-
-
File: 197,
- Errors: 7,
+ <title>File: 203,
+ Errors: 6,
Warnings: 0,
Infos: 0
@@ -127,6 +127,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -186,7 +200,7 @@ under the License.
- org/owasp/dependencycheck/utils/LogUtils.java
+ dependency-check-ant/target/generated-classes/cobertura/task.properties
0
@@ -239,20 +253,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/URLConnectionFactory.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -323,6 +323,20 @@ under the License.
0
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -351,20 +365,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/DownloadFailedException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -449,6 +449,20 @@ under the License.
0
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/taskdefs.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -687,6 +701,20 @@ under the License.
0
+
+
+
+ org/owasp/dependencycheck/data/update/task/DownloadTask.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -701,6 +729,20 @@ under the License.
0
+
+
+
+ dependency-check-utils/src/test/resources/dependencycheck.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -729,6 +771,20 @@ under the License.
0
+
+
+
+ dependency-check-cli/target/generated-classes/cobertura/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -813,34 +869,6 @@ under the License.
2
-
-
-
- org/owasp/dependencycheck/utils/InvalidSettingException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
-
-
-
- org/owasp/dependencycheck/utils/Downloader.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -925,20 +953,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/LogFilter.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -995,6 +1009,34 @@ under the License.
0
+
+
+
+ dependency-check-utils/src/test/resources/test.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -1065,6 +1107,20 @@ under the License.
0
+
+
+
+ org/owasp/dependencycheck/utils/ExtractionUtil.java
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -1124,7 +1180,7 @@ under the License.
- org/owasp/dependencycheck/utils/URLConnectionFailureException.java
+ org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
0
@@ -1138,7 +1194,21 @@ under the License.
- org/owasp/dependencycheck/jaxb/pom/generated/Organization.java
+ dependency-check-cli/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-ant/target/generated-classes/cobertura/log.properties
0
@@ -1359,20 +1429,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/ExtractionException.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1457,20 +1513,6 @@ under the License.
0
-
-
-
- dependency-check-maven/target/classes/log.properties
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1499,6 +1541,34 @@ under the License.
0
+
+
+
+ dependency-check-maven/target/classes/log.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-maven/target/generated-classes/cobertura/mojo.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -1555,20 +1625,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/FileUtils.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1637,7 +1693,7 @@ under the License.
0
- 1
+ 0
@@ -1653,20 +1709,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/data/update/task/CallableDownloadTask.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -1695,20 +1737,6 @@ under the License.
0
-
-
-
- org/owasp/dependencycheck/utils/Settings.java
-
-
- 0
-
-
- 0
-
-
- 0
-
@@ -2003,6 +2031,20 @@ under the License.
0
+
+
+
+ dependency-check-utils/target/test-classes/dependencycheck.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -2017,6 +2059,34 @@ under the License.
0
+
+
+
+ dependency-check-utils/target/generated-classes/cobertura/cobertura.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
+
+
+
+ dependency-check-utils/target/maven-archiver/pom.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
@@ -2479,6 +2549,20 @@ under the License.
0
+
+
+
+ dependency-check-utils/target/test-classes/test.properties
+
+
+ 0
+
+
+ 0
+
+
+ 0
+
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html
index 94fbbf88c..df594246b 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html
@@ -21,7 +21,7 @@ org.owasp.dependencycheck.analyzer
AbstractFileTypeAnalyzer (74%)
-AbstractSuppressionAnalyzer (84%) AbstractSuppressionAnalyzer (82%)
AnalysisPhase (100%) ArchiveAnalyzer (31%)
-AssemblyAnalyzer (68%) AssemblyAnalyzer (66%)
-CPEAnalyzer (81%) CPEAnalyzer (80%)
-CpeSuppressionAnalyzer (55%) CpeSuppressionAnalyzer (88%)
DependencyBundlingAnalyzer (34%)
-FalsePositiveAnalyzer (48%) FalsePositiveAnalyzer (50%)
FileNameAnalyzer (85%) HintAnalyzer (76%)
-JarAnalyzer (53%) JarAnalyzer (60%)
JavaScriptAnalyzer (26%)
-NexusAnalyzer (15%) NexusAnalyzer (12%)
NuspecAnalyzer (20%) NvdCveAnalyzer (67%)
-VulnerabilitySuppressionAnalyzer (55%) VulnerabilitySuppressionAnalyzer (88%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.task.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.task.html
index b704f741e..9eb9b4e89 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.task.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.update.task.html
@@ -15,7 +15,7 @@ org.owasp.dependencycheck.data.update.task
-CallableDownloadTask (0%) DownloadTask (0%)
ProcessTask (0%) Confidence (100%)
-Dependency (57%) Dependency (61%)
Evidence (66%) SuppressionParser (68%)
-SuppressionRule (95%) SuppressionRule (70%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html
index d1219b86d..7008b586b 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html
@@ -27,45 +27,18 @@ org.owasp.dependencycheck.utils
DependencyVersionUtil (95%)
-DownloadFailedException (N/A)
-
-Downloader (19%)
-
-ExtractionException (N/A)
-
-FileUtils (16%) ExtractionUtil (0%)
Filter (91%)
-InvalidSettingException (N/A)
-
-LogFilter (0%)
-
-LogUtils (12%)
-
NonClosingStream (100%)
Pair (28%)
-Settings (52%)
-
-URLConnectionFactory (18%)
-
-URLConnectionFailureException (N/A)
-
UrlStringUtils (95%)
diff --git a/dependency-check-core/cobertura/frame-sourcefiles.html b/dependency-check-core/cobertura/frame-sourcefiles.html
index bb422e3c5..2b23ef089 100644
--- a/dependency-check-core/cobertura/frame-sourcefiles.html
+++ b/dependency-check-core/cobertura/frame-sourcefiles.html
@@ -21,7 +21,7 @@ All Packages
AbstractFileTypeAnalyzer (74%)
-AbstractSuppressionAnalyzer (84%) AbstractSuppressionAnalyzer (82%)
AbstractTokenizingFilter (100%) ArchiveExtractionException (N/A)
-AssemblyAnalyzer (68%) AssemblyAnalyzer (66%)
Build (0%) BuildBase (0%)
-CPEAnalyzer (81%) CPEAnalyzer (80%)
CachedWebDataSource (N/A)
-CallableDownloadTask (0%)
-
Checksum (88%)
@@ -99,7 +96,7 @@ All Packages
CpeMemoryIndex (73%)
-CpeSuppressionAnalyzer (55%) CpeSuppressionAnalyzer (88%)
CweDB (54%) DatabaseProperties (21%)
-Dependency (57%) Dependency (61%)
Dependency (0%) DistributionManagement (N/A)
-DownloadFailedException (N/A)
-
-Downloader (19%) DownloadTask (0%)
DriverLoadException (N/A) Extension (N/A)
-ExtractionException (N/A) ExtractionUtil (0%)
-FalsePositiveAnalyzer (48%) FalsePositiveAnalyzer (50%)
FieldAnalyzer (100%) FileTypeAnalyzer (N/A)
-FileUtils (16%)
-
Filter (91%)
@@ -222,13 +213,10 @@ All Packages
InvalidDataException (N/A)
-InvalidSettingException (N/A)
-
IssueManagement (N/A)
-JarAnalyzer (53%) JarAnalyzer (60%)
JavaScriptAnalyzer (26%) License (N/A)
-LogFilter (0%)
-
-LogUtils (12%)
-
LuceneUtils (100%)
@@ -258,7 +240,7 @@ All Packages
Model (0%)
-NexusAnalyzer (15%) NexusAnalyzer (12%)
NexusSearch (70%) SearchVersionAnalyzer (0%)
-Settings (52%)
-
Site (N/A)
@@ -393,18 +372,12 @@ All Packages
SuppressionParser (68%)
-SuppressionRule (95%) SuppressionRule (70%)
TokenPairConcatenatingFilter (100%)
-URLConnectionFactory (18%)
-
-URLConnectionFailureException (N/A)
-
UpdateException (N/A)
@@ -435,7 +408,7 @@ All Packages
VulnerabilityComparator (100%)
-VulnerabilitySuppressionAnalyzer (55%) VulnerabilitySuppressionAnalyzer (88%)
VulnerableSoftware (75%) AbstractFileTypeAnalyzer 1.6153846153846154; 1.615AbstractSuppressionAnalyzer 3.6666666666666665; 3.667AbstractSuppressionAnalyzer 3.8333333333333335; 3.833AnalysisPhase 0.0; 0ArchiveAnalyzer 6.916666666666667; 6.917AssemblyAnalyzer 6.875; 6.875AssemblyAnalyzer 6.875; 6.875CPEAnalyzer 4.428571428571429; 4.429CPEAnalyzer 4.428571428571429; 4.429CPEAnalyzer$IdentifierConfidence 4.428571428571429; 4.429CPEAnalyzer$IdentifierMatch 4.428571428571429; 4.429CpeSuppressionAnalyzer 2.3333333333333335; 2.333CpeSuppressionAnalyzer 2.3333333333333335; 2.333DependencyBundlingAnalyzer 9.090909090909092; 9.091FalsePositiveAnalyzer 8.75; 8.75FalsePositiveAnalyzer 9.5; 9.5FileNameAnalyzer 2.6666666666666665; 2.667HintAnalyzer 3.3333333333333335; 3.333JarAnalyzer 7.428571428571429; 7.429JarAnalyzer$ClassNameInformation 7.428571428571429; 7.429JarAnalyzer 7.411764705882353; 7.412JarAnalyzer$ClassNameInformation 7.411764705882353; 7.412JavaScriptAnalyzer 2.0; 2NexusAnalyzer 3.3333333333333335; 3.333NexusAnalyzer 4.0; 4NuspecAnalyzer 2.6666666666666665; 2.667NvdCveAnalyzer 2.125; 2.125VulnerabilitySuppressionAnalyzer 2.3333333333333335; 2.333VulnerabilitySuppressionAnalyzer 2.3333333333333335; 2.333
Classes in this Package Line Coverage Branch Coverage Complexity
- CallableDownloadTask 2.4545454545454546; 2.455DownloadTask 2.4545454545454546; 2.455ProcessTask 3.5; 3.5 Package # Classes Line Coverage Branch Coverage Complexity
org.owasp.dependencycheck 1 3.1818181818181817; 3.182org.owasp.dependencycheck.agent 1 1.90625; 1.906org.owasp.dependencycheck.analyzer 24 5.069364161849711; 5.069org.owasp.dependencycheck.agent 1 1.878787878787879; 1.879org.owasp.dependencycheck.analyzer 24 5.133720930232558; 5.134org.owasp.dependencycheck.analyzer.exception 2 1.0; 1org.owasp.dependencycheck.data.cpe 4 2.5; 2.5org.owasp.dependencycheck.data.cwe 2 2.8; 2.8org.owasp.dependencycheck.data.update.exception 2 1.0; 1org.owasp.dependencycheck.data.update.task 2 2.823529411764706; 2.824org.owasp.dependencycheck.data.update.xml 4 2.914285714285714; 2.914org.owasp.dependencycheck.dependency 14 2.4431818181818183; 2.443org.owasp.dependencycheck.dependency 14 2.4431818181818183; 2.443org.owasp.dependencycheck.exception 2 1.0; 1org.owasp.dependencycheck.jaxb.pom 1 1.25; 1.25org.owasp.dependencycheck.jaxb.pom.generated 87 1.0907407407407408; 1.091org.owasp.dependencycheck.reporting 4 3.7142857142857144; 3.714org.owasp.dependencycheck.suppression 6 2.7916666666666665; 2.792org.owasp.dependencycheck.utils 22 3.018867924528302; 3.019org.owasp.dependencycheck.suppression 6 3.0384615384615383; 3.038org.owasp.dependencycheck.utils 11 3.4583333333333335; 3.458
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html
index 88610f70d..c5b491708 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html
@@ -160,6 +160,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html
index ae363336c..e0640f80e 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html
@@ -38,6 +38,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html
index 0a62d8be9..6f196a1e5 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html
@@ -42,6 +42,6 @@ var classTable = new SortableTable(document.getElementById("classResults"),
["String", "Percentage", "Percentage", "FormattedNumber"]);
classTable.sort(0);
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html
index 6315d1499..7865aa33f 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html
index 56de0d88c..95d804d10 100644
--- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html
+++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-core/cobertura/frame-summary.html b/dependency-check-core/cobertura/frame-summary.html
index a3cbe5662..f38b67846 100644
--- a/dependency-check-core/cobertura/frame-summary.html
+++ b/dependency-check-core/cobertura/frame-summary.html
@@ -16,10 +16,10 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html
index 5397497cc..925b195cb 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html
@@ -167,7 +167,7 @@
75
- 76 1 private static final Logger LOGGER = Logger.getLogger(Engine.class .getName());
+ 76 2 private static final Logger LOGGER = Logger.getLogger(Engine.class .getName());
77
78
@@ -182,8 +182,8 @@
83
public Engine() throws DatabaseException {
- 84 1 this (Thread.currentThread().getContextClassLoader());
- 85 1 }
+ 84 2 this (Thread.currentThread().getContextClassLoader());
+ 85 2 }
86
87
@@ -198,29 +198,29 @@
92
- 93 1 public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
- 94 1 this .dependencies = new ArrayList<Dependency>();
- 95 1 this .analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
- 96 1 this .fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
- 97 1 this .serviceClassLoader = serviceClassLoader;
+ 93 2 public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
+ 94 2 this .dependencies = new ArrayList<Dependency>();
+ 95 2 this .analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class );
+ 96 2 this .fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
+ 97 2 this .serviceClassLoader = serviceClassLoader;
98
- 99 1 ConnectionFactory.initialize();
+ 99 2 ConnectionFactory.initialize();
100
- 101 1 boolean autoUpdate = true ;
+ 101 2 boolean autoUpdate = true ;
102
try {
- 103 1 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+ 103 2 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
104 0 } catch (InvalidSettingException ex) {
105 0 LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true." );
- 106 1 }
- 107 1 if (autoUpdate) {
+ 106 2 }
+ 107 2 if (autoUpdate) {
108 0 doUpdates();
109
}
- 110 1 loadAnalyzers();
- 111 1 }
+ 110 2 loadAnalyzers();
+ 111 2 }
112
113
@@ -245,23 +245,23 @@
private void loadAnalyzers() {
124
- 125 10 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 126 9 analyzers.put(phase, new ArrayList<Analyzer>());
+ 125 20 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 126 18 analyzers.put(phase, new ArrayList<Analyzer>());
127
}
128
- 129 1 final AnalyzerService service = new AnalyzerService(serviceClassLoader);
- 130 1 final Iterator<Analyzer> iterator = service.getAnalyzers();
- 131 14 while (iterator.hasNext()) {
- 132 13 final Analyzer a = iterator.next();
- 133 13 analyzers.get(a.getAnalysisPhase()).add(a);
- 134 13 if (a instanceof FileTypeAnalyzer) {
- 135 5 this .fileTypeAnalyzers.add((FileTypeAnalyzer) a);
+ 129 2 final AnalyzerService service = new AnalyzerService(serviceClassLoader);
+ 130 2 final Iterator<Analyzer> iterator = service.getAnalyzers();
+ 131 28 while (iterator.hasNext()) {
+ 132 26 final Analyzer a = iterator.next();
+ 133 26 analyzers.get(a.getAnalysisPhase()).add(a);
+ 134 26 if (a instanceof FileTypeAnalyzer) {
+ 135 10 this .fileTypeAnalyzers.add((FileTypeAnalyzer) a);
136
}
- 137 13 }
- 138 1 }
+ 137 26 }
+ 138 2 }
139
140
@@ -466,17 +466,17 @@
255
public void scan(File file) {
- 256 4 if (file.exists()) {
- 257 4 if (file.isDirectory()) {
- 258 2 scanDirectory(file);
+ 256 8 if (file.exists()) {
+ 257 8 if (file.isDirectory()) {
+ 258 4 scanDirectory(file);
259
} else {
- 260 2 scanFile(file);
+ 260 4 scanFile(file);
261
}
262
}
- 263 4 }
+ 263 8 }
264
265
@@ -491,11 +491,11 @@
270
protected void scanDirectory(File dir) {
- 271 38 final File[] files = dir.listFiles();
- 272 38 if (files != null ) {
- 273 74 for (File f : files) {
- 274 36 if (f.isDirectory()) {
- 275 36 scanDirectory(f);
+ 271 76 final File[] files = dir.listFiles();
+ 272 76 if (files != null ) {
+ 273 148 for (File f : files) {
+ 274 72 if (f.isDirectory()) {
+ 275 72 scanDirectory(f);
276
} else {
277 0 scanFile(f);
@@ -505,7 +505,7 @@
} 280
}
- 281 38 }
+ 281 76 }
282
283
@@ -520,19 +520,19 @@
288
protected void scanFile(File file) {
- 289 2 if (!file.isFile()) {
+ 289 4 if (!file.isFile()) {
290 0 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file." , file.toString());
291 0 LOGGER.log(Level.FINE, msg);
292 0 return ;
293
}
- 294 2 final String fileName = file.getName();
- 295 2 final String extension = FileUtils.getFileExtension(fileName);
- 296 2 if (extension != null ) {
- 297 2 if (supportsExtension(extension)) {
- 298 2 final Dependency dependency = new Dependency(file);
- 299 2 dependencies.add(dependency);
- 300 2 }
+ 294 4 final String fileName = file.getName();
+ 295 4 final String extension = FileUtils.getFileExtension(fileName);
+ 296 4 if (extension != null ) {
+ 297 4 if (supportsExtension(extension)) {
+ 298 4 final Dependency dependency = new Dependency(file);
+ 299 4 dependencies.add(dependency);
+ 300 4 }
301
} else {
302 0 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed." ,
@@ -541,7 +541,7 @@
304 0 LOGGER.log(Level.FINEST, msg);
305
}
- 306 2 }
+ 306 4 }
307
308
@@ -556,7 +556,7 @@
313
try {
- 314 1 ensureDataExists();
+ 314 2 ensureDataExists();
315 0 } catch (NoDataException ex) {
316 0 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis." , ex.getMessage());
317 0 LOGGER.log(Level.SEVERE, msg);
@@ -569,28 +569,28 @@
324 0 return ;
325
- 326 1 }
+ 326 2 }
327
- 328 1 final String logHeader = String.format("%n"
+ 328 2 final String logHeader = String.format("%n"
329
+ "----------------------------------------------------%n"
330
+ "BEGIN ANALYSIS%n"
331
+ "----------------------------------------------------" );
- 332 1 LOGGER.log(Level.FINE, logHeader);
- 333 1 LOGGER.log(Level.INFO, "Analysis Starting" );
+ 332 2 LOGGER.log(Level.FINE, logHeader);
+ 333 2 LOGGER.log(Level.INFO, "Analysis Starting" );
334
335
- 336 10 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 337 9 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 336 20 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 337 18 final List<Analyzer> analyzerList = analyzers.get(phase);
338
- 339 9 for (Analyzer a : analyzerList) {
- 340 13 initializeAnalyzer(a);
+ 339 18 for (Analyzer a : analyzerList) {
+ 340 26 initializeAnalyzer(a);
341
342
@@ -601,23 +601,23 @@
345
- 346 13 final String msg = String.format("Begin Analyzer '%s'" , a.getName());
- 347 13 LOGGER.log(Level.FINE, msg);
- 348 13 final Set<Dependency> dependencySet = new HashSet<Dependency>();
- 349 13 dependencySet.addAll(dependencies);
- 350 13 for (Dependency d : dependencySet) {
- 351 26 boolean shouldAnalyze = true ;
- 352 26 if (a instanceof FileTypeAnalyzer) {
- 353 10 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
- 354 10 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension());
+ 346 26 final String msg = String.format("Begin Analyzer '%s'" , a.getName());
+ 347 26 LOGGER.log(Level.FINE, msg);
+ 348 26 final Set<Dependency> dependencySet = new HashSet<Dependency>();
+ 349 26 dependencySet.addAll(dependencies);
+ 350 26 for (Dependency d : dependencySet) {
+ 351 52 boolean shouldAnalyze = true ;
+ 352 52 if (a instanceof FileTypeAnalyzer) {
+ 353 20 final FileTypeAnalyzer fAnalyzer = (FileTypeAnalyzer) a;
+ 354 20 shouldAnalyze = fAnalyzer.supportsExtension(d.getFileExtension());
355
}
- 356 26 if (shouldAnalyze) {
- 357 20 final String msgFile = String.format("Begin Analysis of '%s'" , d.getActualFilePath());
- 358 20 LOGGER.log(Level.FINE, msgFile);
+ 356 52 if (shouldAnalyze) {
+ 357 40 final String msgFile = String.format("Begin Analysis of '%s'" , d.getActualFilePath());
+ 358 40 LOGGER.log(Level.FINE, msgFile);
359
try {
- 360 20 a.analyze(d, this );
+ 360 40 a.analyze(d, this );
361 0 } catch (AnalysisException ex) {
362 0 final String exMsg = String.format("An error occurred while analyzing '%s'." , d.getActualFilePath());
363 0 LOGGER.log(Level.WARNING, exMsg);
@@ -628,34 +628,34 @@
368 0 LOGGER.log(Level.WARNING, axMsg);
369 0 LOGGER.log(Level.FINE, "" , ex);
- 370 20 }
+ 370 40 }
371
}
- 372 26 }
- 373 13 }
+ 372 52 }
+ 373 26 }
374
}
- 375 10 for (AnalysisPhase phase : AnalysisPhase.values()) {
- 376 9 final List<Analyzer> analyzerList = analyzers.get(phase);
+ 375 20 for (AnalysisPhase phase : AnalysisPhase.values()) {
+ 376 18 final List<Analyzer> analyzerList = analyzers.get(phase);
377
- 378 9 for (Analyzer a : analyzerList) {
- 379 13 closeAnalyzer(a);
- 380 13 }
+ 378 18 for (Analyzer a : analyzerList) {
+ 379 26 closeAnalyzer(a);
+ 380 26 }
381
}
382
- 383 1 final String logFooter = String.format("%n"
+ 383 2 final String logFooter = String.format("%n"
384
+ "----------------------------------------------------%n"
385
+ "END ANALYSIS%n"
386
+ "----------------------------------------------------" );
- 387 1 LOGGER.log(Level.FINE, logFooter);
- 388 1 LOGGER.log(Level.INFO, "Analysis Complete" );
- 389 1 }
+ 387 2 LOGGER.log(Level.FINE, logFooter);
+ 388 2 LOGGER.log(Level.INFO, "Analysis Complete" );
+ 389 2 }
390
391
@@ -672,9 +672,9 @@
private void initializeAnalyzer(Analyzer analyzer) {
397
try {
- 398 13 final String msg = String.format("Initializing %s" , analyzer.getName());
- 399 13 LOGGER.log(Level.FINE, msg);
- 400 13 analyzer.initialize();
+ 398 26 final String msg = String.format("Initializing %s" , analyzer.getName());
+ 399 26 LOGGER.log(Level.FINE, msg);
+ 400 26 analyzer.initialize();
401 0 } catch (Throwable ex) {
402 0 final String msg = String.format("Exception occurred initializing %s." , analyzer.getName());
403 0 LOGGER.log(Level.SEVERE, msg);
@@ -685,8 +685,8 @@
407 0 } catch (Throwable ex1) {
408 0 LOGGER.log(Level.FINEST, null , ex1);
409 0 }
- 410 13 }
- 411 13 }
+ 410 26 }
+ 411 26 }
412
413
@@ -701,15 +701,15 @@
418
private void closeAnalyzer(Analyzer analyzer) {
- 419 13 final String msg = String.format("Closing Analyzer '%s'" , analyzer.getName());
- 420 13 LOGGER.log(Level.FINE, msg);
+ 419 26 final String msg = String.format("Closing Analyzer '%s'" , analyzer.getName());
+ 420 26 LOGGER.log(Level.FINE, msg);
421
try {
- 422 13 analyzer.close();
+ 422 26 analyzer.close();
423 0 } catch (Throwable ex) {
424 0 LOGGER.log(Level.FINEST, null , ex);
- 425 13 }
- 426 13 }
+ 425 26 }
+ 426 26 }
427
428
@@ -776,19 +776,19 @@
467
public boolean supportsExtension(String ext) {
- 468 851 if (ext == null ) {
- 469 3 return false ;
+ 468 1702 if (ext == null ) {
+ 469 6 return false ;
470
}
- 471 848 boolean scan = false ;
- 472 848 for (FileTypeAnalyzer a : this .fileTypeAnalyzers) {
+ 471 1696 boolean scan = false ;
+ 472 1696 for (FileTypeAnalyzer a : this .fileTypeAnalyzers) {
473
474
- 475 4240 scan |= a.supportsExtension(ext);
- 476 4240 }
- 477 848 return scan;
+ 475 8480 scan |= a.supportsExtension(ext);
+ 476 8480 }
+ 477 1696 return scan;
478
}
479
@@ -807,32 +807,32 @@
486
private void ensureDataExists() throws NoDataException, DatabaseException {
- 487 1 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
- 488 1 final CveDB cve = new CveDB();
+ 487 2 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
+ 488 2 final CveDB cve = new CveDB();
489
490
try {
- 491 1 cve.open();
- 492 1 cpe.open(cve);
+ 491 2 cve.open();
+ 492 2 cpe.open(cve);
493 0 } catch (IndexException ex) {
494 0 throw new NoDataException(ex.getMessage(), ex);
495 0 } catch (DatabaseException ex) {
496 0 throw new NoDataException(ex.getMessage(), ex);
497
} finally {
- 498 1 cve.close();
- 499 1 }
- 500 1 if (cpe.numDocs() <= 0) {
+ 498 2 cve.close();
+ 499 2 }
+ 500 2 if (cpe.numDocs() <= 0) {
501 0 cpe.close();
502 0 throw new NoDataException("No documents exist" );
503
}
- 504 1 }
+ 504 2 }
505
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
index 35b748678..ac606eb9e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.agent.DependencyCheckScanAgent.html
@@ -12,7 +12,7 @@
@@ -48,7 +48,7 @@
15
16
-
+ 17
18
@@ -482,27 +482,27 @@
236
237
-
+ 238
239
- private String proxyUrl;
+ private String proxyServer; 240
241
242
-
+ 243
244
-
+ 245
246
- public String getProxyUrl() {
+ public String getProxyServer() { 247
- return proxyUrl;
+ return proxyServer; 248
}
249
@@ -510,17 +510,17 @@
250
251
-
+ 252
253
-
+ 254
255
- public void setProxyUrl(String proxyUrl) {
+ public void setProxyServer(String proxyServer) { 256
- this .proxyUrl = proxyUrl;
+ this .proxyServer = proxyServer; 257
}
258
@@ -528,45 +528,45 @@
259
260
-
+ 261
-
+ 262
- private String proxyPort;
+ 263
-
+ 264
-
+ 265
-
+ @Deprecated 266
-
+ public String getProxyUrl() { 267
-
+ return proxyServer; 268
-
- 269
- public String getProxyPort() {
- 270
- return proxyPort;
- 271
}
- 272
+ 269
- 273
+ 270
- 274
-
- 275
+ 271
+
+ 272
+ 273
+
+ 274
+
+ 275
+
276
-
- 277
+ 277
+ @Deprecated
278
- public void setProxyPort(String proxyPort) {
+ public void setProxyUrl(String proxyUrl) { 279
- this .proxyPort = proxyPort;
+ this .proxyServer = proxyUrl; 280
}
281
@@ -574,27 +574,27 @@
282
283
-
+ 284
285
- private String proxyUsername;
+ private String proxyPort; 286
287
288
-
+ 289
290
-
+ 291
292
- public String getProxyUsername() {
+ public String getProxyPort() { 293
- return proxyUsername;
+ return proxyPort; 294
}
295
@@ -602,17 +602,17 @@
296
297
-
+ 298
299
-
+ 300
301
- public void setProxyUsername(String proxyUsername) {
+ public void setProxyPort(String proxyPort) { 302
- this .proxyUsername = proxyUsername;
+ this .proxyPort = proxyPort; 303
}
304
@@ -620,27 +620,27 @@
305
306
-
+ 307
308
- private String proxyPassword;
+ private String proxyUsername; 309
310
311
-
+ 312
313
-
+ 314
315
- public String getProxyPassword() {
+ public String getProxyUsername() { 316
- return proxyPassword;
+ return proxyUsername; 317
}
318
@@ -648,17 +648,17 @@
319
320
-
+ 321
322
-
+ 323
324
- public void setProxyPassword(String proxyPassword) {
+ public void setProxyUsername(String proxyUsername) { 325
- this .proxyPassword = proxyPassword;
+ this .proxyUsername = proxyUsername; 326
}
327
@@ -666,27 +666,27 @@
328
329
-
+ 330
331
- private String connectionTimeout;
+ private String proxyPassword; 332
333
334
-
+ 335
336
-
+ 337
338
- public String getConnectionTimeout() {
+ public String getProxyPassword() { 339
- return connectionTimeout;
+ return proxyPassword; 340
}
341
@@ -694,17 +694,17 @@
342
343
-
+ 344
345
-
+ 346
347
- public void setConnectionTimeout(String connectionTimeout) {
+ public void setProxyPassword(String proxyPassword) { 348
- this .connectionTimeout = connectionTimeout;
+ this .proxyPassword = proxyPassword; 349
}
350
@@ -712,26 +712,27 @@
351
352
-
+ 353
- 354 0 private String logFile = null ;
+ 354
+ private String connectionTimeout;
355
356
357
-
+ 358
359
-
+ 360
361
- public String getLogFile() {
+ public String getConnectionTimeout() { 362
- return logFile;
+ return connectionTimeout; 363
}
364
@@ -739,17 +740,17 @@
365
366
-
+ 367
368
-
+ 369
370
- public void setLogFile(String logFile) {
+ public void setConnectionTimeout(String connectionTimeout) { 371
- this .logFile = logFile;
+ this .connectionTimeout = connectionTimeout; 372
}
373
@@ -757,27 +758,26 @@
374
375
-
+ 376
- 377
- private String suppressionFile;
+ 377 0 private String logFile = null ;
378
379
380
-
+ 381
382
-
+ 383
384
- public String getSuppressionFile() {
+ public String getLogFile() { 385
- return suppressionFile;
+ return logFile; 386
}
387
@@ -785,17 +785,17 @@
388
389
-
+ 390
391
-
+ 392
393
- public void setSuppressionFile(String suppressionFile) {
+ public void setLogFile(String logFile) { 394
- this .suppressionFile = suppressionFile;
+ this .logFile = logFile; 395
}
396
@@ -803,26 +803,27 @@
397
398
-
+ 399
- 400 0 private boolean showSummary = true ;
+ 400
+ private String suppressionFile;
401
402
403
-
+ 404
405
-
+ 406
407
- public boolean isShowSummary() {
+ public String getSuppressionFile() { 408
- return showSummary;
+ return suppressionFile; 409
}
410
@@ -830,17 +831,17 @@
411
412
-
+ 413
414
-
+ 415
416
- public void setShowSummary(boolean showSummary) {
+ public void setSuppressionFile(String suppressionFile) { 417
- this .showSummary = showSummary;
+ this .suppressionFile = suppressionFile; 418
}
419
@@ -848,26 +849,26 @@
420
421
-
+ 422
- 423 0 private boolean nexusAnalyzerEnabled = true ;
+ 423 0 private boolean showSummary = true ;
424
425
426
-
+ 427
428
-
+ 429
430
- public boolean isNexusAnalyzerEnabled() {
+ public boolean isShowSummary() { 431
- return nexusAnalyzerEnabled;
+ return showSummary; 432
}
433
@@ -875,17 +876,17 @@
434
435
-
+ 436
437
-
+ 438
439
- public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
+ public void setShowSummary(boolean showSummary) { 440
- this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
+ this .showSummary = showSummary; 441
}
442
@@ -893,27 +894,26 @@
443
444
-
+ 445
- 446
- private String nexusUrl;
+ 446 0 private boolean nexusAnalyzerEnabled = true ;
447
448
449
-
+ 450
451
-
+ 452
453
- public String getNexusUrl() {
+ public boolean isNexusAnalyzerEnabled() { 454
- return nexusUrl;
+ return nexusAnalyzerEnabled; 455
}
456
@@ -921,17 +921,17 @@
457
458
-
+ 459
460
-
+ 461
462
- public void setNexusUrl(String nexusUrl) {
+ public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) { 463
- this .nexusUrl = nexusUrl;
+ this .nexusAnalyzerEnabled = nexusAnalyzerEnabled; 464
}
465
@@ -939,26 +939,27 @@
466
467
-
+ 468
- 469 0 private boolean nexusUsesProxy = true ;
+ 469
+ private String nexusUrl;
470
471
472
-
+ 473
474
-
+ 475
476
- public boolean isNexusUsesProxy() {
+ public String getNexusUrl() { 477
- return nexusUsesProxy;
+ return nexusUrl; 478
}
479
@@ -966,17 +967,17 @@
480
481
-
+ 482
483
-
+ 484
485
- public void setNexusUsesProxy(boolean nexusUsesProxy) {
+ public void setNexusUrl(String nexusUrl) { 486
- this .nexusUsesProxy = nexusUsesProxy;
+ this .nexusUrl = nexusUrl; 487
}
488
@@ -984,27 +985,26 @@
489
490
-
+ 491
- 492
- private String databaseDriverName;
+ 492 0 private boolean nexusUsesProxy = true ;
493
494
495
-
+ 496
497
-
+ 498
499
- public String getDatabaseDriverName() {
+ public boolean isNexusUsesProxy() { 500
- return databaseDriverName;
+ return nexusUsesProxy; 501
}
502
@@ -1012,17 +1012,17 @@
503
504
-
+ 505
506
-
+ 507
508
- public void setDatabaseDriverName(String databaseDriverName) {
+ public void setNexusUsesProxy(boolean nexusUsesProxy) { 509
- this .databaseDriverName = databaseDriverName;
+ this .nexusUsesProxy = nexusUsesProxy; 510
}
511
@@ -1030,27 +1030,27 @@
512
513
-
+ 514
515
- private String databaseDriverPath;
+ private String databaseDriverName; 516
517
518
-
+ 519
520
-
+ 521
522
- public String getDatabaseDriverPath() {
+ public String getDatabaseDriverName() { 523
- return databaseDriverPath;
+ return databaseDriverName; 524
}
525
@@ -1058,17 +1058,17 @@
526
527
-
+ 528
529
-
+ 530
531
- public void setDatabaseDriverPath(String databaseDriverPath) {
+ public void setDatabaseDriverName(String databaseDriverName) { 532
- this .databaseDriverPath = databaseDriverPath;
+ this .databaseDriverName = databaseDriverName; 533
}
534
@@ -1076,27 +1076,27 @@
535
536
-
+ 537
538
- private String connectionString;
+ private String databaseDriverPath; 539
540
541
-
+ 542
543
-
+ 544
545
- public String getConnectionString() {
+ public String getDatabaseDriverPath() { 546
- return connectionString;
+ return databaseDriverPath; 547
}
548
@@ -1104,17 +1104,17 @@
549
550
-
+ 551
552
-
+ 553
554
- public void setConnectionString(String connectionString) {
+ public void setDatabaseDriverPath(String databaseDriverPath) { 555
- this .connectionString = connectionString;
+ this .databaseDriverPath = databaseDriverPath; 556
}
557
@@ -1122,27 +1122,27 @@
558
559
-
+ 560
561
- private String databaseUser;
+ private String connectionString; 562
563
564
-
+ 565
566
-
+ 567
568
- public String getDatabaseUser() {
+ public String getConnectionString() { 569
- return databaseUser;
+ return connectionString; 570
}
571
@@ -1150,17 +1150,17 @@
572
573
-
+ 574
575
-
+ 576
577
- public void setDatabaseUser(String databaseUser) {
+ public void setConnectionString(String connectionString) { 578
- this .databaseUser = databaseUser;
+ this .connectionString = connectionString; 579
}
580
@@ -1168,27 +1168,27 @@
581
582
-
+ 583
584
- private String databasePassword;
+ private String databaseUser; 585
586
587
-
+ 588
589
-
+ 590
591
- public String getDatabasePassword() {
+ public String getDatabaseUser() { 592
- return databasePassword;
+ return databaseUser; 593
}
594
@@ -1196,17 +1196,17 @@
595
596
-
+ 597
598
-
+ 599
600
- public void setDatabasePassword(String databasePassword) {
+ public void setDatabaseUser(String databaseUser) { 601
- this .databasePassword = databasePassword;
+ this .databaseUser = databaseUser; 602
}
603
@@ -1214,75 +1214,75 @@
604
605
-
+ 606
-
+ 607
-
+ private String databasePassword; 608
- private String zipExtensions;
+ 609
-
+ 610
-
+ 611
-
+ 612
-
+ 613
-
+ 614
-
+ public String getDatabasePassword() { 615
- public String getZipExtensions() {
+ return databasePassword; 616
- return zipExtensions;
+ } 617
- }
+ 618
-
+ 619
-
+ 620
-
- 621
+ 621
+
622
-
- 623
+ 623
+ public void setDatabasePassword(String databasePassword) {
624
- public void setZipExtensions(String zipExtensions) {
+ this .databasePassword = databasePassword; 625
- this .zipExtensions = zipExtensions;
- 626
}
- 627
+ 626
- 628
+ 627
+ 628
+
629
-
+ 630
631
- private String cveUrl12Modified;
+ private String zipExtensions; 632
633
634
-
+ 635
636
-
+ 637
638
- public String getCveUrl12Modified() {
+ public String getZipExtensions() { 639
- return cveUrl12Modified;
+ return zipExtensions; 640
}
641
@@ -1290,17 +1290,17 @@
642
643
-
+ 644
645
-
+ 646
647
- public void setCveUrl12Modified(String cveUrl12Modified) {
+ public void setZipExtensions(String zipExtensions) { 648
- this .cveUrl12Modified = cveUrl12Modified;
+ this .zipExtensions = zipExtensions; 649
}
650
@@ -1308,27 +1308,27 @@
651
652
-
+ 653
654
- private String cveUrl20Modified;
+ private String cveUrl12Modified; 655
656
657
-
+ 658
659
-
+ 660
661
- public String getCveUrl20Modified() {
+ public String getCveUrl12Modified() { 662
- return cveUrl20Modified;
+ return cveUrl12Modified; 663
}
664
@@ -1336,17 +1336,17 @@
665
666
-
+ 667
668
-
+ 669
670
- public void setCveUrl20Modified(String cveUrl20Modified) {
+ public void setCveUrl12Modified(String cveUrl12Modified) { 671
- this .cveUrl20Modified = cveUrl20Modified;
+ this .cveUrl12Modified = cveUrl12Modified; 672
}
673
@@ -1354,27 +1354,27 @@
674
675
-
+ 676
677
- private String cveUrl12Base;
+ private String cveUrl20Modified; 678
679
680
-
+ 681
682
-
+ 683
684
- public String getCveUrl12Base() {
+ public String getCveUrl20Modified() { 685
- return cveUrl12Base;
+ return cveUrl20Modified; 686
}
687
@@ -1382,17 +1382,17 @@
688
689
-
+ 690
691
-
+ 692
693
- public void setCveUrl12Base(String cveUrl12Base) {
+ public void setCveUrl20Modified(String cveUrl20Modified) { 694
- this .cveUrl12Base = cveUrl12Base;
+ this .cveUrl20Modified = cveUrl20Modified; 695
}
696
@@ -1400,27 +1400,27 @@
697
698
-
+ 699
700
- private String cveUrl20Base;
+ private String cveUrl12Base; 701
702
703
-
+ 704
705
-
+ 706
707
- public String getCveUrl20Base() {
+ public String getCveUrl12Base() { 708
- return cveUrl20Base;
+ return cveUrl12Base; 709
}
710
@@ -1428,17 +1428,17 @@
711
712
-
+ 713
714
-
+ 715
716
- public void setCveUrl20Base(String cveUrl20Base) {
+ public void setCveUrl12Base(String cveUrl12Base) { 717
- this .cveUrl20Base = cveUrl20Base;
+ this .cveUrl12Base = cveUrl12Base; 718
}
719
@@ -1446,27 +1446,27 @@
720
721
-
+ 722
723
- private String pathToMono;
+ private String cveUrl20Base; 724
725
726
-
+ 727
728
-
+ 729
730
- public String getPathToMono() {
+ public String getCveUrl20Base() { 731
- return pathToMono;
+ return cveUrl20Base; 732
}
733
@@ -1474,17 +1474,17 @@
734
735
-
+ 736
737
-
+ 738
739
- public void setPathToMono(String pathToMono) {
+ public void setCveUrl20Base(String cveUrl20Base) { 740
- this .pathToMono = pathToMono;
+ this .cveUrl20Base = cveUrl20Base; 741
}
742
@@ -1492,335 +1492,381 @@
743
744
-
+ 745
-
+ 746
-
+ private String pathToMono; 747
-
+ 748
-
+ 749
-
+ 750
- private Engine executeDependencyCheck() throws DatabaseException {
- 751 0 populateSettings();
- 752 0 Engine engine = null ;
- 753 0 engine = new Engine();
- 754 0 engine.setDependencies(this .dependencies);
- 755 0 engine.analyzeDependencies();
- 756 0 return engine;
- 757
- }
- 758
-
- 759
-
- 760
-
- 761
- 762
-
- 763
-
- 764
+ 751
+
+ 752
- 765
- private void generateExternalReports(Engine engine, File outDirectory) {
- 766 0 DatabaseProperties prop = null ;
- 767 0 CveDB cve = null ;
- 768
- try {
- 769 0 cve = new CveDB();
- 770 0 cve.open();
- 771 0 prop = cve.getDatabaseProperties();
- 772 0 } catch (DatabaseException ex) {
- 773 0 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
- 774
- } finally {
- 775 0 if (cve != null ) {
- 776 0 cve.close();
- 777
- }
- 778
- }
- 779 0 final ReportGenerator r = new ReportGenerator(this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
- 780
- try {
- 781 0 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
- 782 0 } catch (IOException ex) {
- 783 0 LOGGER.log(Level.SEVERE,
- 784
- "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 785 0 LOGGER.log(Level.FINE, null , ex);
- 786 0 } catch (Throwable ex) {
- 787 0 LOGGER.log(Level.SEVERE,
- 788
- "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 789 0 LOGGER.log(Level.FINE, null , ex);
- 790 0 }
- 791 0 }
- 792
+ 753
+ public String getPathToMono() {
+ 754
+ return pathToMono;
+ 755
+ }
+ 756
- 793
+ 757
- 794
-
- 795
-
- 796
+ 758
+
+ 759
+
+ 760
+
+ 761
+ 762
+ public void setPathToMono(String pathToMono) {
+ 763
+ this .pathToMono = pathToMono;
+ 764
+ }
+ 765
+
+ 766
+
+ 767
+
+ 768
+
+ 769
+
+ 770
+
+ 771
+
+ 772
+
+ 773
+ private Engine executeDependencyCheck() throws DatabaseException {
+ 774 0 populateSettings();
+ 775 0 Engine engine = null ;
+ 776 0 engine = new Engine();
+ 777 0 engine.setDependencies(this .dependencies);
+ 778 0 engine.analyzeDependencies();
+ 779 0 return engine;
+ 780
+ }
+ 781
+
+ 782
+
+ 783
+
+ 784
+
+ 785
+
+ 786
+
+ 787
+
+ 788
+ private void generateExternalReports(Engine engine, File outDirectory) {
+ 789 0 DatabaseProperties prop = null ;
+ 790 0 CveDB cve = null ;
+ 791
+ try {
+ 792 0 cve = new CveDB();
+ 793 0 cve.open();
+ 794 0 prop = cve.getDatabaseProperties();
+ 795 0 } catch (DatabaseException ex) {
+ 796 0 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
797
- private void populateSettings() {
- 798 0 Settings.initialize();
- 799 0 if (dataDirectory != null ) {
- 800 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ } finally { 798 0 if (cve != null ) {
+ 799 0 cve.close();
+ 800
+ }
801
- } else {
- 802 0 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
- 803 0 final File base = jarPath.getParentFile();
- 804 0 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
- 805 0 final File dataDir = new File(base, sub);
- 806 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ } 802 0 final ReportGenerator r = new ReportGenerator(this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
+ 803
+ try {
+ 804 0 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
+ 805 0 } catch (IOException ex) {
+ 806 0 LOGGER.log(Level.SEVERE,
807
- }
- 808
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 808 0 LOGGER.log(Level.FINE, null , ex);
+ 809 0 } catch (Throwable ex) {
+ 810 0 LOGGER.log(Level.SEVERE,
+ 811
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 812 0 LOGGER.log(Level.FINE, null , ex);
+ 813 0 }
+ 814 0 }
+ 815
- 809 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
- 810
-
- 811 0 if (proxyUrl != null && !proxyUrl.isEmpty()) {
- 812 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
- 813
- }
- 814 0 if (proxyPort != null && !proxyPort.isEmpty()) {
- 815 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
816
- }
- 817 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
- 818 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
+ 817
+
+ 818
+
819
+
+ 820
+ private void populateSettings() {
+ 821 0 Settings.initialize();
+ 822 0 if (dataDirectory != null ) {
+ 823 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ 824
+ } else {
+ 825 0 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
+ 826 0 final File base = jarPath.getParentFile();
+ 827 0 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+ 828 0 final File dataDir = new File(base, sub);
+ 829 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+ 830
}
- 820 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
- 821 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
- 822
- }
- 823 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
- 824 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
- 825
- }
- 826 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
- 827 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
- 828
- }
- 829 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
- 830 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
- 831 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
- 832
- }
- 833 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
- 834 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
- 835 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 831
+
+ 832 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 833
+
+ 834 0 if (proxyServer != null && !proxyServer.isEmpty()) {
+ 835 0 Settings.setString(Settings.KEYS.PROXY_SERVER, proxyServer);
836
}
- 837 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
- 838 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 837 0 if (proxyPort != null && !proxyPort.isEmpty()) {
+ 838 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
839
}
- 840 0 if (connectionString != null && !connectionString.isEmpty()) {
- 841 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 840 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+ 841 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
842
}
- 843 0 if (databaseUser != null && !databaseUser.isEmpty()) {
- 844 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+ 843 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+ 844 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
845
}
- 846 0 if (databasePassword != null && !databasePassword.isEmpty()) {
- 847 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+ 846 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+ 847 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
848
}
- 849 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
- 850 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+ 849 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+ 850 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
851
}
- 852 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
- 853 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
- 854
+ 852 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+ 853 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+ 854 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 855
}
- 855 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
- 856 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
- 857
+ 856 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+ 857 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+ 858 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 859
}
- 858 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
- 859 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
- 860
+ 860 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+ 861 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 862
}
- 861 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
- 862 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
- 863
+ 863 0 if (connectionString != null && !connectionString.isEmpty()) {
+ 864 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 865
}
- 864 0 if (pathToMono != null && !pathToMono.isEmpty()) {
- 865 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
- 866
- }
- 867 0 }
+ 866 0 if (databaseUser != null && !databaseUser.isEmpty()) {
+ 867 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
868
-
- 869
-
- 870
-
+ } 869 0 if (databasePassword != null && !databasePassword.isEmpty()) {
+ 870 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
871
-
- 872
-
- 873
-
+ } 872 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+ 873 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
874
-
- 875
- public void execute() throws ScanAgentException {
- 876 0 Engine engine = null ;
+ } 875 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+ 876 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
877
- try {
- 878 0 engine = executeDependencyCheck();
- 879 0 generateExternalReports(engine, new File(this .reportOutputDirectory));
- 880 0 if (this .showSummary) {
- 881 0 showSummary(engine.getDependencies());
- 882
- }
- 883 0 if (this .failBuildOnCVSS <= 10) {
- 884 0 checkForFailure(engine.getDependencies());
- 885
- }
- 886 0 } catch (DatabaseException ex) {
- 887 0 LOGGER.log(Level.SEVERE,
- 888
- "Unable to connect to the dependency-check database; analysis has stopped" );
- 889 0 LOGGER.log(Level.FINE, "" , ex);
- 890
- } finally {
- 891 0 Settings.cleanup(true );
- 892 0 if (engine != null ) {
- 893 0 engine.cleanup();
+ } 878 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+ 879 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+ 880
+ }
+ 881 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+ 882 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+ 883
+ }
+ 884 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+ 885 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+ 886
+ }
+ 887 0 if (pathToMono != null && !pathToMono.isEmpty()) {
+ 888 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+ 889
+ }
+ 890 0 }
+ 891
+
+ 892
+
+ 893
+
894
- }
+ 895
- }
- 896 0 }
- 897
-
- 898
-
- 899
-
- 900
-
- 901
-
- 902
-
- 903
- 904
+ 896
+ 897
+
+ 898
+ public void execute() throws ScanAgentException {
+ 899 0 Engine engine = null ;
+ 900
+ try {
+ 901 0 engine = executeDependencyCheck();
+ 902 0 generateExternalReports(engine, new File(this .reportOutputDirectory));
+ 903 0 if (this .showSummary) {
+ 904 0 showSummary(engine.getDependencies());
905
-
- 906
- private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
- 907 0 final StringBuilder ids = new StringBuilder();
- 908 0 for (Dependency d : dependencies) {
- 909 0 boolean addName = true ;
- 910 0 for (Vulnerability v : d.getVulnerabilities()) {
- 911 0 if (v.getCvssScore() >= failBuildOnCVSS) {
- 912 0 if (addName) {
- 913 0 addName = false ;
- 914 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
- 915 0 ids.append(v.getName());
- 916
- } else {
- 917 0 ids.append(", " ).append(v.getName());
- 918
- }
- 919
- }
- 920 0 }
- 921 0 }
- 922 0 if (ids.length() > 0) {
- 923 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
- 924
- + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
- 925
- + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
- 926
-
- 927 0 throw new ScanAgentException(msg);
- 928
- }
- 929 0 }
- 930
-
- 931
-
- 932
-
- 933
-
- 934
-
- 935
-
- 936
- private void showSummary(List<Dependency> dependencies) {
- 937 0 final StringBuilder summary = new StringBuilder();
- 938 0 for (Dependency d : dependencies) {
- 939 0 boolean firstEntry = true ;
- 940 0 final StringBuilder ids = new StringBuilder();
- 941 0 for (Vulnerability v : d.getVulnerabilities()) {
- 942 0 if (firstEntry) {
- 943 0 firstEntry = false ;
- 944
- } else {
- 945 0 ids.append(", " );
- 946
- }
- 947 0 ids.append(v.getName());
- 948 0 }
- 949 0 if (ids.length() > 0) {
- 950 0 summary.append(d.getFileName()).append(" (" );
- 951 0 firstEntry = true ;
- 952 0 for (Identifier id : d.getIdentifiers()) {
- 953 0 if (firstEntry) {
- 954 0 firstEntry = false ;
- 955
- } else {
- 956 0 summary.append(", " );
- 957
- }
- 958 0 summary.append(id.getValue());
- 959 0 }
- 960 0 summary.append(") : " ).append(ids).append(NEW_LINE);
- 961
}
- 962 0 }
- 963 0 if (summary.length() > 0) {
- 964 0 final String msg = String.format("%n%n"
- 965
- + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
- 966
- + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
- 967 0 LOGGER.log(Level.WARNING, msg);
- 968
+ 906 0 if (this .failBuildOnCVSS <= 10) {
+ 907 0 checkForFailure(engine.getDependencies());
+ 908
+ }
+ 909 0 } catch (DatabaseException ex) {
+ 910 0 LOGGER.log(Level.SEVERE,
+ 911
+ "Unable to connect to the dependency-check database; analysis has stopped" );
+ 912 0 LOGGER.log(Level.FINE, "" , ex);
+ 913
+ } finally {
+ 914 0 Settings.cleanup(true );
+ 915 0 if (engine != null ) {
+ 916 0 engine.cleanup();
+ 917
+ }
+ 918
}
- 969 0 }
- 970
+ 919 0 }
+ 920
- 971
+ 921
+
+ 922
+
+ 923
+
+ 924
+
+ 925
+
+ 926
+
+ 927
+
+ 928
+
+ 929
+ private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
+ 930 0 final StringBuilder ids = new StringBuilder();
+ 931 0 for (Dependency d : dependencies) {
+ 932 0 boolean addName = true ;
+ 933 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 934 0 if (v.getCvssScore() >= failBuildOnCVSS) {
+ 935 0 if (addName) {
+ 936 0 addName = false ;
+ 937 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+ 938 0 ids.append(v.getName());
+ 939
+ } else {
+ 940 0 ids.append(", " ).append(v.getName());
+ 941
+ }
+ 942
+ }
+ 943 0 }
+ 944 0 }
+ 945 0 if (ids.length() > 0) {
+ 946 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 947
+ + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+ 948
+ + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+ 949
+
+ 950 0 throw new ScanAgentException(msg);
+ 951
+ }
+ 952 0 }
+ 953
+
+ 954
+
+ 955
+
+ 956
+
+ 957
+
+ 958
+
+ 959
+ private void showSummary(List<Dependency> dependencies) {
+ 960 0 final StringBuilder summary = new StringBuilder();
+ 961 0 for (Dependency d : dependencies) {
+ 962 0 boolean firstEntry = true ;
+ 963 0 final StringBuilder ids = new StringBuilder();
+ 964 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 965 0 if (firstEntry) {
+ 966 0 firstEntry = false ;
+ 967
+ } else {
+ 968 0 ids.append(", " );
+ 969
+ }
+ 970 0 ids.append(v.getName());
+ 971 0 }
+ 972 0 if (ids.length() > 0) {
+ 973 0 summary.append(d.getFileName()).append(" (" );
+ 974 0 firstEntry = true ;
+ 975 0 for (Identifier id : d.getIdentifiers()) {
+ 976 0 if (firstEntry) {
+ 977 0 firstEntry = false ;
+ 978
+ } else {
+ 979 0 summary.append(", " );
+ 980
+ }
+ 981 0 summary.append(id.getValue());
+ 982 0 }
+ 983 0 summary.append(") : " ).append(ids).append(NEW_LINE);
+ 984
+ }
+ 985 0 }
+ 986 0 if (summary.length() > 0) {
+ 987 0 final String msg = String.format("%n%n"
+ 988
+ + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+ 989
+ + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+ 990 0 LOGGER.log(Level.WARNING, msg);
+ 991
+ }
+ 992 0 }
+ 993
+
+ 994
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
index 19dfa4e87..0b5dcc9e3 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html
@@ -83,7 +83,7 @@
public void initialize() throws Exception { 33
- 34 10 }
+ 34 20 }
35
36
@@ -102,11 +102,11 @@
public void close() throws Exception {
43
- 44 15 }
+ 44 30 }
45
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
index edc674cc3..6f96557fa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractFileTypeAnalyzer.html
@@ -101,19 +101,19 @@
42
- 43 29 public AbstractFileTypeAnalyzer() {
- 44 29 final String key = getAnalyzerEnabledSettingKey();
+ 43 58 public AbstractFileTypeAnalyzer() {
+ 44 58 final String key = getAnalyzerEnabledSettingKey();
45
try {
- 46 29 enabled = Settings.getBoolean(key, true );
+ 46 58 enabled = Settings.getBoolean(key, true );
47 0 } catch (InvalidSettingException ex) {
48 0 String msg = String.format("Invalid setting for property '%s'" , key);
49 0 LOGGER.log(Level.WARNING, msg);
50 0 LOGGER.log(Level.FINE, "" , ex);
51 0 msg = String.format("%s has been disabled" , getName());
52 0 LOGGER.log(Level.WARNING, msg);
- 53 29 }
- 54 29 }
+ 53 58 }
+ 54 58 }
55
56
@@ -126,14 +126,14 @@
60
- 61 1 private static final Logger LOGGER = Logger.getLogger(AbstractFileTypeAnalyzer.class .getName());
+ 61 2 private static final Logger LOGGER = Logger.getLogger(AbstractFileTypeAnalyzer.class .getName());
62
63
64
- 65 29 private boolean filesMatched = false ;
+ 65 58 private boolean filesMatched = false ;
66
67
@@ -178,7 +178,7 @@
87
- 88 29 private boolean enabled = true ;
+ 88 58 private boolean enabled = true ;
89
90
@@ -321,14 +321,14 @@
@Override
159
public final void initialize() throws Exception {
- 160 10 if (filesMatched) {
- 161 7 initializeFileTypeAnalyzer();
+ 160 20 if (filesMatched) {
+ 161 14 initializeFileTypeAnalyzer();
162
} else {
- 163 3 enabled = false ;
+ 163 6 enabled = false ;
164
}
- 165 10 }
+ 165 20 }
166
167
@@ -351,11 +351,11 @@
@Override
176
public final void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 177 10 if (enabled) {
- 178 10 analyzeFileType(dependency, engine);
+ 177 20 if (enabled) {
+ 178 20 analyzeFileType(dependency, engine);
179
}
- 180 9 }
+ 180 18 }
181
182
@@ -374,12 +374,12 @@
@Override
189
public final boolean supportsExtension(String extension) {
- 190 4259 if (!enabled) {
- 191 854 return false ;
+ 190 8518 if (!enabled) {
+ 191 1708 return false ;
192
}
- 193 3405 final Set<String> ext = getSupportedExtensions();
- 194 3405 if (ext == null ) {
+ 193 6810 final Set<String> ext = getSupportedExtensions();
+ 194 6810 if (ext == null ) {
195 0 final String msg = String.format("The '%s' analyzer is misconfigured and does not have any file extensions;"
196
+ " it will be disabled" , getName());
@@ -387,12 +387,12 @@
198 0 return false ;
199
} else {
- 200 3405 final boolean match = ext.contains(extension);
- 201 3405 if (match) {
- 202 16 filesMatched = match;
+ 200 6810 final boolean match = ext.contains(extension);
+ 201 6810 if (match) {
+ 202 32 filesMatched = match;
203
}
- 204 3405 return match;
+ 204 6810 return match;
205
}
206
@@ -429,11 +429,11 @@
222
protected static Set<String> newHashSet(String... strings) {
- 223 11 final Set<String> set = new HashSet<String>();
+ 223 22 final Set<String> set = new HashSet<String>();
224
- 225 11 Collections.addAll(set, strings);
- 226 11 return set;
+ 225 22 Collections.addAll(set, strings);
+ 226 22 return set;
227
}
228
@@ -442,6 +442,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
index 9ada7efd9..5441b75a2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html
@@ -12,7 +12,7 @@
@@ -111,7 +111,7 @@
47
- 48 1 private static final Logger LOGGER = Logger.getLogger(AbstractSuppressionAnalyzer.class .getName());
+ 48 2 private static final Logger LOGGER = Logger.getLogger(AbstractSuppressionAnalyzer.class .getName());
49
50
@@ -150,9 +150,9 @@
@Override
67
public void initialize() throws Exception {
- 68 5 super .initialize();
- 69 5 loadSuppressionData();
- 70 4 }
+ 68 10 super .initialize();
+ 69 10 loadSuppressionData();
+ 70 8 }
71
72
@@ -213,104 +213,113 @@
100
private void loadSuppressionData() throws SuppressionParseException {
- 101 5 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
- 102 5 if (suppressionFilePath == null ) {
- 103 2 return ;
+ 101 10 final SuppressionParser parser = new SuppressionParser();
+ 102 10 File file = null ;
+ 103 10 file = new File(this .getClass().getClassLoader().getResource("dependencycheck-base-suppression.xml" ).getPath());
104
- }
- 105 3 File file = null ;
- 106 3 boolean deleteTempFile = false ;
- 107
try {
- 108 3 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
- 109 3 if (uriRx.matcher(suppressionFilePath).matches()) {
- 110 1 deleteTempFile = true ;
- 111 1 file = FileUtils.getTempFile("suppression" , "xml" );
- 112 1 final URL url = new URL(suppressionFilePath);
- 113
- try {
- 114 1 Downloader.fetchFile(url, file, false );
- 115 0 } catch (DownloadFailedException ex) {
- 116 0 Downloader.fetchFile(url, file, true );
- 117 1 }
- 118 1 } else {
- 119 2 file = new File(suppressionFilePath);
- 120 2 if (!file.exists()) {
- 121 2 final InputStream suppressionsFromClasspath = this .getClass().getClassLoader().getResourceAsStream(suppressionFilePath);
- 122 2 if (suppressionsFromClasspath != null ) {
- 123 1 deleteTempFile = true ;
- 124 1 file = FileUtils.getTempFile("suppression" , "xml" );
- 125
- try {
- 126 1 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file);
- 127 0 } catch (IOException ex) {
- 128 0 throwSuppressionParseException("Unable to locate suppressions file in classpath" , ex);
- 129 1 }
- 130
- }
- 131
- }
- 132
- }
- 133
-
- 134 3 if (file != null ) {
- 135 3 final SuppressionParser parser = new SuppressionParser();
- 136
- try {
- 137 3 rules = parser.parseSuppressionRules(file);
- 138 2 LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded." );
- 139 1 } catch (SuppressionParseException ex) {
- 140 1 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
- 141 1 LOGGER.log(Level.WARNING, msg);
- 142 1 LOGGER.log(Level.WARNING, ex.getMessage());
- 143 1 LOGGER.log(Level.FINE, "" , ex);
- 144 1 throw ex;
- 145 2 }
- 146
- }
- 147 0 } catch (DownloadFailedException ex) {
- 148 0 throwSuppressionParseException("Unable to fetch the configured suppression file" , ex);
- 149 0 } catch (MalformedURLException ex) {
- 150 0 throwSuppressionParseException("Configured suppression file has an invalid URL" , ex);
- 151 1 } catch (IOException ex) {
- 152 1 throwSuppressionParseException("Unable to create temp file for suppressions" , ex);
- 153
- } finally {
- 154 3 if (deleteTempFile && file != null ) {
- 155 2 FileUtils.delete(file);
- 156
- }
- 157
+ 105 10 rules = parser.parseSuppressionRules(file);
+ 106 0 } catch (SuppressionParseException ex) {
+ 107 0 LOGGER.log(Level.FINE, "Unable to parse the base suppression data file" , ex);
+ 108 10 }
+ 109 10 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
+ 110 10 if (suppressionFilePath == null ) {
+ 111 4 return ;
+ 112
}
- 158 2 }
- 159
+ 113 6 boolean deleteTempFile = false ;
+ 114
+ try {
+ 115 6 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
+ 116 6 if (uriRx.matcher(suppressionFilePath).matches()) {
+ 117 2 deleteTempFile = true ;
+ 118 2 file = FileUtils.getTempFile("suppression" , "xml" );
+ 119 2 final URL url = new URL(suppressionFilePath);
+ 120
+ try {
+ 121 2 Downloader.fetchFile(url, file, false );
+ 122 0 } catch (DownloadFailedException ex) {
+ 123 0 Downloader.fetchFile(url, file, true );
+ 124 2 }
+ 125 2 } else {
+ 126 4 file = new File(suppressionFilePath);
+ 127 4 if (!file.exists()) {
+ 128 4 final InputStream suppressionsFromClasspath = this .getClass().getClassLoader().getResourceAsStream(suppressionFilePath);
+ 129 4 if (suppressionsFromClasspath != null ) {
+ 130 2 deleteTempFile = true ;
+ 131 2 file = FileUtils.getTempFile("suppression" , "xml" );
+ 132
+ try {
+ 133 2 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file);
+ 134 0 } catch (IOException ex) {
+ 135 0 throwSuppressionParseException("Unable to locate suppressions file in classpath" , ex);
+ 136 2 }
+ 137
+ }
+ 138
+ }
+ 139
+ }
+ 140
+ 141 6 if (file != null ) {
+ 142
+ try {
+ 143
+
+ 144 6 rules.addAll(parser.parseSuppressionRules(file));
+ 145 4 LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded." );
+ 146 2 } catch (SuppressionParseException ex) {
+ 147 2 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
+ 148 2 LOGGER.log(Level.WARNING, msg);
+ 149 2 LOGGER.log(Level.WARNING, ex.getMessage());
+ 150 2 LOGGER.log(Level.FINE, "" , ex);
+ 151 2 throw ex;
+ 152 4 }
+ 153
+ }
+ 154 0 } catch (DownloadFailedException ex) {
+ 155 0 throwSuppressionParseException("Unable to fetch the configured suppression file" , ex);
+ 156 0 } catch (MalformedURLException ex) {
+ 157 0 throwSuppressionParseException("Configured suppression file has an invalid URL" , ex);
+ 158 2 } catch (IOException ex) {
+ 159 2 throwSuppressionParseException("Unable to create temp file for suppressions" , ex);
160
-
- 161
-
- 162
-
+ } finally { 161 6 if (deleteTempFile && file != null ) {
+ 162 4 FileUtils.delete(file);
163
-
+ } 164
-
- 165
-
+ } 165 4 }
166
-
+ 167
- private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException {
- 168 1 LOGGER.log(Level.WARNING, message);
- 169 1 LOGGER.log(Level.FINE, "" , exception);
- 170 1 throw new SuppressionParseException(message, exception);
+ 168
+
+ 169
+
+ 170
+
171
- }
+ 172
+
+ 173
+
+ 174
+ private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException {
+ 175 2 LOGGER.log(Level.WARNING, message);
+ 176 2 LOGGER.log(Level.FINE, "" , exception);
+ 177 2 throw new SuppressionParseException(message, exception);
+ 178
+ }
+ 179
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
index d56222010..651c29bcb 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html
@@ -65,7 +65,7 @@
24
- 25 5 public enum AnalysisPhase {
+ 25 10 public enum AnalysisPhase {
26
27
@@ -74,67 +74,67 @@
29
- 30 1 INITIAL,
+ 30 2 INITIAL,
31
32
33
- 34 1 INFORMATION_COLLECTION,
+ 34 2 INFORMATION_COLLECTION,
35
36
37
- 38 1 PRE_IDENTIFIER_ANALYSIS,
+ 38 2 PRE_IDENTIFIER_ANALYSIS,
39
40
41
- 42 1 IDENTIFIER_ANALYSIS,
+ 42 2 IDENTIFIER_ANALYSIS,
43
44
45
- 46 1 POST_IDENTIFIER_ANALYSIS,
+ 46 2 POST_IDENTIFIER_ANALYSIS,
47
48
49
- 50 1 PRE_FINDING_ANALYSIS,
+ 50 2 PRE_FINDING_ANALYSIS,
51
52
53
- 54 1 FINDING_ANALYSIS,
+ 54 2 FINDING_ANALYSIS,
55
56
57
- 58 1 POST_FINDING_ANALYSIS,
+ 58 2 POST_FINDING_ANALYSIS,
59
60
61
- 62 1 FINAL
+ 62 2 FINAL
63
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
index 837684047..2229f539b 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html
@@ -161,6 +161,6 @@
} 40
- 41 2 public AnalyzerService(ClassLoader classLoader) {
- 42 2 loader = ServiceLoader.load(Analyzer.class , classLoader);
- 43 2 }
+ 41 4 public AnalyzerService(ClassLoader classLoader) {
+ 42 4 loader = ServiceLoader.load(Analyzer.class , classLoader);
+ 43 4 }
44
45
@@ -114,13 +114,13 @@
50
public Iterator<Analyzer> getAnalyzers() {
- 51 2 return loader.iterator();
+ 51 4 return loader.iterator();
52
}
53
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
index 6871564c6..c8a0450e5 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html
@@ -143,7 +143,7 @@
63
- 64 1 private static final Logger LOGGER = Logger.getLogger(ArchiveAnalyzer.class .getName());
+ 64 2 private static final Logger LOGGER = Logger.getLogger(ArchiveAnalyzer.class .getName());
65
66
@@ -158,7 +158,7 @@
71
- 72 1 private static int dirCount = 0;
+ 72 2 private static int dirCount = 0;
73
74
@@ -173,7 +173,7 @@
79
- 80 1 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth" , 3);
+ 80 2 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth" , 3);
81
82
@@ -200,14 +200,14 @@
93
- 94 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
+ 94 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
95
96
97
- 98 1 private static final Set<String> ZIPPABLES = newHashSet("zip" , "ear" , "war" , "jar" , "sar" , "apk" , "nupkg" );
+ 98 2 private static final Set<String> ZIPPABLES = newHashSet("zip" , "ear" , "war" , "jar" , "sar" , "apk" , "nupkg" );
99
100
@@ -216,7 +216,7 @@
102
- 103 1 private static final Set<String> EXTENSIONS = newHashSet("tar" , "gz" , "tgz" );
+ 103 2 private static final Set<String> EXTENSIONS = newHashSet("tar" , "gz" , "tgz" );
104
105
@@ -225,19 +225,19 @@
107
- 108 1 private static final Set<String> REMOVE_FROM_ANALYSIS = newHashSet("zip" , "tar" , "gz" , "tgz" );
+ 108 2 private static final Set<String> REMOVE_FROM_ANALYSIS = newHashSet("zip" , "tar" , "gz" , "tgz" );
109
110
static {
- 111 1 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
- 112 1 if (additionalZipExt != null ) {
+ 111 2 final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
+ 112 2 if (additionalZipExt != null ) {
113 0 final HashSet ext = new HashSet<String>(Arrays.asList(additionalZipExt));
114 0 ZIPPABLES.addAll(ext);
115
}
- 116 1 EXTENSIONS.addAll(ZIPPABLES);
- 117 1 }
+ 116 2 EXTENSIONS.addAll(ZIPPABLES);
+ 117 2 }
118
119
@@ -254,7 +254,7 @@
@Override
125
public Set<String> getSupportedExtensions() {
- 126 850 return EXTENSIONS;
+ 126 1700 return EXTENSIONS;
127
}
128
@@ -273,7 +273,7 @@
@Override
135
public String getName() {
- 136 4 return ANALYZER_NAME;
+ 136 8 return ANALYZER_NAME;
137
}
138
@@ -292,7 +292,7 @@
@Override
145
public AnalysisPhase getAnalysisPhase() {
- 146 1 return ANALYSIS_PHASE;
+ 146 2 return ANALYSIS_PHASE;
147
}
148
@@ -313,7 +313,7 @@
@Override
156
protected String getAnalyzerEnabledSettingKey() {
- 157 2 return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
+ 157 4 return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
158
}
159
@@ -332,19 +332,19 @@
@Override
166
public void initializeFileTypeAnalyzer() throws Exception {
- 167 1 final File baseDir = Settings.getTempDirectory();
- 168 1 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
- 169 1 if (!tempFileLocation.delete()) {
+ 167 2 final File baseDir = Settings.getTempDirectory();
+ 168 2 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+ 169 2 if (!tempFileLocation.delete()) {
170 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
171 0 throw new AnalysisException(msg);
172
}
- 173 1 if (!tempFileLocation.mkdirs()) {
+ 173 2 if (!tempFileLocation.mkdirs()) {
174 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
175 0 throw new AnalysisException(msg);
176
}
- 177 1 }
+ 177 2 }
178
179
@@ -361,16 +361,16 @@
@Override
185
public void close() throws Exception {
- 186 1 if (tempFileLocation != null && tempFileLocation.exists()) {
- 187 1 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
- 188 1 final boolean success = FileUtils.delete(tempFileLocation);
- 189 1 if (!success && tempFileLocation != null & tempFileLocation.exists()) {
+ 186 2 if (tempFileLocation != null && tempFileLocation.exists()) {
+ 187 2 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+ 188 2 final boolean success = FileUtils.delete(tempFileLocation);
+ 189 2 if (!success && tempFileLocation != null & tempFileLocation.exists()) {
190 0 LOGGER.log(Level.WARNING, "Failed to delete some temporary files, see the log for more details" );
191
}
192
}
- 193 1 }
+ 193 2 }
194
195
@@ -393,17 +393,17 @@
@Override
204
public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
- 205 2 final File f = new File(dependency.getActualFilePath());
- 206 2 final File tmpDir = getNextTempDirectory();
- 207 2 extractFiles(f, tmpDir, engine);
+ 205 4 final File f = new File(dependency.getActualFilePath());
+ 206 4 final File tmpDir = getNextTempDirectory();
+ 207 4 extractFiles(f, tmpDir, engine);
208
209
- 210 2 List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
- 211 2 engine.scan(tmpDir);
- 212 2 List<Dependency> newDependencies = engine.getDependencies();
- 213 2 if (dependencies.size() != newDependencies.size()) {
+ 210 4 List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
+ 211 4 engine.scan(tmpDir);
+ 212 4 List<Dependency> newDependencies = engine.getDependencies();
+ 213 4 if (dependencies.size() != newDependencies.size()) {
214
215 0 final Set<Dependency> dependencySet = new HashSet<Dependency>();
@@ -443,7 +443,7 @@
238 0 }
239
}
- 240 2 if (this .REMOVE_FROM_ANALYSIS.contains(dependency.getFileExtension())) {
+ 240 4 if (this .REMOVE_FROM_ANALYSIS.contains(dependency.getFileExtension())) {
241 0 if ("zip" .equals(dependency.getFileExtension()) && isZipFileActuallyJarFile(dependency)) {
242 0 final File tdir = getNextTempDirectory();
243 0 final String fileName = dependency.getFileName();
@@ -486,8 +486,8 @@
272 0 engine.getDependencies().remove(dependency);
273
}
- 274 2 Collections.sort(engine.getDependencies());
- 275 2 }
+ 274 4 Collections.sort(engine.getDependencies());
+ 275 4 }
276
277
@@ -504,20 +504,20 @@
283
private File getNextTempDirectory() throws AnalysisException {
- 284 2 dirCount += 1;
- 285 2 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+ 284 4 dirCount += 1;
