File object +126 * @throws IOException is thrown if the path could not be decoded +127 * @deprecated This method should no longer be used. See the implementation in dependency-check-cli/App.java to see +128 * how the data directory should be set. +129 */ +130 @java.lang.Deprecated +131publicstatic File getDataDirectory(String configuredFilePath, Class clazz) throws IOException { +132final File file = new File(configuredFilePath); +133if (file.isDirectory() && file.canWrite()) { +134returnnew File(file.getCanonicalPath()); +135 } else { +136final File exePath = getPathToJar(clazz); +137returnnew File(exePath, configuredFilePath); +138 } +139 } +140 +141/** +142 * Retrieves the physical path to the parent directory containing the provided class. For example, if a JAR file +143 * contained a class org.something.clazz this method would return the parent directory of the JAR file. +144 * +145 * @param clazz the class to determine the parent directory of +146 * @return the parent directory of the file containing the specified class. +147 * @throws UnsupportedEncodingException thrown if UTF-8 is not supported. +148 * @deprecated this should no longer be used. +149 */ +150 @java.lang.Deprecated +151publicstatic File getPathToJar(Class clazz) throws UnsupportedEncodingException { +152final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath(); +153final String decodedPath = URLDecoder.decode(filePath, "UTF-8"); +154final File jarPath = new File(decodedPath); +155return jarPath.getParentFile(); +156 } +157 +158/** +159 * Extracts the contents of an archive into the specified directory. +160 * +161 * @param archive an archive file such as a WAR or EAR +162 * @param extractTo a directory to extract the contents to +163 * @throws ExtractionException thrown if an exception occurs while extracting the files +164 */ +165publicstaticvoid extractFiles(File archive, File extractTo) throws ExtractionException { +166 extractFiles(archive, extractTo, null); +167 } +168 +169/** +170 * Extracts the contents of an archive into the specified directory. The files are only extracted if they are +171 * supported by the analyzers loaded into the specified engine. If the engine is specified as null then all files +172 * are extracted. +173 * +174 * @param archive an archive file such as a WAR or EAR +175 * @param extractTo a directory to extract the contents to +176 * @param engine the scanning engine +177 * @throws ExtractionException thrown if there is an error extracting the files +178 */ +179publicstaticvoid extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException { +180if (archive == null || extractTo == null) { +181return; +182 } +183 +184 FileInputStream fis = null; +185 ZipInputStream zis = null; +186 +187try { +188 fis = new FileInputStream(archive); +189 } catch (FileNotFoundException ex) { +190 LOGGER.log(Level.FINE, null, ex); +191thrownewExtractionException("Archive file was not found.", ex); +192 } +193 zis = new ZipInputStream(new BufferedInputStream(fis)); +194 ZipEntry entry; +195try { +196while ((entry = zis.getNextEntry()) != null) { +197if (entry.isDirectory()) { +198final File d = new File(extractTo, entry.getName()); +199if (!d.exists() && !d.mkdirs()) { +200final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath()); +201thrownewExtractionException(msg); +202 } +203 } else { +204final File file = new File(extractTo, entry.getName()); +205final String ext = getFileExtension(file.getName()); +206if (engine == null || engine.supportsExtension(ext)) { +207 BufferedOutputStream bos = null; +208 FileOutputStream fos; +209try { +210 fos = new FileOutputStream(file); +211 bos = new BufferedOutputStream(fos, BUFFER_SIZE); +212int count; +213final byte data[] = new byte[BUFFER_SIZE]; +214while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) { +215 bos.write(data, 0, count); +216 } +217 bos.flush(); +218 } catch (FileNotFoundException ex) { +219 LOGGER.log(Level.FINE, null, ex); +220final String msg = String.format("Unable to find file '%s'.", file.getName()); +221thrownewExtractionException(msg, ex); +222 } catch (IOException ex) { +223 LOGGER.log(Level.FINE, null, ex); +224final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); +225thrownewExtractionException(msg, ex); +226 } finally { +227if (bos != null) { +228try { +229 bos.close(); +230 } catch (IOException ex) { +231 LOGGER.log(Level.FINEST, null, ex); +232 } +233 } +234 } +235 } +236 } +237 } +238 } catch (IOException ex) { +239final String msg = String.format("Exception reading archive '%s'.", archive.getName()); +240 LOGGER.log(Level.FINE, msg, ex); +241thrownewExtractionException(msg, ex); +242 } finally { +243try { +244 zis.close(); +245 } catch (IOException ex) { +246 LOGGER.log(Level.FINEST, null, ex); +247 } +248 } +249 } +250 +251/** +252 * Return the bit bucket for the OS. '/dev/null' for Unix and 'NUL' for Windows +253 * +254 * @return a String containing the bit bucket +255 */ +256publicstatic String getBitBucket() { +257if (System.getProperty("os.name").startsWith("Windows")) { +258return BIT_BUCKET_WIN; +259 } else { +260return BIT_BUCKET_UNIX; +261 } +262 } +263 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html index bc0b60c0e..6cf8760b3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html @@ -41,59 +41,64 @@ 33publicfinalclassLogUtils { 3435/** -36 * Private constructor for a utility class. +36 * The logger.37 */ -38privateLogUtils() { -39 } -40 -41/** -42 * Configures the logger for use by the application. -43 * -44 * @param in the input stream to read the log settings from -45 * @param verboseLogFile the file path for the verbose log -46 */ -47publicstaticvoid prepareLogger(InputStream in, String verboseLogFile) { -48try { -49 LogManager.getLogManager().reset(); -50 LogManager.getLogManager().readConfiguration(in); -51if (verboseLogFile != null && !verboseLogFile.isEmpty()) { -52 verboseLoggingEnabled = true; -53final Logger logger = Logger.getLogger(""); -54final FileHandler handler = new FileHandler(verboseLogFile, true); -55 handler.setFormatter(new SimpleFormatter()); -56 handler.setLevel(Level.FINE); -57 handler.setFilter(newLogFilter()); -58 logger.addHandler(handler); -59 logger.setLevel(Level.FINE); -60 } -61 } catch (IOException ex) { -62 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "IO Error preparing the logger", ex); -63 } catch (SecurityException ex) { -64 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "Error preparing the logger", ex); -65 } finally { -66if (in != null) { -67try { -68 in.close(); -69 } catch (Throwable ex) { -70 Logger.getLogger(LogUtils.class.getName()).log(Level.FINEST, "Error closing resource stream", ex); -71 } -72 } -73 } -74 } -75/** -76 * Whether or not verbose logging is enabled. -77 */ -78privatestaticboolean verboseLoggingEnabled = false; -79 +38privatestaticfinal Logger LOGGER = Logger.getLogger(LogUtils.class.getName()); +39 +40/** +41 * Private constructor for a utility class. +42 */ +43privateLogUtils() { +44 } +45 +46/** +47 * Configures the logger for use by the application. +48 * +49 * @param in the input stream to read the log settings from +50 * @param verboseLogFile the file path for the verbose log +51 */ +52publicstaticvoid prepareLogger(InputStream in, String verboseLogFile) { +53try { +54 LogManager.getLogManager().reset(); +55 LogManager.getLogManager().readConfiguration(in); +56if (verboseLogFile != null && !verboseLogFile.isEmpty()) { +57 verboseLoggingEnabled = true; +58final Logger logger = Logger.getLogger(""); +59final FileHandler handler = new FileHandler(verboseLogFile, true); +60 handler.setFormatter(new SimpleFormatter()); +61 handler.setLevel(Level.FINE); +62 handler.setFilter(newLogFilter()); +63 logger.addHandler(handler); +64 logger.setLevel(Level.FINE); +65 } +66 } catch (IOException ex) { +67 LOGGER.log(Level.FINE, "IO Error preparing the logger", ex); +68 } catch (SecurityException ex) { +69 LOGGER.log(Level.FINE, "Error preparing the logger", ex); +70 } finally { +71if (in != null) { +72try { +73 in.close(); +74 } catch (Throwable ex) { +75 LOGGER.log(Level.FINEST, "Error closing resource stream", ex); +76 } +77 } +78 } +79 } 80/** -81 * Get the value of verboseLoggingEnabled. -82 * -83 * @return the value of verboseLoggingEnabled -84 */ -85publicstaticboolean isVerboseLoggingEnabled() { -86return verboseLoggingEnabled; -87 } -88 } +81 * Whether or not verbose logging is enabled. +82 */ +83privatestaticboolean verboseLoggingEnabled = false; +84 +85/** +86 * Get the value of verboseLoggingEnabled. +87 * +88 * @return the value of verboseLoggingEnabled +89 */ +90publicstaticboolean isVerboseLoggingEnabled() { +91return verboseLoggingEnabled; +92 } +93 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html index 7cd51248a..4b399bcb2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html @@ -46,524 +46,581 @@ 38 */39publicfinalclassSettings { 40 -41/** -42 * The logger. -43 */ -44privatestaticfinal Logger LOGGER = Logger.getLogger(Settings.class.getName()); -45 -46/** -47 * The collection of keys used within the properties file. -48 */ -49publicstaticfinalclassKEYS { -50 -51/** -52 * private constructor because this is a "utility" class containing constants -53 */ -54privateKEYS() { -55//do nothing -56 } +41//<editor-fold defaultstate="collapsed" desc="KEYS used to access settings"> +42/** +43 * The collection of keys used within the properties file. +44 */ +45publicstaticfinalclassKEYS { +46 +47/** +48 * private constructor because this is a "utility" class containing constants +49 */ +50privateKEYS() { +51//do nothing +52 } +53/** +54 * The properties key indicating whether or not the cached data sources should be updated. +55 */ +56publicstaticfinal String AUTO_UPDATE = "autoupdate"; 57/** -58 * The properties key indicating whether or not the cached data sources should be updated. +58 * The database driver class name. If this is not in the properties file the embedded database is used.59 */ -60publicstaticfinal String AUTO_UPDATE = "autoupdate"; +60publicstaticfinal String DB_DRIVER_NAME = "data.driver_name"; 61/**62 * The database driver class name. If this is not in the properties file the embedded database is used.63 */ -64publicstaticfinal String DB_DRIVER_NAME = "data.driver_name"; +64publicstaticfinal String DB_DRIVER_PATH = "data.driver_path"; 65/** -66 * The database driver class name. If this is not in the properties file the embedded database is used. +66 * The database connection string. If this is not in the properties file the embedded database is used.67 */ -68publicstaticfinal String DB_DRIVER_PATH = "data.driver_path"; +68publicstaticfinal String DB_CONNECTION_STRING = "data.connection_string"; 69/** -70 * The database connection string. If this is not in the properties file the embedded database is used. +70 * The username to use when connecting to the database.71 */ -72publicstaticfinal String DB_CONNECTION_STRING = "data.connection_string"; +72publicstaticfinal String DB_USER = "data.user"; 73/** -74 * The username to use when connecting to the database. +74 * The password to authenticate to the database.75 */ -76publicstaticfinal String DB_USER = "data.user"; +76publicstaticfinal String DB_PASSWORD = "data.password"; 77/** -78 * The password to authenticate to the database. +78 * The base path to use for the data directory (for embedded db).79 */ -80publicstaticfinal String DB_PASSWORD = "data.password"; +80publicstaticfinal String DATA_DIRECTORY = "data.directory"; 81/** -82 * The base path to use for the data directory (for embedded db). +82 * The properties key for the URL to retrieve the "meta" data from about the CVE entries.83 */ -84publicstaticfinal String DATA_DIRECTORY = "data.directory"; +84publicstaticfinal String CVE_META_URL = "cve.url.meta"; 85/** -86 * The properties key for the URL to retrieve the "meta" data from about the CVE entries. -87 */ -88publicstaticfinal String CVE_META_URL = "cve.url.meta"; -89/** -90 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using -91 * the 2.0 schema. -92 */ -93publicstaticfinal String CVE_MODIFIED_20_URL = "cve.url-2.0.modified"; -94/** -95 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using -96 * the 1.2 schema. +86 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using +87 * the 2.0 schema. +88 */ +89publicstaticfinal String CVE_MODIFIED_20_URL = "cve.url-2.0.modified"; +90/** +91 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using +92 * the 1.2 schema. +93 */ +94publicstaticfinal String CVE_MODIFIED_12_URL = "cve.url-1.2.modified"; +95/** +96 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days).97 */ -98publicstaticfinal String CVE_MODIFIED_12_URL = "cve.url-1.2.modified"; +98publicstaticfinal String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays"; 99/** -100 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days). -101 */ -102publicstaticfinal String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays"; -103/** -104 * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with -105 * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing. +100 * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with +101 * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing. +102 */ +103publicstaticfinal String CVE_START_YEAR = "cve.startyear"; +104/** +105 * The properties key for the CVE schema version 1.2.106 */ -107publicstaticfinal String CVE_START_YEAR = "cve.startyear"; +107publicstaticfinal String CVE_SCHEMA_1_2 = "cve.url-1.2.base"; 108/** -109 * The properties key for the CVE schema version 1.2. +109 * The properties key for the CVE schema version 2.0.110 */ -111publicstaticfinal String CVE_SCHEMA_1_2 = "cve.url-1.2.base"; +111publicstaticfinal String CVE_SCHEMA_2_0 = "cve.url-2.0.base"; 112/** -113 * The properties key for the CVE schema version 2.0. +113 * The properties key for the proxy url.114 */ -115publicstaticfinal String CVE_SCHEMA_2_0 = "cve.url-2.0.base"; +115publicstaticfinal String PROXY_URL = "proxy.url"; 116/** -117 * The properties key for the proxy url. +117 * The properties key for the proxy port - this must be an integer value.118 */ -119publicstaticfinal String PROXY_URL = "proxy.url"; +119publicstaticfinal String PROXY_PORT = "proxy.port"; 120/** -121 * The properties key for the proxy port - this must be an integer value. +121 * The properties key for the proxy username.122 */ -123publicstaticfinal String PROXY_PORT = "proxy.port"; +123publicstaticfinal String PROXY_USERNAME = "proxy.username"; 124/** -125 * The properties key for the proxy username. +125 * The properties key for the proxy password.126 */ -127publicstaticfinal String PROXY_USERNAME = "proxy.username"; +127publicstaticfinal String PROXY_PASSWORD = "proxy.password"; 128/** -129 * The properties key for the proxy password. +129 * The properties key for the connection timeout.130 */ -131publicstaticfinal String PROXY_PASSWORD = "proxy.password"; +131publicstaticfinal String CONNECTION_TIMEOUT = "connection.timeout"; 132/** -133 * The properties key for the connection timeout. +133 * The location of the temporary directory.134 */ -135publicstaticfinal String CONNECTION_TIMEOUT = "connection.timeout"; +135publicstaticfinal String TEMP_DIRECTORY = "temp.directory"; 136/** -137 * The location of the temporary directory. +137 * The maximum number of threads to allocate when downloading files.138 */ -139publicstaticfinal String TEMP_DIRECTORY = "temp.directory"; +139publicstaticfinal String MAX_DOWNLOAD_THREAD_POOL_SIZE = "max.download.threads"; 140/** -141 * The maximum number of threads to allocate when downloading files. +141 * The key for a list of suppression files.142 */ -143publicstaticfinal String MAX_DOWNLOAD_THREAD_POOL_SIZE = "max.download.threads"; +143publicstaticfinal String SUPPRESSION_FILE = "suppression.file"; 144/** -145 * The key for a list of suppression files. +145 * The properties key for whether the Jar Analyzer is enabled.146 */ -147publicstaticfinal String SUPPRESSION_FILE = "suppression.file"; +147publicstaticfinal String ANALYZER_JAR_ENABLED = "analyzer.jar.enabled"; 148/** -149 * The properties key for whether the Jar Analyzer is enabled. +149 * The properties key for whether the Archive analyzer is enabled.150 */ -151publicstaticfinal String ANALYZER_JAR_ENABLED = "analyzer.jar.enabled"; +151publicstaticfinal String ANALYZER_ARCHIVE_ENABLED = "analyzer.archive.enabled"; 152/** -153 * The properties key for whether the Archive analyzer is enabled. +153 * The properties key for whether the .NET Assembly analyzer is enabled.154 */ -155publicstaticfinal String ANALYZER_ARCHIVE_ENABLED = "analyzer.archive.enabled"; +155publicstaticfinal String ANALYZER_ASSEMBLY_ENABLED = "analyzer.assembly.enabled"; 156/** -157 * The properties key for whether the .NET Assembly analyzer is enabled. +157 * The properties key for whether the .NET Nuspec analyzer is enabled.158 */ -159publicstaticfinal String ANALYZER_ASSEMBLY_ENABLED = "analyzer.assembly.enabled"; +159publicstaticfinal String ANALYZER_NUSPEC_ENABLED = "analyzer.nuspec.enabled"; 160/** -161 * The properties key for whether the .NET Nuspec analyzer is enabled. +161 * The properties key for whether the JavaScript analyzer is enabled.162 */ -163publicstaticfinal String ANALYZER_NUSPEC_ENABLED = "analyzer.nuspec.enabled"; +163publicstaticfinal String ANALYZER_JAVASCRIPT_ENABLED = "analyzer.javascript.enabled"; 164/** -165 * The properties key for whether the JavaScript analyzer is enabled. +165 * The properties key for whether the Nexus analyzer is enabled.166 */ -167publicstaticfinal String ANALYZER_JAVASCRIPT_ENABLED = "analyzer.javascript.enabled"; +167publicstaticfinal String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled"; 168/** -169 * The properties key for whether the Nexus analyzer is enabled. +169 * The properties key for the Nexus search URL.170 */ -171publicstaticfinal String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled"; +171publicstaticfinal String ANALYZER_NEXUS_URL = "analyzer.nexus.url"; 172/** -173 * The properties key for the Nexus search URL. +173 * The properties key for using the proxy to reach Nexus.174 */ -175publicstaticfinal String ANALYZER_NEXUS_URL = "analyzer.nexus.url"; +175publicstaticfinal String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy"; 176/** -177 * The properties key for using the proxy to reach Nexus. +177 * The path to mono, if available.178 */ -179publicstaticfinal String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy"; +179publicstaticfinal String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path"; 180/** -181 * The path to mono, if available. +181 * The additional configured zip file extensions, if available.182 */ -183publicstaticfinal String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path"; +183publicstaticfinal String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip"; 184/** -185 * The additional configured zip file extensions, if available. +185 * The properties key for whether Test Scope dependencies should be skipped.186 */ -187publicstaticfinal String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip"; +187publicstaticfinal String SKIP_TEST_SCOPE = "skip.test.scope"; 188/** -189 * The properties key for whether Test Scope dependencies should be skipped. +189 * The properties key for whether Runtime Scope dependencies should be skipped.190 */ -191publicstaticfinal String SKIP_TEST_SCOPE = "skip.test.scope"; +191publicstaticfinal String SKIP_RUNTIME_SCOPE = "skip.runtime.scope"; 192/** -193 * The properties key for whether Runtime Scope dependencies should be skipped. +193 * The properties key for whether Provided Scope dependencies should be skipped.194 */ -195publicstaticfinal String SKIP_RUNTIME_SCOPE = "skip.runtime.scope"; -196/** -197 * The properties key for whether Provided Scope dependencies should be skipped. -198 */ -199publicstaticfinal String SKIP_PROVIDED_SCOPE = "skip.provided.scope"; -200 } -201/** -202 * The properties file location. -203 */ -204privatestaticfinal String PROPERTIES_FILE = "dependencycheck.properties"; -205/** -206 * The singleton instance variable. -207 */ -208privatestaticfinalSettings INSTANCE = newSettings(); -209/** -210 * The properties. -211 */ -212private Properties props = null; -213 -214/** -215 * Private constructor for the Settings class. This class loads the properties files. -216 */ -217privateSettings() { -218 InputStream in = null; -219 props = new Properties(); -220try { -221 in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -222 props.load(in); -223 } catch (IOException ex) { -224 Logger.getLogger(Settings.class.getName()).log(Level.SEVERE, "Unable to load default settings."); -225 Logger.getLogger(Settings.class.getName()).log(Level.FINE, null, ex); -226 } finally { -227if (in != null) { -228try { -229 in.close(); -230 } catch (IOException ex) { -231 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex); -232 } -233 } -234 } -235 logProperties("Properties loaded", props); -236 } -237 -238/** -239 * Logs the properties. This will not log any properties that contain 'password' in the key. -240 * -241 * @param header the header to print with the log message -242 * @param properties the properties to log +195publicstaticfinal String SKIP_PROVIDED_SCOPE = "skip.provided.scope"; +196 } +197//</editor-fold> +198 +199/** +200 * The logger. +201 */ +202privatestaticfinal Logger LOGGER = Logger.getLogger(Settings.class.getName()); +203/** +204 * The properties file location. +205 */ +206privatestaticfinal String PROPERTIES_FILE = "dependencycheck.properties"; +207/** +208 * Thread local settings. +209 */ +210privatestatic ThreadLocal<Settings> localSettings = new ThreadLocal(); +211/** +212 * The properties. +213 */ +214private Properties props = null; +215 +216/** +217 * Private constructor for the Settings class. This class loads the properties files. +218 */ +219privateSettings() { +220 InputStream in = null; +221 props = new Properties(); +222try { +223 in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +224 props.load(in); +225 } catch (IOException ex) { +226 LOGGER.log(Level.SEVERE, "Unable to load default settings."); +227 LOGGER.log(Level.FINE, null, ex); +228 } finally { +229if (in != null) { +230try { +231 in.close(); +232 } catch (IOException ex) { +233 LOGGER.log(Level.FINEST, null, ex); +234 } +235 } +236 } +237 logProperties("Properties loaded", props); +238 } +239 +240/** +241 * Initializes the thread local settings object. Note, to use the settings object you must call this method. +242 * However, you must also call Settings.cleanup() to properly release resources.243 */ -244privatestaticvoid logProperties(String header, Properties properties) { -245if (LOGGER.isLoggable(Level.FINE)) { -246final StringWriter sw = new StringWriter(); -247 PrintWriter pw = null; -248try { -249 pw = new PrintWriter(sw); -250 pw.format("%s:%n%n", header); -251final Enumeration e = properties.propertyNames(); -252while (e.hasMoreElements()) { -253final String key = (String) e.nextElement(); -254if (key.contains("password")) { -255 pw.format("%s='*****'%n", key); -256 } else { -257final String value = properties.getProperty(key); -258if (value != null) { -259 pw.format("%s='%s'%n", key, value); -260 } -261 } -262 } -263 pw.flush(); -264 LOGGER.fine(sw.toString()); -265 } finally { -266if (pw != null) { -267 pw.close(); -268 } -269 } +244publicstaticvoid initialize() { +245 localSettings.set(newSettings()); +246 } +247 +248/** +249 * Cleans up resources to prevent memory leaks. +250 */ +251publicstaticvoid cleanup() { +252if (tempDirectory != null && tempDirectory.exists()) { +253 FileUtils.delete(tempDirectory); +254 } +255try { +256 localSettings.remove(); +257 } catch (Throwable ex) { +258 LOGGER.log(Level.FINE, "Error cleaning up Settings", ex); +259 } +260 } +261 +262/** +263 * Gets the underlying instance of the Settings object. +264 * +265 * @return the Settings object +266 */ +267publicstaticSettings getInstance() { +268return localSettings.get(); +269 } 270 -271 } -272 } -273 -274/** -275 * Sets a property value. -276 * -277 * @param key the key for the property -278 * @param value the value for the property -279 */ -280publicstaticvoid setString(String key, String value) { -281 INSTANCE.props.setProperty(key, value); -282if (LOGGER.isLoggable(Level.FINE)) { -283 LOGGER.fine(String.format("Setting: %s='%s'", key, value)); -284 } -285 } -286 -287/** -288 * Sets a property value. -289 * -290 * @param key the key for the property -291 * @param value the value for the property -292 */ -293publicstaticvoid setBoolean(String key, boolean value) { -294if (value) { -295 INSTANCE.props.setProperty(key, Boolean.TRUE.toString()); -296 } else { -297 INSTANCE.props.setProperty(key, Boolean.FALSE.toString()); -298 } -299if (LOGGER.isLoggable(Level.FINE)) { -300 LOGGER.fine(String.format("Setting: %s='%b'", key, value)); -301 } -302 } -303 -304/** -305 * Merges a new properties file into the current properties. This method allows for the loading of a user provided -306 * properties file.<br/><br/> -307 * Note: even if using this method - system properties will be loaded before properties loaded from files. -308 * -309 * @param filePath the path to the properties file to merge. -310 * @throws FileNotFoundException is thrown when the filePath points to a non-existent file -311 * @throws IOException is thrown when there is an exception loading/merging the properties -312 */ -313publicstaticvoid mergeProperties(File filePath) throws FileNotFoundException, IOException { -314final FileInputStream fis = new FileInputStream(filePath); -315 mergeProperties(fis); -316 } -317 -318/** -319 * Merges a new properties file into the current properties. This method allows for the loading of a user provided -320 * properties file.<br/><br/> -321 * Note: even if using this method - system properties will be loaded before properties loaded from files. -322 * -323 * @param filePath the path to the properties file to merge. -324 * @throws FileNotFoundException is thrown when the filePath points to a non-existent file -325 * @throws IOException is thrown when there is an exception loading/merging the properties -326 */ -327publicstaticvoid mergeProperties(String filePath) throws FileNotFoundException, IOException { -328final FileInputStream fis = new FileInputStream(filePath); -329 mergeProperties(fis); -330 } -331 -332/** -333 * Merges a new properties file into the current properties. This method allows for the loading of a user provided -334 * properties file.<br/><br/> -335 * Note: even if using this method - system properties will be loaded before properties loaded from files. -336 * -337 * @param stream an Input Stream pointing at a properties file to merge -338 * @throws IOException is thrown when there is an exception loading/merging the properties -339 */ -340publicstaticvoid mergeProperties(InputStream stream) throws IOException { -341 INSTANCE.props.load(stream); -342 logProperties("Properties updated via merge", INSTANCE.props); -343 } -344 -345/** -346 * Returns a value from the properties file as a File object. If the value was specified as a system property or -347 * passed in via the -Dprop=value argument - this method will return the value from the system properties before the -348 * values in the contained configuration file. -349 * -350 * @param key the key to lookup within the properties file -351 * @return the property from the properties file converted to a File object -352 */ -353publicstatic File getFile(String key) { -354final String file = getString(key); -355if (file == null) { -356returnnull; -357 } -358returnnew File(file); -359 } -360 -361/** -362 * Returns a value from the properties file as a File object. If the value was specified as a system property or -363 * passed in via the -Dprop=value argument - this method will return the value from the system properties before the -364 * values in the contained configuration file. -365 * -366 * This method will check the configured base directory and will use this as the base of the file path. -367 * Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder -368 * containing the JAR file containing this class. -369 * -370 * @param key the key to lookup within the properties file -371 * @return the property from the properties file converted to a File object -372 */ -373publicstatic File getDataFile(String key) { -374final String file = getString(key); -375 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file)); -376if (file == null) { -377returnnull; -378 } -379if (file.startsWith("[JAR]")) { -380 Logger.getLogger(Settings.class.getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename"); -381final File jarPath = getJarPath(); -382 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString())); -383final File retVal = new File(jarPath, file.substring(6)); -384 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString())); -385return retVal; -386 } -387returnnew File(file); -388 } -389 -390/** -391 * Attempts to retrieve the folder containing the Jar file containing the Settings class. -392 * -393 * @return a File object +271/** +272 * Sets the instance of the Settings object to use in this thread. +273 * +274 * @param instance the instance of the settings object to use in this thread +275 */ +276publicstaticvoid setInstance(Settings instance) { +277 localSettings.set(instance); +278 } +279 +280/** +281 * Logs the properties. This will not log any properties that contain 'password' in the key. +282 * +283 * @param header the header to print with the log message +284 * @param properties the properties to log +285 */ +286privatestaticvoid logProperties(String header, Properties properties) { +287if (LOGGER.isLoggable(Level.FINE)) { +288final StringWriter sw = new StringWriter(); +289 PrintWriter pw = null; +290try { +291 pw = new PrintWriter(sw); +292 pw.format("%s:%n%n", header); +293final Enumeration e = properties.propertyNames(); +294while (e.hasMoreElements()) { +295final String key = (String) e.nextElement(); +296if (key.contains("password")) { +297 pw.format("%s='*****'%n", key); +298 } else { +299final String value = properties.getProperty(key); +300if (value != null) { +301 pw.format("%s='%s'%n", key, value); +302 } +303 } +304 } +305 pw.flush(); +306 LOGGER.fine(sw.toString()); +307 } finally { +308if (pw != null) { +309 pw.close(); +310 } +311 } +312 +313 } +314 } +315 +316/** +317 * Sets a property value. +318 * +319 * @param key the key for the property +320 * @param value the value for the property +321 */ +322publicstaticvoid setString(String key, String value) { +323 localSettings.get().props.setProperty(key, value); +324if (LOGGER.isLoggable(Level.FINE)) { +325 LOGGER.fine(String.format("Setting: %s='%s'", key, value)); +326 } +327 } +328 +329/** +330 * Sets a property value. +331 * +332 * @param key the key for the property +333 * @param value the value for the property +334 */ +335publicstaticvoid setBoolean(String key, boolean value) { +336if (value) { +337 localSettings.get().props.setProperty(key, Boolean.TRUE.toString()); +338 } else { +339 localSettings.get().props.setProperty(key, Boolean.FALSE.toString()); +340 } +341if (LOGGER.isLoggable(Level.FINE)) { +342 LOGGER.fine(String.format("Setting: %s='%b'", key, value)); +343 } +344 } +345 +346/** +347 * Merges a new properties file into the current properties. This method allows for the loading of a user provided +348 * properties file.<br/><br/> +349 * Note: even if using this method - system properties will be loaded before properties loaded from files. +350 * +351 * @param filePath the path to the properties file to merge. +352 * @throws FileNotFoundException is thrown when the filePath points to a non-existent file +353 * @throws IOException is thrown when there is an exception loading/merging the properties +354 */ +355publicstaticvoid mergeProperties(File filePath) throws FileNotFoundException, IOException { +356final FileInputStream fis = new FileInputStream(filePath); +357 mergeProperties(fis); +358 } +359 +360/** +361 * Merges a new properties file into the current properties. This method allows for the loading of a user provided +362 * properties file.<br/><br/> +363 * Note: even if using this method - system properties will be loaded before properties loaded from files. +364 * +365 * @param filePath the path to the properties file to merge. +366 * @throws FileNotFoundException is thrown when the filePath points to a non-existent file +367 * @throws IOException is thrown when there is an exception loading/merging the properties +368 */ +369publicstaticvoid mergeProperties(String filePath) throws FileNotFoundException, IOException { +370final FileInputStream fis = new FileInputStream(filePath); +371 mergeProperties(fis); +372 } +373 +374/** +375 * Merges a new properties file into the current properties. This method allows for the loading of a user provided +376 * properties file.<br/><br/> +377 * Note: even if using this method - system properties will be loaded before properties loaded from files. +378 * +379 * @param stream an Input Stream pointing at a properties file to merge +380 * @throws IOException is thrown when there is an exception loading/merging the properties +381 */ +382publicstaticvoid mergeProperties(InputStream stream) throws IOException { +383 localSettings.get().props.load(stream); +384 logProperties("Properties updated via merge", localSettings.get().props); +385 } +386 +387/** +388 * Returns a value from the properties file as a File object. If the value was specified as a system property or +389 * passed in via the -Dprop=value argument - this method will return the value from the system properties before the +390 * values in the contained configuration file. +391 * +392 * @param key the key to lookup within the properties file +393 * @return the property from the properties file converted to a File object394 */ -395privatestatic File getJarPath() { -396final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath(); -397 String decodedPath = "."; -398try { -399 decodedPath = URLDecoder.decode(jarPath, "UTF-8"); -400 } catch (UnsupportedEncodingException ex) { -401 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex); -402 } -403 -404final File path = new File(decodedPath); -405if (path.getName().toLowerCase().endsWith(".jar")) { -406return path.getParentFile(); -407 } else { -408returnnew File("."); -409 } -410 } -411 -412/** -413 * Returns a value from the properties file. If the value was specified as a system property or passed in via the -414 * -Dprop=value argument - this method will return the value from the system properties before the values in the -415 * contained configuration file. -416 * -417 * @param key the key to lookup within the properties file -418 * @param defaultValue the default value for the requested property -419 * @return the property from the properties file -420 */ -421publicstatic String getString(String key, String defaultValue) { -422final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue)); -423return str; -424 } -425 -426/** -427 * Returns the temporary directory. -428 * -429 * @return the temporary directory -430 */ -431publicstatic File getTempDirectory() { -432returnnew File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir"))); -433 } -434 -435/** -436 * Returns a value from the properties file. If the value was specified as a system property or passed in via the -437 * -Dprop=value argument - this method will return the value from the system properties before the values in the -438 * contained configuration file. -439 * -440 * @param key the key to lookup within the properties file -441 * @return the property from the properties file -442 */ -443publicstatic String getString(String key) { -444return System.getProperty(key, INSTANCE.props.getProperty(key)); -445 } -446 -447/** -448 * Removes a property from the local properties collection. This is mainly used in test cases. -449 * -450 * @param key the property key to remove -451 */ -452publicstaticvoid removeProperty(String key) { -453 INSTANCE.props.remove(key); -454 } -455 -456/** -457 * Returns an int value from the properties file. If the value was specified as a system property or passed in via -458 * the -Dprop=value argument - this method will return the value from the system properties before the values in the -459 * contained configuration file. -460 * -461 * @param key the key to lookup within the properties file -462 * @return the property from the properties file -463 * @throws InvalidSettingException is thrown if there is an error retrieving the setting -464 */ -465publicstaticint getInt(String key) throws InvalidSettingException { -466int value; -467try { -468 value = Integer.parseInt(Settings.getString(key)); -469 } catch (NumberFormatException ex) { -470thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -471 } -472return value; -473 } -474 -475/** -476 * Returns an int value from the properties file. If the value was specified as a system property or passed in via -477 * the -Dprop=value argument - this method will return the value from the system properties before the values in the -478 * contained configuration file. -479 * -480 * @param key the key to lookup within the properties file -481 * @param defaultValue the default value to return -482 * @return the property from the properties file or the defaultValue if the property does not exist or cannot be -483 * converted to an integer -484 */ -485publicstaticint getInt(String key, int defaultValue) { -486int value; -487try { -488 value = Integer.parseInt(Settings.getString(key)); -489 } catch (NumberFormatException ex) { -490final String msg = String.format("Could not convert property '%s' to an int.", key); -491 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, msg, ex); -492 value = defaultValue; -493 } -494return value; -495 } -496 -497/** -498 * Returns a long value from the properties file. If the value was specified as a system property or passed in via -499 * the -Dprop=value argument - this method will return the value from the system properties before the values in the -500 * contained configuration file. -501 * -502 * @param key the key to lookup within the properties file -503 * @return the property from the properties file -504 * @throws InvalidSettingException is thrown if there is an error retrieving the setting -505 */ -506publicstaticlong getLong(String key) throws InvalidSettingException { -507long value; -508try { -509 value = Long.parseLong(Settings.getString(key)); -510 } catch (NumberFormatException ex) { -511thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -512 } -513return value; -514 } -515 -516/** -517 * Returns a boolean value from the properties file. If the value was specified as a system property or passed in -518 * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before -519 * the values in the contained configuration file. -520 * -521 * @param key the key to lookup within the properties file -522 * @return the property from the properties file -523 * @throws InvalidSettingException is thrown if there is an error retrieving the setting -524 */ -525publicstaticboolean getBoolean(String key) throws InvalidSettingException { -526boolean value; -527try { -528 value = Boolean.parseBoolean(Settings.getString(key)); -529 } catch (NumberFormatException ex) { -530thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -531 } -532return value; -533 } -534 -535/** -536 * Returns a boolean value from the properties file. If the value was specified as a system property or passed in -537 * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before -538 * the values in the contained configuration file. -539 * -540 * @param key the key to lookup within the properties file -541 * @param defaultValue the default value to return if the setting does not exist -542 * @return the property from the properties file -543 * @throws InvalidSettingException is thrown if there is an error retrieving the setting -544 */ -545publicstaticboolean getBoolean(String key, boolean defaultValue) throws InvalidSettingException { -546boolean value; -547try { -548final String strValue = Settings.getString(key); -549if (strValue == null) { -550return defaultValue; -551 } -552 value = Boolean.parseBoolean(strValue); -553 } catch (NumberFormatException ex) { -554thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -555 } -556return value; -557 } -558 } +395publicstatic File getFile(String key) { +396final String file = getString(key); +397if (file == null) { +398returnnull; +399 } +400returnnew File(file); +401 } +402 +403/** +404 * Returns a value from the properties file as a File object. If the value was specified as a system property or +405 * passed in via the -Dprop=value argument - this method will return the value from the system properties before the +406 * values in the contained configuration file. +407 * +408 * This method will check the configured base directory and will use this as the base of the file path. +409 * Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder +410 * containing the JAR file containing this class. +411 * +412 * @param key the key to lookup within the properties file +413 * @return the property from the properties file converted to a File object +414 */ +415publicstatic File getDataFile(String key) { +416final String file = getString(key); +417 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file)); +418if (file == null) { +419returnnull; +420 } +421if (file.startsWith("[JAR]")) { +422 LOGGER.log(Level.FINE, "Settings.getDataFile() - transforming filename"); +423final File jarPath = getJarPath(); +424 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString())); +425final File retVal = new File(jarPath, file.substring(6)); +426 LOGGER.log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString())); +427return retVal; +428 } +429returnnew File(file); +430 } +431 +432/** +433 * Attempts to retrieve the folder containing the Jar file containing the Settings class. +434 * +435 * @return a File object +436 */ +437privatestatic File getJarPath() { +438final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath(); +439 String decodedPath = "."; +440try { +441 decodedPath = URLDecoder.decode(jarPath, "UTF-8"); +442 } catch (UnsupportedEncodingException ex) { +443 LOGGER.log(Level.FINEST, null, ex); +444 } +445 +446final File path = new File(decodedPath); +447if (path.getName().toLowerCase().endsWith(".jar")) { +448return path.getParentFile(); +449 } else { +450returnnew File("."); +451 } +452 } +453 +454/** +455 * Returns a value from the properties file. If the value was specified as a system property or passed in via the +456 * -Dprop=value argument - this method will return the value from the system properties before the values in the +457 * contained configuration file. +458 * +459 * @param key the key to lookup within the properties file +460 * @param defaultValue the default value for the requested property +461 * @return the property from the properties file +462 */ +463publicstatic String getString(String key, String defaultValue) { +464final String str = System.getProperty(key, localSettings.get().props.getProperty(key, defaultValue)); +465return str; +466 } +467 +468/** +469 * A reference to the temporary directory; used incase it needs to be deleted during cleanup. +470 */ +471privatestatic File tempDirectory = null; +472 +473/** +474 * Returns the temporary directory. +475 * +476 * @return the temporary directory +477 * @throws java.io.IOException thrown if the temporary directory does not exist and cannot be created +478 */ +479publicstatic File getTempDirectory() throws IOException { +480final File tmpDir = new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir"))); +481if (!tmpDir.exists()) { +482if (!tmpDir.mkdirs()) { +483final String msg = String.format("Unable to make a temporary folder '%s'", tmpDir.getPath()); +484thrownew IOException(msg); +485 } else { +486 tempDirectory = tmpDir; +487 } +488 } +489return tmpDir; +490 } +491 +492/** +493 * Returns a value from the properties file. If the value was specified as a system property or passed in via the +494 * -Dprop=value argument - this method will return the value from the system properties before the values in the +495 * contained configuration file. +496 * +497 * @param key the key to lookup within the properties file +498 * @return the property from the properties file +499 */ +500publicstatic String getString(String key) { +501return System.getProperty(key, localSettings.get().props.getProperty(key)); +502 } +503 +504/** +505 * Removes a property from the local properties collection. This is mainly used in test cases. +506 * +507 * @param key the property key to remove +508 */ +509publicstaticvoid removeProperty(String key) { +510 localSettings.get().props.remove(key); +511 } +512 +513/** +514 * Returns an int value from the properties file. If the value was specified as a system property or passed in via +515 * the -Dprop=value argument - this method will return the value from the system properties before the values in the +516 * contained configuration file. +517 * +518 * @param key the key to lookup within the properties file +519 * @return the property from the properties file +520 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +521 */ +522publicstaticint getInt(String key) throws InvalidSettingException { +523int value; +524try { +525 value = Integer.parseInt(Settings.getString(key)); +526 } catch (NumberFormatException ex) { +527thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +528 } +529return value; +530 } +531 +532/** +533 * Returns an int value from the properties file. If the value was specified as a system property or passed in via +534 * the -Dprop=value argument - this method will return the value from the system properties before the values in the +535 * contained configuration file. +536 * +537 * @param key the key to lookup within the properties file +538 * @param defaultValue the default value to return +539 * @return the property from the properties file or the defaultValue if the property does not exist or cannot be +540 * converted to an integer +541 */ +542publicstaticint getInt(String key, int defaultValue) { +543int value; +544try { +545 value = Integer.parseInt(Settings.getString(key)); +546 } catch (NumberFormatException ex) { +547final String msg = String.format("Could not convert property '%s' to an int.", key); +548 LOGGER.log(Level.FINEST, msg, ex); +549 value = defaultValue; +550 } +551return value; +552 } +553 +554/** +555 * Returns a long value from the properties file. If the value was specified as a system property or passed in via +556 * the -Dprop=value argument - this method will return the value from the system properties before the values in the +557 * contained configuration file. +558 * +559 * @param key the key to lookup within the properties file +560 * @return the property from the properties file +561 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +562 */ +563publicstaticlong getLong(String key) throws InvalidSettingException { +564long value; +565try { +566 value = Long.parseLong(Settings.getString(key)); +567 } catch (NumberFormatException ex) { +568thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +569 } +570return value; +571 } +572 +573/** +574 * Returns a boolean value from the properties file. If the value was specified as a system property or passed in +575 * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before +576 * the values in the contained configuration file. +577 * +578 * @param key the key to lookup within the properties file +579 * @return the property from the properties file +580 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +581 */ +582publicstaticboolean getBoolean(String key) throws InvalidSettingException { +583boolean value; +584try { +585 value = Boolean.parseBoolean(Settings.getString(key)); +586 } catch (NumberFormatException ex) { +587thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +588 } +589return value; +590 } +591 +592/** +593 * Returns a boolean value from the properties file. If the value was specified as a system property or passed in +594 * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before +595 * the values in the contained configuration file. +596 * +597 * @param key the key to lookup within the properties file +598 * @param defaultValue the default value to return if the setting does not exist +599 * @return the property from the properties file +600 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +601 */ +602publicstaticboolean getBoolean(String key, boolean defaultValue) throws InvalidSettingException { +603boolean value; +604try { +605final String strValue = Settings.getString(key); +606if (strValue == null) { +607return defaultValue; +608 } +609 value = Boolean.parseBoolean(strValue); +610 } catch (NumberFormatException ex) { +611thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +612 } +613return value; +614 } +615 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/URLConnectionFactory.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/URLConnectionFactory.html index 4da75aa84..f4b4fceb0 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/URLConnectionFactory.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/URLConnectionFactory.html @@ -63,7 +63,7 @@ 55try { 56if (proxyUrl != null) { 57finalint proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT); -58final SocketAddress addr = new InetSocketAddress(proxyUrl, proxyPort); +58final SocketAddress address = new InetSocketAddress(proxyUrl, proxyPort); 5960final String username = Settings.getString(Settings.KEYS.PROXY_USERNAME); 61final String password = Settings.getString(Settings.KEYS.PROXY_PASSWORD); @@ -80,7 +80,7 @@ 72 Authenticator.setDefault(auth); 73 } 74 -75 proxy = new Proxy(Proxy.Type.HTTP, addr); +75 proxy = new Proxy(Proxy.Type.HTTP, address); 76 conn = (HttpURLConnection) url.openConnection(proxy); 77 } else { 78 conn = (HttpURLConnection) url.openConnection(); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html index 4e4ecc8e6..2131f92aa 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html index f34bafb51..b84445bd8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.2.0 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref/overview-frame.html b/dependency-check-core/xref/overview-frame.html index 9c80cfa15..a57dd938e 100644 --- a/dependency-check-core/xref/overview-frame.html +++ b/dependency-check-core/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference + Dependency-Check Core 1.2.0 Reference diff --git a/dependency-check-core/xref/overview-summary.html b/dependency-check-core/xref/overview-summary.html index eee5f918e..0257b62d4 100644 --- a/dependency-check-core/xref/overview-summary.html +++ b/dependency-check-core/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.1.4 Reference + Dependency-Check Core 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Core 1.1.4 Reference