+ 285 4 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
286
- 287 2 if (directory.exists()) {
+ 287 4 if (directory.exists()) {
288 0 return getNextTempDirectory();
289
}
- 290 2 if (!directory.mkdirs()) {
+ 290 4 if (!directory.mkdirs()) {
291 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
292 0 throw new AnalysisException(msg);
293
}
- 294 2 return directory;
+ 294 4 return directory;
295
}
296
@@ -540,25 +540,25 @@
305
private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
- 306 2 if (archive == null || destination == null ) {
+ 306 4 if (archive == null || destination == null ) {
307 0 return ;
308
}
309
- 310 2 FileInputStream fis = null ;
+ 310 4 FileInputStream fis = null ;
311
try {
- 312 2 fis = new FileInputStream(archive);
+ 312 4 fis = new FileInputStream(archive);
313 0 } catch (FileNotFoundException ex) {
314 0 LOGGER.log(Level.FINE, null , ex);
315 0 throw new AnalysisException("Archive file was not found." , ex);
- 316 2 }
- 317 2 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
+ 316 4 }
+ 317 4 final String archiveExt = FileUtils.getFileExtension(archive.getName()).toLowerCase();
318
try {
- 319 2 if (ZIPPABLES.contains(archiveExt)) {
- 320 2 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
+ 319 4 if (ZIPPABLES.contains(archiveExt)) {
+ 320 4 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
321 0 } else if ("tar" .equals(archiveExt)) {
322 0 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
323 0 } else if ("gz" .equals(archiveExt) || "tgz" .equals(archiveExt)) {
@@ -581,12 +581,12 @@
338
} finally {
339 0 try {
- 340 2 fis.close();
+ 340 4 fis.close();
341 0 } catch (IOException ex) {
342 0 LOGGER.log(Level.FINEST, null , ex);
- 343 2 }
+ 343 4 }
344 0 }
- 345 2 }
+ 345 4 }
346
347
@@ -611,21 +611,21 @@
ArchiveEntry entry;
357
try {
- 358 887 while ((entry = input.getNextEntry()) != null ) {
- 359 885 if (entry.isDirectory()) {
- 360 36 final File d = new File(destination, entry.getName());
- 361 36 if (!d.exists()) {
- 362 36 if (!d.mkdirs()) {
+ 358 1774 while ((entry = input.getNextEntry()) != null ) {
+ 359 1770 if (entry.isDirectory()) {
+ 360 72 final File d = new File(destination, entry.getName());
+ 361 72 if (!d.exists()) {
+ 362 72 if (!d.mkdirs()) {
363 0 final String msg = String.format("Unable to create directory '%s'." , d.getAbsolutePath());
364 0 throw new AnalysisException(msg);
365
}
366
}
- 367 36 } else {
- 368 849 final File file = new File(destination, entry.getName());
- 369 849 final String ext = FileUtils.getFileExtension(file.getName());
- 370 849 if (engine.supportsExtension(ext)) {
+ 367 72 } else {
+ 368 1698 final File file = new File(destination, entry.getName());
+ 369 1698 final String ext = FileUtils.getFileExtension(file.getName());
+ 370 1698 if (engine.supportsExtension(ext)) {
371 0 BufferedOutputStream bos = null ;
372
FileOutputStream fos;
@@ -673,7 +673,7 @@
} 406
}
- 407 849 }
+ 407 1698 }
408
}
409 0 } catch (IOException ex) {
@@ -682,18 +682,18 @@
412 0 throw new ArchiveExtractionException(ex);
413
} finally {
- 414 2 if (input != null ) {
+ 414 4 if (input != null ) {
415
try {
- 416 2 input.close();
+ 416 4 input.close();
417 0 } catch (IOException ex) {
418 0 LOGGER.log(Level.FINEST, null , ex);
- 419 2 }
+ 419 4 }
420
}
421
}
- 422 2 }
+ 422 4 }
423
424
@@ -796,6 +796,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
index ca5114afc..3ce37ef35 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.html
@@ -12,7 +12,7 @@
@@ -135,14 +135,14 @@
59
- 60 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 60 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
61
62
63
- 64 1 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("dll" , "exe" );
+ 64 2 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("dll" , "exe" );
65
66
@@ -165,7 +165,7 @@
75
- 76 1 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzer.class .getName(), "dependencycheck-resources" );
+ 76 2 private static final Logger LOGGER = Logger.getLogger(AssemblyAnalyzer.class .getName(), "dependencycheck-resources" );
77
78
@@ -182,8 +182,8 @@
private List<String> buildArgumentList() {
84
- 85 8 final List<String> args = new ArrayList<String>();
- 86 8 if (!"\\" .equals(System.getProperty("file.separator" ))) {
+ 85 16 final List<String> args = new ArrayList<String>();
+ 86 16 if (!"\\" .equals(System.getProperty("file.separator" ))) {
87 0 if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null ) {
88 0 args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
89
@@ -193,10 +193,10 @@
}
92
}
- 93 8 args.add(grokAssemblyExe.getPath());
+ 93 16 args.add(grokAssemblyExe.getPath());
94
- 95 8 return args;
+ 95 16 return args;
96
}
97
@@ -221,83 +221,83 @@
public void analyzeFileType(Dependency dependency, Engine engine)
107
throws AnalysisException {
- 108 3 if (grokAssemblyExe == null ) {
+ 108 6 if (grokAssemblyExe == null ) {
109 0 LOGGER.warning("analyzer.AssemblyAnalyzer.notdeployed" );
110 0 return ;
111
}
112
- 113 3 final List<String> args = buildArgumentList();
- 114 3 args.add(dependency.getActualFilePath());
- 115 3 final ProcessBuilder pb = new ProcessBuilder(args);
- 116 3 BufferedReader rdr = null ;
- 117 3 Document doc = null ;
+ 113 6 final List<String> args = buildArgumentList();
+ 114 6 args.add(dependency.getActualFilePath());
+ 115 6 final ProcessBuilder pb = new ProcessBuilder(args);
+ 116 6 BufferedReader rdr = null ;
+ 117 6 Document doc = null ;
118
try {
- 119 3 final Process proc = pb.start();
+ 119 6 final Process proc = pb.start();
120
- 121 3 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8" ));
- 122 3 String line = null ;
- 123 3 while (rdr.ready() && (line = rdr.readLine()) != null ) {
+ 121 6 rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8" ));
+ 122 6 String line = null ;
+ 123 6 while (rdr.ready() && (line = rdr.readLine()) != null ) {
124 0 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.stderr" , line);
125
}
- 126 3 int rc = 0;
- 127 3 doc = builder.parse(proc.getInputStream());
+ 126 6 int rc = 0;
+ 127 6 doc = builder.parse(proc.getInputStream());
128
129
try {
- 130 3 rc = proc.waitFor();
+ 130 6 rc = proc.waitFor();
131 0 } catch (InterruptedException ie) {
132
return ;
- 133 3 }
- 134 3 if (rc == 3) {
+ 133 6 }
+ 134 6 if (rc == 3) {
135 0 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.notassembly" , dependency.getActualFilePath());
136
return ;
- 137 3 } else if (rc != 0) {
- 138 1 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.rc" , rc);
+ 137 6 } else if (rc != 0) {
+ 138 2 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.rc" , rc);
139
}
140
- 141 3 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 141 6 final XPath xpath = XPathFactory.newInstance().newXPath();
142
143
- 144 3 final String error = xpath.evaluate("/assembly/error" , doc);
- 145 3 if (error != null && !"" .equals(error)) {
- 146 1 throw new AnalysisException(error);
+ 144 6 final String error = xpath.evaluate("/assembly/error" , doc);
+ 145 6 if (error != null && !"" .equals(error)) {
+ 146 2 throw new AnalysisException(error);
147
}
148
- 149 2 final String version = xpath.evaluate("/assembly/version" , doc);
- 150 2 if (version != null ) {
- 151 2 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
+ 149 4 final String version = xpath.evaluate("/assembly/version" , doc);
+ 150 4 if (version != null ) {
+ 151 4 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly" , "version" ,
152
version, Confidence.HIGHEST));
153
}
154
- 155 2 final String vendor = xpath.evaluate("/assembly/company" , doc);
- 156 2 if (vendor != null ) {
- 157 2 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
+ 155 4 final String vendor = xpath.evaluate("/assembly/company" , doc);
+ 156 4 if (vendor != null ) {
+ 157 4 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly" , "vendor" ,
158
vendor, Confidence.HIGH));
159
}
160
- 161 2 final String product = xpath.evaluate("/assembly/product" , doc);
- 162 2 if (product != null ) {
- 163 2 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
+ 161 4 final String product = xpath.evaluate("/assembly/product" , doc);
+ 162 4 if (product != null ) {
+ 163 4 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly" , "product" ,
164
product, Confidence.HIGH));
165
@@ -314,18 +314,18 @@
173 0 throw new AnalysisException(xpe);
174
} finally {
- 175 3 if (rdr != null ) {
+ 175 6 if (rdr != null ) {
176
try {
- 177 3 rdr.close();
+ 177 6 rdr.close();
178 0 } catch (IOException ex) {
179 0 LOGGER.log(Level.FINEST, "ignore" , ex);
- 180 4 }
+ 180 8 }
181
}
182
}
- 183 2 }
+ 183 4 }
184
185
@@ -342,201 +342,202 @@
@Override
191
public void initializeFileTypeAnalyzer() throws Exception {
- 192 5 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
- 193 5 FileOutputStream fos = null ;
- 194 5 InputStream is = null ;
+ 192 10 final File tempFile = File.createTempFile("GKA" , ".exe" , Settings.getTempDirectory());
+ 193 10 FileOutputStream fos = null ;
+ 194 10 InputStream is = null ;
195
try {
- 196 5 fos = new FileOutputStream(tempFile);
- 197 5 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
- 198 5 final byte [] buff = new byte [4096];
- 199 5 int bread = -1;
- 200 15 while ((bread = is.read(buff)) >= 0) {
- 201 10 fos.write(buff, 0, bread);
+ 196 10 fos = new FileOutputStream(tempFile);
+ 197 10 is = AssemblyAnalyzer.class .getClassLoader().getResourceAsStream("GrokAssembly.exe" );
+ 198 10 final byte [] buff = new byte [4096];
+ 199 10 int bread = -1;
+ 200 30 while ((bread = is.read(buff)) >= 0) {
+ 201 20 fos.write(buff, 0, bread);
202
}
- 203 5 grokAssemblyExe = tempFile;
+ 203 10 grokAssemblyExe = tempFile;
204
- 205 5 grokAssemblyExe.deleteOnExit();
- 206 5 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.deployed" , grokAssemblyExe.getPath());
+ 205 10 grokAssemblyExe.deleteOnExit();
+ 206 10 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.deployed" , grokAssemblyExe.getPath());
207 0 } catch (IOException ioe) {
- 208 0 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.notdeployed" , ioe.getMessage());
- 209 0 throw new AnalysisException("Could not extract GrokAssembly.exe" , ioe);
- 210
+ 208 0 this .setEnabled(false );
+ 209 0 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.notdeployed" , ioe.getMessage());
+ 210 0 throw new AnalysisException("Could not extract GrokAssembly.exe" , ioe);
+ 211
} finally {
- 211 5 if (fos != null ) {
- 212
+ 212 10 if (fos != null ) {
+ 213
try {
- 213 5 fos.close();
- 214 0 } catch (Throwable e) {
- 215 0 LOGGER.fine("Error closing output stream" );
- 216 5 }
- 217
+ 214 10 fos.close();
+ 215 0 } catch (Throwable e) {
+ 216 0 LOGGER.fine("Error closing output stream" );
+ 217 10 }
+ 218
}
- 218 5 if (is != null ) {
- 219
+ 219 10 if (is != null ) {
+ 220
try {
- 220 5 is.close();
- 221 0 } catch (Throwable e) {
- 222 0 LOGGER.fine("Error closing input stream" );
- 223 5 }
- 224
- }
+ 221 10 is.close();
+ 222 0 } catch (Throwable e) {
+ 223 0 LOGGER.fine("Error closing input stream" );
+ 224 10 }
225
- }
+ } 226
-
- 227
-
- 228 5 final List<String> args = buildArgumentList();
- 229 5 BufferedReader rdr = null ;
- 230
- try {
- 231 5 final ProcessBuilder pb = new ProcessBuilder(args);
- 232 5 final Process p = pb.start();
- 233
-
- 234 5 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8" ));
- 235 5 while (rdr.ready() && rdr.readLine() != null ) {
- 236
-
- 237
- }
- 238 5 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
- 239 5 final XPath xpath = XPathFactory.newInstance().newXPath();
- 240 5 final String error = xpath.evaluate("/assembly/error" , doc);
- 241 5 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
- 242 0 LOGGER.warning("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details." );
- 243 0 LOGGER.fine("GrokAssembly.exe is not working properly" );
- 244 0 grokAssemblyExe = null ;
- 245 0 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer" );
- 246
- }
- 247 0 } catch (Throwable e) {
- 248 0 if (e instanceof AnalysisException) {
- 249 0 throw (AnalysisException) e;
- 250
- } else {
- 251 0 LOGGER.warning("analyzer.AssemblyAnalyzer.grokassembly.initialization.failed" );
- 252 0 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.initialization.message" , e.getMessage());
- 253 0 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer" , e);
- 254
- }
- 255
- } finally {
- 256 5 if (rdr != null ) {
- 257
- try {
- 258 5 rdr.close();
- 259 0 } catch (IOException ex) {
- 260 0 LOGGER.log(Level.FINEST, "ignore" , ex);
- 261 5 }
- 262
- }
- 263
}
- 264
+ 227
- 265 5 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
- 266 5 }
- 267
-
- 268
- @Override
- 269
- public void close() throws Exception {
- 270 6 super .close();
- 271
+ 228
+
+ 229 10 final List<String> args = buildArgumentList();
+ 230 10 BufferedReader rdr = null ;
+ 231
try {
- 272 6 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
- 273 0 grokAssemblyExe.deleteOnExit();
- 274
+ 232 10 final ProcessBuilder pb = new ProcessBuilder(args);
+ 233 10 final Process p = pb.start();
+ 234
+
+ 235 10 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8" ));
+ 236 10 while (rdr.ready() && rdr.readLine() != null ) {
+ 237
+
+ 238
}
- 275 0 } catch (SecurityException se) {
- 276 0 LOGGER.fine("analyzer.AssemblyAnalyzer.grokassembly.notdeleted" );
- 277 6 }
- 278 6 }
- 279
+ 239 10 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
+ 240 10 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 241 10 final String error = xpath.evaluate("/assembly/error" , doc);
+ 242 10 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
+ 243 0 LOGGER.warning("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details." );
+ 244 0 LOGGER.fine("GrokAssembly.exe is not working properly" );
+ 245 0 grokAssemblyExe = null ;
+ 246 0 this .setEnabled(false );
+ 247 0 throw new AnalysisException("Could not execute .NET AssemblyAnalyzer" );
+ 248
+ }
+ 249 0 } catch (Throwable e) {
+ 250 0 if (e instanceof AnalysisException) {
+ 251 0 throw (AnalysisException) e;
+ 252
+ } else {
+ 253 0 LOGGER.warning("analyzer.AssemblyAnalyzer.grokassembly.initialization.failed" );
+ 254 0 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.initialization.message" , e.getMessage());
+ 255 0 this .setEnabled(false );
+ 256 0 throw new AnalysisException("An error occured with the .NET AssemblyAnalyzer" , e);
+ 257
+ }
+ 258
+ } finally {
+ 259 10 if (rdr != null ) {
+ 260
+ try {
+ 261 10 rdr.close();
+ 262 0 } catch (IOException ex) {
+ 263 0 LOGGER.log(Level.FINEST, "ignore" , ex);
+ 264 10 }
+ 265
+ }
+ 266
+ }
+ 267 10 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ 268 10 }
+ 269
- 280
-
+ 270
+ @Override
+ 271
+ public void close() throws Exception {
+ 272 12 super .close();
+ 273
+ try {
+ 274 12 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
+ 275 0 grokAssemblyExe.deleteOnExit();
+ 276
+ }
+ 277 0 } catch (SecurityException se) {
+ 278 0 LOGGER.fine("analyzer.AssemblyAnalyzer.grokassembly.notdeleted" );
+ 279 12 }
+ 280 12 }
281
-
+ 282
-
+ 283
-
+ 284
-
+ 285
- @Override
+ 286
- public Set<String> getSupportedExtensions() {
- 287 853 return SUPPORTED_EXTENSIONS;
+ 287
+ @Override
288
- }
- 289
-
+ public Set<String> getSupportedExtensions() { 289 1706 return SUPPORTED_EXTENSIONS;
290
-
+ } 291
-
+ 292
-
+ 293
-
+ 294
-
+ 295
- @Override
+ 296
- public String getName() {
- 297 5 return ANALYZER_NAME;
+ 297
+ @Override
298
- }
- 299
-
+ public String getName() { 299 10 return ANALYZER_NAME;
300
-
+ } 301
-
- 302
-
- 303
-
- 304
-
- 305
- @Override
- 306
- public AnalysisPhase getAnalysisPhase() {
- 307 1 return ANALYSIS_PHASE;
- 308
- }
- 309
- 310
+ 302
- 311
-
- 312
+ 303
+
+ 304
- 313
-
- 314
+ 305
+
+ 306
- 315
+ 307
@Override
- 316
- protected String getAnalyzerEnabledSettingKey() {
- 317 7 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
- 318
+ 308
+ public AnalysisPhase getAnalysisPhase() {
+ 309 2 return ANALYSIS_PHASE;
+ 310
}
- 319
+ 311
+
+ 312
+
+ 313
+
+ 314
+
+ 315
+
+ 316
+
+ 317
+ @Override
+ 318
+ protected String getAnalyzerEnabledSettingKey() {
+ 319 14 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
+ 320
+ }
+ 321
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
index 639b3c060..95f12048a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html
@@ -12,7 +12,7 @@
Classes in this File Line Coverage Branch Coverage Complexity CPEAnalyzer 4.428571428571429; 4.429CPEAnalyzer 4.428571428571429; 4.429CPEAnalyzer$IdentifierConfidence 4.428571428571429; 4.429CPEAnalyzer$IdentifierMatch 4.428571428571429; 4.429 63
- 64 1 private static final Logger LOGGER = Logger.getLogger(CPEAnalyzer.class .getName());
+ 64 2 private static final Logger LOGGER = Logger.getLogger(CPEAnalyzer.class .getName());
65
66
@@ -228,7 +228,7 @@
@Override
105
public String getName() {
- 106 4 return "CPE Analyzer" ;
+ 106 8 return "CPE Analyzer" ;
107
}
108
@@ -247,7 +247,7 @@
@Override
115
public AnalysisPhase getAnalysisPhase() {
- 116 1 return AnalysisPhase.IDENTIFIER_ANALYSIS;
+ 116 2 return AnalysisPhase.IDENTIFIER_ANALYSIS;
117
}
118
@@ -266,8 +266,8 @@
@Override
125
public void initialize() throws Exception {
- 126 1 this .open();
- 127 1 }
+ 126 2 this .open();
+ 127 2 }
128
129
@@ -286,19 +286,19 @@
136
public void open() throws IOException, DatabaseException {
- 137 1 LOGGER.log(Level.FINE, "Opening the CVE Database" );
- 138 1 cve = new CveDB();
- 139 1 cve.open();
- 140 1 LOGGER.log(Level.FINE, "Creating the Lucene CPE Index" );
- 141 1 cpe = CpeMemoryIndex.getInstance();
+ 137 2 LOGGER.log(Level.FINE, "Opening the CVE Database" );
+ 138 2 cve = new CveDB();
+ 139 2 cve.open();
+ 140 2 LOGGER.log(Level.FINE, "Creating the Lucene CPE Index" );
+ 141 2 cpe = CpeMemoryIndex.getInstance();
142
try {
- 143 1 cpe.open(cve);
+ 143 2 cpe.open(cve);
144 0 } catch (IndexException ex) {
145 0 LOGGER.log(Level.FINE, "IndexException" , ex);
146 0 throw new DatabaseException(ex);
- 147 1 }
- 148 1 }
+ 147 2 }
+ 148 2 }
149
150
@@ -311,15 +311,15 @@
@Override
154
public void close() {
- 155 1 if (cpe != null ) {
- 156 1 cpe.close();
+ 155 2 if (cpe != null ) {
+ 156 2 cpe.close();
157
}
- 158 1 if (cve != null ) {
- 159 1 cve.close();
+ 158 2 if (cve != null ) {
+ 159 2 cve.close();
160
}
- 161 1 }
+ 161 2 }
162
163
@@ -342,56 +342,56 @@
172
protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
- 173 2 Confidence confidence = Confidence.HIGHEST;
+ 173 4 Confidence confidence = Confidence.HIGHEST;
174
- 175 2 String vendors = addEvidenceWithoutDuplicateTerms("" , dependency.getVendorEvidence(), confidence);
- 176 2 String products = addEvidenceWithoutDuplicateTerms("" , dependency.getProductEvidence(), confidence);
+ 175 4 String vendors = addEvidenceWithoutDuplicateTerms("" , dependency.getVendorEvidence(), confidence);
+ 176 4 String products = addEvidenceWithoutDuplicateTerms("" , dependency.getProductEvidence(), confidence);
177
178
- 179 2 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
+ 179 4 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
180
- 181 2 int ctr = 0;
+ 181 4 int ctr = 0;
182
do {
- 183 8 if (!vendors.isEmpty() && !products.isEmpty()) {
- 184 8 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
+ 183 16 if (!vendors.isEmpty() && !products.isEmpty()) {
+ 184 16 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
185
dependency.getVendorEvidence().getWeighting());
186
- 187 8 for (IndexEntry e : entries) {
- 188 54 if (verifyEntry(e, dependency)) {
- 189 4 final String vendor = e.getVendor();
- 190 4 final String product = e.getProduct();
- 191 4 determineIdentifiers(dependency, vendor, product);
+ 187 16 for (IndexEntry e : entries) {
+ 188 108 if (verifyEntry(e, dependency)) {
+ 189 8 final String vendor = e.getVendor();
+ 190 8 final String product = e.getProduct();
+ 191 8 determineIdentifiers(dependency, vendor, product);
192
}
- 193 54 }
+ 193 108 }
194
}
- 195 8 confidence = reduceConfidence(confidence);
- 196 8 if (dependency.getVendorEvidence().contains(confidence)) {
- 197 8 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
+ 195 16 confidence = reduceConfidence(confidence);
+ 196 16 if (dependency.getVendorEvidence().contains(confidence)) {
+ 197 16 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
198
}
- 199 8 if (dependency.getProductEvidence().contains(confidence)) {
- 200 7 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
+ 199 16 if (dependency.getProductEvidence().contains(confidence)) {
+ 200 14 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
201
}
202
203
- 204 8 if (dependency.getVersionEvidence().contains(confidence)) {
- 205 6 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
+ 204 16 if (dependency.getVersionEvidence().contains(confidence)) {
+ 205 12 addEvidenceWithoutDuplicateTerms("" , dependency.getVersionEvidence(), confidence);
206
}
- 207 8 } while ((++ctr) < 4);
- 208 2 }
+ 207 16 } while ((++ctr) < 4);
+ 208 4 }
209
210
@@ -416,31 +416,31 @@
220
private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
- 221 27 final String txt = (text == null ) ? "" : text;
- 222 27 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
- 223 27 sb.append(' ' ).append(txt).append(' ' );
- 224 27 for (Evidence e : ec.iterator(confidenceFilter)) {
- 225 76 String value = e.getValue();
+ 221 54 final String txt = (text == null ) ? "" : text;
+ 222 54 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
+ 223 54 sb.append(' ' ).append(txt).append(' ' );
+ 224 54 for (Evidence e : ec.iterator(confidenceFilter)) {
+ 225 152 String value = e.getValue();
226
227
228
- 229 76 if (value.startsWith("http://" )) {
- 230 4 value = value.substring(7).replaceAll("\\." , " " );
+ 229 152 if (value.startsWith("http://" )) {
+ 230 8 value = value.substring(7).replaceAll("\\." , " " );
231
}
- 232 76 if (value.startsWith("https://" )) {
+ 232 152 if (value.startsWith("https://" )) {
233 0 value = value.substring(8).replaceAll("\\." , " " );
234
}
- 235 76 if (sb.indexOf(" " + value + " " ) < 0) {
- 236 48 sb.append(value).append(' ' );
+ 235 152 if (sb.indexOf(" " + value + " " ) < 0) {
+ 236 96 sb.append(value).append(' ' );
237
}
- 238 76 }
- 239 27 return sb.toString().trim();
+ 238 152 }
+ 239 54 return sb.toString().trim();
240
}
241
@@ -459,13 +459,13 @@
248
private Confidence reduceConfidence(final Confidence c) {
- 249 8 if (c == Confidence.HIGHEST) {
- 250 2 return Confidence.HIGH;
- 251 6 } else if (c == Confidence.HIGH) {
- 252 2 return Confidence.MEDIUM;
+ 249 16 if (c == Confidence.HIGHEST) {
+ 250 4 return Confidence.HIGH;
+ 251 12 } else if (c == Confidence.HIGH) {
+ 252 4 return Confidence.MEDIUM;
253
} else {
- 254 4 return Confidence.LOW;
+ 254 8 return Confidence.LOW;
255
}
256
@@ -514,23 +514,23 @@
Set<String> vendorWeightings, Set<String> productWeightings)
278
throws CorruptIndexException, IOException, ParseException {
- 279 8 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
+ 279 16 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
280
- 281 8 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
- 282 8 if (searchString == null ) {
+ 281 16 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
+ 282 16 if (searchString == null ) {
283 0 return ret;
284
}
285
- 286 8 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
- 287 208 for (ScoreDoc d : docs.scoreDocs) {
- 288 200 if (d.score >= 0.08) {
- 289 54 final Document doc = cpe.getDocument(d.doc);
- 290 54 final IndexEntry entry = new IndexEntry();
- 291 54 entry.setVendor(doc.get(Fields.VENDOR));
- 292 54 entry.setProduct(doc.get(Fields.PRODUCT));
+ 286 16 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
+ 287 416 for (ScoreDoc d : docs.scoreDocs) {
+ 288 400 if (d.score >= 0.08) {
+ 289 108 final Document doc = cpe.getDocument(d.doc);
+ 290 108 final IndexEntry entry = new IndexEntry();
+ 291 108 entry.setVendor(doc.get(Fields.VENDOR));
+ 292 108 entry.setProduct(doc.get(Fields.PRODUCT));
293
294
@@ -545,16 +545,16 @@
299
- 300 54 entry.setSearchScore(d.score);
- 301 54 if (!ret.contains(entry)) {
- 302 54 ret.add(entry);
+ 300 108 entry.setSearchScore(d.score);
+ 301 108 if (!ret.contains(entry)) {
+ 302 108 ret.add(entry);
303
}
304
}
305
}
- 306 8 return ret;
+ 306 16 return ret;
307
}
308
@@ -591,23 +591,23 @@
protected String buildSearch(String vendor, String product,
324
Set<String> vendorWeighting, Set<String> productWeightings) {
- 325 8 final String v = vendor;
- 326 8 final String p = product;
- 327 8 final StringBuilder sb = new StringBuilder(v.length() + p.length()
+ 325 16 final String v = vendor;
+ 326 16 final String p = product;
+ 327 16 final StringBuilder sb = new StringBuilder(v.length() + p.length()
328
+ Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
329
- 330 8 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
+ 330 16 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
331 0 return null ;
332
}
- 333 8 sb.append(" AND " );
- 334 8 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
+ 333 16 sb.append(" AND " );
+ 334 16 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
335 0 return null ;
336
}
- 337 8 return sb.toString();
+ 337 16 return sb.toString();
338
}
339
@@ -636,47 +636,47 @@
351
private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
- 352 16 sb.append(" " ).append(field).append(":( " );
+ 352 32 sb.append(" " ).append(field).append(":( " );
353
- 354 16 final String cleanText = cleanseText(searchText);
+ 354 32 final String cleanText = cleanseText(searchText);
355
- 356 16 if ("" .equals(cleanText)) {
+ 356 32 if ("" .equals(cleanText)) {
357 0 return false ;
358
}
359
- 360 16 if (weightedText == null || weightedText.isEmpty()) {
+ 360 32 if (weightedText == null || weightedText.isEmpty()) {
361 0 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
362
} else {
- 363 16 final StringTokenizer tokens = new StringTokenizer(cleanText);
- 364 240 while (tokens.hasMoreElements()) {
- 365 224 final String word = tokens.nextToken();
- 366 224 String temp = null ;
- 367 224 for (String weighted : weightedText) {
- 368 408 final String weightedStr = cleanseText(weighted);
- 369 408 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
- 370 30 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
- 371 30 if (!word.equalsIgnoreCase(weightedStr)) {
+ 363 32 final StringTokenizer tokens = new StringTokenizer(cleanText);
+ 364 480 while (tokens.hasMoreElements()) {
+ 365 448 final String word = tokens.nextToken();
+ 366 448 String temp = null ;
+ 367 448 for (String weighted : weightedText) {
+ 368 816 final String weightedStr = cleanseText(weighted);
+ 369 816 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
+ 370 60 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
+ 371 60 if (!word.equalsIgnoreCase(weightedStr)) {
372 0 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
373
}
374
}
- 375 408 }
- 376 224 if (temp == null ) {
- 377 194 temp = LuceneUtils.escapeLuceneQuery(word);
+ 375 816 }
+ 376 448 if (temp == null ) {
+ 377 388 temp = LuceneUtils.escapeLuceneQuery(word);
378
}
- 379 224 sb.append(" " ).append(temp);
- 380 224 }
+ 379 448 sb.append(" " ).append(temp);
+ 380 448 }
381
}
- 382 16 sb.append(" ) " );
- 383 16 return true ;
+ 382 32 sb.append(" ) " );
+ 383 32 return true ;
384
}
385
@@ -695,7 +695,7 @@
392
private String cleanseText(String text) {
- 393 424 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
+ 393 848 return text.replaceAll(CLEANSE_CHARACTER_RX, " " );
394
}
395
@@ -716,15 +716,15 @@
403
private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
- 404 408 if (l == null || r == null ) {
+ 404 816 if (l == null || r == null ) {
405 0 return false ;
406
}
407
- 408 408 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
- 409 408 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
- 410 408 return left.equalsIgnoreCase(right);
+ 408 816 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "" );
+ 409 816 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "" );
+ 410 816 return left.equalsIgnoreCase(right);
411
}
412
@@ -747,18 +747,18 @@
421
private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
- 422 54 boolean isValid = false ;
+ 422 108 boolean isValid = false ;
423
- 424 54 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
+ 424 108 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
425
&& collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
426
- 427 4 isValid = true ;
+ 427 8 isValid = true ;
428
}
- 429 54 return isValid;
+ 429 108 return isValid;
430
}
431
@@ -803,14 +803,14 @@
451
- 452 59 if (text == null ) {
+ 452 118 if (text == null ) {
453 0 return false ;
454
}
- 455 59 final String[] words = text.split("[\\s_-]" );
- 456 59 final List<String> list = new ArrayList<String>();
- 457 59 String tempWord = null ;
- 458 174 for (String word : words) {
+ 455 118 final String[] words = text.split("[\\s_-]" );
+ 456 118 final List<String> list = new ArrayList<String>();
+ 457 118 String tempWord = null ;
+ 458 348 for (String word : words) {
459
460
@@ -819,28 +819,28 @@
462
- 463 115 if (tempWord != null ) {
- 464 4 list.add(tempWord + word);
- 465 4 tempWord = null ;
- 466 111 } else if (word.length() <= 2) {
- 467 4 tempWord = word;
+ 463 230 if (tempWord != null ) {
+ 464 8 list.add(tempWord + word);
+ 465 8 tempWord = null ;
+ 466 222 } else if (word.length() <= 2) {
+ 467 8 tempWord = word;
468
} else {
- 469 107 list.add(word);
+ 469 214 list.add(word);
470
}
471
}
- 472 59 if (tempWord != null && !list.isEmpty()) {
+ 472 118 if (tempWord != null && !list.isEmpty()) {
473 0 final String tmp = list.get(list.size() - 1) + tempWord;
474 0 list.add(tmp);
475
}
- 476 59 boolean contains = true ;
- 477 59 for (String word : list) {
- 478 111 contains &= ec.containsUsedString(word);
- 479 111 }
- 480 59 return contains;
+ 476 118 boolean contains = true ;
+ 477 118 for (String word : list) {
+ 478 222 contains &= ec.containsUsedString(word);
+ 479 222 }
+ 480 118 return contains;
481
}
482
@@ -865,15 +865,15 @@
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
492
try {
- 493 2 determineCPE(dependency);
+ 493 4 determineCPE(dependency);
494 0 } catch (CorruptIndexException ex) {
495 0 throw new AnalysisException("CPE Index is corrupt." , ex);
496 0 } catch (IOException ex) {
497 0 throw new AnalysisException("Failure opening the CPE Index." , ex);
498 0 } catch (ParseException ex) {
499 0 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency." , ex);
- 500 2 }
- 501 2 }
+ 500 4 }
+ 501 4 }
502
503
@@ -898,422 +898,420 @@
513
private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException {
- 514 4 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
- 515 4 DependencyVersion bestGuess = new DependencyVersion("-" );
- 516 4 Confidence bestGuessConf = null ;
- 517 4 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
- 518 20 for (Confidence conf : Confidence.values()) {
- 519 16 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
- 520 16 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
- 521 16 if (evVer == null ) {
+ 514 8 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
+ 515 8 DependencyVersion bestGuess = new DependencyVersion("-" );
+ 516 8 Confidence bestGuessConf = null ;
+ 517 8 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
+ 518 40 for (Confidence conf : Confidence.values()) {
+ 519 32 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
+ 520 32 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
+ 521 32 if (evVer == null ) {
522 0 continue ;
523
}
- 524 16 for (VulnerableSoftware vs : cpes) {
+ 524 32 for (VulnerableSoftware vs : cpes) {
525
DependencyVersion dbVer;
- 526 240 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
- 527 72 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
+ 526 1248 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
+ 527 512 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
528
} else {
- 529 168 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
+ 529 736 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
530
}
- 531 240 if (dbVer == null
+ 531 1248 if (dbVer == null
532
|| evVer.equals(dbVer)) {
533
- 534
-
- 535 16 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
- 536 16 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
- 537 16 collected.add(match);
- 538 16 } else {
- 539
+ 534 32 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
+ 535 32 final IdentifierMatch match = new IdentifierMatch("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
+ 536 32 collected.add(match);
+ 537 32 } else {
+ 538
- 540 224 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
- 541
+ 539 1216 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
+ 540
&& evVer.matchesAtLeastThreeLevels(dbVer)) {
- 542 56 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
- 543 2 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
- 544 2 bestGuess = dbVer;
- 545 2 bestGuessConf = conf;
- 546
+ 541 256 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+ 542 8 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
+ 543 8 bestGuess = dbVer;
+ 544 8 bestGuessConf = conf;
+ 545
}
- 547
+ 546
}
- 548
+ 547
}
- 549
+ 548
+ }
+ 549 1248 }
+ 550 32 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+ 551 0 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
+ 552 0 bestGuess = evVer;
+ 553 0 bestGuessConf = conf;
+ 554
}
- 550 240 }
- 551 16 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
- 552 2 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
- 553 2 bestGuess = evVer;
- 554 2 bestGuessConf = conf;
555
- }
- 556
}
- 557 16 }
- 558
+ 556 32 }
+ 557
}
- 559 4 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
- 560 4 final String url = null ;
- 561 4 if (bestGuessConf == null ) {
- 562 0 bestGuessConf = Confidence.LOW;
- 563
+ 558 8 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
+ 559 8 final String url = null ;
+ 560 8 if (bestGuessConf == null ) {
+ 561 0 bestGuessConf = Confidence.LOW;
+ 562
}
- 564 4 final IdentifierMatch match = new IdentifierMatch("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
- 565 4 collected.add(match);
- 566
+ 563 8 final IdentifierMatch match = new IdentifierMatch("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
+ 564 8 collected.add(match);
+ 565
- 567 4 Collections.sort(collected);
- 568 4 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
- 569 4 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
- 570 4 for (IdentifierMatch m : collected) {
- 571 20 if (bestIdentifierQuality.equals(m.getConfidence())
- 572
+ 566 8 Collections.sort(collected);
+ 567 8 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
+ 568 8 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
+ 569 8 for (IdentifierMatch m : collected) {
+ 570 40 if (bestIdentifierQuality.equals(m.getConfidence())
+ 571
&& bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
- 573 4 final Identifier i = m.getIdentifier();
- 574 4 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
- 575 0 i.setConfidence(Confidence.LOW);
- 576
+ 572 8 final Identifier i = m.getIdentifier();
+ 573 8 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
+ 574 0 i.setConfidence(Confidence.LOW);
+ 575
} else {
- 577 4 i.setConfidence(bestEvidenceQuality);
- 578
+ 576 8 i.setConfidence(bestEvidenceQuality);
+ 577
}
- 579 4 dependency.addIdentifier(i);
- 580
+ 578 8 dependency.addIdentifier(i);
+ 579
}
- 581 20 }
- 582 4 }
+ 580 40 }
+ 581 8 }
+ 582
+
583
-
+ 584
-
- 585
- 586
+ 585
- 587 1 private enum IdentifierConfidence {
+ 586 2 private enum IdentifierConfidence {
+ 587
+
588
-
+ 589
-
- 590
- 591
+ 590
- 592 1 EXACT_MATCH,
+ 591 2 EXACT_MATCH,
+ 592
+
593
-
- 594
- 595
+ 594
- 596 1 BEST_GUESS
+ 595 2 BEST_GUESS
+ 596
+ }
597
- }
+ 598
-
- 599
- 600
+ 599
- 601
+ 600
- 602 16 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
+ 601 32 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
+ 602
+
603
-
+ 604
-
- 605
+ 605
+
606
-
- 607
- 608
+ 607
- 609
+ 608
- 610
+ 609
- 611
+ 610
- 612
+ 611
- 613 20 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
- 614 20 this .identifier = new Identifier(type, value, url);
- 615 20 this .confidence = identifierConfidence;
- 616 20 this .evidenceConfidence = evidenceConfidence;
- 617 20 }
- 618
+ 612 40 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
+ 613 40 this .identifier = new Identifier(type, value, url);
+ 614 40 this .confidence = identifierConfidence;
+ 615 40 this .evidenceConfidence = evidenceConfidence;
+ 616 40 }
+ 617
+ 618
+
619
-
- 620
+ 620
+
621
-
- 622
private Confidence evidenceConfidence;
+ 622
+
623
-
+ 624
-
- 625
+ 625
+
626
-
- 627
+ 627
+
628
-
- 629
public Confidence getEvidenceConfidence() {
- 630
+ 629
return evidenceConfidence;
+ 630
+ }
631
- }
+ 632
-
+ 633
-
- 634
+ 634
+
635
-
- 636
+ 636
+
637
-
- 638
public void setEvidenceConfidence(Confidence evidenceConfidence) {
- 639
+ 638
this .evidenceConfidence = evidenceConfidence;
+ 639
+ }
640
- }
+ 641
-
- 642
+ 642
+
643
-
- 644
private IdentifierConfidence confidence;
+ 644
+
645
-
+ 646
-
- 647
+ 647
+
648
-
- 649
+ 649
+
650
-
- 651
public IdentifierConfidence getConfidence() {
- 652
+ 651
return confidence;
+ 652
+ }
653
- }
+ 654
-
+ 655
-
- 656
+ 656
+
657
-
- 658
+ 658
+
659
-
- 660
public void setConfidence(IdentifierConfidence confidence) {
- 661
+ 660
this .confidence = confidence;
+ 661
+ }
662
- }
+ 663
-
- 664
+ 664
+
665
-
- 666
private Identifier identifier;
+ 666
+
667
-
+ 668
-
- 669
+ 669
+
670
-
- 671
+ 671
+
672
-
- 673
public Identifier getIdentifier() {
- 674
+ 673
return identifier;
+ 674
+ }
675
- }
+ 676
-
+ 677
-
- 678
+ 678
+
679
-
- 680
+ 680
+
681
-
- 682
public void setIdentifier(Identifier identifier) {
- 683
+ 682
this .identifier = identifier;
+ 683
+ }
684
- }
+ 685
-
- 686
+ 686
+
687
-
+ 688
-
- 689
+ 689
+
690
-
- 691
+ 691
+
692
-
+ @Override 693
- @Override
- 694
public String toString() {
- 695 0 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
- 696
+ 694 0 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
+ 695
+ ", confidence=" + confidence + ", identifier=" + identifier + '}' ;
+ 696
+ }
697
- }
+ 698
-
+ 699
-
- 700
+ 700
+
701
-
- 702
+ 702
+
703
-
+ @Override 704
- @Override
- 705
public int hashCode() {
- 706 0 int hash = 5;
- 707 0 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
- 708 0 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
- 709 0 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
- 710 0 return hash;
+ 705 0 int hash = 5;
+ 706 0 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
+ 707 0 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
+ 708 0 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
+ 709 0 return hash;
+ 710
+ }
711
- }
+ 712
-
+ 713
-
- 714
+ 714
+
715
-
- 716
- 717
+ 716
+ 717
+
718
-
+ @Override 719
- @Override
- 720
public boolean equals(Object obj) {
- 721 0 if (obj == null ) {
- 722 0 return false ;
- 723
+ 720 0 if (obj == null ) {
+ 721 0 return false ;
+ 722
}
- 724 0 if (getClass() != obj.getClass()) {
- 725 0 return false ;
- 726
+ 723 0 if (getClass() != obj.getClass()) {
+ 724 0 return false ;
+ 725
}
- 727 0 final IdentifierMatch other = (IdentifierMatch) obj;
- 728 0 if (this .evidenceConfidence != other.evidenceConfidence) {
- 729 0 return false ;
- 730
+ 726 0 final IdentifierMatch other = (IdentifierMatch) obj;
+ 727 0 if (this .evidenceConfidence != other.evidenceConfidence) {
+ 728 0 return false ;
+ 729
}
- 731 0 if (this .confidence != other.confidence) {
- 732 0 return false ;
- 733
+ 730 0 if (this .confidence != other.confidence) {
+ 731 0 return false ;
+ 732
}
- 734 0 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
- 735 0 return false ;
- 736
+ 733 0 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
+ 734 0 return false ;
+ 735
}
- 737 0 return true ;
+ 736 0 return true ;
+ 737
+ }
738
- }
- 739
- 740
+ 739
- 741
+ 740
- 742
+ 741
- 743
+ 742
- 744
+ 743
- 745
+ 744
- 746
+ 745
- 747
+ 746
- 748
+ 747
@Override
- 749
+ 748
public int compareTo(IdentifierMatch o) {
- 750 16 int conf = this .confidence.compareTo(o.confidence);
- 751 16 if (conf == 0) {
- 752 12 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
- 753 12 if (conf == 0) {
- 754 4 conf = identifier.compareTo(o.identifier);
- 755
+ 749 32 int conf = this .confidence.compareTo(o.confidence);
+ 750 32 if (conf == 0) {
+ 751 24 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
+ 752 24 if (conf == 0) {
+ 753 8 conf = identifier.compareTo(o.identifier);
+ 754
}
- 756
+ 755
}
- 757 16 return conf;
- 758
+ 756 32 return conf;
+ 757
}
- 759
+ 758
}
- 760
+ 759
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
index 74ec43e04..155412620 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html
@@ -12,7 +12,7 @@
@@ -97,7 +97,7 @@
40
- 41 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+ 41 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
42
43
@@ -114,7 +114,7 @@
@Override
49
public String getName() {
- 50 4 return ANALYZER_NAME;
+ 50 8 return ANALYZER_NAME;
51
}
52
@@ -133,7 +133,7 @@
@Override
59
public AnalysisPhase getAnalysisPhase() {
- 60 1 return ANALYSIS_PHASE;
+ 60 2 return ANALYSIS_PHASE;
61
}
62
@@ -146,20 +146,20 @@
public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
66
- 67 2 if (getRules() == null || getRules().size() <= 0) {
- 68 2 return ;
+ 67 4 if (getRules() == null || getRules().size() <= 0) {
+ 68 0 return ;
69
}
70
- 71 0 for (final SuppressionRule rule : getRules()) {
- 72 0 rule.process(dependency);
- 73 0 }
- 74 0 }
+ 71 4 for (final SuppressionRule rule : getRules()) {
+ 72 4 rule.process(dependency);
+ 73 4 }
+ 74 4 }
75
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
index 87f5a4ee8..2516b5425 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html
@@ -119,7 +119,7 @@
51
- 52 1 private static final Logger LOGGER = Logger.getLogger(DependencyBundlingAnalyzer.class .getName());
+ 52 2 private static final Logger LOGGER = Logger.getLogger(DependencyBundlingAnalyzer.class .getName());
53
54
@@ -130,7 +130,7 @@
57
- 58 1 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*" );
+ 58 2 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*" );
59
60
@@ -157,7 +157,7 @@
71
- 72 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
+ 72 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
73
74
@@ -172,7 +172,7 @@
79
public String getName() {
- 80 5 return ANALYZER_NAME;
+ 80 10 return ANALYZER_NAME;
81
}
82
@@ -189,7 +189,7 @@
88
public AnalysisPhase getAnalysisPhase() {
- 89 2 return ANALYSIS_PHASE;
+ 89 4 return ANALYSIS_PHASE;
90
}
91
@@ -216,19 +216,19 @@
@Override
102
public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
- 103 2 if (!analyzed) {
- 104 1 analyzed = true ;
- 105 1 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
- 106 1 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
+ 103 4 if (!analyzed) {
+ 104 2 analyzed = true ;
+ 105 2 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
+ 106 2 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
107
- 108 3 while (mainIterator.hasNext()) {
- 109 2 final Dependency dependency = mainIterator.next();
- 110 2 if (mainIterator.hasNext()) {
- 111 1 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
- 112 2 while (subIterator.hasNext()) {
- 113 1 final Dependency nextDependency = subIterator.next();
- 114 1 if (hashesMatch(dependency, nextDependency)) {
+ 108 6 while (mainIterator.hasNext()) {
+ 109 4 final Dependency dependency = mainIterator.next();
+ 110 4 if (mainIterator.hasNext()) {
+ 111 2 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
+ 112 4 while (subIterator.hasNext()) {
+ 113 2 final Dependency nextDependency = subIterator.next();
+ 114 2 if (hashesMatch(dependency, nextDependency)) {
115 0 if (isCore(dependency, nextDependency)) {
116 0 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
117
@@ -236,7 +236,7 @@
118 0 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
119
}
- 120 1 } else if (isShadedJar(dependency, nextDependency)) {
+ 120 2 } else if (isShadedJar(dependency, nextDependency)) {
121 0 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )) {
122 0 dependenciesToRemove.add(dependency);
123
@@ -244,7 +244,7 @@
124 0 dependenciesToRemove.add(nextDependency);
125
}
- 126 1 } else if (cpeIdentifiersMatch(dependency, nextDependency)
+ 126 2 } else if (cpeIdentifiersMatch(dependency, nextDependency)
127
&& hasSameBasePath(dependency, nextDependency)
128
@@ -260,20 +260,20 @@
}
135
}
- 136 1 }
+ 136 2 }
137
}
- 138 2 }
+ 138 4 }
139
140
- 141 1 for (Dependency d : dependenciesToRemove) {
+ 141 2 for (Dependency d : dependenciesToRemove) {
142 0 engine.getDependencies().remove(d);
143 0 }
144
}
- 145 2 }
+ 145 4 }
146
147
@@ -440,28 +440,28 @@
250
private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
- 251 1 if (dependency1 == null || dependency1.getIdentifiers() == null
+ 251 2 if (dependency1 == null || dependency1.getIdentifiers() == null
252
|| dependency2 == null || dependency2.getIdentifiers() == null ) {
253 0 return false ;
254
}
- 255 1 boolean matches = false ;
- 256 1 int cpeCount1 = 0;
- 257 1 int cpeCount2 = 0;
- 258 1 for (Identifier i : dependency1.getIdentifiers()) {
+ 255 2 boolean matches = false ;
+ 256 2 int cpeCount1 = 0;
+ 257 2 int cpeCount2 = 0;
+ 258 2 for (Identifier i : dependency1.getIdentifiers()) {
259 0 if ("cpe" .equals(i.getType())) {
260 0 cpeCount1 += 1;
261
}
262 0 }
- 263 1 for (Identifier i : dependency2.getIdentifiers()) {
- 264 2 if ("cpe" .equals(i.getType())) {
- 265 2 cpeCount2 += 1;
+ 263 2 for (Identifier i : dependency2.getIdentifiers()) {
+ 264 4 if ("cpe" .equals(i.getType())) {
+ 265 4 cpeCount2 += 1;
266
}
- 267 2 }
- 268 1 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
+ 267 4 }
+ 268 2 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
269 0 for (Identifier i : dependency1.getIdentifiers()) {
270 0 matches |= dependency2.getIdentifiers().contains(i);
271 0 if (!matches) {
@@ -471,12 +471,12 @@
274 0 }
275
}
- 276 1 if (LogUtils.isVerboseLoggingEnabled()) {
+ 276 2 if (LogUtils.isVerboseLoggingEnabled()) {
277 0 final String msg = String.format("IdentifiersMatch=%s (%s, %s)" , matches, dependency1.getFileName(), dependency2.getFileName());
278 0 LOGGER.log(Level.FINE, msg);
279
}
- 280 1 return matches;
+ 280 2 return matches;
281
}
282
@@ -553,24 +553,24 @@
328
boolean isCore(Dependency left, Dependency right) {
- 329 2 final String leftName = left.getFileName().toLowerCase();
- 330 2 final String rightName = right.getFileName().toLowerCase();
+ 329 4 final String leftName = left.getFileName().toLowerCase();
+ 330 4 final String rightName = right.getFileName().toLowerCase();
331
332
final boolean returnVal;
- 333 2 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+ 333 4 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
334
|| rightName.contains("core" ) && !leftName.contains("core" )
335
|| rightName.contains("kernel" ) && !leftName.contains("kernel" )) {
336 0 returnVal = false ;
- 337 2 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
+ 337 4 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" ) && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+" )
338
|| !rightName.contains("core" ) && leftName.contains("core" )
339
|| !rightName.contains("kernel" ) && leftName.contains("kernel" )) {
- 340 2 returnVal = true ;
+ 340 4 returnVal = true ;
341
} else {
342
@@ -594,12 +594,12 @@
351 0 returnVal = leftName.length() <= rightName.length();
352
}
- 353 2 if (LogUtils.isVerboseLoggingEnabled()) {
+ 353 4 if (LogUtils.isVerboseLoggingEnabled()) {
354 0 final String msg = String.format("IsCore=%s (%s, %s)" , returnVal, left.getFileName(), right.getFileName());
355 0 LOGGER.log(Level.FINE, msg);
356
}
- 357 2 return returnVal;
+ 357 4 return returnVal;
358
}
359
@@ -620,11 +620,11 @@
367
private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
- 368 1 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
+ 368 2 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null ) {
369 0 return false ;
370
}
- 371 1 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
+ 371 2 return dependency1.getSha1sum().equals(dependency2.getSha1sum());
372
}
373
@@ -649,21 +649,21 @@
383
private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
- 384 1 final String mainName = dependency.getFileName().toLowerCase();
- 385 1 final String nextName = nextDependency.getFileName().toLowerCase();
- 386 1 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
+ 384 2 final String mainName = dependency.getFileName().toLowerCase();
+ 385 2 final String nextName = nextDependency.getFileName().toLowerCase();
+ 386 2 if (mainName.endsWith(".jar" ) && nextName.endsWith("pom.xml" )) {
387 0 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
- 388 1 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
+ 388 2 } else if (nextName.endsWith(".jar" ) && mainName.endsWith("pom.xml" )) {
389 0 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
390
}
- 391 1 return false ;
+ 391 2 return false ;
392
}
393
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
index 25103e051..8d4128c34 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html
@@ -12,7 +12,7 @@
@@ -111,7 +111,7 @@
47
- 48 1 private static final Logger LOGGER = Logger.getLogger(FalsePositiveAnalyzer.class .getName());
+ 48 2 private static final Logger LOGGER = Logger.getLogger(FalsePositiveAnalyzer.class .getName());
49
50
@@ -128,7 +128,7 @@
56
- 57 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+ 57 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
58
59
@@ -143,7 +143,7 @@
64
public String getName() {
- 65 5 return ANALYZER_NAME;
+ 65 10 return ANALYZER_NAME;
66
}
67
@@ -160,7 +160,7 @@
73
public AnalysisPhase getAnalysisPhase() {
- 74 2 return ANALYSIS_PHASE;
+ 74 4 return ANALYSIS_PHASE;
75
}
76
@@ -185,13 +185,13 @@
@Override
86
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 87 3 removeJreEntries(dependency);
- 88 3 removeBadMatches(dependency);
- 89 3 removeWrongVersionMatches(dependency);
- 90 3 removeSpuriousCPE(dependency);
- 91 3 removeDuplicativeEntriesFromJar(dependency, engine);
- 92 3 addFalseNegativeCPEs(dependency);
- 93 3 }
+ 87 6 removeJreEntries(dependency);
+ 88 6 removeBadMatches(dependency);
+ 89 6 removeWrongVersionMatches(dependency);
+ 90 6 removeSpuriousCPE(dependency);
+ 91 6 removeDuplicativeEntriesFromJar(dependency, engine);
+ 92 6 addFalseNegativeCPEs(dependency);
+ 93 6 }
94
95
@@ -234,28 +234,28 @@
@SuppressWarnings("null" )
114
private void removeSpuriousCPE(Dependency dependency) {
- 115 3 final List<Identifier> ids = new ArrayList<Identifier>();
- 116 3 ids.addAll(dependency.getIdentifiers());
- 117 3 Collections.sort(ids);
- 118 3 final ListIterator<Identifier> mainItr = ids.listIterator();
- 119 5 while (mainItr.hasNext()) {
- 120 2 final Identifier currentId = mainItr.next();
- 121 2 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
- 122 2 if (currentCpe == null ) {
+ 115 6 final List<Identifier> ids = new ArrayList<Identifier>();
+ 116 6 ids.addAll(dependency.getIdentifiers());
+ 117 6 Collections.sort(ids);
+ 118 6 final ListIterator<Identifier> mainItr = ids.listIterator();
+ 119 10 while (mainItr.hasNext()) {
+ 120 4 final Identifier currentId = mainItr.next();
+ 121 4 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
+ 122 4 if (currentCpe == null ) {
123 0 continue ;
124
}
- 125 2 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
- 126 3 while (subItr.hasNext()) {
- 127 1 final Identifier nextId = subItr.next();
- 128 1 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
- 129 1 if (nextCpe == null ) {
+ 125 4 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
+ 126 6 while (subItr.hasNext()) {
+ 127 2 final Identifier nextId = subItr.next();
+ 128 2 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
+ 129 2 if (nextCpe == null ) {
130 0 continue ;
131
}
132
- 133 1 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
+ 133 2 if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
134 0 if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
135
@@ -286,414 +286,450 @@
} 155
}
- 156 1 }
- 157 2 }
- 158 3 }
+ 156 2 }
+ 157 4 }
+ 158 6 }
159
160
161
- 162 1 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
+ 162 2 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
163
+ "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
164
- + "jdk|jre|jsf|jsse)($|:.*)" );
+ + "jdk|jre|jsse)($|:.*)" ); 165
-
- 166
-
- 167
-
- 168 1 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
- 169
+ 166
+
+ 167
+
+ 168
+
+ 169 2 public static final Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)" );
170
171
-
+ 172
-
- 173
-
+ 173 2 public static final Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
174
-
+ 175
- private void removeJreEntries(Dependency dependency) {
- 176 3 final Set<Identifier> identifiers = dependency.getIdentifiers();
- 177 3 final Iterator<Identifier> itr = identifiers.iterator();
- 178 6 while (itr.hasNext()) {
- 179 3 final Identifier i = itr.next();
- 180 3 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
- 181 3 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
- 182 3 if (coreCPE.matches() && !coreFiles.matches()) {
- 183 0 itr.remove();
+ 176
+
+ 177 2 public static final Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$" );
+ 178
+
+ 179
+
+ 180
+
+ 181
+
+ 182
+
+ 183
+
184
- }
- 185 3 }
- 186 3 }
- 187
-
- 188
-
- 189
-
- 190
-
- 191
-
- 192
-
+ private void removeJreEntries(Dependency dependency) { 185 6 final Set<Identifier> identifiers = dependency.getIdentifiers();
+ 186 6 final Iterator<Identifier> itr = identifiers.iterator();
+ 187 12 while (itr.hasNext()) {
+ 188 6 final Identifier i = itr.next();
+ 189 6 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
+ 190 6 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
+ 191 6 if (coreCPE.matches() && !coreFiles.matches()) {
+ 192 0 itr.remove();
193
-
- 194
-
- 195
- private VulnerableSoftware parseCpe(String type, String value) {
- 196 3 if (!"cpe" .equals(type)) {
- 197 0 return null ;
+ } 194 6 final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue());
+ 195 6 final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName());
+ 196 6 if (coreJsfCPE.matches() && !coreJsfFiles.matches()) {
+ 197 0 itr.remove();
198
- }
- 199 3 final VulnerableSoftware cpe = new VulnerableSoftware();
- 200
- try {
- 201 3 cpe.parseName(value);
- 202 0 } catch (UnsupportedEncodingException ex) {
- 203 0 LOGGER.log(Level.FINEST, null , ex);
- 204 0 return null ;
- 205 3 }
- 206 3 return cpe;
+ } 199 6 }
+ 200 6 }
+ 201
+
+ 202
+
+ 203
+
+ 204
+
+ 205
+
+ 206
+
207
- }
+ 208
-
+ 209
-
- 210
-
- 211
-
+ private VulnerableSoftware parseCpe(String type, String value) { 210 6 if (!"cpe" .equals(type)) {
+ 211 0 return null ;
212
-
- 213
-
+ } 213 6 final VulnerableSoftware cpe = new VulnerableSoftware();
214
-
- 215
- private void removeBadMatches(Dependency dependency) {
- 216 3 final Set<Identifier> identifiers = dependency.getIdentifiers();
- 217 3 final Iterator<Identifier> itr = identifiers.iterator();
- 218
-
- 219
-
- 220
-
+ try { 215 6 cpe.parseName(value);
+ 216 0 } catch (UnsupportedEncodingException ex) {
+ 217 0 LOGGER.log(Level.FINEST, null , ex);
+ 218 0 return null ;
+ 219 6 }
+ 220 6 return cpe;
221
-
+ } 222
-
+ 223
-
+ 224
-
+ 225
-
- 226 6 while (itr.hasNext()) {
- 227 3 final Identifier i = itr.next();
- 228
-
- 229 3 if ("cpe" .equals(i.getType())) {
- 230 3 if ((i.getValue().matches(".*c\\+\\+.*" )
- 231
- || i.getValue().startsWith("cpe:/a:file:file" )
- 232
- || i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
- 233
- || i.getValue().startsWith("cpe:/a:cvs:cvs" )
- 234
- || i.getValue().startsWith("cpe:/a:ftp:ftp" )
- 235
- || i.getValue().startsWith("cpe:/a:tcp:tcp" )
- 236
- || i.getValue().startsWith("cpe:/a:ssh:ssh" )
- 237
- || i.getValue().startsWith("cpe:/a:lookup:lookup" ))
- 238
- && (dependency.getFileName().toLowerCase().endsWith(".jar" )
- 239
- || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
- 240
- || dependency.getFileName().toLowerCase().endsWith(".dll" )
- 241
- || dependency.getFileName().toLowerCase().endsWith(".exe" )
- 242
- || dependency.getFileName().toLowerCase().endsWith(".nuspec" )
- 243
- || dependency.getFileName().toLowerCase().endsWith(".nupkg" ))) {
- 244 1 itr.remove();
- 245 2 } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery" )
- 246
- || i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
- 247
- || i.getValue().startsWith("cpe:/a:yahoo:yui" ))
- 248
- && (dependency.getFileName().toLowerCase().endsWith(".jar" )
- 249
- || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
- 250
- || dependency.getFileName().toLowerCase().endsWith(".dll" )
- 251
- || dependency.getFileName().toLowerCase().endsWith(".exe" ))) {
- 252 0 itr.remove();
- 253 2 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
- 254
- && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
- 255 0 itr.remove();
- 256 2 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
- 257
- && !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
- 258 0 itr.remove();
- 259 2 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
- 260
- && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar" )) {
- 261 0 itr.remove();
- 262
- }
- 263
- }
- 264 3 }
- 265 3 }
- 266
-
- 267
-
- 268
-
- 269
+
+ 226
- 270
+ 227
+ 228
+
+ 229
+ private void removeBadMatches(Dependency dependency) {
+ 230 6 final Set<Identifier> identifiers = dependency.getIdentifiers();
+ 231 6 final Iterator<Identifier> itr = identifiers.iterator();
+ 232
+
+ 233
+
+ 234
+
+ 235
+
+ 236
+
+ 237
+
+ 238
+
+ 239
+
+ 240 12 while (itr.hasNext()) {
+ 241 6 final Identifier i = itr.next();
+ 242
+
+ 243 6 if ("cpe" .equals(i.getType())) {
+ 244 6 if ((i.getValue().matches(".*c\\+\\+.*" )
+ 245
+ || i.getValue().startsWith("cpe:/a:file:file" )
+ 246
+ || i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
+ 247
+ || i.getValue().startsWith("cpe:/a:cvs:cvs" )
+ 248
+ || i.getValue().startsWith("cpe:/a:ftp:ftp" )
+ 249
+ || i.getValue().startsWith("cpe:/a:tcp:tcp" )
+ 250
+ || i.getValue().startsWith("cpe:/a:ssh:ssh" )
+ 251
+ || i.getValue().startsWith("cpe:/a:lookup:lookup" ))
+ 252
+ && (dependency.getFileName().toLowerCase().endsWith(".jar" )
+ 253
+ || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
+ 254
+ || dependency.getFileName().toLowerCase().endsWith(".dll" )
+ 255
+ || dependency.getFileName().toLowerCase().endsWith(".exe" )
+ 256
+ || dependency.getFileName().toLowerCase().endsWith(".nuspec" )
+ 257
+ || dependency.getFileName().toLowerCase().endsWith(".nupkg" ))) {
+ 258 2 itr.remove();
+ 259 4 } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery" )
+ 260
+ || i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
+ 261
+ || i.getValue().startsWith("cpe:/a:yahoo:yui" ))
+ 262
+ && (dependency.getFileName().toLowerCase().endsWith(".jar" )
+ 263
+ || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
+ 264
+ || dependency.getFileName().toLowerCase().endsWith(".dll" )
+ 265
+ || dependency.getFileName().toLowerCase().endsWith(".exe" ))) {
+ 266 0 itr.remove();
+ 267 4 } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel" )
+ 268
+ || i.getValue().startsWith("cpe:/a:microsoft:word" )
+ 269
+ || i.getValue().startsWith("cpe:/a:microsoft:visio" )
+ 270
+ || i.getValue().startsWith("cpe:/a:microsoft:powerpoint" )
271
-
+ || i.getValue().startsWith("cpe:/a:microsoft:office" )) 272
- private void removeWrongVersionMatches(Dependency dependency) {
- 273 3 final Set<Identifier> identifiers = dependency.getIdentifiers();
- 274 3 final Iterator<Identifier> itr = identifiers.iterator();
- 275
-
- 276 3 final String fileName = dependency.getFileName();
- 277 3 if (fileName != null && fileName.contains("axis2" )) {
- 278 0 while (itr.hasNext()) {
- 279 0 final Identifier i = itr.next();
- 280 0 if ("cpe" .equals(i.getType())) {
- 281 0 final String cpe = i.getValue();
- 282 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
- 283 0 itr.remove();
+ && (dependency.getFileName().toLowerCase().endsWith(".jar" ) 273
+ || dependency.getFileName().toLowerCase().endsWith("pom.xml" ))) {
+ 274 0 itr.remove();
+ 275 4 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
+ 276
+ && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
+ 277 0 itr.remove();
+ 278 4 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
+ 279
+ && !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
+ 280 0 itr.remove();
+ 281 4 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
+ 282
+ && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar" )) {
+ 283 0 itr.remove();
284
- }
+ } 285
- }
- 286 0 }
- 287 3 } else if (fileName != null && fileName.contains("axis" )) {
- 288 0 while (itr.hasNext()) {
- 289 0 final Identifier i = itr.next();
- 290 0 if ("cpe" .equals(i.getType())) {
- 291 0 final String cpe = i.getValue();
- 292 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
- 293 0 itr.remove();
+ } 286 6 }
+ 287 6 }
+ 288
+
+ 289
+
+ 290
+
+ 291
+
+ 292
+
+ 293
+
294
- }
- 295
- }
- 296 0 }
+ private void removeWrongVersionMatches(Dependency dependency) { 295 6 final Set<Identifier> identifiers = dependency.getIdentifiers();
+ 296 6 final Iterator<Identifier> itr = identifiers.iterator();
297
- }
- 298 3 }
- 299
- 300
-
- 301
-
- 302
-
- 303
-
- 304
-
- 305
-
+ 298 6 final String fileName = dependency.getFileName();
+ 299 6 if (fileName != null && fileName.contains("axis2" )) {
+ 300 0 while (itr.hasNext()) {
+ 301 0 final Identifier i = itr.next();
+ 302 0 if ("cpe" .equals(i.getType())) {
+ 303 0 final String cpe = i.getValue();
+ 304 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
+ 305 0 itr.remove();
306
-
- 307
- private void addFalseNegativeCPEs(Dependency dependency) {
- 308
-
- 309 3 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
- 310 5 while (itr.hasNext()) {
- 311 2 final Identifier i = itr.next();
- 312 2 if ("cpe" .equals(i.getType()) && i.getValue() != null
- 313
- && (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
- 314
- || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
- 315
- || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
- 316
- || i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
- 317 0 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
- 318 0 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
- 319 0 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
- 320 0 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
- 321
- try {
- 322 0 dependency.addIdentifier("cpe" ,
- 323
- newCpe,
- 324
- String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8" )));
- 325 0 dependency.addIdentifier("cpe" ,
- 326
- newCpe2,
- 327
- String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8" )));
- 328 0 dependency.addIdentifier("cpe" ,
- 329
- newCpe3,
- 330
- String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8" )));
- 331 0 dependency.addIdentifier("cpe" ,
- 332
- newCpe4,
- 333
- String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8" )));
- 334 0 } catch (UnsupportedEncodingException ex) {
- 335 0 LOGGER.log(Level.FINE, null , ex);
- 336 0 }
- 337
- }
- 338 2 }
- 339 3 }
- 340
-
- 341
-
- 342
-
- 343
-
- 344
-
- 345
-
- 346
-
- 347
-
- 348
- private void removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) {
- 349 3 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )
- 350
- || "dll" .equals(dependency.getFileExtension())
- 351
- || "exe" .equals(dependency.getFileExtension())) {
- 352 1 String parentPath = dependency.getFilePath().toLowerCase();
- 353 1 if (parentPath.contains(".jar" )) {
- 354 0 parentPath = parentPath.substring(0, parentPath.indexOf(".jar" ) + 4);
- 355 0 final Dependency parent = findDependency(parentPath, engine.getDependencies());
- 356 0 if (parent != null ) {
- 357 0 boolean remove = false ;
- 358 0 for (Identifier i : dependency.getIdentifiers()) {
- 359 0 if ("cpe" .equals(i.getType())) {
- 360 0 final String trimmedCPE = trimCpeToVendor(i.getValue());
- 361 0 for (Identifier parentId : parent.getIdentifiers()) {
- 362 0 if ("cpe" .equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) {
- 363 0 remove |= true ;
- 364
- }
- 365 0 }
- 366
- }
- 367 0 if (!remove) {
- 368 0 return ;
- 369
- }
- 370 0 }
- 371 0 if (remove) {
- 372 0 engine.getDependencies().remove(dependency);
- 373
}
- 374
+ 307
}
- 375
- }
- 376
-
- 377
+ 308 0 }
+ 309 6 } else if (fileName != null && fileName.contains("axis" )) {
+ 310 0 while (itr.hasNext()) {
+ 311 0 final Identifier i = itr.next();
+ 312 0 if ("cpe" .equals(i.getType())) {
+ 313 0 final String cpe = i.getValue();
+ 314 0 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
+ 315 0 itr.remove();
+ 316
+ }
+ 317
+ }
+ 318 0 }
+ 319
}
- 378 3 }
- 379
+ 320 6 }
+ 321
- 380
+ 322
- 381
-
- 382
+ 323
+
+ 324
+
+ 325
+
+ 326
- 383
-
- 384
-
- 385
-
+ 327
+
+ 328
+
+ 329
+ private void addFalseNegativeCPEs(Dependency dependency) {
+ 330
+
+ 331 6 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+ 332 10 while (itr.hasNext()) {
+ 333 4 final Identifier i = itr.next();
+ 334 4 if ("cpe" .equals(i.getType()) && i.getValue() != null
+ 335
+ && (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
+ 336
+ || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
+ 337
+ || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
+ 338
+ || i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
+ 339 0 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
+ 340 0 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
+ 341 0 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
+ 342 0 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
+ 343
+ try {
+ 344 0 dependency.addIdentifier("cpe" ,
+ 345
+ newCpe,
+ 346
+ String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8" )));
+ 347 0 dependency.addIdentifier("cpe" ,
+ 348
+ newCpe2,
+ 349
+ String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8" )));
+ 350 0 dependency.addIdentifier("cpe" ,
+ 351
+ newCpe3,
+ 352
+ String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8" )));
+ 353 0 dependency.addIdentifier("cpe" ,
+ 354
+ newCpe4,
+ 355
+ String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8" )));
+ 356 0 } catch (UnsupportedEncodingException ex) {
+ 357 0 LOGGER.log(Level.FINE, null , ex);
+ 358 0 }
+ 359
+ }
+ 360 4 }
+ 361 6 }
+ 362
+
+ 363
+
+ 364
+
+ 365
+
+ 366
+
+ 367
+
+ 368
+
+ 369
+
+ 370
+ private void removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) {
+ 371 6 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )
+ 372
+ || "dll" .equals(dependency.getFileExtension())
+ 373
+ || "exe" .equals(dependency.getFileExtension())) {
+ 374 2 String parentPath = dependency.getFilePath().toLowerCase();
+ 375 2 if (parentPath.contains(".jar" )) {
+ 376 0 parentPath = parentPath.substring(0, parentPath.indexOf(".jar" ) + 4);
+ 377 0 final Dependency parent = findDependency(parentPath, engine.getDependencies());
+ 378 0 if (parent != null ) {
+ 379 0 boolean remove = false ;
+ 380 0 for (Identifier i : dependency.getIdentifiers()) {
+ 381 0 if ("cpe" .equals(i.getType())) {
+ 382 0 final String trimmedCPE = trimCpeToVendor(i.getValue());
+ 383 0 for (Identifier parentId : parent.getIdentifiers()) {
+ 384 0 if ("cpe" .equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) {
+ 385 0 remove |= true ;
386
-
- 387
- private Dependency findDependency(String dependencyPath, List<Dependency> dependencies) {
- 388 0 for (Dependency d : dependencies) {
- 389 0 if (d.getFilePath().equalsIgnoreCase(dependencyPath)) {
- 390 0 return d;
+ } 387 0 }
+ 388
+ }
+ 389 0 if (!remove) {
+ 390 0 return ;
391
- }
- 392 0 }
- 393 0 return null ;
- 394
- }
+ } 392 0 }
+ 393 0 if (remove) {
+ 394 0 engine.getDependencies().remove(dependency);
395
-
+ } 396
-
+ } 397
-
+ } 398
-
+ 399
-
- 400
-
- 401
-
- 402
- private String trimCpeToVendor(String value) {
- 403
-
- 404 0 final int pos1 = value.indexOf(":" , 7);
- 405 0 final int pos2 = value.indexOf(":" , pos1 + 1);
- 406 0 if (pos2 < 0) {
- 407 0 return value;
- 408
- } else {
- 409 0 return value.substring(0, pos2);
- 410
}
- 411
+ 400 6 }
+ 401
+
+ 402
+
+ 403
+
+ 404
+
+ 405
+
+ 406
+
+ 407
+
+ 408
+
+ 409
+ private Dependency findDependency(String dependencyPath, List<Dependency> dependencies) {
+ 410 0 for (Dependency d : dependencies) {
+ 411 0 if (d.getFilePath().equalsIgnoreCase(dependencyPath)) {
+ 412 0 return d;
+ 413
+ }
+ 414 0 }
+ 415 0 return null ;
+ 416
}
- 412
+ 417
+
+ 418
+
+ 419
+
+ 420
+
+ 421
+
+ 422
+
+ 423
+
+ 424
+ private String trimCpeToVendor(String value) {
+ 425
+
+ 426 0 final int pos1 = value.indexOf(":" , 7);
+ 427 0 final int pos2 = value.indexOf(":" , pos1 + 1);
+ 428 0 if (pos2 < 0) {
+ 429 0 return value;
+ 430
+ } else {
+ 431 0 return value.substring(0, pos2);
+ 432
+ }
+ 433
+ }
+ 434
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
index 881f8b14c..26e799abb 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html
@@ -103,7 +103,7 @@
43
- 44 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 44 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
45
46
@@ -118,7 +118,7 @@
51
public String getName() {
- 52 5 return ANALYZER_NAME;
+ 52 10 return ANALYZER_NAME;
53
}
54
@@ -135,7 +135,7 @@
60
public AnalysisPhase getAnalysisPhase() {
- 61 2 return ANALYSIS_PHASE;
+ 61 4 return ANALYSIS_PHASE;
62
}
63
@@ -164,41 +164,41 @@
75
- 76 4 final File f = new File(dependency.getFileName());
- 77 4 String fileName = f.getName();
+ 76 8 final File f = new File(dependency.getFileName());
+ 77 8 String fileName = f.getName();
78
79
- 80 4 final int pos = fileName.lastIndexOf("." );
- 81 4 if (pos > 0) {
- 82 4 fileName = fileName.substring(0, pos);
+ 80 8 final int pos = fileName.lastIndexOf("." );
+ 81 8 if (pos > 0) {
+ 82 8 fileName = fileName.substring(0, pos);
83
}
84
85
- 86 4 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
- 87 4 if (version != null ) {
+ 86 8 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
+ 87 8 if (version != null ) {
88
89
90
- 91 4 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
+ 91 8 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
92 0 dependency.getVersionEvidence().addEvidence("file" , "name" ,
93
version.toString(), Confidence.MEDIUM);
94
} else {
- 95 4 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+ 95 8 dependency.getVersionEvidence().addEvidence("file" , "name" ,
96
version.toString(), Confidence.HIGHEST);
97
}
- 98 4 dependency.getVersionEvidence().addEvidence("file" , "name" ,
+ 98 8 dependency.getVersionEvidence().addEvidence("file" , "name" ,
99
fileName, Confidence.MEDIUM);
100
@@ -207,11 +207,11 @@
102
- 103 4 if (fileName.contains("-" )) {
- 104 4 dependency.getProductEvidence().addEvidence("file" , "name" ,
+ 103 8 if (fileName.contains("-" )) {
+ 104 8 dependency.getProductEvidence().addEvidence("file" , "name" ,
105
fileName, Confidence.HIGHEST);
- 106 4 dependency.getVendorEvidence().addEvidence("file" , "name" ,
+ 106 8 dependency.getVendorEvidence().addEvidence("file" , "name" ,
107
fileName, Confidence.HIGHEST);
108
@@ -224,11 +224,11 @@
fileName, Confidence.HIGH);
113
}
- 114 4 }
+ 114 8 }
115
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
index 9ed8d56e2..1ac81c08e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileTypeAnalyzer.html
@@ -87,6 +87,6 @@
} 42
- 43 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
+ 43 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
44
45
@@ -118,7 +118,7 @@
@Override
51
public String getName() {
- 52 5 return ANALYZER_NAME;
+ 52 10 return ANALYZER_NAME;
53
}
54
@@ -137,7 +137,7 @@
@Override
61
public AnalysisPhase getAnalysisPhase() {
- 62 2 return ANALYSIS_PHASE;
+ 62 4 return ANALYSIS_PHASE;
63
}
64
@@ -164,7 +164,7 @@
@Override
75
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 76 2 final Evidence springTest1 = new Evidence("Manifest" ,
+ 76 4 final Evidence springTest1 = new Evidence("Manifest" ,
77
"Implementation-Title" ,
78
@@ -173,7 +173,7 @@
Confidence.HIGH);
80
- 81 2 final Evidence springTest2 = new Evidence("Manifest" ,
+ 81 4 final Evidence springTest2 = new Evidence("Manifest" ,
82
"Implementation-Title" ,
83
@@ -182,7 +182,7 @@
Confidence.HIGH);
85
- 86 2 final Evidence springTest3 = new Evidence("Manifest" ,
+ 86 4 final Evidence springTest3 = new Evidence("Manifest" ,
87
"Bundle-Vendor" ,
88
@@ -191,26 +191,26 @@
Confidence.HIGH);
90
- 91 2 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
- 92 2 if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
- 93 1 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
- 94 1 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "SpringSource" , Confidence.HIGH);
- 95 1 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+ 91 4 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
+ 92 4 if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
+ 93 2 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
+ 94 2 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "SpringSource" , Confidence.HIGH);
+ 95 2 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
96
}
97
- 98 2 evidence = dependency.getVendorEvidence().getEvidence();
- 99 2 if (evidence.contains(springTest3)) {
- 100 1 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
- 101 1 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
+ 98 4 evidence = dependency.getVendorEvidence().getEvidence();
+ 99 4 if (evidence.contains(springTest3)) {
+ 100 2 dependency.getProductEvidence().addEvidence("hint analyzer" , "product" , "springsource_spring_framework" , Confidence.HIGH);
+ 101 2 dependency.getVendorEvidence().addEvidence("hint analyzer" , "vendor" , "vmware" , Confidence.HIGH);
102
}
- 103 2 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
- 104 2 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
- 105 27 while (itr.hasNext()) {
- 106 25 final Evidence e = itr.next();
- 107 25 if ("sun" .equalsIgnoreCase(e.getValue(false ))) {
+ 103 4 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
+ 104 4 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
+ 105 54 while (itr.hasNext()) {
+ 106 50 final Evidence e = itr.next();
+ 107 50 if ("sun" .equalsIgnoreCase(e.getValue(false ))) {
108 0 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)" , e.getName(), "oracle" , e.getConfidence());
109 0 newEntries.add(newEvidence);
110 0 } else if ("oracle" .equalsIgnoreCase(e.getValue(false ))) {
@@ -218,17 +218,17 @@
112 0 newEntries.add(newEvidence);
113
}
- 114 25 }
- 115 2 for (Evidence e : newEntries) {
+ 114 50 }
+ 115 4 for (Evidence e : newEntries) {
116 0 dependency.getVendorEvidence().addEvidence(e);
117 0 }
118
- 119 2 }
+ 119 4 }
120
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
index 8aaccea4d..ebbb1f86a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html
@@ -12,8 +12,8 @@
@@ -151,2026 +151,1976 @@
66
import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
67
- import org.owasp.dependencycheck.jaxb.pom.generated.Parent;
- 68
import org.owasp.dependencycheck.utils.FileUtils;
- 69
+ 68
import org.owasp.dependencycheck.utils.NonClosingStream;
- 70
+ 69
import org.owasp.dependencycheck.utils.Settings;
- 71
+ 70
import org.xml.sax.InputSource;
- 72
+ 71
import org.xml.sax.SAXException;
- 73
+ 72
import org.xml.sax.XMLFilter;
- 74
+ 73
import org.xml.sax.XMLReader;
- 75
+ 74
- 76
+ 75
+ 76
+
77
78
-
- 79
-
- 80
- 81
+ 79
- 82
+ 80
public class JarAnalyzer extends AbstractFileTypeAnalyzer {
- 83
+ 81
- 84
+ 82
- 85
+ 83
- 86
+ 84
+ 85
+
+ 86 2 private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class .getName());
87
-
- 88 1 private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class .getName());
- 89
- 90
+ 88
- 91
+ 89
- 92
+ 90
private static final int BUFFER_SIZE = 4096;
- 93
+ 91
- 94
+ 92
+ 93
+
+ 94 2 private static int dirCount = 0;
95
-
- 96 1 private static int dirCount = 0;
- 97
- 98
+ 96
+ 97
+
+ 98 2 private static final String NEWLINE = System.getProperty("line.separator" );
99
-
- 100 1 private static final String NEWLINE = System.getProperty("line.separator" );
- 101
- 102
+ 100
+ 101
+
+ 102 2 private static final Set<String> IGNORE_VALUES = newHashSet(
103
-
- 104 1 private static final Set<String> IGNORE_VALUES = newHashSet(
- 105
"Sun Java System Application Server" );
- 106
+ 104
- 107
+ 105
+ 106
+
+ 107 2 private static final Set<String> IGNORE_KEYS = newHashSet(
108
-
- 109 1 private static final Set<String> IGNORE_KEYS = newHashSet(
- 110
"built-by" ,
- 111
+ 109
"created-by" ,
- 112
+ 110
"builtby" ,
- 113
+ 111
"createdby" ,
- 114
+ 112
"build-jdk" ,
- 115
+ 113
"buildjdk" ,
- 116
+ 114
"ant-version" ,
- 117
+ 115
"antversion" ,
- 118
+ 116
"dynamicimportpackage" ,
- 119
+ 117
"dynamicimport-package" ,
- 120
+ 118
"dynamic-importpackage" ,
- 121
+ 119
"dynamic-import-package" ,
- 122
+ 120
"import-package" ,
- 123
+ 121
"ignore-package" ,
- 124
+ 122
"export-package" ,
- 125
+ 123
"importpackage" ,
- 126
+ 124
"ignorepackage" ,
- 127
+ 125
"exportpackage" ,
- 128
+ 126
"sealed" ,
- 129
+ 127
"manifest-version" ,
- 130
+ 128
"archiver-version" ,
- 131
+ 129
"manifestversion" ,
- 132
+ 130
"archiverversion" ,
- 133
+ 131
"classpath" ,
- 134
+ 132
"class-path" ,
- 135
+ 133
"tool" ,
- 136
+ 134
"bundle-manifestversion" ,
- 137
+ 135
"bundlemanifestversion" ,
- 138
+ 136
"include-resource" ,
- 139
+ 137
"embed-dependency" ,
- 140
+ 138
"ipojo-components" ,
- 141
+ 139
"ipojo-extension" ,
- 142
+ 140
"eclipse-sourcereferences" );
+ 141
+
+ 142
+
143
-
+ 144
-
- 145
-
- 146
private static final String BUNDLE_VERSION = "Bundle-Version" ;
+ 145
+
+ 146
+
147
-
+ 148
-
- 149
-
- 150
private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
+ 149
+
+ 150
+
151
-
+ 152
-
- 153
-
- 154
private static final String BUNDLE_NAME = "Bundle-Name" ;
- 155
+ 153
- 156
+ 154
- 157
+ 155
- 158
+ 156
private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
- 159
+ 157
- 160
+ 158
+ 159
+
+ 160 2 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
161
-
- 162 1 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
- 163
- 164
+ 162
- 165
+ 163
- 166
+ 164
private Unmarshaller pomUnmarshaller;
+ 165
+
+ 166
+
167
-
+ 168
-
- 169
-
- 170
+ 169
+
+ 170 14 public JarAnalyzer() {
171
-
- 172 7 public JarAnalyzer() {
- 173
try {
- 174 7 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
- 175 7 pomUnmarshaller = jaxbContext.createUnmarshaller();
- 176 0 } catch (JAXBException ex) {
- 177 0 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details." );
- 178 0 LOGGER.log(Level.FINE, null , ex);
- 179 7 }
- 180 7 }
- 181
+ 172 14 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
+ 173 14 pomUnmarshaller = jaxbContext.createUnmarshaller();
+ 174 0 } catch (JAXBException ex) {
+ 175 0 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details." );
+ 176 0 LOGGER.log(Level.FINE, null , ex);
+ 177 14 }
+ 178 14 }
+ 179
- 182
+ 180
- 183
+ 181
- 184
+ 182
- 185
+ 183
- 186
+ 184
private static final String ANALYZER_NAME = "Jar Analyzer" ;
- 187
+ 185
- 188
+ 186
+ 187
+
+ 188 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
189
-
- 190 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
- 191
- 192
+ 190
+ 191
+
+ 192 2 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
193
-
- 194 1 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
+ 194
+
195
-
- 196
-
- 197
- 198
+ 196
- 199
+ 197
+ 198
+
+ 199
+ @Override
200
-
- 201
- @Override
- 202
public Set<String> getSupportedExtensions() {
- 203 852 return EXTENSIONS;
+ 201 1704 return EXTENSIONS;
+ 202
+ }
+ 203
+
204
- }
+ 205
-
- 206
-
- 207
- 208
+ 206
- 209
+ 207
+ 208
+
+ 209
+ @Override
210
-
- 211
- @Override
- 212
public String getName() {
- 213 5 return ANALYZER_NAME;
+ 211 10 return ANALYZER_NAME;
+ 212
+ }
+ 213
+
214
- }
+ 215
-
- 216
-
- 217
- 218
+ 216
- 219
+ 217
- 220
+ 218
- 221
+ 219
public AnalysisPhase getAnalysisPhase() {
- 222 1 return ANALYSIS_PHASE;
- 223
+ 220 2 return ANALYSIS_PHASE;
+ 221
}
- 224
+ 222
+ 223
+
+ 224
+
225
-
- 226
-
- 227
- 228
+ 226
- 229
+ 227
+ 228
+
+ 229
+ @Override
230
-
- 231
- @Override
- 232
protected String getAnalyzerEnabledSettingKey() {
- 233 7 return Settings.KEYS.ANALYZER_JAR_ENABLED;
+ 231 14 return Settings.KEYS.ANALYZER_JAR_ENABLED;
+ 232
+ }
+ 233
+
234
- }
+ 235
-
- 236
-
- 237
- 238
+ 236
- 239
+ 237
- 240
+ 238
- 241
+ 239
- 242
+ 240
- 243
+ 241
- 244
+ 242
@Override
- 245
+ 243
public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
- 246
+ 244
try {
- 247 5 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
- 248 5 final String fileName = dependency.getFileName().toLowerCase();
- 249 5 if (classNames.isEmpty()
- 250
+ 245 10 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
+ 246 10 final String fileName = dependency.getFileName().toLowerCase();
+ 247 10 if (classNames.isEmpty()
+ 248
&& (fileName.endsWith("-sources.jar" )
- 251
+ 249
|| fileName.endsWith("-javadoc.jar" )
- 252
+ 250
|| fileName.endsWith("-src.jar" )
- 253
+ 251
|| fileName.endsWith("-doc.jar" ))) {
- 254 0 engine.getDependencies().remove(dependency);
- 255
+ 252 0 engine.getDependencies().remove(dependency);
+ 253
}
- 256 5 final boolean hasManifest = parseManifest(dependency, classNames);
- 257 5 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
- 258 5 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
- 259 5 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
- 260 0 } catch (IOException ex) {
- 261 0 throw new AnalysisException("Exception occurred reading the JAR file." , ex);
- 262 5 }
- 263 5 }
+ 254 10 final boolean hasManifest = parseManifest(dependency, classNames);
+ 255 10 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
+ 256 10 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
+ 257 10 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
+ 258 0 } catch (IOException ex) {
+ 259 0 throw new AnalysisException("Exception occurred reading the JAR file." , ex);
+ 260 10 }
+ 261 10 }
+ 262
+
+ 263
+
264
-
- 265
-
- 266
- 267
+ 265
+ 266
+
+ 267
+
268
-
- 269
-
- 270
- 271
+ 269
- 272
+ 270
- 273
+ 271
- 274
+ 272
- 275
+ 273
protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
- 276 5 boolean foundSomething = false ;
- 277
+ 274 10 boolean foundSomething = false ;
+ 275
final JarFile jar;
- 278
+ 276
try {
- 279 5 jar = new JarFile(dependency.getActualFilePath());
- 280 0 } catch (IOException ex) {
- 281 0 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
- 282
+ 277 10 jar = new JarFile(dependency.getActualFilePath());
+ 278 0 } catch (IOException ex) {
+ 279 0 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
+ 280
- 283 0 LOGGER.log(Level.WARNING, msg);
- 284 0 LOGGER.log(Level.FINE, "" , ex);
- 285 0 return false ;
- 286 5 }
- 287
+ 281 0 LOGGER.log(Level.WARNING, msg);
+ 282 0 LOGGER.log(Level.FINE, "" , ex);
+ 283 0 return false ;
+ 284 10 }
+ 285
List<String> pomEntries;
- 288
+ 286
try {
- 289 5 pomEntries = retrievePomListing(jar);
- 290 0 } catch (IOException ex) {
- 291 0 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
- 292
+ 287 10 pomEntries = retrievePomListing(jar);
+ 288 0 } catch (IOException ex) {
+ 289 0 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
+ 290
- 293 0 LOGGER.log(Level.WARNING, msg);
- 294 0 LOGGER.log(Level.FINE, msg, ex);
- 295 0 return false ;
- 296 5 }
- 297 5 if (pomEntries.isEmpty()) {
- 298 4 return false ;
- 299
+ 291 0 LOGGER.log(Level.WARNING, msg);
+ 292 0 LOGGER.log(Level.FINE, msg, ex);
+ 293 0 return false ;
+ 294 10 }
+ 295 10 if (pomEntries.isEmpty()) {
+ 296 8 return false ;
+ 297
}
- 300 1 for (String path : pomEntries) {
- 301 1 Properties pomProperties = null ;
- 302
+ 298 2 for (String path : pomEntries) {
+ 299 2 Properties pomProperties = null ;
+ 300
try {
- 303 1 pomProperties = retrievePomProperties(path, jar);
- 304 0 } catch (IOException ex) {
- 305 0 LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
- 306 1 }
- 307 1 Model pom = null ;
+ 301 2 pomProperties = retrievePomProperties(path, jar);
+ 302 0 } catch (IOException ex) {
+ 303 0 LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
+ 304 2 }
+ 305 2 Model pom = null ;
+ 306
+ try {
+ 307 2 if (pomEntries.size() > 1) {
308
- try {
- 309 1 if (pomEntries.size() > 1) {
- 310
- 311 0 final Dependency newDependency = new Dependency();
- 312 0 pom = extractPom(path, jar, newDependency);
+ 309 0 final Dependency newDependency = new Dependency();
+ 310 0 pom = extractPom(path, jar, newDependency);
+ 311
+
+ 312 0 final String displayPath = String.format("%s%s%s" ,
313
-
- 314 0 final String displayPath = String.format("%s%s%s" ,
- 315
dependency.getFilePath(),
- 316
+ 314
File.separator,
+ 315
+ path);
+ 316 0 final String displayName = String.format("%s%s%s" ,
317
- path);
- 318 0 final String displayName = String.format("%s%s%s" ,
- 319
dependency.getFileName(),
- 320
+ 318
File.separator,
- 321
+ 319
path);
- 322
+ 320
- 323 0 newDependency.setFileName(displayName);
- 324 0 newDependency.setFilePath(displayPath);
- 325 0 addPomEvidence(newDependency, pom, pomProperties);
- 326 0 engine.getDependencies().add(newDependency);
- 327 0 Collections.sort(engine.getDependencies());
- 328 0 } else {
- 329 1 pom = retrievePom(path, jar);
- 330 1 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
- 331
+ 321 0 newDependency.setFileName(displayName);
+ 322 0 newDependency.setFilePath(displayPath);
+ 323 0 setPomEvidence(newDependency, pom, pomProperties, null );
+ 324 0 engine.getDependencies().add(newDependency);
+ 325 0 Collections.sort(engine.getDependencies());
+ 326 0 } else {
+ 327 2 pom = retrievePom(path, jar);
+ 328 2 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
+ 329
}
- 332 0 } catch (AnalysisException ex) {
- 333 0 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
- 334 0 LOGGER.log(Level.WARNING, msg);
- 335 0 LOGGER.log(Level.FINE, "" , ex);
- 336 1 }
- 337 1 }
- 338 1 return foundSomething;
+ 330 0 } catch (AnalysisException ex) {
+ 331 0 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
+ 332 0 LOGGER.log(Level.WARNING, msg);
+ 333 0 LOGGER.log(Level.FINE, "" , ex);
+ 334 2 }
+ 335 2 }
+ 336 2 return foundSomething;
+ 337
+ }
+ 338
+
339
- }
+ 340
-
- 341
-
- 342
- 343
+ 341
- 344
+ 342
- 345
+ 343
- 346
+ 344
- 347
+ 345
- 348
+ 346
- 349
+ 347
@edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
- 350
+ 348
justification = "The reader is closed by closing the zipEntry" )
- 351
+ 349
private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
- 352 1 Properties pomProperties = null ;
- 353 1 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
- 354 1 final ZipEntry propEntry = jar.getEntry(propPath);
- 355 1 if (propEntry != null ) {
- 356 0 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
- 357 0 pomProperties = new Properties();
- 358 0 pomProperties.load(reader);
+ 350 2 Properties pomProperties = null ;
+ 351 2 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
+ 352 2 final ZipEntry propEntry = jar.getEntry(propPath);
+ 353 2 if (propEntry != null ) {
+ 354 0 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
+ 355 0 pomProperties = new Properties();
+ 356 0 pomProperties.load(reader);
+ 357
+ }
+ 358 2 return pomProperties;
359
- }
- 360 1 return pomProperties;
+ } 360
+
361
- }
+ 362
-
- 363
-
- 364
- 365
+ 363
- 366
+ 364
- 367
+ 365
- 368
+ 366
- 369
+ 367
- 370
+ 368
private List<String> retrievePomListing(final JarFile jar) throws IOException {
- 371 5 final List<String> pomEntries = new ArrayList<String>();
- 372 5 final Enumeration<JarEntry> entries = jar.entries();
- 373 1848 while (entries.hasMoreElements()) {
- 374 1843 final JarEntry entry = entries.nextElement();
- 375 1843 final String entryName = (new File(entry.getName())).getName().toLowerCase();
- 376 1843 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
- 377 1 pomEntries.add(entry.getName());
- 378
+ 369 10 final List<String> pomEntries = new ArrayList<String>();
+ 370 10 final Enumeration<JarEntry> entries = jar.entries();
+ 371 3696 while (entries.hasMoreElements()) {
+ 372 3686 final JarEntry entry = entries.nextElement();
+ 373 3686 final String entryName = (new File(entry.getName())).getName().toLowerCase();
+ 374 3686 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
+ 375 2 pomEntries.add(entry.getName());
+ 376
}
- 379 1843 }
- 380 5 return pomEntries;
+ 377 3686 }
+ 378 10 return pomEntries;
+ 379
+ }
+ 380
+
381
- }
+ 382
-
+ 383
-
+ 384
-
+ 385
-
+ 386
-
- 387
-
- 388
+ 387
+
+ 388
+
389
-
+ 390
-
+ 391
-
- 392
-
- 393
private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
- 394 0 InputStream input = null ;
- 395 0 FileOutputStream fos = null ;
- 396 0 BufferedOutputStream bos = null ;
- 397 0 final File tmpDir = getNextTempDirectory();
- 398 0 final File file = new File(tmpDir, "pom.xml" );
- 399
+ 392 0 InputStream input = null ;
+ 393 0 FileOutputStream fos = null ;
+ 394 0 BufferedOutputStream bos = null ;
+ 395 0 final File tmpDir = getNextTempDirectory();
+ 396 0 final File file = new File(tmpDir, "pom.xml" );
+ 397
try {
- 400 0 final ZipEntry entry = jar.getEntry(path);
- 401 0 input = jar.getInputStream(entry);
- 402 0 fos = new FileOutputStream(file);
- 403 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
- 404
+ 398 0 final ZipEntry entry = jar.getEntry(path);
+ 399 0 input = jar.getInputStream(entry);
+ 400 0 fos = new FileOutputStream(file);
+ 401 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+ 402
int count;
- 405 0 final byte data[] = new byte [BUFFER_SIZE];
- 406 0 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
- 407 0 bos.write(data, 0, count);
- 408
+ 403 0 final byte data[] = new byte [BUFFER_SIZE];
+ 404 0 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
+ 405 0 bos.write(data, 0, count);
+ 406
}
- 409 0 bos.flush();
- 410 0 dependency.setActualFilePath(file.getAbsolutePath());
- 411 0 } catch (IOException ex) {
- 412 0 final String msg = String.format("An error occurred reading '%s' from '%s'." , path, dependency.getFilePath());
- 413 0 LOGGER.warning(msg);
- 414 0 LOGGER.log(Level.SEVERE, "" , ex);
- 415
+ 407 0 bos.flush();
+ 408 0 dependency.setActualFilePath(file.getAbsolutePath());
+ 409 0 } catch (IOException ex) {
+ 410 0 final String msg = String.format("An error occurred reading '%s' from '%s'." , path, dependency.getFilePath());
+ 411 0 LOGGER.warning(msg);
+ 412 0 LOGGER.log(Level.SEVERE, "" , ex);
+ 413
} finally {
- 416 0 closeStream(bos);
- 417 0 closeStream(fos);
- 418 0 closeStream(input);
- 419 0 }
- 420 0 Model model = null ;
- 421 0 FileInputStream fis = null ;
- 422
+ 414 0 closeStream(bos);
+ 415 0 closeStream(fos);
+ 416 0 closeStream(input);
+ 417 0 }
+ 418 0 Model model = null ;
+ 419 0 FileInputStream fis = null ;
+ 420
try {
- 423 0 fis = new FileInputStream(file);
- 424 0 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
- 425 0 final InputSource xml = new InputSource(reader);
- 426 0 final SAXSource source = new SAXSource(xml);
- 427 0 model = readPom(source);
- 428 0 } catch (FileNotFoundException ex) {
- 429 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
- 430 0 LOGGER.log(Level.WARNING, msg);
- 431 0 LOGGER.log(Level.FINE, "" , ex);
- 432 0 throw new AnalysisException(ex);
- 433 0 } catch (UnsupportedEncodingException ex) {
- 434 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
- 435 0 LOGGER.log(Level.WARNING, msg);
- 436 0 LOGGER.log(Level.FINE, "" , ex);
- 437 0 throw new AnalysisException(ex);
- 438 0 } catch (AnalysisException ex) {
- 439 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
- 440 0 LOGGER.log(Level.WARNING, msg);
- 441 0 LOGGER.log(Level.FINE, "" , ex);
- 442 0 throw ex;
- 443
+ 421 0 fis = new FileInputStream(file);
+ 422 0 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
+ 423 0 final InputSource xml = new InputSource(reader);
+ 424 0 final SAXSource source = new SAXSource(xml);
+ 425 0 model = readPom(source);
+ 426 0 } catch (FileNotFoundException ex) {
+ 427 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
+ 428 0 LOGGER.log(Level.WARNING, msg);
+ 429 0 LOGGER.log(Level.FINE, "" , ex);
+ 430 0 throw new AnalysisException(ex);
+ 431 0 } catch (UnsupportedEncodingException ex) {
+ 432 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+ 433 0 LOGGER.log(Level.WARNING, msg);
+ 434 0 LOGGER.log(Level.FINE, "" , ex);
+ 435 0 throw new AnalysisException(ex);
+ 436 0 } catch (AnalysisException ex) {
+ 437 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
+ 438 0 LOGGER.log(Level.WARNING, msg);
+ 439 0 LOGGER.log(Level.FINE, "" , ex);
+ 440 0 throw ex;
+ 441
} finally {
- 444 0 closeStream(fis);
- 445 0 }
- 446 0 return model;
+ 442 0 closeStream(fis);
+ 443 0 }
+ 444 0 return model;
+ 445
+ }
+ 446
+
447
- }
+ 448
-
- 449
-
- 450
- 451
+ 449
- 452
+ 450
- 453
+ 451
- 454
+ 452
private void closeStream(InputStream stream) {
- 455 0 if (stream != null ) {
- 456
+ 453 0 if (stream != null ) {
+ 454
try {
- 457 0 stream.close();
- 458 0 } catch (IOException ex) {
- 459 0 LOGGER.log(Level.FINEST, null , ex);
- 460 0 }
+ 455 0 stream.close();
+ 456 0 } catch (IOException ex) {
+ 457 0 LOGGER.log(Level.FINEST, null , ex);
+ 458 0 }
+ 459
+ }
+ 460 0 }
461
- }
- 462 0 }
+ 462
+
463
-
- 464
-
- 465
- 466
+ 464
- 467
+ 465
- 468
+ 466
- 469
+ 467
private void closeStream(OutputStream stream) {
- 470 0 if (stream != null ) {
- 471
+ 468 0 if (stream != null ) {
+ 469
try {
- 472 0 stream.close();
- 473 0 } catch (IOException ex) {
- 474 0 LOGGER.log(Level.FINEST, null , ex);
- 475 0 }
+ 470 0 stream.close();
+ 471 0 } catch (IOException ex) {
+ 472 0 LOGGER.log(Level.FINEST, null , ex);
+ 473 0 }
+ 474
+ }
+ 475 0 }
476
- }
- 477 0 }
+ 477
+
478
-
+ 479
-
+ 480
-
- 481
-
- 482
- 483
+ 481
- 484
+ 482
+ 483
+
+ 484
+
485
-
+ 486
-
- 487
-
- 488
private Model retrievePom(String path, JarFile jar) throws AnalysisException {
- 489 1 final ZipEntry entry = jar.getEntry(path);
- 490 1 Model model = null ;
- 491 1 if (entry != null ) {
- 492
+ 487 2 final ZipEntry entry = jar.getEntry(path);
+ 488 2 Model model = null ;
+ 489 2 if (entry != null ) {
+ 490
try {
- 493 1 final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
- 494 1 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
- 495 1 final InputSource xml = new InputSource(reader);
- 496 1 final SAXSource source = new SAXSource(xml);
- 497 1 model = readPom(source);
- 498 0 } catch (SecurityException ex) {
- 499 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
- 500 0 LOGGER.log(Level.WARNING, msg);
- 501 0 LOGGER.log(Level.FINE, null , ex);
- 502 0 throw new AnalysisException(ex);
- 503 0 } catch (IOException ex) {
- 504 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
- 505 0 LOGGER.log(Level.WARNING, msg);
- 506 0 LOGGER.log(Level.FINE, "" , ex);
- 507 0 throw new AnalysisException(ex);
- 508 0 } catch (Throwable ex) {
- 509 0 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
- 510 0 LOGGER.log(Level.WARNING, msg);
- 511 0 LOGGER.log(Level.FINE, "" , ex);
- 512 0 throw new AnalysisException(ex);
- 513 1 }
+ 491 2 final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
+ 492 2 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
+ 493 2 final InputSource xml = new InputSource(reader);
+ 494 2 final SAXSource source = new SAXSource(xml);
+ 495 2 model = readPom(source);
+ 496 0 } catch (SecurityException ex) {
+ 497 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
+ 498 0 LOGGER.log(Level.WARNING, msg);
+ 499 0 LOGGER.log(Level.FINE, null , ex);
+ 500 0 throw new AnalysisException(ex);
+ 501 0 } catch (IOException ex) {
+ 502 0 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+ 503 0 LOGGER.log(Level.WARNING, msg);
+ 504 0 LOGGER.log(Level.FINE, "" , ex);
+ 505 0 throw new AnalysisException(ex);
+ 506 0 } catch (Throwable ex) {
+ 507 0 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
+ 508 0 LOGGER.log(Level.WARNING, msg);
+ 509 0 LOGGER.log(Level.FINE, "" , ex);
+ 510 0 throw new AnalysisException(ex);
+ 511 2 }
+ 512
+ }
+ 513 2 return model;
514
- }
- 515 1 return model;
+ } 515
+
516
- }
+ 517
-
- 518
-
- 519
- 520
+ 518
- 521
+ 519
- 522
+ 520
- 523
+ 521
- 524
+ 522
- 525
+ 523
- 526
+ 524
private Model readPom(SAXSource source) throws AnalysisException {
- 527 1 Model model = null ;
- 528
+ 525 2 Model model = null ;
+ 526
try {
- 529 1 final XMLFilter filter = new MavenNamespaceFilter();
- 530 1 final SAXParserFactory spf = SAXParserFactory.newInstance();
- 531 1 final SAXParser sp = spf.newSAXParser();
- 532 1 final XMLReader xr = sp.getXMLReader();
- 533 1 filter.setParent(xr);
- 534 1 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
- 535 1 model = el.getValue();
- 536 0 } catch (SecurityException ex) {
+ 527 2 final XMLFilter filter = new MavenNamespaceFilter();
+ 528 2 final SAXParserFactory spf = SAXParserFactory.newInstance();
+ 529 2 final SAXParser sp = spf.newSAXParser();
+ 530 2 final XMLReader xr = sp.getXMLReader();
+ 531 2 filter.setParent(xr);
+ 532 2 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
+ 533 2 model = el.getValue();
+ 534 0 } catch (SecurityException ex) {
+ 535 0 throw new AnalysisException(ex);
+ 536 0 } catch (ParserConfigurationException ex) {
537 0 throw new AnalysisException(ex);
- 538 0 } catch (ParserConfigurationException ex) {
+ 538 0 } catch (SAXException ex) {
539 0 throw new AnalysisException(ex);
- 540 0 } catch (SAXException ex) {
+ 540 0 } catch (JAXBException ex) {
541 0 throw new AnalysisException(ex);
- 542 0 } catch (JAXBException ex) {
+ 542 0 } catch (Throwable ex) {
543 0 throw new AnalysisException(ex);
- 544 0 } catch (Throwable ex) {
- 545 0 throw new AnalysisException(ex);
- 546 1 }
- 547 1 return model;
- 548
+ 544 2 }
+ 545 2 return model;
+ 546
}
- 549
+ 547
- 550
+ 548
- 551
+ 549
- 552
+ 550
- 553
+ 551
- 554
+ 552
- 555
+ 553
- 556
+ 554
- 557
+ 555
- 558
+ 556
- 559
+ 557
- 560
+ 558
private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
- 561 1 boolean foundSomething = false ;
- 562 1 if (pom == null ) {
- 563 0 return foundSomething;
- 564
+ 559 2 boolean foundSomething = false ;
+ 560 2 boolean addAsIdentifier = true ;
+ 561 2 if (pom == null ) {
+ 562 0 return foundSomething;
+ 563
}
- 565 1 String groupid = interpolateString(pom.getGroupId(), pomProperties);
- 566 1 if (groupid != null && !groupid.isEmpty()) {
- 567 1 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
- 568 1 groupid = groupid.substring(4);
- 569
+ 564 2 String groupid = interpolateString(pom.getGroupId(), pomProperties);
+ 565 2 String parentGroupId = null ;
+ 566
+
+ 567 2 if (pom.getParent() != null ) {
+ 568 2 parentGroupId = interpolateString(pom.getParent().getGroupId(), pomProperties);
+ 569 2 if ((groupid == null || groupid.isEmpty()) && parentGroupId != null && !parentGroupId.isEmpty()) {
+ 570 0 groupid = parentGroupId;
+ 571
}
- 570 1 foundSomething = true ;
- 571 1 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
- 572 1 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
- 573 1 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
- 574 1 addMatchingValues(classes, groupid, dependency.getProductEvidence());
- 575
+ 572
}
- 576 1 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
- 577 1 if (artifactid != null && !artifactid.isEmpty()) {
- 578 1 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
- 579 0 artifactid = artifactid.substring(4);
- 580
+ 573 2 final String originalGroupID = groupid;
+ 574
+
+ 575 2 if (groupid != null && !groupid.isEmpty()) {
+ 576 2 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
+ 577 2 groupid = groupid.substring(4);
+ 578
}
- 581 1 foundSomething = true ;
- 582 1 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
- 583 1 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
- 584 1 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
- 585 1 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
- 586
- }
- 587
-
- 588 1 final String version = interpolateString(pom.getVersion(), pomProperties);
- 589 1 if (version != null && !version.isEmpty()) {
- 590 0 foundSomething = true ;
- 591 0 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+ 579 2 foundSomething = true ;
+ 580 2 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
+ 581 2 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+ 582 2 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
+ 583 2 addMatchingValues(classes, groupid, dependency.getProductEvidence());
+ 584 2 if (parentGroupId != null && !parentGroupId.isEmpty() && !parentGroupId.equals(groupid)) {
+ 585 2 dependency.getVendorEvidence().addEvidence("pom" , "parent-groupid" , parentGroupId, Confidence.MEDIUM);
+ 586 2 dependency.getProductEvidence().addEvidence("pom" , "parent-groupid" , parentGroupId, Confidence.LOW);
+ 587 2 addMatchingValues(classes, parentGroupId, dependency.getVendorEvidence());
+ 588 2 addMatchingValues(classes, parentGroupId, dependency.getProductEvidence());
+ 589
+ }
+ 590
+ } else {
+ 591 0 addAsIdentifier = false ;
592
}
593
-
- 594 1 final Organization org = pom.getOrganization();
- 595 1 if (org != null && org.getName() != null ) {
- 596 0 foundSomething = true ;
- 597 0 final String orgName = interpolateString(org.getName(), pomProperties);
- 598 0 if (orgName != null && !orgName.isEmpty()) {
- 599 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
- 600 0 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
+ 594 2 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+ 595 2 String parentArtifactId = null ;
+ 596
+
+ 597 2 if (pom.getParent() != null ) {
+ 598 2 parentArtifactId = interpolateString(pom.getParent().getArtifactId(), pomProperties);
+ 599 2 if ((artifactid == null || artifactid.isEmpty()) && parentArtifactId != null && !parentArtifactId.isEmpty()) {
+ 600 0 artifactid = parentArtifactId;
601
}
602
}
- 603
-
- 604 1 final String pomName = interpolateString(pom.getName(), pomProperties);
- 605 1 if (pomName != null && !pomName.isEmpty()) {
- 606 1 foundSomething = true ;
- 607 1 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 608 1 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 609 1 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
- 610 1 addMatchingValues(classes, pomName, dependency.getProductEvidence());
- 611
- }
- 612
-
- 613
-
- 614 1 if (pom.getDescription() != null ) {
- 615 0 foundSomething = true ;
- 616 0 final String description = interpolateString(pom.getDescription(), pomProperties);
- 617 0 if (description != null && !description.isEmpty()) {
- 618 0 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
- 619 0 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
- 620 0 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
+ 603 2 final String originalArtifactID = artifactid;
+ 604 2 if (artifactid != null && !artifactid.isEmpty()) {
+ 605 2 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
+ 606 0 artifactid = artifactid.substring(4);
+ 607
+ }
+ 608 2 foundSomething = true ;
+ 609 2 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
+ 610 2 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+ 611 2 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
+ 612 2 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
+ 613 2 if (parentArtifactId != null && !parentArtifactId.isEmpty() && !parentArtifactId.equals(artifactid)) {
+ 614 2 dependency.getProductEvidence().addEvidence("pom" , "parent-artifactid" , parentArtifactId, Confidence.MEDIUM);
+ 615 2 dependency.getVendorEvidence().addEvidence("pom" , "parent-artifactid" , parentArtifactId, Confidence.LOW);
+ 616 2 addMatchingValues(classes, parentArtifactId, dependency.getVendorEvidence());
+ 617 2 addMatchingValues(classes, parentArtifactId, dependency.getProductEvidence());
+ 618
+ }
+ 619
+ } else {
+ 620 0 addAsIdentifier = false ;
621
- }
- 622
}
- 623 1 extractLicense(pom, pomProperties, dependency);
- 624 1 return foundSomething;
+ 622
+
+ 623 2 String version = interpolateString(pom.getVersion(), pomProperties);
+ 624 2 String parentVersion = null ;
625
- }
- 626
- 627
-
- 628
-
- 629
-
+ 626 2 if (pom.getParent() != null ) {
+ 627 2 parentVersion = interpolateString(pom.getParent().getVersion(), pomProperties);
+ 628 2 if ((version == null || version.isEmpty()) && parentVersion != null && !parentVersion.isEmpty()) {
+ 629 2 version = parentVersion;
630
-
+ } 631
-
+ } 632
-
- 633
-
- 634
-
- 635
- protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
- 636
- Dependency dependency, boolean addPackagesAsEvidence) {
- 637 5 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
- 638 5 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
- 639 5 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
- 640
- 641 5 final int classCount = classNames.size();
- 642 5 final EvidenceCollection vendor = dependency.getVendorEvidence();
- 643 5 final EvidenceCollection product = dependency.getProductEvidence();
- 644
+ 633 2 if (version != null && !version.isEmpty()) {
+ 634 2 foundSomething = true ;
+ 635 2 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+ 636 2 if (parentVersion != null && !parentVersion.isEmpty() && !parentVersion.equals(version)) {
+ 637 0 dependency.getVersionEvidence().addEvidence("pom" , "parent-version" , version, Confidence.LOW);
+ 638
+ }
+ 639
+ } else {
+ 640 0 addAsIdentifier = false ;
+ 641
+ }
+ 642
- 645 5 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
- 646 48 final float ratio = entry.getValue() / (float ) classCount;
- 647 48 if (ratio > 0.5) {
- 648
-
- 649 10 vendor.addWeighting(entry.getKey());
- 650 10 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
- 651 8 vendor.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
- 652
- }
- 653
+ 643 2 if (addAsIdentifier) {
+ 644 2 dependency.addIdentifier("maven" , String.format("%s:%s:%s" , originalGroupID, originalArtifactID, version), null , Confidence.LOW);
+ 645
+ }
+ 646
+
+ 647
+
+ 648 2 final Organization org = pom.getOrganization();
+ 649 2 if (org != null && org.getName() != null ) {
+ 650 0 foundSomething = true ;
+ 651 0 final String orgName = interpolateString(org.getName(), pomProperties);
+ 652 0 if (orgName != null && !orgName.isEmpty()) {
+ 653 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+ 654 0 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
+ 655
}
- 654 48 }
- 655 5 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
- 656 985 final float ratio = entry.getValue() / (float ) classCount;
- 657 985 if (ratio > 0.5) {
- 658 5 product.addWeighting(entry.getKey());
- 659 5 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
- 660 4 product.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
- 661
- }
- 662
- }
- 663 985 }
- 664 5 }
+ 656
+ }
+ 657
+
+ 658 2 final String pomName = interpolateString(pom.getName(), pomProperties);
+ 659 2 if (pomName != null && !pomName.isEmpty()) {
+ 660 2 foundSomething = true ;
+ 661 2 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+ 662 2 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+ 663 2 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
+ 664 2 addMatchingValues(classes, pomName, dependency.getProductEvidence());
665
-
+ } 666
-
+ 667
-
- 668
-
- 669
-
- 670
-
- 671
-
- 672
-
- 673
-
- 674
-
+ 668 2 if (pom.getDescription() != null ) {
+ 669 0 foundSomething = true ;
+ 670 0 final String description = interpolateString(pom.getDescription(), pomProperties);
+ 671 0 if (description != null && !description.isEmpty()) {
+ 672 0 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
+ 673 0 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
+ 674 0 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
675
-
- 676
-
- 677
-
- 678
-
- 679
-
- 680
- protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
- 681 5 boolean foundSomething = false ;
- 682 5 JarFile jar = null ;
- 683
- try {
- 684 5 jar = new JarFile(dependency.getActualFilePath());
- 685
-
- 686 5 final Manifest manifest = jar.getManifest();
- 687
-
- 688 5 if (manifest == null ) {
- 689
-
- 690 0 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
- 691
- && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
- 692
- && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
- 693
- && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
- 694 0 LOGGER.log(Level.FINE,
- 695
- String.format("Jar file '%s' does not contain a manifest." ,
- 696
- dependency.getFileName()));
- 697
- }
- 698 0 return false ;
- 699
}
- 700 5 final Attributes atts = manifest.getMainAttributes();
- 701
+ 676
+ }
+ 677 2 extractLicense(pom, pomProperties, dependency);
+ 678 2 return foundSomething;
+ 679
+ }
+ 680
- 702 5 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
- 703 5 final EvidenceCollection productEvidence = dependency.getProductEvidence();
- 704 5 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
- 705
+ 681
+
+ 682
+
+ 683
+
+ 684
+
+ 685
+
+ 686
+
+ 687
+
+ 688
+
+ 689
+ protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
+ 690
+ Dependency dependency, boolean addPackagesAsEvidence) {
+ 691 10 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
+ 692 10 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
+ 693 10 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
+ 694
- 706 5 final String source = "Manifest" ;
- 707
+ 695 10 final int classCount = classNames.size();
+ 696 10 final EvidenceCollection vendor = dependency.getVendorEvidence();
+ 697 10 final EvidenceCollection product = dependency.getProductEvidence();
+ 698
- 708 5 for (Entry<Object, Object> entry : atts.entrySet()) {
- 709 65 String key = entry.getKey().toString();
- 710 65 String value = atts.getValue(key);
- 711 65 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
- 712 0 value = Jsoup.parse(value).text();
- 713
+ 699 10 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
+ 700 96 final float ratio = entry.getValue() / (float ) classCount;
+ 701 96 if (ratio > 0.5) {
+ 702
+
+ 703 20 vendor.addWeighting(entry.getKey());
+ 704 20 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+ 705 16 vendor.addEvidence("jar" , "package name" , entry.getKey(), Confidence.LOW);
+ 706
}
- 714 65 if (IGNORE_VALUES.contains(value)) {
- 715 0 continue ;
- 716 65 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
- 717 1 foundSomething = true ;
- 718 1 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 719 1 addMatchingValues(classInformation, value, productEvidence);
- 720 64 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
- 721 2 foundSomething = true ;
- 722 2 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 723 62 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
- 724 1 foundSomething = true ;
- 725 1 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 726 1 addMatchingValues(classInformation, value, vendorEvidence);
- 727 61 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
- 728 0 foundSomething = true ;
- 729 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 730 0 addMatchingValues(classInformation, value, vendorEvidence);
- 731 61 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
- 732 2 foundSomething = true ;
- 733 2 addDescription(dependency, value, "manifest" , key);
+ 707
+ }
+ 708 96 }
+ 709 10 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
+ 710 1970 final float ratio = entry.getValue() / (float ) classCount;
+ 711 1970 if (ratio > 0.5) {
+ 712 10 product.addWeighting(entry.getKey());
+ 713 10 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+ 714 8 product.addEvidence("jar" , "package name" , entry.getKey(), Confidence.LOW);
+ 715
+ }
+ 716
+ }
+ 717 1970 }
+ 718 10 }
+ 719
+
+ 720
+
+ 721
+
+ 722
+
+ 723
+
+ 724
+
+ 725
+
+ 726
+
+ 727
+
+ 728
+
+ 729
+
+ 730
+
+ 731
+
+ 732
+
+ 733
+
734
-
- 735 2 addMatchingValues(classInformation, value, productEvidence);
- 736 59 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
- 737 3 foundSomething = true ;
- 738 3 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 739 3 addMatchingValues(classInformation, value, productEvidence);
- 740 56 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
- 741 3 foundSomething = true ;
- 742 3 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 743 3 addMatchingValues(classInformation, value, vendorEvidence);
- 744 53 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
- 745 3 foundSomething = true ;
- 746 3 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
- 747 50 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
- 748 2 continue ;
+ protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException { 735 10 boolean foundSomething = false ;
+ 736 10 JarFile jar = null ;
+ 737
+ try {
+ 738 10 jar = new JarFile(dependency.getActualFilePath());
+ 739
+
+ 740 10 final Manifest manifest = jar.getManifest();
+ 741
+
+ 742 10 if (manifest == null ) {
+ 743
+
+ 744 0 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
+ 745
+ && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
+ 746
+ && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
+ 747
+ && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
+ 748 0 LOGGER.log(Level.FINE,
749
-
+ String.format("Jar file '%s' does not contain a manifest." , 750
-
+ dependency.getFileName())); 751
-
- 752
-
+ } 752 0 return false ;
753
-
- 754
-
+ } 754 10 final Attributes atts = manifest.getMainAttributes();
755
-
- 756
-
- 757
- } else {
- 758 48 key = key.toLowerCase();
+ 756 10 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
+ 757 10 final EvidenceCollection productEvidence = dependency.getProductEvidence();
+ 758 10 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
759
- 760 48 if (!IGNORE_KEYS.contains(key)
+ 760 10 final String source = "Manifest" ;
761
- && !key.endsWith("jdk" )
- 762
- && !key.contains("lastmodified" )
- 763
- && !key.endsWith("package" )
- 764
- && !key.endsWith("classpath" )
- 765
- && !key.endsWith("class-path" )
- 766
- && !key.endsWith("-scm" )
+ 762 10 for (Entry<Object, Object> entry : atts.entrySet()) {
+ 763 130 String key = entry.getKey().toString();
+ 764 130 String value = atts.getValue(key);
+ 765 130 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
+ 766 0 value = Jsoup.parse(value).text();
767
- && !key.startsWith("scm-" )
- 768
- && !value.trim().startsWith("scm:" )
- 769
- && !isImportPackage(key, value)
- 770
- && !isPackage(key, value)) {
- 771
-
- 772 14 foundSomething = true ;
- 773 14 if (key.contains("version" )) {
- 774 1 if (key.contains("specification" )) {
- 775 1 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
- 776
- } else {
- 777 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 778
- }
- 779 13 } else if ("build-id" .equals(key)) {
- 780 0 int pos = value.indexOf('(' );
- 781 0 if (pos >= 0) {
- 782 0 value = value.substring(0, pos - 1);
- 783
- }
- 784 0 pos = value.indexOf('[' );
- 785 0 if (pos >= 0) {
- 786 0 value = value.substring(0, pos - 1);
- 787
- }
- 788 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 789 0 } else if (key.contains("title" )) {
- 790 1 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 791 1 addMatchingValues(classInformation, value, productEvidence);
- 792 12 } else if (key.contains("vendor" )) {
- 793 0 if (key.contains("specification" )) {
- 794 0 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
- 795
- } else {
- 796 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 797 0 addMatchingValues(classInformation, value, vendorEvidence);
- 798
- }
- 799 12 } else if (key.contains("name" )) {
- 800 3 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 801 3 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
- 802 3 addMatchingValues(classInformation, value, vendorEvidence);
- 803 3 addMatchingValues(classInformation, value, productEvidence);
- 804 9 } else if (key.contains("license" )) {
- 805 2 addLicense(dependency, value);
- 806
- } else {
- 807 7 if (key.contains("description" )) {
- 808 0 addDescription(dependency, value, "manifest" , key);
- 809
- } else {
- 810 7 productEvidence.addEvidence(source, key, value, Confidence.LOW);
- 811 7 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
- 812 7 addMatchingValues(classInformation, value, vendorEvidence);
- 813 7 addMatchingValues(classInformation, value, productEvidence);
- 814 7 if (value.matches(".*\\d.*" )) {
- 815 3 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
- 816 15 while (tokenizer.hasMoreElements()) {
- 817 12 final String s = tokenizer.nextToken();
- 818 12 if (s.matches("^[0-9.]+$" )) {
- 819 1 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
- 820
- }
- 821 12 }
- 822
- }
- 823
- }
- 824
- }
- 825
- }
- 826
}
- 827 63 }
- 828
- } finally {
- 829 5 if (jar != null ) {
- 830 5 jar.close();
- 831
- }
+ 768 130 if (IGNORE_VALUES.contains(value)) {
+ 769 0 continue ;
+ 770 130 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
+ 771 2 foundSomething = true ;
+ 772 2 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 773 2 addMatchingValues(classInformation, value, productEvidence);
+ 774 128 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
+ 775 4 foundSomething = true ;
+ 776 4 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 777 124 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
+ 778 2 foundSomething = true ;
+ 779 2 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 780 2 addMatchingValues(classInformation, value, vendorEvidence);
+ 781 122 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
+ 782 0 foundSomething = true ;
+ 783 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 784 0 addMatchingValues(classInformation, value, vendorEvidence);
+ 785 122 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
+ 786 4 foundSomething = true ;
+ 787 4 addDescription(dependency, value, "manifest" , key);
+ 788
+
+ 789 4 addMatchingValues(classInformation, value, productEvidence);
+ 790 118 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
+ 791 6 foundSomething = true ;
+ 792 6 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 793 6 addMatchingValues(classInformation, value, productEvidence);
+ 794 112 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
+ 795 6 foundSomething = true ;
+ 796 6 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 797 6 addMatchingValues(classInformation, value, vendorEvidence);
+ 798 106 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
+ 799 6 foundSomething = true ;
+ 800 6 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+ 801 100 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
+ 802 4 continue ;
+ 803
+
+ 804
+
+ 805
+
+ 806
+
+ 807
+
+ 808
+
+ 809
+
+ 810
+
+ 811
+ } else {
+ 812 96 key = key.toLowerCase();
+ 813
+
+ 814 96 if (!IGNORE_KEYS.contains(key)
+ 815
+ && !key.endsWith("jdk" )
+ 816
+ && !key.contains("lastmodified" )
+ 817
+ && !key.endsWith("package" )
+ 818
+ && !key.endsWith("classpath" )
+ 819
+ && !key.endsWith("class-path" )
+ 820
+ && !key.endsWith("-scm" )
+ 821
+ && !key.startsWith("scm-" )
+ 822
+ && !value.trim().startsWith("scm:" )
+ 823
+ && !isImportPackage(key, value)
+ 824
+ && !isPackage(key, value)) {
+ 825
+
+ 826 28 foundSomething = true ;
+ 827 28 if (key.contains("version" )) {
+ 828 2 if (key.contains("specification" )) {
+ 829 2 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 830
+ } else {
+ 831 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
832
- }
- 833 5 return foundSomething;
- 834
- }
- 835
-
- 836
-
+ } 833 26 } else if ("build-id" .equals(key)) {
+ 834 0 int pos = value.indexOf('(' );
+ 835 0 if (pos >= 0) {
+ 836 0 value = value.substring(0, pos - 1);
837
-
- 838
-
- 839
-
- 840
-
+ } 838 0 pos = value.indexOf('[' );
+ 839 0 if (pos >= 0) {
+ 840 0 value = value.substring(0, pos - 1);
841
-
- 842
-
- 843
-
- 844
-
- 845
-
- 846
-
- 847
-
- 848
- private String addDescription(Dependency dependency, String description, String source, String key) {
- 849 2 if (dependency.getDescription() == null ) {
- 850 2 dependency.setDescription(description);
- 851
- }
+ } 842 0 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 843 0 } else if (key.contains("title" )) {
+ 844 2 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 845 2 addMatchingValues(classInformation, value, productEvidence);
+ 846 24 } else if (key.contains("vendor" )) {
+ 847 0 if (key.contains("specification" )) {
+ 848 0 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 849
+ } else {
+ 850 0 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 851 0 addMatchingValues(classInformation, value, vendorEvidence);
852
- String desc;
- 853 2 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
- 854 0 desc = Jsoup.parse(description).text();
- 855
- } else {
- 856 2 desc = description;
- 857
- }
- 858 2 dependency.setDescription(desc);
- 859 2 if (desc.length() > 100) {
- 860 0 desc = desc.replaceAll("\\s\\s+" , " " );
- 861 0 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
- 862 0 final int posLike = desc.toLowerCase().indexOf("like " , 100);
- 863 0 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
- 864 0 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
- 865 0 int pos = -1;
- 866 0 pos = Math.max(pos, posSuchAs);
- 867 0 if (pos >= 0 && posLike >= 0) {
- 868 0 pos = Math.min(pos, posLike);
- 869
- } else {
- 870 0 pos = Math.max(pos, posLike);
- 871
- }
- 872 0 if (pos >= 0 && posWillUse >= 0) {
- 873 0 pos = Math.min(pos, posWillUse);
+ } 853 24 } else if (key.contains("name" )) {
+ 854 6 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 855 6 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+ 856 6 addMatchingValues(classInformation, value, vendorEvidence);
+ 857 6 addMatchingValues(classInformation, value, productEvidence);
+ 858 18 } else if (key.contains("license" )) {
+ 859 4 addLicense(dependency, value);
+ 860
+ } else {
+ 861 14 if (key.contains("description" )) {
+ 862 0 addDescription(dependency, value, "manifest" , key);
+ 863
+ } else {
+ 864 14 productEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 865 14 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+ 866 14 addMatchingValues(classInformation, value, vendorEvidence);
+ 867 14 addMatchingValues(classInformation, value, productEvidence);
+ 868 14 if (value.matches(".*\\d.*" )) {
+ 869 6 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
+ 870 30 while (tokenizer.hasMoreElements()) {
+ 871 24 final String s = tokenizer.nextToken();
+ 872 24 if (s.matches("^[0-9.]+$" )) {
+ 873 2 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
874
- } else {
- 875 0 pos = Math.max(pos, posWillUse);
+ } 875 24 }
876
- }
- 877 0 if (pos >= 0 && posUses >= 0) {
- 878 0 pos = Math.min(pos, posUses);
+ } 877
+ }
+ 878
+ }
879
- } else {
- 880 0 pos = Math.max(pos, posUses);
- 881
- }
+ } 880
+ }
+ 881 126 }
882
-
- 883 0 if (pos > 0) {
- 884 0 final StringBuilder sb = new StringBuilder(pos + 3);
- 885 0 sb.append(desc.substring(0, pos));
- 886 0 sb.append("..." );
- 887 0 desc = sb.toString();
+ } finally { 883 10 if (jar != null ) {
+ 884 10 jar.close();
+ 885
+ }
+ 886
+ }
+ 887 10 return foundSomething;
888
- }
- 889 0 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
- 890 0 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
- 891 0 } else {
- 892 2 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
- 893 2 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
- 894
- }
- 895 2 return desc;
- 896
}
+ 889
+
+ 890
+
+ 891
+
+ 892
+
+ 893
+
+ 894
+
+ 895
+
+ 896
+
897
-
+ 898
-
+ 899
-
+ 900
-
+ 901
-
+ 902
-
- 903
-
- 904
- private void addLicense(Dependency d, String license) {
- 905 2 if (d.getLicense() == null ) {
- 906 2 d.setLicense(license);
- 907 0 } else if (!d.getLicense().contains(license)) {
- 908 0 d.setLicense(d.getLicense() + NEWLINE + license);
+ private String addDescription(Dependency dependency, String description, String source, String key) { 903 4 if (dependency.getDescription() == null ) {
+ 904 4 dependency.setDescription(description);
+ 905
+ }
+ 906
+ String desc;
+ 907 4 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
+ 908 0 desc = Jsoup.parse(description).text();
909
- }
- 910 2 }
+ } else { 910 4 desc = description;
911
-
- 912
-
- 913
-
- 914
-
- 915 7 private File tempFileLocation = null ;
- 916
-
- 917
-
- 918
-
- 919
-
- 920
-
- 921
-
- 922
- @Override
+ } 912 4 dependency.setDescription(desc);
+ 913 4 if (desc.length() > 100) {
+ 914 0 desc = desc.replaceAll("\\s\\s+" , " " );
+ 915 0 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
+ 916 0 final int posLike = desc.toLowerCase().indexOf("like " , 100);
+ 917 0 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
+ 918 0 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
+ 919 0 int pos = -1;
+ 920 0 pos = Math.max(pos, posSuchAs);
+ 921 0 if (pos >= 0 && posLike >= 0) {
+ 922 0 pos = Math.min(pos, posLike);
923
- public void initializeFileTypeAnalyzer() throws Exception {
- 924 1 final File baseDir = Settings.getTempDirectory();
- 925 1 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
- 926 1 if (!tempFileLocation.delete()) {
- 927 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
- 928 0 throw new AnalysisException(msg);
- 929
- }
- 930 1 if (!tempFileLocation.mkdirs()) {
- 931 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
- 932 0 throw new AnalysisException(msg);
- 933
- }
- 934 1 }
- 935
-
- 936
-
- 937
-
- 938
-
- 939
- @Override
- 940
- public void close() {
- 941 1 if (tempFileLocation != null && tempFileLocation.exists()) {
- 942 1 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
- 943 1 final boolean success = FileUtils.delete(tempFileLocation);
- 944 1 if (!success) {
- 945 0 LOGGER.log(Level.WARNING,
- 946
- "Failed to delete some temporary files, see the log for more details" );
- 947
+ } else {
+ 924 0 pos = Math.max(pos, posLike);
+ 925
}
+ 926 0 if (pos >= 0 && posWillUse >= 0) {
+ 927 0 pos = Math.min(pos, posWillUse);
+ 928
+ } else {
+ 929 0 pos = Math.max(pos, posWillUse);
+ 930
+ }
+ 931 0 if (pos >= 0 && posUses >= 0) {
+ 932 0 pos = Math.min(pos, posUses);
+ 933
+ } else {
+ 934 0 pos = Math.max(pos, posUses);
+ 935
+ }
+ 936
+
+ 937 0 if (pos > 0) {
+ 938 0 final StringBuilder sb = new StringBuilder(pos + 3);
+ 939 0 sb.append(desc.substring(0, pos));
+ 940 0 sb.append("..." );
+ 941 0 desc = sb.toString();
+ 942
+ }
+ 943 0 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
+ 944 0 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
+ 945 0 } else {
+ 946 4 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
+ 947 4 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
948
}
- 949 1 }
+ 949 4 return desc;
950
-
+ } 951
-
+ 952
-
+ 953
-
+ 954
-
+ 955
-
+ 956
-
+ 957
-
+ 958
-
- 959
-
- 960
-
- 961
-
- 962
-
+ private void addLicense(Dependency d, String license) { 959 4 if (d.getLicense() == null ) {
+ 960 4 d.setLicense(license);
+ 961 0 } else if (!d.getLicense().contains(license)) {
+ 962 0 d.setLicense(d.getLicense() + NEWLINE + license);
963
-
- 964
-
+ } 964 4 }
965
-
+ 966
-
+ 967
-
+ 968
-
- 969
-
+ 969 14 private File tempFileLocation = null ;
970
-
+ 971
-
+ 972
-
+ 973
974
-
+ 975
-
+ 976
-
+ @Override 977
-
- 978
- protected String interpolateString(String text, Properties properties) {
- 979 11 Properties props = properties;
- 980 11 if (text == null ) {
- 981 1 return text;
- 982
+ public void initializeFileTypeAnalyzer() throws Exception {
+ 978 2 final File baseDir = Settings.getTempDirectory();
+ 979 2 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+ 980 2 if (!tempFileLocation.delete()) {
+ 981 0 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
+ 982 0 throw new AnalysisException(msg);
+ 983
}
- 983 10 if (props == null ) {
- 984 3 props = new Properties();
- 985
+ 984 2 if (!tempFileLocation.mkdirs()) {
+ 985 0 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
+ 986 0 throw new AnalysisException(msg);
+ 987
}
- 986
+ 988 2 }
+ 989
- 987 10 final int pos = text.indexOf("${" );
- 988 10 if (pos < 0) {
- 989 7 return text;
990
- }
- 991 3 final int end = text.indexOf("}" );
- 992 3 if (end < pos) {
- 993 0 return text;
+ 991
+
+ 992
+
+ 993
+ @Override
994
- }
- 995
-
- 996 3 final String propName = text.substring(pos + 2, end);
- 997 3 String propValue = interpolateString(props.getProperty(propName), props);
- 998 3 if (propValue == null ) {
- 999 0 propValue = "" ;
+ public void close() { 995 2 if (tempFileLocation != null && tempFileLocation.exists()) {
+ 996 2 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+ 997 2 final boolean success = FileUtils.delete(tempFileLocation);
+ 998 2 if (!success) {
+ 999 0 LOGGER.log(Level.WARNING,
1000
+ "Failed to delete some temporary files, see the log for more details" );
+ 1001
+ }
+ 1002
}
- 1001 3 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
- 1002 3 sb.append(text.subSequence(0, pos));
- 1003 3 sb.append(propValue);
- 1004 3 sb.append(text.substring(end + 1));
- 1005 3 return interpolateString(sb.toString(), props);
+ 1003 2 }
+ 1004
+
+ 1005
+
1006
- }
+ 1007
-
+ 1008
-
+ 1009
-
+ 1010
-
+ 1011
-
+ 1012
-
+ 1013
-
+ 1014
-
+ 1015
- private boolean isImportPackage(String key, String value) {
- 1016 15 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$" );
- 1017 15 final boolean matches = packageRx.matcher(value).matches();
- 1018 15 return matches && (key.contains("import" ) || key.contains("include" ) || value.length() > 10);
+ 1016
+
+ 1017
+
+ 1018
+
1019
- }
+ 1020
-
+ 1021
-
+ 1022
-
+ 1023
-
+ 1024
-
+ 1025
-
+ 1026
-
+ 1027
-
+ 1028
- private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
- 1029 5 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
- 1030 5 JarFile jar = null ;
+ 1029
+
+ 1030
+
1031
- try {
- 1032 5 jar = new JarFile(dependency.getActualFilePath());
- 1033 5 final Enumeration entries = jar.entries();
- 1034 1848 while (entries.hasMoreElements()) {
- 1035 1843 final JarEntry entry = (JarEntry) entries.nextElement();
- 1036 1843 final String name = entry.getName().toLowerCase();
- 1037
-
- 1038 1843 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
- 1039 1535 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
- 1040 1535 classNames.add(className);
- 1041
- }
- 1042 1843 }
- 1043 0 } catch (IOException ex) {
- 1044 0 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
- 1045 0 LOGGER.log(Level.WARNING, msg);
- 1046 0 LOGGER.log(Level.FINE, null , ex);
- 1047
- } finally {
- 1048 5 if (jar != null ) {
+ 1032
+ protected String interpolateString(String text, Properties properties) {
+ 1033 28 Properties props = properties;
+ 1034 28 if (text == null ) {
+ 1035 2 return text;
+ 1036
+ }
+ 1037 26 if (props == null ) {
+ 1038 12 props = new Properties();
+ 1039
+ }
+ 1040
+
+ 1041 26 final int pos = text.indexOf("${" );
+ 1042 26 if (pos < 0) {
+ 1043 20 return text;
+ 1044
+ }
+ 1045 6 final int end = text.indexOf("}" );
+ 1046 6 if (end < pos) {
+ 1047 0 return text;
+ 1048
+ }
1049
- try {
- 1050 5 jar.close();
- 1051 0 } catch (IOException ex) {
- 1052 0 LOGGER.log(Level.FINEST, null , ex);
- 1053 5 }
+ 1050 6 final String propName = text.substring(pos + 2, end);
+ 1051 6 String propValue = interpolateString(props.getProperty(propName), props);
+ 1052 6 if (propValue == null ) {
+ 1053 0 propValue = "" ;
1054
- }
- 1055
}
- 1056 5 return classNames;
- 1057
- }
- 1058
-
- 1059
-
+ 1055 6 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
+ 1056 6 sb.append(text.subSequence(0, pos));
+ 1057 6 sb.append(propValue);
+ 1058 6 sb.append(text.substring(end + 1));
+ 1059 6 return interpolateString(sb.toString(), props);
1060
-
+ } 1061
-
+ 1062
-
+ 1063
-
+ 1064
-
+ 1065
-
+ 1066
-
+ 1067
- private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
+ 1068
- HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
- 1069 5 for (ClassNameInformation entry : classNames) {
- 1070 1535 final ArrayList<String> list = entry.getPackageStructure();
- 1071 1535 addEntry(vendor, list.get(0));
- 1072
+
+ 1069
+ private boolean isImportPackage(String key, String value) {
+ 1070 30 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$" );
+ 1071 30 final boolean matches = packageRx.matcher(value).matches();
+ 1072 30 return matches && (key.contains("import" ) || key.contains("include" ) || value.length() > 10);
+ 1073
+ }
+ 1074
- 1073 1535 if (list.size() == 2) {
- 1074 0 addEntry(product, list.get(1));
1075
- }
- 1076 1535 if (list.size() == 3) {
- 1077 345 addEntry(vendor, list.get(1));
- 1078 345 addEntry(product, list.get(1));
- 1079 345 addEntry(product, list.get(2));
- 1080
- }
- 1081 1535 if (list.size() >= 4) {
- 1082 1190 addEntry(vendor, list.get(1));
- 1083 1190 addEntry(vendor, list.get(2));
- 1084 1190 addEntry(product, list.get(1));
- 1085 1190 addEntry(product, list.get(2));
- 1086 1190 addEntry(product, list.get(3));
- 1087
- }
- 1088 1535 }
- 1089 5 }
- 1090
-
- 1091
- 1092
-
- 1093
-
- 1094
+ 1076
+
+ 1077
+
+ 1078
- 1095
-
- 1096
-
- 1097
-
- 1098
- private void addEntry(HashMap<String, Integer> collection, String key) {
- 1099 8520 if (collection.containsKey(key)) {
- 1100 7487 collection.put(key, collection.get(key) + 1);
- 1101
- } else {
- 1102 1033 collection.put(key, 1);
- 1103
- }
- 1104 8520 }
- 1105
-
- 1106
-
- 1107
-
- 1108
-
- 1109
-
- 1110
-
- 1111
-
- 1112
-
- 1113
-
- 1114
-
- 1115
- private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
- 1116 37 if (value == null || value.isEmpty()) {
- 1117 0 return ;
- 1118
- }
- 1119 37 final String text = value.toLowerCase();
- 1120 37 for (ClassNameInformation cni : classes) {
- 1121 14916 for (String key : cni.getPackageStructure()) {
- 1122 57504 if (text.contains(key)) {
- 1123 13816 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
- 1124
- }
- 1125 57504 }
- 1126 14916 }
- 1127 37 }
- 1128
-
- 1129
-
- 1130
-
- 1131
-
- 1132
-
- 1133
-
- 1134
-
- 1135
-
- 1136
- private boolean isPackage(String key, String value) {
- 1137
-
- 1138 15 return !key.matches(".*(version|title|vendor|name|license|description).*" )
- 1139
- && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
- 1140
-
- 1141
- }
- 1142
-
- 1143
-
- 1144
-
- 1145
-
- 1146
-
- 1147
+ 1079
+ 1080
+
+ 1081
+
+ 1082
+ private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
+ 1083 10 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
+ 1084 10 JarFile jar = null ;
+ 1085
+ try {
+ 1086 10 jar = new JarFile(dependency.getActualFilePath());
+ 1087 10 final Enumeration entries = jar.entries();
+ 1088 3696 while (entries.hasMoreElements()) {
+ 1089 3686 final JarEntry entry = (JarEntry) entries.nextElement();
+ 1090 3686 final String name = entry.getName().toLowerCase();
+ 1091
+
+ 1092 3686 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
+ 1093 3070 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
+ 1094 3070 classNames.add(className);
+ 1095
+ }
+ 1096 3686 }
+ 1097 0 } catch (IOException ex) {
+ 1098 0 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
+ 1099 0 LOGGER.log(Level.WARNING, msg);
+ 1100 0 LOGGER.log(Level.FINE, null , ex);
+ 1101
+ } finally {