    +

    Dependency-Check Core 1.2.0 Reference

    + EscapeTool +
    Format
    diff --git a/dependency-check-jenkins/index.html b/dependency-check-jenkins/index.html index 33cf42f71..81ac63c9e 100644 --- a/dependency-check-jenkins/index.html +++ b/dependency-check-jenkins/index.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-jenkins/license.html b/dependency-check-jenkins/license.html index f2fdada0a..5dd52d947 100644 --- a/dependency-check-jenkins/license.html +++ b/dependency-check-jenkins/license.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-jenkins/project-info.html b/dependency-check-jenkins/project-info.html index 1013eddd7..34cb33e1a 100644 --- a/dependency-check-jenkins/project-info.html +++ b/dependency-check-jenkins/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-jenkins/project-summary.html b/dependency-check-jenkins/project-summary.html index 6564d9b9c..841c48ae9 100644 --- a/dependency-check-jenkins/project-summary.html +++ b/dependency-check-jenkins/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -196,7 +196,7 @@ - +
    dependency-check-jenkins
    Version1.1.4
    1.2.0
    Type pom
    diff --git a/dependency-check-maven/apidocs/allclasses-frame.html b/dependency-check-maven/apidocs/allclasses-frame.html index 4d263d3cb..abf53b83f 100644 --- a/dependency-check-maven/apidocs/allclasses-frame.html +++ b/dependency-check-maven/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Maven Plugin 1.1.4 API) - +All Classes (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/allclasses-noframe.html b/dependency-check-maven/apidocs/allclasses-noframe.html index 06fceacd5..5e34f7bb3 100644 --- a/dependency-check-maven/apidocs/allclasses-noframe.html +++ b/dependency-check-maven/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Maven Plugin 1.1.4 API) - +All Classes (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/constant-values.html b/dependency-check-maven/apidocs/constant-values.html index 285471754..f8d2f7ada 100644 --- a/dependency-check-maven/apidocs/constant-values.html +++ b/dependency-check-maven/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Maven Plugin 1.1.4 API) - +Constant Field Values (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/deprecated-list.html b/dependency-check-maven/apidocs/deprecated-list.html index 0151b3aae..6bc443543 100644 --- a/dependency-check-maven/apidocs/deprecated-list.html +++ b/dependency-check-maven/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Maven Plugin 1.1.4 API) - +Deprecated List (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/help-doc.html b/dependency-check-maven/apidocs/help-doc.html index c8fa5790f..acb44ad31 100644 --- a/dependency-check-maven/apidocs/help-doc.html +++ b/dependency-check-maven/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Maven Plugin 1.1.4 API) - +API Help (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/index-all.html b/dependency-check-maven/apidocs/index-all.html index f0d81547b..1ef10759b 100644 --- a/dependency-check-maven/apidocs/index-all.html +++ b/dependency-check-maven/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Maven Plugin 1.1.4 API) - +Index (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/index.html b/dependency-check-maven/apidocs/index.html index 0a509f307..1e3dcaaeb 100644 --- a/dependency-check-maven/apidocs/index.html +++ b/dependency-check-maven/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Maven Plugin 1.1.4 API +Dependency-Check Maven Plugin 1.2.0 API diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html index 7f320a222..153fb4649 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html @@ -2,16 +2,16 @@ - + -HelpMojo (Dependency-Check Maven Plugin 1.1.4 API) - +HelpMojo (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html index 6cc8c3093..7fc2ea564 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html index cd728b47e..97a9b92cd 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.1.4 API) - +Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html index dce7d372d..4c588190d 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.4 API) - +org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html index 14fb50b5c..f268321d1 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.4 API) - +org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html index 69fca8edd..a037dee48 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.1.4 API) - +org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html index f057fe59e..912274cbd 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.4 API) - +Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/apidocs/overview-tree.html b/dependency-check-maven/apidocs/overview-tree.html index 149104312..2457f8ec7 100644 --- a/dependency-check-maven/apidocs/overview-tree.html +++ b/dependency-check-maven/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Maven Plugin 1.1.4 API) - +Class Hierarchy (Dependency-Check Maven Plugin 1.2.0 API) + diff --git a/dependency-check-maven/check-mojo.html b/dependency-check-maven/check-mojo.html index fe51369ad..30a6bde4a 100644 --- a/dependency-check-maven/check-mojo.html +++ b/dependency-check-maven/check-mojo.html @@ -1,13 +1,13 @@ - + dependency-check-maven - dependency-check:check @@ -55,7 +55,7 @@
  • - + /
  • @@ -69,9 +69,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -107,7 +107,7 @@ Project Information - +
  • @@ -165,7 +165,7 @@

    Full name:

    -

    org.owasp:dependency-check-maven:1.1.4:check

    +

    org.owasp:dependency-check-maven:1.2.0:check

    Description:

    @@ -622,7 +622,7 @@ Reports page.
    Default value is: Dependency-Check.
    U - -Skip Analisys for Provided Scope Dependencies.
    Default value is: false.
    User property is: skipProvidedScope. +Skip Analysis for Provided Scope Dependencies.
    Default value is: false.
    User property is: skipProvidedScope. @@ -633,7 +633,7 @@ Reports page.
    Default value is: Dependency-Check.
    U - -Skip Analisys for Runtime Scope Dependencies.
    Default value is: false.
    User property is: skipRuntimeScope. +Skip Analysis for Runtime Scope Dependencies.
    Default value is: false.
    User property is: skipRuntimeScope. @@ -644,7 +644,7 @@ Reports page.
    Default value is: Dependency-Check.
    U - -Skip Analisys for Test Scope Dependencies.
    Default value is: true.
    User property is: skipTestScope. +Skip Analysis for Test Scope Dependencies.
    Default value is: true.
    User property is: skipTestScope. @@ -655,7 +655,7 @@ Reports page.
    Default value is: Dependency-Check.
    U - -The Connection Timeout.
    User property is: suppressionFile. +The path to the suppression file.
    User property is: suppressionFile. @@ -1143,7 +1143,7 @@ Dependency-Check report. This generally maps to "target/site".

    skipProvidedScope:

    -
    Skip Analisys for Provided Scope Dependencies.
    +
    Skip Analysis for Provided Scope Dependencies.
      @@ -1157,7 +1157,7 @@ Dependency-Check report. This generally maps to "target/site".

    skipRuntimeScope:

    -
    Skip Analisys for Runtime Scope Dependencies.
    +
    Skip Analysis for Runtime Scope Dependencies.
      @@ -1171,7 +1171,7 @@ Dependency-Check report. This generally maps to "target/site".

    skipTestScope:

    -
    Skip Analisys for Test Scope Dependencies.
    +
    Skip Analysis for Test Scope Dependencies.
      @@ -1185,7 +1185,7 @@ Dependency-Check report. This generally maps to "target/site".

    suppressionFile:

    -
    The Connection Timeout.
    +
    The path to the suppression file.
      diff --git a/dependency-check-maven/checkstyle.html b/dependency-check-maven/checkstyle.html index 8458642eb..9235638f8 100644 --- a/dependency-check-maven/checkstyle.html +++ b/dependency-check-maven/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Checkstyle Results @@ -54,7 +54,7 @@
    • - + /
    • @@ -67,9 +67,9 @@ -
    • | Last Published: 2014-03-29
    • +
    • | Last Published: 2014-04-28
    • - Version: 1.1.4 + Version: 1.2.0
    @@ -105,7 +105,7 @@ Project Information
  • - +
  • @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • @@ -286,95 +272,95 @@ Errors '}' is not preceded with whitespace. -136 +141 Errors '}' is not preceded with whitespace. -142 +147 Errors '}' is not preceded with whitespace. -150 +155 Errors '}' is not preceded with whitespace. -158 +163 Errors '}' is not preceded with whitespace. -165 +170 Errors '}' is not preceded with whitespace. -174 +179 Errors '}' is not preceded with whitespace. -183 +188 Errors '}' is not preceded with whitespace. -192 +197 Errors '}' is not preceded with whitespace. -199 +204 Errors '}' is not preceded with whitespace. -205 +210 Errors '}' is not preceded with whitespace. -211 +216 Errors '}' is not preceded with whitespace. -218 +223 Errors '}' is not preceded with whitespace. -225 +230 Errors '}' is not preceded with whitespace. -232 +237 Errors '}' is not preceded with whitespace. -239 +244 Errors '}' is not preceded with whitespace. -246 +251 Errors '}' is not preceded with whitespace. -252 +257 Errors '}' is not preceded with whitespace. -258 +263 Errors '}' is not preceded with whitespace. -264 +269 Errors '}' is not preceded with whitespace. -270 +275 Errors '}' is not preceded with whitespace. -276 +281 Errors '}' is not preceded with whitespace. -282 +287 Errors '}' is not preceded with whitespace. -288 +293 diff --git a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html index 69d9a9c27..149e3013e 100644 --- a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html +++ b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.maven2
    0%
    0/606
    0%
    0/342
    5.5
    org.owasp.dependencycheck.maven2
    0%
    0/607
    0%
    0/340
    5.477
    - + diff --git a/dependency-check-maven/cobertura/frame-summary.html b/dependency-check-maven/cobertura/frame-summary.html index 83156e73b..43d8c273f 100644 --- a/dependency-check-maven/cobertura/frame-summary.html +++ b/dependency-check-maven/cobertura/frame-summary.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages2
    0%
    0/606
    0%
    0/342
    5.5
    org.owasp.dependencycheck.maven2
    0%
    0/606
    0%
    0/342
    5.5
    All Packages2
    0%
    0/607
    0%
    0/340
    5.477
    org.owasp.dependencycheck.maven2
    0%
    0/607
    0%
    0/340
    5.477
    - + diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html index 3cc138816..7c537ea07 100644 --- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyCheckMojo
    0%
    0/455
    0%
    0/236
    5.621
    DependencyCheckMojo
    0%
    0/456
    0%
    0/234
    5.586
     
    @@ -161,588 +161,590 @@  72  
         /**
     73   -
          * The properties file location.
    +
          * Logger field reference.
     74  
          */
    -  75   -
         private static final String PROPERTIES_FILE = "mojo.properties";
    +  75  0
         private final Logger logger = Logger.getLogger(DependencyCheckMojo.class.getName());
     76   -
         /**
    +
     