+ 1102 10 if (jar != null ) {
+ 1103
+ try {
+ 1104 10 jar.close();
+ 1105 0 } catch (IOException ex) {
+ 1106 0 LOGGER.log(Level.FINEST, null , ex);
+ 1107 10 }
+ 1108
+ }
+ 1109
+ }
+ 1110 10 return classNames;
+ 1111
+ }
+ 1112
+
+ 1113
+
+ 1114
+
+ 1115
+
+ 1116
+
+ 1117
+
+ 1118
+
+ 1119
+
+ 1120
+
+ 1121
+ private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
+ 1122
+ HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
+ 1123 10 for (ClassNameInformation entry : classNames) {
+ 1124 3070 final ArrayList<String> list = entry.getPackageStructure();
+ 1125 3070 addEntry(vendor, list.get(0));
+ 1126
+
+ 1127 3070 if (list.size() == 2) {
+ 1128 0 addEntry(product, list.get(1));
+ 1129
+ }
+ 1130 3070 if (list.size() == 3) {
+ 1131 690 addEntry(vendor, list.get(1));
+ 1132 690 addEntry(product, list.get(1));
+ 1133 690 addEntry(product, list.get(2));
+ 1134
+ }
+ 1135 3070 if (list.size() >= 4) {
+ 1136 2380 addEntry(vendor, list.get(1));
+ 1137 2380 addEntry(vendor, list.get(2));
+ 1138 2380 addEntry(product, list.get(1));
+ 1139 2380 addEntry(product, list.get(2));
+ 1140 2380 addEntry(product, list.get(3));
+ 1141
+ }
+ 1142 3070 }
+ 1143 10 }
+ 1144
+
+ 1145
+
+ 1146
+
+ 1147
+
1148
-
+ 1149
-
+ 1150
-
+ 1151
- private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) {
- 1152 0 if (pom == null ) {
- 1153 0 return ;
- 1154
+
+ 1152
+ private void addEntry(HashMap<String, Integer> collection, String key) {
+ 1153 17040 if (collection.containsKey(key)) {
+ 1154 14974 collection.put(key, collection.get(key) + 1);
+ 1155
+ } else {
+ 1156 2066 collection.put(key, 1);
+ 1157
}
- 1155 0 String groupid = interpolateString(pom.getGroupId(), pomProperties);
- 1156 0 if (groupid != null && !groupid.isEmpty()) {
- 1157 0 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
- 1158 0 groupid = groupid.substring(4);
+ 1158 17040 }
1159
- }
- 1160 0 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
- 1161 0 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+ 1160
+
+ 1161
+
1162
- }
- 1163 0 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
- 1164 0 if (artifactid != null && !artifactid.isEmpty()) {
- 1165 0 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
- 1166 0 artifactid = artifactid.substring(4);
+ 1163
+
+ 1164
+
+ 1165
+
+ 1166
+
1167
- }
- 1168 0 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
- 1169 0 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
- 1170
+
+ 1168
+
+ 1169
+ private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
+ 1170 82 if (value == null || value.isEmpty() || classes == null || classes.isEmpty()) {
+ 1171 0 return ;
+ 1172
}
- 1171 0 final String version = interpolateString(pom.getVersion(), pomProperties);
- 1172 0 if (version != null && !version.isEmpty()) {
- 1173 0 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
- 1174
- }
- 1175
-
- 1176 0 final Parent parent = pom.getParent();
- 1177 0 if (parent != null ) {
- 1178 0 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
- 1179 0 if (parentGroupId != null && !parentGroupId.isEmpty()) {
- 1180 0 if (groupid == null || groupid.isEmpty()) {
- 1181 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.HIGH);
+ 1173 82 final String text = value.toLowerCase();
+ 1174 82 for (ClassNameInformation cni : classes) {
+ 1175 33000 for (String key : cni.getPackageStructure()) {
+ 1176 127640 if (text.contains(key)) {
+ 1177 30800 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
+ 1178
+ }
+ 1179 127640 }
+ 1180 33000 }
+ 1181 82 }
1182
- } else {
- 1183 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.MEDIUM);
+ 1183
+
1184
- }
- 1185 0 dependency.getProductEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.LOW);
+ 1185
+
1186
- }
- 1187 0 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
- 1188 0 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
- 1189 0 if (artifactid == null || artifactid.isEmpty()) {
- 1190 0 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.HIGH);
+ 1187
+
+ 1188
+
+ 1189
+
+ 1190
+ private boolean isPackage(String key, String value) {
1191
- } else {
- 1192 0 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.MEDIUM);
+ 1192 30 return !key.matches(".*(version|title|vendor|name|license|description).*" )
1193
- }
- 1194 0 dependency.getVendorEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.LOW);
+ && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" ); 1194
+
1195
- }
- 1196 0 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
- 1197 0 if (parentVersion != null && !parentVersion.isEmpty()) {
- 1198 0 if (version == null || version.isEmpty()) {
- 1199 0 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.HIGH);
- 1200
- } else {
- 1201 0 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.LOW);
- 1202
- }
- 1203
- }
- 1204
- }
- 1205
-
- 1206 0 final Organization org = pom.getOrganization();
- 1207 0 if (org != null && org.getName() != null ) {
- 1208 0 final String orgName = interpolateString(org.getName(), pomProperties);
- 1209 0 if (orgName != null && !orgName.isEmpty()) {
- 1210 0 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
- 1211
- }
- 1212
- }
- 1213
-
- 1214 0 final String pomName = interpolateString(pom.getName(), pomProperties);
- 1215 0 if (pomName != null && !pomName.isEmpty()) {
- 1216 0 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 1217 0 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
- 1218
- }
- 1219
+ }
+ 1196
- 1220
-
- 1221 0 if (pom.getDescription() != null ) {
- 1222 0 final String description = interpolateString(pom.getDescription(), pomProperties);
- 1223 0 if (description != null && !description.isEmpty()) {
- 1224 0 addDescription(dependency, description, "pom" , "description" );
- 1225
- }
- 1226
- }
- 1227 0 extractLicense(pom, pomProperties, dependency);
- 1228 0 }
- 1229
-
- 1230
+ 1197
- 1231
+ 1198
- 1232
+ 1199
- 1233
+ 1200
- 1234
+ 1201
- 1235
+ 1202
- 1236
+ 1203
- 1237
+ 1204
private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
- 1238
+ 1205
- 1239 1 if (pom.getLicenses() != null ) {
- 1240 0 String license = null ;
- 1241 0 for (License lic : pom.getLicenses().getLicense()) {
- 1242 0 String tmp = null ;
- 1243 0 if (lic.getName() != null ) {
- 1244 0 tmp = interpolateString(lic.getName(), pomProperties);
- 1245
+ 1206 2 if (pom.getLicenses() != null ) {
+ 1207 0 String license = null ;
+ 1208 0 for (License lic : pom.getLicenses().getLicense()) {
+ 1209 0 String tmp = null ;
+ 1210 0 if (lic.getName() != null ) {
+ 1211 0 tmp = interpolateString(lic.getName(), pomProperties);
+ 1212
}
- 1246 0 if (lic.getUrl() != null ) {
- 1247 0 if (tmp == null ) {
- 1248 0 tmp = interpolateString(lic.getUrl(), pomProperties);
- 1249
+ 1213 0 if (lic.getUrl() != null ) {
+ 1214 0 if (tmp == null ) {
+ 1215 0 tmp = interpolateString(lic.getUrl(), pomProperties);
+ 1216
} else {
- 1250 0 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
- 1251
+ 1217 0 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
+ 1218
}
- 1252
+ 1219
}
- 1253 0 if (tmp == null ) {
- 1254 0 continue ;
- 1255
+ 1220 0 if (tmp == null ) {
+ 1221 0 continue ;
+ 1222
}
- 1256 0 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
- 1257 0 tmp = Jsoup.parse(tmp).text();
- 1258
+ 1223 0 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
+ 1224 0 tmp = Jsoup.parse(tmp).text();
+ 1225
}
- 1259 0 if (license == null ) {
- 1260 0 license = tmp;
- 1261
+ 1226 0 if (license == null ) {
+ 1227 0 license = tmp;
+ 1228
} else {
- 1262 0 license += "\n" + tmp;
- 1263
+ 1229 0 license += "\n" + tmp;
+ 1230
}
- 1264 0 }
- 1265 0 if (license != null ) {
- 1266 0 dependency.setLicense(license);
- 1267
+ 1231 0 }
+ 1232 0 if (license != null ) {
+ 1233 0 dependency.setLicense(license);
+ 1234
}
- 1268
+ 1235
}
- 1269 1 }
- 1270
+ 1236 2 }
+ 1237
- 1271
+ 1238
- 1272
+ 1239
- 1273
+ 1240
- 1274
+ 1241
protected static class ClassNameInformation {
- 1275
+ 1242
- 1276
+ 1243
- 1277
+ 1244
- 1278
+ 1245
- 1279
+ 1246
- 1280
+ 1247
- 1281
+ 1248
- 1282
+ 1249
- 1283
+ 1250
- 1284
+ 1251
- 1285
+ 1252
- 1286
+ 1253
- 1287
+ 1254
- 1288
+ 1255
- 1289
+ 1256
- 1290
+ 1257
- 1291
+ 1258
- 1292
+ 1259
- 1293
+ 1260
- 1294
+ 1261
- 1295
+ 1262
- 1296 1535 ClassNameInformation(String className) {
- 1297 1535 name = className;
- 1298 1535 if (name.contains("/" )) {
- 1299 1535 final String[] tmp = className.toLowerCase().split("/" );
- 1300 1535 int start = 0;
- 1301 1535 int end = 3;
- 1302 1535 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
- 1303 1535 start = 1;
- 1304 1535 end = 4;
- 1305
+ 1263 3070 ClassNameInformation(String className) {
+ 1264 3070 name = className;
+ 1265 3070 if (name.contains("/" )) {
+ 1266 3070 final String[] tmp = className.toLowerCase().split("/" );
+ 1267 3070 int start = 0;
+ 1268 3070 int end = 3;
+ 1269 3070 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
+ 1270 3070 start = 1;
+ 1271 3070 end = 4;
+ 1272
}
- 1306 1535 if (tmp.length <= end) {
- 1307 345 end = tmp.length - 1;
- 1308
+ 1273 3070 if (tmp.length <= end) {
+ 1274 690 end = tmp.length - 1;
+ 1275
}
- 1309 7330 for (int i = start; i <= end; i++) {
- 1310 5795 packageStructure.add(tmp[i]);
- 1311
+ 1276 14660 for (int i = start; i <= end; i++) {
+ 1277 11590 packageStructure.add(tmp[i]);
+ 1278
}
- 1312 1535 } else {
- 1313 0 packageStructure.add(name);
- 1314
+ 1279 3070 } else {
+ 1280 0 packageStructure.add(name);
+ 1281
}
- 1315 1535 }
- 1316
+ 1282 3070 }
+ 1283
- 1317
+ 1284
- 1318
+ 1285
- 1319
+ 1286
private String name;
- 1320
+ 1287
- 1321
+ 1288
- 1322
+ 1289
- 1323
+ 1290
- 1324
+ 1291
- 1325
+ 1292
- 1326
+ 1293
public String getName() {
- 1327
+ 1294
return name;
- 1328
+ 1295
}
- 1329
+ 1296
- 1330
+ 1297
- 1331
+ 1298
- 1332
+ 1299
- 1333
+ 1300
- 1334
+ 1301
- 1335
+ 1302
public void setName(String name) {
- 1336
+ 1303
this .name = name;
- 1337
+ 1304
}
- 1338
+ 1305
- 1339
+ 1306
- 1340
+ 1307
- 1341 1535 private final ArrayList<String> packageStructure = new ArrayList<String>();
- 1342
+ 1308 3070 private final ArrayList<String> packageStructure = new ArrayList<String>();
+ 1309
- 1343
+ 1310
- 1344
+ 1311
- 1345
+ 1312
- 1346
+ 1313
- 1347
+ 1314
- 1348
+ 1315
public ArrayList<String> getPackageStructure() {
- 1349
+ 1316
return packageStructure;
- 1350
+ 1317
}
- 1351
+ 1318
}
- 1352
+ 1319
- 1353
+ 1320
- 1354
+ 1321
- 1355
+ 1322
- 1356
+ 1323
- 1357
+ 1324
- 1358
+ 1325
- 1359
+ 1326
private File getNextTempDirectory() throws AnalysisException {
- 1360 0 dirCount += 1;
- 1361 0 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
- 1362
+ 1327 0 dirCount += 1;
+ 1328 0 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+ 1329
- 1363 0 if (directory.exists()) {
- 1364 0 return getNextTempDirectory();
- 1365
+ 1330 0 if (directory.exists()) {
+ 1331 0 return getNextTempDirectory();
+ 1332
}
- 1366 0 if (!directory.mkdirs()) {
- 1367 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
- 1368 0 throw new AnalysisException(msg);
- 1369
+ 1333 0 if (!directory.mkdirs()) {
+ 1334 0 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+ 1335 0 throw new AnalysisException(msg);
+ 1336
}
- 1370 0 return directory;
- 1371
+ 1337 0 return directory;
+ 1338
}
- 1372
+ 1339
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html
index fef2f1136..c920ab563 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html
@@ -105,7 +105,7 @@
44
- 45 1 private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class .getName());
+ 45 2 private static final Logger LOGGER = Logger.getLogger(JavaScriptAnalyzer.class .getName());
46
47
@@ -124,14 +124,14 @@
54
- 55 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 55 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
56
57
58
- 59 1 private static final Set<String> EXTENSIONS = newHashSet("js" );
+ 59 2 private static final Set<String> EXTENSIONS = newHashSet("js" );
60
61
@@ -148,7 +148,7 @@
@Override
67
public Set<String> getSupportedExtensions() {
- 68 2 return EXTENSIONS;
+ 68 4 return EXTENSIONS;
69
}
70
@@ -167,7 +167,7 @@
@Override
77
public String getName() {
- 78 1 return ANALYZER_NAME;
+ 78 2 return ANALYZER_NAME;
79
}
80
@@ -186,7 +186,7 @@
@Override
87
public AnalysisPhase getAnalysisPhase() {
- 88 1 return ANALYSIS_PHASE;
+ 88 2 return ANALYSIS_PHASE;
89
}
90
@@ -205,7 +205,7 @@
@Override
97
protected String getAnalyzerEnabledSettingKey() {
- 98 5 return Settings.KEYS.ANALYZER_JAVASCRIPT_ENABLED;
+ 98 10 return Settings.KEYS.ANALYZER_JAVASCRIPT_ENABLED;
99
}
100
@@ -275,6 +275,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
index 8786b6cec..2d13a5602 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html
@@ -12,7 +12,7 @@
@@ -82,260 +82,275 @@
32
import org.owasp.dependencycheck.dependency.Dependency;
33
- import org.owasp.dependencycheck.utils.Settings;
+ import org.owasp.dependencycheck.dependency.Identifier; 34
-
+ import org.owasp.dependencycheck.utils.Settings; 35
-
+ 36
-
+ 37
-
+ 38
-
+ 39
-
+ 40
-
- 41
-
- 42
-
- 43
-
- 44
-
- 45
-
- 46
+ 41
+
+ 42
+
+ 43
+
+ 44
+
+ 45
+
+ 46
+
47
-
+ 48
-
+ 49
- public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
+ 50
-
+ public class NexusAnalyzer extends AbstractFileTypeAnalyzer { 51
-
+ 52
-
+ 53
+
+ 54
- 54 1 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
- 55
-
+ 55 2 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
56
-
+ 57
-
+ 58
-
+ 59
- private static final String ANALYZER_NAME = "Nexus Analyzer" ;
+ 60
-
+ private static final String ANALYZER_NAME = "Nexus Analyzer" ; 61
-
+ 62
-
+ 63
+
+ 64
- 64 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
- 65
-
+ 65 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
66
-
+ 67
-
+ 68
+
+ 69
- 69 1 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
- 70
-
+ 70 2 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
71
-
+ 72
-
+ 73
-
+ 74
- private NexusSearch searcher;
+ 75
-
+ private NexusSearch searcher; 76
-
+ 77
-
+ 78
-
+ 79
-
+ 80
-
+ 81
- @Override
+ 82
+ @Override
+ 83
public void initializeFileTypeAnalyzer() throws Exception {
- 83 0 LOGGER.fine("Initializing Nexus Analyzer" );
- 84 0 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , isEnabled()));
- 85 0 if (isEnabled()) {
- 86 0 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
- 87 0 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
- 88
+ 84 0 LOGGER.fine("Initializing Nexus Analyzer" );
+ 85 0 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , isEnabled()));
+ 86 0 if (isEnabled()) {
+ 87 0 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+ 88 0 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
+ 89
try {
- 89 0 searcher = new NexusSearch(new URL(searchUrl));
- 90 0 if (!searcher.preflightRequest()) {
- 91 0 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
- 92 0 setEnabled(false );
- 93
+ 90 0 searcher = new NexusSearch(new URL(searchUrl));
+ 91 0 if (!searcher.preflightRequest()) {
+ 92 0 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
+ 93 0 setEnabled(false );
+ 94
}
- 94 0 } catch (MalformedURLException mue) {
- 95
-
+ 95 0 } catch (MalformedURLException mue) {
96
+
+ 97
- 97 0 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
- 98 0 setEnabled(false );
- 99 0 }
- 100
+ 98 0 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
+ 99 0 setEnabled(false );
+ 100 0 }
+ 101
}
- 101 0 }
- 102
-
+ 102 0 }
103
-
+ 104
-
+ 105
-
+ 106
-
+ 107
-
+ 108
- @Override
+ 109
+ @Override
+ 110
public String getName() {
- 110 4 return ANALYZER_NAME;
- 111
- }
+ 111 8 return ANALYZER_NAME;
112
-
+ } 113
-
+ 114
-
+ 115
-
+ 116
-
+ 117
-
+ 118
- @Override
+ 119
+ @Override
+ 120
protected String getAnalyzerEnabledSettingKey() {
- 120 2 return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
- 121
- }
+ 121 4 return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
122
-
+ } 123
-
+ 124
-
+ 125
-
+ 126
-
+ 127
-
+ 128
- @Override
+ 129
+ @Override
+ 130
public AnalysisPhase getAnalysisPhase() {
- 130 1 return ANALYSIS_PHASE;
- 131
- }
+ 131 2 return ANALYSIS_PHASE;
132
-
- 133
-
- 134
-
- 135
-
- 136
-
- 137
-
- 138
- @Override
- 139
- public Set<String> getSupportedExtensions() {
- 140 0 return SUPPORTED_EXTENSIONS;
- 141
}
- 142
+ 133
- 143
+ 134
- 144
-
- 145
+ 135
+
+ 136
- 146
-
- 147
-
- 148
-
- 149
+ 137
+
+ 138
- 150
+ 139
@Override
+ 140
+ public Set<String> getSupportedExtensions() {
+ 141 0 return SUPPORTED_EXTENSIONS;
+ 142
+ }
+ 143
+
+ 144
+
+ 145
+
+ 146
+
+ 147
+
+ 148
+
+ 149
+
+ 150
+
151
- public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ @Override 152
+ public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ 153
try {
- 153 0 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
- 154 0 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
- 155 0 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
- 156
+ 154 0 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
+ 155 0 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
+ 156 0 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
+ 157
}
- 157 0 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
- 158 0 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
- 159
+ 158 0 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
+ 159 0 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
+ 160
}
- 160 0 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
- 161 0 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
- 162
+ 161 0 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
+ 162 0 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
+ 163
}
- 163 0 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
- 164 0 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
- 165
+ 164 0 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
+ 165 0 boolean found = false ;
+ 166 0 for (Identifier i : dependency.getIdentifiers()) {
+ 167 0 if ("maven" .equals(i.getType()) && i.getValue().equals(ma.toString())) {
+ 168 0 found = true ;
+ 169 0 i.setConfidence(Confidence.HIGHEST);
+ 170 0 i.setUrl(ma.getArtifactUrl());
+ 171 0 break ;
+ 172
+ }
+ 173 0 }
+ 174 0 if (!found) {
+ 175 0 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
+ 176
+ }
+ 177
}
- 166 0 } catch (IllegalArgumentException iae) {
- 167
+ 178 0 } catch (IllegalArgumentException iae) {
+ 179
- 168 0 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
- 169 0 } catch (FileNotFoundException fnfe) {
- 170
+ 180 0 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
+ 181 0 } catch (FileNotFoundException fnfe) {
+ 182
- 171 0 LOGGER.fine(String.format("Artifact not found in repository '%s'" , dependency.getFileName()));
- 172 0 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
- 173 0 } catch (IOException ioe) {
- 174
+ 183 0 LOGGER.fine(String.format("Artifact not found in repository '%s'" , dependency.getFileName()));
+ 184 0 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
+ 185 0 } catch (IOException ioe) {
+ 186
- 175 0 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
- 176 0 }
- 177 0 }
- 178
+ 187 0 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
+ 188 0 }
+ 189 0 }
+ 190
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
index 15b56cbdf..82dc4d9f6 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NuspecAnalyzer.html
@@ -107,7 +107,7 @@
45
- 46 1 private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class .getName());
+ 46 2 private static final Logger LOGGER = Logger.getLogger(NuspecAnalyzer.class .getName());
47
48
@@ -126,7 +126,7 @@
55
- 56 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+ 56 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
57
58
@@ -135,7 +135,7 @@
60
- 61 1 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec" );
+ 61 2 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("nuspec" );
62
63
@@ -169,7 +169,7 @@
@Override
78
public String getName() {
- 79 5 return ANALYZER_NAME;
+ 79 10 return ANALYZER_NAME;
80
}
81
@@ -188,7 +188,7 @@
@Override
88
protected String getAnalyzerEnabledSettingKey() {
- 89 6 return Settings.KEYS.ANALYZER_NUSPEC_ENABLED;
+ 89 12 return Settings.KEYS.ANALYZER_NUSPEC_ENABLED;
90
}
91
@@ -207,7 +207,7 @@
@Override
98
public AnalysisPhase getAnalysisPhase() {
- 99 2 return ANALYSIS_PHASE;
+ 99 4 return ANALYSIS_PHASE;
100
}
101
@@ -226,7 +226,7 @@
@Override
108
public Set<String> getSupportedExtensions() {
- 109 852 return SUPPORTED_EXTENSIONS;
+ 109 1704 return SUPPORTED_EXTENSIONS;
110
}
111
@@ -297,6 +297,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
index 1ee36bd4f..699d06be2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html
@@ -129,9 +129,9 @@
56
public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException {
- 57 1 cveDB = new CveDB();
- 58 1 cveDB.open();
- 59 1 }
+ 57 2 cveDB = new CveDB();
+ 58 2 cveDB.open();
+ 59 2 }
60
61
@@ -144,9 +144,9 @@
@Override
65
public void close() {
- 66 1 cveDB.close();
- 67 1 cveDB = null ;
- 68 1 }
+ 66 2 cveDB.close();
+ 67 2 cveDB = null ;
+ 68 2 }
69
70
@@ -206,20 +206,20 @@
@Override
100
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
- 101 2 for (Identifier id : dependency.getIdentifiers()) {
- 102 2 if ("cpe" .equals(id.getType())) {
+ 101 4 for (Identifier id : dependency.getIdentifiers()) {
+ 102 4 if ("cpe" .equals(id.getType())) {
103
try {
- 104 2 final String value = id.getValue();
- 105 2 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
- 106 2 dependency.getVulnerabilities().addAll(vulns);
+ 104 4 final String value = id.getValue();
+ 105 4 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
+ 106 4 dependency.getVulnerabilities().addAll(vulns);
107 0 } catch (DatabaseException ex) {
108 0 throw new AnalysisException(ex);
- 109 2 }
+ 109 4 }
110
}
- 111 2 }
- 112 2 for (Identifier id : dependency.getSuppressedIdentifiers()) {
+ 111 4 }
+ 112 4 for (Identifier id : dependency.getSuppressedIdentifiers()) {
113 0 if ("cpe" .equals(id.getType())) {
114
try {
@@ -232,7 +232,7 @@
121
}
122 0 }
- 123 2 }
+ 123 4 }
124
125
@@ -249,7 +249,7 @@
@Override
131
public String getName() {
- 132 4 return "NVD CVE Analyzer" ;
+ 132 8 return "NVD CVE Analyzer" ;
133
}
134
@@ -268,7 +268,7 @@
@Override
141
public AnalysisPhase getAnalysisPhase() {
- 142 1 return AnalysisPhase.FINDING_ANALYSIS;
+ 142 2 return AnalysisPhase.FINDING_ANALYSIS;
143
}
144
@@ -287,12 +287,12 @@
@Override
151
public void initialize() throws Exception {
- 152 1 this .open();
- 153 1 }
+ 152 2 this .open();
+ 153 2 }
154
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
index 38f836318..8a91f9fe0 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html
@@ -12,7 +12,7 @@
@@ -97,7 +97,7 @@
40
- 41 1 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
+ 41 2 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
42
43
@@ -114,7 +114,7 @@
@Override
49
public String getName() {
- 50 4 return ANALYZER_NAME;
+ 50 8 return ANALYZER_NAME;
51
}
52
@@ -133,7 +133,7 @@
@Override
59
public AnalysisPhase getAnalysisPhase() {
- 60 1 return ANALYSIS_PHASE;
+ 60 2 return ANALYSIS_PHASE;
61
}
62
@@ -146,20 +146,20 @@
public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
66
- 67 2 if (getRules() == null || getRules().size() <= 0) {
- 68 2 return ;
+ 67 4 if (getRules() == null || getRules().size() <= 0) {
+ 68 0 return ;
69
}
70
- 71 0 for (final SuppressionRule rule : getRules()) {
- 72 0 rule.process(dependency);
- 73 0 }
- 74 0 }
+ 71 4 for (final SuppressionRule rule : getRules()) {
+ 72 4 rule.process(dependency);
+ 73 4 }
+ 74 4 }
75
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
index 4bded4797..cdcf43b93 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.exception.AnalysisException.html
@@ -151,6 +151,6 @@
} } 59
- 60 1 private static final Logger LOGGER = Logger.getLogger(CpeMemoryIndex.class .getName());
+ 60 2 private static final Logger LOGGER = Logger.getLogger(CpeMemoryIndex.class .getName());
61
62
63
- 64 1 private static CpeMemoryIndex instance = new CpeMemoryIndex();
+ 64 2 private static CpeMemoryIndex instance = new CpeMemoryIndex();
65
66
@@ -169,7 +169,7 @@
77
public static CpeMemoryIndex getInstance() {
- 78 2 return instance;
+ 78 4 return instance;
79
}
80
@@ -244,22 +244,22 @@
115
public void open(CveDB cve) throws IndexException {
- 116 2 if (!openState) {
- 117 1 index = new RAMDirectory();
- 118 1 buildIndex(cve);
+ 116 4 if (!openState) {
+ 117 2 index = new RAMDirectory();
+ 118 2 buildIndex(cve);
119
try {
- 120 1 indexReader = DirectoryReader.open(index);
+ 120 2 indexReader = DirectoryReader.open(index);
121 0 } catch (IOException ex) {
122 0 throw new IndexException(ex);
- 123 1 }
- 124 1 indexSearcher = new IndexSearcher(indexReader);
- 125 1 searchingAnalyzer = createSearchingAnalyzer();
- 126 1 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
- 127 1 openState = true ;
+ 123 2 }
+ 124 2 indexSearcher = new IndexSearcher(indexReader);
+ 125 2 searchingAnalyzer = createSearchingAnalyzer();
+ 126 2 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
+ 127 2 openState = true ;
128
}
- 129 2 }
+ 129 4 }
130
131
@@ -302,9 +302,9 @@
@SuppressWarnings("unchecked" )
150
private Analyzer createIndexingAnalyzer() {
- 151 1 final Map fieldAnalyzers = new HashMap();
- 152 1 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
- 153 1 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
+ 151 2 final Map fieldAnalyzers = new HashMap();
+ 152 2 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
+ 153 2 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
154
}
155
@@ -323,15 +323,15 @@
@SuppressWarnings("unchecked" )
162
private Analyzer createSearchingAnalyzer() {
- 163 1 final Map fieldAnalyzers = new HashMap();
- 164 1 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
- 165 1 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
- 166 1 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
- 167 1 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
- 168 1 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
+ 163 2 final Map fieldAnalyzers = new HashMap();
+ 164 2 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
+ 165 2 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
+ 166 2 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
+ 167 2 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
+ 168 2 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
169
- 170 1 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
+ 170 2 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
171
}
172
@@ -356,13 +356,13 @@
182
public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException {
- 183 21494 final Document doc = new Document();
- 184 21494 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
- 185 21494 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
- 186 21494 doc.add(v);
- 187 21494 doc.add(p);
- 188 21494 indexWriter.addDocument(doc);
- 189 21494 }
+ 183 44272 final Document doc = new Document();
+ 184 44272 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
+ 185 44272 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
+ 186 44272 doc.add(v);
+ 187 44272 doc.add(p);
+ 188 44272 indexWriter.addDocument(doc);
+ 189 44272 }
190
191
@@ -373,30 +373,30 @@
194
public void close() {
- 195 1 if (searchingAnalyzer != null ) {
- 196 1 searchingAnalyzer.close();
- 197 1 searchingAnalyzer = null ;
+ 195 2 if (searchingAnalyzer != null ) {
+ 196 2 searchingAnalyzer.close();
+ 197 2 searchingAnalyzer = null ;
198
}
- 199 1 if (indexReader != null ) {
+ 199 2 if (indexReader != null ) {
200
try {
- 201 1 indexReader.close();
+ 201 2 indexReader.close();
202 0 } catch (IOException ex) {
203 0 LOGGER.log(Level.FINEST, null , ex);
- 204 1 }
- 205 1 indexReader = null ;
+ 204 2 }
+ 205 2 indexReader = null ;
206
}
- 207 1 queryParser = null ;
- 208 1 indexSearcher = null ;
- 209 1 if (index != null ) {
- 210 1 index.close();
- 211 1 index = null ;
+ 207 2 queryParser = null ;
+ 208 2 indexSearcher = null ;
+ 209 2 if (index != null ) {
+ 210 2 index.close();
+ 211 2 index = null ;
212
}
- 213 1 openState = false ;
- 214 1 }
+ 213 2 openState = false ;
+ 214 2 }
215
216
@@ -413,53 +413,53 @@
222
private void buildIndex(CveDB cve) throws IndexException {
- 223 1 Analyzer analyzer = null ;
- 224 1 IndexWriter indexWriter = null ;
+ 223 2 Analyzer analyzer = null ;
+ 224 2 IndexWriter indexWriter = null ;
225
try {
- 226 1 analyzer = createIndexingAnalyzer();
- 227 1 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
- 228 1 indexWriter = new IndexWriter(index, conf);
+ 226 2 analyzer = createIndexingAnalyzer();
+ 227 2 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
+ 228 2 indexWriter = new IndexWriter(index, conf);
229
try {
- 230 1 final Set<Pair<String, String>> data = cve.getVendorProductList();
- 231 1 for (Pair<String, String> pair : data) {
- 232 21494 saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
- 233 21494 }
+ 230 2 final Set<Pair<String, String>> data = cve.getVendorProductList();
+ 231 2 for (Pair<String, String> pair : data) {
+ 232 44272 saveEntry(pair.getLeft(), pair.getRight(), indexWriter);
+ 233 44272 }
234 0 } catch (DatabaseException ex) {
235 0 LOGGER.log(Level.FINE, null , ex);
236 0 throw new IndexException("Error reading CPE data" , ex);
- 237 1 }
+ 237 2 }
238 0 } catch (CorruptIndexException ex) {
239 0 throw new IndexException("Unable to close an in-memory index" , ex);
240 0 } catch (IOException ex) {
241 0 throw new IndexException("Unable to close an in-memory index" , ex);
242
} finally {
- 243 1 if (indexWriter != null ) {
+ 243 2 if (indexWriter != null ) {
244
try {
245
try {
- 246 1 indexWriter.commit();
+ 246 2 indexWriter.commit();
247
} finally {
- 248 1 indexWriter.close(true );
- 249 1 }
+ 248 2 indexWriter.close(true );
+ 249 2 }
250 0 } catch (CorruptIndexException ex) {
251 0 throw new IndexException("Unable to close an in-memory index" , ex);
252 0 } catch (IOException ex) {
253 0 throw new IndexException("Unable to close an in-memory index" , ex);
- 254 1 }
- 255 1 if (analyzer != null ) {
- 256 1 analyzer.close();
+ 254 2 }
+ 255 2 if (analyzer != null ) {
+ 256 2 analyzer.close();
257
}
258
}
259
}
- 260 1 }
+ 260 2 }
261
262
@@ -501,12 +501,12 @@
283
public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException {
- 284 8 if (searchString == null || searchString.trim().isEmpty()) {
+ 284 16 if (searchString == null || searchString.trim().isEmpty()) {
285 0 throw new ParseException("Query is null or empty" );
286
}
- 287 8 final Query query = queryParser.parse(searchString);
- 288 8 return indexSearcher.search(query, maxQueryResults);
+ 287 16 final Query query = queryParser.parse(searchString);
+ 288 16 return indexSearcher.search(query, maxQueryResults);
289
}
290
@@ -553,7 +553,7 @@
312
public Document getDocument(int documentId) throws IOException {
- 313 54 return indexSearcher.doc(documentId);
+ 313 108 return indexSearcher.doc(documentId);
314
}
315
@@ -570,17 +570,17 @@
321
public int numDocs() {
- 322 1 if (indexReader == null ) {
+ 322 2 if (indexReader == null ) {
323 0 return -1;
324
}
- 325 1 return indexReader.numDocs();
+ 325 2 return indexReader.numDocs();
326
}
327
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
index 5c79f48f5..435dafe90 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html
@@ -103,6 +103,6 @@
} 144
public void parseName(String cpeName) throws UnsupportedEncodingException {
- 145 1 if (cpeName != null && cpeName.length() > 7) {
- 146 1 final String[] data = cpeName.substring(7).split(":" );
- 147 1 if (data.length >= 1) {
- 148 1 vendor = URLDecoder.decode(data[0].replace("+" , "%2B" ), "UTF-8" );
- 149 1 if (data.length >= 2) {
- 150 1 product = URLDecoder.decode(data[1].replace("+" , "%2B" ), "UTF-8" );
+ 145 2 if (cpeName != null && cpeName.length() > 7) {
+ 146 2 final String[] data = cpeName.substring(7).split(":" );
+ 147 2 if (data.length >= 1) {
+ 148 2 vendor = URLDecoder.decode(data[0].replace("+" , "%2B" ), "UTF-8" );
+ 149 2 if (data.length >= 2) {
+ 150 2 product = URLDecoder.decode(data[1].replace("+" , "%2B" ), "UTF-8" );
151
}
152
}
153
}
- 154 1 }
+ 154 2 }
155
156
@@ -332,21 +332,21 @@
@Override
164
public boolean equals(Object obj) {
- 165 336 if (obj == null ) {
+ 165 672 if (obj == null ) {
166 0 return false ;
167
}
- 168 336 if (getClass() != obj.getClass()) {
+ 168 672 if (getClass() != obj.getClass()) {
169 0 return false ;
170
}
- 171 336 final IndexEntry other = (IndexEntry) obj;
- 172 336 if ((this .vendor == null ) ? (other.vendor != null ) : !this .vendor.equals(other.vendor)) {
- 173 279 return false ;
+ 171 672 final IndexEntry other = (IndexEntry) obj;
+ 172 672 if ((this .vendor == null ) ? (other.vendor != null ) : !this .vendor.equals(other.vendor)) {
+ 173 558 return false ;
174
}
- 175 57 if ((this .product == null ) ? (other.product != null ) : !this .product.equals(other.product)) {
- 176 57 return false ;
+ 175 114 if ((this .product == null ) ? (other.product != null ) : !this .product.equals(other.product)) {
+ 176 114 return false ;
177
}
178 0 return true ;
@@ -375,6 +375,6 @@
} } 34
- 35 1 private static final Logger LOGGER = Logger.getLogger(CweDB.class .getName());
+ 35 2 private static final Logger LOGGER = Logger.getLogger(CweDB.class .getName());
36
37
@@ -104,7 +104,7 @@
44
- 45 1 private static final HashMap<String, String> CWE = loadData();
+ 45 2 private static final HashMap<String, String> CWE = loadData();
46
47
@@ -119,13 +119,13 @@
52
private static HashMap<String, String> loadData() {
- 53 1 ObjectInputStream oin = null ;
+ 53 2 ObjectInputStream oin = null ;
54
try {
- 55 1 final String filePath = "data/cwe.hashmap.serialized" ;
- 56 1 final InputStream input = CweDB.class .getClassLoader().getResourceAsStream(filePath);
- 57 1 oin = new ObjectInputStream(input);
- 58 1 return (HashMap<String, String>) oin.readObject();
+ 55 2 final String filePath = "data/cwe.hashmap.serialized" ;
+ 56 2 final InputStream input = CweDB.class .getClassLoader().getResourceAsStream(filePath);
+ 57 2 oin = new ObjectInputStream(input);
+ 58 2 return (HashMap<String, String>) oin.readObject();
59 0 } catch (ClassNotFoundException ex) {
60 0 LOGGER.log(Level.WARNING, "Unable to load CWE data. This should not be an issue." );
61 0 LOGGER.log(Level.FINE, null , ex);
@@ -134,13 +134,13 @@
64 0 LOGGER.log(Level.FINE, null , ex);
65
} finally {
- 66 1 if (oin != null ) {
+ 66 2 if (oin != null ) {
67
try {
- 68 1 oin.close();
+ 68 2 oin.close();
69 0 } catch (IOException ex) {
70 0 LOGGER.log(Level.FINEST, null , ex);
- 71 2 }
+ 71 4 }
72
}
73
@@ -166,8 +166,8 @@
84
public static String getCweName(String cweId) {
- 85 4 if (cweId != null ) {
- 86 4 return CWE.get(cweId);
+ 85 18 if (cweId != null ) {
+ 86 18 return CWE.get(cweId);
87
}
88 0 return null ;
@@ -177,6 +177,6 @@
} } 34
- 35 11 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
+ 35 17 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
36
37
@@ -144,9 +144,9 @@
64
public AbstractTokenizingFilter(TokenStream stream) {
- 65 11 super (stream);
- 66 11 tokens = new LinkedList<String>();
- 67 11 }
+ 65 17 super (stream);
+ 66 17 tokens = new LinkedList<String>();
+ 67 17 }
68
69
@@ -161,20 +161,20 @@
74
protected boolean addTerm() {
- 75 32759 final boolean termAdded = tokens.size() > 0;
- 76 32777 if (termAdded) {
- 77 21691 final String term = tokens.pop();
- 78 21690 clearAttributes();
- 79 21690 termAtt.append(term);
+ 75 34893 final boolean termAdded = tokens.size() > 0;
+ 76 34890 if (termAdded) {
+ 77 22715 final String term = tokens.pop();
+ 78 22718 clearAttributes();
+ 79 22717 termAtt.append(term);
80
}
- 81 32766 return termAdded;
+ 81 34894 return termAdded;
82
}
83
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
index 7dec0b2e7..e367f8eb4 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html
@@ -135,13 +135,13 @@
@Override 59
protected boolean isTokenChar(int c) {
- 60 501912 return Character.isLetter(c) || Character.isDigit(c);
+ 60 1036730 return Character.isLetter(c) || Character.isDigit(c);
61
}
62
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
index 2f3238297..6536f562c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html
@@ -112,6 +112,6 @@
} @Override 61
protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
- 62 3 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
+ 62 6 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
63
- 64 3 TokenStream stream = source;
+ 64 6 TokenStream stream = source;
65
- 66 3 stream = new WordDelimiterFilter(stream,
+ 66 6 stream = new WordDelimiterFilter(stream,
67
WordDelimiterFilter.CATENATE_WORDS
68
@@ -162,17 +162,17 @@
| WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null );
74
- 75 3 stream = new LowerCaseFilter(version, stream);
- 76 3 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
+ 75 6 stream = new LowerCaseFilter(version, stream);
+ 76 6 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
77
- 78 3 return new TokenStreamComponents(source, stream);
+ 78 6 return new TokenStreamComponents(source, stream);
79
}
80
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
index a93b156ac..519fb8155 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html
@@ -83,7 +83,7 @@
33
- 34 1 public static final Version CURRENT_VERSION = Version.LUCENE_45;
+ 34 2 public static final Version CURRENT_VERSION = Version.LUCENE_45;
35
36
@@ -124,15 +124,15 @@
final CharSequence text) {
54
- 55 227 if (text == null || buf == null ) {
- 56 1 return ;
+ 55 454 if (text == null || buf == null ) {
+ 56 2 return ;
57
}
58
- 59 2333 for (int i = 0; i < text.length(); i++) {
- 60 2107 final char c = text.charAt(i);
- 61 2107 switch (c) {
+ 59 4666 for (int i = 0; i < text.length(); i++) {
+ 60 4214 final char c = text.charAt(i);
+ 61 4214 switch (c) {
62
case '+' :
63
@@ -169,17 +169,17 @@
case ':' :
79
case '\\' :
- 80 72 buf.append('\\' );
+ 80 144 buf.append('\\' );
81
default :
- 82 2107 buf.append(c);
+ 82 4214 buf.append(c);
83
break ;
84
}
85
}
- 86 226 }
+ 86 452 }
87
88
@@ -198,27 +198,27 @@
public static String escapeLuceneQuery(final CharSequence text) {
95
- 96 226 if (text == null ) {
- 97 1 return null ;
+ 96 452 if (text == null ) {
+ 97 2 return null ;
98
}
99
- 100 225 int size = text.length();
- 101 225 size = size >> 1;
- 102 225 final StringBuilder buf = new StringBuilder(size);
+ 100 450 int size = text.length();
+ 101 450 size = size >> 1;
+ 102 450 final StringBuilder buf = new StringBuilder(size);
103
- 104 225 appendEscapedLuceneQuery(buf, text);
+ 104 450 appendEscapedLuceneQuery(buf, text);
105
- 106 225 return buf.toString();
+ 106 450 return buf.toString();
107
}
108
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
index f30d01650..617256693 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html
@@ -145,13 +145,13 @@
@Override 64
protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
- 65 4 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
+ 65 8 final Tokenizer source = new AlphaNumericTokenizer(version, reader);
66
- 67 4 TokenStream stream = source;
+ 67 8 TokenStream stream = source;
68
- 69 4 stream = new WordDelimiterFilter(stream,
+ 69 8 stream = new WordDelimiterFilter(stream,
70
WordDelimiterFilter.GENERATE_WORD_PARTS
71
@@ -166,14 +166,14 @@
| WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null );
76
- 77 4 stream = new LowerCaseFilter(version, stream);
- 78 4 stream = new UrlTokenizingFilter(stream);
- 79 4 concatenatingFilter = new TokenPairConcatenatingFilter(stream);
- 80 4 stream = concatenatingFilter;
- 81 4 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
+ 77 8 stream = new LowerCaseFilter(version, stream);
+ 78 8 stream = new UrlTokenizingFilter(stream);
+ 79 8 concatenatingFilter = new TokenPairConcatenatingFilter(stream);
+ 80 8 stream = concatenatingFilter;
+ 81 8 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
82
- 83 4 return new TokenStreamComponents(source, stream);
+ 83 8 return new TokenStreamComponents(source, stream);
84
}
85
@@ -194,15 +194,15 @@
93
public void clear() {
- 94 2 if (concatenatingFilter != null ) {
- 95 2 concatenatingFilter.clear();
+ 94 4 if (concatenatingFilter != null ) {
+ 95 4 concatenatingFilter.clear();
96
}
- 97 2 }
+ 97 4 }
98
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html
index 9ba309179..bfe4881d3 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html
@@ -158,6 +158,6 @@
} 38
- 39 6 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
+ 39 12 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class );
40
41
@@ -160,9 +160,9 @@
72
public TokenPairConcatenatingFilter(TokenStream stream) {
- 73 6 super (stream);
- 74 6 words = new LinkedList<String>();
- 75 6 }
+ 73 12 super (stream);
+ 74 12 words = new LinkedList<String>();
+ 75 12 }
76
77
@@ -187,35 +187,35 @@
87
- 88 1540 while (input.incrementToken()) {
- 89 439 final String word = new String(termAtt.buffer(), 0, termAtt.length());
- 90 439 words.add(word);
- 91 439 }
+ 88 3080 while (input.incrementToken()) {
+ 89 878 final String word = new String(termAtt.buffer(), 0, termAtt.length());
+ 90 878 words.add(word);
+ 91 878 }
92
93
94
- 95 1101 if (previousWord != null && words.size() > 0) {
- 96 431 final String word = words.getFirst();
- 97 431 clearAttributes();
- 98 431 termAtt.append(previousWord).append(word);
- 99 431 previousWord = null ;
- 100 431 return true ;
+ 95 2202 if (previousWord != null && words.size() > 0) {
+ 96 862 final String word = words.getFirst();
+ 97 862 clearAttributes();
+ 98 862 termAtt.append(previousWord).append(word);
+ 99 862 previousWord = null ;
+ 100 862 return true ;
101
}
102
- 103 670 if (words.size() > 0) {
- 104 439 final String word = words.removeFirst();
- 105 439 clearAttributes();
- 106 439 termAtt.append(word);
- 107 439 previousWord = word;
- 108 439 return true ;
+ 103 1340 if (words.size() > 0) {
+ 104 878 final String word = words.removeFirst();
+ 105 878 clearAttributes();
+ 106 878 termAtt.append(word);
+ 107 878 previousWord = word;
+ 108 878 return true ;
109
}
- 110 231 return false ;
+ 110 462 return false ;
111
}
112
@@ -236,13 +236,13 @@
120
public void clear() {
- 121 3 previousWord = null ;
- 122 3 words.clear();
- 123 3 }
+ 121 6 previousWord = null ;
+ 122 6 words.clear();
+ 123 6 }
124
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
index 4718e3fa9..944378bbb 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html
@@ -99,7 +99,7 @@
41
- 42 1 private static final Logger LOGGER = Logger.getLogger(UrlTokenizingFilter.class .getName());
+ 42 2 private static final Logger LOGGER = Logger.getLogger(UrlTokenizingFilter.class .getName());
43
44
@@ -136,22 +136,22 @@
@Override
60
public boolean incrementToken() throws IOException {
- 61 31383 final LinkedList<String> tokens = getTokens();
- 62 32815 final CharTermAttribute termAtt = getTermAtt();
- 63 32812 if (tokens.size() == 0 && input.incrementToken()) {
- 64 21697 final String text = new String(termAtt.buffer(), 0, termAtt.length());
- 65 21687 if (UrlStringUtils.containsUrl(text)) {
- 66 2 final String[] parts = text.split("\\s" );
- 67 4 for (String part : parts) {
- 68 2 if (UrlStringUtils.isUrl(part)) {
+ 61 34967 final LinkedList<String> tokens = getTokens();
+ 62 34971 final CharTermAttribute termAtt = getTermAtt();
+ 63 34973 if (tokens.size() == 0 && input.incrementToken()) {
+ 64 22705 final String text = new String(termAtt.buffer(), 0, termAtt.length());
+ 65 22705 if (UrlStringUtils.containsUrl(text)) {
+ 66 4 final String[] parts = text.split("\\s" );
+ 67 8 for (String part : parts) {
+ 68 4 if (UrlStringUtils.isUrl(part)) {
69
try {
- 70 2 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
- 71 2 tokens.addAll(data);
+ 70 4 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
+ 71 4 tokens.addAll(data);
72 0 } catch (MalformedURLException ex) {
73 0 LOGGER.log(Level.FINE, "error parsing " + part, ex);
74 0 tokens.add(part);
- 75 2 }
+ 75 4 }
76
} else {
77 0 tokens.add(part);
@@ -159,19 +159,19 @@
} 79
}
- 80 2 } else {
- 81 21680 tokens.add(text);
+ 80 4 } else {
+ 81 22707 tokens.add(text);
82
}
83
}
- 84 32732 return addTerm();
+ 84 34887 return addTerm();
85
}
86
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html
index 81b105e1e..161e5739c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html
@@ -157,6 +157,6 @@
} } 73
- 74 1 public MavenArtifact(String groupId, String artifactId, String version, String url) {
- 75 1 setGroupId(groupId);
- 76 1 setArtifactId(artifactId);
- 77 1 setVersion(version);
- 78 1 setArtifactUrl(url);
- 79 1 }
+ 74 2 public MavenArtifact(String groupId, String artifactId, String version, String url) {
+ 75 2 setGroupId(groupId);
+ 76 2 setArtifactId(artifactId);
+ 77 2 setVersion(version);
+ 78 2 setArtifactUrl(url);
+ 79 2 }
80
81
@@ -335,6 +335,6 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
index 2a609a514..57d0ed938 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html
@@ -125,7 +125,7 @@
54
- 55 1 private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
+ 55 2 private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
56
.getName());
57
@@ -142,25 +142,25 @@
63
- 64 4 public NexusSearch(URL rootURL) {
- 65 4 this .rootURL = rootURL;
+ 64 8 public NexusSearch(URL rootURL) {
+ 65 8 this .rootURL = rootURL;
66
try {
- 67 4 if (null != Settings.getString(Settings.KEYS.PROXY_URL)
+ 67 8 if (null != Settings.getString(Settings.KEYS.PROXY_SERVER)
68
&& Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) {
69 0 useProxy = true ;
70 0 LOGGER.fine("Using proxy" );
71
} else {
- 72 4 useProxy = false ;
- 73 4 LOGGER.fine("Not using proxy" );
+ 72 8 useProxy = false ;
+ 73 8 LOGGER.fine("Not using proxy" );
74
}
75 0 } catch (InvalidSettingException ise) {
76 0 useProxy = false ;
- 77 4 }
- 78 4 }
+ 77 8 }
+ 78 8 }
79
80
@@ -183,18 +183,18 @@
89
public MavenArtifact searchSha1(String sha1) throws IOException {
- 90 4 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$" )) {
- 91 2 throw new IllegalArgumentException("Invalid SHA1 format" );
+ 90 8 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$" )) {
+ 91 4 throw new IllegalArgumentException("Invalid SHA1 format" );
92
}
93
- 94 2 final URL url = new URL(rootURL, String.format("identify/sha1/%s" ,
+ 94 4 final URL url = new URL(rootURL, String.format("identify/sha1/%s" ,
95
sha1.toLowerCase()));
96
- 97 2 LOGGER.fine(String.format("Searching Nexus url %s" , url.toString()));
+ 97 4 LOGGER.fine(String.format("Searching Nexus url %s" , url.toString()));
98
99
@@ -207,55 +207,55 @@
103
- 104 2 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
+ 104 4 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
105
- 106 2 conn.setDoOutput(true );
+ 106 4 conn.setDoOutput(true );
107
108
109
- 110 2 conn.addRequestProperty("Accept" , "application/xml" );
- 111 2 conn.connect();
+ 110 4 conn.addRequestProperty("Accept" , "application/xml" );
+ 111 4 conn.connect();
112
- 113 2 if (conn.getResponseCode() == 200) {
+ 113 4 if (conn.getResponseCode() == 200) {
114
try {
- 115 1 final DocumentBuilder builder = DocumentBuilderFactory
+ 115 2 final DocumentBuilder builder = DocumentBuilderFactory
116
.newInstance().newDocumentBuilder();
- 117 1 final Document doc = builder.parse(conn.getInputStream());
- 118 1 final XPath xpath = XPathFactory.newInstance().newXPath();
- 119 1 final String groupId = xpath
+ 117 2 final Document doc = builder.parse(conn.getInputStream());
+ 118 2 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 119 2 final String groupId = xpath
120
.evaluate(
121
"/org.sonatype.nexus.rest.model.NexusArtifact/groupId" ,
122
doc);
- 123 1 final String artifactId = xpath.evaluate(
+ 123 2 final String artifactId = xpath.evaluate(
124
"/org.sonatype.nexus.rest.model.NexusArtifact/artifactId" ,
125
doc);
- 126 1 final String version = xpath
+ 126 2 final String version = xpath
127
.evaluate(
128
"/org.sonatype.nexus.rest.model.NexusArtifact/version" ,
129
doc);
- 130 1 final String link = xpath
+ 130 2 final String link = xpath
131
.evaluate(
132
"/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink" ,
133
doc);
- 134 1 return new MavenArtifact(groupId, artifactId, version, link);
+ 134 2 return new MavenArtifact(groupId, artifactId, version, link);
135 0 } catch (Throwable e) {
136
@@ -264,8 +264,8 @@
138 0 throw new IOException(e.getMessage(), e);
139
}
- 140 1 } else if (conn.getResponseCode() == 404) {
- 141 1 throw new FileNotFoundException("Artifact not found in Nexus" );
+ 140 2 } else if (conn.getResponseCode() == 404) {
+ 141 2 throw new FileNotFoundException("Artifact not found in Nexus" );
142
} else {
143 0 final String msg = String.format("Could not connect to Nexus received response code: %d %s" ,
@@ -293,27 +293,27 @@
public boolean preflightRequest() { 156
try {
- 157 4 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status" ), useProxy);
- 158 4 conn.addRequestProperty("Accept" , "application/xml" );
- 159 4 conn.connect();
- 160 4 if (conn.getResponseCode() != 200) {
+ 157 8 final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status" ), useProxy);
+ 158 8 conn.addRequestProperty("Accept" , "application/xml" );
+ 159 8 conn.connect();
+ 160 8 if (conn.getResponseCode() != 200) {
161 0 LOGGER.log(Level.WARNING, "Expected 200 result from Nexus, got {0}" , conn.getResponseCode());
162 0 return false ;
163
}
- 164 4 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
- 165 4 final Document doc = builder.parse(conn.getInputStream());
- 166 4 if (!"status" .equals(doc.getDocumentElement().getNodeName())) {
+ 164 8 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ 165 8 final Document doc = builder.parse(conn.getInputStream());
+ 166 8 if (!"status" .equals(doc.getDocumentElement().getNodeName())) {
167 0 LOGGER.log(Level.WARNING, "Expected root node name of status, got {0}" , doc.getDocumentElement().getNodeName());
168 0 return false ;
169
}
170 0 } catch (Throwable e) {
171 0 return false ;
- 172 4 }
+ 172 8 }
173
- 174 4 return true ;
+ 174 8 return true ;
175
}
176
@@ -324,6 +324,6 @@
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
index 5ecfbdf7c..bd3908378 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nuget.NugetPackage.html
@@ -377,6 +377,6 @@
} } } 41
private String getOrNull(Node n) {
- 42 3 if (n != null ) {
- 43 3 return n.getTextContent();
+ 42 6 if (n != null ) {
+ 43 6 return n.getTextContent();
44
} else {
45 0 return null ;
@@ -130,32 +130,32 @@
public NugetPackage parse(InputStream stream) throws NuspecParseException { 58
try {
- 59 3 final Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream);
- 60 2 final XPath xpath = XPathFactory.newInstance().newXPath();
- 61 2 final NugetPackage nuspec = new NugetPackage();
+ 59 6 final Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream);
+ 60 4 final XPath xpath = XPathFactory.newInstance().newXPath();
+ 61 4 final NugetPackage nuspec = new NugetPackage();
62
- 63 2 if (xpath.evaluate("/package/metadata/id" , d, XPathConstants.NODE) == null
+ 63 4 if (xpath.evaluate("/package/metadata/id" , d, XPathConstants.NODE) == null
64
|| xpath.evaluate("/package/metadata/version" , d, XPathConstants.NODE) == null
65
|| xpath.evaluate("/package/metadata/authors" , d, XPathConstants.NODE) == null
66
|| xpath.evaluate("/package/metadata/description" , d, XPathConstants.NODE) == null ) {
- 67 1 throw new NuspecParseException("Invalid Nuspec format" );
+ 67 2 throw new NuspecParseException("Invalid Nuspec format" );
68
}
69
- 70 1 nuspec.setId(xpath.evaluate("/package/metadata/id" , d));
- 71 1 nuspec.setVersion(xpath.evaluate("/package/metadata/version" , d));
- 72 1 nuspec.setAuthors(xpath.evaluate("/package/metadata/authors" , d));
- 73 1 nuspec.setOwners(getOrNull((Node) xpath.evaluate("/package/metadata/owners" , d, XPathConstants.NODE)));
- 74 1 nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl" , d, XPathConstants.NODE)));
- 75 1 nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title" , d, XPathConstants.NODE)));
- 76 1 return nuspec;
- 77 2 } catch (Throwable e) {
- 78 2 throw new NuspecParseException("Unable to parse nuspec" , e);
+ 70 2 nuspec.setId(xpath.evaluate("/package/metadata/id" , d));
+ 71 2 nuspec.setVersion(xpath.evaluate("/package/metadata/version" , d));
+ 72 2 nuspec.setAuthors(xpath.evaluate("/package/metadata/authors" , d));
+ 73 2 nuspec.setOwners(getOrNull((Node) xpath.evaluate("/package/metadata/owners" , d, XPathConstants.NODE)));
+ 74 2 nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl" , d, XPathConstants.NODE)));
+ 75 2 nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title" , d, XPathConstants.NODE)));
+ 76 2 return nuspec;
+ 77 4 } catch (Throwable e) {
+ 78 4 throw new NuspecParseException("Unable to parse nuspec" , e);
79
}
80
@@ -164,6 +164,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
index 986399504..7695c96cb 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html
@@ -111,7 +111,7 @@
47
- 48 1 private static final Logger LOGGER = Logger.getLogger(ConnectionFactory.class .getName());
+ 48 2 private static final Logger LOGGER = Logger.getLogger(ConnectionFactory.class .getName());
49
50
@@ -134,28 +134,28 @@
59
- 60 1 private static Driver driver = null ;
+ 60 2 private static Driver driver = null ;
61
62
63
- 64 1 private static String connectionString = null ;
+ 64 2 private static String connectionString = null ;
65
66
67
- 68 1 private static String userName = null ;
+ 68 2 private static String userName = null ;
69
70
71
- 72 1 private static String password = null ;
+ 72 2 private static String password = null ;
73
74
@@ -186,68 +186,68 @@
public static synchronized void initialize() throws DatabaseException {
87
- 88 7 if (connectionString != null ) {
- 89 6 return ;
+ 88 14 if (connectionString != null ) {
+ 89 12 return ;
90
}
- 91 1 Connection conn = null ;
+ 91 2 Connection conn = null ;
92
try {
93
- 94 1 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "" );
- 95 1 if (!driverName.isEmpty()) {
- 96 1 LOGGER.log(Level.FINE, "Loading driver: {0}" , driverName);
- 97 1 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "" );
+ 94 2 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "" );
+ 95 2 if (!driverName.isEmpty()) {
+ 96 2 LOGGER.log(Level.FINE, "Loading driver: {0}" , driverName);
+ 97 2 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "" );
98
try {
- 99 1 if (!driverPath.isEmpty()) {
+ 99 2 if (!driverPath.isEmpty()) {
100 0 LOGGER.log(Level.FINE, "Loading driver from: {0}" , driverPath);
101 0 driver = DriverLoader.load(driverName, driverPath);
102
} else {
- 103 1 driver = DriverLoader.load(driverName);
+ 103 2 driver = DriverLoader.load(driverName);
104
}
105 0 } catch (DriverLoadException ex) {
106 0 LOGGER.log(Level.FINE, "Unable to load database driver" , ex);
107 0 throw new DatabaseException("Unable to load database driver" );
- 108 1 }
+ 108 2 }
109
}
- 110 1 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser" );
+ 110 2 userName = Settings.getString(Settings.KEYS.DB_USER, "dcuser" );
111
- 112 1 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!" );
+ 112 2 password = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!" );
113
try {
- 114 1 connectionString = getConnectionString();
+ 114 2 connectionString = getConnectionString();
115 0 } catch (IOException ex) {
116 0 LOGGER.log(Level.FINE,
117
"Unable to retrieve the database connection string" , ex);
118 0 throw new DatabaseException("Unable to retrieve the database connection string" );
- 119 1 }
- 120 1 boolean shouldCreateSchema = false ;
+ 119 2 }
+ 120 2 boolean shouldCreateSchema = false ;
121
try {
- 122 1 if (connectionString.startsWith("jdbc:h2:file:" )) {
- 123 1 shouldCreateSchema = !dbSchemaExists();
- 124 1 LOGGER.log(Level.FINE, "Need to create DB Structure: {0}" , shouldCreateSchema);
+ 122 2 if (connectionString.startsWith("jdbc:h2:file:" )) {
+ 123 2 shouldCreateSchema = !dbSchemaExists();
+ 124 2 LOGGER.log(Level.FINE, "Need to create DB Structure: {0}" , shouldCreateSchema);
125
}
126 0 } catch (IOException ioex) {
127 0 LOGGER.log(Level.FINE, "Unable to verify database exists" , ioex);
128 0 throw new DatabaseException("Unable to verify database exists" );
- 129 1 }
- 130 1 LOGGER.log(Level.FINE, "Loading database connection" );
- 131 1 LOGGER.log(Level.FINE, "Connection String: {0}" , connectionString);
- 132 1 LOGGER.log(Level.FINE, "Database User: {0}" , userName);
+ 129 2 }
+ 130 2 LOGGER.log(Level.FINE, "Loading database connection" );
+ 131 2 LOGGER.log(Level.FINE, "Connection String: {0}" , connectionString);
+ 132 2 LOGGER.log(Level.FINE, "Database User: {0}" , userName);
133
134
try {
- 135 1 conn = DriverManager.getConnection(connectionString, userName, password);
+ 135 2 conn = DriverManager.getConnection(connectionString, userName, password);
136 0 } catch (SQLException ex) {
137 0 if (ex.getMessage().contains("java.net.UnknownHostException" ) && connectionString.contains("AUTO_SERVER=TRUE;" )) {
138 0 connectionString = connectionString.replace("AUTO_SERVER=TRUE;" , "" );
@@ -268,10 +268,10 @@
150 0 throw new DatabaseException("Unable to connect to the database" );
151
}
- 152 1 }
+ 152 2 }
153
- 154 1 if (shouldCreateSchema) {
+ 154 2 if (shouldCreateSchema) {
155
try {
156 0 createTables(conn);
@@ -283,27 +283,27 @@
} else { 162
try {
- 163 1 ensureSchemaVersion(conn);
+ 163 2 ensureSchemaVersion(conn);
164 0 } catch (DatabaseException dex) {
165 0 LOGGER.log(Level.FINE, null , dex);
166 0 throw new DatabaseException("Database schema does not match this version of dependency-check" );
- 167 1 }
+ 167 2 }
168
}
169
} finally {
- 170 1 if (conn != null ) {
+ 170 2 if (conn != null ) {
171
try {
- 172 1 conn.close();
+ 172 2 conn.close();
173 0 } catch (SQLException ex) {
174 0 LOGGER.log(Level.FINE, "An error occurred closing the connection" , ex);
- 175 1 }
+ 175 2 }
176
}
177
}
- 178 1 }
+ 178 2 }
179
180
@@ -352,16 +352,16 @@
208
public static Connection getConnection() throws DatabaseException {
- 209 6 initialize();
- 210 6 Connection conn = null ;
+ 209 12 initialize();
+ 210 12 Connection conn = null ;
211
try {
- 212 6 conn = DriverManager.getConnection(connectionString, userName, password);
+ 212 12 conn = DriverManager.getConnection(connectionString, userName, password);
213 0 } catch (SQLException ex) {
214 0 LOGGER.log(Level.FINE, null , ex);
215 0 throw new DatabaseException("Unable to connect to the database" );
- 216 6 }
- 217 6 return conn;
+ 216 12 }
+ 217 12 return conn;
218
}
219
@@ -382,12 +382,12 @@
227
private static String getConnectionString() throws IOException {
- 228 1 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE" );
- 229 1 if (connStr.contains("%s" )) {
- 230 1 final String directory = getDataDirectory().getCanonicalPath();
- 231 1 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION);
- 232 1 LOGGER.log(Level.FINE, String.format("File path for H2 file: '%s'" , dataFile.toString()));
- 233 1 return String.format(connStr, dataFile.getAbsolutePath());
+ 228 2 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE" );
+ 229 2 if (connStr.contains("%s" )) {
+ 230 2 final String directory = getDataDirectory().getCanonicalPath();
+ 231 2 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION);
+ 232 2 LOGGER.log(Level.FINE, String.format("File path for H2 file: '%s'" , dataFile.toString()));
+ 233 2 return String.format(connStr, dataFile.getAbsolutePath());
234
}
235 0 return connStr;
@@ -411,15 +411,15 @@
245
public static File getDataDirectory() throws IOException {
- 246 2 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
- 247 2 if (!path.exists()) {
+ 246 4 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
+ 247 4 if (!path.exists()) {
248 0 if (!path.mkdirs()) {
249 0 throw new IOException("Unable to create NVD CVE Data directory" );
250
}
251
}
- 252 2 return path;
+ 252 4 return path;
253
}
254
@@ -438,10 +438,10 @@
261
private static boolean dbSchemaExists() throws IOException {
- 262 1 final File dir = getDataDirectory();
- 263 1 final String name = String.format("cve.%s.h2.db" , DB_SCHEMA_VERSION);
- 264 1 final File file = new File(dir, name);
- 265 1 return file.exists();
+ 262 2 final File dir = getDataDirectory();
+ 263 2 final String name = String.format("cve.%s.h2.db" , DB_SCHEMA_VERSION);
+ 264 2 final File file = new File(dir, name);
+ 265 2 return file.exists();
266
}
267
@@ -522,19 +522,19 @@
317
private static void ensureSchemaVersion(Connection conn) throws DatabaseException {
- 318 1 ResultSet rs = null ;
- 319 1 CallableStatement cs = null ;
+ 318 2 ResultSet rs = null ;
+ 319 2 CallableStatement cs = null ;
320
try {
- 321 1 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'" );
- 322 1 rs = cs.executeQuery();
- 323 1 if (rs.next()) {
- 324 1 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
- 325 1 if (isWrongSchema) {
+ 321 2 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'" );
+ 322 2 rs = cs.executeQuery();
+ 323 2 if (rs.next()) {
+ 324 2 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
+ 325 2 if (isWrongSchema) {
326 0 throw new DatabaseException("Incorrect database schema; unable to continue" );
327
}
- 328 1 } else {
+ 328 2 } else {
329 0 throw new DatabaseException("Database schema is missing" );
330
}
@@ -543,14 +543,14 @@
333 0 throw new DatabaseException("Unable to check the database schema version" );
334
} finally {
- 335 1 DBUtils.closeResultSet(rs);
- 336 1 DBUtils.closeStatement(cs);
- 337 1 }
- 338 1 }
+ 335 2 DBUtils.closeResultSet(rs);
+ 336 2 DBUtils.closeStatement(cs);
+ 337 2 }
+ 338 2 }
339
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
index 83f4c669f..8e491b1f2 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html
@@ -121,6 +121,6 @@
} } 41
- 42 1 private static final Logger LOGGER = Logger.getLogger(DatabaseProperties.class .getName());
+ 42 2 private static final Logger LOGGER = Logger.getLogger(DatabaseProperties.class .getName());
43
44
@@ -158,10 +158,10 @@
71
- 72 3 DatabaseProperties(CveDB cveDB) {
- 73 3 this .cveDB = cveDB;
- 74 3 loadProperties();
- 75 3 }
+ 72 6 DatabaseProperties(CveDB cveDB) {
+ 73 6 this .cveDB = cveDB;
+ 74 6 loadProperties();
+ 75 6 }
76
77
@@ -172,8 +172,8 @@
80
private void loadProperties() {
- 81 3 this .properties = cveDB.getProperties();
- 82 3 }
+ 81 6 this .properties = cveDB.getProperties();
+ 82 6 }
83
84
@@ -323,6 +323,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
index c5795115f..363170ece 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html
@@ -137,6 +137,6 @@
} 42
- 43 1 private static final Logger LOGGER = Logger.getLogger(DriverLoader.class .getName());
+ 43 2 private static final Logger LOGGER = Logger.getLogger(DriverLoader.class .getName());
44
45
@@ -133,8 +133,8 @@
58
public static Driver load(String className) throws DriverLoadException {
- 59 3 final ClassLoader loader = DriverLoader.class .getClassLoader();
- 60 3 return load(className, loader);
+ 59 6 final ClassLoader loader = DriverLoader.class .getClassLoader();
+ 60 6 return load(className, loader);
61
}
62
@@ -167,56 +167,56 @@
76
public static Driver load(String className, String pathToDriver) throws DriverLoadException {
- 77 4 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
- 78 4 final ArrayList<URL> urls = new ArrayList<URL>();
- 79 4 final String[] paths = pathToDriver.split(File.pathSeparator);
- 80 9 for (String path : paths) {
- 81 5 final File file = new File(path);
- 82 5 if (file.isDirectory()) {
- 83 2 final File[] files = file.listFiles();
+ 77 8 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
+ 78 8 final ArrayList<URL> urls = new ArrayList<URL>();
+ 79 8 final String[] paths = pathToDriver.split(File.pathSeparator);
+ 80 18 for (String path : paths) {
+ 81 10 final File file = new File(path);
+ 82 10 if (file.isDirectory()) {
+ 83 4 final File[] files = file.listFiles();
84
- 85 34 for (File f : files) {
+ 85 68 for (File f : files) {
86
try {
- 87 32 urls.add(f.toURI().toURL());
+ 87 64 urls.add(f.toURI().toURL());
88 0 } catch (MalformedURLException ex) {
89 0 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'" ,
90
className, f.getAbsoluteFile());
91 0 LOGGER.log(Level.FINE, msg, ex);
92 0 throw new DriverLoadException(msg, ex);
- 93 32 }
+ 93 64 }
94
}
- 95 2 } else if (file.exists()) {
+ 95 4 } else if (file.exists()) {
96
try {
- 97 2 urls.add(file.toURI().toURL());
+ 97 4 urls.add(file.toURI().toURL());
98 0 } catch (MalformedURLException ex) {
99 0 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'" ,
100
className, file.getAbsoluteFile());
101 0 LOGGER.log(Level.FINE, msg, ex);
102 0 throw new DriverLoadException(msg, ex);
- 103 2 }
+ 103 4 }
104
}
105
}
- 106 4 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
+ 106 8 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
107
@Override
108
public URLClassLoader run() {
- 109 4 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
+ 109 8 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
110
}
111
});
112
- 113 4 return load(className, loader);
+ 113 8 return load(className, loader);
114
}
115
@@ -241,19 +241,19 @@
private static Driver load(String className, ClassLoader loader) throws DriverLoadException {
125
try {
- 126 7 final Class c = Class.forName(className, true , loader);
+ 126 14 final Class c = Class.forName(className, true , loader);
127
- 128 4 final Driver driver = (Driver) c.newInstance();
- 129 4 final Driver shim = new DriverShim(driver);
+ 128 8 final Driver driver = (Driver) c.newInstance();
+ 129 8 final Driver shim = new DriverShim(driver);
130
- 131 4 DriverManager.registerDriver(shim);
- 132 4 return shim;
- 133 3 } catch (ClassNotFoundException ex) {
- 134 3 final String msg = String.format("Unable to load database driver '%s'" , className);
- 135 3 LOGGER.log(Level.FINE, msg, ex);
- 136 3 throw new DriverLoadException(msg, ex);
+ 131 8 DriverManager.registerDriver(shim);
+ 132 8 return shim;
+ 133 6 } catch (ClassNotFoundException ex) {
+ 134 6 final String msg = String.format("Unable to load database driver '%s'" , className);
+ 135 6 LOGGER.log(Level.FINE, msg, ex);
+ 136 6 throw new DriverLoadException(msg, ex);
137 0 } catch (InstantiationException ex) {
138 0 final String msg = String.format("Unable to load database driver '%s'" , className);
139 0 LOGGER.log(Level.FINE, msg, ex);
@@ -274,6 +274,6 @@
} 44
- 45 1 private static final Logger LOGGER = Logger.getLogger(DriverShim.class .getName());
+ 45 2 private static final Logger LOGGER = Logger.getLogger(DriverShim.class .getName());
46
47
@@ -156,7 +156,7 @@
@Override
70
public boolean acceptsURL(String url) throws SQLException {
- 71 2 return this .driver.acceptsURL(url);
+ 71 4 return this .driver.acceptsURL(url);
72
}
73
@@ -388,13 +388,13 @@
@Override
201
public String toString() {
- 202 7 return "DriverShim{" + "driver=" + driver + '}' ;
+ 202 14 return "DriverShim{" + "driver=" + driver + '}' ;
203
}
204
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
index ba4f025b9..af22cf90a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html
@@ -93,6 +93,6 @@
} } } 36
import org.owasp.dependencycheck.data.update.exception.UpdateException;
37
- import org.owasp.dependencycheck.data.update.task.CallableDownloadTask;
+ import org.owasp.dependencycheck.data.update.task.DownloadTask; 38
import org.owasp.dependencycheck.data.update.task.ProcessTask;
39
@@ -240,7 +240,7 @@
122 0 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
123 0 for (NvdCveInfo cve : updateable) {
124 0 if (cve.getNeedsUpdate()) {