     77   -
          * Name of the logging properties file.
    -  78   -
          */
    -  79   -
         private static final String LOG_PROPERTIES_FILE = "log.properties";
    -  80  
         /**
    -  81   -
          * System specific new line character.
    -  82   +  78   +
          * The properties file location.
    +  79   +
          */
    +  80   +
         private static final String PROPERTIES_FILE = "mojo.properties";
    +  81   +
         /**
    +  82   +
          * Name of the logging properties file.
    +  83  
          */
    -  83  0
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
     84   -
         // <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">
    +
         private static final String LOG_PROPERTIES_FILE = "log.properties";
     85  
         /**
     86   -
          * The Maven Project Object.
    +
          * System specific new line character.
     87  
          */
    -  88   -
         @Component
    +  88  0
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
     89   -
         private MavenProject project;
    +
         // <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">
     90  
         /**
     91   -
          * The path to the verbose log.
    +
          * The Maven Project Object.
     92  
          */
     93   -
         @Parameter(property = "logfile", defaultValue = "")
    +
         @Component
     94   -
         private String logFile;
    +
         private MavenProject project;
     95  
         /**
     96   -
          * The name of the report to be displayed in the Maven Generated Reports page.
    +
          * The path to the verbose log.
     97  
          */
     98   -
         @Parameter(property = "name", defaultValue = "Dependency-Check")
    +
         @Parameter(property = "logfile", defaultValue = "")
     99   -
         private String name;
    +
         private String logFile;
     100  
         /**
     101   -
          * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    +
          * The name of the report to be displayed in the Maven Generated Reports page.
     102  
          */
     103   -
         @Parameter(property = "description", defaultValue = "A report providing details on any published "
    +
         @Parameter(property = "name", defaultValue = "Dependency-Check")
     104   -
                 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
    +
         private String name;
     105   -
                 + "false positives and false negatives.")
    +
         /**
     106   -
         private String description;
    +
          * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
     107   -
         /**
    -  108   -
          * Specifies the destination directory for the generated Dependency-Check report. This generally maps to
    -  109   -
          * "target/site".
    -  110  
          */
    +  108   +
         @Parameter(property = "description", defaultValue = "A report providing details on any published "
    +  109   +
                 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
    +  110   +
                 + "false positives and false negatives.")
     111   -
         @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
    +
         private String description;
     112   -
         private File reportOutputDirectory;
    -  113  
         /**
    +  113   +
          * Specifies the destination directory for the generated Dependency-Check report. This generally maps to
     114   -
          * The output directory. This generally maps to "target".
    +
          * "target/site".
     115  
          */
     116   -
         @Parameter(defaultValue = "${project.build.directory}", required = true)
    +
         @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
     117   -
         private File outputDirectory;
    +
         private File reportOutputDirectory;
     118  
         /**
     119   -
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
    +
          * The output directory. This generally maps to "target".
     120   -
          * which means since the CVSS scores are 0-10, by default the build will never fail.
    +
          */
     121   -
          */
    -  122  0
         @SuppressWarnings("CanBeFinal")
    +
         @Parameter(defaultValue = "${project.build.directory}", required = true)
    +  122   +
         private File outputDirectory;
     123   -
         @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
    +
         /**
     124   -
         private float failBuildOnCVSS = 11;
    +
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
     125   -
         /**
    +
          * which means since the CVSS scores are 0-10, by default the build will never fail.
     126   -
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
    -  127   -
          * false. Default is true.
    +
          */
    +  127  0
         @SuppressWarnings("CanBeFinal")
     128   -
          */
    -  129  0
         @SuppressWarnings("CanBeFinal")
    +
         @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
    +  129   +
         private float failBuildOnCVSS = 11;
     130   -
         @Parameter(property = "autoupdate", defaultValue = "true", required = true)
    +
         /**
     131   -
         private boolean autoUpdate = true;
    +
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
     132   -
         /**
    +
          * false. Default is true.
     133   -
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
    -  134   -
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
    +
          */
    +  134  0
         @SuppressWarnings("CanBeFinal")
     135   -
          */
    -  136  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "autoupdate", defaultValue = "true", required = true)
    +  136   +
         private boolean autoUpdate = true;
     137   -
         @Parameter(property = "format", defaultValue = "HTML", required = true)
    +
         /**
     138   -
         private String format = "HTML";
    +
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
     139   -
         /**
    +
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
     140   -
          * Sets whether or not the external report format should be used.
    -  141  
          */
    -  142  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  141  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  142   +
         @Parameter(property = "format", defaultValue = "HTML", required = true)
     143   -
         @Parameter(property = "externalReport", defaultValue = "false", required = true)
    +
         private String format = "HTML";
     144   -
         private boolean externalReport = false;
    +
         /**
     145   -
         /**
    +
          * Sets whether or not the external report format should be used.
     146   -
          * The Proxy URL.
    -  147   -
          *
    +
          */
    +  147  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     148   -
          * @deprecated Please use mavenSettings instead
    +
         @Parameter(property = "externalReport", defaultValue = "false", required = true)
     149   -
          */
    -  150  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         private boolean externalReport = false;
    +  150   +
         /**
     151   -
         @Parameter(property = "proxyUrl", defaultValue = "", required = false)
    +
          * The Proxy URL.
     152   -
         @Deprecated
    +
          *
     153   -
         private String proxyUrl = null;
    +
          * @deprecated Please use mavenSettings instead
     154   -
     
    -  155   -
         /**
    +
          */
    +  155  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     156   -
          * The maven settings.
    +
         @Parameter(property = "proxyUrl", defaultValue = "", required = false)
     157   -
          */
    +
         @Deprecated
     158   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         private String proxyUrl = null;
     159   -
         @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false)
    +
     
     160   -
         private org.apache.maven.settings.Settings mavenSettings;
    +
         /**
     161   -
     
    +
          * The maven settings.
     162   -
         /**
    +
          */
     163   -
          * The maven settings proxy id.
    +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     164   -
          */
    +
         @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false)
     165   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         private org.apache.maven.settings.Settings mavenSettings;
     166   -
         @Parameter(property = "mavenSettingsProxyId", required = false)
    +
     
     167   -
         private String mavenSettingsProxyId;
    +
         /**
     168   -
     
    +
          * The maven settings proxy id.
     169   -
         /**
    +
          */
     170   -
          * The Proxy Port.
    +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     171   -
          *
    +
         @Parameter(property = "mavenSettingsProxyId", required = false)
     172   -
          * @deprecated Please use mavenSettings instead
    +
         private String mavenSettingsProxyId;
     173   -
          */
    -  174  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
     
    +  174   +
         /**
     175   -
         @Parameter(property = "proxyPort", defaultValue = "", required = false)
    +
          * The Proxy Port.
     176   -
         @Deprecated
    +
          *
     177   -
         private String proxyPort = null;
    +
          * @deprecated Please use mavenSettings instead
     178   -
         /**
    -  179   -
          * The Proxy username.
    +
          */
    +  179  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     180   -
          *
    +
         @Parameter(property = "proxyPort", defaultValue = "", required = false)
     181   -
          * @deprecated Please use mavenSettings instead
    +
         @Deprecated
     182   -
          */
    -  183  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         private String proxyPort = null;
    +  183   +
         /**
     184   -
         @Parameter(property = "proxyUsername", defaultValue = "", required = false)
    +
          * The Proxy username.
     185   -
         @Deprecated
    -  186   -
         private String proxyUsername = null;
    -  187   -
         /**
    -  188   -
          * The Proxy password.
    -  189  
          *
    -  190   +  186  
          * @deprecated Please use mavenSettings instead
    -  191   +  187  
          */
    -  192  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  193   -
         @Parameter(property = "proxyPassword", defaultValue = "", required = false)
    -  194   +  188  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  189   +
         @Parameter(property = "proxyUsername", defaultValue = "", required = false)
    +  190  
         @Deprecated
    +  191   +
         private String proxyUsername = null;
    +  192   +
         /**
    +  193   +
          * The Proxy password.
    +  194   +
          *
     195   -
         private String proxyPassword = null;
    +
          * @deprecated Please use mavenSettings instead
     196   -
         /**
    -  197   -
          * The Connection Timeout.
    +
          */
    +  197  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     198   -
          */
    -  199  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "proxyPassword", defaultValue = "", required = false)
    +  199   +
         @Deprecated
     200   -
         @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
    +
         private String proxyPassword = null;
     201   -
         private String connectionTimeout = null;
    +
         /**
     202   -
         /**
    -  203  
          * The Connection Timeout.
    -  204   +  203  
          */
    -  205  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  204  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  205   +
         @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
     206   -
         @Parameter(property = "suppressionFile", defaultValue = "", required = false)
    +
         private String connectionTimeout = null;
     207   -
         private String suppressionFile = null;
    +
         /**
     208   -
         /**
    +
          * The path to the suppression file.
     209   -
          * Flag indicating whether or not to show a summary in the output.
    -  210  
          */
    -  211  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  210  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  211   +
         @Parameter(property = "suppressionFile", defaultValue = "", required = false)
     212   -
         @Parameter(property = "showSummary", defaultValue = "true", required = false)
    +
         private String suppressionFile = null;
     213   -
         private boolean showSummary = true;
    +
         /**
     214   -
     
    +
          * Flag indicating whether or not to show a summary in the output.
     215   -
         /**
    -  216   -
          * Whether or not the Jar Analyzer is enabled.
    +
          */
    +  216  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     217   -
          */
    -  218  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "showSummary", defaultValue = "true", required = false)
    +  218   +
         private boolean showSummary = true;
     219   -
         @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false)
    +
     
     220   -
         private boolean jarAnalyzerEnabled = true;
    +
         /**
     221   -
     
    +
          * Whether or not the Jar Analyzer is enabled.
     222   -
         /**
    -  223   -
          * Whether or not the Archive Analyzer is enabled.
    +
          */
    +  223  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     224   -
          */
    -  225  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false)
    +  225   +
         private boolean jarAnalyzerEnabled = true;
     226   -
         @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false)
    +
     
     227   -
         private boolean archiveAnalyzerEnabled = true;
    +
         /**
     228   -
     
    +
          * Whether or not the Archive Analyzer is enabled.
     229   -
         /**
    -  230   -
          * Whether or not the .NET Assembly Analyzer is enabled.
    +
          */
    +  230  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     231   -
          */
    -  232  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false)
    +  232   +
         private boolean archiveAnalyzerEnabled = true;
     233   -
         @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false)
    +
     
     234   -
         private boolean assemblyAnalyzerEnabled = true;
    +
         /**
     235   -
     
    +
          * Whether or not the .NET Assembly Analyzer is enabled.
     236   -
         /**
    -  237   -
          * Whether or not the .NET Nuspec Analyzer is enabled.
    +
          */
    +  237  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     238   -
          */
    -  239  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false)
    +  239   +
         private boolean assemblyAnalyzerEnabled = true;
     240   -
         @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false)
    -  241   -
         private boolean nuspecAnalyzerEnabled = true;
    -  242  
     
    +  241   +
         /**
    +  242   +
          * Whether or not the .NET Nuspec Analyzer is enabled.
     243   -
         /**
    -  244   -
          * Whether or not the Nexus Analyzer is enabled.
    +
          */
    +  244  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     245   -
          */
    -  246  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false)
    +  246   +
         private boolean nuspecAnalyzerEnabled = true;
     247   -
         @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false)
    +
     
     248   -
         private boolean nexusAnalyzerEnabled = true;
    +
         /**
     249   -
         /**
    -  250  
          * Whether or not the Nexus Analyzer is enabled.
    -  251   +  250  
          */
    +  251  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     252   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false)
     253   -
         @Parameter(property = "nexusUrl", defaultValue = "", required = false)
    +
         private boolean nexusAnalyzerEnabled = true;
     254   -
         private String nexusUrl;
    +
         /**
     255   -
         /**
    +
          * Whether or not the Nexus Analyzer is enabled.
     256   -
          * Whether or not the configured proxy is used to connect to Nexus.
    +
          */
     257   -
          */
    -  258  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  258   +
         @Parameter(property = "nexusUrl", defaultValue = "", required = false)
     259   -
         @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false)
    +
         private String nexusUrl;
     260   -
         private boolean nexusUsesProxy = true;
    +
         /**
     261   -
         /**
    +
          * Whether or not the configured proxy is used to connect to Nexus.
     262   -
          * The database connection string.
    -  263  
          */
    +  263  0
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     264   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false)
     265   -
         @Parameter(property = "connectionString", defaultValue = "", required = false)
    +
         private boolean nexusUsesProxy = true;
     266   -
         private String connectionString;
    +
         /**
     267   -
         /**
    +
          * The database connection string.
     268   -
          * The database driver name. An example would be org.h2.Driver.
    +
          */
     269   -
          */
    +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     270   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "connectionString", defaultValue = "", required = false)
     271   -
         @Parameter(property = "databaseDriverName", defaultValue = "", required = false)
    +
         private String connectionString;
     272   -
         private String databaseDriverName;
    +
         /**
     273   -
         /**
    +
          * The database driver name. An example would be org.h2.Driver.
     274   -
          * The path to the database driver if it is not on the class path.
    +
          */
     275   -
          */
    +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     276   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "databaseDriverName", defaultValue = "", required = false)
     277   -
         @Parameter(property = "databaseDriverPath", defaultValue = "", required = false)
    +
         private String databaseDriverName;
     278   -
         private String databaseDriverPath;
    +
         /**
     279   -
         /**
    +
          * The path to the database driver if it is not on the class path.
     280   -
          * The database user name.
    +
          */
     281   -
          */
    +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     282   -
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +
         @Parameter(property = "databaseDriverPath", defaultValue = "", required = false)
     283   -
         @Parameter(property = "databaseUser", defaultValue = "", required = false)
    +
         private String databaseDriverPath;
     284   -
         private String databaseUser;
    +
         /**
     285   -
         /**
    +
          * The database user name.
     286   -
          * The password to use when connecting to the database.
    +
          */
     287   -
          */
    -  288  
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  288   +
         @Parameter(property = "databaseUser", defaultValue = "", required = false)
     289   -
         @Parameter(property = "databasePassword", defaultValue = "", required = false)
    +
         private String databaseUser;
     290   -
         private String databasePassword;
    -  291  
         /**
    +  291   +
          * The password to use when connecting to the database.
     292   -
          * A comma-separated list of file extensions to add to analysis next to jar, zip, ....
    -  293  
          */
    +  293   +
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     294   -
         @Parameter(property = "zipExtensions", required = false)
    +
         @Parameter(property = "databasePassword", defaultValue = "", required = false)
     295   -
         private String zipExtensions;
    +
         private String databasePassword;
     296  
         /**
     297   -
          * Skip Analisys for Test Scope Dependencies.
    +
          * A comma-separated list of file extensions to add to analysis next to jar, zip, ....
     298  
          */
    -  299  0
         @SuppressWarnings("CanBeFinal")
    +  299   +
         @Parameter(property = "zipExtensions", required = false)
     300   -
         @Parameter(property = "skipTestScope", defaultValue = "true", required = false)
    +
         private String zipExtensions;
     301   -
         private boolean skipTestScope = true;
    +
         /**
     302   -
         /**
    +
          * Skip Analysis for Test Scope Dependencies.
     303   -
          * Skip Analisys for Runtime Scope Dependencies.
    -  304  
          */
    -  305  0
         @SuppressWarnings("CanBeFinal")
    +  304  0
         @SuppressWarnings("CanBeFinal")
    +  305   +
         @Parameter(property = "skipTestScope", defaultValue = "true", required = false)
     306   -
         @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false)
    +
         private boolean skipTestScope = true;
     307   -
         private boolean skipRuntimeScope = false;
    +
         /**
     308   -
         /**
    +
          * Skip Analysis for Runtime Scope Dependencies.
     309   -
          * Skip Analisys for Provided Scope Dependencies.
    -  310  
          */
    -  311  0
         @SuppressWarnings("CanBeFinal")
    +  310  0
         @SuppressWarnings("CanBeFinal")
    +  311   +
         @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false)
     312   -
         @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false)
    +
         private boolean skipRuntimeScope = false;
     313   -
         private boolean skipProvidedScope = false;
    -  314  
         /**
    +  314   +
          * Skip Analysis for Provided Scope Dependencies.
     315   -
          * The data directory, hold DC SQL DB.
    -  316  
          */
    +  316  0
         @SuppressWarnings("CanBeFinal")
     317   -
         @Parameter(property = "dataDirectory", defaultValue = "", required = false)
    +
         @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false)
     318   -
         private String dataDirectory;
    +
         private boolean skipProvidedScope = false;
     319  
         /**
     320   -
          * Data Mirror URL for CVE 1.2.
    +
          * The data directory, hold DC SQL DB.
     321  
          */
     322   -
         @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false)
    +
         @Parameter(property = "dataDirectory", defaultValue = "", required = false)
     323   -
         private String cveUrl12Modified;
    +
         private String dataDirectory;
     324  
         /**
     325   -
          * Data Mirror URL for CVE 2.0.
    +
          * Data Mirror URL for CVE 1.2.
     326  
          */
     327   -
         @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false)
    +
         @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false)
     328   -
         private String cveUrl20Modified;
    +
         private String cveUrl12Modified;
     329  
         /**
     330   -
          * Base Data Mirror URL for CVE 1.2.
    +
          * Data Mirror URL for CVE 2.0.
     331  
          */
     332   -
         @Parameter(property = "cveUrl12Base", defaultValue = "", required = false)
    +
         @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false)
     333   -
         private String cveUrl12Base;
    +
         private String cveUrl20Modified;
     334  
         /**
     335   -
          * Data Mirror URL for CVE 2.0.
    +
          * Base Data Mirror URL for CVE 1.2.
     336  
          */
     337   -
         @Parameter(property = "cveUrl20Base", defaultValue = "", required = false)
    +
         @Parameter(property = "cveUrl12Base", defaultValue = "", required = false)
     338   -
         private String cveUrl20Base;
    +
         private String cveUrl12Base;
     339   -
     
    +
         /**
     340   -
         /**
    +
          * Data Mirror URL for CVE 2.0.
     341   -
          * The path to mono for .NET Assembly analysis on non-windows systems.
    +
          */
     342   -
          */
    +
         @Parameter(property = "cveUrl20Base", defaultValue = "", required = false)
     343   -
         @Parameter(property = "pathToMono", defaultValue = "", required = false)
    +
         private String cveUrl20Base;
     344   -
         private String pathToMono;
    +
     
     345   -
     
    -  346   -
         // </editor-fold>
    -  347  
         /**
    -  348   -
          * Executes the Dependency-Check on the dependent libraries.
    -  349   -
          *
    -  350   -
          * @return the Engine used to scan the dependencies.
    -  351   -
          * @throws DatabaseException thrown if there is an exception connecting to the database
    -  352   +  346   +
          * The path to mono for .NET Assembly analysis on non-windows systems.
    +  347  
          */
    +  348   +
         @Parameter(property = "pathToMono", defaultValue = "", required = false)
    +  349   +
         private String pathToMono;
    +  350   +
     
    +  351   +
         // </editor-fold>
    +  352   +
         /**
     353   -
         private Engine executeDependencyCheck() throws DatabaseException {
    +
          * Executes the Dependency-Check on the dependent libraries.
     354   -
     
    -  355  0
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  356  0
             LogUtils.prepareLogger(in, logFile);
    +
          *
    +  355   +
          * @return the Engine used to scan the dependencies.
    +  356   +
          * @throws DatabaseException thrown if there is an exception connecting to the database
     357   +
          */
    +  358   +
         private Engine executeDependencyCheck() throws DatabaseException {
    +  359  
     
    -  358  0
             populateSettings();
    -  359  0
             Engine engine = null;
    -  360   -
             try {
    -  361  0
                 engine = new Engine();
    -  362  0
                 final Set<Artifact> artifacts = project.getArtifacts();
    -  363  0
                 for (Artifact a : artifacts) {
    -  364  0
                     if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
    -  365  0
                         continue;
    -  366   -
                     }
    -  367   +  360  0
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  361  0
             LogUtils.prepareLogger(in, logFile);
    +  362  
     
    -  368  0
                     if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
    -  369  0
                         continue;
    +  363  0
             populateSettings();
    +  364  0
             final Engine engine = new Engine();
    +  365   +
     
    +  366  0
             final Set<Artifact> artifacts = project.getArtifacts();
    +  367  0
             for (Artifact a : artifacts) {
    +  368  0
                 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
    +  369  0
                     continue;
     370   -
                     }
    +
                 }
     371  
     
    -  372  0
                     if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
    -  373  0
                         continue;
    +  372  0
                 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
    +  373  0
                     continue;
     374   -
                     }
    +
                 }
     375  
     
    -  376  0
                     engine.scan(a.getFile().getAbsolutePath());
    -  377  0
                 }
    -  378  0
                 engine.analyzeDependencies();
    -  379   -
             } finally {
    -  380  0
                 if (engine != null) {
    -  381  0
                     engine.cleanup();
    -  382   +  376  0
                 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
    +  377  0
                     continue;
    +  378  
                 }
    +  379   +
     
    +  380  0
                 engine.scan(a.getFile().getAbsolutePath());
    +  381  0
             }
    +  382  0
             engine.analyzeDependencies();
     383   -
             }
    +
     
     384  0
             return engine;
     385  
         }
    @@ -770,7 +772,7 @@  398  0
                 cve.open();
     399  0
                 prop = cve.getDatabaseProperties();
     400  0
             } catch (DatabaseException ex) {
    -  401  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +  401  0
                 logger.log(Level.FINE, "Unable to retrieve DB Properties", ex);
     402  
             } finally {
     403  0
                 if (cve != null) {
    @@ -784,15 +786,15 @@
             try {
     409  0
                 r.generateReports(outDirectory.getCanonicalPath(), format);
     410  0
             } catch (IOException ex) {
    -  411  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE,
    +  411  0
                 logger.log(Level.SEVERE,
     412  
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    -  413  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    +  413  0
                 logger.log(Level.FINE, null, ex);
     414  0
             } catch (Throwable ex) {
    -  415  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE,
    +  415  0
                 logger.log(Level.SEVERE,
     416  
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    -  417  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    +  417  0
                 logger.log(Level.FINE, null, ex);
     418  0
             }
     419  0
         }
     420   @@ -1326,7 +1328,7 @@  804  0
                         return proxies.get(0);
     805  
                     } else {
    -  806  0
                         throw new IllegalStateException("Ambigous proxy definition");
    +  806  0
                         throw new IllegalStateException("Ambiguous proxy definition");
     807  
                     }
     808   @@ -1348,533 +1350,530 @@
          */
     817  
         private void populateSettings() {
    -  818  0
             InputStream mojoProperties = null;
    -  819   +  818  0
             Settings.initialize();
    +  819  0
             InputStream mojoProperties = null;
    +  820  
             try {
    -  820  0
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  821  0
                 Settings.mergeProperties(mojoProperties);
    -  822  0
             } catch (IOException ex) {
    -  823  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    -  824  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    -  825   +  821  0
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  822  0
                 Settings.mergeProperties(mojoProperties);
    +  823  0
             } catch (IOException ex) {
    +  824  0
                 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    +  825  0
                 logger.log(Level.FINE, null, ex);
    +  826  
             } finally {
    -  826  0
                 if (mojoProperties != null) {
    -  827   +  827  0
                 if (mojoProperties != null) {
    +  828  
                     try {
    -  828  0
                         mojoProperties.close();
    -  829  0
                     } catch (IOException ex) {
    -  830  0
                         Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex);
    -  831  0
                     }
    -  832   -
                 }
    +  829  0
                         mojoProperties.close();
    +  830  0
                     } catch (IOException ex) {
    +  831  0
                         logger.log(Level.FINEST, null, ex);
    +  832  0
                     }
     833   -
             }
    +
                 }
     834   +
             }
    +  835  
     
    -  835  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    -  836   +  836  0
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  837  
     
    -  837  0
             final Proxy proxy = getMavenProxy();
    -  838  0
             if (proxy != null) {
    -  839  0
                 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy));
    -  840  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
    -  841  0
                 final String userName = proxy.getUsername();
    -  842  0
                 final String password = proxy.getPassword();
    -  843  0
                 if (userName != null && password != null) {
    -  844  0
                     Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
    -  845  0
                     Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
    -  846   -
                 }
    +  838  0
             final Proxy proxy = getMavenProxy();
    +  839  0
             if (proxy != null) {
    +  840  0
                 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy));
    +  841  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
    +  842  0
                 final String userName = proxy.getUsername();
    +  843  0
                 final String password = proxy.getPassword();
    +  844  0
                 if (userName != null && password != null) {
    +  845  0
                     Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
    +  846  0
                     Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
     847   -
             }
    +
                 }
     848   +
             }
    +  849  
     
    -  849  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  850  0
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    -  851   +  850  0
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  851  0
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    +  852  
             }
    -  852  0
             if (proxyPort != null && !proxyPort.isEmpty()) {
    -  853  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    -  854   +  853  0
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  854  0
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    +  855  
             }
    -  855  0
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    -  856  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    -  857   +  856  0
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    +  857  0
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    +  858  
             }
    -  858  0
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    -  859  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    -  860   +  859  0
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    +  860  0
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    +  861  
             }
    -  861  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  862  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    -  863   -
             }
    -  864  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  865  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    -  866   +  862  0
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  863  0
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  864  
             }
    +  865  0
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  866  0
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
     867   -
     
    +
             }
     868   -
             //File Type Analyzer Settings
    +
     
     869   +
             //File Type Analyzer Settings
    +  870  
             //JAR ANALYZER
    -  870  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
    -  871   +  871  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
    +  872  
             //NUSPEC ANALYZER
    -  872  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    -  873   +  873  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
    +  874  
             //NEXUS ANALYZER
    -  874  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    -  875  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    -  876  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    -  877   +  875  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    +  876  0
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  877  0
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  878  
             }
    -  878  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    -  879   +  879  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
    +  880  
             //ARCHIVE ANALYZER
    -  880  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    -  881  0
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    -  882  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
    -  883   -
             }
    +  881  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
    +  882  0
             if (zipExtensions != null && !zipExtensions.isEmpty()) {
    +  883  0
                 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
     884   +
             }
    +  885  
             //ASSEMBLY ANALYZER
    -  885  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    -  886  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    -  887  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
    -  888   -
             }
    +  886  0
             Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
    +  887  0
             if (pathToMono != null && !pathToMono.isEmpty()) {
    +  888  0
                 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
     889   -
     
    +
             }
     890   +
     
    +  891  
             //Database configuration
    -  891  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    -  892  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    -  893   +  892  0
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  893  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  894  
             }
    -  894  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    -  895  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    -  896   +  895  0
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  896  0
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    +  897  
             }
    -  897  0
             if (connectionString != null && !connectionString.isEmpty()) {
    -  898  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    -  899   +  898  0
             if (connectionString != null && !connectionString.isEmpty()) {
    +  899  0
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    +  900  
             }
    -  900  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    -  901  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    -  902   -
             }
    -  903  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    -  904  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    -  905   +  901  0
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  902  0
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  903  
             }
    +  904  0
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  905  0
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
     906   +
             }
    +  907  
             // Data Directory
    -  907  0
             if (dataDirectory != null && !dataDirectory.isEmpty()) {
    -  908  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    -  909   -
             }
    +  908  0
             if (dataDirectory != null && !dataDirectory.isEmpty()) {
    +  909  0
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
     910   -
     
    +
             }
     911   +
     
    +  912  
             // Scope Exclusion
    -  912  0
             Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
    -  913  0
             Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
    -  914  0
             Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
    -  915   -
     
    +  913  0
             Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
    +  914  0
             Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
    +  915  0
             Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
     916   +
     
    +  917  
             // CVE Data Mirroring
    -  917  0
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    -  918  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
    -  919   +  918  0
             if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
    +  919  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
    +  920  
             }
    -  920  0
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    -  921  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
    -  922   +  921  0
             if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
    +  922  0
                 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
    +  923  
             }
    -  923  0
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    -  924  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
    -  925   -
             }
    -  926  0
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    -  927  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
    -  928   +  924  0
             if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
    +  925  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
    +  926  
             }
    +  927  0
             if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
    +  928  0
                 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
     929   +
             }
    +  930  
     
    -  930  0
         }
    -  931   -
     
    +  931  0
         }
     932   -
         /**
    +
     
     933   -
          * Executes the dependency-check and generates the report.
    +
         /**
     934   -
          *
    +
          * Executes the dependency-check and generates the report.
     935   -
          * @throws MojoExecutionException if a maven exception occurs
    +
          *
     936   -
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level
    +
          * @throws MojoExecutionException if a maven exception occurs
     937   -
          */
    +
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level
     938   +
          */
    +  939  
         public void execute() throws MojoExecutionException, MojoFailureException {
    -  939  0
             Engine engine = null;
    -  940   +  940  0
             Engine engine = null;
    +  941  
             try {
    -  941  0
                 engine = executeDependencyCheck();
    -  942  0
                 generateExternalReports(engine, outputDirectory);
    -  943  0
                 if (this.showSummary) {
    -  944  0
                     showSummary(engine.getDependencies());
    -  945   +  942  0
                 engine = executeDependencyCheck();
    +  943  0
                 generateExternalReports(engine, outputDirectory);
    +  944  0
                 if (this.showSummary) {
    +  945  0
                     showSummary(engine.getDependencies());
    +  946  
                 }
    -  946  0
                 if (this.failBuildOnCVSS <= 10) {
    -  947  0
                     checkForFailure(engine.getDependencies());
    -  948   +  947  0
                 if (this.failBuildOnCVSS <= 10) {
    +  948  0
                     checkForFailure(engine.getDependencies());
    +  949  
                 }
    -  949  0
             } catch (DatabaseException ex) {
    -  950  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE,
    -  951   +  950  0
             } catch (DatabaseException ex) {
    +  951  0
                 logger.log(Level.SEVERE,
    +  952  
                         "Unable to connect to the dependency-check database; analysis has stopped");
    -  952  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "", ex);
    -  953   +  953  0
                 logger.log(Level.FINE, "", ex);
    +  954  
             } finally {
    -  954  0
                 if (engine != null) {
    -  955  0
                     engine.cleanup();
    -  956   +  955  0
                 Settings.cleanup();
    +  956  0
                 if (engine != null) {
    +  957  0
                     engine.cleanup();
    +  958  
                 }
    -  957   -
             }
    -  958  0
         }
     959   -
     
    -  960   -
         /**
    +
             }
    +  960  0
         }
     961   -
          * Generates the Dependency-Check Site Report.
    +
     
     962   -
          *
    +
         /**
     963   -
          * @param sink the sink to write the report to
    -  964   -
          * @param locale the locale to use when generating the report
    -  965   -
          * @throws MavenReportException if a Maven report exception occurs
    -  966   -
          */
    -  967   -
         public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
    -  968   -
                 Locale locale) throws MavenReportException {
    -  969  0
             generate((Sink) sink, null, locale);
    -  970  0
         }
    -  971   -
     
    -  972   -
         /**
    -  973  
          * Generates the Dependency-Check Site Report.
    -  974   +  964  
          *
    -  975   +  965  
          * @param sink the sink to write the report to
    -  976   -
          * @param sinkFactory the sink factory
    -  977   +  966  
          * @param locale the locale to use when generating the report
    +  967   +
          * @throws MavenReportException if a Maven report exception occurs
    +  968   +
          */
    +  969   +
         public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
    +  970   +
                 Locale locale) throws MavenReportException {
    +  971  0
             generate((Sink) sink, null, locale);
    +  972  0
         }
    +  973   +
     
    +  974   +
         /**
    +  975   +
          * Generates the Dependency-Check Site Report.
    +  976   +
          *
    +  977   +
          * @param sink the sink to write the report to
     978   -
          * @throws MavenReportException if a maven report exception occurs
    +
          * @param sinkFactory the sink factory
     979   -
          */
    +
          * @param locale the locale to use when generating the report
     980   -
         public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
    -  981  0
             Engine engine = null;
    +
          * @throws MavenReportException if a maven report exception occurs
    +  981   +
          */
     982   +
         public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
    +  983  0
             Engine engine = null;
    +  984  
             try {
    -  983  0
                 engine = executeDependencyCheck();
    -  984  0
                 if (this.externalReport) {
    -  985  0
                     generateExternalReports(engine, reportOutputDirectory);
    -  986   -
                 } else {
    -  987  0
                     generateMavenSiteReport(engine, sink);
    +  985  0
                 engine = executeDependencyCheck();
    +  986  0
                 if (this.externalReport) {
    +  987  0
                     generateExternalReports(engine, reportOutputDirectory);
     988   +
                 } else {
    +  989  0
                     generateMavenSiteReport(engine, sink);
    +  990  
                 }
    -  989  0
             } catch (DatabaseException ex) {
    -  990  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE,
    -  991   -
                         "Unable to connect to the dependency-check database; analysis has stopped");
    -  992  0
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "", ex);
    +  991  0
             } catch (DatabaseException ex) {
    +  992  0
                 logger.log(Level.SEVERE,
     993   +
                         "Unable to connect to the dependency-check database; analysis has stopped");
    +  994  0
                 logger.log(Level.FINE, "", ex);
    +  995  
             } finally {
    -  994  0
                 if (engine != null) {
    -  995  0
                     engine.cleanup();
    -  996   -
                 }
    -  997   -
             }
    -  998  0
         }
    +  996  0
                 Settings.cleanup();
    +  997  0
                 if (engine != null) {
    +  998  0
                     engine.cleanup();
     999   -
     
    -  1000   -
         // <editor-fold defaultstate="collapsed" desc="required setter/getter methods">
    -  1001   -
         /**
    -  1002   -
          * Returns the output name.
    -  1003   -
          *
    -  1004   -
          * @return the output name
    -  1005   -
          */
    -  1006   -
         public String getOutputName() {
    -  1007  0
             if ("HTML".equalsIgnoreCase(this.format)
    -  1008   -
                     || "ALL".equalsIgnoreCase(this.format)) {
    -  1009  0
                 return "dependency-check-report";
    -  1010  0
             } else if ("XML".equalsIgnoreCase(this.format)) {
    -  1011  0
                 return "dependency-check-report.xml#";
    -  1012  0
             } else if ("VULN".equalsIgnoreCase(this.format)) {
    -  1013  0
                 return "dependency-check-vulnerability";
    -  1014   -
             } else {
    -  1015  0
                 Logger.getLogger(DependencyCheckMojo.class
    -  1016   -
                         .getName()).log(Level.WARNING, "Unknown report format used during site generatation.");
    -  1017  0
                 return "dependency-check-report";
    -  1018   -
             }
    -  1019   -
         }
    -  1020   -
     
    -  1021   -
         /**
    -  1022   -
          * Returns the category name.
    -  1023   -
          *
    -  1024   -
          * @return the category name
    -  1025   -
          */
    -  1026   -
         public String getCategoryName() {
    -  1027  0
             return MavenReport.CATEGORY_PROJECT_REPORTS;
    -  1028   -
         }
    -  1029   -
     
    -  1030   -
         /**
    -  1031   -
          * Returns the report name.
    -  1032   -
          *
    -  1033   -
          * @param locale the location
    -  1034   -
          * @return the report name
    -  1035   -
          */
    -  1036   -
         public String getName(Locale locale) {
    -  1037  0
             return name;
    -  1038   -
         }
    -  1039   -
     
    -  1040   -
         /**
    -  1041   -
          * Sets the Reporting output directory.
    -  1042   -
          *
    -  1043   -
          * @param directory the output directory
    -  1044   -
          */
    -  1045   -
         public void setReportOutputDirectory(File directory) {
    -  1046  0
             reportOutputDirectory = directory;
    -  1047  0
         }
    -  1048   -
     
    -  1049   -
         /**
    -  1050   -
          * Returns the output directory.
    -  1051   -
          *
    -  1052   -
          * @return the output directory
    -  1053   -
          */
    -  1054   -
         public File getReportOutputDirectory() {
    -  1055  0
             return reportOutputDirectory;
    -  1056   -
         }
    -  1057   -
     
    -  1058   -
         /**
    -  1059   -
          * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    -  1060   -
          *
    -  1061   -
          * @param locale The Locale to get the description for
    -  1062   -
          * @return the description
    -  1063   -
          */
    -  1064   -
         public String getDescription(Locale locale) {
    -  1065  0
             return description;
    -  1066   -
         }
    -  1067   -
     
    -  1068   -
         /**
    -  1069   -
          * Returns whether this is an external report.
    -  1070   -
          *
    -  1071   -
          * @return true or false;
    -  1072   -
          */
    -  1073   -
         public boolean isExternalReport() {
    -  1074  0
             return externalReport;
    -  1075   -
         }
    -  1076   -
     
    -  1077   -
         /**
    -  1078   -
          * Returns whether or not the plugin can generate a report.
    -  1079   -
          *
    -  1080   -
          * @return true
    -  1081   -
          */
    -  1082   -
         public boolean canGenerateReport() {
    -  1083  0
             return true;
    -  1084   -
         }
    -  1085   -
         // </editor-fold>
    -  1086   -
     
    -  1087   -
         /**
    -  1088   -
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    -  1089   -
          * configuration.
    -  1090   -
          *
    -  1091   -
          * @param dependencies the list of dependency objects
    -  1092   -
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set
    -  1093   -
          */
    -  1094   -
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
    -  1095  0
             final StringBuilder ids = new StringBuilder();
    -  1096  0
             for (Dependency d : dependencies) {
    -  1097  0
                 boolean addName = true;
    -  1098  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1099  0
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    -  1100  0
                         if (addName) {
    -  1101  0
                             addName = false;
    -  1102  0
                             ids.append(NEW_LINE).append(d.getFileName()).append(": ");
    -  1103  0
                             ids.append(v.getName());
    -  1104   -
                         } else {
    -  1105  0
                             ids.append(", ").append(v.getName());
    -  1106   -
                         }
    -  1107   -
                     }
    -  1108  0
                 }
    -  1109  0
             }
    -  1110  0
             if (ids.length() > 0) {
    -  1111  0
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    -  1112   -
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    -  1113   -
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    -  1114  0
                 throw new MojoFailureException(msg);
    -  1115   -
             }
    -  1116  0
         }
    -  1117   -
     
    -  1118   -
         /**
    -  1119   -
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    -  1120   -
          *
    -  1121   -
          * @param dependencies a list of dependency objects
    -  1122   -
          */
    -  1123   -
         private void showSummary(List<Dependency> dependencies) {
    -  1124  0
             final StringBuilder summary = new StringBuilder();
    -  1125  0
             for (Dependency d : dependencies) {
    -  1126  0
                 boolean firstEntry = true;
    -  1127  0
                 final StringBuilder ids = new StringBuilder();
    -  1128  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  1129  0
                     if (firstEntry) {
    -  1130  0
                         firstEntry = false;
    -  1131   -
                     } else {
    -  1132  0
                         ids.append(", ");
    -  1133   -
                     }
    -  1134  0
                     ids.append(v.getName());
    -  1135  0
                 }
    -  1136  0
                 if (ids.length() > 0) {
    -  1137  0
                     summary.append(d.getFileName()).append(" (");
    -  1138  0
                     firstEntry = true;
    -  1139  0
                     for (Identifier id : d.getIdentifiers()) {
    -  1140  0
                         if (firstEntry) {
    -  1141  0
                             firstEntry = false;
    -  1142   -
                         } else {
    -  1143  0
                             summary.append(", ");
    -  1144   -
                         }
    -  1145  0
                         summary.append(id.getValue());
    -  1146  0
                     }
    -  1147  0
                     summary.append(") : ").append(ids).append(NEW_LINE);
    -  1148  
                 }
    -  1149  0
             }
    -  1150  0
             if (summary.length() > 0) {
    -  1151  0
                 final String msg = String.format("%n%n"
    -  1152   +  1000   +
             }
    +  1001  0
         }
    +  1002   +
     