- 125 0 final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB, Settings.getInstance());
+ 125 0 final DownloadTask call = new DownloadTask(cve, processExecutor, cveDB, Settings.getInstance());
126 0 downloadFutures.add(downloadExecutors.submit(call));
127
}
@@ -546,6 +546,6 @@
} } 34
- 35 12 public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
+ 35 24 public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
36
37
@@ -94,7 +94,7 @@
39
- 40 5 private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
+ 40 10 private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
41
42
@@ -127,13 +127,13 @@
56
public boolean isUpdateNeeded() {
- 57 3 for (NvdCveInfo item : this ) {
- 58 4 if (item.getNeedsUpdate()) {
- 59 1 return true ;
+ 57 6 for (NvdCveInfo item : this ) {
+ 58 8 if (item.getNeedsUpdate()) {
+ 59 2 return true ;
60
}
- 61 3 }
- 62 2 return false ;
+ 61 6 }
+ 62 4 return false ;
63
}
64
@@ -160,8 +160,8 @@
75
public void add(String id, String url, String oldUrl) throws MalformedURLException, DownloadFailedException {
- 76 1 add(id, url, oldUrl, false );
- 77 1 }
+ 76 2 add(id, url, oldUrl, false );
+ 77 2 }
78
79
@@ -188,14 +188,14 @@
90
public void add(String id, String url, String oldUrl, boolean needsUpdate) throws MalformedURLException, DownloadFailedException {
- 91 9 final NvdCveInfo item = new NvdCveInfo();
- 92 9 item.setNeedsUpdate(needsUpdate);
- 93 9 item.setId(id);
- 94 9 item.setUrl(url);
- 95 9 item.setOldSchemaVersionUrl(oldUrl);
- 96 9 item.setTimestamp(Downloader.getLastModified(new URL(url)));
- 97 9 collection.put(id, item);
- 98 9 }
+ 91 18 final NvdCveInfo item = new NvdCveInfo();
+ 92 18 item.setNeedsUpdate(needsUpdate);
+ 93 18 item.setId(id);
+ 94 18 item.setUrl(url);
+ 95 18 item.setOldSchemaVersionUrl(oldUrl);
+ 96 18 item.setTimestamp(Downloader.getLastModified(new URL(url)));
+ 97 18 collection.put(id, item);
+ 98 18 }
99
100
@@ -206,8 +206,8 @@
103
public void clear() {
- 104 1 collection.clear();
- 105 1 }
+ 104 2 collection.clear();
+ 105 2 }
106
107
@@ -233,7 +233,7 @@
118
- 119 5 private Iterator<Entry<String, NvdCveInfo>> iterableContent = null ;
+ 119 10 private Iterator<Entry<String, NvdCveInfo>> iterableContent = null ;
120
121
@@ -256,8 +256,8 @@
@Override
130
public Iterator<NvdCveInfo> iterator() {
- 131 4 iterableContent = collection.entrySet().iterator();
- 132 4 return this ;
+ 131 8 iterableContent = collection.entrySet().iterator();
+ 132 8 return this ;
133
}
134
@@ -282,7 +282,7 @@
@Override
144
public boolean hasNext() {
- 145 10 return iterableContent.hasNext();
+ 145 20 return iterableContent.hasNext();
146
}
147
@@ -307,7 +307,7 @@
@Override
157
public NvdCveInfo next() {
- 158 7 return iterableContent.next().getValue();
+ 158 14 return iterableContent.next().getValue();
159
}
160
@@ -328,8 +328,8 @@
@Override
168
public void remove() {
- 169 1 iterableContent.remove();
- 170 1 }
+ 169 2 iterableContent.remove();
+ 170 2 }
171
172
@@ -346,7 +346,7 @@
178
NvdCveInfo get(String key) {
- 179 2 return collection.get(key);
+ 179 4 return collection.get(key);
180
}
181
@@ -362,6 +362,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
index f08e061d9..f28fb3d0a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html
@@ -119,6 +119,6 @@
} } Coverage Report
+Coverage Report - org.owasp.dependencycheck.data.update.task.DownloadTask
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.data.update.task;
+ 19
+
+ 20
+ import java.io.File;
+ 21
+ import java.io.IOException;
+ 22
+ import java.net.URL;
+ 23
+ import java.util.concurrent.Callable;
+ 24
+ import java.util.concurrent.ExecutorService;
+ 25
+ import java.util.concurrent.Future;
+ 26
+ import java.util.logging.Level;
+ 27
+ import java.util.logging.Logger;
+ 28
+ import org.owasp.dependencycheck.data.nvdcve.CveDB;
+ 29
+ import org.owasp.dependencycheck.data.update.NvdCveInfo;
+ 30
+ import org.owasp.dependencycheck.data.update.exception.UpdateException;
+ 31
+ import org.owasp.dependencycheck.utils.DownloadFailedException;
+ 32
+ import org.owasp.dependencycheck.utils.Downloader;
+ 33
+ import org.owasp.dependencycheck.utils.Settings;
+ 34
+
+ 35
+
+ 36
+
+ 37
+
+ 38
+
+ 39
+
+ 40 0 public class DownloadTask implements Callable<Future<ProcessTask>> {
+ 41
+
+ 42
+
+ 43
+
+ 44
+
+ 45 0 private static final Logger LOGGER = Logger.getLogger(DownloadTask.class .getName());
+ 46
+
+ 47
+
+ 48
+
+ 49
+
+ 50
+
+ 51
+
+ 52
+
+ 53
+
+ 54
+
+ 55
+
+ 56
+
+ 57 0 public DownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB, Settings settings) throws UpdateException {
+ 58 0 this .nvdCveInfo = nvdCveInfo;
+ 59 0 this .processorService = processor;
+ 60 0 this .cveDB = cveDB;
+ 61 0 this .settings = settings;
+ 62
+
+ 63
+ final File file1;
+ 64
+ final File file2;
+ 65
+
+ 66
+ try {
+ 67 0 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_" , ".xml" , Settings.getTempDirectory());
+ 68 0 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_" , ".xml" , Settings.getTempDirectory());
+ 69 0 } catch (IOException ex) {
+ 70 0 throw new UpdateException("Unable to create temporary files" , ex);
+ 71 0 }
+ 72 0 this .first = file1;
+ 73 0 this .second = file2;
+ 74
+
+ 75 0 }
+ 76
+
+ 77
+
+ 78
+
+ 79
+ private CveDB cveDB;
+ 80
+
+ 81
+
+ 82
+
+ 83
+ private ExecutorService processorService;
+ 84
+
+ 85
+
+ 86
+
+ 87
+ private NvdCveInfo nvdCveInfo;
+ 88
+
+ 89
+
+ 90
+
+ 91
+ private Settings settings;
+ 92
+
+ 93
+
+ 94
+
+ 95
+
+ 96
+
+ 97
+
+ 98
+ public NvdCveInfo getNvdCveInfo() {
+ 99
+ return nvdCveInfo;
+ 100
+ }
+ 101
+
+ 102
+
+ 103
+
+ 104
+
+ 105
+
+ 106
+
+ 107
+ public void setNvdCveInfo(NvdCveInfo nvdCveInfo) {
+ 108
+ this .nvdCveInfo = nvdCveInfo;
+ 109
+ }
+ 110
+
+ 111
+
+ 112
+
+ 113
+ private File first;
+ 114
+
+ 115
+
+ 116
+
+ 117
+
+ 118
+
+ 119
+
+ 120
+ public File getFirst() {
+ 121
+ return first;
+ 122
+ }
+ 123
+
+ 124
+
+ 125
+
+ 126
+
+ 127
+
+ 128
+
+ 129
+ public void setFirst(File first) {
+ 130
+ this .first = first;
+ 131
+ }
+ 132
+
+ 133
+
+ 134
+
+ 135
+ private File second;
+ 136
+
+ 137
+
+ 138
+
+ 139
+
+ 140
+
+ 141
+
+ 142
+ public File getSecond() {
+ 143
+ return second;
+ 144
+ }
+ 145
+
+ 146
+
+ 147
+
+ 148
+
+ 149
+
+ 150
+
+ 151
+ public void setSecond(File second) {
+ 152
+ this .second = second;
+ 153
+ }
+ 154
+
+ 155
+
+ 156
+
+ 157 0 private Exception exception = null ;
+ 158
+
+ 159
+
+ 160
+
+ 161
+
+ 162
+
+ 163
+
+ 164
+ public Exception getException() {
+ 165
+ return exception;
+ 166
+ }
+ 167
+
+ 168
+
+ 169
+
+ 170
+
+ 171
+
+ 172
+
+ 173
+ public boolean hasException() {
+ 174 0 return exception != null ;
+ 175
+ }
+ 176
+
+ 177
+ @Override
+ 178
+ public Future<ProcessTask> call() throws Exception {
+ 179
+ try {
+ 180 0 Settings.setInstance(settings);
+ 181 0 final URL url1 = new URL(nvdCveInfo.getUrl());
+ 182 0 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl());
+ 183 0 String msg = String.format("Download Started for NVD CVE - %s" , nvdCveInfo.getId());
+ 184 0 LOGGER.log(Level.INFO, msg);
+ 185
+ try {
+ 186 0 Downloader.fetchFile(url1, first);
+ 187 0 Downloader.fetchFile(url2, second);
+ 188 0 } catch (DownloadFailedException ex) {
+ 189 0 msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported." , nvdCveInfo.getId());
+ 190 0 LOGGER.log(Level.WARNING, msg);
+ 191 0 LOGGER.log(Level.FINE, null , ex);
+ 192 0 return null ;
+ 193 0 }
+ 194
+
+ 195 0 msg = String.format("Download Complete for NVD CVE - %s" , nvdCveInfo.getId());
+ 196 0 LOGGER.log(Level.INFO, msg);
+ 197
+
+ 198 0 final ProcessTask task = new ProcessTask(cveDB, this , settings);
+ 199 0 return this .processorService.submit(task);
+ 200
+
+ 201 0 } catch (Throwable ex) {
+ 202 0 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported." , nvdCveInfo.getId());
+ 203 0 LOGGER.log(Level.WARNING, msg);
+ 204 0 LOGGER.log(Level.FINE, "Download Task Failed" , ex);
+ 205
+ } finally {
+ 206 0 Settings.cleanup(false );
+ 207 0 }
+ 208 0 return null ;
+ 209
+ }
+ 210
+
+ 211
+
+ 212
+
+ 213
+
+ 214
+ public void cleanup() {
+ 215 0 boolean deleted = false ;
+ 216
+ try {
+ 217 0 if (first != null && first.exists()) {
+ 218 0 deleted = first.delete();
+ 219
+ }
+ 220
+ } finally {
+ 221 0 if (first != null && (first.exists() || !deleted)) {
+ 222 0 first.deleteOnExit();
+ 223
+ }
+ 224
+ }
+ 225
+ try {
+ 226 0 deleted = false ;
+ 227 0 if (second != null && second.exists()) {
+ 228 0 deleted = second.delete();
+ 229
+ }
+ 230
+ } finally {
+ 231 0 if (second != null && (second.exists() || !deleted)) {
+ 232 0 second.deleteOnExit();
+ 233
+ }
+ 234
+ }
+ 235 0 }
+ 236
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html
index f01d6905e..2bc346792 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html
@@ -177,7 +177,7 @@
81
82
- private final CallableDownloadTask filePair;
+ private final DownloadTask filePair; 83
84
@@ -212,7 +212,7 @@
99
- 100 0 public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair, Settings settings) {
+ 100 0 public ProcessTask(final CveDB cveDB, final DownloadTask filePair, Settings settings) {
101 0 this .cveDB = cveDB;
102 0 this .filePair = filePair;
103 0 this .properties = cveDB.getDatabaseProperties();
@@ -343,6 +343,6 @@
} 36
- 37 1 public class NvdCve12Handler extends DefaultHandler {
+ 37 2 public class NvdCve12Handler extends DefaultHandler {
38
39
@@ -139,21 +139,21 @@
61
- 62 1 private boolean skip = false ;
+ 62 2 private boolean skip = false ;
63
64
65
- 66 1 private boolean hasPreviousVersion = false ;
+ 66 2 private boolean hasPreviousVersion = false ;
67
68
69
- 70 1 private final Element current = new Element();
+ 70 2 private final Element current = new Element();
71
72
@@ -186,33 +186,33 @@
@Override
86
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
- 87 1222 current.setNode(qName);
- 88 1222 if (current.isEntryNode()) {
- 89 27 vendor = null ;
- 90 27 product = null ;
- 91 27 hasPreviousVersion = false ;
- 92 27 final String reject = attributes.getValue("reject" );
- 93 27 skip = "1" .equals(reject);
- 94 27 if (!skip) {
- 95 26 vulnerability = attributes.getValue("name" );
- 96 26 software = new ArrayList<VulnerableSoftware>();
+ 87 2444 current.setNode(qName);
+ 88 2444 if (current.isEntryNode()) {
+ 89 54 vendor = null ;
+ 90 54 product = null ;
+ 91 54 hasPreviousVersion = false ;
+ 92 54 final String reject = attributes.getValue("reject" );
+ 93 54 skip = "1" .equals(reject);
+ 94 54 if (!skip) {
+ 95 52 vulnerability = attributes.getValue("name" );
+ 96 52 software = new ArrayList<VulnerableSoftware>();
97
} else {
- 98 1 vulnerability = null ;
- 99 1 software = null ;
+ 98 2 vulnerability = null ;
+ 99 2 software = null ;
100
}
- 101 27 } else if (!skip && current.isProdNode()) {
+ 101 54 } else if (!skip && current.isProdNode()) {
102
- 103 52 vendor = attributes.getValue("vendor" );
- 104 52 product = attributes.getValue("name" );
- 105 1143 } else if (!skip && current.isVersNode()) {
- 106 761 final String prev = attributes.getValue("prev" );
- 107 761 if (prev != null && "1" .equals(prev)) {
- 108 1 hasPreviousVersion = true ;
- 109 1 final String edition = attributes.getValue("edition" );
- 110 1 final String num = attributes.getValue("num" );
+ 103 104 vendor = attributes.getValue("vendor" );
+ 104 104 product = attributes.getValue("name" );
+ 105 2286 } else if (!skip && current.isVersNode()) {
+ 106 1522 final String prev = attributes.getValue("prev" );
+ 107 1522 if (prev != null && "1" .equals(prev)) {
+ 108 2 hasPreviousVersion = true ;
+ 109 2 final String edition = attributes.getValue("edition" );
+ 110 2 final String num = attributes.getValue("num" );
111
112
@@ -221,48 +221,48 @@
114
- 115 1 String cpe = "cpe:/a:" + vendor + ":" + product;
- 116 1 if (num != null ) {
- 117 1 cpe += ":" + num;
+ 115 2 String cpe = "cpe:/a:" + vendor + ":" + product;
+ 116 2 if (num != null ) {
+ 117 2 cpe += ":" + num;
118
}
- 119 1 if (edition != null ) {
+ 119 2 if (edition != null ) {
120 0 cpe += ":" + edition;
121
}
- 122 1 final VulnerableSoftware vs = new VulnerableSoftware();
- 123 1 vs.setCpe(cpe);
- 124 1 vs.setPreviousVersion(prev);
- 125 1 software.add(vs);
+ 122 2 final VulnerableSoftware vs = new VulnerableSoftware();
+ 123 2 vs.setCpe(cpe);
+ 124 2 vs.setPreviousVersion(prev);
+ 125 2 software.add(vs);
126
}
- 127 761 } else if (current.isNVDNode()) {
- 128 1 final String nvdVer = attributes.getValue("nvd_xml_version" );
- 129 1 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
+ 127 1522 } else if (current.isNVDNode()) {
+ 128 2 final String nvdVer = attributes.getValue("nvd_xml_version" );
+ 129 2 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
130 0 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported" );
131
}
- 132 1 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
+ 132 2 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
133
}
- 134 1222 }
+ 134 2444 }
135
136
@Override
137
public void endElement(String uri, String localName, String qName) throws SAXException {
- 138 1222 current.setNode(qName);
- 139 1222 if (current.isEntryNode()) {
- 140 27 if (!skip && hasPreviousVersion) {
- 141 1 vulnerabilities.put(vulnerability, software);
+ 138 2444 current.setNode(qName);
+ 139 2444 if (current.isEntryNode()) {
+ 140 54 if (!skip && hasPreviousVersion) {
+ 141 2 vulnerabilities.put(vulnerability, software);
142
}
- 143 27 vulnerability = null ;
- 144 27 software = null ;
+ 143 54 vulnerability = null ;
+ 144 54 software = null ;
145
}
- 146 1222 }
+ 146 2444 }
147
148
@@ -273,7 +273,7 @@
151
- 152 1 protected static class Element {
+ 152 2 protected static class Element {
153
154
@@ -374,7 +374,7 @@
202
public boolean isNVDNode() {
- 203 382 return NVD.equals(node);
+ 203 764 return NVD.equals(node);
204
}
205
@@ -391,7 +391,7 @@
211
public boolean isEntryNode() {
- 212 2444 return ENTRY.equals(node);
+ 212 4888 return ENTRY.equals(node);
213
}
214
@@ -425,7 +425,7 @@
229
public boolean isProdNode() {
- 230 1192 return PROD.equals(node);
+ 230 2384 return PROD.equals(node);
231
}
232
@@ -442,7 +442,7 @@
238
public boolean isVersNode() {
- 239 1140 return VERS.equals(node);
+ 239 2280 return VERS.equals(node);
240
}
241
@@ -453,6 +453,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html
index f138fd65a..e95c05a04 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html
@@ -98,7 +98,7 @@
40
- 41 1 public class NvdCve20Handler extends DefaultHandler {
+ 41 2 public class NvdCve20Handler extends DefaultHandler {
42
43
@@ -107,7 +107,7 @@
45
- 46 1 private static final Logger LOGGER = Logger.getLogger(NvdCve20Handler.class .getName());
+ 46 2 private static final Logger LOGGER = Logger.getLogger(NvdCve20Handler.class .getName());
47
48
@@ -122,7 +122,7 @@
53
- 54 1 private final Element current = new Element();
+ 54 2 private final Element current = new Element();
55
56
@@ -153,7 +153,7 @@
69
- 70 1 private boolean hasApplicationCpe = false ;
+ 70 2 private boolean hasApplicationCpe = false ;
71
72
@@ -212,144 +212,144 @@
@Override
99
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
- 100 2412 current.setNode(qName);
- 101 2412 if (current.isEntryNode()) {
- 102 27 hasApplicationCpe = false ;
- 103 27 vulnerability = new Vulnerability();
- 104 27 vulnerability.setName(attributes.getValue("id" ));
- 105 2385 } else if (current.isVulnProductNode()) {
- 106 727 nodeText = new StringBuilder(100);
- 107 1658 } else if (current.isVulnReferencesNode()) {
- 108 90 final String lang = attributes.getValue("xml:lang" );
- 109 90 if ("en" .equals(lang)) {
- 110 90 reference = new Reference();
+ 100 4824 current.setNode(qName);
+ 101 4824 if (current.isEntryNode()) {
+ 102 54 hasApplicationCpe = false ;
+ 103 54 vulnerability = new Vulnerability();
+ 104 54 vulnerability.setName(attributes.getValue("id" ));
+ 105 4770 } else if (current.isVulnProductNode()) {
+ 106 1454 nodeText = new StringBuilder(100);
+ 107 3316 } else if (current.isVulnReferencesNode()) {
+ 108 180 final String lang = attributes.getValue("xml:lang" );
+ 109 180 if ("en" .equals(lang)) {
+ 110 180 reference = new Reference();
111
} else {
112 0 reference = null ;
113
}
- 114 90 } else if (reference != null && current.isVulnReferenceNode()) {
- 115 90 reference.setUrl(attributes.getValue("href" ));
- 116 90 nodeText = new StringBuilder(130);
- 117 1478 } else if (reference != null && current.isVulnSourceNode()) {
- 118 90 nodeText = new StringBuilder(30);
- 119 1388 } else if (current.isVulnSummaryNode()) {
- 120 27 nodeText = new StringBuilder(500);
- 121 1361 } else if (current.isNVDNode()) {
- 122 1 final String nvdVer = attributes.getValue("nvd_xml_version" );
- 123 1 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
+ 114 180 } else if (reference != null && current.isVulnReferenceNode()) {
+ 115 180 reference.setUrl(attributes.getValue("href" ));
+ 116 180 nodeText = new StringBuilder(130);
+ 117 2956 } else if (reference != null && current.isVulnSourceNode()) {
+ 118 180 nodeText = new StringBuilder(30);
+ 119 2776 } else if (current.isVulnSummaryNode()) {
+ 120 54 nodeText = new StringBuilder(500);
+ 121 2722 } else if (current.isNVDNode()) {
+ 122 2 final String nvdVer = attributes.getValue("nvd_xml_version" );
+ 123 2 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
124 0 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported" );
125
}
- 126 1 } else if (current.isVulnCWENode()) {
- 127 19 vulnerability.setCwe(attributes.getValue("id" ));
- 128 1341 } else if (current.isCVSSScoreNode()) {
- 129 26 nodeText = new StringBuilder(5);
- 130 1315 } else if (current.isCVSSAccessVectorNode()) {
- 131 26 nodeText = new StringBuilder(20);
- 132 1289 } else if (current.isCVSSAccessComplexityNode()) {
- 133 26 nodeText = new StringBuilder(20);
- 134 1263 } else if (current.isCVSSAuthenticationNode()) {
- 135 26 nodeText = new StringBuilder(20);
- 136 1237 } else if (current.isCVSSAvailabilityImpactNode()) {
- 137 26 nodeText = new StringBuilder(20);
- 138 1211 } else if (current.isCVSSConfidentialityImpactNode()) {
- 139 26 nodeText = new StringBuilder(20);
- 140 1185 } else if (current.isCVSSIntegrityImpactNode()) {
- 141 26 nodeText = new StringBuilder(20);
+ 126 2 } else if (current.isVulnCWENode()) {
+ 127 38 vulnerability.setCwe(attributes.getValue("id" ));
+ 128 2682 } else if (current.isCVSSScoreNode()) {
+ 129 52 nodeText = new StringBuilder(5);
+ 130 2630 } else if (current.isCVSSAccessVectorNode()) {
+ 131 52 nodeText = new StringBuilder(20);
+ 132 2578 } else if (current.isCVSSAccessComplexityNode()) {
+ 133 52 nodeText = new StringBuilder(20);
+ 134 2526 } else if (current.isCVSSAuthenticationNode()) {
+ 135 52 nodeText = new StringBuilder(20);
+ 136 2474 } else if (current.isCVSSAvailabilityImpactNode()) {
+ 137 52 nodeText = new StringBuilder(20);
+ 138 2422 } else if (current.isCVSSConfidentialityImpactNode()) {
+ 139 52 nodeText = new StringBuilder(20);
+ 140 2370 } else if (current.isCVSSIntegrityImpactNode()) {
+ 141 52 nodeText = new StringBuilder(20);
142
}
- 143 2412 }
+ 143 4824 }
144
145
@Override
146
public void characters(char [] ch, int start, int length) throws SAXException {
- 147 3987 if (nodeText != null ) {
- 148 1142 nodeText.append(ch, start, length);
+ 147 7974 if (nodeText != null ) {
+ 148 2284 nodeText.append(ch, start, length);
149
}
- 150 3987 }
+ 150 7974 }
151
152
@Override
153
public void endElement(String uri, String localName, String qName) throws SAXException {
- 154 2412 current.setNode(qName);
- 155 2412 if (current.isEntryNode()) {
- 156 27 totalNumberOfEntries += 1;
- 157 27 if (hasApplicationCpe) {
- 158 19 totalNumberOfApplicationEntries += 1;
+ 154 4824 current.setNode(qName);
+ 155 4824 if (current.isEntryNode()) {
+ 156 54 totalNumberOfEntries += 1;
+ 157 54 if (hasApplicationCpe) {
+ 158 38 totalNumberOfApplicationEntries += 1;
159
try {
- 160 19 saveEntry(vulnerability);
+ 160 38 saveEntry(vulnerability);
161 0 } catch (DatabaseException ex) {
162 0 throw new SAXException(ex);
163 0 } catch (CorruptIndexException ex) {
164 0 throw new SAXException(ex);
165 0 } catch (IOException ex) {
166 0 throw new SAXException(ex);
- 167 19 }
+ 167 38 }
168
}
- 169 27 vulnerability = null ;
- 170 2385 } else if (current.isCVSSScoreNode()) {
+ 169 54 vulnerability = null ;
+ 170 4770 } else if (current.isCVSSScoreNode()) {
171
try {
- 172 26 final float score = Float.parseFloat(nodeText.toString());
- 173 26 vulnerability.setCvssScore(score);
+ 172 52 final float score = Float.parseFloat(nodeText.toString());
+ 173 52 vulnerability.setCvssScore(score);
174 0 } catch (NumberFormatException ex) {
175 0 LOGGER.log(Level.SEVERE, "Error parsing CVSS Score." );
176 0 LOGGER.log(Level.FINE, null , ex);
- 177 26 }
- 178 26 nodeText = null ;
- 179 2359 } else if (current.isCVSSAccessVectorNode()) {
- 180 26 vulnerability.setCvssAccessVector(nodeText.toString());
- 181 26 nodeText = null ;
- 182 2333 } else if (current.isCVSSAccessComplexityNode()) {
- 183 26 vulnerability.setCvssAccessComplexity(nodeText.toString());
- 184 26 nodeText = null ;
- 185 2307 } else if (current.isCVSSAuthenticationNode()) {
- 186 26 vulnerability.setCvssAuthentication(nodeText.toString());
- 187 26 nodeText = null ;
- 188 2281 } else if (current.isCVSSAvailabilityImpactNode()) {
- 189 26 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
- 190 26 nodeText = null ;
- 191 2255 } else if (current.isCVSSConfidentialityImpactNode()) {
- 192 26 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
- 193 26 nodeText = null ;
- 194 2229 } else if (current.isCVSSIntegrityImpactNode()) {
- 195 26 vulnerability.setCvssIntegrityImpact(nodeText.toString());
- 196 26 nodeText = null ;
- 197 2203 } else if (current.isVulnProductNode()) {
- 198 727 final String cpe = nodeText.toString();
- 199 727 if (cpe.startsWith("cpe:/a:" )) {
- 200 614 hasApplicationCpe = true ;
- 201 614 vulnerability.addVulnerableSoftware(cpe);
+ 177 52 }
+ 178 52 nodeText = null ;
+ 179 4718 } else if (current.isCVSSAccessVectorNode()) {
+ 180 52 vulnerability.setCvssAccessVector(nodeText.toString());
+ 181 52 nodeText = null ;
+ 182 4666 } else if (current.isCVSSAccessComplexityNode()) {
+ 183 52 vulnerability.setCvssAccessComplexity(nodeText.toString());
+ 184 52 nodeText = null ;
+ 185 4614 } else if (current.isCVSSAuthenticationNode()) {
+ 186 52 vulnerability.setCvssAuthentication(nodeText.toString());
+ 187 52 nodeText = null ;
+ 188 4562 } else if (current.isCVSSAvailabilityImpactNode()) {
+ 189 52 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
+ 190 52 nodeText = null ;
+ 191 4510 } else if (current.isCVSSConfidentialityImpactNode()) {
+ 192 52 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
+ 193 52 nodeText = null ;
+ 194 4458 } else if (current.isCVSSIntegrityImpactNode()) {
+ 195 52 vulnerability.setCvssIntegrityImpact(nodeText.toString());
+ 196 52 nodeText = null ;
+ 197 4406 } else if (current.isVulnProductNode()) {
+ 198 1454 final String cpe = nodeText.toString();
+ 199 1454 if (cpe.startsWith("cpe:/a:" )) {
+ 200 1228 hasApplicationCpe = true ;
+ 201 1228 vulnerability.addVulnerableSoftware(cpe);
202
}
- 203 727 nodeText = null ;
- 204 727 } else if (reference != null && current.isVulnReferencesNode()) {
- 205 90 vulnerability.addReference(reference);
- 206 90 reference = null ;
- 207 1386 } else if (reference != null && current.isVulnReferenceNode()) {
- 208 90 reference.setName(nodeText.toString());
- 209 90 nodeText = null ;
- 210 1296 } else if (reference != null && current.isVulnSourceNode()) {
- 211 90 reference.setSource(nodeText.toString());
- 212 90 nodeText = null ;
- 213 1206 } else if (current.isVulnSummaryNode()) {
- 214 27 vulnerability.setDescription(nodeText.toString());
- 215 27 if (nodeText.indexOf("** REJECT **" ) >= 0) {
- 216 1 hasApplicationCpe = true ;
+ 203 1454 nodeText = null ;
+ 204 1454 } else if (reference != null && current.isVulnReferencesNode()) {
+ 205 180 vulnerability.addReference(reference);
+ 206 180 reference = null ;
+ 207 2772 } else if (reference != null && current.isVulnReferenceNode()) {
+ 208 180 reference.setName(nodeText.toString());
+ 209 180 nodeText = null ;
+ 210 2592 } else if (reference != null && current.isVulnSourceNode()) {
+ 211 180 reference.setSource(nodeText.toString());
+ 212 180 nodeText = null ;
+ 213 2412 } else if (current.isVulnSummaryNode()) {
+ 214 54 vulnerability.setDescription(nodeText.toString());
+ 215 54 if (nodeText.indexOf("** REJECT **" ) >= 0) {
+ 216 2 hasApplicationCpe = true ;
217
}
- 218 27 nodeText = null ;
+ 218 54 nodeText = null ;
219
}
- 220 2412 }
+ 220 4824 }
221
222
@@ -422,8 +422,8 @@
256
private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException {
- 257 19 if (cveDB == null ) {
- 258 19 return ;
+ 257 38 if (cveDB == null ) {
+ 258 38 return ;
259
}
260 0 final String cveName = vuln.getName();
@@ -446,7 +446,7 @@
273
- 274 1 protected static class Element {
+ 274 2 protected static class Element {
275
276
@@ -627,7 +627,7 @@
364
public boolean isNVDNode() {
- 365 1361 return NVD.equals(node);
+ 365 2722 return NVD.equals(node);
366
}
367
@@ -644,7 +644,7 @@
373
public boolean isEntryNode() {
- 374 4824 return ENTRY.equals(node);
+ 374 9648 return ENTRY.equals(node);
375
}
376
@@ -661,7 +661,7 @@
382
public boolean isVulnProductNode() {
- 383 4588 return VULN_PRODUCT.equals(node);
+ 383 9176 return VULN_PRODUCT.equals(node);
384
}
385
@@ -678,7 +678,7 @@
391
public boolean isVulnReferencesNode() {
- 392 1928 return VULN_REFERENCES.equals(node);
+ 392 3856 return VULN_REFERENCES.equals(node);
393
}
394
@@ -695,7 +695,7 @@
400
public boolean isVulnReferenceNode() {
- 401 360 return VULN_REFERENCE.equals(node);
+ 401 720 return VULN_REFERENCE.equals(node);
402
}
403
@@ -712,7 +712,7 @@
409
public boolean isVulnSourceNode() {
- 410 180 return VULN_SOURCE.equals(node);
+ 410 360 return VULN_SOURCE.equals(node);
411
}
412
@@ -729,7 +729,7 @@
418
public boolean isVulnSummaryNode() {
- 419 2594 return VULN_SUMMARY.equals(node);
+ 419 5188 return VULN_SUMMARY.equals(node);
420
}
421
@@ -746,7 +746,7 @@
427
public boolean isVulnCWENode() {
- 428 1360 return VULN_CWE.equals(node);
+ 428 2720 return VULN_CWE.equals(node);
429
}
430
@@ -763,7 +763,7 @@
436
public boolean isCVSSScoreNode() {
- 437 3726 return CVSS_SCORE.equals(node);
+ 437 7452 return CVSS_SCORE.equals(node);
438
}
439
@@ -780,7 +780,7 @@
445
public boolean isCVSSAccessVectorNode() {
- 446 3674 return CVSS_ACCESS_VECTOR.equals(node);
+ 446 7348 return CVSS_ACCESS_VECTOR.equals(node);
447
}
448
@@ -797,7 +797,7 @@
454
public boolean isCVSSAccessComplexityNode() {
- 455 3622 return CVSS_ACCESS_COMPLEXITY.equals(node);
+ 455 7244 return CVSS_ACCESS_COMPLEXITY.equals(node);
456
}
457
@@ -814,7 +814,7 @@
463
public boolean isCVSSAuthenticationNode() {
- 464 3570 return CVSS_AUTHENTICATION.equals(node);
+ 464 7140 return CVSS_AUTHENTICATION.equals(node);
465
}
466
@@ -831,7 +831,7 @@
472
public boolean isCVSSConfidentialityImpactNode() {
- 473 3466 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
+ 473 6932 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
474
}
475
@@ -848,7 +848,7 @@
481
public boolean isCVSSIntegrityImpactNode() {
- 482 3414 return CVSS_INTEGRITY_IMPACT.equals(node);
+ 482 6828 return CVSS_INTEGRITY_IMPACT.equals(node);
483
}
484
@@ -865,7 +865,7 @@
490
public boolean isCVSSAvailabilityImpactNode() {
- 491 3518 return CVSS_AVAILABILITY_IMPACT.equals(node);
+ 491 7036 return CVSS_AVAILABILITY_IMPACT.equals(node);
492
}
493
@@ -876,6 +876,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html
index 07d5e4159..340a917bd 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html
@@ -65,7 +65,7 @@
24
- 25 5 public enum Confidence {
+ 25 10 public enum Confidence {
26
27
@@ -74,32 +74,32 @@
29
- 30 1 HIGHEST,
+ 30 2 HIGHEST,
31
32
33
- 34 1 HIGH,
+ 34 2 HIGH,
35
36
37
- 38 1 MEDIUM,
+ 38 2 MEDIUM,
39
40
41
- 42 1 LOW
+ 42 2 LOW
43
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html
index c29ee1694..56b44384e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html
@@ -12,7 +12,7 @@
@@ -91,7 +91,7 @@
37
- 38 2 public class Dependency implements Comparable<Dependency> {
+ 38 4 public class Dependency implements Comparable<Dependency> {
39
40
@@ -100,7 +100,7 @@
42
- 43 1 private static final Logger LOGGER = Logger.getLogger(Dependency.class .getName());
+ 43 2 private static final Logger LOGGER = Logger.getLogger(Dependency.class .getName());
44
45
@@ -189,15 +189,15 @@
87
- 88 37 public Dependency() {
- 89 37 vendorEvidence = new EvidenceCollection();
- 90 37 productEvidence = new EvidenceCollection();
- 91 37 versionEvidence = new EvidenceCollection();
- 92 37 identifiers = new TreeSet<Identifier>();
- 93 37 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
- 94 37 suppressedIdentifiers = new TreeSet<Identifier>();
- 95 37 suppressedVulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
- 96 37 }
+ 88 76 public Dependency() {
+ 89 76 vendorEvidence = new EvidenceCollection();
+ 90 76 productEvidence = new EvidenceCollection();
+ 91 76 versionEvidence = new EvidenceCollection();
+ 92 76 identifiers = new TreeSet<Identifier>();
+ 93 76 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
+ 94 76 suppressedIdentifiers = new TreeSet<Identifier>();
+ 95 76 suppressedVulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
+ 96 76 }
97
98
@@ -212,13 +212,13 @@
103
public Dependency(File file) {
- 104 16 this ();
- 105 16 this .actualFilePath = file.getPath();
- 106 16 this .filePath = this .actualFilePath;
- 107 16 this .fileName = file.getName();
- 108 16 this .fileExtension = FileUtils.getFileExtension(fileName);
- 109 16 determineHashes(file);
- 110 16 }
+ 104 34 this ();
+ 105 34 this .actualFilePath = file.getPath();
+ 106 34 this .filePath = this .actualFilePath;
+ 107 34 this .fileName = file.getName();
+ 108 34 this .fileExtension = FileUtils.getFileExtension(fileName);
+ 109 34 determineHashes(file);
+ 110 34 }
111
112
@@ -288,13 +288,13 @@
145
public void setActualFilePath(String actualFilePath) {
- 146 2 this .actualFilePath = actualFilePath;
- 147 2 if (this .sha1sum == null ) {
- 148 2 final File file = new File(this .actualFilePath);
- 149 2 determineHashes(file);
+ 146 4 this .actualFilePath = actualFilePath;
+ 147 4 if (this .sha1sum == null ) {
+ 148 4 final File file = new File(this .actualFilePath);
+ 149 4 determineHashes(file);
150
}
- 151 2 }
+ 151 4 }
152
153
@@ -327,7 +327,7 @@
167
public File getActualFile() {
- 168 2 return new File(this .actualFilePath);
+ 168 4 return new File(this .actualFilePath);
169
}
170
@@ -356,7 +356,7 @@
182
- 183 37 private String displayName = null ;
+ 183 76 private String displayName = null ;
184
185
@@ -586,9 +586,9 @@
299
public void addIdentifier(String type, String value, String url) {
- 300 6 final Identifier i = new Identifier(type, value, url);
- 301 6 this .identifiers.add(i);
- 302 6 }
+ 300 22 final Identifier i = new Identifier(type, value, url);
+ 301 22 this .identifiers.add(i);
+ 302 22 }
303
304
@@ -609,10 +609,10 @@
312
public void addIdentifier(String type, String value, String url, Confidence confidence) {
- 313 0 final Identifier i = new Identifier(type, value, url);
- 314 0 i.setConfidence(confidence);
- 315 0 this .identifiers.add(i);
- 316 0 }
+ 313 2 final Identifier i = new Identifier(type, value, url);
+ 314 2 i.setConfidence(confidence);
+ 315 2 this .identifiers.add(i);
+ 316 2 }
317
318
@@ -627,8 +627,8 @@
323
public void addIdentifier(Identifier identifier) {
- 324 4 this .identifiers.add(identifier);
- 325 4 }
+ 324 8 this .identifiers.add(identifier);
+ 325 8 }
326
327
@@ -687,8 +687,8 @@
354
public void addSuppressedIdentifier(Identifier identifier) {
- 355 4 this .suppressedIdentifiers.add(identifier);
- 356 4 }
+ 355 14 this .suppressedIdentifiers.add(identifier);
+ 356 14 }
357
358
@@ -749,8 +749,8 @@
386
public void addSuppressedVulnerability(Vulnerability vulnerability) {
- 387 3 this .suppressedVulnerabilities.add(vulnerability);
- 388 3 }
+ 387 6 this .suppressedVulnerabilities.add(vulnerability);
+ 388 6 }
389
390
@@ -765,7 +765,7 @@
395
public EvidenceCollection getEvidence() {
- 396 3 return EvidenceCollection.merge(this .productEvidence, this .vendorEvidence, this .versionEvidence);
+ 396 6 return EvidenceCollection.merge(this .productEvidence, this .vendorEvidence, this .versionEvidence);
397
}
398
@@ -799,7 +799,7 @@
413
public EvidenceCollection getEvidenceUsed() {
- 414 1 return EvidenceCollection.mergeUsed(this .productEvidence, this .vendorEvidence, this .versionEvidence);
+ 414 2 return EvidenceCollection.mergeUsed(this .productEvidence, this .vendorEvidence, this .versionEvidence);
415
}
416
@@ -1002,24 +1002,24 @@
515
private void determineHashes(File file) {
- 516 18 String md5 = null ;
- 517 18 String sha1 = null ;
+ 516 38 String md5 = null ;
+ 517 38 String sha1 = null ;
518
try {
- 519 18 md5 = Checksum.getMD5Checksum(file);
- 520 15 sha1 = Checksum.getSHA1Checksum(file);
- 521 3 } catch (IOException ex) {
- 522 3 final String msg = String.format("Unable to read '%s' to determine hashes." , file.getName());
- 523 3 LOGGER.log(Level.WARNING, msg);
- 524 3 LOGGER.log(Level.FINE, null , ex);
+ 519 38 md5 = Checksum.getMD5Checksum(file);
+ 520 32 sha1 = Checksum.getSHA1Checksum(file);
+ 521 6 } catch (IOException ex) {
+ 522 6 final String msg = String.format("Unable to read '%s' to determine hashes." , file.getName());
+ 523 6 LOGGER.log(Level.WARNING, msg);
+ 524 6 LOGGER.log(Level.FINE, null , ex);
525 0 } catch (NoSuchAlgorithmException ex) {
526 0 final String msg = "Unable to use MD5 of SHA1 checksums." ;
527 0 LOGGER.log(Level.WARNING, msg);
528 0 LOGGER.log(Level.FINE, null , ex);
- 529 18 }
- 530 18 this .setMd5sum(md5);
- 531 18 this .setSha1sum(sha1);
- 532 18 }
+ 529 38 }
+ 530 38 this .setMd5sum(md5);
+ 531 38 this .setSha1sum(sha1);
+ 532 38 }
533
534
@@ -1034,15 +1034,15 @@
539
public void addVulnerability(Vulnerability vulnerability) {
- 540 3 this .vulnerabilities.add(vulnerability);
- 541 3 }
+ 540 6 this .vulnerabilities.add(vulnerability);
+ 541 6 }
542
543
544
- 545 37 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
+ 545 76 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
546
547
@@ -1111,7 +1111,7 @@
580
public int compareTo(Dependency o) {
- 581 2 return this .getFileName().compareToIgnoreCase(o.getFileName());
+ 581 4 return this .getFileName().compareToIgnoreCase(o.getFileName());
582
}
583
@@ -1218,22 +1218,22 @@
@Override
651
public int hashCode() {
- 652 26 int hash = 3;
- 653 26 hash = 47 * hash + (this .actualFilePath != null ? this .actualFilePath.hashCode() : 0);
- 654 26 hash = 47 * hash + (this .filePath != null ? this .filePath.hashCode() : 0);
- 655 26 hash = 47 * hash + (this .fileName != null ? this .fileName.hashCode() : 0);
- 656 26 hash = 47 * hash + (this .fileExtension != null ? this .fileExtension.hashCode() : 0);
- 657 26 hash = 47 * hash + (this .md5sum != null ? this .md5sum.hashCode() : 0);
- 658 26 hash = 47 * hash + (this .sha1sum != null ? this .sha1sum.hashCode() : 0);
- 659 26 hash = 47 * hash + (this .identifiers != null ? this .identifiers.hashCode() : 0);
- 660 26 hash = 47 * hash + (this .vendorEvidence != null ? this .vendorEvidence.hashCode() : 0);
- 661 26 hash = 47 * hash + (this .productEvidence != null ? this .productEvidence.hashCode() : 0);
- 662 26 hash = 47 * hash + (this .versionEvidence != null ? this .versionEvidence.hashCode() : 0);
- 663 26 hash = 47 * hash + (this .description != null ? this .description.hashCode() : 0);
- 664 26 hash = 47 * hash + (this .license != null ? this .license.hashCode() : 0);
- 665 26 hash = 47 * hash + (this .vulnerabilities != null ? this .vulnerabilities.hashCode() : 0);
- 666 26 hash = 47 * hash + (this .relatedDependencies != null ? this .relatedDependencies.hashCode() : 0);
- 667 26 return hash;
+ 652 52 int hash = 3;
+ 653 52 hash = 47 * hash + (this .actualFilePath != null ? this .actualFilePath.hashCode() : 0);
+ 654 52 hash = 47 * hash + (this .filePath != null ? this .filePath.hashCode() : 0);
+ 655 52 hash = 47 * hash + (this .fileName != null ? this .fileName.hashCode() : 0);
+ 656 52 hash = 47 * hash + (this .fileExtension != null ? this .fileExtension.hashCode() : 0);
+ 657 52 hash = 47 * hash + (this .md5sum != null ? this .md5sum.hashCode() : 0);
+ 658 52 hash = 47 * hash + (this .sha1sum != null ? this .sha1sum.hashCode() : 0);
+ 659 52 hash = 47 * hash + (this .identifiers != null ? this .identifiers.hashCode() : 0);
+ 660 52 hash = 47 * hash + (this .vendorEvidence != null ? this .vendorEvidence.hashCode() : 0);
+ 661 52 hash = 47 * hash + (this .productEvidence != null ? this .productEvidence.hashCode() : 0);
+ 662 52 hash = 47 * hash + (this .versionEvidence != null ? this .versionEvidence.hashCode() : 0);
+ 663 52 hash = 47 * hash + (this .description != null ? this .description.hashCode() : 0);
+ 664 52 hash = 47 * hash + (this .license != null ? this .license.hashCode() : 0);
+ 665 52 hash = 47 * hash + (this .vulnerabilities != null ? this .vulnerabilities.hashCode() : 0);
+ 666 52 hash = 47 * hash + (this .relatedDependencies != null ? this .relatedDependencies.hashCode() : 0);
+ 667 52 return hash;
668
}
669
@@ -1259,6 +1259,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html
index 2924600cb..3fde8c4ad 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html
@@ -65,7 +65,7 @@
24
- 25 35743 public class Evidence implements Comparable<Evidence> {
+ 25 79428 public class Evidence implements Comparable<Evidence> {
26
27
@@ -218,8 +218,8 @@
101
public String getValue() {
- 102 863 used = true ;
- 103 863 return value;
+ 102 1718 used = true ;
+ 103 1718 return value;
104
}
105
@@ -238,8 +238,8 @@
112
public String getValue(Boolean setUsed) {
- 113 50 used = used || setUsed;
- 114 50 return value;
+ 113 100 used = used || setUsed;
+ 114 100 return value;
115
}
116
@@ -364,12 +364,12 @@
@Override
176
public int hashCode() {
- 177 2 int hash = 3;
- 178 2 hash = 67 * hash + (this .name != null ? this .name.hashCode() : 0);
- 179 2 hash = 67 * hash + (this .source != null ? this .source.hashCode() : 0);
- 180 2 hash = 67 * hash + (this .value != null ? this .value.hashCode() : 0);
- 181 2 hash = 67 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
- 182 2 return hash;
+ 177 4 int hash = 3;
+ 178 4 hash = 67 * hash + (this .name != null ? this .name.hashCode() : 0);
+ 179 4 hash = 67 * hash + (this .source != null ? this .source.hashCode() : 0);
+ 180 4 hash = 67 * hash + (this .value != null ? this .value.hashCode() : 0);
+ 181 4 hash = 67 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
+ 182 4 return hash;
183
}
184
@@ -443,33 +443,33 @@
222
public int compareTo(Evidence o) {
- 223 35743 if (o == null ) {
+ 223 79428 if (o == null ) {
224 0 return 1;
225
}
- 226 35743 if (equalsWithNullCheck(source, o.source)) {
- 227 22863 if (equalsWithNullCheck(name, o.name)) {
- 228 22756 if (equalsWithNullCheck(value, o.value)) {
- 229 13850 if (equalsWithNullCheck(confidence, o.confidence)) {
- 230 13848 return 0;
+ 226 79428 if (equalsWithNullCheck(source, o.source)) {
+ 227 50502 if (equalsWithNullCheck(name, o.name)) {
+ 228 50316 if (equalsWithNullCheck(value, o.value)) {
+ 229 30890 if (equalsWithNullCheck(confidence, o.confidence)) {
+ 230 30864 return 0;
231
} else {
- 232 2 return compareToWithNullCheck(confidence, o.confidence);
+ 232 26 return compareToWithNullCheck(confidence, o.confidence);
233
}
234
} else {
- 235 8906 return compareToIgnoreCaseWithNullCheck(value, o.value);
+ 235 19426 return compareToIgnoreCaseWithNullCheck(value, o.value);
236
}
237
} else {
- 238 107 return compareToIgnoreCaseWithNullCheck(name, o.name);
+ 238 186 return compareToIgnoreCaseWithNullCheck(name, o.name);
239
}
240
} else {
- 241 12880 return compareToIgnoreCaseWithNullCheck(source, o.source);
+ 241 28926 return compareToIgnoreCaseWithNullCheck(source, o.source);
242
}
243
@@ -492,13 +492,13 @@
252
private boolean equalsWithNullCheck(String me, String other) {
- 253 81362 if (me == null && other == null ) {
+ 253 180246 if (me == null && other == null ) {
254 0 return true ;
- 255 81362 } else if (me == null || other == null ) {
+ 255 180246 } else if (me == null || other == null ) {
256 0 return false ;
257
}
- 258 81362 return me.equals(other);
+ 258 180246 return me.equals(other);
259
}
260
@@ -519,13 +519,13 @@
268
private boolean equalsWithNullCheck(Confidence me, Confidence other) {
- 269 13850 if (me == null && other == null ) {
+ 269 30890 if (me == null && other == null ) {
270 0 return true ;
- 271 13850 } else if (me == null || other == null ) {
+ 271 30890 } else if (me == null || other == null ) {
272 0 return false ;
273
}
- 274 13850 return me.equals(other);
+ 274 30890 return me.equals(other);
275
}
276
@@ -548,15 +548,15 @@
285
private int compareToIgnoreCaseWithNullCheck(String me, String other) {
- 286 21893 if (me == null && other == null ) {
+ 286 48538 if (me == null && other == null ) {
287 0 return 0;
- 288 21893 } else if (me == null ) {
+ 288 48538 } else if (me == null ) {
289 0 return -1;
- 290 21893 } else if (other == null ) {
+ 290 48538 } else if (other == null ) {
291 0 return 1;
292
}
- 293 21893 return me.compareToIgnoreCase(other);
+ 293 48538 return me.compareToIgnoreCase(other);
294
}
295
@@ -579,21 +579,21 @@
304
private int compareToWithNullCheck(Confidence me, Confidence other) {
- 305 2 if (me == null && other == null ) {
+ 305 26 if (me == null && other == null ) {
306 0 return 0;
- 307 2 } else if (me == null ) {
+ 307 26 } else if (me == null ) {
308 0 return -1;
- 309 2 } else if (other == null ) {
+ 309 26 } else if (other == null ) {
310 0 return 1;
311
}
- 312 2 return me.compareTo(other);
+ 312 26 return me.compareTo(other);
313
}
314
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html
index 3d4ed4449..5be8284d7 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html
@@ -108,17 +108,17 @@
43
- 44 1 private static final Logger LOGGER = Logger.getLogger(EvidenceCollection.class .getName());
+ 44 2 private static final Logger LOGGER = Logger.getLogger(EvidenceCollection.class .getName());
45
46
47
- 48 73 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
+ 48 146 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
49
public boolean passes(Evidence evidence) {
- 50 73 return evidence.getConfidence() == Confidence.HIGHEST;
+ 50 146 return evidence.getConfidence() == Confidence.HIGHEST;
51
}
52
@@ -129,10 +129,10 @@
55
- 56 63 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
+ 56 126 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
57
public boolean passes(Evidence evidence) {
- 58 63 return evidence.getConfidence() == Confidence.HIGH;
+ 58 126 return evidence.getConfidence() == Confidence.HIGH;
59
}
60
@@ -143,10 +143,10 @@
63
- 64 1 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
+ 64 2 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
65
public boolean passes(Evidence evidence) {
- 66 73 return evidence.getConfidence() == Confidence.MEDIUM;
+ 66 146 return evidence.getConfidence() == Confidence.MEDIUM;
67
}
68
@@ -157,10 +157,10 @@
71
- 72 1 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
+ 72 2 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
73
public boolean passes(Evidence evidence) {
- 74 122 return evidence.getConfidence() == Confidence.LOW;
+ 74 244 return evidence.getConfidence() == Confidence.LOW;
75
}
76
@@ -171,10 +171,10 @@
79
- 80 1 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
+ 80 2 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
81
public boolean passes(Evidence evidence) {
- 82 995 return evidence.isUsed();
+ 82 1912 return evidence.isUsed();
83
}
84
@@ -195,15 +195,15 @@
92
public final Iterable<Evidence> iterator(Confidence confidence) {
- 93 44 if (confidence == Confidence.HIGHEST) {
- 94 10 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this .list);
- 95 34 } else if (confidence == Confidence.HIGH) {
- 96 10 return EvidenceCollection.HIGH_CONFIDENCE.filter(this .list);
- 97 24 } else if (confidence == Confidence.MEDIUM) {
- 98 10 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this .list);
+ 93 88 if (confidence == Confidence.HIGHEST) {
+ 94 20 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this .list);
+ 95 68 } else if (confidence == Confidence.HIGH) {
+ 96 20 return EvidenceCollection.HIGH_CONFIDENCE.filter(this .list);
+ 97 48 } else if (confidence == Confidence.MEDIUM) {
+ 98 20 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this .list);
99
} else {
- 100 14 return EvidenceCollection.LOW_CONFIDENCE.filter(this .list);
+ 100 28 return EvidenceCollection.LOW_CONFIDENCE.filter(this .list);
101
}
102
@@ -232,10 +232,10 @@
114
- 115 115 public EvidenceCollection() {
- 116 115 list = new TreeSet<Evidence>();
- 117 115 weightedStrings = new HashSet<String>();
- 118 115 }
+ 115 236 public EvidenceCollection() {
+ 116 236 list = new TreeSet<Evidence>();
+ 117 236 weightedStrings = new HashSet<String>();
+ 118 236 }
119
120
@@ -250,8 +250,8 @@
125
public void addEvidence(Evidence e) {
- 126 13904 list.add(e);
- 127 13904 }
+ 126 30986 list.add(e);
+ 127 30986 }
128
129
@@ -272,9 +272,9 @@
137
public void addEvidence(String source, String name, String value, Confidence confidence) {
- 138 13897 final Evidence e = new Evidence(source, name, value, confidence);
- 139 13897 addEvidence(e);
- 140 13897 }
+ 138 30972 final Evidence e = new Evidence(source, name, value, confidence);
+ 139 30972 addEvidence(e);
+ 140 30972 }
141
142
@@ -301,8 +301,8 @@
153
public void addWeighting(String str) {
- 154 15 weightedStrings.add(str);
- 155 15 }
+ 154 30 weightedStrings.add(str);
+ 155 30 }
156
157
@@ -389,18 +389,18 @@
202
public Set<Evidence> getEvidence(String source, String name) {
- 203 2 if (source == null || name == null ) {
+ 203 4 if (source == null || name == null ) {
204 0 return null ;
205
}
- 206 2 final Set<Evidence> ret = new HashSet<Evidence>();
- 207 2 for (Evidence e : list) {
- 208 2 if (source.equals(e.getSource()) && name.equals(e.getName())) {
- 209 2 ret.add(e);
+ 206 4 final Set<Evidence> ret = new HashSet<Evidence>();
+ 207 4 for (Evidence e : list) {
+ 208 4 if (source.equals(e.getSource()) && name.equals(e.getName())) {
+ 209 4 ret.add(e);
210
}
- 211 2 }
- 212 2 return ret;
+ 211 4 }
+ 212 4 return ret;
213
}
214
@@ -417,7 +417,7 @@
220
public Iterator<Evidence> iterator() {
- 221 117 return list.iterator();
+ 221 234 return list.iterator();
222
}
223
@@ -436,23 +436,23 @@
230
public boolean containsUsedString(String text) {
- 231 112 if (text == null ) {
+ 231 224 if (text == null ) {
232 0 return false ;
233
}
- 234 112 final String textToTest = text.toLowerCase();
+ 234 224 final String textToTest = text.toLowerCase();
235
- 236 112 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this )) {
+ 236 224 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this )) {
237
- 238 754 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]" , "" );
- 239 754 if (value.contains(textToTest)) {
- 240 44 return true ;
+ 238 1496 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]" , "" );
+ 239 1496 if (value.contains(textToTest)) {
+ 240 88 return true ;
241
}
- 242 710 }
- 243 68 return false ;
+ 242 1408 }
+ 243 136 return false ;
244
}
245
@@ -503,13 +503,13 @@
272
public boolean contains(Confidence confidence) {
- 273 24 for (Evidence e : list) {
- 274 114 if (e.getConfidence().equals(confidence)) {
- 275 21 return true ;
+ 273 48 for (Evidence e : list) {
+ 274 256 if (e.getConfidence().equals(confidence)) {
+ 275 42 return true ;
276
}
- 277 93 }
- 278 3 return false ;
+ 277 214 }
+ 278 6 return false ;
279
}
280
@@ -528,17 +528,17 @@
287
public static EvidenceCollection mergeUsed(EvidenceCollection... ec) {
- 288 1 final EvidenceCollection ret = new EvidenceCollection();
- 289 4 for (EvidenceCollection col : ec) {
- 290 3 for (Evidence e : col.list) {
- 291 2 if (e.isUsed()) {
- 292 1 ret.addEvidence(e);
+ 288 2 final EvidenceCollection ret = new EvidenceCollection();
+ 289 8 for (EvidenceCollection col : ec) {
+ 290 6 for (Evidence e : col.list) {
+ 291 4 if (e.isUsed()) {
+ 292 2 ret.addEvidence(e);
293
}
- 294 2 }
+ 294 4 }
295
}
- 296 1 return ret;
+ 296 2 return ret;
297
}
298
@@ -557,13 +557,13 @@
305
public static EvidenceCollection merge(EvidenceCollection... ec) {
- 306 3 final EvidenceCollection ret = new EvidenceCollection();
- 307 12 for (EvidenceCollection col : ec) {
- 308 9 ret.list.addAll(col.list);
- 309 9 ret.weightedStrings.addAll(col.weightedStrings);
+ 306 6 final EvidenceCollection ret = new EvidenceCollection();
+ 307 24 for (EvidenceCollection col : ec) {
+ 308 18 ret.list.addAll(col.list);
+ 309 18 ret.weightedStrings.addAll(col.weightedStrings);
310
}
- 311 3 return ret;
+ 311 6 return ret;
312
}
313
@@ -613,11 +613,11 @@
@Override
340
public String toString() {
- 341 3 final StringBuilder sb = new StringBuilder();
- 342 3 for (Evidence e : this .list) {
- 343 11 sb.append(e.getValue()).append(' ' );
- 344 11 }
- 345 3 return sb.toString();
+ 341 6 final StringBuilder sb = new StringBuilder();
+ 342 6 for (Evidence e : this .list) {
+ 343 26 sb.append(e.getValue()).append(' ' );
+ 344 26 }
+ 345 6 return sb.toString();
346
}
347
@@ -634,7 +634,7 @@
353
public int size() {
- 354 29 return list.size();
+ 354 58 return list.size();
355
}
356
@@ -677,22 +677,22 @@
375
private String urlCorrection(String value) {
- 376 754 if (value == null || !UrlStringUtils.containsUrl(value)) {
- 377 749 return value;
+ 376 1496 if (value == null || !UrlStringUtils.containsUrl(value)) {
+ 377 1486 return value;
378
}
- 379 5 final StringBuilder sb = new StringBuilder(value.length());
- 380 5 final String[] parts = value.split("\\s" );
- 381 10 for (String part : parts) {
- 382 5 if (UrlStringUtils.isUrl(part)) {
+ 379 10 final StringBuilder sb = new StringBuilder(value.length());
+ 380 10 final String[] parts = value.split("\\s" );
+ 381 20 for (String part : parts) {
+ 382 10 if (UrlStringUtils.isUrl(part)) {
383
try {
- 384 5 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
- 385 5 sb.append(' ' ).append(StringUtils.join(data, ' ' ));
+ 384 10 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
+ 385 10 sb.append(' ' ).append(StringUtils.join(data, ' ' ));
386 0 } catch (MalformedURLException ex) {
387 0 LOGGER.log(Level.FINE, "error parsing " + part, ex);
388 0 sb.append(' ' ).append(part);
- 389 5 }
+ 389 10 }
390
} else {
391 0 sb.append(' ' ).append(part);
@@ -700,13 +700,13 @@
} 393
}
- 394 5 return sb.toString().trim();
+ 394 10 return sb.toString().trim();
395
}
396
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html
index 196fbbdb9..be3317055 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html
@@ -63,7 +63,7 @@
23
- 24 18 public class Identifier implements Comparable<Identifier> {
+ 24 64 public class Identifier implements Comparable<Identifier> {
25
26
@@ -373,10 +373,10 @@
@Override
185
public int hashCode() {
- 186 10 int hash = 5;
- 187 10 hash = 53 * hash + (this .value != null ? this .value.hashCode() : 0);
- 188 10 hash = 53 * hash + (this .type != null ? this .type.hashCode() : 0);
- 189 10 return hash;
+ 186 20 int hash = 5;
+ 187 20 hash = 53 * hash + (this .value != null ? this .value.hashCode() : 0);
+ 188 20 hash = 53 * hash + (this .type != null ? this .type.hashCode() : 0);
+ 189 20 return hash;
190
}
191
@@ -414,17 +414,17 @@
208
public int compareTo(Identifier o) {
- 209 22 if (o == null ) {
+ 209 72 if (o == null ) {
210 0 return -1;
211
}
- 212 22 return this .value.compareTo(o.value);
+ 212 72 return this .value.compareTo(o.value);
213
}
214
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html
index 3f76d04ee..15c67bc0d 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html
@@ -69,7 +69,7 @@
26
- 27 276 public class Reference implements Serializable, Comparable<Reference> {
+ 27 704 public class Reference implements Serializable, Comparable<Reference> {
28
29
@@ -271,10 +271,10 @@
136
public int compareTo(Reference o) {
- 137 276 if (source.equals(o.source)) {
- 138 83 if (name.equals(o.name)) {
- 139 29 if (url.equals(o.url)) {
- 140 29 return 0;
+ 137 704 if (source.equals(o.source)) {
+ 138 210 if (name.equals(o.name)) {
+ 139 68 if (url.equals(o.url)) {
+ 140 68 return 0;
141
} else {
142 0 return url.compareTo(o.url);
@@ -282,12 +282,12 @@
} 144
} else {
- 145 54 return name.compareTo(o.name);
+ 145 142 return name.compareTo(o.name);
146
}
147
} else {
- 148 193 return source.compareTo(o.source);
+ 148 494 return source.compareTo(o.source);
149
}
150
@@ -296,6 +296,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html
index e4ebadbd3..e5137b636 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html
@@ -75,7 +75,7 @@
29
- 30 31 public class Vulnerability implements Serializable, Comparable<Vulnerability> {
+ 30 72 public class Vulnerability implements Serializable, Comparable<Vulnerability> {
31
32
@@ -180,7 +180,7 @@
82
- 83 31 private SortedSet<Reference> references = new TreeSet<Reference>();
+ 83 72 private SortedSet<Reference> references = new TreeSet<Reference>();
84
85
@@ -231,8 +231,8 @@
108
public void addReference(Reference ref) {
- 109 90 this .references.add(ref);
- 110 90 }
+ 109 180 this .references.add(ref);
+ 110 180 }
111
112
@@ -251,19 +251,19 @@
119
public void addReference(String referenceSource, String referenceName, String referenceUrl) {
- 120 36 final Reference ref = new Reference();
- 121 36 ref.setSource(referenceSource);
- 122 36 ref.setName(referenceName);
- 123 36 ref.setUrl(referenceUrl);
- 124 36 this .references.add(ref);
- 125 36 }
+ 120 136 final Reference ref = new Reference();
+ 121 136 ref.setSource(referenceSource);
+ 122 136 ref.setName(referenceName);
+ 123 136 ref.setUrl(referenceUrl);
+ 124 136 this .references.add(ref);
+ 125 136 }
126
127
128
- 129 31 private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
+ 129 72 private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
130
131
@@ -316,7 +316,7 @@
155
public boolean addVulnerableSoftware(String cpe) {
- 156 666 return addVulnerableSoftware(cpe, null );
+ 156 1684 return addVulnerableSoftware(cpe, null );
157
}
158
@@ -337,13 +337,13 @@
166
public boolean addVulnerableSoftware(String cpe, String previousVersion) {
- 167 668 final VulnerableSoftware vs = new VulnerableSoftware();
- 168 668 vs.setCpe(cpe);
- 169 668 if (previousVersion != null ) {
- 170 2 vs.setPreviousVersion(previousVersion);
+ 167 1700 final VulnerableSoftware vs = new VulnerableSoftware();
+ 168 1700 vs.setCpe(cpe);
+ 169 1700 if (previousVersion != null ) {
+ 170 16 vs.setPreviousVersion(previousVersion);
171
}
- 172 668 return updateVulnerableSoftware(vs);
+ 172 1700 return updateVulnerableSoftware(vs);
173
}
174
@@ -362,11 +362,11 @@
181
public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) {
- 182 668 if (vulnerableSoftware.contains(vulnSoftware)) {
+ 182 1700 if (vulnerableSoftware.contains(vulnSoftware)) {
183 0 vulnerableSoftware.remove(vulnSoftware);
184
}
- 185 668 return vulnerableSoftware.add(vulnSoftware);
+ 185 1700 return vulnerableSoftware.add(vulnSoftware);
186
}
187
@@ -749,9 +749,9 @@
@Override
380
public int hashCode() {
- 381 3 int hash = 5;
- 382 3 hash = 41 * hash + (this .name != null ? this .name.hashCode() : 0);
- 383 3 return hash;
+ 381 16 int hash = 5;
+ 382 16 hash = 41 * hash + (this .name != null ? this .name.hashCode() : 0);
+ 383 16 return hash;
384
}
385
@@ -811,9 +811,9 @@
413
public void setMatchedCPE(String cpeId, String previous) {
- 414 3 matchedCPE = cpeId;
- 415 3 matchedAllPreviousCPE = previous;
- 416 3 }
+ 414 16 matchedCPE = cpeId;
+ 415 16 matchedAllPreviousCPE = previous;
+ 416 16 }
417
418
@@ -871,6 +871,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html
index 30f2f20b7..d81ad72a9 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html
@@ -71,7 +71,7 @@
27
- 28 10 public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
+ 28 50 public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
29
30
@@ -100,13 +100,13 @@
42
public int compare(Vulnerability o1, Vulnerability o2) {
- 43 10 return o2.getName().compareTo(o1.getName());
+ 43 50 return o2.getName().compareTo(o1.getName());
44
}
45
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html
index b1c3d2bd1..3598d2c4e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html
@@ -79,7 +79,7 @@
31
- 32 7937 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
+ 32 20008 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
33
34
@@ -88,7 +88,7 @@
36
- 37 1 private static final Logger LOGGER = Logger.getLogger(VulnerableSoftware.class .getName());
+ 37 2 private static final Logger LOGGER = Logger.getLogger(VulnerableSoftware.class .getName());
38
39
@@ -113,14 +113,14 @@
public void setCpe(String cpe) {
49
try {
- 50 736 parseName(cpe);
+ 50 2028 parseName(cpe);
51 0 } catch (UnsupportedEncodingException ex) {
52 0 final String msg = String.format("Character encoding is unsupported for CPE '%s'." , cpe);
53 0 LOGGER.log(Level.WARNING, msg);
54 0 LOGGER.log(Level.FINE, null , ex);
55 0 setName(cpe);
- 56 736 }
- 57 736 }
+ 56 2028 }
+ 57 2028 }
58
59
@@ -157,32 +157,32 @@
@Override
75
public void parseName(String cpeName) throws UnsupportedEncodingException {
- 76 760 this .name = cpeName;
- 77 760 if (cpeName != null && cpeName.length() > 7) {
- 78 760 final String[] data = cpeName.substring(7).split(":" );
- 79 760 if (data.length >= 1) {
- 80 760 this .setVendor(urlDecode(data[0]));
+ 76 2102 this .name = cpeName;
+ 77 2102 if (cpeName != null && cpeName.length() > 7) {
+ 78 2102 final String[] data = cpeName.substring(7).split(":" );
+ 79 2102 if (data.length >= 1) {
+ 80 2102 this .setVendor(urlDecode(data[0]));
81
}
- 82 760 if (data.length >= 2) {
- 83 760 this .setProduct(urlDecode(data[1]));
+ 82 2102 if (data.length >= 2) {
+ 83 2102 this .setProduct(urlDecode(data[1]));
84
}
- 85 760 if (data.length >= 3) {
- 86 760 version = urlDecode(data[2]);
+ 85 2102 if (data.length >= 3) {
+ 86 2102 version = urlDecode(data[2]);
87
}
- 88 760 if (data.length >= 4) {
- 89 43 revision = urlDecode(data[3]);
+ 88 2102 if (data.length >= 4) {
+ 89 302 revision = urlDecode(data[3]);
90
}
- 91 760 if (data.length >= 5) {
+ 91 2102 if (data.length >= 5) {
92 0 edition = urlDecode(data[4]);
93
}
94
}
- 95 760 }
+ 95 2102 }
96
97
@@ -262,17 +262,17 @@
@Override
135
public boolean equals(Object obj) {
- 136 1 if (obj == null ) {
+ 136 2 if (obj == null ) {
137 0 return false ;
138
}
- 139 1 if (getClass() != obj.getClass()) {
+ 139 2 if (getClass() != obj.getClass()) {
140 0 return false ;
141
}
- 142 1 final VulnerableSoftware other = (VulnerableSoftware) obj;
- 143 1 if ((this .getName() == null ) ? (other.getName() != null ) : !this .getName().equals(other.getName())) {
- 144 1 return false ;
+ 142 2 final VulnerableSoftware other = (VulnerableSoftware) obj;
+ 143 2 if ((this .getName() == null ) ? (other.getName() != null ) : !this .getName().equals(other.getName())) {
+ 144 2 return false ;
145
}
146 0 return true ;
@@ -294,9 +294,9 @@
@Override 155
public int hashCode() {
- 156 63 int hash = 7;
- 157 63 hash = 83 * hash + (this .getName() != null ? this .getName().hashCode() : 0);
- 158 63 return hash;
+ 156 326 int hash = 7;
+ 157 326 hash = 83 * hash + (this .getName() != null ? this .getName().hashCode() : 0);
+ 158 326 return hash;
159
}
160
@@ -336,21 +336,21 @@
@Override
178
public int compareTo(VulnerableSoftware vs) {
- 179 7939 int result = 0;
- 180 7939 final String[] left = this .getName().split(":" );
- 181 7939 final String[] right = vs.getName().split(":" );
- 182 7939 final int max = (left.length <= right.length) ? left.length : right.length;
- 183 7939 if (max > 0) {
- 184 47603 for (int i = 0; result == 0 && i < max; i++) {
- 185 39664 final String[] subLeft = left[i].split("\\." );
- 186 39664 final String[] subRight = right[i].split("\\." );
- 187 39664 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
- 188 39664 if (subMax > 0) {
- 189 90802 for (int x = 0; result == 0 && x < subMax; x++) {
- 190 51138 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
+ 179 20012 int result = 0;
+ 180 20012 final String[] left = this .getName().split(":" );
+ 181 20012 final String[] right = vs.getName().split(":" );
+ 182 20012 final int max = (left.length <= right.length) ? left.length : right.length;
+ 183 20012 if (max > 0) {
+ 184 120502 for (int i = 0; result == 0 && i < max; i++) {
+ 185 100490 final String[] subLeft = left[i].split("\\." );
+ 186 100490 final String[] subRight = right[i].split("\\." );
+ 187 100490 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
+ 188 100490 if (subMax > 0) {
+ 189 229296 for (int x = 0; result == 0 && x < subMax; x++) {
+ 190 128806 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
191
try {
- 192 18719 result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x]));
+ 192 46904 result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x]));
193
194
@@ -376,21 +376,21 @@
205 0 result = subLeft[x].compareToIgnoreCase(subRight[x]);
206
}
- 207 18719 }
+ 207 46904 }
208
} else {
- 209 32419 result = subLeft[x].compareToIgnoreCase(subRight[x]);
+ 209 81902 result = subLeft[x].compareToIgnoreCase(subRight[x]);
210
}
211
}
- 212 39664 if (result == 0) {
- 213 31803 if (subLeft.length > subRight.length) {
- 214 18 result = 2;
+ 212 100490 if (result == 0) {
+ 213 80928 if (subLeft.length > subRight.length) {
+ 214 228 result = 2;
215
}
- 216 31803 if (subRight.length > subLeft.length) {
- 217 7 result = -2;
+ 216 80928 if (subRight.length > subLeft.length) {
+ 217 14 result = -2;
218
}
219
@@ -402,13 +402,13 @@
}
223
}
- 224 7939 if (result == 0) {
- 225 53 if (left.length > right.length) {
- 226 22 result = 2;
+ 224 20012 if (result == 0) {
+ 225 208 if (left.length > right.length) {
+ 226 136 result = 2;
227
}
- 228 53 if (right.length > left.length) {
- 229 10 result = -2;
+ 228 208 if (right.length > left.length) {
+ 229 20 result = -2;
230
}
231
@@ -418,7 +418,7 @@
233 0 result = this .getName().compareToIgnoreCase(vs.getName());
234
}
- 235 7939 return result;
+ 235 20012 return result;
236
}
237
@@ -437,19 +437,19 @@
244
private static boolean isPositiveInteger(final String str) {
- 245 69929 if (str == null || str.isEmpty()) {
- 246 14 return false ;
+ 245 175854 if (str == null || str.isEmpty()) {
+ 246 28 return false ;
247
}
- 248 115424 for (int i = 0; i < str.length(); i++) {
- 249 77914 final char c = str.charAt(i);
- 250 77914 if (c < '0' || c > '9' ) {
- 251 32405 return false ;
+ 248 285796 for (int i = 0; i < str.length(); i++) {
+ 249 191844 final char c = str.charAt(i);
+ 250 191844 if (c < '0' || c > '9' ) {
+ 251 81874 return false ;
252
}
253
}
- 254 37510 return true ;
+ 254 93952 return true ;
255
}
256
@@ -644,12 +644,12 @@
351
private String urlDecode(String string) {
- 352 2323 final String text = string.replace("+" , "%2B" );
+ 352 6608 final String text = string.replace("+" , "%2B" );
353
String result;
354
try {
- 355 2323 result = URLDecoder.decode(text, "UTF-8" );
+ 355 6608 result = URLDecoder.decode(text, "UTF-8" );
356 0 } catch (UnsupportedEncodingException ex) {
357
try {
@@ -657,14 +657,14 @@
359 0 } catch (UnsupportedEncodingException ex1) {
360 0 result = URLDecoder.decode(text);
361 0 }
- 362 2323 }
- 363 2323 return result;
+ 362 6608 }
+ 363 6608 return result;
364
}
365
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html
index 3e5c52e9f..5a8ae09aa 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html
@@ -155,6 +155,6 @@
} } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } } package org.owasp.dependencycheck.jaxb.pom.generated; } } } 110
public boolean matches(String text) {
- 111 22 if (text == null ) {
+ 111 68 if (text == null ) {
112 0 return false ;
113
}
- 114 22 if (this .regex) {
+ 114 68 if (this .regex) {
115
Pattern rx;
- 116 7 if (this .caseSensitive) {
- 117 2 rx = Pattern.compile(this .value);
+ 116 18 if (this .caseSensitive) {
+ 117 4 rx = Pattern.compile(this .value);
118
} else {
- 119 5 rx = Pattern.compile(this .value, Pattern.CASE_INSENSITIVE);
+ 119 14 rx = Pattern.compile(this .value, Pattern.CASE_INSENSITIVE);
120
}
- 121 7 return rx.matcher(text).matches();
+ 121 18 return rx.matcher(text).matches();
122
} else {
- 123 15 if (this .caseSensitive) {
- 124 2 return value.equals(text);
+ 123 50 if (this .caseSensitive) {
+ 124 4 return value.equals(text);
125
} else {
- 126 13 return value.equalsIgnoreCase(text);
+ 126 46 return value.equalsIgnoreCase(text);
127
}
128
@@ -308,28 +308,28 @@
@Override
153
public boolean equals(Object obj) {
- 154 1 if (obj == null ) {
+ 154 2 if (obj == null ) {
155 0 return false ;
156
}
- 157 1 if (getClass() != obj.getClass()) {
+ 157 2 if (getClass() != obj.getClass()) {
158 0 return false ;
159
}
- 160 1 final PropertyType other = (PropertyType) obj;
- 161 1 if ((this .value == null ) ? (other.value != null ) : !this .value.equals(other.value)) {
+ 160 2 final PropertyType other = (PropertyType) obj;
+ 161 2 if ((this .value == null ) ? (other.value != null ) : !this .value.equals(other.value)) {
162 0 return false ;
163
}
- 164 1 if (this .regex != other.regex) {
+ 164 2 if (this .regex != other.regex) {
165 0 return false ;
166
}
- 167 1 if (this .caseSensitive != other.caseSensitive) {
+ 167 2 if (this .caseSensitive != other.caseSensitive) {
168 0 return false ;
169
}
- 170 1 return true ;
+ 170 2 return true ;
171
}
172
@@ -357,6 +357,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html
index d3b6b6c48..498431682 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html
@@ -87,7 +87,7 @@
35
- 36 1 private static final Logger LOGGER = Logger.getLogger(SuppressionErrorHandler.class .getName());
+ 36 2 private static final Logger LOGGER = Logger.getLogger(SuppressionErrorHandler.class .getName());
37
38
@@ -197,6 +197,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html
index 9b200afc8..24ba36793 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html
@@ -12,7 +12,7 @@
@@ -77,7 +77,7 @@
30
- 31 5 public class SuppressionHandler extends DefaultHandler {
+ 31 20 public class SuppressionHandler extends DefaultHandler {
32
33
@@ -131,200 +131,207 @@
57
58
-
+ 59
60
- public static final String CVSS_BELOW = "cvssBelow" ;
+ public static final String GAV = "gav" ; 61
62
-
+ 63
- 64 5 private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
+ 64
+ public static final String CVSS_BELOW = "cvssBelow" ;
65
-
+ 66
-
+ 67
-
- 68
-
+ 68 20 private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
69
-
+ 70
-
- 71
- public List<SuppressionRule> getSuppressionRules() {
- 72
- return suppressionRules;
- 73
- }
- 74
- 75
-
- 76
+ 71
+
+ 72
+
+ 73
+
+ 74
+ 75
+ public List<SuppressionRule> getSuppressionRules() {
+ 76
+ return suppressionRules;
77
- private SuppressionRule rule;
+ } 78
79
-
+ 80
81
- private Attributes currentAttributes;
+ private SuppressionRule rule; 82
83
-
+ 84
85
- private StringBuffer currentText;
+ private Attributes currentAttributes; 86
-
+ 87
-
+ 88
-
+ 89
-
+ private StringBuffer currentText; 90
-
+ 91
-
+ 92
-
+ 93
-
+ 94
-
+ 95
-
+ 96
- @Override
+ 97
- public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
- 98 80 currentAttributes = null ;
- 99 80 currentText = new StringBuffer();
- 100
-
- 101 80 if (SUPPRESS.equals(qName)) {
- 102 20 rule = new SuppressionRule();