    +  1003   +
         // <editor-fold defaultstate="collapsed" desc="required setter/getter methods">
    +  1004   +
         /**
    +  1005   +
          * Returns the output name.
    +  1006   +
          *
    +  1007   +
          * @return the output name
    +  1008   +
          */
    +  1009   +
         public String getOutputName() {
    +  1010  0
             if ("HTML".equalsIgnoreCase(this.format)
    +  1011   +
                     || "ALL".equalsIgnoreCase(this.format)) {
    +  1012  0
                 return "dependency-check-report";
    +  1013  0
             } else if ("XML".equalsIgnoreCase(this.format)) {
    +  1014  0
                 return "dependency-check-report.xml#";
    +  1015  0
             } else if ("VULN".equalsIgnoreCase(this.format)) {
    +  1016  0
                 return "dependency-check-vulnerability";
    +  1017   +
             } else {
    +  1018  0
                 logger.log(Level.WARNING, "Unknown report format used during site generation.");
    +  1019  0
                 return "dependency-check-report";
    +  1020   +
             }
    +  1021   +
         }
    +  1022   +
     
    +  1023   +
         /**
    +  1024   +
          * Returns the category name.
    +  1025   +
          *
    +  1026   +
          * @return the category name
    +  1027   +
          */
    +  1028   +
         public String getCategoryName() {
    +  1029  0
             return MavenReport.CATEGORY_PROJECT_REPORTS;
    +  1030   +
         }
    +  1031   +
     
    +  1032   +
         /**
    +  1033   +
          * Returns the report name.
    +  1034   +
          *
    +  1035   +
          * @param locale the location
    +  1036   +
          * @return the report name
    +  1037   +
          */
    +  1038   +
         public String getName(Locale locale) {
    +  1039  0
             return name;
    +  1040   +
         }
    +  1041   +
     
    +  1042   +
         /**
    +  1043   +
          * Sets the Reporting output directory.
    +  1044   +
          *
    +  1045   +
          * @param directory the output directory
    +  1046   +
          */
    +  1047   +
         public void setReportOutputDirectory(File directory) {
    +  1048  0
             reportOutputDirectory = directory;
    +  1049  0
         }
    +  1050   +
     
    +  1051   +
         /**
    +  1052   +
          * Returns the output directory.
    +  1053   +
          *
    +  1054   +
          * @return the output directory
    +  1055   +
          */
    +  1056   +
         public File getReportOutputDirectory() {
    +  1057  0
             return reportOutputDirectory;
    +  1058   +
         }
    +  1059   +
     
    +  1060   +
         /**
    +  1061   +
          * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    +  1062   +
          *
    +  1063   +
          * @param locale The Locale to get the description for
    +  1064   +
          * @return the description
    +  1065   +
          */
    +  1066   +
         public String getDescription(Locale locale) {
    +  1067  0
             return description;
    +  1068   +
         }
    +  1069   +
     
    +  1070   +
         /**
    +  1071   +
          * Returns whether this is an external report.
    +  1072   +
          *
    +  1073   +
          * @return true or false;
    +  1074   +
          */
    +  1075   +
         public boolean isExternalReport() {
    +  1076  0
             return externalReport;
    +  1077   +
         }
    +  1078   +
     
    +  1079   +
         /**
    +  1080   +
          * Returns whether or not the plugin can generate a report.
    +  1081   +
          *
    +  1082   +
          * @return true
    +  1083   +
          */
    +  1084   +
         public boolean canGenerateReport() {
    +  1085  0
             return true;
    +  1086   +
         }
    +  1087   +
         // </editor-fold>
    +  1088   +
     
    +  1089   +
         /**
    +  1090   +
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    +  1091   +
          * configuration.
    +  1092   +
          *
    +  1093   +
          * @param dependencies the list of dependency objects
    +  1094   +
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set
    +  1095   +
          */
    +  1096   +
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
    +  1097  0
             final StringBuilder ids = new StringBuilder();
    +  1098  0
             for (Dependency d : dependencies) {
    +  1099  0
                 boolean addName = true;
    +  1100  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  1101  0
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    +  1102  0
                         if (addName) {
    +  1103  0
                             addName = false;
    +  1104  0
                             ids.append(NEW_LINE).append(d.getFileName()).append(": ");
    +  1105  0
                             ids.append(v.getName());
    +  1106   +
                         } else {
    +  1107  0
                             ids.append(", ").append(v.getName());
    +  1108   +
                         }
    +  1109   +
                     }
    +  1110  0
                 }
    +  1111  0
             }
    +  1112  0
             if (ids.length() > 0) {
    +  1113  0
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    +  1114   +
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    +  1115   +
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    +  1116  0
                 throw new MojoFailureException(msg);
    +  1117   +
             }
    +  1118  0
         }
    +  1119   +
     
    +  1120   +
         /**
    +  1121   +
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    +  1122   +
          *
    +  1123   +
          * @param dependencies a list of dependency objects
    +  1124   +
          */
    +  1125   +
         private void showSummary(List<Dependency> dependencies) {
    +  1126  0
             final StringBuilder summary = new StringBuilder();
    +  1127  0
             for (Dependency d : dependencies) {
    +  1128  0
                 boolean firstEntry = true;
    +  1129  0
                 final StringBuilder ids = new StringBuilder();
    +  1130  0
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  1131  0
                     if (firstEntry) {
    +  1132  0
                         firstEntry = false;
    +  1133   +
                     } else {
    +  1134  0
                         ids.append(", ");
    +  1135   +
                     }
    +  1136  0
                     ids.append(v.getName());
    +  1137  0
                 }
    +  1138  0
                 if (ids.length() > 0) {
    +  1139  0
                     summary.append(d.getFileName()).append(" (");
    +  1140  0
                     firstEntry = true;
    +  1141  0
                     for (Identifier id : d.getIdentifiers()) {
    +  1142  0
                         if (firstEntry) {
    +  1143  0
                             firstEntry = false;
    +  1144   +
                         } else {
    +  1145  0
                             summary.append(", ");
    +  1146   +
                         }
    +  1147  0
                         summary.append(id.getValue());
    +  1148  0
                     }
    +  1149  0
                     summary.append(") : ").append(ids).append(NEW_LINE);
    +  1150   +
                 }
    +  1151  0
             }
    +  1152  0
             if (summary.length() > 0) {
    +  1153  0
                 final String msg = String.format("%n%n"
    +  1154  
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    -  1153   -
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    -  1154  0
                 Logger
     1155   -
                         .getLogger(DependencyCheckMojo.class
    -  1156   -
                                 .getName()).log(Level.WARNING, msg);
    +
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    +  1156  0
                 logger.log(Level.WARNING, msg);
     1157  
             }
     1158  0
         }
    @@ -1882,6 +1881,6 @@
     }
    - + diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html index 828959ce9..c7385493d 100644 --- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html @@ -744,6 +744,6 @@
     }
    - + diff --git a/dependency-check-maven/configuration.html b/dependency-check-maven/configuration.html index 21fa1e1ef..4b8b72fa1 100644 --- a/dependency-check-maven/configuration.html +++ b/dependency-check-maven/configuration.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Configuration @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -103,7 +103,7 @@ Project Information - +
  • @@ -477,7 +477,7 @@

    Deprecated Configuration

    -

    The following properties have been deprecated. These can stell be set in the dependency-check-maven plugin’s configuration. However, future versions will remove these properties. Instead using these properties you should use Maven’s settings to configure a proxy.

    +

    The following properties have been deprecated. These can still be set in the dependency-check-maven plugin’s configuration. However, future versions will remove these properties. Instead using these properties you should use Maven’s settings to configure a proxy.

    diff --git a/dependency-check-maven/dependency-updates-report.html b/dependency-check-maven/dependency-updates-report.html index 96726a3b1..d9c8a50d8 100644 --- a/dependency-check-maven/dependency-updates-report.html +++ b/dependency-check-maven/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Dependency Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • @@ -387,7 +373,7 @@
  • - + @@ -634,7 +620,7 @@ - + diff --git a/dependency-check-maven/findbugs.html b/dependency-check-maven/findbugs.html index 6472ba885..fc4e80f77 100644 --- a/dependency-check-maven/findbugs.html +++ b/dependency-check-maven/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-maven - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -183,20 +183,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • FindBugs Report diff --git a/dependency-check-maven/help-mojo.html b/dependency-check-maven/help-mojo.html index bb77e7847..29f3bff6b 100644 --- a/dependency-check-maven/help-mojo.html +++ b/dependency-check-maven/help-mojo.html @@ -1,13 +1,13 @@ - + dependency-check-maven - dependency-check:help @@ -55,7 +55,7 @@
  • - + /
  • @@ -69,9 +69,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -107,7 +107,7 @@ Project Information - +
  • @@ -163,7 +163,7 @@

    Full name:

    -

    org.owasp:dependency-check-maven:1.1.4:help

    +

    org.owasp:dependency-check-maven:1.2.0:help

    Description:

    diff --git a/dependency-check-maven/index.html b/dependency-check-maven/index.html index 33cf42f71..81ac63c9e 100644 --- a/dependency-check-maven/index.html +++ b/dependency-check-maven/index.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-maven/license.html b/dependency-check-maven/license.html index f2fdada0a..5dd52d947 100644 --- a/dependency-check-maven/license.html +++ b/dependency-check-maven/license.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project License @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-maven/plugin-info.html b/dependency-check-maven/plugin-info.html index 30c10fb33..45a348f52 100644 --- a/dependency-check-maven/plugin-info.html +++ b/dependency-check-maven/plugin-info.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Plugin Documentation @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • @@ -293,7 +279,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> </plugin> ... </plugins> @@ -303,7 +289,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> </plugin> ... </plugins> @@ -315,7 +301,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> </plugin> ... </plugins> diff --git a/dependency-check-maven/plugin-updates-report.html b/dependency-check-maven/plugin-updates-report.html index f6ba44fb9..747e88d74 100644 --- a/dependency-check-maven/plugin-updates-report.html +++ b/dependency-check-maven/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Plugin Updates Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • diff --git a/dependency-check-maven/project-info.html b/dependency-check-maven/project-info.html index 1013eddd7..34cb33e1a 100644 --- a/dependency-check-maven/project-info.html +++ b/dependency-check-maven/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Information @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • diff --git a/dependency-check-maven/project-reports.html b/dependency-check-maven/project-reports.html index 0ddcef943..6c6976693 100644 --- a/dependency-check-maven/project-reports.html +++ b/dependency-check-maven/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Generated Reports @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • Project Reports @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • @@ -285,12 +271,6 @@
  • - - - - - -
    org.owasp dependency-check-core1.1.41.2.0 compile jardependency-check-core
    Current Version1.1.4
    1.2.0
    Scope compile
    Checkstyle Report on coding style conventions.
    CPD ReportDuplicate code detection.
    PMD ReportVerification of coding rules.
    FindBugs Report Generates a source code report with the FindBugs Library.
    diff --git a/dependency-check-maven/project-summary.html b/dependency-check-maven/project-summary.html index 6564d9b9c..841c48ae9 100644 --- a/dependency-check-maven/project-summary.html +++ b/dependency-check-maven/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Summary @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -196,7 +196,7 @@ dependency-check-jenkins Version -1.1.4 +1.2.0 Type pom diff --git a/dependency-check-maven/surefire-report.html b/dependency-check-maven/surefire-report.html index 4f20b966e..f6b5d8552 100644 --- a/dependency-check-maven/surefire-report.html +++ b/dependency-check-maven/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Surefire Report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • @@ -265,7 +251,8 @@ function toggleDisplay(elementId) {
    -

    Summary


    +

    Summary

    +

    [Summary] [Package List] [Test Cases]


    @@ -275,13 +262,65 @@ function toggleDisplay(elementId) { + - - -
    TestsSuccess Rate Time
    1 0 0 000%0

    +100% +0.078

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    +
    +

    Package List

    +

    [Summary] [Package List] [Test Cases]


    + + + + + + + + + + + + + + + + +
    PackageTestsErrors FailuresSkippedSuccess RateTime
    org.owasp.dependencycheck.maven1000100%0.078

    +

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    +
    +

    org.owasp.dependencycheck.maven

    + + + + + + + + + + + + + + + + + + +
    ClassTestsErrors FailuresSkippedSuccess RateTime
    DependencyCheckMojoTest1000100%0.078

    +
    +

    Test Cases

    +

    [Summary] [Package List] [Test Cases]

    +
    +

    DependencyCheckMojoTest

    + + + + +
    testGenerate_Sink_SinkFactory_Locale0.001

    diff --git a/dependency-check-maven/taglist.html b/dependency-check-maven/taglist.html index 2cdd2e0d0..ffdd40a16 100644 --- a/dependency-check-maven/taglist.html +++ b/dependency-check-maven/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Tag List report @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -105,7 +105,7 @@ Project Information - +
  • @@ -181,20 +181,6 @@ Checkstyle
  • -
  • - - - - CPD Report -
  • - -
  • - - - - PMD Report -
  • -
  • diff --git a/dependency-check-maven/usage.html b/dependency-check-maven/usage.html index 8e1e1e6ff..e606fec96 100644 --- a/dependency-check-maven/usage.html +++ b/dependency-check-maven/usage.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Usage @@ -54,7 +54,7 @@
  • - + /
  • @@ -67,9 +67,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -103,7 +103,7 @@ Project Information - +
  • @@ -169,7 +169,7 @@ <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> <executions> <execution> <goals> @@ -197,7 +197,7 @@ <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> <configuration> <failBuildOnCVSS>8</failBuildOnCVSS> </configuration> @@ -233,7 +233,7 @@ <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> <configuration> <externalReport>false</externalReport> </configuration> @@ -260,7 +260,7 @@ <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> <configuration> <skipProvidedScope>true</skipProvidedScope> <skipRuntimeScope>true</skipRuntimeScope> @@ -292,7 +292,7 @@ <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.1.4</version> + <version>1.2.0</version> <configuration> <cveUrl12Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-modified.xml</cveUrl12Modified> <cveUrl20Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-2.0-modified.xml</cveUrl20Modified> diff --git a/dependency-check-maven/xref-test/index.html b/dependency-check-maven/xref-test/index.html index 5492a5cd6..de3fb3241 100644 --- a/dependency-check-maven/xref-test/index.html +++ b/dependency-check-maven/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference + Dependency-Check Maven Plugin 1.2.0 Reference diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html index 5175523d1..864a78901 100644 --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.2.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html index 4adfe3947..d771f33f4 100644 --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.2.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref-test/overview-frame.html b/dependency-check-maven/xref-test/overview-frame.html index ac0f28839..e1b596024 100644 --- a/dependency-check-maven/xref-test/overview-frame.html +++ b/dependency-check-maven/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference + Dependency-Check Maven Plugin 1.2.0 Reference diff --git a/dependency-check-maven/xref-test/overview-summary.html b/dependency-check-maven/xref-test/overview-summary.html index 19fc8889a..7bf35700a 100644 --- a/dependency-check-maven/xref-test/overview-summary.html +++ b/dependency-check-maven/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference + Dependency-Check Maven Plugin 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Maven Plugin 1.1.4 Reference