- 103 60 } else if (FILE_PATH.equals(qName)) {
- 104 12 currentAttributes = attributes;
- 105
- }
- 106 80 }
- 107
-
- 108
-
- 109
-
- 110
-
- 111
-
- 112
-
- 113
-
- 114
+
+ 98
- 115
+ 99
- 116
+ 100
@Override
- 117
- public void endElement(String uri, String localName, String qName) throws SAXException {
- 118 80 if (SUPPRESS.equals(qName)) {
- 119 20 suppressionRules.add(rule);
- 120 20 rule = null ;
- 121 60 } else if (FILE_PATH.equals(qName)) {
- 122 12 final PropertyType pt = processPropertyType();
- 123 12 rule.setFilePath(pt);
- 124 12 } else if (SHA1.equals(qName)) {
- 125 4 rule.setSha1(currentText.toString());
- 126 44 } else if (CPE.equals(qName)) {
- 127 8 final PropertyType pt = processPropertyType();
- 128 8 rule.addCpe(pt);
- 129 8 } else if (CWE.equals(qName)) {
- 130 0 rule.addCwe(currentText.toString());
- 131 36 } else if (CVE.equals(qName)) {
- 132 8 rule.addCve(currentText.toString());
- 133 28 } else if (CVSS_BELOW.equals(qName)) {
- 134 4 final float cvss = Float.parseFloat(currentText.toString());
- 135 4 rule.addCvssBelow(cvss);
- 136
+ 101
+ public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
+ 102 230 currentAttributes = attributes;
+ 103 230 currentText = new StringBuffer();
+ 104 230 if (SUPPRESS.equals(qName)) {
+ 105 50 rule = new SuppressionRule();
+ 106
}
- 137 80 }
- 138
+ 107 230 }
+ 108
- 139
+ 109
- 140
-
- 141
+ 110
+
+ 111
- 142
-
- 143
-
- 144
-
- 145
-
- 146
+ 112
+
+ 113
+
+ 114
+
+ 115
+
+ 116
- 147
+ 117
@Override
- 148
- public void characters(char [] ch, int start, int length) throws SAXException {
- 149 176 currentText.append(ch, start, length);
- 150 176 }
- 151
+ 118
+ public void endElement(String uri, String localName, String qName) throws SAXException {
+ 119 230 if (SUPPRESS.equals(qName)) {
+ 120 50 suppressionRules.add(rule);
+ 121 50 rule = null ;
+ 122 180 } else if (FILE_PATH.equals(qName)) {
+ 123 24 final PropertyType pt = processPropertyType();
+ 124 24 rule.setFilePath(pt);
+ 125 24 } else if (SHA1.equals(qName)) {
+ 126 8 rule.setSha1(currentText.toString());
+ 127 148 } else if (GAV.equals(qName)) {
+ 128 10 final PropertyType pt = processPropertyType();
+ 129 10 rule.setGav(pt);
+ 130 10 } else if (CPE.equals(qName)) {
+ 131 46 final PropertyType pt = processPropertyType();
+ 132 46 rule.addCpe(pt);
+ 133 46 } else if (CWE.equals(qName)) {
+ 134 0 rule.addCwe(currentText.toString());
+ 135 92 } else if (CVE.equals(qName)) {
+ 136 16 rule.addCve(currentText.toString());
+ 137 76 } else if (CVSS_BELOW.equals(qName)) {
+ 138 8 final float cvss = Float.parseFloat(currentText.toString());
+ 139 8 rule.addCvssBelow(cvss);
+ 140
+ }
+ 141 230 }
+ 142
- 152
+ 143
- 153
-
- 154
-
- 155
+ 144
+
+ 145
- 156
-
- 157
+ 146
+
+ 147
+
+ 148
+
+ 149
+
+ 150
+ 151
+ @Override
+ 152
+ public void characters(char [] ch, int start, int length) throws SAXException {
+ 153 492 currentText.append(ch, start, length);
+ 154 492 }
+ 155
+
+ 156
+
+ 157
+
158
+
+ 159
+
+ 160
+
+ 161
+
+ 162
private PropertyType processPropertyType() {
- 159 20 final PropertyType pt = new PropertyType();
- 160 20 pt.setValue(currentText.toString());
- 161 20 if (currentAttributes != null && currentAttributes.getLength() > 0) {
- 162 12 final String regex = currentAttributes.getValue("regex" );
- 163 12 if (regex != null ) {
- 164 12 pt.setRegex(Boolean.parseBoolean(regex));
- 165
- }
- 166 12 final String caseSensitive = currentAttributes.getValue("caseSensitive" );
- 167 12 if (caseSensitive != null ) {
- 168 12 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
+ 163 80 final PropertyType pt = new PropertyType();
+ 164 80 pt.setValue(currentText.toString());
+ 165 80 if (currentAttributes != null && currentAttributes.getLength() > 0) {
+ 166 80 final String regex = currentAttributes.getValue("regex" );
+ 167 80 if (regex != null ) {
+ 168 80 pt.setRegex(Boolean.parseBoolean(regex));
169
}
- 170
- }
- 171 20 return pt;
- 172
- }
+ 170 80 final String caseSensitive = currentAttributes.getValue("caseSensitive" );
+ 171 80 if (caseSensitive != null ) {
+ 172 80 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
173
+ }
+ 174
+ }
+ 175 80 return pt;
+ 176
+ }
+ 177
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html
index 89baed5f6..85299de1c 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html
@@ -155,6 +155,6 @@
} 46
- 47 1 private static final Logger LOGGER = Logger.getLogger(SuppressionParser.class .getName());
+ 47 2 private static final Logger LOGGER = Logger.getLogger(SuppressionParser.class .getName());
48
49
@@ -154,41 +154,41 @@
public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException {
69
try {
- 70 4 final InputStream schemaStream = this .getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd" );
- 71 4 final SuppressionHandler handler = new SuppressionHandler();
+ 70 18 final InputStream schemaStream = this .getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd" );
+ 71 18 final SuppressionHandler handler = new SuppressionHandler();
72
- 73 4 final SAXParserFactory factory = SAXParserFactory.newInstance();
- 74 4 factory.setNamespaceAware(true );
- 75 4 factory.setValidating(true );
- 76 4 final SAXParser saxParser = factory.newSAXParser();
- 77 4 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
- 78 4 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
- 79 4 final XMLReader xmlReader = saxParser.getXMLReader();
- 80 4 xmlReader.setErrorHandler(new SuppressionErrorHandler());
- 81 4 xmlReader.setContentHandler(handler);
+ 73 18 final SAXParserFactory factory = SAXParserFactory.newInstance();
+ 74 18 factory.setNamespaceAware(true );
+ 75 18 factory.setValidating(true );
+ 76 18 final SAXParser saxParser = factory.newSAXParser();
+ 77 18 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
+ 78 18 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
+ 79 18 final XMLReader xmlReader = saxParser.getXMLReader();
+ 80 18 xmlReader.setErrorHandler(new SuppressionErrorHandler());
+ 81 18 xmlReader.setContentHandler(handler);
82
- 83 4 final InputStream inputStream = new FileInputStream(file);
- 84 3 final Reader reader = new InputStreamReader(inputStream, "UTF-8" );
- 85 3 final InputSource in = new InputSource(reader);
+ 83 18 final InputStream inputStream = new FileInputStream(file);
+ 84 16 final Reader reader = new InputStreamReader(inputStream, "UTF-8" );
+ 85 16 final InputSource in = new InputSource(reader);
86
87
- 88 3 xmlReader.parse(in);
+ 88 16 xmlReader.parse(in);
89
- 90 3 return handler.getSuppressionRules();
+ 90 16 return handler.getSuppressionRules();
91 0 } catch (ParserConfigurationException ex) {
92 0 LOGGER.log(Level.FINE, null , ex);
93 0 throw new SuppressionParseException(ex);
94 0 } catch (SAXException ex) {
95 0 LOGGER.log(Level.FINE, null , ex);
96 0 throw new SuppressionParseException(ex);
- 97 1 } catch (FileNotFoundException ex) {
- 98 1 LOGGER.log(Level.FINE, null , ex);
- 99 1 throw new SuppressionParseException(ex);
+ 97 2 } catch (FileNotFoundException ex) {
+ 98 2 LOGGER.log(Level.FINE, null , ex);
+ 99 2 throw new SuppressionParseException(ex);
100 0 } catch (IOException ex) {
101 0 LOGGER.log(Level.FINE, null , ex);
102 0 throw new SuppressionParseException(ex);
@@ -200,6 +200,6 @@
}
@@ -77,7 +77,7 @@
30
- 31 33 public class SuppressionRule {
+ 31 78 public class SuppressionRule {
32
33
@@ -174,7 +174,7 @@
79
- 80 33 private List<PropertyType> cpe = new ArrayList<PropertyType>();
+ 80 78 private List<PropertyType> cpe = new ArrayList<PropertyType>();
81
82
@@ -225,8 +225,8 @@
105
public void addCpe(PropertyType cpe) {
- 106 12 this .cpe.add(cpe);
- 107 12 }
+ 106 60 this .cpe.add(cpe);
+ 107 60 }
108
109
@@ -241,7 +241,7 @@
114
public boolean hasCpe() {
- 115 10 return cpe.size() > 0;
+ 115 22 return cpe.size() > 0;
116
}
117
@@ -250,7 +250,7 @@
119
- 120 33 private List<Float> cvssBelow = new ArrayList<Float>();
+ 120 78 private List<Float> cvssBelow = new ArrayList<Float>();
121
122
@@ -301,8 +301,8 @@
145
public void addCvssBelow(Float cvss) {
- 146 7 this .cvssBelow.add(cvss);
- 147 7 }
+ 146 14 this .cvssBelow.add(cvss);
+ 147 14 }
148
149
@@ -317,7 +317,7 @@
154
public boolean hasCvssBelow() {
- 155 7 return cvssBelow.size() > 0;
+ 155 16 return cvssBelow.size() > 0;
156
}
157
@@ -326,7 +326,7 @@
159
- 160 33 private List<String> cwe = new ArrayList<String>();
+ 160 78 private List<String> cwe = new ArrayList<String>();
161
162
@@ -377,8 +377,8 @@
185
public void addCwe(String cwe) {
- 186 2 this .cwe.add(cwe);
- 187 2 }
+ 186 4 this .cwe.add(cwe);
+ 187 4 }
188
189
@@ -393,7 +393,7 @@
194
public boolean hasCwe() {
- 195 8 return cwe.size() > 0;
+ 195 18 return cwe.size() > 0;
196
}
197
@@ -402,7 +402,7 @@
199
- 200 33 private List<String> cve = new ArrayList<String>();
+ 200 78 private List<String> cve = new ArrayList<String>();
201
202
@@ -453,8 +453,8 @@
225
public void addCve(String cve) {
- 226 11 this .cve.add(cve);
- 227 11 }
+ 226 22 this .cve.add(cve);
+ 227 22 }
228
229
@@ -469,194 +469,338 @@
234
public boolean hasCve() {
- 235 10 return cve.size() > 0;
+ 235 22 return cve.size() > 0;
236
}
237
-
+ 238
-
+ 239
-
- 240
-
+ 240 78 private PropertyType gav = null ;
241
-
+ 242
-
+ 243
-
+ 244
- public void process(Dependency dependency) {
- 245 9 if (filePath != null && !filePath.matches(dependency.getFilePath())) {
- 246 0 return ;
+ 245
+
+ 246
+
247
- }
- 248 9 if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
- 249 1 return ;
+ public PropertyType getGav() { 248
+ return gav;
+ 249
+ }
250
- }
- 251 8 if (this .hasCpe()) {
- 252 3 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
- 253 8 while (itr.hasNext()) {
- 254 5 final Identifier i = itr.next();
- 255 5 for (PropertyType c : this .cpe) {
- 256 9 if (cpeMatches(c, i)) {
- 257 4 dependency.addSuppressedIdentifier(i);
- 258 4 itr.remove();
- 259 4 break ;
+ 251
+
+ 252
+
+ 253
+
+ 254
+
+ 255
+
+ 256
+ public void setGav(PropertyType gav) {
+ 257
+ this .gav = gav;
+ 258
+ }
+ 259
+
260
- }
- 261 5 }
- 262 5 }
+ 261
+
+ 262
+
263
- }
- 264 8 if (hasCve() || hasCwe() || hasCvssBelow()) {
- 265 5 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
- 266 10 while (itr.hasNext()) {
- 267 5 boolean remove = false ;
- 268 5 final Vulnerability v = itr.next();
- 269 5 for (String entry : this .cve) {
- 270 3 if (entry.equalsIgnoreCase(v.getName())) {
- 271 1 remove = true ;
- 272 1 break ;
+ 264
+
+ 265
+ public boolean hasGav() {
+ 266 0 return gav != null ;
+ 267
+ }
+ 268
+
+ 269
+
+ 270
+
+ 271
+
+ 272
+
273
- }
- 274 2 }
- 275 5 if (!remove) {
- 276 4 for (String entry : this .cwe) {
- 277 1 if (v.getCwe() != null ) {
- 278 1 final String toMatch = String.format("CWE-%s " , entry);
- 279 1 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
- 280 1 if (toTest.equals(toMatch)) {
- 281 1 remove = true ;
- 282 1 break ;
- 283
- }
- 284
- }
- 285 0 }
- 286
+
+ 274
+
+ 275
+ public void process(Dependency dependency) {
+ 276 28 if (filePath != null && !filePath.matches(dependency.getFilePath())) {
+ 277 0 return ;
+ 278
+ }
+ 279 28 if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
+ 280 2 return ;
+ 281
+ }
+ 282 26 if (gav != null ) {
+ 283 10 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+ 284 10 boolean gavFound = false ;
+ 285 26 while (itr.hasNext()) {
+ 286 18 final Identifier i = itr.next();
+ 287 18 if (identifierMatches("maven" , this .gav, i)) {
+ 288 2 gavFound = true ;
+ 289 2 break ;
+ 290
}
- 287 5 if (!remove) {
- 288 3 for (float cvss : this .cvssBelow) {
- 289 3 if (v.getCvssScore() < cvss) {
- 290 1 remove = true ;
- 291 1 break ;
- 292
- }
- 293 2 }
+ 291 16 }
+ 292 10 if (!gavFound) {
+ 293 8 return ;
294
- }
- 295 5 if (remove) {
- 296 3 dependency.addSuppressedVulnerability(v);
- 297 3 itr.remove();
- 298
- }
- 299 5 }
- 300
- }
- 301 8 }
- 302
-
- 303
-
- 304
-
- 305
-
- 306
-
- 307
-
- 308
-
- 309
- boolean cpeHasNoVersion(PropertyType c) {
- 310 14 if (c.isRegex()) {
- 311 2 return false ;
- 312
- }
- 313 12 if (countCharacter(c.getValue(), ':' ) == 3) {
- 314 3 return true ;
- 315
- }
- 316 9 return false ;
- 317
- }
- 318
-
- 319
-
- 320
-
- 321
-
- 322
-
- 323
-
- 324
-
- 325
-
- 326
- int countCharacter(String str, char c) {
- 327 15 int count = 0;
- 328 15 int pos = str.indexOf(c) + 1;
- 329 66 while (pos > 0) {
- 330 51 count += 1;
- 331 51 pos = str.indexOf(c, pos) + 1;
- 332
- }
- 333 15 return count;
- 334
- }
- 335
-
- 336
-
- 337
-
- 338
-
- 339
-
- 340
-
- 341
-
- 342
-
- 343
- boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) {
- 344 16 if (cpeEntry.matches(identifier.getValue())) {
- 345 5 return true ;
- 346 11 } else if (cpeHasNoVersion(cpeEntry)) {
- 347 2 if (cpeEntry.isCaseSensitive()) {
- 348 0 if (identifier.getValue().startsWith(cpeEntry.getValue())) {
- 349 0 return true ;
- 350
- }
- 351
- } else {
- 352 2 final String id = identifier.getValue().toLowerCase();
- 353 2 final String check = cpeEntry.getValue().toLowerCase();
- 354 2 if (id.startsWith(check)) {
- 355 2 return true ;
- 356
- }
- 357
}
+ 295
+ }
+ 296
+
+ 297 18 if (this .hasCpe()) {
+ 298 8 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+ 299 28 while (itr.hasNext()) {
+ 300 20 final Identifier i = itr.next();
+ 301 20 for (PropertyType c : this .cpe) {
+ 302 42 if (identifierMatches("cpe" , c, i)) {
+ 303 14 dependency.addSuppressedIdentifier(i);
+ 304 14 itr.remove();
+ 305 14 break ;
+ 306
+ }
+ 307 28 }
+ 308 20 }
+ 309
+ }
+ 310 18 if (hasCve() || hasCwe() || hasCvssBelow()) {
+ 311 10 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
+ 312 20 while (itr.hasNext()) {
+ 313 10 boolean remove = false ;
+ 314 10 final Vulnerability v = itr.next();
+ 315 10 for (String entry : this .cve) {
+ 316 6 if (entry.equalsIgnoreCase(v.getName())) {
+ 317 2 remove = true ;
+ 318 2 break ;
+ 319
+ }
+ 320 4 }
+ 321 10 if (!remove) {
+ 322 8 for (String entry : this .cwe) {
+ 323 2 if (v.getCwe() != null ) {
+ 324 2 final String toMatch = String.format("CWE-%s " , entry);
+ 325 2 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
+ 326 2 if (toTest.equals(toMatch)) {
+ 327 2 remove = true ;
+ 328 2 break ;
+ 329
+ }
+ 330
+ }
+ 331 0 }
+ 332
+ }
+ 333 10 if (!remove) {
+ 334 6 for (float cvss : this .cvssBelow) {
+ 335 6 if (v.getCvssScore() < cvss) {
+ 336 2 remove = true ;
+ 337 2 break ;
+ 338
+ }
+ 339 4 }
+ 340
+ }
+ 341 10 if (remove) {
+ 342 6 dependency.addSuppressedVulnerability(v);
+ 343 6 itr.remove();
+ 344
+ }
+ 345 10 }
+ 346
+ }
+ 347 18 }
+ 348
+
+ 349
+
+ 350
+
+ 351
+
+ 352
+
+ 353
+
+ 354
+
+ 355
+ boolean cpeHasNoVersion(PropertyType c) {
+ 356 46 if (c.isRegex()) {
+ 357 4 return false ;
358
}
- 359 9 return false ;
- 360
- }
+ 359 42 if (countCharacter(c.getValue(), ':' ) == 3) {
+ 360 24 return true ;
361
+ }
+ 362 18 return false ;
+ 363
+ }
+ 364
+
+ 365
+
+ 366
+
+ 367
+
+ 368
+
+ 369
+
+ 370
+
+ 371
+
+ 372
+ int countCharacter(String str, char c) {
+ 373 48 int count = 0;
+ 374 48 int pos = str.indexOf(c) + 1;
+ 375 204 while (pos > 0) {
+ 376 156 count += 1;
+ 377 156 pos = str.indexOf(c, pos) + 1;
+ 378
+ }
+ 379 48 return count;
+ 380
+ }
+ 381
+
+ 382
+
+ 383
+
+ 384
+
+ 385
+
+ 386
+
+ 387
+
+ 388
+
+ 389
+
+ 390
+ boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) {
+ 391 78 if (identifierType.equals(identifier.getType())) {
+ 392 56 if (suppressionEntry.matches(identifier.getValue())) {
+ 393 14 return true ;
+ 394 42 } else if ("cpe" .equals(identifierType) && cpeHasNoVersion(suppressionEntry)) {
+ 395 22 if (suppressionEntry.isCaseSensitive()) {
+ 396 0 return identifier.getValue().startsWith(suppressionEntry.getValue());
+ 397
+ } else {
+ 398 22 final String id = identifier.getValue().toLowerCase();
+ 399 22 final String check = suppressionEntry.getValue().toLowerCase();
+ 400 22 return id.startsWith(check);
+ 401
+ }
+ 402
+ }
+ 403
+ }
+ 404 42 return false ;
+ 405
+ }
+ 406
+
+ 407
+
+ 408
+
+ 409
+
+ 410
+
+ 411
+
+ 412
+ @Override
+ 413
+ public String toString() {
+ 414 0 final StringBuilder sb = new StringBuilder();
+ 415 0 sb.append("SuppressionRule{" );
+ 416 0 if (filePath != null ) {
+ 417 0 sb.append("filePath=" ).append(filePath).append("," );
+ 418
+ }
+ 419 0 if (sha1 != null ) {
+ 420 0 sb.append("sha1=" ).append(sha1).append("," );
+ 421
+ }
+ 422 0 if (gav != null ) {
+ 423 0 sb.append("gav=" ).append(gav).append("," );
+ 424
+ }
+ 425 0 if (cpe != null && cpe.size() > 0) {
+ 426 0 sb.append("cpe={" );
+ 427 0 for (PropertyType pt : cpe) {
+ 428 0 sb.append(pt).append("," );
+ 429 0 }
+ 430 0 sb.append("}" );
+ 431
+ }
+ 432 0 if (cwe != null && cwe.size() > 0) {
+ 433 0 sb.append("cwe={" );
+ 434 0 for (String s : cwe) {
+ 435 0 sb.append(s).append("," );
+ 436 0 }
+ 437 0 sb.append("}" );
+ 438
+ }
+ 439 0 if (cve != null && cve.size() > 0) {
+ 440 0 sb.append("cve={" );
+ 441 0 for (String s : cve) {
+ 442 0 sb.append(s).append("," );
+ 443 0 }
+ 444 0 sb.append("}" );
+ 445
+ }
+ 446 0 if (cvssBelow != null && cvssBelow.size() > 0) {
+ 447 0 sb.append("cvssBelow={" );
+ 448 0 for (Float s : cvssBelow) {
+ 449 0 sb.append(s).append("," );
+ 450 0 }
+ 451 0 sb.append("}" );
+ 452
+ }
+ 453 0 sb.append("}" );
+ 454 0 return sb.toString();
+ 455
+ }
+ 456
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html
index f4517829f..4d128305a 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html
@@ -69,7 +69,7 @@
26
- 27 1 private static final Logger LOGGER = Logger.getLogger(Checksum.class .getName());
+ 27 2 private static final Logger LOGGER = Logger.getLogger(Checksum.class .getName());
28
29
@@ -108,36 +108,36 @@
46
public static byte [] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException {
- 47 38 InputStream fis = null ;
- 48 38 byte [] buffer = new byte [1024];
- 49 38 MessageDigest complete = MessageDigest.getInstance(algorithm);
+ 47 80 InputStream fis = null ;
+ 48 80 byte [] buffer = new byte [1024];
+ 49 80 MessageDigest complete = MessageDigest.getInstance(algorithm);
50
int numRead;
51
try {
- 52 37 fis = new FileInputStream(file);
+ 52 78 fis = new FileInputStream(file);
53
do {
- 54 13356 numRead = fis.read(buffer);
- 55 13356 if (numRead > 0) {
- 56 13323 complete.update(buffer, 0, numRead);
+ 54 27616 numRead = fis.read(buffer);
+ 55 27616 if (numRead > 0) {
+ 56 27546 complete.update(buffer, 0, numRead);
57
}
- 58 13356 } while (numRead != -1);
+ 58 27616 } while (numRead != -1);
59
} finally {
- 60 37 if (fis != null ) {
+ 60 78 if (fis != null ) {
61
try {
- 62 33 fis.close();
+ 62 70 fis.close();
63 0 } catch (IOException ex) {
64 0 LOGGER.log(Level.FINEST, "Error closing file '" + file.getName() + "'." , ex);
- 65 37 }
+ 65 78 }
66
}
67
}
- 68 33 return complete.digest();
+ 68 70 return complete.digest();
69
}
70
@@ -160,8 +160,8 @@
79
public static String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException {
- 80 19 byte [] b = getChecksum("MD5" , file);
- 81 16 return getHex(b);
+ 80 40 byte [] b = getChecksum("MD5" , file);
+ 81 34 return getHex(b);
82
}
83
@@ -184,8 +184,8 @@
92
public static String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException {
- 93 16 byte [] b = getChecksum("SHA1" , file);
- 94 16 return getHex(b);
+ 93 34 byte [] b = getChecksum("SHA1" , file);
+ 94 34 return getHex(b);
95
}
96
@@ -212,22 +212,22 @@
107
public static String getHex(byte [] raw) {
- 108 33 if (raw == null ) {
+ 108 70 if (raw == null ) {
109 0 return null ;
110
}
- 111 33 final StringBuilder hex = new StringBuilder(2 * raw.length);
- 112 626 for (final byte b : raw) {
- 113 593 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
+ 111 70 final StringBuilder hex = new StringBuilder(2 * raw.length);
+ 112 1328 for (final byte b : raw) {
+ 113 1258 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
114
}
- 115 33 return hex.toString();
+ 115 70 return hex.toString();
116
}
117
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html
index 7c6944b98..d275c8597 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html
@@ -89,7 +89,7 @@
36
- 37 1 private static final Logger LOGGER = Logger.getLogger(DBUtils.class .getName());
+ 37 2 private static final Logger LOGGER = Logger.getLogger(DBUtils.class .getName());
38
39
@@ -150,16 +150,16 @@
72
public static void closeStatement(Statement statement) {
- 73 20 if (statement != null ) {
+ 73 70 if (statement != null ) {
74
try {
- 75 20 statement.close();
+ 75 70 statement.close();
76 0 } catch (SQLException ex) {
77 0 LOGGER.log(Level.FINEST, statement.toString(), ex);
- 78 20 }
+ 78 70 }
79
}
- 80 20 }
+ 80 70 }
81
82
@@ -174,20 +174,20 @@
87
public static void closeResultSet(ResultSet rs) {
- 88 22 if (rs != null ) {
+ 88 74 if (rs != null ) {
89
try {
- 90 22 rs.close();
+ 90 74 rs.close();
91 0 } catch (SQLException ex) {
92 0 LOGGER.log(Level.FINEST, rs.toString(), ex);
- 93 22 }
+ 93 74 }
94
}
- 95 22 }
+ 95 74 }
96
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html
index 28902a829..ca2244d01 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html
@@ -95,7 +95,7 @@
39
- 40 14 public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
+ 40 28 public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
41
42
@@ -124,9 +124,9 @@
54
- 55 327 public DependencyVersion(String version) {
- 56 327 parseVersion(version);
- 57 327 }
+ 55 1448 public DependencyVersion(String version) {
+ 56 1448 parseVersion(version);
+ 57 1448 }
58
59
@@ -143,21 +143,21 @@
65
public final void parseVersion(String version) {
- 66 329 versionParts = new ArrayList<String>();
- 67 329 if (version != null ) {
- 68 329 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)" );
- 69 329 final Matcher matcher = rx.matcher(version.toLowerCase());
- 70 1377 while (matcher.find()) {
- 71 1048 versionParts.add(matcher.group());
+ 66 1452 versionParts = new ArrayList<String>();
+ 67 1452 if (version != null ) {
+ 68 1452 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)" );
+ 69 1452 final Matcher matcher = rx.matcher(version.toLowerCase());
+ 70 6106 while (matcher.find()) {
+ 71 4654 versionParts.add(matcher.group());
72
}
- 73 329 if (versionParts.isEmpty()) {
- 74 6 versionParts.add(version);
+ 73 1452 if (versionParts.isEmpty()) {
+ 74 12 versionParts.add(version);
75
}
76
}
- 77 329 }
+ 77 1452 }
78
79
@@ -216,7 +216,7 @@
106
public Iterator iterator() {
- 107 1 return versionParts.iterator();
+ 107 2 return versionParts.iterator();
108
}
109
@@ -235,7 +235,7 @@
@Override
116
public String toString() {
- 117 59 return StringUtils.join(versionParts.toArray(), "." );
+ 117 170 return StringUtils.join(versionParts.toArray(), "." );
118
}
119
@@ -256,30 +256,30 @@
@Override
127
public boolean equals(Object obj) {
- 128 268 if (obj == null ) {
+ 128 1330 if (obj == null ) {
129 0 return false ;
130
}
- 131 268 if (getClass() != obj.getClass()) {
+ 131 1330 if (getClass() != obj.getClass()) {
132 0 return false ;
133
}
- 134 268 final DependencyVersion other = (DependencyVersion) obj;
- 135 268 final int max = (this .versionParts.size() < other.versionParts.size())
+ 134 1330 final DependencyVersion other = (DependencyVersion) obj;
+ 135 1330 final int max = (this .versionParts.size() < other.versionParts.size())
136
? this .versionParts.size() : other.versionParts.size();
137
- 138 679 for (int i = 0; i < max; i++) {
- 139 595 final String thisPart = this .versionParts.get(i);
- 140 595 final String otherPart = other.versionParts.get(i);
- 141 595 if (!thisPart.equals(otherPart)) {
- 142 184 return false ;
+ 138 2886 for (int i = 0; i < max; i++) {
+ 139 2564 final String thisPart = this .versionParts.get(i);
+ 140 2564 final String otherPart = other.versionParts.get(i);
+ 141 2564 if (!thisPart.equals(otherPart)) {
+ 142 1008 return false ;
143
}
144
}
- 145 84 if (this .versionParts.size() > max) {
+ 145 322 if (this .versionParts.size() > max) {
146 0 for (int i = max; i < this .versionParts.size(); i++) {
147 0 if (!"0" .equals(this .versionParts.get(i))) {
148 0 return false ;
@@ -291,10 +291,10 @@
} 152
- 153 84 if (other.versionParts.size() > max) {
- 154 57 for (int i = max; i < other.versionParts.size(); i++) {
- 155 57 if (!"0" .equals(other.versionParts.get(i))) {
- 156 57 return false ;
+ 153 322 if (other.versionParts.size() > max) {
+ 154 258 for (int i = max; i < other.versionParts.size(); i++) {
+ 155 258 if (!"0" .equals(other.versionParts.get(i))) {
+ 156 258 return false ;
157
}
158
@@ -313,7 +313,7 @@
165
- 166 27 return true ;
+ 166 64 return true ;
167
}
168
@@ -332,9 +332,9 @@
@Override
175
public int hashCode() {
- 176 1 int hash = 5;
- 177 1 hash = 71 * hash + (this .versionParts != null ? this .versionParts.hashCode() : 0);
- 178 1 return hash;
+ 176 2 int hash = 5;
+ 177 2 hash = 71 * hash + (this .versionParts != null ? this .versionParts.hashCode() : 0);
+ 178 2 return hash;
179
}
180
@@ -355,35 +355,35 @@
188
public boolean matchesAtLeastThreeLevels(DependencyVersion version) {
- 189 228 if (version == null ) {
+ 189 1208 if (version == null ) {
190 0 return false ;
191
}
192
- 193 228 boolean ret = true ;
- 194 228 int max = (this .versionParts.size() < version.versionParts.size())
+ 193 1208 boolean ret = true ;
+ 194 1208 int max = (this .versionParts.size() < version.versionParts.size())
195
? this .versionParts.size() : version.versionParts.size();
196
- 197 228 if (max > 3) {
- 198 2 max = 3;
+ 197 1208 if (max > 3) {
+ 198 4 max = 3;
199
}
200
- 201 563 for (int i = 0; i < max; i++) {
- 202 505 if (this .versionParts.get(i) == null || !this .versionParts.get(i).equals(version.versionParts.get(i))) {
- 203 170 ret = false ;
- 204 170 break ;
+ 201 2582 for (int i = 0; i < max; i++) {
+ 202 2322 if (this .versionParts.get(i) == null || !this .versionParts.get(i).equals(version.versionParts.get(i))) {
+ 203 948 ret = false ;
+ 204 948 break ;
205
}
206
}
207
- 208 228 return ret;
+ 208 1208 return ret;
209
}
210
@@ -392,36 +392,36 @@
@Override
212
public int compareTo(DependencyVersion version) {
- 213 19 if (version == null ) {
+ 213 38 if (version == null ) {
214 0 return 1;
215
}
- 216 19 final List<String> left = this .getVersionParts();
- 217 19 final List<String> right = version.getVersionParts();
- 218 19 final int max = left.size() < right.size() ? left.size() : right.size();
+ 216 38 final List<String> left = this .getVersionParts();
+ 217 38 final List<String> right = version.getVersionParts();
+ 218 38 final int max = left.size() < right.size() ? left.size() : right.size();
219
- 220 45 for (int i = 0; i < max; i++) {
- 221 38 final String lStr = left.get(i);
- 222 38 final String rStr = right.get(i);
- 223 38 if (lStr.equals(rStr)) {
- 224 26 continue ;
+ 220 90 for (int i = 0; i < max; i++) {
+ 221 76 final String lStr = left.get(i);
+ 222 76 final String rStr = right.get(i);
+ 223 76 if (lStr.equals(rStr)) {
+ 224 52 continue ;
225
}
226
try {
- 227 12 final int l = Integer.parseInt(lStr);
- 228 7 final int r = Integer.parseInt(rStr);
- 229 7 if (l < r) {
- 230 5 return -1;
- 231 2 } else if (l > r) {
- 232 2 return 1;
+ 227 24 final int l = Integer.parseInt(lStr);
+ 228 14 final int r = Integer.parseInt(rStr);
+ 229 14 if (l < r) {
+ 230 10 return -1;
+ 231 4 } else if (l > r) {
+ 232 4 return 1;
233
}
- 234 5 } catch (NumberFormatException ex) {
- 235 5 final int comp = left.get(i).compareTo(right.get(i));
- 236 5 if (comp < 0) {
- 237 5 return -1;
+ 234 10 } catch (NumberFormatException ex) {
+ 235 10 final int comp = left.get(i).compareTo(right.get(i));
+ 236 10 if (comp < 0) {
+ 237 10 return -1;
238 0 } else if (comp > 0) {
239 0 return 1;
240
@@ -429,13 +429,13 @@
241 0 }
242
}
- 243 7 if (left.size() < right.size()) {
- 244 3 return -1;
- 245 4 } else if (left.size() > right.size()) {
- 246 3 return 1;
+ 243 14 if (left.size() < right.size()) {
+ 244 6 return -1;
+ 245 8 } else if (left.size() > right.size()) {
+ 246 6 return 1;
247
} else {
- 248 1 return 0;
+ 248 2 return 0;
249
}
250
@@ -444,6 +444,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html
index aeade4435..d3e9af8be 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html
@@ -85,7 +85,7 @@
34
- 35 1 private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
+ 35 2 private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
36
37
@@ -94,7 +94,7 @@
39
- 40 1 private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
+ 40 2 private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?" );
41
42
@@ -131,56 +131,56 @@
58
public static DependencyVersion parseVersion(String text) {
- 59 298 if (text == null ) {
+ 59 1390 if (text == null ) {
60 0 return null ;
61
}
62
- 63 298 if ("-" .equals(text)) {
- 64 1 final DependencyVersion dv = new DependencyVersion();
- 65 1 final ArrayList<String> list = new ArrayList<String>();
- 66 1 list.add(text);
- 67 1 dv.setVersionParts(list);
- 68 1 return dv;
+ 63 1390 if ("-" .equals(text)) {
+ 64 2 final DependencyVersion dv = new DependencyVersion();
+ 65 2 final ArrayList<String> list = new ArrayList<String>();
+ 66 2 list.add(text);
+ 67 2 dv.setVersionParts(list);
+ 68 2 return dv;
69
}
- 70 297 String version = null ;
- 71 297 Matcher matcher = RX_VERSION.matcher(text);
- 72 297 if (matcher.find()) {
- 73 293 version = matcher.group();
+ 70 1388 String version = null ;
+ 71 1388 Matcher matcher = RX_VERSION.matcher(text);
+ 72 1388 if (matcher.find()) {
+ 73 1380 version = matcher.group();
74
}
75
- 76 297 if (matcher.find()) {
- 77 2 return null ;
+ 76 1388 if (matcher.find()) {
+ 77 4 return null ;
78
}
- 79 295 if (version == null ) {
- 80 4 matcher = RX_SINGLE_VERSION.matcher(text);
- 81 4 if (matcher.find()) {
- 82 2 version = matcher.group();
+ 79 1384 if (version == null ) {
+ 80 8 matcher = RX_SINGLE_VERSION.matcher(text);
+ 81 8 if (matcher.find()) {
+ 82 4 version = matcher.group();
83
} else {
- 84 2 return null ;
+ 84 4 return null ;
85
}
86
- 87 2 if (matcher.find()) {
- 88 1 return null ;
+ 87 4 if (matcher.find()) {
+ 88 2 return null ;
89
}
90
}
- 91 292 return new DependencyVersion(version);
+ 91 1378 return new DependencyVersion(version);
92
}
93
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html
new file mode 100644
index 000000000..149d15e08
--- /dev/null
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionUtil.html
@@ -0,0 +1,263 @@
+
+
+
+Coverage Report
+Coverage Report - org.owasp.dependencycheck.utils.ExtractionUtil
+
+
+
+
+ 1
+
+ 2
+
+ 3
+
+ 4
+
+ 5
+
+ 6
+
+ 7
+
+ 8
+
+ 9
+
+ 10
+
+ 11
+
+ 12
+
+ 13
+
+ 14
+
+ 15
+
+ 16
+
+ 17
+
+ 18
+ package org.owasp.dependencycheck.utils;
+ 19
+
+ 20
+ import java.io.BufferedInputStream;
+ 21
+ import java.io.BufferedOutputStream;
+ 22
+ import java.io.File;
+ 23
+ import java.io.FileInputStream;
+ 24
+ import java.io.FileNotFoundException;
+ 25
+ import java.io.FileOutputStream;
+ 26
+ import java.io.IOException;
+ 27
+ import java.util.logging.Level;
+ 28
+ import java.util.logging.Logger;
+ 29
+ import java.util.zip.ZipEntry;
+ 30
+ import java.util.zip.ZipInputStream;
+ 31
+ import org.owasp.dependencycheck.Engine;
+ 32
+ import static org.owasp.dependencycheck.utils.FileUtils.getFileExtension;
+ 33
+
+ 34
+
+ 35
+
+ 36
+
+ 37
+
+ 38
+ public final class ExtractionUtil {
+ 39
+
+ 40
+
+ 41
+
+ 42
+
+ 43 0 private static final Logger LOGGER = Logger.getLogger(ExtractionUtil.class .getName());
+ 44
+
+ 45
+
+ 46
+
+ 47
+ private static final int BUFFER_SIZE = 4096;
+ 48
+
+ 49
+
+ 50
+
+ 51
+
+ 52
+ private ExtractionUtil() {
+ 53
+ }
+ 54
+
+ 55
+
+ 56
+
+ 57
+
+ 58
+
+ 59
+
+ 60
+
+ 61
+
+ 62
+ public static void extractFiles(File archive, File extractTo) throws ExtractionException {
+ 63 0 extractFiles(archive, extractTo, null );
+ 64 0 }
+ 65
+
+ 66
+
+ 67
+
+ 68
+
+ 69
+
+ 70
+
+ 71
+
+ 72
+
+ 73
+
+ 74
+
+ 75
+
+ 76
+ public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
+ 77 0 if (archive == null || extractTo == null ) {
+ 78 0 return ;
+ 79
+ }
+ 80
+
+ 81 0 FileInputStream fis = null ;
+ 82 0 ZipInputStream zis = null ;
+ 83
+
+ 84
+ try {
+ 85 0 fis = new FileInputStream(archive);
+ 86 0 } catch (FileNotFoundException ex) {
+ 87 0 LOGGER.log(Level.FINE, null , ex);
+ 88 0 throw new ExtractionException("Archive file was not found." , ex);
+ 89 0 }
+ 90 0 zis = new ZipInputStream(new BufferedInputStream(fis));
+ 91
+ ZipEntry entry;
+ 92
+ try {
+ 93 0 while ((entry = zis.getNextEntry()) != null ) {
+ 94 0 if (entry.isDirectory()) {
+ 95 0 final File d = new File(extractTo, entry.getName());
+ 96 0 if (!d.exists() && !d.mkdirs()) {
+ 97 0 final String msg = String.format("Unable to create '%s'." , d.getAbsolutePath());
+ 98 0 throw new ExtractionException(msg);
+ 99
+ }
+ 100 0 } else {
+ 101 0 final File file = new File(extractTo, entry.getName());
+ 102 0 final String ext = getFileExtension(file.getName());
+ 103 0 if (engine == null || engine.supportsExtension(ext)) {
+ 104 0 BufferedOutputStream bos = null ;
+ 105
+ FileOutputStream fos;
+ 106
+ try {
+ 107 0 fos = new FileOutputStream(file);
+ 108 0 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+ 109
+ int count;
+ 110 0 final byte data[] = new byte [BUFFER_SIZE];
+ 111 0 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
+ 112 0 bos.write(data, 0, count);
+ 113
+ }
+ 114 0 bos.flush();
+ 115 0 } catch (FileNotFoundException ex) {
+ 116 0 LOGGER.log(Level.FINE, null , ex);
+ 117 0 final String msg = String.format("Unable to find file '%s'." , file.getName());
+ 118 0 throw new ExtractionException(msg, ex);
+ 119 0 } catch (IOException ex) {
+ 120 0 LOGGER.log(Level.FINE, null , ex);
+ 121 0 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+ 122 0 throw new ExtractionException(msg, ex);
+ 123
+ } finally {
+ 124 0 if (bos != null ) {
+ 125
+ try {
+ 126 0 bos.close();
+ 127 0 } catch (IOException ex) {
+ 128 0 LOGGER.log(Level.FINEST, null , ex);
+ 129 0 }
+ 130
+ }
+ 131
+ }
+ 132
+ }
+ 133 0 }
+ 134
+ }
+ 135 0 } catch (IOException ex) {
+ 136 0 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
+ 137 0 LOGGER.log(Level.FINE, msg, ex);
+ 138 0 throw new ExtractionException(msg, ex);
+ 139
+ } finally {
+ 140 0 try {
+ 141 0 zis.close();
+ 142 0 } catch (IOException ex) {
+ 143 0 LOGGER.log(Level.FINEST, null , ex);
+ 144 0 }
+ 145 0 }
+ 146 0 }
+ 147
+ }
+
+
+
+
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html
index e44d9cd8d..b149bc895 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html
@@ -57,19 +57,19 @@
19
public Iterator<T> filter(Iterator<T> iterator) {
- 20 157 return new FilterIterator(iterator);
+ 20 314 return new FilterIterator(iterator);
21
}
22
23
public Iterable<T> filter(final Iterable<T> iterable) {
- 24 157 return new Iterable<T>() {
+ 24 314 return new Iterable<T>() {
25
26
public Iterator<T> iterator() {
- 27 157 return filter(iterable.iterator());
+ 27 314 return filter(iterable.iterator());
28
}
29
@@ -78,7 +78,7 @@
}
31
- 32 157 private class FilterIterator implements Iterator<T> {
+ 32 314 private class FilterIterator implements Iterator<T> {
33
34
@@ -87,28 +87,28 @@
private T next;
36
- 37 157 private FilterIterator(Iterator<T> iterator) {
- 38 157 this .iterator = iterator;
- 39 157 toNext();
- 40 157 }
+ 37 314 private FilterIterator(Iterator<T> iterator) {
+ 38 314 this .iterator = iterator;
+ 39 314 toNext();
+ 40 314 }
41
42
public boolean hasNext() {
- 43 962 return next != null ;
+ 43 1912 return next != null ;
44
}
45
46
public T next() {
- 47 849 if (next == null ) {
+ 47 1686 if (next == null ) {
48 0 throw new NoSuchElementException();
49
}
- 50 849 T returnValue = next;
- 51 849 toNext();
- 52 849 return returnValue;
+ 50 1686 T returnValue = next;
+ 51 1686 toNext();
+ 52 1686 return returnValue;
53
}
54
@@ -122,22 +122,22 @@
59
private void toNext() {
- 60 1006 next = null ;
- 61 1444 while (iterator.hasNext()) {
- 62 1329 T item = iterator.next();
- 63 1329 if (item != null && passes(item)) {
- 64 891 next = item;
- 65 891 break ;
+ 60 2000 next = null ;
+ 61 2810 while (iterator.hasNext()) {
+ 62 2580 T item = iterator.next();
+ 63 2580 if (item != null && passes(item)) {
+ 64 1770 next = item;
+ 65 1770 break ;
66
}
- 67 438 }
- 68 1006 }
+ 67 810 }
+ 68 2000 }
69
}
70
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html
index 19eca0006..0d0745004 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html
@@ -107,11 +107,11 @@
public void close() { 45
- 46 1 }
+ 46 2 }
47
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html
index f9f8ab518..f4b0eeb2e 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Pair.html
@@ -211,10 +211,10 @@
@Override 97
public int hashCode() {
- 98 21505 int hash = 3;
- 99 21505 hash = 53 * hash + (this .left != null ? this .left.hashCode() : 0);
- 100 21505 hash = 53 * hash + (this .right != null ? this .right.hashCode() : 0);
- 101 21505 return hash;
+ 98 44294 int hash = 3;
+ 99 44294 hash = 53 * hash + (this .left != null ? this .left.hashCode() : 0);
+ 100 44294 hash = 53 * hash + (this .right != null ? this .right.hashCode() : 0);
+ 101 44294 return hash;
102
}
103
@@ -259,6 +259,6 @@
}
-
+
diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html
index a27365ea8..ce2fecac3 100644
--- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html
+++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html
@@ -99,14 +99,14 @@
41
- 42 1 private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$" , Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
+ 42 2 private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$" , Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
43
44
45
- 46 1 private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*" , Pattern.CASE_INSENSITIVE);
+ 46 2 private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*" , Pattern.CASE_INSENSITIVE);
47
48
@@ -125,7 +125,7 @@
55
public static boolean containsUrl(String text) {
- 56 22445 return CONTAINS_URL_TEST.matcher(text).matches();
+ 56 24200 return CONTAINS_URL_TEST.matcher(text).matches();
57
}
58
@@ -144,7 +144,7 @@
65
public static boolean isUrl(String text) {
- 66 7 return IS_URL_TEST.matcher(text).matches();
+ 66 14 return IS_URL_TEST.matcher(text).matches();
67
}
68
@@ -153,7 +153,7 @@
70
- 71 1 private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
+ 71 2 private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
72
Arrays.asList("www" , "com" , "org" , "gov" , "info" , "name" , "net" , "pro" , "tel" , "mobi" , "xxx" ));
73
@@ -188,40 +188,40 @@
88
public static List<String> extractImportantUrlData(String text) throws MalformedURLException {
- 89 7 final ArrayList<String> importantParts = new ArrayList<String>();
- 90 7 final URL url = new URL(text);
- 91 7 final String[] domain = url.getHost().split("\\." );
+ 89 14 final ArrayList<String> importantParts = new ArrayList<String>();
+ 90 14 final URL url = new URL(text);
+ 91 14 final String[] domain = url.getHost().split("\\." );
92
- 93 20 for (int i = 0; i < domain.length - 1; i++) {
- 94 13 final String sub = domain[i];
- 95 13 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
- 96 12 importantParts.add(sub);
+ 93 40 for (int i = 0; i < domain.length - 1; i++) {
+ 94 26 final String sub = domain[i];
+ 95 26 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
+ 96 24 importantParts.add(sub);
97
}
98
}
- 99 7 final String document = url.getPath();
- 100 7 final String[] pathParts = document.split("[\\//]" );
- 101 12 for (int i = 0; i < pathParts.length - 2; i++) {
- 102 5 if (!pathParts[i].isEmpty()) {
+ 99 14 final String document = url.getPath();
+ 100 14 final String[] pathParts = document.split("[\\//]" );
+ 101 24 for (int i = 0; i < pathParts.length - 2; i++) {
+ 102 10 if (!pathParts[i].isEmpty()) {
103 0 importantParts.add(pathParts[i]);
104
}
105
}
- 106 7 if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
- 107 6 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$" , "" );
- 108 6 importantParts.add(fileNameNoExt);
+ 106 14 if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
+ 107 12 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$" , "" );
+ 108 12 importantParts.add(fileNameNoExt);
109
}
- 110 7 return importantParts;
+ 110 14 return importantParts;
111
}
112
}
-
+
diff --git a/dependency-check-core/cpd.html b/dependency-check-core/cpd.html
index 334b59474..7ab7e0300 100644
--- a/dependency-check-core/cpd.html
+++ b/dependency-check-core/cpd.html
@@ -1,13 +1,13 @@
dependency-check-core - CPD Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -248,10 +248,10 @@
Line
org\owasp\dependencycheck\analyzer\ArchiveAnalyzer.java
-165
+165
org\owasp\dependencycheck\analyzer\JarAnalyzer.java
-922
+976
@Override
diff --git a/dependency-check-core/dependency-updates-report.html b/dependency-check-core/dependency-updates-report.html
index c2786299b..6d00d573e 100644
--- a/dependency-check-core/dependency-updates-report.html
+++ b/dependency-check-core/dependency-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-core - Dependency Updates Report
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -252,7 +252,7 @@
# of dependencies where the next version available is an incremental version update
-7
+
8
# of dependencies where the next version available is a minor version update
@@ -260,7 +260,7 @@
# of dependencies where the next version available is a major version update
-0
+1
Dependency Management
This project does not declare any dependencies in a dependencyManagement section.
@@ -412,7 +412,7 @@
1.5
-org.apache.commons
commons-compress
1.8
@@ -420,7 +420,7 @@
jar
1.8.1
@@ -592,6 +592,18 @@
+org.owasp
+dependency-check-utils
+1.2.2
+compile
+jar
+
+
org.springframework
spring-webmvc
@@ -603,6 +615,18 @@
2.5.6 3.0.0.RELEASE
+
+org.springframework.security
+spring-security-web
+3.0.0.RELEASE
+provided
+jar
+3.0.1.RELEASE
Status
Group Id
@@ -722,7 +746,7 @@
jar
Newer versions
-2.5.1 Next Incremental 2.6 Next Minor 3.0-RC2 Latest Minor 3.0 Next Major 3.2.1 Latest Major
+2.5.1 Next Incremental 2.6 Next Minor 3.0-RC2 Latest Minor 3.0 Next Major 3.3-EA2 Latest Major
commons-cli:commons-cli
@@ -908,7 +932,7 @@
Status
-
+
Group Id
org.apache.commons
@@ -926,7 +950,10 @@
Type
-jar
+jar
+
+Newer versions
+1.8.1 Next Incremental
org.apache.geronimo.daytrader:daytrader-ear
@@ -977,7 +1004,7 @@
jar
Newer versions
-4.6.0 Next Minor 4.8.0 Latest Minor
+4.6.0 Next Minor 4.8.1 Latest Minor
org.apache.lucene:lucene-core
@@ -1004,7 +1031,7 @@
jar
Newer versions
-4.6.0 Next Minor 4.8.0 Latest Minor
+4.6.0 Next Minor 4.8.1 Latest Minor
org.apache.lucene:lucene-queryparser
@@ -1031,7 +1058,7 @@
jar
Newer versions
-4.6.0 Next Minor 4.8.0 Latest Minor
+4.6.0 Next Minor 4.8.1 Latest Minor
org.apache.lucene:lucene-test-framework
@@ -1058,7 +1085,7 @@
jar
Newer versions
-4.4.0 Next Minor 4.8.0 Latest Minor
+4.4.0 Next Minor 4.8.1 Latest Minor
org.apache.maven.scm:maven-scm-provider-cvsexe
@@ -1294,6 +1321,30 @@
Newer versions
6.1H.22 Next Version 6.1.17 Next Incremental 6.1.26 Latest Incremental
+
org.owasp:dependency-check-utils
+
+
+Status
+
+
+Group Id
+org.owasp
+
+Artifact Id
+dependency-check-utils
+
+Current Version
+1.2.2
+
+Scope
+compile
+
+Classifier
+
+
+Type
+jar
org.springframework:spring-webmvc
@@ -1319,7 +1370,34 @@
jar
Newer versions
-2.5.6 Next Incremental 2.5.6.SEC03 Latest Incremental 3.0.0.RELEASE Next Major 4.0.4.RELEASE Latest Major
+2.5.6 Next Incremental 2.5.6.SEC03 Latest Incremental 3.0.0.RELEASE Next Major 4.0.5.RELEASE Latest Major
+
org.springframework.security:spring-security-web
+
+
+Status
+
+
+Group Id
+org.springframework.security
+
+Artifact Id
+spring-security-web
+
+Current Version
+3.0.0.RELEASE
+
+Scope
+provided
+
+Classifier
+
+
+Type
+jar
+
+Newer versions
+3.0.1.RELEASE Next Major 3.2.4.RELEASE Latest Major
dependency-check-core - Surefire Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -268,12 +268,12 @@ function toggleDisplay(elementId) {
Success Rate
Time
-35
+33
0
0
0
100%
-435.441 560.478 Note: failures are anticipated and checked for with assertions while errors are unanticipated.
org.owasp.dependencycheck
@@ -377,28 +369,7 @@ function toggleDisplay(elementId) {
0
0
100%
-70.844
-
-
org.owasp.dependencycheck.utils
-
94.223
org.owasp.dependencycheck.analyzer
+27.555
org.owasp.dependencycheck.data.update
@@ -458,7 +429,7 @@ function toggleDisplay(elementId) {
0
0
100%
-20.147
+24.639
StandardUpdateIntegrationTest 0
0
100%
-6.305
+6.793
org.owasp.dependencycheck.data.nvdcve
@@ -488,7 +459,7 @@ function toggleDisplay(elementId) {
0
0
100%
-47.399
+57.307
DatabasePropertiesIntegrationTest 0
0
100%
-68.998
98.093
Test Cases [Summary ] [Package List ] [Test Cases ]
@@ -507,170 +478,159 @@ function toggleDisplay(elementId) {
testAnalyzeTar
-19.447
+
28.104
testAnalyzeTgz
-20.04
+
23.515
testAnalyze
-15.895
+
25.304
testGetAnalysisPhase
-3.715
+
3.896
testGetName
-3.014
+
3.343
testAnalyze_badZip
-14.338
+
18.653
testInitialize
-2.764
+
4.097
testAnalyzeTarGz
-17.752
+
21.009
testSupportsExtension
-3.489
+
5.494
testGetSupportedExtensions
-3.284
+3.399
CPEAnalyzerIntegrationTest
testSearchCPE
-16.521
+21.368
testDetermineCPE
-10.462
+20.171
testDetermineCPE_full
-25.31
+36.654
testBuildSearch
-2.945
+4.308
VulnerabilitySuppressionAnalyzerIntegrationTest
testAnalyze
-22.925
+19.529
testGetAnalysisPhase
-2.765
+4.916
testGetName
-2.686
+3.11
CveDBIntegrationTest
testOpen
-15.129
+23.592
testGetCPEs
-14.713
+14.964
testGetVulnerabilities
-17.557
+18.751
DatabasePropertiesIntegrationTest
testSave
-14.682
+22.904
testGetProperty_String_String
-15.192
+15.986
testGetProperties
-10.662
+21.22
testGetProperty_String
-13.377
+17.139
testIsEmpty
-15.085
+20.844
NvdCveUpdaterIntegrationTest
testUpdate
-20.147
+24.639
StandardUpdateIntegrationTest
testOpenDataStores
-2.455
+3.309
testUpdatesNeeded
-1.9
+1.662
testWithinRange
-1.95
+1.822
EngineIntegrationTest
testScan
-0.974
+1.793
testEngine
-69.87
+92.43
ReportGeneratorIntegrationTest
testGenerateXMLReport
-24.944
+27.881
testGenerateReport
-2.966
-
-
DownloaderIntegrationTest
-
-
-testGetLastModified
-0.397
-
-testFetchFile
-6.089
4.672 dependency-check-core - FindBugs Bug Detector Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -252,8 +252,8 @@
Errors
Missing Classes
-210
-6
+199
+5
0
0
org.owasp.dependencycheck.analyzer.AssemblyAnalyzer
-
+
Bug
Category
Details
Line
Priority
-
+
org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer() discards result of readLine after checking if it is nonnull
STYLE
RV_DONT_JUST_NULL_CHECK_READLINE 235 236 Medium
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
-
+
Bug
Category
Details
Line
Priority
-
+
Possible null pointer dereference of currentVersion on branch that might be infeasible in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency)
STYLE
NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE 145 Medium
-
+
Possible null pointer dereference of nextVersion on branch that might be infeasible in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency)
STYLE
NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE
org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer
-
+
Bug
Category
Details
Line
Priority
-
+
Found reliance on default encoding in org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.analyzeFileType(Dependency, Engine): new java.io.FileReader(File)
I18N
DM_DEFAULT_ENCODING 115 High
-
org.owasp.dependencycheck.utils.URLConnectionFactory
-
-
-Bug
-Category
-Details
-Line
-Priority
-
-Redundant nullcheck of conn which is known to be null in org.owasp.dependencycheck.utils.URLConnectionFactory.createHttpURLConnection(URL)
-STYLE
-RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE 83 Medium
High
diff --git a/dependency-check-core/index.html b/dependency-check-core/index.html
index 907fc84c1..73a0a76f0 100644
--- a/dependency-check-core/index.html
+++ b/dependency-check-core/index.html
@@ -1,13 +1,13 @@
dependency-check-core - About
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-core/javancss.html b/dependency-check-core/javancss.html
index db8d4363d..c90301394 100644
--- a/dependency-check-core/javancss.html
+++ b/dependency-check-core/javancss.html
@@ -1,13 +1,13 @@
dependency-check-core - JavaNCSS Metric Results
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -258,12 +258,12 @@
org.owasp.dependencycheck.analyzer
23
-173
-2219
-191
-1292
-152
-646
+172
+2227
+190
+1283
+148
+652
org.owasp.dependencycheck.jaxb.pom.generated
86
@@ -274,15 +274,6 @@
228
0
-org.owasp.dependencycheck.utils
-22
-106
-866
-113
-699
-10
-472
-
org.owasp.dependencycheck.dependency
14
176
@@ -291,7 +282,7 @@
1097
17
231
-
+
org.owasp.dependencycheck.data.nvdcve
9
61
@@ -300,15 +291,24 @@
413
31
281
+
+org.owasp.dependencycheck.utils
+11
+48
+383
+46
+288
+6
+172
org.owasp.dependencycheck.suppression
6
-48
-330
-54
-338
-6
-151
+52
+379
+58
+362
+5
+154
org.owasp.dependencycheck.data.update.xml
4
@@ -321,10 +321,10 @@
org.owasp.dependencycheck.agent
1
-64
-294
-65
-442
+66
+298
+67
+455
0
35
@@ -454,13 +454,13 @@
Single lines comment
Multi lines comment
-207
-1417
-9029
-1572
-13138
-494
-2972
+196
+1364
+8607
+1510
+12755
+485
+2681
[ package ] [ object ] [ method ] [ explanation ]
@@ -474,10 +474,10 @@
Javadocs
org.owasp.dependencycheck.analyzer.JarAnalyzer 639
-31
+623
+30
1
-37
+
36
org.owasp.dependencycheck.data.nvdcve.CveDB 406
@@ -486,10 +486,10 @@
21
org.owasp.dependencycheck.agent.DependencyCheckScanAgent 277
-64
+281
+66
0
-65
+
67
org.owasp.dependencycheck.analyzer.CPEAnalyzer 261
@@ -527,29 +527,29 @@
0
22
-org.owasp.dependencycheck.utils.Settings 189
-23
-1
-26
-
org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory 175
87
0
88
+
+org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer 163
+12
+0
+13
+org.owasp.dependencycheck.suppression.SuppressionRule 160
+28
+0
+29
+
org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer 157
11
0
12
-
-org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer 154
-12
-0
-13
org.owasp.dependencycheck.data.nvdcve.ConnectionFactory 151
@@ -564,7 +564,7 @@
9
org.owasp.dependencycheck.analyzer.AssemblyAnalyzer 131
+134
8
0
8
@@ -581,47 +581,35 @@
0
20
-org.owasp.dependencycheck.suppression.SuppressionRule 113
-24
-0
-25
-
org.owasp.dependencycheck.dependency.Vulnerability 108
36
0
35
-
+
org.owasp.dependencycheck.data.cpe.CpeMemoryIndex 107
14
0
15
-
+
org.owasp.dependencycheck.dependency.Evidence 102
21
0
22
-
+
org.owasp.dependencycheck.jaxb.pom.generated.Build 101
28
5
39
-
+
org.owasp.dependencycheck.jaxb.pom.generated.Profile 97
24
6
37
-
-org.owasp.dependencycheck.utils.FileUtils 97
-9
-0
-10
org.owasp.dependencycheck.utils.DependencyVersion 91
@@ -635,23 +623,35 @@
1
7
-org.owasp.dependencycheck.utils.Downloader 85
-4
-0
-5
-
org.owasp.dependencycheck.data.update.xml.NvdCve12Handler 80
3
1
10
-
-org.owasp.dependencycheck.data.update.task.CallableDownloadTask
+org.owasp.dependencycheck.data.update.task.DownloadTask 75
11
0
-11
+
11
+
+org.owasp.dependencycheck.jaxb.pom.generated.Plugin 70
+18
+4
+27
+
+org.owasp.dependencycheck.jaxb.pom.generated.BuildBase 65
+16
+4
+25
+
+org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer 63
+6
+0
+7
TOP 30 classes containing the most methods.
+
11
+
+org.owasp.dependencycheck.data.nexus.MavenArtifact 33
+12
+0
+13
Averages.
@@ -849,11 +849,11 @@
Methods average
Javadocs average
-40.30
-9,029.00
-0.31
-6.85
-8.02
+40.49
+8,607.00
+0.32
+6.96
+8.15
[ package ] [ object ] [ method ] [ explanation ]
@@ -876,74 +876,74 @@
17
1
+org.owasp.dependencycheck.analyzer.JarAnalyzer.setPomEvidence(Dependency,Model,Properties,ClassNameInformation) 87
+47
+1
+
org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.endElement(String,String,String) 71
27
0
-
+
org.owasp.dependencycheck.data.update.StandardUpdate.update() 62
25
1
-
+
org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.initialize() 60
25
1
+
+org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer() 55
+20
+1
org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.startElement(String,String,String,Attributes) 55
21
0
-org.owasp.dependencycheck.utils.Downloader.fetchFile(URL,File,boolean) 55
-22
-1
-
-org.owasp.dependencycheck.analyzer.JarAnalyzer.addPomEvidence(Dependency,Model,Properties) 54
-35
-1
-
org.owasp.dependencycheck.data.nvdcve.CveDB.getVulnerability(String) 54
9
1
-org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.initializeFileTypeAnalyzer() 52
-20
-1
-
-org.owasp.dependencycheck.utils.FileUtils.extractFiles(File,File,Engine) org.owasp.dependencycheck.utils.ExtractionUtil.extractFiles(File,File,Engine) 51
23
1
-
+
org.owasp.dependencycheck.agent.DependencyCheckScanAgent.populateSettings() 49
38
1
-
+
org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.extractArchive(ArchiveInputStream,File,Engine) 49
23
1
-
+
org.owasp.dependencycheck.analyzer.AssemblyAnalyzer.analyzeFileType(Dependency,Engine) 49
24
1
-
+
org.owasp.dependencycheck.analyzer.JarAnalyzer.extractPom(String,JarFile,Dependency) 49
9
1
-
-org.owasp.dependencycheck.analyzer.JarAnalyzer.setPomEvidence(Dependency,Model,Properties,ClassNameInformation)
+org.owasp.dependencycheck.suppression.SuppressionRule.process(Dependency) 49
-22
+30
+1
+
+org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.loadSuppressionData() 47
+17
1
org.owasp.dependencycheck.analyzer.CPEAnalyzer.determineIdentifiers(Dependency,String,String) 12
1
-org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.loadSuppressionData() 43
-16
-1
-
org.owasp.dependencycheck.analyzer.JarAnalyzer.analyzePOM(Dependency,ClassNameInformation,Engine) 42
11
1
-
+
org.owasp.dependencycheck.data.update.StandardUpdate.updatesNeeded() 42
17
1
-
+
org.owasp.dependencycheck.reporting.ReportGenerator.generateReport(String,String) 41
16
1
-
+
org.owasp.dependencycheck.analyzer.JarAnalyzer.addDescription(Dependency,String,String,String) 40
11
1
-
+
org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.startElement(String,String,String,Attributes) 40
14
0
-
-org.owasp.dependencycheck.suppression.SuppressionRule.process(Dependency) 39
-25
-1
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency) 35
@@ -1014,6 +1004,16 @@
org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.extractFiles(File,File,Engine) 32
14
+1
+
+org.owasp.dependencycheck.utils.DependencyVersion.compareTo(DependencyVersion) 32
+19
+0
+
+org.owasp.dependencycheck.suppression.SuppressionRule.toString() 31
+16
1
Averages.
@@ -1024,9 +1024,9 @@
CCN average
Javadocs average
-9,029.00
-4.89
-2.34
+8,607.00
+4.85
+2.35
0.97
diff --git a/dependency-check-core/license.html b/dependency-check-core/license.html
index 978a84de2..95817c906 100644
--- a/dependency-check-core/license.html
+++ b/dependency-check-core/license.html
@@ -1,13 +1,13 @@
-
+
dependency-check-core - Project License
@@ -54,7 +54,7 @@
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-core/plugin-updates-report.html b/dependency-check-core/plugin-updates-report.html
index fa6188822..76d7e1529 100644
--- a/dependency-check-core/plugin-updates-report.html
+++ b/dependency-check-core/plugin-updates-report.html
@@ -1,13 +1,13 @@
-
+
dependency-check-core - Plugin Updates Report
@@ -54,7 +54,7 @@
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-core/pmd.html b/dependency-check-core/pmd.html
index 96921d043..921d26993 100644
--- a/dependency-check-core/pmd.html
+++ b/dependency-check-core/pmd.html
@@ -1,13 +1,13 @@
-
+
dependency-check-core - PMD Results
@@ -54,7 +54,7 @@
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -250,10 +250,10 @@
Line
These nested if statements could be combined
-362–365
+
362 –365
These nested if statements could be combined
-376–379
+376 –379
org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
@@ -262,7 +262,7 @@
Line
Avoid empty while statements
-235–237
+236 –238
org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
@@ -271,16 +271,16 @@
Line
Useless parentheses.
-222
+222
These nested if statements could be combined
-542–547
+541 –546
These nested if statements could be combined
-543–546
+542 –545
These nested if statements could be combined
-552–555
+551 –554
org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
@@ -289,7 +289,7 @@
Line
These nested if statements could be combined
-228–230
+228 –230
org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
@@ -298,7 +298,7 @@
Line
These nested if statements could be combined
-134–154
+134 –154
org/owasp/dependencycheck/analyzer/JarAnalyzer.java
@@ -307,7 +307,7 @@
Line
Useless parentheses.
-375
+373
org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java
@@ -316,7 +316,7 @@
Line
Avoid unused local variables such as 'extractComments'.
-113
+113
org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java
@@ -325,7 +325,7 @@
Line
Useless parentheses.
-76
+76
org/owasp/dependencycheck/data/cpe/IndexEntry.java
@@ -334,10 +334,10 @@
Line
Useless parentheses.
-172
+172
Useless parentheses.
-175
+175
org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java
@@ -346,7 +346,7 @@
Line
These nested if statements could be combined
-248–250
+248 –250
org/owasp/dependencycheck/data/nvdcve/CveDB.java
@@ -354,14 +354,8 @@
Violation
Line
-Avoid unused private fields such as 'SELECT_PROPERTY'.
-251
-
-Avoid unused private fields such as 'DELETE_PROPERTY'.
-263
-
Useless parentheses.
-743
+745
org/owasp/dependencycheck/data/nvdcve/DriverShim.java
@@ -370,7 +364,7 @@
Line
Useless parentheses.
-192
+192
org/owasp/dependencycheck/data/update/StandardUpdate.java
@@ -379,7 +373,7 @@
Line
Useless parentheses.
-118
+118
org/owasp/dependencycheck/dependency/Dependency.java
@@ -388,28 +382,28 @@
Line
Useless parentheses.
-599
+599
Useless parentheses.
-602
+602
Useless parentheses.
-605
+605
Useless parentheses.
-608
+608
Useless parentheses.
-611
+611
Useless parentheses.
-614
+614
Useless parentheses.
-629
+629
Useless parentheses.
-632
+632
org/owasp/dependencycheck/dependency/Evidence.java
@@ -418,7 +412,7 @@
Line
Useless parentheses.
-202
+202
org/owasp/dependencycheck/dependency/Identifier.java
@@ -427,10 +421,10 @@
Line
Useless parentheses.
-175
+175
Useless parentheses.
-178
+178
org/owasp/dependencycheck/dependency/Reference.java
@@ -439,13 +433,13 @@
Line
Useless parentheses.
-109
+109
Useless parentheses.
-112
+112
Useless parentheses.
-115
+115
org/owasp/dependencycheck/dependency/Vulnerability.java
@@ -454,7 +448,7 @@
Line
Useless parentheses.
-373
+373
org/owasp/dependencycheck/dependency/VulnerableSoftware.java
@@ -463,13 +457,13 @@
Line
Useless parentheses.
-143
+143
Useless parentheses.
-182
+182
Useless parentheses.
-187
+187
org/owasp/dependencycheck/suppression/PropertyType.java
@@ -478,7 +472,7 @@
Line
Useless parentheses.
-161
+161
org/owasp/dependencycheck/utils/Checksum.java
@@ -487,7 +481,7 @@
Line
Useless parentheses.
-113
+113
org/owasp/dependencycheck/utils/DependencyVersion.java
@@ -496,10 +490,10 @@
Line
Useless parentheses.
-135
+135
Useless parentheses.
-194
+194 dependency-check-core - Project Information
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-core/project-reports.html b/dependency-check-core/project-reports.html
index 56054d8de..d5dfa9c40 100644
--- a/dependency-check-core/project-reports.html
+++ b/dependency-check-core/project-reports.html
@@ -1,13 +1,13 @@
dependency-check-core - Generated Reports
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-core/project-summary.html b/dependency-check-core/project-summary.html
index 274cb7289..99040553e 100644
--- a/dependency-check-core/project-summary.html
+++ b/dependency-check-core/project-summary.html
@@ -1,13 +1,13 @@
dependency-check-core - Project Summary
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -203,7 +203,7 @@
dependency-check-core
Version
-1.2.1
+1.2.2
Type
jar
diff --git a/dependency-check-core/surefire-report.html b/dependency-check-core/surefire-report.html
index 5012bc409..dabce3d36 100644
--- a/dependency-check-core/surefire-report.html
+++ b/dependency-check-core/surefire-report.html
@@ -1,13 +1,13 @@
dependency-check-core - Surefire Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -268,12 +268,12 @@ function toggleDisplay(elementId) {
Success Rate
Time
-166
+154
0
0
1
-99.398%
-42.099 99.351%
+48.094 Note: failures are anticipated and checked for with assertions while errors are unanticipated.
Package List
@@ -310,7 +310,7 @@ function toggleDisplay(elementId) {
0
0
100%
-
1.857
+
1.224
org.owasp.dependencycheck.dependency 23
@@ -318,10 +318,10 @@ function toggleDisplay(elementId) {
0
0
100%
-0.029
+
0.04
org.owasp.dependencycheck.utils 29
+16
0
0
0
@@ -334,7 +334,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.133
+
0.058
org.owasp.dependencycheck.analyzer 42
@@ -342,7 +342,7 @@ function toggleDisplay(elementId) {
0
1
97.619%
-39.08
+
45.46
org.owasp.dependencycheck.data.update 10
@@ -358,10 +358,10 @@ function toggleDisplay(elementId) {
0
0
100%
-0.035
+
0.048
org.owasp.dependencycheck.suppression 35
+36
0
0
0
@@ -374,7 +374,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.963
+
1.263
org.owasp.dependencycheck.data.cpe 1
@@ -382,7 +382,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.001
+
0
Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.
org.owasp.dependencycheck.data.cwe
@@ -446,7 +446,7 @@ function toggleDisplay(elementId) {
0
0
100%
-
1.857
+
1.224
org.owasp.dependencycheck.dependency
@@ -467,7 +467,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.029
+0.04
VulnerableSoftwareTest 100%
0
-DownloaderTest 1
-0
-0
-0
-100%
-0
-
-FileUtilsTest 2
-0
-0
-0
-100%
-0
-
FilterTest 2
@@ -542,15 +524,6 @@ function toggleDisplay(elementId) {
0
0
100%
-0
-
-SettingsTest 10
-0
-0
-0
-100%
0
org.owasp.dependencycheck.data.update.xml
@@ -572,7 +545,7 @@ function toggleDisplay(elementId) {
0
0
100%
-
0.032
+
0
NvdCve_2_0_HandlerTest 0
0
100%
-0.101
+0.058
org.owasp.dependencycheck.analyzer
@@ -602,7 +575,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.007
+0
AbstractSuppressionAnalyzerTest 0
0
100%
-0.434
+0.628
AnalyzerServiceTest 0
0
100%
-0.516
+0.569
AssemblyAnalyzerTest 0
1
80%
-0.77
+0.991
DependencyBundlingAnalyzerTest 0
0
100%
-0.037
+0.073
HintAnalyzerTest 0
0
100%
-35.82
+41
JarAnalyzerTest 0
0
100%
-1.483
+2.183
JavaScriptAnalyzerTest 0
0
100%
-0.013
+0.016
NuspecAnalyzerTest 0
0
100%
-0.035
+0.048
org.owasp.dependencycheck.suppression
@@ -786,7 +759,7 @@ function toggleDisplay(elementId) {
SuppressionRuleTest 29
+30
0
0
0
@@ -830,7 +803,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.084
+0.072
UrlTokenizingFilterTest 0
0
100%
-0.879
+1.191
org.owasp.dependencycheck.data.cpe
@@ -860,7 +833,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.001
0 0
AbstractSuppressionAnalyzerTest
testFailureToLocateSuppressionFileAnywhere
-0.18
+0.509
testGetRulesFromSuppressionFileFromURL
-0.244
+0.094
testGetRulesFromSuppressionFileInClasspath
-0.01
+0.024
testGetSupportedExtensions
-0
+0.001
AnalyzerServiceTest
testGetAnalyzers
-0.516
+0.569
AssemblyAnalyzerTest
testGetName
-0.352
+0.295
testAnalysis
-0.127
+0.205
testWithSettingMono
@@ -920,11 +893,11 @@ function toggleDisplay(elementId) {
testNonexistent
-0.076
+0.142
testLog4Net
-0.215
+0.349
DependencyBundlingAnalyzerTest
@@ -965,7 +938,7 @@ function toggleDisplay(elementId) {
testAnalyze
-0.037
+0.073
testClose
@@ -988,45 +961,45 @@ function toggleDisplay(elementId) {
testAnalyze
-30.076
+31.424
testGetAnalysisPhase
-2.896
+5.02
testGetName
-2.848
+4.556
JarAnalyzerTest
testAnalyze
-0.527
+0.696
testGetName
-0.227
+0.491
testInterpolateString
-0.274
+0.391
testSupportsExtension
-0.219
+0.335
testGetSupportedExtensions
-0.236
+0.27
JavaScriptAnalyzerTest
testAnalyze
-0.012
+0.014
testClose
@@ -1038,7 +1011,7 @@ function toggleDisplay(elementId) {
testGetName
-0.001
+0.002
testInitialize
@@ -1076,7 +1049,7 @@ function toggleDisplay(elementId) {
testSetName
-0.001
+0
CweDBTest
@@ -1116,45 +1089,45 @@ function toggleDisplay(elementId) {
testClear
-0.084
+0.06
testExamples
-0
+0.012
UrlTokenizingFilterTest
testRandomStrings
-0.865
+testExamples
+0.054
testExamples
-0.005
+testEmptyTerm
+0.015
testEmptyTerm
-0.009
+testRandomStrings
+1.122
NexusSearchTest
testNullSha1
-1.226
+0.996
testMalformedSha1
-0.124
+0.045
testValidSha1
-0.219
+0.097
testMissingSha1
-0.288
+0.086
XPathNuspecParserTest
@@ -1192,11 +1165,11 @@ function toggleDisplay(elementId) {
testLoad_String_String
-0.012
+0
testLoad_String_String_multiple_paths
-0.023
+0.048
NvdCveInfoTest
@@ -1249,14 +1222,14 @@ function toggleDisplay(elementId) {
testParse
-0.032
+0
NvdCve_2_0_HandlerTest
testParse
-0.101
+0.058
DependencyTest
@@ -1267,7 +1240,7 @@ function toggleDisplay(elementId) {
testGetSha1sum
-0.013
+0.01
testGetProductEvidence
@@ -1275,7 +1248,7 @@ function toggleDisplay(elementId) {
testGetActualFilePath
-0.003
+0
testSetFileExtension
@@ -1323,11 +1296,11 @@ function toggleDisplay(elementId) {
testGetMd5sum
-0.006
+0.029
testGetEvidence
-0.001
+0
testSetIdentifiers
@@ -1339,7 +1312,7 @@ function toggleDisplay(elementId) {
testSetActualFilePath
-0.006
+0.001
VulnerableSoftwareTest
@@ -1429,81 +1402,85 @@ function toggleDisplay(elementId) {
0
testAddCvssBelow
+testProcessGAV
0
testAddCvssBelow
+0
+
+testFilePath
0
-
+
testGetCvssBelow
0
-
+
testSetFilePath
0
-
+
testGetFilePath
-0
-
+0.001
+
testAddCpe
0
-
+
testAddCve
0
-
+
testAddCwe
0
-
+
testGetCpe
0
-
+
testGetCve
0
-
+
testGetCwe
0
-
+
testHasCpe
0
-
+
testHasCve
0
-
+
testHasCwe
0
-
+
testSetCvssBelow
0
-
+
testSetSha1
0
-
+
testSetCpe
0
-
+
testSetCve
0
-
+
testSetCwe
-0.001
-
+0
+
testCountCharacter
0
@@ -1573,24 +1550,6 @@ function toggleDisplay(elementId) {
testParseVersionFromFileName
0
-
DownloaderTest
-
-
-testGetLastModified_file
-0
-
FileUtilsTest
-
-
-testGetFileExtension
-0
-
-testDelete
-0
FilterTest
@@ -1600,49 +1559,6 @@ function toggleDisplay(elementId) {
testPasses
-0
-
Failure Details
diff --git a/dependency-check-core/taglist.html b/dependency-check-core/taglist.html
index 588caae39..466ce7906 100644
--- a/dependency-check-core/taglist.html
+++ b/dependency-check-core/taglist.html
@@ -1,13 +1,13 @@
-
+
dependency-check-core - Tag List report
@@ -54,7 +54,7 @@
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -246,13 +246,13 @@
Total number of occurrences
Tag strings used by tag class
-Todo Work 22
+Todo Work 21
todo, FIXME
Each tag is detailed below:
-
-
Number of occurrences found in the code: 22
+
+
Number of occurrences found in the code: 21
org.owasp.dependencycheck.analyzer.ArchiveAnalyzer
@@ -271,7 +271,7 @@
451
the following isn't quite right is it? need to think about this guessing game a bit more.
-539
+538
org.owasp.dependencycheck.analyzer.CPEAnalyzerIntegrationTest
Line
@@ -295,22 +295,22 @@
132
- can we utilize the pom's groupid and artifactId to filter??? most of these are due to low quality data. Other idea would be to say any CPE found based on LOW confidence evidence should have a different CPE type? (this might be a better solution then just removing the URL for "best-guess" matches).
-219
+233
move this startsWith expression to a configuration file?
-228
+242
move this to the hint analyzer
-308
+330
org.owasp.dependencycheck.analyzer.JarAnalyzer
Line
remove weighting
-648
+702
change this to a regex?
-766
+820
org.owasp.dependencycheck.analyzer.JavaScriptAnalyzerTest
Line
@@ -340,7 +340,7 @@
Line
consider utilizing the matchThreeVersion method to get additional results. However, this might also introduce false positives.
-753
+755
org.owasp.dependencycheck.data.update.StandardUpdateIntegrationTest
Line
@@ -358,13 +358,7 @@
Line
steal better version of code from compareTo
-137
-
-org.owasp.dependencycheck.utils.Downloader
-Line
-
-add the FTP protocol?