    +

    Dependency-Check Maven Plugin 1.2.0 Reference

    diff --git a/dependency-check-maven/xref/index.html b/dependency-check-maven/xref/index.html index 5492a5cd6..de3fb3241 100644 --- a/dependency-check-maven/xref/index.html +++ b/dependency-check-maven/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference + Dependency-Check Maven Plugin 1.2.0 Reference diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html index eb1060507..db9043ebb 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html @@ -78,317 +78,317 @@ 70publicclassDependencyCheckMojoextends AbstractMojo implements MavenMultiPageReport { 7172/** -73 * The properties file location. +73 * Logger field reference.74 */ -75privatestaticfinal String PROPERTIES_FILE = "mojo.properties"; -76/** -77 * Name of the logging properties file. -78 */ -79privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; -80/** -81 * System specific new line character. -82 */ -83privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); -84// <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components"> +75privatefinal Logger logger = Logger.getLogger(DependencyCheckMojo.class.getName()); +76 +77/** +78 * The properties file location. +79 */ +80privatestaticfinal String PROPERTIES_FILE = "mojo.properties"; +81/** +82 * Name of the logging properties file. +83 */ +84privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; 85/** -86 * The Maven Project Object. +86 * System specific new line character.87 */ -88 @Component -89private MavenProject project; +88privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); +89// <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">90/** -91 * The path to the verbose log. +91 * The Maven Project Object.92 */ -93 @Parameter(property = "logfile", defaultValue = "") -94private String logFile; +93 @Component +94private MavenProject project; 95/** -96 * The name of the report to be displayed in the Maven Generated Reports page. +96 * The path to the verbose log.97 */ -98 @Parameter(property = "name", defaultValue = "Dependency-Check") -99private String name; +98 @Parameter(property = "logfile", defaultValue = "") +99private String logFile; 100/** -101 * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page. +101 * The name of the report to be displayed in the Maven Generated Reports page.102 */ -103 @Parameter(property = "description", defaultValue = "A report providing details on any published " -104 + "vulnerabilities within project dependencies. This report is a best effort but may contain " -105 + "false positives and false negatives.") -106private String description; -107/** -108 * Specifies the destination directory for the generated Dependency-Check report. This generally maps to -109 * "target/site". -110 */ -111 @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true) -112private File reportOutputDirectory; -113/** -114 * The output directory. This generally maps to "target". +103 @Parameter(property = "name", defaultValue = "Dependency-Check") +104private String name; +105/** +106 * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page. +107 */ +108 @Parameter(property = "description", defaultValue = "A report providing details on any published " +109 + "vulnerabilities within project dependencies. This report is a best effort but may contain " +110 + "false positives and false negatives.") +111private String description; +112/** +113 * Specifies the destination directory for the generated Dependency-Check report. This generally maps to +114 * "target/site".115 */ -116 @Parameter(defaultValue = "${project.build.directory}", required = true) -117private File outputDirectory; +116 @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true) +117private File reportOutputDirectory; 118/** -119 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 -120 * which means since the CVSS scores are 0-10, by default the build will never fail. -121 */ -122 @SuppressWarnings("CanBeFinal") -123 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true) -124privatefloat failBuildOnCVSS = 11; -125/** -126 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to -127 * false. Default is true. -128 */ -129 @SuppressWarnings("CanBeFinal") -130 @Parameter(property = "autoupdate", defaultValue = "true", required = true) -131privateboolean autoUpdate = true; -132/** -133 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this -134 * within the Site plugin unless the externalReport is set to true. Default is HTML. -135 */ -136 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -137 @Parameter(property = "format", defaultValue = "HTML", required = true) -138private String format = "HTML"; -139/** -140 * Sets whether or not the external report format should be used. -141 */ -142 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -143 @Parameter(property = "externalReport", defaultValue = "false", required = true) -144privateboolean externalReport = false; -145/** -146 * The Proxy URL. -147 * -148 * @deprecated Please use mavenSettings instead -149 */ -150 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -151 @Parameter(property = "proxyUrl", defaultValue = "", required = false) -152 @Deprecated -153private String proxyUrl = null; -154 -155/** -156 * The maven settings. -157 */ -158 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -159 @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false) -160private org.apache.maven.settings.Settings mavenSettings; -161 -162/** -163 * The maven settings proxy id. -164 */ -165 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -166 @Parameter(property = "mavenSettingsProxyId", required = false) -167private String mavenSettingsProxyId; -168 -169/** -170 * The Proxy Port. -171 * -172 * @deprecated Please use mavenSettings instead -173 */ -174 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -175 @Parameter(property = "proxyPort", defaultValue = "", required = false) -176 @Deprecated -177private String proxyPort = null; -178/** -179 * The Proxy username. -180 * -181 * @deprecated Please use mavenSettings instead -182 */ -183 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -184 @Parameter(property = "proxyUsername", defaultValue = "", required = false) -185 @Deprecated -186private String proxyUsername = null; -187/** -188 * The Proxy password. -189 * -190 * @deprecated Please use mavenSettings instead -191 */ -192 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -193 @Parameter(property = "proxyPassword", defaultValue = "", required = false) -194 @Deprecated -195private String proxyPassword = null; -196/** -197 * The Connection Timeout. -198 */ -199 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -200 @Parameter(property = "connectionTimeout", defaultValue = "", required = false) -201private String connectionTimeout = null; -202/** -203 * The Connection Timeout. -204 */ -205 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -206 @Parameter(property = "suppressionFile", defaultValue = "", required = false) -207private String suppressionFile = null; -208/** -209 * Flag indicating whether or not to show a summary in the output. -210 */ -211 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -212 @Parameter(property = "showSummary", defaultValue = "true", required = false) -213privateboolean showSummary = true; -214 -215/** -216 * Whether or not the Jar Analyzer is enabled. -217 */ -218 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -219 @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false) -220privateboolean jarAnalyzerEnabled = true; -221 -222/** -223 * Whether or not the Archive Analyzer is enabled. -224 */ -225 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -226 @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false) -227privateboolean archiveAnalyzerEnabled = true; -228 -229/** -230 * Whether or not the .NET Assembly Analyzer is enabled. -231 */ -232 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -233 @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false) -234privateboolean assemblyAnalyzerEnabled = true; -235 -236/** -237 * Whether or not the .NET Nuspec Analyzer is enabled. -238 */ -239 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -240 @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false) -241privateboolean nuspecAnalyzerEnabled = true; -242 -243/** -244 * Whether or not the Nexus Analyzer is enabled. -245 */ -246 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -247 @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false) -248privateboolean nexusAnalyzerEnabled = true; -249/** -250 * Whether or not the Nexus Analyzer is enabled. -251 */ -252 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -253 @Parameter(property = "nexusUrl", defaultValue = "", required = false) -254private String nexusUrl; -255/** -256 * Whether or not the configured proxy is used to connect to Nexus. -257 */ -258 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -259 @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false) -260privateboolean nexusUsesProxy = true; -261/** -262 * The database connection string. -263 */ -264 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -265 @Parameter(property = "connectionString", defaultValue = "", required = false) -266private String connectionString; -267/** -268 * The database driver name. An example would be org.h2.Driver. -269 */ -270 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -271 @Parameter(property = "databaseDriverName", defaultValue = "", required = false) -272private String databaseDriverName; -273/** -274 * The path to the database driver if it is not on the class path. -275 */ -276 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -277 @Parameter(property = "databaseDriverPath", defaultValue = "", required = false) -278private String databaseDriverPath; -279/** -280 * The database user name. -281 */ -282 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -283 @Parameter(property = "databaseUser", defaultValue = "", required = false) -284private String databaseUser; -285/** -286 * The password to use when connecting to the database. -287 */ -288 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -289 @Parameter(property = "databasePassword", defaultValue = "", required = false) -290private String databasePassword; -291/** -292 * A comma-separated list of file extensions to add to analysis next to jar, zip, .... -293 */ -294 @Parameter(property = "zipExtensions", required = false) -295private String zipExtensions; +119 * The output directory. This generally maps to "target". +120 */ +121 @Parameter(defaultValue = "${project.build.directory}", required = true) +122private File outputDirectory; +123/** +124 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 +125 * which means since the CVSS scores are 0-10, by default the build will never fail. +126 */ +127 @SuppressWarnings("CanBeFinal") +128 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true) +129privatefloat failBuildOnCVSS = 11; +130/** +131 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to +132 * false. Default is true. +133 */ +134 @SuppressWarnings("CanBeFinal") +135 @Parameter(property = "autoupdate", defaultValue = "true", required = true) +136privateboolean autoUpdate = true; +137/** +138 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this +139 * within the Site plugin unless the externalReport is set to true. Default is HTML. +140 */ +141 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +142 @Parameter(property = "format", defaultValue = "HTML", required = true) +143private String format = "HTML"; +144/** +145 * Sets whether or not the external report format should be used. +146 */ +147 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +148 @Parameter(property = "externalReport", defaultValue = "false", required = true) +149privateboolean externalReport = false; +150/** +151 * The Proxy URL. +152 * +153 * @deprecated Please use mavenSettings instead +154 */ +155 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +156 @Parameter(property = "proxyUrl", defaultValue = "", required = false) +157 @Deprecated +158private String proxyUrl = null; +159 +160/** +161 * The maven settings. +162 */ +163 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +164 @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false) +165private org.apache.maven.settings.Settings mavenSettings; +166 +167/** +168 * The maven settings proxy id. +169 */ +170 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +171 @Parameter(property = "mavenSettingsProxyId", required = false) +172private String mavenSettingsProxyId; +173 +174/** +175 * The Proxy Port. +176 * +177 * @deprecated Please use mavenSettings instead +178 */ +179 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +180 @Parameter(property = "proxyPort", defaultValue = "", required = false) +181 @Deprecated +182private String proxyPort = null; +183/** +184 * The Proxy username. +185 * +186 * @deprecated Please use mavenSettings instead +187 */ +188 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +189 @Parameter(property = "proxyUsername", defaultValue = "", required = false) +190 @Deprecated +191private String proxyUsername = null; +192/** +193 * The Proxy password. +194 * +195 * @deprecated Please use mavenSettings instead +196 */ +197 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +198 @Parameter(property = "proxyPassword", defaultValue = "", required = false) +199 @Deprecated +200private String proxyPassword = null; +201/** +202 * The Connection Timeout. +203 */ +204 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +205 @Parameter(property = "connectionTimeout", defaultValue = "", required = false) +206private String connectionTimeout = null; +207/** +208 * The path to the suppression file. +209 */ +210 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +211 @Parameter(property = "suppressionFile", defaultValue = "", required = false) +212private String suppressionFile = null; +213/** +214 * Flag indicating whether or not to show a summary in the output. +215 */ +216 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +217 @Parameter(property = "showSummary", defaultValue = "true", required = false) +218privateboolean showSummary = true; +219 +220/** +221 * Whether or not the Jar Analyzer is enabled. +222 */ +223 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +224 @Parameter(property = "jarAnalyzerEnabled", defaultValue = "true", required = false) +225privateboolean jarAnalyzerEnabled = true; +226 +227/** +228 * Whether or not the Archive Analyzer is enabled. +229 */ +230 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +231 @Parameter(property = "archiveAnalyzerEnabled", defaultValue = "true", required = false) +232privateboolean archiveAnalyzerEnabled = true; +233 +234/** +235 * Whether or not the .NET Assembly Analyzer is enabled. +236 */ +237 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +238 @Parameter(property = "assemblyAnalyzerEnabled", defaultValue = "true", required = false) +239privateboolean assemblyAnalyzerEnabled = true; +240 +241/** +242 * Whether or not the .NET Nuspec Analyzer is enabled. +243 */ +244 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +245 @Parameter(property = "nuspecAnalyzerEnabled", defaultValue = "true", required = false) +246privateboolean nuspecAnalyzerEnabled = true; +247 +248/** +249 * Whether or not the Nexus Analyzer is enabled. +250 */ +251 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +252 @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false) +253privateboolean nexusAnalyzerEnabled = true; +254/** +255 * Whether or not the Nexus Analyzer is enabled. +256 */ +257 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +258 @Parameter(property = "nexusUrl", defaultValue = "", required = false) +259private String nexusUrl; +260/** +261 * Whether or not the configured proxy is used to connect to Nexus. +262 */ +263 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +264 @Parameter(property = "nexusUsesProxy", defaultValue = "true", required = false) +265privateboolean nexusUsesProxy = true; +266/** +267 * The database connection string. +268 */ +269 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +270 @Parameter(property = "connectionString", defaultValue = "", required = false) +271private String connectionString; +272/** +273 * The database driver name. An example would be org.h2.Driver. +274 */ +275 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +276 @Parameter(property = "databaseDriverName", defaultValue = "", required = false) +277private String databaseDriverName; +278/** +279 * The path to the database driver if it is not on the class path. +280 */ +281 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +282 @Parameter(property = "databaseDriverPath", defaultValue = "", required = false) +283private String databaseDriverPath; +284/** +285 * The database user name. +286 */ +287 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +288 @Parameter(property = "databaseUser", defaultValue = "", required = false) +289private String databaseUser; +290/** +291 * The password to use when connecting to the database. +292 */ +293 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +294 @Parameter(property = "databasePassword", defaultValue = "", required = false) +295private String databasePassword; 296/** -297 * Skip Analisys for Test Scope Dependencies. +297 * A comma-separated list of file extensions to add to analysis next to jar, zip, ....298 */ -299 @SuppressWarnings("CanBeFinal") -300 @Parameter(property = "skipTestScope", defaultValue = "true", required = false) -301privateboolean skipTestScope = true; -302/** -303 * Skip Analisys for Runtime Scope Dependencies. -304 */ -305 @SuppressWarnings("CanBeFinal") -306 @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false) -307privateboolean skipRuntimeScope = false; -308/** -309 * Skip Analisys for Provided Scope Dependencies. -310 */ -311 @SuppressWarnings("CanBeFinal") -312 @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false) -313privateboolean skipProvidedScope = false; -314/** -315 * The data directory, hold DC SQL DB. -316 */ -317 @Parameter(property = "dataDirectory", defaultValue = "", required = false) -318private String dataDirectory; +299 @Parameter(property = "zipExtensions", required = false) +300private String zipExtensions; +301/** +302 * Skip Analysis for Test Scope Dependencies. +303 */ +304 @SuppressWarnings("CanBeFinal") +305 @Parameter(property = "skipTestScope", defaultValue = "true", required = false) +306privateboolean skipTestScope = true; +307/** +308 * Skip Analysis for Runtime Scope Dependencies. +309 */ +310 @SuppressWarnings("CanBeFinal") +311 @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false) +312privateboolean skipRuntimeScope = false; +313/** +314 * Skip Analysis for Provided Scope Dependencies. +315 */ +316 @SuppressWarnings("CanBeFinal") +317 @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false) +318privateboolean skipProvidedScope = false; 319/** -320 * Data Mirror URL for CVE 1.2. +320 * The data directory, hold DC SQL DB.321 */ -322 @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false) -323private String cveUrl12Modified; +322 @Parameter(property = "dataDirectory", defaultValue = "", required = false) +323private String dataDirectory; 324/** -325 * Data Mirror URL for CVE 2.0. +325 * Data Mirror URL for CVE 1.2.326 */ -327 @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false) -328private String cveUrl20Modified; +327 @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false) +328private String cveUrl12Modified; 329/** -330 * Base Data Mirror URL for CVE 1.2. +330 * Data Mirror URL for CVE 2.0.331 */ -332 @Parameter(property = "cveUrl12Base", defaultValue = "", required = false) -333private String cveUrl12Base; +332 @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false) +333private String cveUrl20Modified; 334/** -335 * Data Mirror URL for CVE 2.0. +335 * Base Data Mirror URL for CVE 1.2.336 */ -337 @Parameter(property = "cveUrl20Base", defaultValue = "", required = false) -338private String cveUrl20Base; -339 -340/** -341 * The path to mono for .NET Assembly analysis on non-windows systems. -342 */ -343 @Parameter(property = "pathToMono", defaultValue = "", required = false) -344private String pathToMono; -345 -346// </editor-fold> -347/** -348 * Executes the Dependency-Check on the dependent libraries. -349 * -350 * @return the Engine used to scan the dependencies. -351 * @throws DatabaseException thrown if there is an exception connecting to the database -352 */ -353private Engine executeDependencyCheck() throws DatabaseException { -354 -355final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -356 LogUtils.prepareLogger(in, logFile); -357 -358 populateSettings(); -359 Engine engine = null; -360try { -361 engine = new Engine(); -362final Set<Artifact> artifacts = project.getArtifacts(); -363for (Artifact a : artifacts) { -364if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) { -365continue; -366 } -367 -368if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) { -369continue; -370 } +337 @Parameter(property = "cveUrl12Base", defaultValue = "", required = false) +338private String cveUrl12Base; +339/** +340 * Data Mirror URL for CVE 2.0. +341 */ +342 @Parameter(property = "cveUrl20Base", defaultValue = "", required = false) +343private String cveUrl20Base; +344 +345/** +346 * The path to mono for .NET Assembly analysis on non-windows systems. +347 */ +348 @Parameter(property = "pathToMono", defaultValue = "", required = false) +349private String pathToMono; +350 +351// </editor-fold> +352/** +353 * Executes the Dependency-Check on the dependent libraries. +354 * +355 * @return the Engine used to scan the dependencies. +356 * @throws DatabaseException thrown if there is an exception connecting to the database +357 */ +358private Engine executeDependencyCheck() throws DatabaseException { +359 +360final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +361 LogUtils.prepareLogger(in, logFile); +362 +363 populateSettings(); +364final Engine engine = new Engine(); +365 +366final Set<Artifact> artifacts = project.getArtifacts(); +367for (Artifact a : artifacts) { +368if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) { +369continue; +370 } 371 -372if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) { -373continue; -374 } +372if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) { +373continue; +374 } 375 -376 engine.scan(a.getFile().getAbsolutePath()); -377 } -378 engine.analyzeDependencies(); -379 } finally { -380if (engine != null) { -381 engine.cleanup(); -382 } -383 } +376if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) { +377continue; +378 } +379 +380 engine.scan(a.getFile().getAbsolutePath()); +381 } +382 engine.analyzeDependencies(); +383384return engine; 385 } 386 @@ -406,7 +406,7 @@ 398 cve.open(); 399 prop = cve.getDatabaseProperties(); 400 } catch (DatabaseException ex) { -401 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); +401 logger.log(Level.FINE, "Unable to retrieve DB Properties", ex); 402 } finally { 403if (cve != null) { 404 cve.close(); @@ -416,13 +416,13 @@ 408try { 409 r.generateReports(outDirectory.getCanonicalPath(), format); 410 } catch (IOException ex) { -411 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, +411 logger.log(Level.SEVERE, 412"Unexpected exception occurred during analysis; please see the verbose error log for more details."); -413 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); +413 logger.log(Level.FINE, null, ex); 414 } catch (Throwable ex) { -415 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, +415 logger.log(Level.SEVERE, 416"Unexpected exception occurred during analysis; please see the verbose error log for more details."); -417 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); +417 logger.log(Level.FINE, null, ex); 418 } 419 } 420 @@ -811,7 +811,7 @@ 803 } elseif (proxies.size() == 1) { 804return proxies.get(0); 805 } else { -806thrownew IllegalStateException("Ambigous proxy definition"); +806thrownew IllegalStateException("Ambiguous proxy definition"); 807 } 808 } 809 } @@ -823,345 +823,345 @@ 815 * properties required to change the proxy url, port, and connection timeout.816 */817privatevoid populateSettings() { -818 InputStream mojoProperties = null; -819try { -820 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -821 Settings.mergeProperties(mojoProperties); -822 } catch (IOException ex) { -823 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); -824 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); -825 } finally { -826if (mojoProperties != null) { -827try { -828 mojoProperties.close(); -829 } catch (IOException ex) { -830 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex); -831 } -832 } -833 } -834 -835 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -836 -837final Proxy proxy = getMavenProxy(); -838if (proxy != null) { -839 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy)); -840 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort())); -841final String userName = proxy.getUsername(); -842final String password = proxy.getPassword(); -843if (userName != null && password != null) { -844 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName); -845 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password); -846 } -847 } -848 -849if (proxyUrl != null && !proxyUrl.isEmpty()) { -850 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); -851 } -852if (proxyPort != null && !proxyPort.isEmpty()) { -853 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); -854 } -855if (proxyUsername != null && !proxyUsername.isEmpty()) { -856 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); -857 } -858if (proxyPassword != null && !proxyPassword.isEmpty()) { -859 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); -860 } -861if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -862 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); -863 } -864if (suppressionFile != null && !suppressionFile.isEmpty()) { -865 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -866 } -867 -868//File Type Analyzer Settings -869//JAR ANALYZER -870 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled); -871//NUSPEC ANALYZER -872 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled); -873//NEXUS ANALYZER -874 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); -875if (nexusUrl != null && !nexusUrl.isEmpty()) { -876 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); -877 } -878 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); -879//ARCHIVE ANALYZER -880 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled); -881if (zipExtensions != null && !zipExtensions.isEmpty()) { -882 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); -883 } -884//ASSEMBLY ANALYZER -885 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled); -886if (pathToMono != null && !pathToMono.isEmpty()) { -887 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); -888 } -889 -890//Database configuration -891if (databaseDriverName != null && !databaseDriverName.isEmpty()) { -892 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); -893 } -894if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { -895 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); -896 } -897if (connectionString != null && !connectionString.isEmpty()) { -898 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); -899 } -900if (databaseUser != null && !databaseUser.isEmpty()) { -901 Settings.setString(Settings.KEYS.DB_USER, databaseUser); -902 } -903if (databasePassword != null && !databasePassword.isEmpty()) { -904 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); -905 } -906// Data Directory -907if (dataDirectory != null && !dataDirectory.isEmpty()) { -908 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -909 } -910 -911// Scope Exclusion -912 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope); -913 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope); -914 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope); -915 -916// CVE Data Mirroring -917if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { -918 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); -919 } -920if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { -921 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); -922 } -923if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { -924 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); -925 } -926if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { -927 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); -928 } -929 -930 } -931 -932/** -933 * Executes the dependency-check and generates the report. -934 * -935 * @throws MojoExecutionException if a maven exception occurs -936 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level -937 */ -938publicvoid execute() throws MojoExecutionException, MojoFailureException { -939 Engine engine = null; -940try { -941 engine = executeDependencyCheck(); -942 generateExternalReports(engine, outputDirectory); -943if (this.showSummary) { -944 showSummary(engine.getDependencies()); -945 } -946if (this.failBuildOnCVSS <= 10) { -947 checkForFailure(engine.getDependencies()); -948 } -949 } catch (DatabaseException ex) { -950 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, -951"Unable to connect to the dependency-check database; analysis has stopped"); -952 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "", ex); -953 } finally { -954if (engine != null) { -955 engine.cleanup(); -956 } -957 } -958 } -959 -960/** -961 * Generates the Dependency-Check Site Report. -962 * -963 * @param sink the sink to write the report to -964 * @param locale the locale to use when generating the report -965 * @throws MavenReportException if a Maven report exception occurs -966 */ -967publicvoid generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, -968 Locale locale) throws MavenReportException { -969 generate((Sink) sink, null, locale); -970 } -971 -972/** -973 * Generates the Dependency-Check Site Report. -974 * -975 * @param sink the sink to write the report to -976 * @param sinkFactory the sink factory -977 * @param locale the locale to use when generating the report -978 * @throws MavenReportException if a maven report exception occurs -979 */ -980publicvoid generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException { -981 Engine engine = null; -982try { -983 engine = executeDependencyCheck(); -984if (this.externalReport) { -985 generateExternalReports(engine, reportOutputDirectory); -986 } else { -987 generateMavenSiteReport(engine, sink); -988 } -989 } catch (DatabaseException ex) { -990 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, -991"Unable to connect to the dependency-check database; analysis has stopped"); -992 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "", ex); -993 } finally { -994if (engine != null) { -995 engine.cleanup(); -996 } -997 } -998 } -999 -1000// <editor-fold defaultstate="collapsed" desc="required setter/getter methods"> -1001/** -1002 * Returns the output name. -1003 * -1004 * @return the output name -1005 */ -1006public String getOutputName() { -1007if ("HTML".equalsIgnoreCase(this.format) -1008 || "ALL".equalsIgnoreCase(this.format)) { -1009return"dependency-check-report"; -1010 } elseif ("XML".equalsIgnoreCase(this.format)) { -1011return"dependency-check-report.xml#"; -1012 } elseif ("VULN".equalsIgnoreCase(this.format)) { -1013return"dependency-check-vulnerability"; -1014 } else { -1015 Logger.getLogger(DependencyCheckMojo.class -1016 .getName()).log(Level.WARNING, "Unknown report format used during site generatation."); -1017return"dependency-check-report"; -1018 } -1019 } -1020 -1021/** -1022 * Returns the category name. -1023 * -1024 * @return the category name -1025 */ -1026public String getCategoryName() { -1027return MavenReport.CATEGORY_PROJECT_REPORTS; -1028 } -1029 -1030/** -1031 * Returns the report name. -1032 * -1033 * @param locale the location -1034 * @return the report name -1035 */ -1036public String getName(Locale locale) { -1037return name; -1038 } -1039 -1040/** -1041 * Sets the Reporting output directory. -1042 * -1043 * @param directory the output directory -1044 */ -1045publicvoid setReportOutputDirectory(File directory) { -1046 reportOutputDirectory = directory; -1047 } -1048 -1049/** -1050 * Returns the output directory. -1051 * -1052 * @return the output directory -1053 */ -1054public File getReportOutputDirectory() { -1055return reportOutputDirectory; -1056 } -1057 -1058/** -1059 * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page. -1060 * -1061 * @param locale The Locale to get the description for -1062 * @return the description -1063 */ -1064public String getDescription(Locale locale) { -1065return description; -1066 } -1067 -1068/** -1069 * Returns whether this is an external report. -1070 * -1071 * @return true or false; -1072 */ -1073publicboolean isExternalReport() { -1074return externalReport; -1075 } -1076 -1077/** -1078 * Returns whether or not the plugin can generate a report. -1079 * -1080 * @return true -1081 */ -1082publicboolean canGenerateReport() { -1083returntrue; -1084 } -1085// </editor-fold> -1086 -1087/** -1088 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the -1089 * configuration. -1090 * -1091 * @param dependencies the list of dependency objects -1092 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set -1093 */ -1094privatevoid checkForFailure(List<Dependency> dependencies) throws MojoFailureException { -1095final StringBuilder ids = new StringBuilder(); -1096for (Dependency d : dependencies) { -1097boolean addName = true; -1098for (Vulnerability v : d.getVulnerabilities()) { -1099if (v.getCvssScore() >= failBuildOnCVSS) { -1100if (addName) { -1101 addName = false; -1102 ids.append(NEW_LINE).append(d.getFileName()).append(": "); -1103 ids.append(v.getName()); -1104 } else { -1105 ids.append(", ").append(v.getName()); -1106 } -1107 } -1108 } -1109 } -1110if (ids.length() > 0) { -1111final String msg = String.format("%n%nDependency-Check Failure:%n" -1112 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" -1113 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); -1114thrownew MojoFailureException(msg); -1115 } -1116 } -1117 -1118/** -1119 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. -1120 * -1121 * @param dependencies a list of dependency objects -1122 */ -1123privatevoid showSummary(List<Dependency> dependencies) { -1124final StringBuilder summary = new StringBuilder(); -1125for (Dependency d : dependencies) { -1126boolean firstEntry = true; -1127final StringBuilder ids = new StringBuilder(); -1128for (Vulnerability v : d.getVulnerabilities()) { -1129if (firstEntry) { -1130 firstEntry = false; -1131 } else { -1132 ids.append(", "); -1133 } -1134 ids.append(v.getName()); -1135 } -1136if (ids.length() > 0) { -1137 summary.append(d.getFileName()).append(" ("); -1138 firstEntry = true; -1139for (Identifier id : d.getIdentifiers()) { -1140if (firstEntry) { -1141 firstEntry = false; -1142 } else { -1143 summary.append(", "); -1144 } -1145 summary.append(id.getValue()); -1146 } -1147 summary.append(") : ").append(ids).append(NEW_LINE); -1148 } -1149 } -1150if (summary.length() > 0) { -1151final String msg = String.format("%n%n" -1152 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" -1153 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); -1154 Logger -1155 .getLogger(DependencyCheckMojo.class -1156 .getName()).log(Level.WARNING, msg); +818 Settings.initialize(); +819 InputStream mojoProperties = null; +820try { +821 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +822 Settings.mergeProperties(mojoProperties); +823 } catch (IOException ex) { +824 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); +825 logger.log(Level.FINE, null, ex); +826 } finally { +827if (mojoProperties != null) { +828try { +829 mojoProperties.close(); +830 } catch (IOException ex) { +831 logger.log(Level.FINEST, null, ex); +832 } +833 } +834 } +835 +836 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +837 +838final Proxy proxy = getMavenProxy(); +839if (proxy != null) { +840 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy)); +841 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort())); +842final String userName = proxy.getUsername(); +843final String password = proxy.getPassword(); +844if (userName != null && password != null) { +845 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName); +846 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password); +847 } +848 } +849 +850if (proxyUrl != null && !proxyUrl.isEmpty()) { +851 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +852 } +853if (proxyPort != null && !proxyPort.isEmpty()) { +854 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +855 } +856if (proxyUsername != null && !proxyUsername.isEmpty()) { +857 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); +858 } +859if (proxyPassword != null && !proxyPassword.isEmpty()) { +860 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); +861 } +862if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +863 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +864 } +865if (suppressionFile != null && !suppressionFile.isEmpty()) { +866 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +867 } +868 +869//File Type Analyzer Settings +870//JAR ANALYZER +871 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled); +872//NUSPEC ANALYZER +873 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled); +874//NEXUS ANALYZER +875 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); +876if (nexusUrl != null && !nexusUrl.isEmpty()) { +877 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +878 } +879 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy); +880//ARCHIVE ANALYZER +881 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled); +882if (zipExtensions != null && !zipExtensions.isEmpty()) { +883 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); +884 } +885//ASSEMBLY ANALYZER +886 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled); +887if (pathToMono != null && !pathToMono.isEmpty()) { +888 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono); +889 } +890 +891//Database configuration +892if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +893 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +894 } +895if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +896 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +897 } +898if (connectionString != null && !connectionString.isEmpty()) { +899 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +900 } +901if (databaseUser != null && !databaseUser.isEmpty()) { +902 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +903 } +904if (databasePassword != null && !databasePassword.isEmpty()) { +905 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +906 } +907// Data Directory +908if (dataDirectory != null && !dataDirectory.isEmpty()) { +909 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +910 } +911 +912// Scope Exclusion +913 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope); +914 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope); +915 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope); +916 +917// CVE Data Mirroring +918if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { +919 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); +920 } +921if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { +922 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); +923 } +924if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { +925 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); +926 } +927if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { +928 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); +929 } +930 +931 } +932 +933/** +934 * Executes the dependency-check and generates the report. +935 * +936 * @throws MojoExecutionException if a maven exception occurs +937 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level +938 */ +939publicvoid execute() throws MojoExecutionException, MojoFailureException { +940 Engine engine = null; +941try { +942 engine = executeDependencyCheck(); +943 generateExternalReports(engine, outputDirectory); +944if (this.showSummary) { +945 showSummary(engine.getDependencies()); +946 } +947if (this.failBuildOnCVSS <= 10) { +948 checkForFailure(engine.getDependencies()); +949 } +950 } catch (DatabaseException ex) { +951 logger.log(Level.SEVERE, +952"Unable to connect to the dependency-check database; analysis has stopped"); +953 logger.log(Level.FINE, "", ex); +954 } finally { +955 Settings.cleanup(); +956if (engine != null) { +957 engine.cleanup(); +958 } +959 } +960 } +961 +962/** +963 * Generates the Dependency-Check Site Report. +964 * +965 * @param sink the sink to write the report to +966 * @param locale the locale to use when generating the report +967 * @throws MavenReportException if a Maven report exception occurs +968 */ +969publicvoid generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, +970 Locale locale) throws MavenReportException { +971 generate((Sink) sink, null, locale); +972 } +973 +974/** +975 * Generates the Dependency-Check Site Report. +976 * +977 * @param sink the sink to write the report to +978 * @param sinkFactory the sink factory +979 * @param locale the locale to use when generating the report +980 * @throws MavenReportException if a maven report exception occurs +981 */ +982publicvoid generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException { +983 Engine engine = null; +984try { +985 engine = executeDependencyCheck(); +986if (this.externalReport) { +987 generateExternalReports(engine, reportOutputDirectory); +988 } else { +989 generateMavenSiteReport(engine, sink); +990 } +991 } catch (DatabaseException ex) { +992 logger.log(Level.SEVERE, +993"Unable to connect to the dependency-check database; analysis has stopped"); +994 logger.log(Level.FINE, "", ex); +995 } finally { +996 Settings.cleanup(); +997if (engine != null) { +998 engine.cleanup(); +999 } +1000 } +1001 } +1002 +1003// <editor-fold defaultstate="collapsed" desc="required setter/getter methods"> +1004/** +1005 * Returns the output name. +1006 * +1007 * @return the output name +1008 */ +1009public String getOutputName() { +1010if ("HTML".equalsIgnoreCase(this.format) +1011 || "ALL".equalsIgnoreCase(this.format)) { +1012return"dependency-check-report"; +1013 } elseif ("XML".equalsIgnoreCase(this.format)) { +1014return"dependency-check-report.xml#"; +1015 } elseif ("VULN".equalsIgnoreCase(this.format)) { +1016return"dependency-check-vulnerability"; +1017 } else { +1018 logger.log(Level.WARNING, "Unknown report format used during site generation."); +1019return"dependency-check-report"; +1020 } +1021 } +1022 +1023/** +1024 * Returns the category name. +1025 * +1026 * @return the category name +1027 */ +1028public String getCategoryName() { +1029return MavenReport.CATEGORY_PROJECT_REPORTS; +1030 } +1031 +1032/** +1033 * Returns the report name. +1034 * +1035 * @param locale the location +1036 * @return the report name +1037 */ +1038public String getName(Locale locale) { +1039return name; +1040 } +1041 +1042/** +1043 * Sets the Reporting output directory. +1044 * +1045 * @param directory the output directory +1046 */ +1047publicvoid setReportOutputDirectory(File directory) { +1048 reportOutputDirectory = directory; +1049 } +1050 +1051/** +1052 * Returns the output directory. +1053 * +1054 * @return the output directory +1055 */ +1056public File getReportOutputDirectory() { +1057return reportOutputDirectory; +1058 } +1059 +1060/** +1061 * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page. +1062 * +1063 * @param locale The Locale to get the description for +1064 * @return the description +1065 */ +1066public String getDescription(Locale locale) { +1067return description; +1068 } +1069 +1070/** +1071 * Returns whether this is an external report. +1072 * +1073 * @return true or false; +1074 */ +1075publicboolean isExternalReport() { +1076return externalReport; +1077 } +1078 +1079/** +1080 * Returns whether or not the plugin can generate a report. +1081 * +1082 * @return true +1083 */ +1084publicboolean canGenerateReport() { +1085returntrue; +1086 } +1087// </editor-fold> +1088 +1089/** +1090 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the +1091 * configuration. +1092 * +1093 * @param dependencies the list of dependency objects +1094 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set +1095 */ +1096privatevoid checkForFailure(List<Dependency> dependencies) throws MojoFailureException { +1097final StringBuilder ids = new StringBuilder(); +1098for (Dependency d : dependencies) { +1099boolean addName = true; +1100for (Vulnerability v : d.getVulnerabilities()) { +1101if (v.getCvssScore() >= failBuildOnCVSS) { +1102if (addName) { +1103 addName = false; +1104 ids.append(NEW_LINE).append(d.getFileName()).append(": "); +1105 ids.append(v.getName()); +1106 } else { +1107 ids.append(", ").append(v.getName()); +1108 } +1109 } +1110 } +1111 } +1112if (ids.length() > 0) { +1113final String msg = String.format("%n%nDependency-Check Failure:%n" +1114 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" +1115 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); +1116thrownew MojoFailureException(msg); +1117 } +1118 } +1119 +1120/** +1121 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. +1122 * +1123 * @param dependencies a list of dependency objects +1124 */ +1125privatevoid showSummary(List<Dependency> dependencies) { +1126final StringBuilder summary = new StringBuilder(); +1127for (Dependency d : dependencies) { +1128boolean firstEntry = true; +1129final StringBuilder ids = new StringBuilder(); +1130for (Vulnerability v : d.getVulnerabilities()) { +1131if (firstEntry) { +1132 firstEntry = false; +1133 } else { +1134 ids.append(", "); +1135 } +1136 ids.append(v.getName()); +1137 } +1138if (ids.length() > 0) { +1139 summary.append(d.getFileName()).append(" ("); +1140 firstEntry = true; +1141for (Identifier id : d.getIdentifiers()) { +1142if (firstEntry) { +1143 firstEntry = false; +1144 } else { +1145 summary.append(", "); +1146 } +1147 summary.append(id.getValue()); +1148 } +1149 summary.append(") : ").append(ids).append(NEW_LINE); +1150 } +1151 } +1152if (summary.length() > 0) { +1153final String msg = String.format("%n%n" +1154 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" +1155 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); +1156 logger.log(Level.WARNING, msg); 1157 } 1158 } 1159 } diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html index 4e0df994c..d55141514 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.2.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html index 17b6787d3..5da2efb8a 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.2.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref/overview-frame.html b/dependency-check-maven/xref/overview-frame.html index ac0f28839..e1b596024 100644 --- a/dependency-check-maven/xref/overview-frame.html +++ b/dependency-check-maven/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference + Dependency-Check Maven Plugin 1.2.0 Reference diff --git a/dependency-check-maven/xref/overview-summary.html b/dependency-check-maven/xref/overview-summary.html index 19fc8889a..7bf35700a 100644 --- a/dependency-check-maven/xref/overview-summary.html +++ b/dependency-check-maven/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.1.4 Reference + Dependency-Check Maven Plugin 1.2.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Maven Plugin 1.1.4 Reference