-163
+137
DependencyVersionUtilTest
-
-
- DownloaderIntegrationTest
-
-
- DownloaderTest
DriverLoaderTest
@@ -88,9 +82,6 @@
FileNameAnalyzerTest
-
-
- FileUtilsTest
FilterTest
@@ -133,9 +124,6 @@
ReportGeneratorIntegrationTest
-
-
- SettingsTest
StandardUpdateIntegrationTest
diff --git a/dependency-check-core/xref-test/index.html b/dependency-check-core/xref-test/index.html
index b102045ee..794b5abc7 100644
--- a/dependency-check-core/xref-test/index.html
+++ b/dependency-check-core/xref-test/index.html
@@ -4,7 +4,7 @@
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html
index 4b63ad798..14960e064 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzerTest.html
@@ -42,8 +42,8 @@
34 import java.util.logging.Level;
35 import java.util.logging.Logger;
36
-37 import static org.junit.Assert.assertEquals;
-38 import static org.junit.Assert.assertNull;
+37 import static org.junit.Assert.assertNull;
+38 import static org.junit.Assert.assertTrue;
39
40
41
@@ -75,7 +75,7 @@
67 instance.initialize();
68 int expCount = 5;
69 List<SuppressionRule> result = instance.getRules();
-70 assertEquals(expCount, result.size());
+70 assertTrue(expCount <= result.size());
71 }
72
73
@@ -87,7 +87,7 @@
79 instance.initialize();
80 int expCount = 5;
81 List<SuppressionRule> result = instance.getRules();
-82 assertEquals(expCount, result.size());
+82 assertTrue(expCount <= result.size());
83 }
84
85 @Test(expected = SuppressionParseException.class )
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html
index 6c30a98cb..9c5bc8915 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerIntegrationTest.html
@@ -123,62 +123,62 @@
115 FalsePositiveAnalyzer fp = new FalsePositiveAnalyzer();
116 fp.analyze(dep, null );
117
-118
-119
-120
-121 if (expResult != null ) {
-122 Identifier expIdentifier = new Identifier("cpe" , expResult, expResult);
-123 Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }" , dep.getIdentifiers().contains(expIdentifier));
-124 } else if (dep.getIdentifiers().isEmpty()) {
-125 Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "' }" , dep.getIdentifiers().isEmpty());
-126 } else {
-127 Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "', identifier:'" + dep.getIdentifiers().iterator().next().getValue() + "' }" , dep.getIdentifiers().isEmpty());
-128 }
-129 }
-130
-131
-132
-133
-134
-135
-136 @Test
-137 public void testDetermineCPE() throws Exception {
-138 File file = new File(this .getClass().getClassLoader().getResource("struts2-core-2.1.2.jar" ).getPath());
-139
-140 Dependency struts = new Dependency(file);
+118 if (expResult != null ) {
+119 Identifier expIdentifier = new Identifier("cpe" , expResult, expResult);
+120 Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }" , dep.getIdentifiers().contains(expIdentifier));
+121 } else {
+122 for (Identifier i : dep.getIdentifiers()) {
+123 Assert.assertFalse(String.format("%s - found a CPE identifier when should have been none (found '%s')" , dep.getFileName(), i.getValue()), "cpe" .equals(i.getType()));
+124 }
+125 }
+126 }
+127
+128
+129
+130
+131
+132
+133 @Test
+134 public void testDetermineCPE() throws Exception {
+135 File file = new File(this .getClass().getClassLoader().getResource("struts2-core-2.1.2.jar" ).getPath());
+136
+137 Dependency struts = new Dependency(file);
+138
+139 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer();
+140 fnAnalyzer.analyze(struts, null );
141
-142 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer();
-143 fnAnalyzer.analyze(struts, null );
+142 JarAnalyzer jarAnalyzer = new JarAnalyzer();
+143 jarAnalyzer.analyze(struts, null );
144
-145 JarAnalyzer jarAnalyzer = new JarAnalyzer();
-146 jarAnalyzer.analyze(struts, null );
-147
-148 File fileCommonValidator = new File(this .getClass().getClassLoader().getResource("commons-validator-1.4.0.jar" ).getPath());
-149 Dependency commonValidator = new Dependency(fileCommonValidator);
-150 jarAnalyzer.analyze(commonValidator, null );
-151
-152 File fileSpring = new File(this .getClass().getClassLoader().getResource("spring-core-2.5.5.jar" ).getPath());
-153 Dependency spring = new Dependency(fileSpring);
-154 jarAnalyzer.analyze(spring, null );
-155
-156 File fileSpring3 = new File(this .getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar" ).getPath());
-157 Dependency spring3 = new Dependency(fileSpring3);
-158 jarAnalyzer.analyze(spring3, null );
-159
-160 CPEAnalyzer instance = new CPEAnalyzer();
-161 instance.open();
-162 instance.determineCPE(commonValidator);
-163 instance.determineCPE(struts);
-164 instance.determineCPE(spring);
-165 instance.determineCPE(spring3);
-166 instance.close();
-167
-168 String expResult = "cpe:/a:apache:struts:2.1.2" ;
-169 Identifier expIdentifier = new Identifier("cpe" , expResult, expResult);
-170 String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5" ;
-171 String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0" ;
-172
-173 Assert.assertTrue("Apache Common Validator - found an identifier?" , commonValidator.getIdentifiers().isEmpty());
+145 File fileCommonValidator = new File(this .getClass().getClassLoader().getResource("commons-validator-1.4.0.jar" ).getPath());
+146 Dependency commonValidator = new Dependency(fileCommonValidator);
+147 jarAnalyzer.analyze(commonValidator, null );
+148
+149 File fileSpring = new File(this .getClass().getClassLoader().getResource("spring-core-2.5.5.jar" ).getPath());
+150 Dependency spring = new Dependency(fileSpring);
+151 jarAnalyzer.analyze(spring, null );
+152
+153 File fileSpring3 = new File(this .getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar" ).getPath());
+154 Dependency spring3 = new Dependency(fileSpring3);
+155 jarAnalyzer.analyze(spring3, null );
+156
+157 CPEAnalyzer instance = new CPEAnalyzer();
+158 instance.open();
+159 instance.determineCPE(commonValidator);
+160 instance.determineCPE(struts);
+161 instance.determineCPE(spring);
+162 instance.determineCPE(spring3);
+163 instance.close();
+164
+165 String expResult = "cpe:/a:apache:struts:2.1.2" ;
+166 Identifier expIdentifier = new Identifier("cpe" , expResult, expResult);
+167 String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5" ;
+168 String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0" ;
+169
+170 for (Identifier i : commonValidator.getIdentifiers()) {
+171 Assert.assertFalse("Apache Common Validator - found a CPE identifier?" , "cpe" .equals(i.getType()));
+172 }
+173
174 Assert.assertTrue("Incorrect match size - struts" , struts.getIdentifiers().size() >= 1);
175 Assert.assertTrue("Incorrect match - struts" , struts.getIdentifiers().contains(expIdentifier));
176 Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1);
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html
index ade6b6b90..490602c9d 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.analyzer
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.analyzer
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cpe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cpe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.reporting
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.reporting
339 }
340
341
-342
+342
343
344 @Test
345 public void testCpeMatches() {
-346 Identifier identifier = new Identifier("cwe" , "cpe:/a:microsoft:.net_framework:4.5" , "some url not needed for this test" );
+346 Identifier identifier = new Identifier("cpe" , "cpe:/a:microsoft:.net_framework:4.5" , "some url not needed for this test" );
347
348 PropertyType cpe = new PropertyType();
349 cpe.setValue("cpe:/a:microsoft:.net_framework:4.5" );
350
351 SuppressionRule instance = new SuppressionRule();
352 boolean expResult = true ;
-353 boolean result = instance.cpeMatches(cpe, identifier);
+353 boolean result = instance.identifierMatches("cpe" , cpe, identifier);
354 assertEquals(expResult, result);
355
356 cpe.setValue("cpe:/a:microsoft:.net_framework:4.0" );
357 expResult = false;
-358 result = instance.cpeMatches(cpe, identifier);
+358 result = instance.identifierMatches("cpe" , cpe, identifier);
359 assertEquals(expResult, result);
360
361 cpe.setValue("CPE:/a:microsoft:.net_framework:4.5" );
362 cpe.setCaseSensitive(true );
363 expResult = false;
-364 result = instance.cpeMatches(cpe, identifier);
+364 result = instance.identifierMatches("cpe" , cpe, identifier);
365 assertEquals(expResult, result);
366
367 cpe.setValue("cpe:/a:microsoft:.net_framework" );
368 cpe.setCaseSensitive(false);
369 expResult = true ;
-370 result = instance.cpeMatches(cpe, identifier);
+370 result = instance.identifierMatches("cpe" , cpe, identifier);
371 assertEquals(expResult, result);
372
373 cpe.setValue("cpe:/a:microsoft:.*" );
374 cpe.setRegex(true );
375 expResult = true ;
-376 result = instance.cpeMatches(cpe, identifier);
+376 result = instance.identifierMatches("cpe" , cpe, identifier);
377 assertEquals(expResult, result);
378
379 cpe.setValue("CPE:/a:microsoft:.*" );
380 cpe.setRegex(true );
381 cpe.setCaseSensitive(true );
382 expResult = false;
-383 result = instance.cpeMatches(cpe, identifier);
+383 result = instance.identifierMatches("cpe" , cpe, identifier);
384 assertEquals(expResult, result);
385
386 cpe.setValue("cpe:/a:apache:.*" );
387 cpe.setRegex(true );
388 cpe.setCaseSensitive(false);
389 expResult = false;
-390 result = instance.cpeMatches(cpe, identifier);
+390 result = instance.identifierMatches("cpe" , cpe, identifier);
391 assertEquals(expResult, result);
-392 }
-393
-394
-395
-396
-397 @Test
-398 public void testProcess() {
-399 File struts = new File(this .getClass().getClassLoader().getResource("struts2-core-2.1.2.jar" ).getPath());
-400 Dependency dependency = new Dependency(struts);
-401 dependency.addIdentifier("cwe" , "cpe:/a:microsoft:.net_framework:4.5" , "some url not needed for this test" );
-402 String sha1 = dependency.getSha1sum();
-403 dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970" );
-404 Vulnerability v = createVulnerability();
-405 dependency.addVulnerability(v);
-406
-407
-408 SuppressionRule instance = new SuppressionRule();
-409 instance.setSha1(sha1);
-410 instance.addCwe("287" );
-411 instance.process(dependency);
-412 assertTrue(dependency.getVulnerabilities().size() == 1);
-413 dependency.setSha1sum(sha1);
-414 instance.process(dependency);
-415 assertTrue(dependency.getVulnerabilities().isEmpty());
-416 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1);
-417
-418
-419 dependency.addVulnerability(v);
-420 instance = new SuppressionRule();
-421 instance.addCvssBelow(5f);
-422 instance.process(dependency);
-423 assertTrue(dependency.getVulnerabilities().size() == 1);
-424 instance.addCvssBelow(8f);
-425 instance.process(dependency);
-426 assertTrue(dependency.getVulnerabilities().isEmpty());
-427 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1);
-428
-429
-430 dependency.addVulnerability(v);
-431 instance = new SuppressionRule();
-432 instance.addCve("CVE-2012-1337" );
-433 instance.process(dependency);
-434 assertTrue(dependency.getVulnerabilities().size() == 1);
-435 instance.addCve("CVE-2013-1337" );
-436 instance.process(dependency);
-437 assertTrue(dependency.getVulnerabilities().isEmpty());
-438 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1);
-439
-440
-441 instance = new SuppressionRule();
-442 PropertyType pt = new PropertyType();
-443 pt.setValue("cpe:/a:microsoft:.net_framework:4.0" );
-444 instance.addCpe(pt);
-445 instance.process(dependency);
-446 assertTrue(dependency.getIdentifiers().size() == 1);
-447 pt = new PropertyType();
-448 pt.setValue("cpe:/a:microsoft:.net_framework:4.5" );
-449 instance.addCpe(pt);
-450 pt = new PropertyType();
-451 pt.setValue(".*" );
-452 pt.setRegex(true );
-453 instance.setFilePath(pt);
-454 instance.process(dependency);
-455 assertTrue(dependency.getIdentifiers().isEmpty());
-456 assertTrue(dependency.getSuppressedIdentifiers().size() == 1);
-457
-458 dependency.addIdentifier("cwe" , "cpe:/a:microsoft:.net_framework:4.0" , "some url not needed for this test" );
-459 dependency.addIdentifier("cwe" , "cpe:/a:microsoft:.net_framework:4.5" , "some url not needed for this test" );
-460 dependency.addIdentifier("cwe" , "cpe:/a:microsoft:.net_framework:5.0" , "some url not needed for this test" );
-461 pt = new PropertyType();
-462 pt.setValue("cpe:/a:microsoft:.net_framework" );
-463 instance.addCpe(pt);
-464 assertTrue(dependency.getIdentifiers().size() == 3);
-465 instance.process(dependency);
-466 assertTrue(dependency.getIdentifiers().isEmpty());
-467 assertTrue(dependency.getSuppressedIdentifiers().size() == 3);
-468 }
-469
-470 private Vulnerability createVulnerability() {
-471 Vulnerability v = new Vulnerability();
-472 v.setCwe("CWE-287 Improper Authentication" );
-473 v.setName("CVE-2013-1337" );
-474 v.setCvssScore(7.5f);
-475 return v;
-476 }
-477 }
+392
+393 identifier = new Identifier("maven" , "org.springframework:spring-core:2.5.5" , "https://repository.sonatype.org/service/local/artifact/maven/redirect?r=central-proxy&g=org.springframework&a=spring-core&v=2.5.5&e=jar" );
+394 cpe.setValue("org.springframework:spring-core:2.5.5" );
+395 cpe.setRegex(false);
+396 cpe.setCaseSensitive(false);
+397 expResult = true ;
+398 result = instance.identifierMatches("maven" , cpe, identifier);
+399 assertEquals(expResult, result);
+400
+401 cpe.setValue("org\\.springframework\\.security:spring.*" );
+402 cpe.setRegex(true );
+403 cpe.setCaseSensitive(false);
+404 expResult = false;
+405 result = instance.identifierMatches("maven" , cpe, identifier);
+406 assertEquals(expResult, result);
+407 }
+408
+409
+410
+411
+412 @Test
+413 public void testProcess() {
+414 File struts = new File(this .getClass().getClassLoader().getResource("struts2-core-2.1.2.jar" ).getPath());
+415 Dependency dependency = new Dependency(struts);
+416 dependency.addIdentifier("cpe" , "cpe:/a:microsoft:.net_framework:4.5" , "some url not needed for this test" );
+417 String sha1 = dependency.getSha1sum();
+418 dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970" );
+419 Vulnerability v = createVulnerability();
+420 dependency.addVulnerability(v);
+421
+422
+423 SuppressionRule instance = new SuppressionRule();
+424 instance.setSha1(sha1);
+425 instance.addCwe("287" );
+426 instance.process(dependency);
+427 assertTrue(dependency.getVulnerabilities().size() == 1);
+428 dependency.setSha1sum(sha1);
+429 instance.process(dependency);
+430 assertTrue(dependency.getVulnerabilities().isEmpty());
+431 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1);
+432
+433
+434 dependency.addVulnerability(v);
+435 instance = new SuppressionRule();
+436 instance.addCvssBelow(5f);
+437 instance.process(dependency);
+438 assertTrue(dependency.getVulnerabilities().size() == 1);
+439 instance.addCvssBelow(8f);
+440 instance.process(dependency);
+441 assertTrue(dependency.getVulnerabilities().isEmpty());
+442 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1);
+443
+444
+445 dependency.addVulnerability(v);
+446 instance = new SuppressionRule();
+447 instance.addCve("CVE-2012-1337" );
+448 instance.process(dependency);
+449 assertTrue(dependency.getVulnerabilities().size() == 1);
+450 instance.addCve("CVE-2013-1337" );
+451 instance.process(dependency);
+452 assertTrue(dependency.getVulnerabilities().isEmpty());
+453 assertTrue(dependency.getSuppressedVulnerabilities().size() == 1);
+454
+455
+456 instance = new SuppressionRule();
+457 PropertyType pt = new PropertyType();
+458 pt.setValue("cpe:/a:microsoft:.net_framework:4.0" );
+459 instance.addCpe(pt);
+460 instance.process(dependency);
+461 assertTrue(dependency.getIdentifiers().size() == 1);
+462 pt = new PropertyType();
+463 pt.setValue("cpe:/a:microsoft:.net_framework:4.5" );
+464 instance.addCpe(pt);
+465 pt = new PropertyType();
+466 pt.setValue(".*" );
+467 pt.setRegex(true );
+468 instance.setFilePath(pt);
+469 instance.process(dependency);
+470 assertTrue(dependency.getIdentifiers().isEmpty());
+471 assertTrue(dependency.getSuppressedIdentifiers().size() == 1);
+472
+473 dependency.addIdentifier("cpe" , "cpe:/a:microsoft:.net_framework:4.0" , "some url not needed for this test" );
+474 dependency.addIdentifier("cpe" , "cpe:/a:microsoft:.net_framework:4.5" , "some url not needed for this test" );
+475 dependency.addIdentifier("cpe" , "cpe:/a:microsoft:.net_framework:5.0" , "some url not needed for this test" );
+476 pt = new PropertyType();
+477 pt.setValue("cpe:/a:microsoft:.net_framework" );
+478 instance.addCpe(pt);
+479 assertTrue(dependency.getIdentifiers().size() == 3);
+480 instance.process(dependency);
+481 assertTrue(dependency.getIdentifiers().isEmpty());
+482 assertTrue(dependency.getSuppressedIdentifiers().size() == 3);
+483 }
+484
+485
+486
+487
+488 @Test
+489 public void testProcessGAV() {
+490 File spring = new File(this .getClass().getClassLoader().getResource("spring-security-web-3.0.0.RELEASE.jar" ).getPath());
+491 Dependency dependency = new Dependency(spring);
+492 dependency.addIdentifier("cpe" , "cpe:/a:vmware:springsource_spring_framework:3.0.0" , "some url not needed for this test" );
+493 dependency.addIdentifier("cpe" , "cpe:/a:springsource:spring_framework:3.0.0" , "some url not needed for this test" );
+494 dependency.addIdentifier("cpe" , "cpe:/a:mod_security:mod_security:3.0.0" , "some url not needed for this test" );
+495 dependency.addIdentifier("cpe" , "cpe:/a:vmware:springsource_spring_security:3.0.0" , "some url not needed for this test" );
+496 dependency.addIdentifier("maven" , "org.springframework.security:spring-security-web:3.0.0.RELEASE" , "some url not needed for this test" );
+497
+498
+499 SuppressionRule instance = new SuppressionRule();
+500 PropertyType pt = new PropertyType();
+501
+502 pt.setValue("org\\.springframework\\.security:spring.*" );
+503 pt.setRegex(true );
+504 pt.setCaseSensitive(false);
+505 instance.setGav(pt);
+506
+507 pt = new PropertyType();
+508 pt.setValue("cpe:/a:mod_security:mod_security" );
+509 instance.addCpe(pt);
+510 pt = new PropertyType();
+511 pt.setValue("cpe:/a:springsource:spring_framework" );
+512 instance.addCpe(pt);
+513 pt = new PropertyType();
+514 pt.setValue("cpe:/a:vmware:springsource_spring_framework" );
+515 instance.addCpe(pt);
+516
+517 instance.process(dependency);
+518 assertEquals(2, dependency.getIdentifiers().size());
+519
+520 }
+521
+522 private Vulnerability createVulnerability() {
+523 Vulnerability v = new Vulnerability();
+524 v.setCwe("CWE-287 Improper Authentication" );
+525 v.setName("CVE-2013-1337" );
+526 v.setCvssScore(7.5f);
+527 return v;
+528 }
+529 }
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.suppression
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.suppression
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.utils
DependencyVersionUtilTest
-
-
- DownloaderIntegrationTest
-
-
- DownloaderTest
-
-
- FileUtilsTest
FilterTest
-
-
- SettingsTest
diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html
index 1dd086720..4a689c4db 100644
--- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html
+++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.utils
DependencyVersionUtilTest
-
-
-
- DownloaderIntegrationTest
-
-
-
-
- DownloaderTest
-
-
-
-
- FileUtilsTest
-
FilterTest
-
-
-
- SettingsTest
-
diff --git a/dependency-check-core/xref-test/overview-frame.html b/dependency-check-core/xref-test/overview-frame.html
index 9b20e010d..535c9db40 100644
--- a/dependency-check-core/xref-test/overview-frame.html
+++ b/dependency-check-core/xref-test/overview-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
diff --git a/dependency-check-core/xref/allclasses-frame.html b/dependency-check-core/xref/allclasses-frame.html
index f7b842ae4..6527f3309 100644
--- a/dependency-check-core/xref/allclasses-frame.html
+++ b/dependency-check-core/xref/allclasses-frame.html
@@ -70,9 +70,6 @@
CachedWebDataSource
-
-
- CallableDownloadTask
Checksum
@@ -162,10 +159,7 @@
DistributionManagement
- DownloadFailedException
-
-
- Downloader
+ DownloadTask
DriverLoadException
@@ -210,7 +204,7 @@
Extensions
- ExtractionException
+ ExtractionUtil
FalsePositiveAnalyzer
@@ -226,9 +220,6 @@
FileTypeAnalyzer
-
-
- FileUtils
Filter
@@ -268,9 +259,6 @@
InvalidDataException
-
-
- InvalidSettingException
IssueManagement
@@ -280,21 +268,12 @@
JavaScriptAnalyzer
-
-
- KEYS
License
Licenses
-
-
- LogFilter
-
-
- LogUtils
LuceneUtils
@@ -463,9 +442,6 @@
SearchVersionAnalyzer
-
-
- Settings
Site
@@ -493,12 +469,6 @@
TokenPairConcatenatingFilter
-
-
- URLConnectionFactory
-
-
- URLConnectionFailureException
UpdateException
diff --git a/dependency-check-core/xref/index.html b/dependency-check-core/xref/index.html
index b102045ee..794b5abc7 100644
--- a/dependency-check-core/xref/index.html
+++ b/dependency-check-core/xref/index.html
@@ -4,7 +4,7 @@
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html b/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html
index e98d7f19c..8e5ec385d 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.html
@@ -21,7 +21,7 @@
13
14
15
-16
+16
17
18 package org.owasp.dependencycheck.agent;
19
@@ -242,741 +242,764 @@
234 }
235
236
-237
+237
238
-239 private String proxyUrl;
+239 private String proxyServer;
240
241
-242
+242
243
-244
+244
245
-246 public String getProxyUrl() {
-247 return proxyUrl;
+246 public String getProxyServer() {
+247 return proxyServer;
248 }
249
250
-251
+251
252
-253
+253
254
-255 public void setProxyUrl(String proxyUrl) {
-256 this .proxyUrl = proxyUrl;
+255 public void setProxyServer(String proxyServer) {
+256 this .proxyServer = proxyServer;
257 }
258
259
-260
-261
-262 private String proxyPort;
-263
-264
-265
-266
-267
-268
-269 public String getProxyPort() {
-270 return proxyPort;
-271 }
-272
-273
-274
-275
-276
-277
-278 public void setProxyPort(String proxyPort) {
-279 this .proxyPort = proxyPort;
+260
+261
+262
+263
+264
+265 @Deprecated
+266 public String getProxyUrl() {
+267 return proxyServer;
+268 }
+269
+270
+271
+272
+273
+274
+275
+276
+277 @Deprecated
+278 public void setProxyUrl(String proxyUrl) {
+279 this .proxyServer = proxyUrl;
280 }
281
282
-283
+283
284
-285 private String proxyUsername;
+285 private String proxyPort;
286
287
-288
+288
289
-290
+290
291
-292 public String getProxyUsername() {
-293 return proxyUsername;
+292 public String getProxyPort() {
+293 return proxyPort;
294 }
295
296
-297
+297
298
-299
+299
300
-301 public void setProxyUsername(String proxyUsername) {
-302 this .proxyUsername = proxyUsername;
+301 public void setProxyPort(String proxyPort) {
+302 this .proxyPort = proxyPort;
303 }
304
305
-306
+306
307
-308 private String proxyPassword;
+308 private String proxyUsername;
309
310
-311
+311
312
-313
+313
314
-315 public String getProxyPassword() {
-316 return proxyPassword;
+315 public String getProxyUsername() {
+316 return proxyUsername;
317 }
318
319
-320
+320
321
-322
+322
323
-324 public void setProxyPassword(String proxyPassword) {
-325 this .proxyPassword = proxyPassword;
+324 public void setProxyUsername(String proxyUsername) {
+325 this .proxyUsername = proxyUsername;
326 }
327
328
-329
+329
330
-331 private String connectionTimeout;
+331 private String proxyPassword;
332
333
-334
+334
335
-336
+336
337
-338 public String getConnectionTimeout() {
-339 return connectionTimeout;
+338 public String getProxyPassword() {
+339 return proxyPassword;
340 }
341
342
-343
+343
344
-345
+345
346
-347 public void setConnectionTimeout(String connectionTimeout) {
-348 this .connectionTimeout = connectionTimeout;
+347 public void setProxyPassword(String proxyPassword) {
+348 this .proxyPassword = proxyPassword;
349 }
350
351
-352
+352
353
-354 private String logFile = null ;
+354 private String connectionTimeout;
355
356
-357
+357
358
-359
+359
360
-361 public String getLogFile() {
-362 return logFile;
+361 public String getConnectionTimeout() {
+362 return connectionTimeout;
363 }
364
365
-366
+366
367
-368
+368
369
-370 public void setLogFile(String logFile) {
-371 this .logFile = logFile;
+370 public void setConnectionTimeout(String connectionTimeout) {
+371 this .connectionTimeout = connectionTimeout;
372 }
373
374
-375
+375
376
-377 private String suppressionFile;
+377 private String logFile = null ;
378
379
-380
+380
381
-382
+382
383
-384 public String getSuppressionFile() {
-385 return suppressionFile;
+384 public String getLogFile() {
+385 return logFile;
386 }
387
388
-389
+389
390
-391
+391
392
-393 public void setSuppressionFile(String suppressionFile) {
-394 this .suppressionFile = suppressionFile;
+393 public void setLogFile(String logFile) {
+394 this .logFile = logFile;
395 }
396
397
-398
+398
399
-400 private boolean showSummary = true ;
+400 private String suppressionFile;
401
402
-403
+403
404
-405
+405
406
-407 public boolean isShowSummary() {
-408 return showSummary;
+407 public String getSuppressionFile() {
+408 return suppressionFile;
409 }
410
411
-412
+412
413
-414
+414
415
-416 public void setShowSummary(boolean showSummary) {
-417 this .showSummary = showSummary;
+416 public void setSuppressionFile(String suppressionFile) {
+417 this .suppressionFile = suppressionFile;
418 }
419
420
-421
+421
422
-423 private boolean nexusAnalyzerEnabled = true ;
+423 private boolean showSummary = true ;
424
425
-426
+426
427
-428
+428
429
-430 public boolean isNexusAnalyzerEnabled() {
-431 return nexusAnalyzerEnabled;
+430 public boolean isShowSummary() {
+431 return showSummary;
432 }
433
434
-435
+435
436
-437
+437
438
-439 public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
-440 this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
+439 public void setShowSummary(boolean showSummary) {
+440 this .showSummary = showSummary;
441 }
442
443
-444
+444
445
-446 private String nexusUrl;
+446 private boolean nexusAnalyzerEnabled = true ;
447
448
-449
+449
450
-451
+451
452
-453 public String getNexusUrl() {
-454 return nexusUrl;
+453 public boolean isNexusAnalyzerEnabled() {
+454 return nexusAnalyzerEnabled;
455 }
456
457
-458
+458
459
-460
+460
461
-462 public void setNexusUrl(String nexusUrl) {
-463 this .nexusUrl = nexusUrl;
+462 public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
+463 this .nexusAnalyzerEnabled = nexusAnalyzerEnabled;
464 }
465
466
-467
+467
468
-469 private boolean nexusUsesProxy = true ;
+469 private String nexusUrl;
470
471
-472
+472
473
-474
+474
475
-476 public boolean isNexusUsesProxy() {
-477 return nexusUsesProxy;
+476 public String getNexusUrl() {
+477 return nexusUrl;
478 }
479
480
-481
+481
482
-483
+483
484
-485 public void setNexusUsesProxy(boolean nexusUsesProxy) {
-486 this .nexusUsesProxy = nexusUsesProxy;
+485 public void setNexusUrl(String nexusUrl) {
+486 this .nexusUrl = nexusUrl;
487 }
488
489
-490
+490
491
-492 private String databaseDriverName;
+492 private boolean nexusUsesProxy = true ;
493
494
-495
+495
496
-497
+497
498
-499 public String getDatabaseDriverName() {
-500 return databaseDriverName;
+499 public boolean isNexusUsesProxy() {
+500 return nexusUsesProxy;
501 }
502
503
-504
+504
505
-506
+506
507
-508 public void setDatabaseDriverName(String databaseDriverName) {
-509 this .databaseDriverName = databaseDriverName;
+508 public void setNexusUsesProxy(boolean nexusUsesProxy) {
+509 this .nexusUsesProxy = nexusUsesProxy;
510 }
511
512
-513
+513
514
-515 private String databaseDriverPath;
+515 private String databaseDriverName;
516
517
-518
+518
519
-520
+520
521
-522 public String getDatabaseDriverPath() {
-523 return databaseDriverPath;
+522 public String getDatabaseDriverName() {
+523 return databaseDriverName;
524 }
525
526
-527
+527
528
-529
+529
530
-531 public void setDatabaseDriverPath(String databaseDriverPath) {
-532 this .databaseDriverPath = databaseDriverPath;
+531 public void setDatabaseDriverName(String databaseDriverName) {
+532 this .databaseDriverName = databaseDriverName;
533 }
534
535
-536
+536
537
-538 private String connectionString;
+538 private String databaseDriverPath;
539
540
-541
+541
542
-543
+543
544
-545 public String getConnectionString() {
-546 return connectionString;
+545 public String getDatabaseDriverPath() {
+546 return databaseDriverPath;
547 }
548
549
-550
+550
551
-552
+552
553
-554 public void setConnectionString(String connectionString) {
-555 this .connectionString = connectionString;
+554 public void setDatabaseDriverPath(String databaseDriverPath) {
+555 this .databaseDriverPath = databaseDriverPath;
556 }
557
558
-559
+559
560
-561 private String databaseUser;
+561 private String connectionString;
562
563
-564
+564
565
-566
+566
567
-568 public String getDatabaseUser() {
-569 return databaseUser;
+568 public String getConnectionString() {
+569 return connectionString;
570 }
571
572
-573
+573
574
-575
+575
576
-577 public void setDatabaseUser(String databaseUser) {
-578 this .databaseUser = databaseUser;
+577 public void setConnectionString(String connectionString) {
+578 this .connectionString = connectionString;
579 }
580
581
-582
+582
583
-584 private String databasePassword;
+584 private String databaseUser;
585
586
-587
+587
588
-589
+589
590
-591 public String getDatabasePassword() {
-592 return databasePassword;
+591 public String getDatabaseUser() {
+592 return databaseUser;
593 }
594
595
-596
+596
597
-598
+598
599
-600 public void setDatabasePassword(String databasePassword) {
-601 this .databasePassword = databasePassword;
+600 public void setDatabaseUser(String databaseUser) {
+601 this .databaseUser = databaseUser;
602 }
603
604
-605
-606
-607
-608 private String zipExtensions;
-609
-610
-611
-612
-613
-614
-615 public String getZipExtensions() {
-616 return zipExtensions;
-617 }
-618
-619
-620
-621
-622
-623
-624 public void setZipExtensions(String zipExtensions) {
-625 this .zipExtensions = zipExtensions;
-626 }
-627
-628
-629
+605
+606
+607 private String databasePassword;
+608
+609
+610
+611
+612
+613
+614 public String getDatabasePassword() {
+615 return databasePassword;
+616 }
+617
+618
+619
+620
+621
+622
+623 public void setDatabasePassword(String databasePassword) {
+624 this .databasePassword = databasePassword;
+625 }
+626
+627
+628
+629
630
-631 private String cveUrl12Modified;
+631 private String zipExtensions;
632
633
-634
+634
635
-636
+636
637
-638 public String getCveUrl12Modified() {
-639 return cveUrl12Modified;
+638 public String getZipExtensions() {
+639 return zipExtensions;
640 }
641
642
-643
+643
644
-645
+645
646
-647 public void setCveUrl12Modified(String cveUrl12Modified) {
-648 this .cveUrl12Modified = cveUrl12Modified;
+647 public void setZipExtensions(String zipExtensions) {
+648 this .zipExtensions = zipExtensions;
649 }
650
651
-652
+652
653
-654 private String cveUrl20Modified;
+654 private String cveUrl12Modified;
655
656
-657
+657
658
-659
+659
660
-661 public String getCveUrl20Modified() {
-662 return cveUrl20Modified;
+661 public String getCveUrl12Modified() {
+662 return cveUrl12Modified;
663 }
664
665
-666
+666
667
-668
+668
669
-670 public void setCveUrl20Modified(String cveUrl20Modified) {
-671 this .cveUrl20Modified = cveUrl20Modified;
+670 public void setCveUrl12Modified(String cveUrl12Modified) {
+671 this .cveUrl12Modified = cveUrl12Modified;
672 }
673
674
-675
+675
676
-677 private String cveUrl12Base;
+677 private String cveUrl20Modified;
678
679
-680
+680
681
-682
+682
683
-684 public String getCveUrl12Base() {
-685 return cveUrl12Base;
+684 public String getCveUrl20Modified() {
+685 return cveUrl20Modified;
686 }
687
688
-689
+689
690
-691
+691
692
-693 public void setCveUrl12Base(String cveUrl12Base) {
-694 this .cveUrl12Base = cveUrl12Base;
+693 public void setCveUrl20Modified(String cveUrl20Modified) {
+694 this .cveUrl20Modified = cveUrl20Modified;
695 }
696
697
-698
+698
699
-700 private String cveUrl20Base;
+700 private String cveUrl12Base;
701
702
-703
+703
704
-705
+705
706
-707 public String getCveUrl20Base() {
-708 return cveUrl20Base;
+707 public String getCveUrl12Base() {
+708 return cveUrl12Base;
709 }
710
711
-712
+712
713
-714
+714
715
-716 public void setCveUrl20Base(String cveUrl20Base) {
-717 this .cveUrl20Base = cveUrl20Base;
+716 public void setCveUrl12Base(String cveUrl12Base) {
+717 this .cveUrl12Base = cveUrl12Base;
718 }
719
720
-721
+721
722
-723 private String pathToMono;
+723 private String cveUrl20Base;
724
725
-726
+726
727
-728
+728
729
-730 public String getPathToMono() {
-731 return pathToMono;
+730 public String getCveUrl20Base() {
+731 return cveUrl20Base;
732 }
733
734
-735
+735
736
-737
+737
738
-739 public void setPathToMono(String pathToMono) {
-740 this .pathToMono = pathToMono;
+739 public void setCveUrl20Base(String cveUrl20Base) {
+740 this .cveUrl20Base = cveUrl20Base;
741 }
742
743
-744
-745
-746
-747
-748
-749
-750 private Engine executeDependencyCheck() throws DatabaseException {
-751 populateSettings();
-752 Engine engine = null ;
-753 engine = new Engine ();
-754 engine.setDependencies(this .dependencies);
-755 engine.analyzeDependencies();
-756 return engine;
-757 }
-758
-759
-760
-761
-762
-763
-764
-765 private void generateExternalReports(Engine engine, File outDirectory) {
-766 DatabaseProperties prop = null ;
-767 CveDB cve = null ;
-768 try {
-769 cve = new CveDB ();
-770 cve.open();
-771 prop = cve.getDatabaseProperties();
-772 } catch (DatabaseException ex) {
-773 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
-774 } finally {
-775 if (cve != null ) {
-776 cve.close();
-777 }
-778 }
-779 final ReportGenerator r = new ReportGenerator (this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
-780 try {
-781 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
-782 } catch (IOException ex) {
-783 LOGGER.log(Level.SEVERE,
-784 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
-785 LOGGER.log(Level.FINE, null , ex);
-786 } catch (Throwable ex) {
-787 LOGGER.log(Level.SEVERE,
-788 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
-789 LOGGER.log(Level.FINE, null , ex);
-790 }
-791 }
-792
-793
-794
-795
-796
-797 private void populateSettings() {
-798 Settings.initialize();
-799 if (dataDirectory != null ) {
-800 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
-801 } else {
-802 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
-803 final File base = jarPath.getParentFile();
-804 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
-805 final File dataDir = new File(base, sub);
-806 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
-807 }
-808
-809 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
-810
-811 if (proxyUrl != null && !proxyUrl.isEmpty()) {
-812 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
+744
+745
+746 private String pathToMono;
+747
+748
+749
+750
+751
+752
+753 public String getPathToMono() {
+754 return pathToMono;
+755 }
+756
+757
+758
+759
+760
+761
+762 public void setPathToMono(String pathToMono) {
+763 this .pathToMono = pathToMono;
+764 }
+765
+766
+767
+768
+769
+770
+771
+772
+773 private Engine executeDependencyCheck() throws DatabaseException {
+774 populateSettings();
+775 Engine engine = null ;
+776 engine = new Engine ();
+777 engine.setDependencies(this .dependencies);
+778 engine.analyzeDependencies();
+779 return engine;
+780 }
+781
+782
+783
+784
+785
+786
+787
+788 private void generateExternalReports(Engine engine, File outDirectory) {
+789 DatabaseProperties prop = null ;
+790 CveDB cve = null ;
+791 try {
+792 cve = new CveDB ();
+793 cve.open();
+794 prop = cve.getDatabaseProperties();
+795 } catch (DatabaseException ex) {
+796 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+797 } finally {
+798 if (cve != null ) {
+799 cve.close();
+800 }
+801 }
+802 final ReportGenerator r = new ReportGenerator (this .applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
+803 try {
+804 r.generateReports(outDirectory.getCanonicalPath(), this .reportFormat.name());
+805 } catch (IOException ex) {
+806 LOGGER.log(Level.SEVERE,
+807 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+808 LOGGER.log(Level.FINE, null , ex);
+809 } catch (Throwable ex) {
+810 LOGGER.log(Level.SEVERE,
+811 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+812 LOGGER.log(Level.FINE, null , ex);
813 }
-814 if (proxyPort != null && !proxyPort.isEmpty()) {
-815 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
-816 }
-817 if (proxyUsername != null && !proxyUsername.isEmpty()) {
-818 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
-819 }
-820 if (proxyPassword != null && !proxyPassword.isEmpty()) {
-821 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
-822 }
-823 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
-824 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
-825 }
-826 if (suppressionFile != null && !suppressionFile.isEmpty()) {
-827 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
-828 }
-829 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
-830 if (nexusUrl != null && !nexusUrl.isEmpty()) {
-831 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
-832 }
-833 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
-834 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
-835 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+814 }
+815
+816
+817
+818
+819
+820 private void populateSettings() {
+821 Settings.initialize();
+822 if (dataDirectory != null ) {
+823 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+824 } else {
+825 final File jarPath = new File(DependencyCheckScanAgent.class .getProtectionDomain().getCodeSource().getLocation().getPath());
+826 final File base = jarPath.getParentFile();
+827 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+828 final File dataDir = new File(base, sub);
+829 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
+830 }
+831
+832 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+833
+834 if (proxyServer != null && !proxyServer.isEmpty()) {
+835 Settings.setString(Settings.KEYS.PROXY_SERVER, proxyServer);
836 }
-837 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
-838 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+837 if (proxyPort != null && !proxyPort.isEmpty()) {
+838 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
839 }
-840 if (connectionString != null && !connectionString.isEmpty()) {
-841 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+840 if (proxyUsername != null && !proxyUsername.isEmpty()) {
+841 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
842 }
-843 if (databaseUser != null && !databaseUser.isEmpty()) {
-844 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+843 if (proxyPassword != null && !proxyPassword.isEmpty()) {
+844 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
845 }
-846 if (databasePassword != null && !databasePassword.isEmpty()) {
-847 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+846 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+847 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
848 }
-849 if (zipExtensions != null && !zipExtensions.isEmpty()) {
-850 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+849 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+850 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
851 }
-852 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
-853 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
-854 }
-855 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
-856 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
-857 }
-858 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
-859 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
-860 }
-861 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
-862 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
-863 }
-864 if (pathToMono != null && !pathToMono.isEmpty()) {
-865 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
-866 }
-867 }
-868
-869
-870
-871
-872
-873
-874
-875 public void execute() throws ScanAgentException {
-876 Engine engine = null ;
-877 try {
-878 engine = executeDependencyCheck();
-879 generateExternalReports(engine, new File(this .reportOutputDirectory));
-880 if (this .showSummary) {
-881 showSummary(engine.getDependencies());
-882 }
-883 if (this .failBuildOnCVSS <= 10) {
-884 checkForFailure(engine.getDependencies());
-885 }
-886 } catch (DatabaseException ex) {
-887 LOGGER.log(Level.SEVERE,
-888 "Unable to connect to the dependency-check database; analysis has stopped" );
-889 LOGGER.log(Level.FINE, "" , ex);
-890 } finally {
-891 Settings.cleanup(true );
-892 if (engine != null ) {
-893 engine.cleanup();
-894 }
-895 }
-896 }
-897
-898
-899
-900
-901
-902
-903
-904
-905
-906 private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
-907 final StringBuilder ids = new StringBuilder();
-908 for (Dependency d : dependencies) {
-909 boolean addName = true ;
-910 for (Vulnerability v : d.getVulnerabilities()) {
-911 if (v.getCvssScore() >= failBuildOnCVSS) {
-912 if (addName) {
-913 addName = false;
-914 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
-915 ids.append(v.getName());
-916 } else {
-917 ids.append(", " ).append(v.getName());
-918 }
-919 }
-920 }
-921 }
-922 if (ids.length() > 0) {
-923 final String msg = String.format("%n%nDependency-Check Failure:%n"
-924 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
-925 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
-926
-927 throw new ScanAgentException (msg);
-928 }
-929 }
-930
-931
-932
-933
-934
-935
-936 private void showSummary(List<Dependency> dependencies) {
-937 final StringBuilder summary = new StringBuilder();
-938 for (Dependency d : dependencies) {
-939 boolean firstEntry = true ;
-940 final StringBuilder ids = new StringBuilder();
-941 for (Vulnerability v : d.getVulnerabilities()) {
-942 if (firstEntry) {
-943 firstEntry = false;
-944 } else {
-945 ids.append(", " );
-946 }
-947 ids.append(v.getName());
-948 }
-949 if (ids.length() > 0) {
-950 summary.append(d.getFileName()).append(" (" );
-951 firstEntry = true ;
-952 for (Identifier id : d.getIdentifiers()) {
-953 if (firstEntry) {
-954 firstEntry = false;
-955 } else {
-956 summary.append(", " );
-957 }
-958 summary.append(id.getValue());
-959 }
-960 summary.append(") : " ).append(ids).append(NEW_LINE);
-961 }
-962 }
-963 if (summary.length() > 0) {
-964 final String msg = String.format("%n%n"
-965 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
-966 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
-967 LOGGER.log(Level.WARNING, msg);
-968 }
-969 }
-970
-971 }
+852 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+853 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+854 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+855 }
+856 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+857 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+858 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+859 }
+860 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+861 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+862 }
+863 if (connectionString != null && !connectionString.isEmpty()) {
+864 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+865 }
+866 if (databaseUser != null && !databaseUser.isEmpty()) {
+867 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+868 }
+869 if (databasePassword != null && !databasePassword.isEmpty()) {
+870 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+871 }
+872 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+873 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+874 }
+875 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+876 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+877 }
+878 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+879 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
+880 }
+881 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+882 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+883 }
+884 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+885 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+886 }
+887 if (pathToMono != null && !pathToMono.isEmpty()) {
+888 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+889 }
+890 }
+891
+892
+893
+894
+895
+896
+897
+898 public void execute() throws ScanAgentException {
+899 Engine engine = null ;
+900 try {
+901 engine = executeDependencyCheck();
+902 generateExternalReports(engine, new File(this .reportOutputDirectory));
+903 if (this .showSummary) {
+904 showSummary(engine.getDependencies());
+905 }
+906 if (this .failBuildOnCVSS <= 10) {
+907 checkForFailure(engine.getDependencies());
+908 }
+909 } catch (DatabaseException ex) {
+910 LOGGER.log(Level.SEVERE,
+911 "Unable to connect to the dependency-check database; analysis has stopped" );
+912 LOGGER.log(Level.FINE, "" , ex);
+913 } finally {
+914 Settings.cleanup(true );
+915 if (engine != null ) {
+916 engine.cleanup();
+917 }
+918 }
+919 }
+920
+921
+922
+923
+924
+925
+926
+927
+928
+929 private void checkForFailure(List<Dependency> dependencies) throws ScanAgentException {
+930 final StringBuilder ids = new StringBuilder();
+931 for (Dependency d : dependencies) {
+932 boolean addName = true ;
+933 for (Vulnerability v : d.getVulnerabilities()) {
+934 if (v.getCvssScore() >= failBuildOnCVSS) {
+935 if (addName) {
+936 addName = false;
+937 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+938 ids.append(v.getName());
+939 } else {
+940 ids.append(", " ).append(v.getName());
+941 }
+942 }
+943 }
+944 }
+945 if (ids.length() > 0) {
+946 final String msg = String.format("%n%nDependency-Check Failure:%n"
+947 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+948 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+949
+950 throw new ScanAgentException (msg);
+951 }
+952 }
+953
+954
+955
+956
+957
+958
+959 private void showSummary(List<Dependency> dependencies) {
+960 final StringBuilder summary = new StringBuilder();
+961 for (Dependency d : dependencies) {
+962 boolean firstEntry = true ;
+963 final StringBuilder ids = new StringBuilder();
+964 for (Vulnerability v : d.getVulnerabilities()) {
+965 if (firstEntry) {
+966 firstEntry = false;
+967 } else {
+968 ids.append(", " );
+969 }
+970 ids.append(v.getName());
+971 }
+972 if (ids.length() > 0) {
+973 summary.append(d.getFileName()).append(" (" );
+974 firstEntry = true ;
+975 for (Identifier id : d.getIdentifiers()) {
+976 if (firstEntry) {
+977 firstEntry = false;
+978 } else {
+979 summary.append(", " );
+980 }
+981 summary.append(id.getValue());
+982 }
+983 summary.append(") : " ).append(ids).append(NEW_LINE);
+984 }
+985 }
+986 if (summary.length() > 0) {
+987 final String msg = String.format("%n%n"
+988 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+989 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+990 LOGGER.log(Level.WARNING, msg);
+991 }
+992 }
+993
+994 }
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.agent
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.agent
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.agent
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.agent
98
99
100 private void loadSuppressionData() throws SuppressionParseException {
-101 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
-102 if (suppressionFilePath == null ) {
-103 return ;
-104 }
-105 File file = null ;
-106 boolean deleteTempFile = false;
-107 try {
-108 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
-109 if (uriRx.matcher(suppressionFilePath).matches()) {
-110 deleteTempFile = true ;
-111 file = FileUtils.getTempFile("suppression" , "xml" );
-112 final URL url = new URL(suppressionFilePath);
-113 try {
-114 Downloader.fetchFile(url, file, false);
-115 } catch (DownloadFailedException ex) {
-116 Downloader.fetchFile(url, file, true );
-117 }
-118 } else {
-119 file = new File(suppressionFilePath);
-120 if (!file.exists()) {
-121 final InputStream suppressionsFromClasspath = this .getClass().getClassLoader().getResourceAsStream(suppressionFilePath);
-122 if (suppressionsFromClasspath != null ) {
-123 deleteTempFile = true ;
-124 file = FileUtils.getTempFile("suppression" , "xml" );
-125 try {
-126 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file);
-127 } catch (IOException ex) {
-128 throwSuppressionParseException("Unable to locate suppressions file in classpath" , ex);
-129 }
-130 }
-131 }
-132 }
-133
-134 if (file != null ) {
-135 final SuppressionParser parser = new SuppressionParser ();
-136 try {
-137 rules = parser.parseSuppressionRules(file);
-138 LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded." );
-139 } catch (SuppressionParseException ex) {
-140 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
-141 LOGGER.log(Level.WARNING, msg);
-142 LOGGER.log(Level.WARNING, ex.getMessage());
-143 LOGGER.log(Level.FINE, "" , ex);
-144 throw ex;
-145 }
-146 }
-147 } catch (DownloadFailedException ex) {
-148 throwSuppressionParseException("Unable to fetch the configured suppression file" , ex);
-149 } catch (MalformedURLException ex) {
-150 throwSuppressionParseException("Configured suppression file has an invalid URL" , ex);
-151 } catch (IOException ex) {
-152 throwSuppressionParseException("Unable to create temp file for suppressions" , ex);
-153 } finally {
-154 if (deleteTempFile && file != null ) {
-155 FileUtils.delete(file);
-156 }
-157 }
-158 }
-159
-160
-161
-162
-163
-164
-165
-166
-167 private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException {
-168 LOGGER.log(Level.WARNING, message);
-169 LOGGER.log(Level.FINE, "" , exception);
-170 throw new SuppressionParseException (message, exception);
-171 }
-172 }
+101 final SuppressionParser parser = new SuppressionParser ();
+102 File file = null ;
+103 file = new File(this .getClass().getClassLoader().getResource("dependencycheck-base-suppression.xml" ).getPath());
+104 try {
+105 rules = parser.parseSuppressionRules(file);
+106 } catch (SuppressionParseException ex) {
+107 LOGGER.log(Level.FINE, "Unable to parse the base suppression data file" , ex);
+108 }
+109 final String suppressionFilePath = Settings.getString(Settings.KEYS.SUPPRESSION_FILE);
+110 if (suppressionFilePath == null ) {
+111 return ;
+112 }
+113 boolean deleteTempFile = false;
+114 try {
+115 final Pattern uriRx = Pattern.compile("^(https?|file)\\:.*" , Pattern.CASE_INSENSITIVE);
+116 if (uriRx.matcher(suppressionFilePath).matches()) {
+117 deleteTempFile = true ;
+118 file = FileUtils.getTempFile("suppression" , "xml" );
+119 final URL url = new URL(suppressionFilePath);
+120 try {
+121 Downloader.fetchFile(url, file, false);
+122 } catch (DownloadFailedException ex) {
+123 Downloader.fetchFile(url, file, true );
+124 }
+125 } else {
+126 file = new File(suppressionFilePath);
+127 if (!file.exists()) {
+128 final InputStream suppressionsFromClasspath = this .getClass().getClassLoader().getResourceAsStream(suppressionFilePath);
+129 if (suppressionsFromClasspath != null ) {
+130 deleteTempFile = true ;
+131 file = FileUtils.getTempFile("suppression" , "xml" );
+132 try {
+133 org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionsFromClasspath, file);
+134 } catch (IOException ex) {
+135 throwSuppressionParseException("Unable to locate suppressions file in classpath" , ex);
+136 }
+137 }
+138 }
+139 }
+140
+141 if (file != null ) {
+142 try {
+143
+144 rules.addAll(parser.parseSuppressionRules(file));
+145 LOGGER.log(Level.FINE, rules.size() + " suppression rules were loaded." );
+146 } catch (SuppressionParseException ex) {
+147 final String msg = String.format("Unable to parse suppression xml file '%s'" , file.getPath());
+148 LOGGER.log(Level.WARNING, msg);
+149 LOGGER.log(Level.WARNING, ex.getMessage());
+150 LOGGER.log(Level.FINE, "" , ex);
+151 throw ex;
+152 }
+153 }
+154 } catch (DownloadFailedException ex) {
+155 throwSuppressionParseException("Unable to fetch the configured suppression file" , ex);
+156 } catch (MalformedURLException ex) {
+157 throwSuppressionParseException("Configured suppression file has an invalid URL" , ex);
+158 } catch (IOException ex) {
+159 throwSuppressionParseException("Unable to create temp file for suppressions" , ex);
+160 } finally {
+161 if (deleteTempFile && file != null ) {
+162 FileUtils.delete(file);
+163 }
+164 }
+165 }
+166
+167
+168
+169
+170
+171
+172
+173
+174 private void throwSuppressionParseException(String message, Exception exception) throws SuppressionParseException {
+175 LOGGER.log(Level.WARNING, message);
+176 LOGGER.log(Level.FINE, "" , exception);
+177 throw new SuppressionParseException (message, exception);
+178 }
+179 }
205 grokAssemblyExe.deleteOnExit();
206 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.deployed" , grokAssemblyExe.getPath());
207 } catch (IOException ioe) {
-208 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.notdeployed" , ioe.getMessage());
-209 throw new AnalysisException ("Could not extract GrokAssembly.exe" , ioe);
-210 } finally {
-211 if (fos != null ) {
-212 try {
-213 fos.close();
-214 } catch (Throwable e) {
-215 LOGGER.fine("Error closing output stream" );
-216 }
-217 }
-218 if (is != null ) {
-219 try {
-220 is.close();
-221 } catch (Throwable e) {
-222 LOGGER.fine("Error closing input stream" );
-223 }
-224 }
-225 }
-226
-227
-228 final List<String> args = buildArgumentList();
-229 BufferedReader rdr = null ;
-230 try {
-231 final ProcessBuilder pb = new ProcessBuilder(args);
-232 final Process p = pb.start();
-233
-234 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8" ));
-235 while (rdr.ready() && rdr.readLine() != null ) {
-236
-237 }
-238 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
-239 final XPath xpath = XPathFactory.newInstance().newXPath();
-240 final String error = xpath.evaluate("/assembly/error" , doc);
-241 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
-242 LOGGER.warning("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details." );
-243 LOGGER.fine("GrokAssembly.exe is not working properly" );
-244 grokAssemblyExe = null ;
-245 throw new AnalysisException ("Could not execute .NET AssemblyAnalyzer" );
-246 }
-247 } catch (Throwable e) {
-248 if (e instanceof AnalysisException) {
-249 throw (AnalysisException) e;
-250 } else {
-251 LOGGER.warning("analyzer.AssemblyAnalyzer.grokassembly.initialization.failed" );
-252 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.initialization.message" , e.getMessage());
-253 throw new AnalysisException ("An error occured with the .NET AssemblyAnalyzer" , e);
-254 }
-255 } finally {
-256 if (rdr != null ) {
-257 try {
-258 rdr.close();
-259 } catch (IOException ex) {
-260 LOGGER.log(Level.FINEST, "ignore" , ex);
-261 }
-262 }
-263 }
-264
-265 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
-266 }
-267
-268 @Override
-269 public void close() throws Exception {
-270 super .close();
-271 try {
-272 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
-273 grokAssemblyExe.deleteOnExit();
-274 }
-275 } catch (SecurityException se) {
-276 LOGGER.fine("analyzer.AssemblyAnalyzer.grokassembly.notdeleted" );
-277 }
-278 }
-279
-280
-281
-282
-283
-284
-285 @Override
-286 public Set<String> getSupportedExtensions() {
-287 return SUPPORTED_EXTENSIONS;
-288 }
-289
-290
-291
-292
-293
-294
-295 @Override
-296 public String getName() {
-297 return ANALYZER_NAME;
-298 }
-299
-300
-301
-302
-303
-304
-305 @Override
-306 public AnalysisPhase getAnalysisPhase() {
-307 return ANALYSIS_PHASE;
-308 }
-309
-310
-311
-312
-313
-314
-315 @Override
-316 protected String getAnalyzerEnabledSettingKey() {
-317 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
-318 }
-319 }
+208 this .setEnabled(false);
+209 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.notdeployed" , ioe.getMessage());
+210 throw new AnalysisException ("Could not extract GrokAssembly.exe" , ioe);
+211 } finally {
+212 if (fos != null ) {
+213 try {
+214 fos.close();
+215 } catch (Throwable e) {
+216 LOGGER.fine("Error closing output stream" );
+217 }
+218 }
+219 if (is != null ) {
+220 try {
+221 is.close();
+222 } catch (Throwable e) {
+223 LOGGER.fine("Error closing input stream" );
+224 }
+225 }
+226 }
+227
+228
+229 final List<String> args = buildArgumentList();
+230 BufferedReader rdr = null ;
+231 try {
+232 final ProcessBuilder pb = new ProcessBuilder(args);
+233 final Process p = pb.start();
+234
+235 rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8" ));
+236 while (rdr.ready() && rdr.readLine() != null ) {
+237
+238 }
+239 final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
+240 final XPath xpath = XPathFactory.newInstance().newXPath();
+241 final String error = xpath.evaluate("/assembly/error" , doc);
+242 if (p.waitFor() != 1 || error == null || "" .equals(error)) {
+243 LOGGER.warning("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details." );
+244 LOGGER.fine("GrokAssembly.exe is not working properly" );
+245 grokAssemblyExe = null ;
+246 this .setEnabled(false);
+247 throw new AnalysisException ("Could not execute .NET AssemblyAnalyzer" );
+248 }
+249 } catch (Throwable e) {
+250 if (e instanceof AnalysisException) {
+251 throw (AnalysisException) e;
+252 } else {
+253 LOGGER.warning("analyzer.AssemblyAnalyzer.grokassembly.initialization.failed" );
+254 LOGGER.log(Level.FINE, "analyzer.AssemblyAnalyzer.grokassembly.initialization.message" , e.getMessage());
+255 this .setEnabled(false);
+256 throw new AnalysisException ("An error occured with the .NET AssemblyAnalyzer" , e);
+257 }
+258 } finally {
+259 if (rdr != null ) {
+260 try {
+261 rdr.close();
+262 } catch (IOException ex) {
+263 LOGGER.log(Level.FINEST, "ignore" , ex);
+264 }
+265 }
+266 }
+267 builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+268 }
+269
+270 @Override
+271 public void close() throws Exception {
+272 super .close();
+273 try {
+274 if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
+275 grokAssemblyExe.deleteOnExit();
+276 }
+277 } catch (SecurityException se) {
+278 LOGGER.fine("analyzer.AssemblyAnalyzer.grokassembly.notdeleted" );
+279 }
+280 }
+281
+282
+283
+284
+285
+286
+287 @Override
+288 public Set<String> getSupportedExtensions() {
+289 return SUPPORTED_EXTENSIONS;
+290 }
+291
+292
+293
+294
+295
+296
+297 @Override
+298 public String getName() {
+299 return ANALYZER_NAME;
+300 }
+301
+302
+303
+304
+305
+306
+307 @Override
+308 public AnalysisPhase getAnalysisPhase() {
+309 return ANALYSIS_PHASE;
+310 }
+311
+312
+313
+314
+315
+316
+317 @Override
+318 protected String getAnalyzerEnabledSettingKey() {
+319 return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
+320 }
+321 }
531 if (dbVer == null
532 || evVer.equals(dbVer)) {
533
-534
-535 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
-536 final IdentifierMatch match = new IdentifierMatch ("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
-537 collected.add(match);
-538 } else {
-539
-540 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
-541 && evVer.matchesAtLeastThreeLevels(dbVer)) {
-542 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
-543 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
-544 bestGuess = dbVer;
-545 bestGuessConf = conf;
-546 }
-547 }
-548 }
-549 }
-550 }
-551 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
-552 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
-553 bestGuess = evVer;
-554 bestGuessConf = conf;
-555 }
-556 }
-557 }
-558 }
-559 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
-560 final String url = null ;
-561 if (bestGuessConf == null ) {
-562 bestGuessConf = Confidence.LOW;
-563 }
-564 final IdentifierMatch match = new IdentifierMatch ("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
-565 collected.add(match);
-566
-567 Collections.sort(collected);
-568 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
-569 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
-570 for (IdentifierMatch m : collected) {
-571 if (bestIdentifierQuality.equals(m.getConfidence())
-572 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
-573 final Identifier i = m.getIdentifier();
-574 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
-575 i.setConfidence(Confidence.LOW);
-576 } else {
-577 i.setConfidence(bestEvidenceQuality);
-578 }
-579 dependency.addIdentifier(i);
-580 }
-581 }
-582 }
-583
-584
-585
-586
-587 private enum IdentifierConfidence {
-588
-589
-590
-591
-592 EXACT_MATCH,
-593
-594
-595
-596 BEST_GUESS
-597 }
-598
-599
-600
-601
-602 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
-603
-604
-605
-606
-607
-608
-609
-610
-611
-612
-613 IdentifierMatch (String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
-614 this .identifier = new Identifier (type, value, url);
-615 this .confidence = identifierConfidence;
-616 this .evidenceConfidence = evidenceConfidence;
-617 }
-618
-619
-620
-621
-622 private Confidence evidenceConfidence;
-623
-624
-625
-626
-627
-628
-629 public Confidence getEvidenceConfidence() {
-630 return evidenceConfidence;
-631 }
-632
-633
-634
-635
-636
-637
-638 public void setEvidenceConfidence(Confidence evidenceConfidence) {
-639 this .evidenceConfidence = evidenceConfidence;
-640 }
-641
-642
-643
-644 private IdentifierConfidence confidence;
-645
-646
-647
-648
-649
-650
-651 public IdentifierConfidence getConfidence() {
-652 return confidence;
-653 }
-654
-655
-656
-657
-658
-659
-660 public void setConfidence(IdentifierConfidence confidence) {
-661 this .confidence = confidence;
-662 }
-663
-664
-665
-666 private Identifier identifier;
-667
-668
-669
-670
-671
-672
-673 public Identifier getIdentifier() {
-674 return identifier;
-675 }
-676
-677
-678
-679
-680
-681
-682 public void setIdentifier(Identifier identifier) {
-683 this .identifier = identifier;
-684 }
-685
-686
-687
-688
-689
-690
-691
-692
-693 @Override
-694 public String toString() {
-695 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
-696 + ", confidence=" + confidence + ", identifier=" + identifier + '}';
-697 }
-698
-699
-700
-701
-702
-703
-704 @Override
-705 public int hashCode() {
-706 int hash = 5;
-707 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
-708 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
-709 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
-710 return hash;
-711 }
-712
-713
-714
-715
-716
-717
-718
-719 @Override
-720 public boolean equals(Object obj) {
-721 if (obj == null ) {
-722 return false;
-723 }
-724 if (getClass() != obj.getClass()) {
-725 return false;
-726 }
-727 final IdentifierMatch other = (IdentifierMatch) obj;
-728 if (this .evidenceConfidence != other.evidenceConfidence) {
-729 return false;
-730 }
-731 if (this .confidence != other.confidence) {
-732 return false;
-733 }
-734 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
-735 return false;
-736 }
-737 return true ;
-738 }
-739
-740
-741
-742
-743
-744
-745
-746
-747
-748 @Override
-749 public int compareTo(IdentifierMatch o) {
-750 int conf = this .confidence.compareTo(o.confidence);
-751 if (conf == 0) {
-752 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
-753 if (conf == 0) {
-754 conf = identifier.compareTo(o.identifier);
-755 }
-756 }
-757 return conf;
-758 }
-759 }
-760 }
+534 final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getName(), "UTF-8" ));
+535 final IdentifierMatch match = new IdentifierMatch ("cpe" , vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
+536 collected.add(match);
+537 } else {
+538
+539 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
+540 && evVer.matchesAtLeastThreeLevels(dbVer)) {
+541 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+542 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
+543 bestGuess = dbVer;
+544 bestGuessConf = conf;
+545 }
+546 }
+547 }
+548 }
+549 }
+550 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
+551 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
+552 bestGuess = evVer;
+553 bestGuessConf = conf;
+554 }
+555 }
+556 }
+557 }
+558 final String cpeName = String.format("cpe:/a:%s:%s:%s" , vendor, product, bestGuess.toString());
+559 final String url = null ;
+560 if (bestGuessConf == null ) {
+561 bestGuessConf = Confidence.LOW;
+562 }
+563 final IdentifierMatch match = new IdentifierMatch ("cpe" , cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
+564 collected.add(match);
+565
+566 Collections.sort(collected);
+567 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
+568 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
+569 for (IdentifierMatch m : collected) {
+570 if (bestIdentifierQuality.equals(m.getConfidence())
+571 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
+572 final Identifier i = m.getIdentifier();
+573 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
+574 i.setConfidence(Confidence.LOW);
+575 } else {
+576 i.setConfidence(bestEvidenceQuality);
+577 }
+578 dependency.addIdentifier(i);
+579 }
+580 }
+581 }
+582
+583
+584
+585
+586 private enum IdentifierConfidence {
+587
+588
+589
+590
+591 EXACT_MATCH,
+592
+593
+594
+595 BEST_GUESS
+596 }
+597
+598
+599
+600
+601 private static class IdentifierMatch implements Comparable<IdentifierMatch> {
+602
+603
+604
+605
+606
+607
+608
+609
+610
+611
+612 IdentifierMatch (String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
+613 this .identifier = new Identifier (type, value, url);
+614 this .confidence = identifierConfidence;
+615 this .evidenceConfidence = evidenceConfidence;
+616 }
+617
+618
+619
+620
+621 private Confidence evidenceConfidence;
+622
+623
+624
+625
+626
+627
+628 public Confidence getEvidenceConfidence() {
+629 return evidenceConfidence;
+630 }
+631
+632
+633
+634
+635
+636
+637 public void setEvidenceConfidence(Confidence evidenceConfidence) {
+638 this .evidenceConfidence = evidenceConfidence;
+639 }
+640
+641
+642
+643 private IdentifierConfidence confidence;
+644
+645
+646
+647
+648
+649
+650 public IdentifierConfidence getConfidence() {
+651 return confidence;
+652 }
+653
+654
+655
+656
+657
+658
+659 public void setConfidence(IdentifierConfidence confidence) {
+660 this .confidence = confidence;
+661 }
+662
+663
+664
+665 private Identifier identifier;
+666
+667
+668
+669
+670
+671
+672 public Identifier getIdentifier() {
+673 return identifier;
+674 }
+675
+676
+677
+678
+679
+680
+681 public void setIdentifier(Identifier identifier) {
+682 this .identifier = identifier;
+683 }
+684
+685
+686
+687
+688
+689
+690
+691
+692 @Override
+693 public String toString() {
+694 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
+695 + ", confidence=" + confidence + ", identifier=" + identifier + '}';
+696 }
+697
+698
+699
+700
+701
+702
+703 @Override
+704 public int hashCode() {
+705 int hash = 5;
+706 hash = 97 * hash + (this .evidenceConfidence != null ? this .evidenceConfidence.hashCode() : 0);
+707 hash = 97 * hash + (this .confidence != null ? this .confidence.hashCode() : 0);
+708 hash = 97 * hash + (this .identifier != null ? this .identifier.hashCode() : 0);
+709 return hash;
+710 }
+711
+712
+713
+714
+715
+716
+717
+718 @Override
+719 public boolean equals(Object obj) {
+720 if (obj == null ) {
+721 return false;
+722 }
+723 if (getClass() != obj.getClass()) {
+724 return false;
+725 }
+726 final IdentifierMatch other = (IdentifierMatch) obj;
+727 if (this .evidenceConfidence != other.evidenceConfidence) {
+728 return false;
+729 }
+730 if (this .confidence != other.confidence) {
+731 return false;
+732 }
+733 if (this .identifier != other.identifier && (this .identifier == null || !this .identifier.equals(other.identifier))) {
+734 return false;
+735 }
+736 return true ;
+737 }
+738
+739
+740
+741
+742
+743
+744
+745
+746
+747 @Override
+748 public int compareTo(IdentifierMatch o) {
+749 int conf = this .confidence.compareTo(o.confidence);
+750 if (conf == 0) {
+751 conf = this .evidenceConfidence.compareTo(o.evidenceConfidence);
+752 if (conf == 0) {
+753 conf = identifier.compareTo(o.identifier);
+754 }
+755 }
+756 return conf;
+757 }
+758 }
+759 }
161
162 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
163 + "java(_platform_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
-164 + "jdk|jre|jsf|jsse)($|:.*)" );
-165
-166
-167
-168 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
-169
+164 + "jdk|jre|jsse)($|:.*)" );
+165
+166
+167
+168
+169 public static final Pattern CORE_JAVA_JSF = Pattern.compile("^cpe:/a:(sun|oracle|ibm):jsf($|:.*)" );
170
-171
-172
-173
-174
-175 private void removeJreEntries(Dependency dependency) {
-176 final Set<Identifier> identifiers = dependency.getIdentifiers();
-177 final Iterator<Identifier> itr = identifiers.iterator();
-178 while (itr.hasNext()) {
-179 final Identifier i = itr.next();
-180 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
-181 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
-182 if (coreCPE.matches() && !coreFiles.matches()) {
-183 itr.remove();
-184 }
-185 }
-186 }
-187
-188
-189
-190
-191
-192
-193
-194
-195 private VulnerableSoftware parseCpe(String type, String value) {
-196 if (!"cpe" .equals(type)) {
-197 return null ;
-198 }
-199 final VulnerableSoftware cpe = new VulnerableSoftware ();
-200 try {
-201 cpe.parseName(value);
-202 } catch (UnsupportedEncodingException ex) {
-203 LOGGER.log(Level.FINEST, null , ex);
-204 return null ;
-205 }
-206 return cpe;
-207 }
-208
-209
-210
-211
-212
-213
-214
-215 private void removeBadMatches(Dependency dependency) {
-216 final Set<Identifier> identifiers = dependency.getIdentifiers();
-217 final Iterator<Identifier> itr = identifiers.iterator();
-218
-219
-220
-221
-222
-223
-224
-225
-226 while (itr.hasNext()) {
-227 final Identifier i = itr.next();
-228
-229 if ("cpe" .equals(i.getType())) {
-230 if ((i.getValue().matches(".*c\\+\\+.*" )
-231 || i.getValue().startsWith("cpe:/a:file:file" )
-232 || i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
-233 || i.getValue().startsWith("cpe:/a:cvs:cvs" )
-234 || i.getValue().startsWith("cpe:/a:ftp:ftp" )
-235 || i.getValue().startsWith("cpe:/a:tcp:tcp" )
-236 || i.getValue().startsWith("cpe:/a:ssh:ssh" )
-237 || i.getValue().startsWith("cpe:/a:lookup:lookup" ))
-238 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
-239 || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
-240 || dependency.getFileName().toLowerCase().endsWith(".dll" )
-241 || dependency.getFileName().toLowerCase().endsWith(".exe" )
-242 || dependency.getFileName().toLowerCase().endsWith(".nuspec" )
-243 || dependency.getFileName().toLowerCase().endsWith(".nupkg" ))) {
-244 itr.remove();
-245 } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery" )
-246 || i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
-247 || i.getValue().startsWith("cpe:/a:yahoo:yui" ))
-248 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
-249 || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
-250 || dependency.getFileName().toLowerCase().endsWith(".dll" )
-251 || dependency.getFileName().toLowerCase().endsWith(".exe" ))) {
-252 itr.remove();
-253 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
-254 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
-255 itr.remove();
-256 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
-257 && !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
+171
+172
+173 public static final Pattern CORE_FILES = Pattern.compile("(^|/)((alt[-])?rt|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$" );
+174
+175
+176
+177 public static final Pattern CORE_JSF_FILES = Pattern.compile("(^|/)jsf[-][^/]*\\.jar$" );
+178
+179
+180
+181
+182
+183
+184 private void removeJreEntries(Dependency dependency) {
+185 final Set<Identifier> identifiers = dependency.getIdentifiers();
+186 final Iterator<Identifier> itr = identifiers.iterator();
+187 while (itr.hasNext()) {
+188 final Identifier i = itr.next();
+189 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
+190 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
+191 if (coreCPE.matches() && !coreFiles.matches()) {
+192 itr.remove();
+193 }
+194 final Matcher coreJsfCPE = CORE_JAVA_JSF.matcher(i.getValue());
+195 final Matcher coreJsfFiles = CORE_JSF_FILES.matcher(dependency.getFileName());
+196 if (coreJsfCPE.matches() && !coreJsfFiles.matches()) {
+197 itr.remove();
+198 }
+199 }
+200 }
+201
+202
+203
+204
+205
+206
+207
+208
+209 private VulnerableSoftware parseCpe(String type, String value) {
+210 if (!"cpe" .equals(type)) {
+211 return null ;
+212 }
+213 final VulnerableSoftware cpe = new VulnerableSoftware ();
+214 try {
+215 cpe.parseName(value);
+216 } catch (UnsupportedEncodingException ex) {
+217 LOGGER.log(Level.FINEST, null , ex);
+218 return null ;
+219 }
+220 return cpe;
+221 }
+222
+223
+224
+225
+226
+227
+228
+229 private void removeBadMatches(Dependency dependency) {
+230 final Set<Identifier> identifiers = dependency.getIdentifiers();
+231 final Iterator<Identifier> itr = identifiers.iterator();
+232
+233
+234
+235
+236
+237
+238
+239
+240 while (itr.hasNext()) {
+241 final Identifier i = itr.next();
+242
+243 if ("cpe" .equals(i.getType())) {
+244 if ((i.getValue().matches(".*c\\+\\+.*" )
+245 || i.getValue().startsWith("cpe:/a:file:file" )
+246 || i.getValue().startsWith("cpe:/a:mozilla:mozilla" )
+247 || i.getValue().startsWith("cpe:/a:cvs:cvs" )
+248 || i.getValue().startsWith("cpe:/a:ftp:ftp" )
+249 || i.getValue().startsWith("cpe:/a:tcp:tcp" )
+250 || i.getValue().startsWith("cpe:/a:ssh:ssh" )
+251 || i.getValue().startsWith("cpe:/a:lookup:lookup" ))
+252 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
+253 || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
+254 || dependency.getFileName().toLowerCase().endsWith(".dll" )
+255 || dependency.getFileName().toLowerCase().endsWith(".exe" )
+256 || dependency.getFileName().toLowerCase().endsWith(".nuspec" )
+257 || dependency.getFileName().toLowerCase().endsWith(".nupkg" ))) {
258 itr.remove();
-259 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
-260 && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar" )) {
-261 itr.remove();
-262 }
-263 }
-264 }
-265 }
-266
-267
-268
-269
-270
-271
-272 private void removeWrongVersionMatches(Dependency dependency) {
-273 final Set<Identifier> identifiers = dependency.getIdentifiers();
-274 final Iterator<Identifier> itr = identifiers.iterator();
-275
-276 final String fileName = dependency.getFileName();
-277 if (fileName != null && fileName.contains("axis2" )) {
-278 while (itr.hasNext()) {
-279 final Identifier i = itr.next();
-280 if ("cpe" .equals(i.getType())) {
-281 final String cpe = i.getValue();
-282 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
-283 itr.remove();
-284 }
-285 }
-286 }
-287 } else if (fileName != null && fileName.contains("axis" )) {
-288 while (itr.hasNext()) {
-289 final Identifier i = itr.next();
-290 if ("cpe" .equals(i.getType())) {
-291 final String cpe = i.getValue();
-292 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
-293 itr.remove();
-294 }
-295 }
-296 }
-297 }
-298 }
-299
-300
-301
-302
-303
-304
-305
-306
-307 private void addFalseNegativeCPEs(Dependency dependency) {
-308
-309 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
-310 while (itr.hasNext()) {
-311 final Identifier i = itr.next();
-312 if ("cpe" .equals(i.getType()) && i.getValue() != null
-313 && (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
-314 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
-315 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
-316 || i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
-317 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
-318 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
-319 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
-320 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
-321 try {
-322 dependency.addIdentifier("cpe" ,
-323 newCpe,
-324 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8" )));
-325 dependency.addIdentifier("cpe" ,
-326 newCpe2,
-327 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8" )));
-328 dependency.addIdentifier("cpe" ,
-329 newCpe3,
-330 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8" )));
-331 dependency.addIdentifier("cpe" ,
-332 newCpe4,
-333 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8" )));
-334 } catch (UnsupportedEncodingException ex) {
-335 LOGGER.log(Level.FINE, null , ex);
-336 }
-337 }
-338 }
-339 }
-340
-341
-342
-343
-344
-345
-346
-347
-348 private void removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) {
-349 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )
-350 || "dll" .equals(dependency.getFileExtension())
-351 || "exe" .equals(dependency.getFileExtension())) {
-352 String parentPath = dependency.getFilePath().toLowerCase();
-353 if (parentPath.contains(".jar" )) {
-354 parentPath = parentPath.substring(0, parentPath.indexOf(".jar" ) + 4);
-355 final Dependency parent = findDependency(parentPath, engine.getDependencies());
-356 if (parent != null ) {
-357 boolean remove = false;
-358 for (Identifier i : dependency.getIdentifiers()) {
-359 if ("cpe" .equals(i.getType())) {
-360 final String trimmedCPE = trimCpeToVendor(i.getValue());
-361 for (Identifier parentId : parent.getIdentifiers()) {
-362 if ("cpe" .equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) {
-363 remove |= true ;
-364 }
-365 }
-366 }
-367 if (!remove) {
-368 return ;
-369 }
-370 }
-371 if (remove) {
-372 engine.getDependencies().remove(dependency);
-373 }
-374 }
-375 }
-376
-377 }
-378 }
-379
-380
-381
-382
-383
-384
-385
-386
-387 private Dependency findDependency(String dependencyPath, List<Dependency> dependencies) {
-388 for (Dependency d : dependencies) {
-389 if (d.getFilePath().equalsIgnoreCase(dependencyPath)) {
-390 return d;
-391 }
-392 }
-393 return null ;
-394 }
-395
-396
-397
-398
-399
-400
-401
-402 private String trimCpeToVendor(String value) {
-403
-404 final int pos1 = value.indexOf(":" , 7);
-405 final int pos2 = value.indexOf(":" , pos1 + 1);
-406 if (pos2 < 0) {
-407 return value;
-408 } else {
-409 return value.substring(0, pos2);
-410 }
-411 }
-412 }
+259 } else if ((i.getValue().startsWith("cpe:/a:jquery:jquery" )
+260 || i.getValue().startsWith("cpe:/a:prototypejs:prototype" )
+261 || i.getValue().startsWith("cpe:/a:yahoo:yui" ))
+262 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
+263 || dependency.getFileName().toLowerCase().endsWith("pom.xml" )
+264 || dependency.getFileName().toLowerCase().endsWith(".dll" )
+265 || dependency.getFileName().toLowerCase().endsWith(".exe" ))) {
+266 itr.remove();
+267 } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel" )
+268 || i.getValue().startsWith("cpe:/a:microsoft:word" )
+269 || i.getValue().startsWith("cpe:/a:microsoft:visio" )
+270 || i.getValue().startsWith("cpe:/a:microsoft:powerpoint" )
+271 || i.getValue().startsWith("cpe:/a:microsoft:office" ))
+272 && (dependency.getFileName().toLowerCase().endsWith(".jar" )
+273 || dependency.getFileName().toLowerCase().endsWith("pom.xml" ))) {
+274 itr.remove();
+275 } else if (i.getValue().startsWith("cpe:/a:apache:maven" )
+276 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar" )) {
+277 itr.remove();
+278 } else if (i.getValue().startsWith("cpe:/a:m-core:m-core" )
+279 && !dependency.getEvidenceUsed().containsUsedString("m-core" )) {
+280 itr.remove();
+281 } else if (i.getValue().startsWith("cpe:/a:jboss:jboss" )
+282 && !dependency.getFileName().toLowerCase().matches("jboss-?[\\d\\.-]+(GA)?\\.jar" )) {
+283 itr.remove();
+284 }
+285 }
+286 }
+287 }
+288
+289
+290
+291
+292
+293
+294 private void removeWrongVersionMatches(Dependency dependency) {
+295 final Set<Identifier> identifiers = dependency.getIdentifiers();
+296 final Iterator<Identifier> itr = identifiers.iterator();
+297
+298 final String fileName = dependency.getFileName();
+299 if (fileName != null && fileName.contains("axis2" )) {
+300 while (itr.hasNext()) {
+301 final Identifier i = itr.next();
+302 if ("cpe" .equals(i.getType())) {
+303 final String cpe = i.getValue();
+304 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:" ) || "cpe:/a:apache:axis" .equals(cpe))) {
+305 itr.remove();
+306 }
+307 }
+308 }
+309 } else if (fileName != null && fileName.contains("axis" )) {
+310 while (itr.hasNext()) {
+311 final Identifier i = itr.next();
+312 if ("cpe" .equals(i.getType())) {
+313 final String cpe = i.getValue();
+314 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:" ) || "cpe:/a:apache:axis2" .equals(cpe))) {
+315 itr.remove();
+316 }
+317 }
+318 }
+319 }
+320 }
+321
+322
+323
+324
+325
+326
+327
+328
+329 private void addFalseNegativeCPEs(Dependency dependency) {
+330
+331 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+332 while (itr.hasNext()) {
+333 final Identifier i = itr.next();
+334 if ("cpe" .equals(i.getType()) && i.getValue() != null
+335 && (i.getValue().startsWith("cpe:/a:oracle:opensso:" )
+336 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:" )
+337 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:" )
+338 || i.getValue().startsWith("cpe:/a:sun:opensso:" ))) {
+339 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s" , i.getValue().substring(22));
+340 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s" , i.getValue().substring(22));
+341 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s" , i.getValue().substring(22));
+342 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s" , i.getValue().substring(22));
+343 try {
+344 dependency.addIdentifier("cpe" ,
+345 newCpe,
+346 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe, "UTF-8" )));
+347 dependency.addIdentifier("cpe" ,
+348 newCpe2,
+349 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe2, "UTF-8" )));
+350 dependency.addIdentifier("cpe" ,
+351 newCpe3,
+352 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe3, "UTF-8" )));
+353 dependency.addIdentifier("cpe" ,
+354 newCpe4,
+355 String.format(CPEAnalyzer.NVD_SEARCH_URL, URLEncoder.encode(newCpe4, "UTF-8" )));
+356 } catch (UnsupportedEncodingException ex) {
+357 LOGGER.log(Level.FINE, null , ex);
+358 }
+359 }
+360 }
+361 }
+362
+363
+364
+365
+366
+367
+368
+369
+370 private void removeDuplicativeEntriesFromJar(Dependency dependency, Engine engine) {
+371 if (dependency.getFileName().toLowerCase().endsWith("pom.xml" )
+372 || "dll" .equals(dependency.getFileExtension())
+373 || "exe" .equals(dependency.getFileExtension())) {
+374 String parentPath = dependency.getFilePath().toLowerCase();
+375 if (parentPath.contains(".jar" )) {
+376 parentPath = parentPath.substring(0, parentPath.indexOf(".jar" ) + 4);