    +

    Dependency-Check Maven Plugin 1.2.0 Reference

    diff --git a/index.html b/index.html index 47d563a7b..124f7ab86 100644 --- a/index.html +++ b/index.html @@ -1,13 +1,13 @@ - + dependency-check - About @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/issue-tracking.html b/issue-tracking.html index 74b2f9a99..4d1bf3ced 100644 --- a/issue-tracking.html +++ b/issue-tracking.html @@ -1,13 +1,13 @@ - + dependency-check - Issue Tracking @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/license.html b/license.html index 9c491232c..e79a8292d 100644 --- a/license.html +++ b/license.html @@ -1,13 +1,13 @@ - + dependency-check - Project License @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/mail-lists.html b/mail-lists.html index 5d71b2d88..04cb418b8 100644 --- a/mail-lists.html +++ b/mail-lists.html @@ -1,13 +1,13 @@ - + dependency-check - Project Mailing Lists @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/modules.html b/modules.html index 93e2db120..a4865b1ec 100644 --- a/modules.html +++ b/modules.html @@ -1,13 +1,13 @@ - + dependency-check - Project Modules @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/project-info.html b/project-info.html index fd45b0e3a..7ea7e0c13 100644 --- a/project-info.html +++ b/project-info.html @@ -1,13 +1,13 @@ - + dependency-check - Project Information @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/project-summary.html b/project-summary.html index 2f21c789f..efb8b9aa7 100644 --- a/project-summary.html +++ b/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check - Project Summary @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • @@ -291,7 +298,7 @@ - +
    dependency-check-parent
    Version1.1.4
    1.2.0
    Type pom
    diff --git a/source-repository.html b/source-repository.html index e1202f37d..b7ed47224 100644 --- a/source-repository.html +++ b/source-repository.html @@ -1,13 +1,13 @@ - + dependency-check - Source Repository @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/suppression.html b/suppression.html index ea39143d0..2eec36ed1 100644 --- a/suppression.html +++ b/suppression.html @@ -1,13 +1,13 @@ - + dependency-check - Suppressing False Positives @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -111,6 +111,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer
  • diff --git a/team-list.html b/team-list.html index cd20c2a73..cc34088e3 100644 --- a/team-list.html +++ b/team-list.html @@ -1,13 +1,13 @@ - + dependency-check - Team list @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-03-29
  • +
  • | Last Published: 2014-04-28
  • - Version: 1.1.4 + Version: 1.2.0
  • @@ -169,6 +169,13 @@ Sample Report + + +
  • + + + + Nexus Analyzer