+377 final Dependency parent = findDependency(parentPath, engine.getDependencies());
+378 if (parent != null ) {
+379 boolean remove = false;
+380 for (Identifier i : dependency.getIdentifiers()) {
+381 if ("cpe" .equals(i.getType())) {
+382 final String trimmedCPE = trimCpeToVendor(i.getValue());
+383 for (Identifier parentId : parent.getIdentifiers()) {
+384 if ("cpe" .equals(parentId.getType()) && parentId.getValue().startsWith(trimmedCPE)) {
+385 remove |= true ;
+386 }
+387 }
+388 }
+389 if (!remove) {
+390 return ;
+391 }
+392 }
+393 if (remove) {
+394 engine.getDependencies().remove(dependency);
+395 }
+396 }
+397 }
+398
+399 }
+400 }
+401
+402
+403
+404
+405
+406
+407
+408
+409 private Dependency findDependency(String dependencyPath, List<Dependency> dependencies) {
+410 for (Dependency d : dependencies) {
+411 if (d.getFilePath().equalsIgnoreCase(dependencyPath)) {
+412 return d;
+413 }
+414 }
+415 return null ;
+416 }
+417
+418
+419
+420
+421
+422
+423
+424 private String trimCpeToVendor(String value) {
+425
+426 final int pos1 = value.indexOf(":" , 7);
+427 final int pos2 = value.indexOf(":" , pos1 + 1);
+428 if (pos2 < 0) {
+429 return value;
+430 } else {
+431 return value.substring(0, pos2);
+432 }
+433 }
+434 }
64 import org.owasp.dependencycheck.jaxb.pom.generated.License;
65 import org.owasp.dependencycheck.jaxb.pom.generated.Model;
66 import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
-67 import org.owasp.dependencycheck.jaxb.pom.generated.Parent;
-68 import org.owasp.dependencycheck.utils.FileUtils;
-69 import org.owasp.dependencycheck.utils.NonClosingStream;
-70 import org.owasp.dependencycheck.utils.Settings;
-71 import org.xml.sax.InputSource;
-72 import org.xml.sax.SAXException;
-73 import org.xml.sax.XMLFilter;
-74 import org.xml.sax.XMLReader;
-75
-76
+67 import org.owasp.dependencycheck.utils.FileUtils;
+68 import org.owasp.dependencycheck.utils.NonClosingStream;
+69 import org.owasp.dependencycheck.utils.Settings;
+70 import org.xml.sax.InputSource;
+71 import org.xml.sax.SAXException;
+72 import org.xml.sax.XMLFilter;
+73 import org.xml.sax.XMLReader;
+74
+75
+76
77
-78
-79
-80
-81
-82 public class JarAnalyzer extends AbstractFileTypeAnalyzer {
-83
-84
-85
-86
-87
-88 private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class .getName());
-89
-90
-91
-92 private static final int BUFFER_SIZE = 4096;
-93
-94
-95
-96 private static int dirCount = 0;
-97
-98
-99
-100 private static final String NEWLINE = System.getProperty("line.separator" );
-101
-102
-103
-104 private static final Set<String> IGNORE_VALUES = newHashSet(
-105 "Sun Java System Application Server" );
-106
-107
-108
-109 private static final Set<String> IGNORE_KEYS = newHashSet(
-110 "built-by" ,
-111 "created-by" ,
-112 "builtby" ,
-113 "createdby" ,
-114 "build-jdk" ,
-115 "buildjdk" ,
-116 "ant-version" ,
-117 "antversion" ,
-118 "dynamicimportpackage" ,
-119 "dynamicimport-package" ,
-120 "dynamic-importpackage" ,
-121 "dynamic-import-package" ,
-122 "import-package" ,
-123 "ignore-package" ,
-124 "export-package" ,
-125 "importpackage" ,
-126 "ignorepackage" ,
-127 "exportpackage" ,
-128 "sealed" ,
-129 "manifest-version" ,
-130 "archiver-version" ,
-131 "manifestversion" ,
-132 "archiverversion" ,
-133 "classpath" ,
-134 "class-path" ,
-135 "tool" ,
-136 "bundle-manifestversion" ,
-137 "bundlemanifestversion" ,
-138 "include-resource" ,
-139 "embed-dependency" ,
-140 "ipojo-components" ,
-141 "ipojo-extension" ,
-142 "eclipse-sourcereferences" );
-143
-144
-145
-146 private static final String BUNDLE_VERSION = "Bundle-Version" ;
-147
-148
-149
-150 private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
-151
-152
-153
-154 private static final String BUNDLE_NAME = "Bundle-Name" ;
-155
-156
-157
-158 private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
-159
-160
-161
-162 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
-163
-164
-165
-166 private Unmarshaller pomUnmarshaller;
-167
-168
-169
-170
-171
-172 public JarAnalyzer () {
-173 try {
-174 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
-175 pomUnmarshaller = jaxbContext.createUnmarshaller();
-176 } catch (JAXBException ex) {
-177 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details." );
-178 LOGGER.log(Level.FINE, null , ex);
-179 }
-180 }
-181
-182
-183
-184
-185
-186 private static final String ANALYZER_NAME = "Jar Analyzer" ;
-187
-188
-189
-190 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-191
-192
-193
-194 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
-195
-196
-197
-198
-199
-200
-201 @Override
-202 public Set<String> getSupportedExtensions() {
-203 return EXTENSIONS;
-204 }
-205
-206
-207
-208
-209
-210
-211 @Override
-212 public String getName() {
-213 return ANALYZER_NAME;
-214 }
-215
-216
-217
-218
-219
-220
-221 public AnalysisPhase getAnalysisPhase() {
-222 return ANALYSIS_PHASE;
-223 }
-224
-225
-226
-227
-228
-229
-230
-231 @Override
-232 protected String getAnalyzerEnabledSettingKey() {
-233 return Settings.KEYS.ANALYZER_JAR_ENABLED;
-234 }
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244 @Override
-245 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
-246 try {
-247 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
-248 final String fileName = dependency.getFileName().toLowerCase();
-249 if (classNames.isEmpty()
-250 && (fileName.endsWith("-sources.jar" )
-251 || fileName.endsWith("-javadoc.jar" )
-252 || fileName.endsWith("-src.jar" )
-253 || fileName.endsWith("-doc.jar" ))) {
-254 engine.getDependencies().remove(dependency);
-255 }
-256 final boolean hasManifest = parseManifest(dependency, classNames);
-257 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
-258 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
-259 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
-260 } catch (IOException ex) {
-261 throw new AnalysisException ("Exception occurred reading the JAR file." , ex);
-262 }
-263 }
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275 protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
-276 boolean foundSomething = false;
-277 final JarFile jar;
-278 try {
-279 jar = new JarFile(dependency.getActualFilePath());
-280 } catch (IOException ex) {
-281 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
-282
-283 LOGGER.log(Level.WARNING, msg);
-284 LOGGER.log(Level.FINE, "" , ex);
-285 return false;
-286 }
-287 List<String> pomEntries;
-288 try {
-289 pomEntries = retrievePomListing(jar);
-290 } catch (IOException ex) {
-291 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
-292
-293 LOGGER.log(Level.WARNING, msg);
-294 LOGGER.log(Level.FINE, msg, ex);
-295 return false;
-296 }
-297 if (pomEntries.isEmpty()) {
-298 return false;
-299 }
-300 for (String path : pomEntries) {
-301 Properties pomProperties = null ;
-302 try {
-303 pomProperties = retrievePomProperties(path, jar);
-304 } catch (IOException ex) {
-305 LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
-306 }
-307 Model pom = null ;
-308 try {
-309 if (pomEntries.size() > 1) {
-310
-311 final Dependency newDependency = new Dependency ();
-312 pom = extractPom(path, jar, newDependency);
-313
-314 final String displayPath = String.format("%s%s%s" ,
-315 dependency.getFilePath(),
-316 File.separator,
-317 path);
-318 final String displayName = String.format("%s%s%s" ,
-319 dependency.getFileName(),
-320 File.separator,
-321 path);
-322
-323 newDependency.setFileName(displayName);
-324 newDependency.setFilePath(displayPath);
-325 addPomEvidence(newDependency, pom, pomProperties);
-326 engine.getDependencies().add(newDependency);
-327 Collections.sort(engine.getDependencies());
-328 } else {
-329 pom = retrievePom(path, jar);
-330 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
-331 }
-332 } catch (AnalysisException ex) {
-333 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
-334 LOGGER.log(Level.WARNING, msg);
-335 LOGGER.log(Level.FINE, "" , ex);
-336 }
-337 }
-338 return foundSomething;
-339 }
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
-350 justification = "The reader is closed by closing the zipEntry" )
-351 private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
-352 Properties pomProperties = null ;
-353 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
-354 final ZipEntry propEntry = jar.getEntry(propPath);
-355 if (propEntry != null ) {
-356 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
-357 pomProperties = new Properties ();
-358 pomProperties.load(reader);
-359 }
-360 return pomProperties;
-361 }
-362
-363
-364
-365
-366
-367
-368
-369
-370 private List<String> retrievePomListing(final JarFile jar) throws IOException {
-371 final List<String> pomEntries = new ArrayList<String>();
-372 final Enumeration<JarEntry> entries = jar.entries();
-373 while (entries.hasMoreElements()) {
-374 final JarEntry entry = entries.nextElement();
-375 final String entryName = (new File(entry.getName())).getName().toLowerCase();
-376 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
-377 pomEntries.add(entry.getName());
-378 }
-379 }
-380 return pomEntries;
-381 }
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393 private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
-394 InputStream input = null ;
-395 FileOutputStream fos = null ;
-396 BufferedOutputStream bos = null ;
-397 final File tmpDir = getNextTempDirectory();
-398 final File file = new File(tmpDir, "pom.xml" );
-399 try {
-400 final ZipEntry entry = jar.getEntry(path);
-401 input = jar.getInputStream(entry);
-402 fos = new FileOutputStream(file);
-403 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
-404 int count;
-405 final byte data[] = new byte[BUFFER_SIZE];
-406 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
-407 bos.write(data, 0, count);
-408 }
-409 bos.flush();
-410 dependency.setActualFilePath(file.getAbsolutePath());
-411 } catch (IOException ex) {
-412 final String msg = String.format("An error occurred reading '%s' from '%s'." , path, dependency.getFilePath());
-413 LOGGER.warning(msg);
-414 LOGGER.log(Level.SEVERE, "" , ex);
-415 } finally {
-416 closeStream(bos);
-417 closeStream(fos);
-418 closeStream(input);
-419 }
-420 Model model = null ;
-421 FileInputStream fis = null ;
-422 try {
-423 fis = new FileInputStream(file);
-424 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
-425 final InputSource xml = new InputSource(reader);
-426 final SAXSource source = new SAXSource(xml);
-427 model = readPom(source);
-428 } catch (FileNotFoundException ex) {
-429 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
-430 LOGGER.log(Level.WARNING, msg);
-431 LOGGER.log(Level.FINE, "" , ex);
-432 throw new AnalysisException (ex);
-433 } catch (UnsupportedEncodingException ex) {
-434 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
-435 LOGGER.log(Level.WARNING, msg);
-436 LOGGER.log(Level.FINE, "" , ex);
-437 throw new AnalysisException (ex);
-438 } catch (AnalysisException ex) {
-439 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
-440 LOGGER.log(Level.WARNING, msg);
-441 LOGGER.log(Level.FINE, "" , ex);
-442 throw ex;
-443 } finally {
-444 closeStream(fis);
-445 }
-446 return model;
-447 }
-448
-449
-450
-451
-452
-453
-454 private void closeStream(InputStream stream) {
-455 if (stream != null ) {
-456 try {
-457 stream.close();
-458 } catch (IOException ex) {
-459 LOGGER.log(Level.FINEST, null , ex);
-460 }
-461 }
-462 }
-463
-464
-465
-466
-467
-468
-469 private void closeStream(OutputStream stream) {
-470 if (stream != null ) {
-471 try {
-472 stream.close();
-473 } catch (IOException ex) {
-474 LOGGER.log(Level.FINEST, null , ex);
-475 }
-476 }
-477 }
-478
-479
-480
-481
-482
-483
-484
-485
-486
-487
-488 private Model retrievePom(String path, JarFile jar) throws AnalysisException {
-489 final ZipEntry entry = jar.getEntry(path);
-490 Model model = null ;
-491 if (entry != null ) {
-492 try {
-493 final NonClosingStream stream = new NonClosingStream (jar.getInputStream(entry));
-494 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
-495 final InputSource xml = new InputSource(reader);
-496 final SAXSource source = new SAXSource(xml);
-497 model = readPom(source);
-498 } catch (SecurityException ex) {
-499 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
-500 LOGGER.log(Level.WARNING, msg);
-501 LOGGER.log(Level.FINE, null , ex);
-502 throw new AnalysisException (ex);
-503 } catch (IOException ex) {
-504 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
-505 LOGGER.log(Level.WARNING, msg);
-506 LOGGER.log(Level.FINE, "" , ex);
-507 throw new AnalysisException (ex);
-508 } catch (Throwable ex) {
-509 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
-510 LOGGER.log(Level.WARNING, msg);
-511 LOGGER.log(Level.FINE, "" , ex);
-512 throw new AnalysisException (ex);
-513 }
-514 }
-515 return model;
-516 }
-517
-518
-519
-520
-521
-522
-523
-524
-525
-526 private Model readPom(SAXSource source) throws AnalysisException {
-527 Model model = null ;
-528 try {
-529 final XMLFilter filter = new MavenNamespaceFilter ();
-530 final SAXParserFactory spf = SAXParserFactory.newInstance();
-531 final SAXParser sp = spf.newSAXParser();
-532 final XMLReader xr = sp.getXMLReader();
-533 filter.setParent(xr);
-534 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
-535 model = el.getValue();
-536 } catch (SecurityException ex) {
+78
+79
+80 public class JarAnalyzer extends AbstractFileTypeAnalyzer {
+81
+82
+83
+84
+85
+86 private static final Logger LOGGER = Logger.getLogger(JarAnalyzer.class .getName());
+87
+88
+89
+90 private static final int BUFFER_SIZE = 4096;
+91
+92
+93
+94 private static int dirCount = 0;
+95
+96
+97
+98 private static final String NEWLINE = System.getProperty("line.separator" );
+99
+100
+101
+102 private static final Set<String> IGNORE_VALUES = newHashSet(
+103 "Sun Java System Application Server" );
+104
+105
+106
+107 private static final Set<String> IGNORE_KEYS = newHashSet(
+108 "built-by" ,
+109 "created-by" ,
+110 "builtby" ,
+111 "createdby" ,
+112 "build-jdk" ,
+113 "buildjdk" ,
+114 "ant-version" ,
+115 "antversion" ,
+116 "dynamicimportpackage" ,
+117 "dynamicimport-package" ,
+118 "dynamic-importpackage" ,
+119 "dynamic-import-package" ,
+120 "import-package" ,
+121 "ignore-package" ,
+122 "export-package" ,
+123 "importpackage" ,
+124 "ignorepackage" ,
+125 "exportpackage" ,
+126 "sealed" ,
+127 "manifest-version" ,
+128 "archiver-version" ,
+129 "manifestversion" ,
+130 "archiverversion" ,
+131 "classpath" ,
+132 "class-path" ,
+133 "tool" ,
+134 "bundle-manifestversion" ,
+135 "bundlemanifestversion" ,
+136 "include-resource" ,
+137 "embed-dependency" ,
+138 "ipojo-components" ,
+139 "ipojo-extension" ,
+140 "eclipse-sourcereferences" );
+141
+142
+143
+144 private static final String BUNDLE_VERSION = "Bundle-Version" ;
+145
+146
+147
+148 private static final String BUNDLE_DESCRIPTION = "Bundle-Description" ;
+149
+150
+151
+152 private static final String BUNDLE_NAME = "Bundle-Name" ;
+153
+154
+155
+156 private static final String BUNDLE_VENDOR = "Bundle-Vendor" ;
+157
+158
+159
+160 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>" , Pattern.CASE_INSENSITIVE);
+161
+162
+163
+164 private Unmarshaller pomUnmarshaller;
+165
+166
+167
+168
+169
+170 public JarAnalyzer () {
+171 try {
+172 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated" );
+173 pomUnmarshaller = jaxbContext.createUnmarshaller();
+174 } catch (JAXBException ex) {
+175 LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details." );
+176 LOGGER.log(Level.FINE, null , ex);
+177 }
+178 }
+179
+180
+181
+182
+183
+184 private static final String ANALYZER_NAME = "Jar Analyzer" ;
+185
+186
+187
+188 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+189
+190
+191
+192 private static final Set<String> EXTENSIONS = newHashSet("jar" , "war" );
+193
+194
+195
+196
+197
+198
+199 @Override
+200 public Set<String> getSupportedExtensions() {
+201 return EXTENSIONS;
+202 }
+203
+204
+205
+206
+207
+208
+209 @Override
+210 public String getName() {
+211 return ANALYZER_NAME;
+212 }
+213
+214
+215
+216
+217
+218
+219 public AnalysisPhase getAnalysisPhase() {
+220 return ANALYSIS_PHASE;
+221 }
+222
+223
+224
+225
+226
+227
+228
+229 @Override
+230 protected String getAnalyzerEnabledSettingKey() {
+231 return Settings.KEYS.ANALYZER_JAR_ENABLED;
+232 }
+233
+234
+235
+236
+237
+238
+239
+240
+241
+242 @Override
+243 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+244 try {
+245 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
+246 final String fileName = dependency.getFileName().toLowerCase();
+247 if (classNames.isEmpty()
+248 && (fileName.endsWith("-sources.jar" )
+249 || fileName.endsWith("-javadoc.jar" )
+250 || fileName.endsWith("-src.jar" )
+251 || fileName.endsWith("-doc.jar" ))) {
+252 engine.getDependencies().remove(dependency);
+253 }
+254 final boolean hasManifest = parseManifest(dependency, classNames);
+255 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
+256 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
+257 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
+258 } catch (IOException ex) {
+259 throw new AnalysisException ("Exception occurred reading the JAR file." , ex);
+260 }
+261 }
+262
+263
+264
+265
+266
+267
+268
+269
+270
+271
+272
+273 protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
+274 boolean foundSomething = false;
+275 final JarFile jar;
+276 try {
+277 jar = new JarFile(dependency.getActualFilePath());
+278 } catch (IOException ex) {
+279 final String msg = String.format("Unable to read JarFile '%s'." , dependency.getActualFilePath());
+280
+281 LOGGER.log(Level.WARNING, msg);
+282 LOGGER.log(Level.FINE, "" , ex);
+283 return false;
+284 }
+285 List<String> pomEntries;
+286 try {
+287 pomEntries = retrievePomListing(jar);
+288 } catch (IOException ex) {
+289 final String msg = String.format("Unable to read Jar file entries in '%s'." , dependency.getActualFilePath());
+290
+291 LOGGER.log(Level.WARNING, msg);
+292 LOGGER.log(Level.FINE, msg, ex);
+293 return false;
+294 }
+295 if (pomEntries.isEmpty()) {
+296 return false;
+297 }
+298 for (String path : pomEntries) {
+299 Properties pomProperties = null ;
+300 try {
+301 pomProperties = retrievePomProperties(path, jar);
+302 } catch (IOException ex) {
+303 LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties" , ex);
+304 }
+305 Model pom = null ;
+306 try {
+307 if (pomEntries.size() > 1) {
+308
+309 final Dependency newDependency = new Dependency ();
+310 pom = extractPom(path, jar, newDependency);
+311
+312 final String displayPath = String.format("%s%s%s" ,
+313 dependency.getFilePath(),
+314 File.separator,
+315 path);
+316 final String displayName = String.format("%s%s%s" ,
+317 dependency.getFileName(),
+318 File.separator,
+319 path);
+320
+321 newDependency.setFileName(displayName);
+322 newDependency.setFilePath(displayPath);
+323 setPomEvidence(newDependency, pom, pomProperties, null );
+324 engine.getDependencies().add(newDependency);
+325 Collections.sort(engine.getDependencies());
+326 } else {
+327 pom = retrievePom(path, jar);
+328 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
+329 }
+330 } catch (AnalysisException ex) {
+331 final String msg = String.format("An error occured while analyzing '%s'." , dependency.getActualFilePath());
+332 LOGGER.log(Level.WARNING, msg);
+333 LOGGER.log(Level.FINE, "" , ex);
+334 }
+335 }
+336 return foundSomething;
+337 }
+338
+339
+340
+341
+342
+343
+344
+345
+346
+347 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM" ,
+348 justification = "The reader is closed by closing the zipEntry" )
+349 private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
+350 Properties pomProperties = null ;
+351 final String propPath = path.substring(0, path.length() - 7) + "pom.properies" ;
+352 final ZipEntry propEntry = jar.getEntry(propPath);
+353 if (propEntry != null ) {
+354 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8" );
+355 pomProperties = new Properties ();
+356 pomProperties.load(reader);
+357 }
+358 return pomProperties;
+359 }
+360
+361
+362
+363
+364
+365
+366
+367
+368 private List<String> retrievePomListing(final JarFile jar) throws IOException {
+369 final List<String> pomEntries = new ArrayList<String>();
+370 final Enumeration<JarEntry> entries = jar.entries();
+371 while (entries.hasMoreElements()) {
+372 final JarEntry entry = entries.nextElement();
+373 final String entryName = (new File(entry.getName())).getName().toLowerCase();
+374 if (!entry.isDirectory() && "pom.xml" .equals(entryName)) {
+375 pomEntries.add(entry.getName());
+376 }
+377 }
+378 return pomEntries;
+379 }
+380
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390
+391 private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
+392 InputStream input = null ;
+393 FileOutputStream fos = null ;
+394 BufferedOutputStream bos = null ;
+395 final File tmpDir = getNextTempDirectory();
+396 final File file = new File(tmpDir, "pom.xml" );
+397 try {
+398 final ZipEntry entry = jar.getEntry(path);
+399 input = jar.getInputStream(entry);
+400 fos = new FileOutputStream(file);
+401 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+402 int count;
+403 final byte data[] = new byte[BUFFER_SIZE];
+404 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
+405 bos.write(data, 0, count);
+406 }
+407 bos.flush();
+408 dependency.setActualFilePath(file.getAbsolutePath());
+409 } catch (IOException ex) {
+410 final String msg = String.format("An error occurred reading '%s' from '%s'." , path, dependency.getFilePath());
+411 LOGGER.warning(msg);
+412 LOGGER.log(Level.SEVERE, "" , ex);
+413 } finally {
+414 closeStream(bos);
+415 closeStream(fos);
+416 closeStream(input);
+417 }
+418 Model model = null ;
+419 FileInputStream fis = null ;
+420 try {
+421 fis = new FileInputStream(file);
+422 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8" );
+423 final InputSource xml = new InputSource(reader);
+424 final SAXSource source = new SAXSource(xml);
+425 model = readPom(source);
+426 } catch (FileNotFoundException ex) {
+427 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)" , path, jar.getName());
+428 LOGGER.log(Level.WARNING, msg);
+429 LOGGER.log(Level.FINE, "" , ex);
+430 throw new AnalysisException (ex);
+431 } catch (UnsupportedEncodingException ex) {
+432 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+433 LOGGER.log(Level.WARNING, msg);
+434 LOGGER.log(Level.FINE, "" , ex);
+435 throw new AnalysisException (ex);
+436 } catch (AnalysisException ex) {
+437 final String msg = String.format("Unable to parse pom '%s' in jar '%s'" , path, jar.getName());
+438 LOGGER.log(Level.WARNING, msg);
+439 LOGGER.log(Level.FINE, "" , ex);
+440 throw ex;
+441 } finally {
+442 closeStream(fis);
+443 }
+444 return model;
+445 }
+446
+447
+448
+449
+450
+451
+452 private void closeStream(InputStream stream) {
+453 if (stream != null ) {
+454 try {
+455 stream.close();
+456 } catch (IOException ex) {
+457 LOGGER.log(Level.FINEST, null , ex);
+458 }
+459 }
+460 }
+461
+462
+463
+464
+465
+466
+467 private void closeStream(OutputStream stream) {
+468 if (stream != null ) {
+469 try {
+470 stream.close();
+471 } catch (IOException ex) {
+472 LOGGER.log(Level.FINEST, null , ex);
+473 }
+474 }
+475 }
+476
+477
+478
+479
+480
+481
+482
+483
+484
+485
+486 private Model retrievePom(String path, JarFile jar) throws AnalysisException {
+487 final ZipEntry entry = jar.getEntry(path);
+488 Model model = null ;
+489 if (entry != null ) {
+490 try {
+491 final NonClosingStream stream = new NonClosingStream (jar.getInputStream(entry));
+492 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8" );
+493 final InputSource xml = new InputSource(reader);
+494 final SAXSource source = new SAXSource(xml);
+495 model = readPom(source);
+496 } catch (SecurityException ex) {
+497 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature" , path, jar.getName());
+498 LOGGER.log(Level.WARNING, msg);
+499 LOGGER.log(Level.FINE, null , ex);
+500 throw new AnalysisException (ex);
+501 } catch (IOException ex) {
+502 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)" , path, jar.getName());
+503 LOGGER.log(Level.WARNING, msg);
+504 LOGGER.log(Level.FINE, "" , ex);
+505 throw new AnalysisException (ex);
+506 } catch (Throwable ex) {
+507 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'" , path, jar.getName());
+508 LOGGER.log(Level.WARNING, msg);
+509 LOGGER.log(Level.FINE, "" , ex);
+510 throw new AnalysisException (ex);
+511 }
+512 }
+513 return model;
+514 }
+515
+516
+517
+518
+519
+520
+521
+522
+523
+524 private Model readPom(SAXSource source) throws AnalysisException {
+525 Model model = null ;
+526 try {
+527 final XMLFilter filter = new MavenNamespaceFilter ();
+528 final SAXParserFactory spf = SAXParserFactory.newInstance();
+529 final SAXParser sp = spf.newSAXParser();
+530 final XMLReader xr = sp.getXMLReader();
+531 filter.setParent(xr);
+532 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class );
+533 model = el.getValue();
+534 } catch (SecurityException ex) {
+535 throw new AnalysisException (ex);
+536 } catch (ParserConfigurationException ex) {
537 throw new AnalysisException (ex);
-538 } catch (ParserConfigurationException ex) {
+538 } catch (SAXException ex) {
539 throw new AnalysisException (ex);
-540 } catch (SAXException ex) {
+540 } catch (JAXBException ex) {
541 throw new AnalysisException (ex);
-542 } catch (JAXBException ex) {
+542 } catch (Throwable ex) {
543 throw new AnalysisException (ex);
-544 } catch (Throwable ex) {
-545 throw new AnalysisException (ex);
-546 }
-547 return model;
-548 }
-549
-550
-551
-552
-553
-554
-555
-556
-557
-558
-559
-560 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
-561 boolean foundSomething = false;
-562 if (pom == null ) {
-563 return foundSomething;
-564 }
-565 String groupid = interpolateString(pom.getGroupId(), pomProperties);
-566 if (groupid != null && !groupid.isEmpty()) {
-567 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
-568 groupid = groupid.substring(4);
-569 }
-570 foundSomething = true ;
-571 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
-572 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
-573 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
-574 addMatchingValues(classes, groupid, dependency.getProductEvidence());
-575 }
-576 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
-577 if (artifactid != null && !artifactid.isEmpty()) {
-578 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
-579 artifactid = artifactid.substring(4);
-580 }
-581 foundSomething = true ;
-582 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
-583 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
-584 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
-585 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
-586 }
-587
-588 final String version = interpolateString(pom.getVersion(), pomProperties);
-589 if (version != null && !version.isEmpty()) {
-590 foundSomething = true ;
-591 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+544 }
+545 return model;
+546 }
+547
+548
+549
+550
+551
+552
+553
+554
+555
+556
+557
+558 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
+559 boolean foundSomething = false;
+560 boolean addAsIdentifier = true ;
+561 if (pom == null ) {
+562 return foundSomething;
+563 }
+564 String groupid = interpolateString(pom.getGroupId(), pomProperties);
+565 String parentGroupId = null ;
+566
+567 if (pom.getParent() != null ) {
+568 parentGroupId = interpolateString(pom.getParent().getGroupId(), pomProperties);
+569 if ((groupid == null || groupid.isEmpty()) && parentGroupId != null && !parentGroupId.isEmpty()) {
+570 groupid = parentGroupId;
+571 }
+572 }
+573 final String originalGroupID = groupid;
+574
+575 if (groupid != null && !groupid.isEmpty()) {
+576 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
+577 groupid = groupid.substring(4);
+578 }
+579 foundSomething = true ;
+580 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
+581 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
+582 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
+583 addMatchingValues(classes, groupid, dependency.getProductEvidence());
+584 if (parentGroupId != null && !parentGroupId.isEmpty() && !parentGroupId.equals(groupid)) {
+585 dependency.getVendorEvidence().addEvidence("pom" , "parent-groupid" , parentGroupId, Confidence.MEDIUM);
+586 dependency.getProductEvidence().addEvidence("pom" , "parent-groupid" , parentGroupId, Confidence.LOW);
+587 addMatchingValues(classes, parentGroupId, dependency.getVendorEvidence());
+588 addMatchingValues(classes, parentGroupId, dependency.getProductEvidence());
+589 }
+590 } else {
+591 addAsIdentifier = false;
592 }
-593
-594 final Organization org = pom.getOrganization();
-595 if (org != null && org.getName() != null ) {
-596 foundSomething = true ;
-597 final String orgName = interpolateString(org.getName(), pomProperties);
-598 if (orgName != null && !orgName.isEmpty()) {
-599 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
-600 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
+593
+594 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
+595 String parentArtifactId = null ;
+596
+597 if (pom.getParent() != null ) {
+598 parentArtifactId = interpolateString(pom.getParent().getArtifactId(), pomProperties);
+599 if ((artifactid == null || artifactid.isEmpty()) && parentArtifactId != null && !parentArtifactId.isEmpty()) {
+600 artifactid = parentArtifactId;
601 }
602 }
-603
-604 final String pomName = interpolateString(pom.getName(), pomProperties);
-605 if (pomName != null && !pomName.isEmpty()) {
-606 foundSomething = true ;
-607 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-608 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-609 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
-610 addMatchingValues(classes, pomName, dependency.getProductEvidence());
-611 }
-612
-613
-614 if (pom.getDescription() != null ) {
-615 foundSomething = true ;
-616 final String description = interpolateString(pom.getDescription(), pomProperties);
-617 if (description != null && !description.isEmpty()) {
-618 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
-619 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
-620 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
-621 }
-622 }
-623 extractLicense(pom, pomProperties, dependency);
-624 return foundSomething;
-625 }
-626
-627
-628
-629
-630
-631
-632
-633
-634
-635 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
-636 Dependency dependency, boolean addPackagesAsEvidence) {
-637 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
-638 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
-639 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
-640
-641 final int classCount = classNames.size();
-642 final EvidenceCollection vendor = dependency.getVendorEvidence();
-643 final EvidenceCollection product = dependency.getProductEvidence();
-644
-645 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
-646 final float ratio = entry.getValue() / (float ) classCount;
-647 if (ratio > 0.5) {
-648
-649 vendor.addWeighting(entry.getKey());
-650 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
-651 vendor.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
-652 }
-653 }
-654 }
-655 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
-656 final float ratio = entry.getValue() / (float ) classCount;
-657 if (ratio > 0.5) {
-658 product.addWeighting(entry.getKey());
-659 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
-660 product.addEvidence("jar" , "package" , entry.getKey(), Confidence.LOW);
-661 }
-662 }
-663 }
-664 }
-665
-666
-667
-668
-669
-670
-671
-672
-673
-674
-675
-676
-677
-678
-679
-680 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
-681 boolean foundSomething = false;
-682 JarFile jar = null ;
-683 try {
-684 jar = new JarFile(dependency.getActualFilePath());
-685
-686 final Manifest manifest = jar.getManifest();
-687
-688 if (manifest == null ) {
-689
-690 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
-691 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
-692 && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
-693 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
-694 LOGGER.log(Level.FINE,
-695 String.format("Jar file '%s' does not contain a manifest." ,
-696 dependency.getFileName()));
-697 }
-698 return false;
-699 }
-700 final Attributes atts = manifest.getMainAttributes();
-701
-702 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
-703 final EvidenceCollection productEvidence = dependency.getProductEvidence();
-704 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
-705
-706 final String source = "Manifest" ;
-707
-708 for (Entry<Object, Object> entry : atts.entrySet()) {
-709 String key = entry.getKey().toString();
-710 String value = atts.getValue(key);
-711 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
-712 value = Jsoup.parse(value).text();
-713 }
-714 if (IGNORE_VALUES.contains(value)) {
-715 continue ;
-716 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
-717 foundSomething = true ;
-718 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
-719 addMatchingValues(classInformation, value, productEvidence);
-720 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
-721 foundSomething = true ;
-722 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
-723 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
-724 foundSomething = true ;
-725 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
-726 addMatchingValues(classInformation, value, vendorEvidence);
-727 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
-728 foundSomething = true ;
-729 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-730 addMatchingValues(classInformation, value, vendorEvidence);
-731 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
-732 foundSomething = true ;
-733 addDescription(dependency, value, "manifest" , key);
-734
-735 addMatchingValues(classInformation, value, productEvidence);
-736 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
-737 foundSomething = true ;
-738 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-739 addMatchingValues(classInformation, value, productEvidence);
-740 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
-741 foundSomething = true ;
-742 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
-743 addMatchingValues(classInformation, value, vendorEvidence);
-744 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
-745 foundSomething = true ;
-746 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
-747 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
-748 continue ;
-749
-750
-751
-752
-753
-754
-755
-756
-757 } else {
-758 key = key.toLowerCase();
+603 final String originalArtifactID = artifactid;
+604 if (artifactid != null && !artifactid.isEmpty()) {
+605 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
+606 artifactid = artifactid.substring(4);
+607 }
+608 foundSomething = true ;
+609 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
+610 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
+611 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
+612 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
+613 if (parentArtifactId != null && !parentArtifactId.isEmpty() && !parentArtifactId.equals(artifactid)) {
+614 dependency.getProductEvidence().addEvidence("pom" , "parent-artifactid" , parentArtifactId, Confidence.MEDIUM);
+615 dependency.getVendorEvidence().addEvidence("pom" , "parent-artifactid" , parentArtifactId, Confidence.LOW);
+616 addMatchingValues(classes, parentArtifactId, dependency.getVendorEvidence());
+617 addMatchingValues(classes, parentArtifactId, dependency.getProductEvidence());
+618 }
+619 } else {
+620 addAsIdentifier = false;
+621 }
+622
+623 String version = interpolateString(pom.getVersion(), pomProperties);
+624 String parentVersion = null ;
+625
+626 if (pom.getParent() != null ) {
+627 parentVersion = interpolateString(pom.getParent().getVersion(), pomProperties);
+628 if ((version == null || version.isEmpty()) && parentVersion != null && !parentVersion.isEmpty()) {
+629 version = parentVersion;
+630 }
+631 }
+632
+633 if (version != null && !version.isEmpty()) {
+634 foundSomething = true ;
+635 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
+636 if (parentVersion != null && !parentVersion.isEmpty() && !parentVersion.equals(version)) {
+637 dependency.getVersionEvidence().addEvidence("pom" , "parent-version" , version, Confidence.LOW);
+638 }
+639 } else {
+640 addAsIdentifier = false;
+641 }
+642
+643 if (addAsIdentifier) {
+644 dependency.addIdentifier("maven" , String.format("%s:%s:%s" , originalGroupID, originalArtifactID, version), null , Confidence.LOW);
+645 }
+646
+647
+648 final Organization org = pom.getOrganization();
+649 if (org != null && org.getName() != null ) {
+650 foundSomething = true ;
+651 final String orgName = interpolateString(org.getName(), pomProperties);
+652 if (orgName != null && !orgName.isEmpty()) {
+653 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
+654 addMatchingValues(classes, orgName, dependency.getVendorEvidence());
+655 }
+656 }
+657
+658 final String pomName = interpolateString(pom.getName(), pomProperties);
+659 if (pomName != null && !pomName.isEmpty()) {
+660 foundSomething = true ;
+661 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+662 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
+663 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
+664 addMatchingValues(classes, pomName, dependency.getProductEvidence());
+665 }
+666
+667
+668 if (pom.getDescription() != null ) {
+669 foundSomething = true ;
+670 final String description = interpolateString(pom.getDescription(), pomProperties);
+671 if (description != null && !description.isEmpty()) {
+672 final String trimmedDescription = addDescription(dependency, description, "pom" , "description" );
+673 addMatchingValues(classes, trimmedDescription, dependency.getVendorEvidence());
+674 addMatchingValues(classes, trimmedDescription, dependency.getProductEvidence());
+675 }
+676 }
+677 extractLicense(pom, pomProperties, dependency);
+678 return foundSomething;
+679 }
+680
+681
+682
+683
+684
+685
+686
+687
+688
+689 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
+690 Dependency dependency, boolean addPackagesAsEvidence) {
+691 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
+692 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
+693 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
+694
+695 final int classCount = classNames.size();
+696 final EvidenceCollection vendor = dependency.getVendorEvidence();
+697 final EvidenceCollection product = dependency.getProductEvidence();
+698
+699 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
+700 final float ratio = entry.getValue() / (float ) classCount;
+701 if (ratio > 0.5) {
+702
+703 vendor.addWeighting(entry.getKey());
+704 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+705 vendor.addEvidence("jar" , "package name" , entry.getKey(), Confidence.LOW);
+706 }
+707 }
+708 }
+709 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
+710 final float ratio = entry.getValue() / (float ) classCount;
+711 if (ratio > 0.5) {
+712 product.addWeighting(entry.getKey());
+713 if (addPackagesAsEvidence && entry.getKey().length() > 1) {
+714 product.addEvidence("jar" , "package name" , entry.getKey(), Confidence.LOW);
+715 }
+716 }
+717 }
+718 }
+719
+720
+721
+722
+723
+724
+725
+726
+727
+728
+729
+730
+731
+732
+733
+734 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
+735 boolean foundSomething = false;
+736 JarFile jar = null ;
+737 try {
+738 jar = new JarFile(dependency.getActualFilePath());
+739
+740 final Manifest manifest = jar.getManifest();
+741
+742 if (manifest == null ) {
+743
+744 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar" )
+745 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar" )
+746 && !dependency.getFileName().toLowerCase().endsWith("-src.jar" )
+747 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar" )) {
+748 LOGGER.log(Level.FINE,
+749 String.format("Jar file '%s' does not contain a manifest." ,
+750 dependency.getFileName()));
+751 }
+752 return false;
+753 }
+754 final Attributes atts = manifest.getMainAttributes();
+755
+756 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
+757 final EvidenceCollection productEvidence = dependency.getProductEvidence();
+758 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
759
-760 if (!IGNORE_KEYS.contains(key)
-761 && !key.endsWith("jdk" )
-762 && !key.contains("lastmodified" )
-763 && !key.endsWith("package" )
-764 && !key.endsWith("classpath" )
-765 && !key.endsWith("class-path" )
-766 && !key.endsWith("-scm" )
-767 && !key.startsWith("scm-" )
-768 && !value.trim().startsWith("scm:" )
-769 && !isImportPackage(key, value)
-770 && !isPackage(key, value)) {
-771
-772 foundSomething = true ;
-773 if (key.contains("version" )) {
-774 if (key.contains("specification" )) {
-775 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
-776 } else {
-777 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-778 }
-779 } else if ("build-id" .equals(key)) {
-780 int pos = value.indexOf('(');
-781 if (pos >= 0) {
-782 value = value.substring(0, pos - 1);
-783 }
-784 pos = value.indexOf('[');
-785 if (pos >= 0) {
-786 value = value.substring(0, pos - 1);
-787 }
-788 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-789 } else if (key.contains("title" )) {
-790 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-791 addMatchingValues(classInformation, value, productEvidence);
-792 } else if (key.contains("vendor" )) {
-793 if (key.contains("specification" )) {
-794 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
-795 } else {
-796 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-797 addMatchingValues(classInformation, value, vendorEvidence);
-798 }
-799 } else if (key.contains("name" )) {
-800 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-801 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
-802 addMatchingValues(classInformation, value, vendorEvidence);
-803 addMatchingValues(classInformation, value, productEvidence);
-804 } else if (key.contains("license" )) {
-805 addLicense(dependency, value);
-806 } else {
-807 if (key.contains("description" )) {
-808 addDescription(dependency, value, "manifest" , key);
-809 } else {
-810 productEvidence.addEvidence(source, key, value, Confidence.LOW);
-811 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
-812 addMatchingValues(classInformation, value, vendorEvidence);
-813 addMatchingValues(classInformation, value, productEvidence);
-814 if (value.matches(".*\\d.*" )) {
-815 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
-816 while (tokenizer.hasMoreElements()) {
-817 final String s = tokenizer.nextToken();
-818 if (s.matches("^[0-9.]+$" )) {
-819 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
-820 }
-821 }
-822 }
-823 }
-824 }
-825 }
-826 }
-827 }
-828 } finally {
-829 if (jar != null ) {
-830 jar.close();
-831 }
-832 }
-833 return foundSomething;
-834 }
-835
-836
-837
-838
-839
-840
-841
-842
-843
-844
-845
-846
-847
-848 private String addDescription(Dependency dependency, String description, String source, String key) {
-849 if (dependency.getDescription() == null ) {
-850 dependency.setDescription(description);
-851 }
-852 String desc;
-853 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
-854 desc = Jsoup.parse(description).text();
-855 } else {
-856 desc = description;
-857 }
-858 dependency.setDescription(desc);
-859 if (desc.length() > 100) {
-860 desc = desc.replaceAll("\\s\\s+" , " " );
-861 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
-862 final int posLike = desc.toLowerCase().indexOf("like " , 100);
-863 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
-864 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
-865 int pos = -1;
-866 pos = Math.max(pos, posSuchAs);
-867 if (pos >= 0 && posLike >= 0) {
-868 pos = Math.min(pos, posLike);
-869 } else {
-870 pos = Math.max(pos, posLike);
-871 }
-872 if (pos >= 0 && posWillUse >= 0) {
-873 pos = Math.min(pos, posWillUse);
-874 } else {
-875 pos = Math.max(pos, posWillUse);
-876 }
-877 if (pos >= 0 && posUses >= 0) {
-878 pos = Math.min(pos, posUses);
-879 } else {
-880 pos = Math.max(pos, posUses);
+760 final String source = "Manifest" ;
+761
+762 for (Entry<Object, Object> entry : atts.entrySet()) {
+763 String key = entry.getKey().toString();
+764 String value = atts.getValue(key);
+765 if (HTML_DETECTION_PATTERN.matcher(value).find()) {
+766 value = Jsoup.parse(value).text();
+767 }
+768 if (IGNORE_VALUES.contains(value)) {
+769 continue ;
+770 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
+771 foundSomething = true ;
+772 productEvidence.addEvidence(source, key, value, Confidence.HIGH);
+773 addMatchingValues(classInformation, value, productEvidence);
+774 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
+775 foundSomething = true ;
+776 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+777 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
+778 foundSomething = true ;
+779 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+780 addMatchingValues(classInformation, value, vendorEvidence);
+781 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
+782 foundSomething = true ;
+783 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+784 addMatchingValues(classInformation, value, vendorEvidence);
+785 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
+786 foundSomething = true ;
+787 addDescription(dependency, value, "manifest" , key);
+788
+789 addMatchingValues(classInformation, value, productEvidence);
+790 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
+791 foundSomething = true ;
+792 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+793 addMatchingValues(classInformation, value, productEvidence);
+794 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
+795 foundSomething = true ;
+796 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
+797 addMatchingValues(classInformation, value, vendorEvidence);
+798 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
+799 foundSomething = true ;
+800 versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
+801 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
+802 continue ;
+803
+804
+805
+806
+807
+808
+809
+810
+811 } else {
+812 key = key.toLowerCase();
+813
+814 if (!IGNORE_KEYS.contains(key)
+815 && !key.endsWith("jdk" )
+816 && !key.contains("lastmodified" )
+817 && !key.endsWith("package" )
+818 && !key.endsWith("classpath" )
+819 && !key.endsWith("class-path" )
+820 && !key.endsWith("-scm" )
+821 && !key.startsWith("scm-" )
+822 && !value.trim().startsWith("scm:" )
+823 && !isImportPackage(key, value)
+824 && !isPackage(key, value)) {
+825
+826 foundSomething = true ;
+827 if (key.contains("version" )) {
+828 if (key.contains("specification" )) {
+829 versionEvidence.addEvidence(source, key, value, Confidence.LOW);
+830 } else {
+831 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+832 }
+833 } else if ("build-id" .equals(key)) {
+834 int pos = value.indexOf('(');
+835 if (pos >= 0) {
+836 value = value.substring(0, pos - 1);
+837 }
+838 pos = value.indexOf('[');
+839 if (pos >= 0) {
+840 value = value.substring(0, pos - 1);
+841 }
+842 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+843 } else if (key.contains("title" )) {
+844 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+845 addMatchingValues(classInformation, value, productEvidence);
+846 } else if (key.contains("vendor" )) {
+847 if (key.contains("specification" )) {
+848 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+849 } else {
+850 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+851 addMatchingValues(classInformation, value, vendorEvidence);
+852 }
+853 } else if (key.contains("name" )) {
+854 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+855 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
+856 addMatchingValues(classInformation, value, vendorEvidence);
+857 addMatchingValues(classInformation, value, productEvidence);
+858 } else if (key.contains("license" )) {
+859 addLicense(dependency, value);
+860 } else {
+861 if (key.contains("description" )) {
+862 addDescription(dependency, value, "manifest" , key);
+863 } else {
+864 productEvidence.addEvidence(source, key, value, Confidence.LOW);
+865 vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
+866 addMatchingValues(classInformation, value, vendorEvidence);
+867 addMatchingValues(classInformation, value, productEvidence);
+868 if (value.matches(".*\\d.*" )) {
+869 final StringTokenizer tokenizer = new StringTokenizer(value, " " );
+870 while (tokenizer.hasMoreElements()) {
+871 final String s = tokenizer.nextToken();
+872 if (s.matches("^[0-9.]+$" )) {
+873 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
+874 }
+875 }
+876 }
+877 }
+878 }
+879 }
+880 }
881 }
-882
-883 if (pos > 0) {
-884 final StringBuilder sb = new StringBuilder(pos + 3);
-885 sb.append(desc.substring(0, pos));
-886 sb.append("..." );
-887 desc = sb.toString();
-888 }
-889 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
-890 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
-891 } else {
-892 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
-893 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
-894 }
-895 return desc;
-896 }
-897
-898
-899
-900
-901
-902
-903
-904 private void addLicense(Dependency d, String license) {
-905 if (d.getLicense() == null ) {
-906 d.setLicense(license);
-907 } else if (!d.getLicense().contains(license)) {
-908 d.setLicense(d.getLicense() + NEWLINE + license);
-909 }
-910 }
-911
-912
-913
-914
-915 private File tempFileLocation = null ;
-916
-917
-918
-919
-920
-921
-922 @Override
-923 public void initializeFileTypeAnalyzer() throws Exception {
-924 final File baseDir = Settings.getTempDirectory();
-925 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
-926 if (!tempFileLocation.delete()) {
-927 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
-928 throw new AnalysisException (msg);
-929 }
-930 if (!tempFileLocation.mkdirs()) {
-931 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
-932 throw new AnalysisException (msg);
-933 }
-934 }
-935
-936
-937
-938
-939 @Override
-940 public void close() {
-941 if (tempFileLocation != null && tempFileLocation.exists()) {
-942 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
-943 final boolean success = FileUtils.delete(tempFileLocation);
-944 if (!success) {
-945 LOGGER.log(Level.WARNING,
-946 "Failed to delete some temporary files, see the log for more details" );
-947 }
+882 } finally {
+883 if (jar != null ) {
+884 jar.close();
+885 }
+886 }
+887 return foundSomething;
+888 }
+889
+890
+891
+892
+893
+894
+895
+896
+897
+898
+899
+900
+901
+902 private String addDescription(Dependency dependency, String description, String source, String key) {
+903 if (dependency.getDescription() == null ) {
+904 dependency.setDescription(description);
+905 }
+906 String desc;
+907 if (HTML_DETECTION_PATTERN.matcher(description).find()) {
+908 desc = Jsoup.parse(description).text();
+909 } else {
+910 desc = description;
+911 }
+912 dependency.setDescription(desc);
+913 if (desc.length() > 100) {
+914 desc = desc.replaceAll("\\s\\s+" , " " );
+915 final int posSuchAs = desc.toLowerCase().indexOf("such as " , 100);
+916 final int posLike = desc.toLowerCase().indexOf("like " , 100);
+917 final int posWillUse = desc.toLowerCase().indexOf("will use " , 100);
+918 final int posUses = desc.toLowerCase().indexOf(" uses " , 100);
+919 int pos = -1;
+920 pos = Math.max(pos, posSuchAs);
+921 if (pos >= 0 && posLike >= 0) {
+922 pos = Math.min(pos, posLike);
+923 } else {
+924 pos = Math.max(pos, posLike);
+925 }
+926 if (pos >= 0 && posWillUse >= 0) {
+927 pos = Math.min(pos, posWillUse);
+928 } else {
+929 pos = Math.max(pos, posWillUse);
+930 }
+931 if (pos >= 0 && posUses >= 0) {
+932 pos = Math.min(pos, posUses);
+933 } else {
+934 pos = Math.max(pos, posUses);
+935 }
+936
+937 if (pos > 0) {
+938 final StringBuilder sb = new StringBuilder(pos + 3);
+939 sb.append(desc.substring(0, pos));
+940 sb.append("..." );
+941 desc = sb.toString();
+942 }
+943 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.LOW);
+944 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.LOW);
+945 } else {
+946 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
+947 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
948 }
-949 }
-950
-951
-952
-953
-954
-955
-956
-957
-958
-959
-960
-961
-962
-963
-964
-965
-966
-967
-968
-969
-970
-971
-972
+949 return desc;
+950 }
+951
+952
+953
+954
+955
+956
+957
+958 private void addLicense(Dependency d, String license) {
+959 if (d.getLicense() == null ) {
+960 d.setLicense(license);
+961 } else if (!d.getLicense().contains(license)) {
+962 d.setLicense(d.getLicense() + NEWLINE + license);
+963 }
+964 }
+965
+966
+967
+968
+969 private File tempFileLocation = null ;
+970
+971
+972
973
-974
-975
-976
-977
-978 protected String interpolateString(String text, Properties properties) {
-979 Properties props = properties;
-980 if (text == null ) {
-981 return text;
-982 }
-983 if (props == null ) {
-984 props = new Properties ();
-985 }
-986
-987 final int pos = text.indexOf("${" );
-988 if (pos < 0) {
-989 return text;
-990 }
-991 final int end = text.indexOf("}" );
-992 if (end < pos) {
-993 return text;
-994 }
-995
-996 final String propName = text.substring(pos + 2, end);
-997 String propValue = interpolateString(props.getProperty(propName), props);
-998 if (propValue == null ) {
-999 propValue = "" ;
-1000 }
-1001 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
-1002 sb.append(text.subSequence(0, pos));
-1003 sb.append(propValue);
-1004 sb.append(text.substring(end + 1));
-1005 return interpolateString(sb.toString(), props);
-1006 }
-1007
-1008
-1009
-1010
-1011
-1012
-1013
-1014
-1015 private boolean isImportPackage(String key, String value) {
-1016 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$" );
-1017 final boolean matches = packageRx.matcher(value).matches();
-1018 return matches && (key.contains("import" ) || key.contains("include" ) || value.length() > 10);
-1019 }
-1020
-1021
-1022
-1023
-1024
-1025
-1026
-1027
-1028 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
-1029 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
-1030 JarFile jar = null ;
-1031 try {
-1032 jar = new JarFile(dependency.getActualFilePath());
-1033 final Enumeration entries = jar.entries();
-1034 while (entries.hasMoreElements()) {
-1035 final JarEntry entry = (JarEntry) entries.nextElement();
-1036 final String name = entry.getName().toLowerCase();
-1037
-1038 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
-1039 final ClassNameInformation className = new ClassNameInformation (name.substring(0, name.length() - 6));
-1040 classNames.add(className);
-1041 }
-1042 }
-1043 } catch (IOException ex) {
-1044 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
-1045 LOGGER.log(Level.WARNING, msg);
-1046 LOGGER.log(Level.FINE, null , ex);
-1047 } finally {
-1048 if (jar != null ) {
-1049 try {
-1050 jar.close();
-1051 } catch (IOException ex) {
-1052 LOGGER.log(Level.FINEST, null , ex);
-1053 }
-1054 }
-1055 }
-1056 return classNames;
-1057 }
-1058
-1059
-1060
-1061
-1062
-1063
-1064
-1065
-1066
-1067 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
-1068 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
-1069 for (ClassNameInformation entry : classNames) {
-1070 final ArrayList<String> list = entry.getPackageStructure();
-1071 addEntry(vendor, list.get(0));
-1072
-1073 if (list.size() == 2) {
-1074 addEntry(product, list.get(1));
-1075 }
-1076 if (list.size() == 3) {
-1077 addEntry(vendor, list.get(1));
-1078 addEntry(product, list.get(1));
-1079 addEntry(product, list.get(2));
-1080 }
-1081 if (list.size() >= 4) {
-1082 addEntry(vendor, list.get(1));
-1083 addEntry(vendor, list.get(2));
-1084 addEntry(product, list.get(1));
-1085 addEntry(product, list.get(2));
-1086 addEntry(product, list.get(3));
-1087 }
-1088 }
-1089 }
-1090
-1091
-1092
-1093
-1094
-1095
-1096
-1097
-1098 private void addEntry(HashMap<String, Integer> collection, String key) {
-1099 if (collection.containsKey(key)) {
-1100 collection.put(key, collection.get(key) + 1);
-1101 } else {
-1102 collection.put(key, 1);
-1103 }
-1104 }
-1105
-1106
-1107
-1108
-1109
-1110
-1111
-1112
-1113
-1114
-1115 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
-1116 if (value == null || value.isEmpty()) {
-1117 return ;
-1118 }
-1119 final String text = value.toLowerCase();
-1120 for (ClassNameInformation cni : classes) {
-1121 for (String key : cni.getPackageStructure()) {
-1122 if (text.contains(key)) {
-1123 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
-1124 }
-1125 }
-1126 }
-1127 }
-1128
-1129
-1130
-1131
-1132
-1133
-1134
-1135
-1136 private boolean isPackage(String key, String value) {
-1137
-1138 return !key.matches(".*(version|title|vendor|name|license|description).*" )
-1139 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
-1140
-1141 }
-1142
-1143
-1144
-1145
-1146
-1147
-1148
-1149
-1150
-1151 private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) {
-1152 if (pom == null ) {
-1153 return ;
-1154 }
-1155 String groupid = interpolateString(pom.getGroupId(), pomProperties);
-1156 if (groupid != null && !groupid.isEmpty()) {
-1157 if (groupid.startsWith("org." ) || groupid.startsWith("com." )) {
-1158 groupid = groupid.substring(4);
-1159 }
-1160 dependency.getVendorEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.HIGH);
-1161 dependency.getProductEvidence().addEvidence("pom" , "groupid" , groupid, Confidence.LOW);
-1162 }
-1163 String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
-1164 if (artifactid != null && !artifactid.isEmpty()) {
-1165 if (artifactid.startsWith("org." ) || artifactid.startsWith("com." )) {
-1166 artifactid = artifactid.substring(4);
-1167 }
-1168 dependency.getProductEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.HIGH);
-1169 dependency.getVendorEvidence().addEvidence("pom" , "artifactid" , artifactid, Confidence.LOW);
-1170 }
-1171 final String version = interpolateString(pom.getVersion(), pomProperties);
-1172 if (version != null && !version.isEmpty()) {
-1173 dependency.getVersionEvidence().addEvidence("pom" , "version" , version, Confidence.HIGHEST);
-1174 }
-1175
-1176 final Parent parent = pom.getParent();
-1177 if (parent != null ) {
-1178 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
-1179 if (parentGroupId != null && !parentGroupId.isEmpty()) {
-1180 if (groupid == null || groupid.isEmpty()) {
-1181 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.HIGH);
-1182 } else {
-1183 dependency.getVendorEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.MEDIUM);
-1184 }
-1185 dependency.getProductEvidence().addEvidence("pom" , "parent.groupid" , parentGroupId, Confidence.LOW);
-1186 }
-1187 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
-1188 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
-1189 if (artifactid == null || artifactid.isEmpty()) {
-1190 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.HIGH);
-1191 } else {
-1192 dependency.getProductEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.MEDIUM);
-1193 }
-1194 dependency.getVendorEvidence().addEvidence("pom" , "parent.artifactid" , parentArtifactId, Confidence.LOW);
-1195 }
-1196 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
-1197 if (parentVersion != null && !parentVersion.isEmpty()) {
-1198 if (version == null || version.isEmpty()) {
-1199 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.HIGH);
-1200 } else {
-1201 dependency.getVersionEvidence().addEvidence("pom" , "parent.version" , parentVersion, Confidence.LOW);
-1202 }
-1203 }
-1204 }
-1205
-1206 final Organization org = pom.getOrganization();
-1207 if (org != null && org.getName() != null ) {
-1208 final String orgName = interpolateString(org.getName(), pomProperties);
-1209 if (orgName != null && !orgName.isEmpty()) {
-1210 dependency.getVendorEvidence().addEvidence("pom" , "organization name" , orgName, Confidence.HIGH);
-1211 }
-1212 }
-1213
-1214 final String pomName = interpolateString(pom.getName(), pomProperties);
-1215 if (pomName != null && !pomName.isEmpty()) {
-1216 dependency.getProductEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-1217 dependency.getVendorEvidence().addEvidence("pom" , "name" , pomName, Confidence.HIGH);
-1218 }
-1219
-1220
-1221 if (pom.getDescription() != null ) {
-1222 final String description = interpolateString(pom.getDescription(), pomProperties);
-1223 if (description != null && !description.isEmpty()) {
-1224 addDescription(dependency, description, "pom" , "description" );
-1225 }
-1226 }
-1227 extractLicense(pom, pomProperties, dependency);
-1228 }
-1229
-1230
-1231
-1232
-1233
-1234
-1235
-1236
-1237 private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
-1238
-1239 if (pom.getLicenses() != null ) {
-1240 String license = null ;
-1241 for (License lic : pom.getLicenses().getLicense()) {
-1242 String tmp = null ;
-1243 if (lic.getName() != null ) {
-1244 tmp = interpolateString(lic.getName(), pomProperties);
-1245 }
-1246 if (lic.getUrl() != null ) {
-1247 if (tmp == null ) {
-1248 tmp = interpolateString(lic.getUrl(), pomProperties);
-1249 } else {
-1250 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
-1251 }
-1252 }
-1253 if (tmp == null ) {
-1254 continue ;
-1255 }
-1256 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
-1257 tmp = Jsoup.parse(tmp).text();
-1258 }
-1259 if (license == null ) {
-1260 license = tmp;
-1261 } else {
-1262 license += "\n" + tmp;
-1263 }
-1264 }
-1265 if (license != null ) {
-1266 dependency.setLicense(license);
-1267 }
-1268 }
-1269 }
-1270
-1271
-1272
-1273
-1274 protected static class ClassNameInformation {
-1275
-1276
-1277
-1278
-1279
-1280
-1281
-1282
-1283
-1284
-1285
-1286
-1287
-1288
-1289
-1290
-1291
-1292
-1293
-1294
-1295
-1296 ClassNameInformation (String className) {
-1297 name = className;
-1298 if (name.contains("/" )) {
-1299 final String[] tmp = className.toLowerCase().split("/" );
-1300 int start = 0;
-1301 int end = 3;
-1302 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
-1303 start = 1;
-1304 end = 4;
-1305 }
-1306 if (tmp.length <= end) {
-1307 end = tmp.length - 1;
-1308 }
-1309 for (int i = start; i <= end; i++) {
-1310 packageStructure.add(tmp[i]);
-1311 }
-1312 } else {
-1313 packageStructure.add(name);
-1314 }
-1315 }
-1316
-1317
-1318
-1319 private String name;
-1320
-1321
-1322
-1323
-1324
-1325
-1326 public String getName() {
-1327 return name;
-1328 }
-1329
-1330
-1331
-1332
-1333
-1334
-1335 public void setName(String name) {
-1336 this .name = name;
-1337 }
-1338
-1339
-1340
-1341 private final ArrayList<String> packageStructure = new ArrayList<String>();
-1342
-1343
-1344
-1345
-1346
-1347
-1348 public ArrayList<String> getPackageStructure() {
-1349 return packageStructure;
-1350 }
-1351 }
-1352
-1353
-1354
-1355
-1356
-1357
-1358
-1359 private File getNextTempDirectory() throws AnalysisException {
-1360 dirCount += 1;
-1361 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
-1362
-1363 if (directory.exists()) {
-1364 return getNextTempDirectory();
-1365 }
-1366 if (!directory.mkdirs()) {
-1367 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
-1368 throw new AnalysisException (msg);
-1369 }
-1370 return directory;
-1371 }
-1372 }
+974
+975
+976 @Override
+977 public void initializeFileTypeAnalyzer() throws Exception {
+978 final File baseDir = Settings.getTempDirectory();
+979 tempFileLocation = File.createTempFile("check" , "tmp" , baseDir);
+980 if (!tempFileLocation.delete()) {
+981 final String msg = String.format("Unable to delete temporary file '%s'." , tempFileLocation.getAbsolutePath());
+982 throw new AnalysisException (msg);
+983 }
+984 if (!tempFileLocation.mkdirs()) {
+985 final String msg = String.format("Unable to create directory '%s'." , tempFileLocation.getAbsolutePath());
+986 throw new AnalysisException (msg);
+987 }
+988 }
+989
+990
+991
+992
+993 @Override
+994 public void close() {
+995 if (tempFileLocation != null && tempFileLocation.exists()) {
+996 LOGGER.log(Level.FINE, "Attempting to delete temporary files" );
+997 final boolean success = FileUtils.delete(tempFileLocation);
+998 if (!success) {
+999 LOGGER.log(Level.WARNING,
+1000 "Failed to delete some temporary files, see the log for more details" );
+1001 }
+1002 }
+1003 }
+1004
+1005
+1006
+1007
+1008
+1009
+1010
+1011
+1012
+1013
+1014
+1015
+1016
+1017
+1018
+1019
+1020
+1021
+1022
+1023
+1024
+1025
+1026
+1027
+1028
+1029
+1030
+1031
+1032 protected String interpolateString(String text, Properties properties) {
+1033 Properties props = properties;
+1034 if (text == null ) {
+1035 return text;
+1036 }
+1037 if (props == null ) {
+1038 props = new Properties ();
+1039 }
+1040
+1041 final int pos = text.indexOf("${" );
+1042 if (pos < 0) {
+1043 return text;
+1044 }
+1045 final int end = text.indexOf("}" );
+1046 if (end < pos) {
+1047 return text;
+1048 }
+1049
+1050 final String propName = text.substring(pos + 2, end);
+1051 String propValue = interpolateString(props.getProperty(propName), props);
+1052 if (propValue == null ) {
+1053 propValue = "" ;
+1054 }
+1055 final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
+1056 sb.append(text.subSequence(0, pos));
+1057 sb.append(propValue);
+1058 sb.append(text.substring(end + 1));
+1059 return interpolateString(sb.toString(), props);
+1060 }
+1061
+1062
+1063
+1064
+1065
+1066
+1067
+1068
+1069 private boolean isImportPackage(String key, String value) {
+1070 final Pattern packageRx = Pattern.compile("^([a-zA-Z0-9_#\\$\\*\\.]+\\s*[,;]\\s*)+([a-zA-Z0-9_#\\$\\*\\.]+\\s*)?$" );
+1071 final boolean matches = packageRx.matcher(value).matches();
+1072 return matches && (key.contains("import" ) || key.contains("include" ) || value.length() > 10);
+1073 }
+1074
+1075
+1076
+1077
+1078
+1079
+1080
+1081
+1082 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
+1083 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
+1084 JarFile jar = null ;
+1085 try {
+1086 jar = new JarFile(dependency.getActualFilePath());
+1087 final Enumeration entries = jar.entries();
+1088 while (entries.hasMoreElements()) {
+1089 final JarEntry entry = (JarEntry) entries.nextElement();
+1090 final String name = entry.getName().toLowerCase();
+1091
+1092 if (name.endsWith(".class" ) && !name.matches("^javax?\\..*$" )) {
+1093 final ClassNameInformation className = new ClassNameInformation (name.substring(0, name.length() - 6));
+1094 classNames.add(className);
+1095 }
+1096 }
+1097 } catch (IOException ex) {
+1098 final String msg = String.format("Unable to open jar file '%s'." , dependency.getFileName());
+1099 LOGGER.log(Level.WARNING, msg);
+1100 LOGGER.log(Level.FINE, null , ex);
+1101 } finally {
+1102 if (jar != null ) {
+1103 try {
+1104 jar.close();
+1105 } catch (IOException ex) {
+1106 LOGGER.log(Level.FINEST, null , ex);
+1107 }
+1108 }
+1109 }
+1110 return classNames;
+1111 }
+1112
+1113
+1114
+1115
+1116
+1117
+1118
+1119
+1120
+1121 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
+1122 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
+1123 for (ClassNameInformation entry : classNames) {
+1124 final ArrayList<String> list = entry.getPackageStructure();
+1125 addEntry(vendor, list.get(0));
+1126
+1127 if (list.size() == 2) {
+1128 addEntry(product, list.get(1));
+1129 }
+1130 if (list.size() == 3) {
+1131 addEntry(vendor, list.get(1));
+1132 addEntry(product, list.get(1));
+1133 addEntry(product, list.get(2));
+1134 }
+1135 if (list.size() >= 4) {
+1136 addEntry(vendor, list.get(1));
+1137 addEntry(vendor, list.get(2));
+1138 addEntry(product, list.get(1));
+1139 addEntry(product, list.get(2));
+1140 addEntry(product, list.get(3));
+1141 }
+1142 }
+1143 }
+1144
+1145
+1146
+1147
+1148
+1149
+1150
+1151
+1152 private void addEntry(HashMap<String, Integer> collection, String key) {
+1153 if (collection.containsKey(key)) {
+1154 collection.put(key, collection.get(key) + 1);
+1155 } else {
+1156 collection.put(key, 1);
+1157 }
+1158 }
+1159
+1160
+1161
+1162
+1163
+1164
+1165
+1166
+1167
+1168
+1169 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
+1170 if (value == null || value.isEmpty() || classes == null || classes.isEmpty()) {
+1171 return ;
+1172 }
+1173 final String text = value.toLowerCase();
+1174 for (ClassNameInformation cni : classes) {
+1175 for (String key : cni.getPackageStructure()) {
+1176 if (text.contains(key)) {
+1177 evidence.addEvidence("jar" , "package name" , key, Confidence.HIGHEST);
+1178 }
+1179 }
+1180 }
+1181 }
+1182
+1183
+1184
+1185
+1186
+1187
+1188
+1189
+1190 private boolean isPackage(String key, String value) {
+1191
+1192 return !key.matches(".*(version|title|vendor|name|license|description).*" )
+1193 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$" );
+1194
+1195 }
+1196
+1197
+1198
+1199
+1200
+1201
+1202
+1203
+1204 private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
+1205
+1206 if (pom.getLicenses() != null ) {
+1207 String license = null ;
+1208 for (License lic : pom.getLicenses().getLicense()) {
+1209 String tmp = null ;
+1210 if (lic.getName() != null ) {
+1211 tmp = interpolateString(lic.getName(), pomProperties);
+1212 }
+1213 if (lic.getUrl() != null ) {
+1214 if (tmp == null ) {
+1215 tmp = interpolateString(lic.getUrl(), pomProperties);
+1216 } else {
+1217 tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
+1218 }
+1219 }
+1220 if (tmp == null ) {
+1221 continue ;
+1222 }
+1223 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
+1224 tmp = Jsoup.parse(tmp).text();
+1225 }
+1226 if (license == null ) {
+1227 license = tmp;
+1228 } else {
+1229 license += "\n" + tmp;
+1230 }
+1231 }
+1232 if (license != null ) {
+1233 dependency.setLicense(license);
+1234 }
+1235 }
+1236 }
+1237
+1238
+1239
+1240
+1241 protected static class ClassNameInformation {
+1242
+1243
+1244
+1245
+1246
+1247
+1248
+1249
+1250
+1251
+1252
+1253
+1254
+1255
+1256
+1257
+1258
+1259
+1260
+1261
+1262
+1263 ClassNameInformation (String className) {
+1264 name = className;
+1265 if (name.contains("/" )) {
+1266 final String[] tmp = className.toLowerCase().split("/" );
+1267 int start = 0;
+1268 int end = 3;
+1269 if ("com" .equals(tmp[0]) || "org" .equals(tmp[0])) {
+1270 start = 1;
+1271 end = 4;
+1272 }
+1273 if (tmp.length <= end) {
+1274 end = tmp.length - 1;
+1275 }
+1276 for (int i = start; i <= end; i++) {
+1277 packageStructure.add(tmp[i]);
+1278 }
+1279 } else {
+1280 packageStructure.add(name);
+1281 }
+1282 }
+1283
+1284
+1285
+1286 private String name;
+1287
+1288
+1289
+1290
+1291
+1292
+1293 public String getName() {
+1294 return name;
+1295 }
+1296
+1297
+1298
+1299
+1300
+1301
+1302 public void setName(String name) {
+1303 this .name = name;
+1304 }
+1305
+1306
+1307
+1308 private final ArrayList<String> packageStructure = new ArrayList<String>();
+1309
+1310
+1311
+1312
+1313
+1314
+1315 public ArrayList<String> getPackageStructure() {
+1316 return packageStructure;
+1317 }
+1318 }
+1319
+1320
+1321
+1322
+1323
+1324
+1325
+1326 private File getNextTempDirectory() throws AnalysisException {
+1327 dirCount += 1;
+1328 final File directory = new File(tempFileLocation, String.valueOf(dirCount));
+1329
+1330 if (directory.exists()) {
+1331 return getNextTempDirectory();
+1332 }
+1333 if (!directory.mkdirs()) {
+1334 final String msg = String.format("Unable to create temp directory '%s'." , directory.getAbsolutePath());
+1335 throw new AnalysisException (msg);
+1336 }
+1337 return directory;
+1338 }
+1339 }
30 import org.owasp.dependencycheck.data.nexus.NexusSearch;
31 import org.owasp.dependencycheck.dependency.Confidence;
32 import org.owasp.dependencycheck.dependency.Dependency;
-33 import org.owasp.dependencycheck.utils.Settings;
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49 public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
-50
-51
-52
-53
-54 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
-55
-56
-57
-58
-59 private static final String ANALYZER_NAME = "Nexus Analyzer" ;
-60
-61
-62
-63
-64 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
-65
-66
-67
-68
-69 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
-70
-71
-72
-73
-74 private NexusSearch searcher;
-75
-76
-77
-78
-79
-80
-81 @Override
-82 public void initializeFileTypeAnalyzer() throws Exception {
-83 LOGGER.fine("Initializing Nexus Analyzer" );
-84 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , isEnabled()));
-85 if (isEnabled()) {
-86 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
-87 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
-88 try {
-89 searcher = new NexusSearch (new URL(searchUrl));
-90 if (!searcher.preflightRequest()) {
-91 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
-92 setEnabled(false);
-93 }
-94 } catch (MalformedURLException mue) {
-95
-96
-97 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
-98 setEnabled(false);
-99 }
-100 }
-101 }
-102
-103
-104
-105
-106
-107
-108 @Override
-109 public String getName() {
-110 return ANALYZER_NAME;
-111 }
-112
-113
-114
-115
-116
-117
-118 @Override
-119 protected String getAnalyzerEnabledSettingKey() {
-120 return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
-121 }
-122
-123
-124
-125
-126
-127
-128 @Override
-129 public AnalysisPhase getAnalysisPhase() {
-130 return ANALYSIS_PHASE;
-131 }
-132
-133
-134
-135
-136
-137
-138 @Override
-139 public Set<String> getSupportedExtensions() {
-140 return SUPPORTED_EXTENSIONS;
-141 }
-142
-143
-144
-145
-146
-147
-148
-149
-150 @Override
-151 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
-152 try {
-153 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
-154 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
-155 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
-156 }
-157 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
-158 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
-159 }
-160 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
-161 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
-162 }
-163 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
-164 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
-165 }
-166 } catch (IllegalArgumentException iae) {
-167
-168 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
-169 } catch (FileNotFoundException fnfe) {
-170
-171 LOGGER.fine(String.format("Artifact not found in repository '%s'" , dependency.getFileName()));
-172 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
-173 } catch (IOException ioe) {
-174
-175 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
-176 }
-177 }
-178 }
+33 import org.owasp.dependencycheck.dependency.Identifier;
+34 import org.owasp.dependencycheck.utils.Settings;
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50 public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
+51
+52
+53
+54
+55 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class .getName());
+56
+57
+58
+59
+60 private static final String ANALYZER_NAME = "Nexus Analyzer" ;
+61
+62
+63
+64
+65 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+66
+67
+68
+69
+70 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar" );
+71
+72
+73
+74
+75 private NexusSearch searcher;
+76
+77
+78
+79
+80
+81
+82 @Override
+83 public void initializeFileTypeAnalyzer() throws Exception {
+84 LOGGER.fine("Initializing Nexus Analyzer" );
+85 LOGGER.fine(String.format("Nexus Analyzer enabled: %s" , isEnabled()));
+86 if (isEnabled()) {
+87 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+88 LOGGER.fine(String.format("Nexus Analyzer URL: %s" , searchUrl));
+89 try {
+90 searcher = new NexusSearch (new URL(searchUrl));
+91 if (!searcher.preflightRequest()) {
+92 LOGGER.warning("There was an issue getting Nexus status. Disabling analyzer." );
+93 setEnabled(false);
+94 }
+95 } catch (MalformedURLException mue) {
+96
+97
+98 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled" , searchUrl));
+99 setEnabled(false);
+100 }
+101 }
+102 }
+103
+104
+105
+106
+107
+108
+109 @Override
+110 public String getName() {
+111 return ANALYZER_NAME;
+112 }
+113
+114
+115
+116
+117
+118
+119 @Override
+120 protected String getAnalyzerEnabledSettingKey() {
+121 return Settings.KEYS.ANALYZER_NEXUS_ENABLED;
+122 }
+123
+124
+125
+126
+127
+128
+129 @Override
+130 public AnalysisPhase getAnalysisPhase() {
+131 return ANALYSIS_PHASE;
+132 }
+133
+134
+135
+136
+137
+138
+139 @Override
+140 public Set<String> getSupportedExtensions() {
+141 return SUPPORTED_EXTENSIONS;
+142 }
+143
+144
+145
+146
+147
+148
+149
+150
+151 @Override
+152 public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+153 try {
+154 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
+155 if (ma.getGroupId() != null && !"" .equals(ma.getGroupId())) {
+156 dependency.getVendorEvidence().addEvidence("nexus" , "groupid" , ma.getGroupId(), Confidence.HIGH);
+157 }
+158 if (ma.getArtifactId() != null && !"" .equals(ma.getArtifactId())) {
+159 dependency.getProductEvidence().addEvidence("nexus" , "artifactid" , ma.getArtifactId(), Confidence.HIGH);
+160 }
+161 if (ma.getVersion() != null && !"" .equals(ma.getVersion())) {
+162 dependency.getVersionEvidence().addEvidence("nexus" , "version" , ma.getVersion(), Confidence.HIGH);
+163 }
+164 if (ma.getArtifactUrl() != null && !"" .equals(ma.getArtifactUrl())) {
+165 boolean found = false;
+166 for (Identifier i : dependency.getIdentifiers()) {
+167 if ("maven" .equals(i.getType()) && i.getValue().equals(ma.toString())) {
+168 found = true ;
+169 i.setConfidence(Confidence.HIGHEST);
+170 i.setUrl(ma.getArtifactUrl());
+171 break ;
+172 }
+173 }
+174 if (!found) {
+175 dependency.addIdentifier("maven" , ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
+176 }
+177 }
+178 } catch (IllegalArgumentException iae) {
+179
+180 LOGGER.info(String.format("invalid sha-1 hash on %s" , dependency.getFileName()));
+181 } catch (FileNotFoundException fnfe) {
+182
+183 LOGGER.fine(String.format("Artifact not found in repository '%s'" , dependency.getFileName()));
+184 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
+185 } catch (IOException ioe) {
+186
+187 LOGGER.log(Level.FINE, "Could not connect to nexus repository" , ioe);
+188 }
+189 }
+190 }
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.analyzer.exception
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.analyzer.exception
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.analyzer.exception
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.analyzer.exception
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.analyzer
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.analyzer
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.analyzer
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cpe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cpe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cpe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.cwe
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.cwe
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.lucene
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.lucene
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.lucene
64 public NexusSearch (URL rootURL) {
65 this .rootURL = rootURL;
66 try {
-67 if (null != Settings.getString(Settings.KEYS.PROXY_URL)
+67 if (null != Settings.getString(Settings.KEYS.PROXY_SERVER)
68 && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY)) {
69 useProxy = true ;
70 LOGGER.fine("Using proxy" );
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html
index 5115ab67e..50550d829 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nexus
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nexus
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nuget
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nuget
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nuget
248
249
250
-251 private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?" ;
-252
-253
-254
-255 private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)" ;
-256
-257
-258
-259 private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?" ;
-260
-261
-262
-263 private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?" ;
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274 public Set<VulnerableSoftware> getCPEs(String vendor, String product) {
-275 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>();
-276 ResultSet rs = null ;
-277 PreparedStatement ps = null ;
-278 try {
-279 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES);
-280 ps.setString(1, vendor);
-281 ps.setString(2, product);
-282 rs = ps.executeQuery();
-283
-284 while (rs.next()) {
-285 final VulnerableSoftware vs = new VulnerableSoftware ();
-286 vs.setCpe(rs.getString(1));
-287 cpe.add(vs);
-288 }
-289 } catch (SQLException ex) {
-290 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
-291 LOGGER.log(Level.SEVERE, msg);
-292 LOGGER.log(Level.FINE, null , ex);
-293 } finally {
-294 DBUtils.closeResultSet(rs);
-295 DBUtils.closeStatement(ps);
-296 }
-297 return cpe;
-298 }
-299
-300
-301
-302
-303
-304
-305
-306 public Set<Pair<String, String>> getVendorProductList() throws DatabaseException {
-307 final HashSet data = new HashSet<Pair<String, String>>();
-308 ResultSet rs = null ;
-309 PreparedStatement ps = null ;
-310 try {
-311 ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST);
-312 rs = ps.executeQuery();
-313 while (rs.next()) {
-314 data.add(new Pair (rs.getString(1), rs.getString(2)));
-315 }
-316 } catch (SQLException ex) {
-317 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
-318 throw new DatabaseException (msg, ex);
-319 } finally {
-320 DBUtils.closeResultSet(rs);
-321 DBUtils.closeStatement(ps);
-322 }
-323 return data;
-324 }
-325
-326
-327
-328
-329
-330
-331 Properties getProperties() {
-332 final Properties prop = new Properties();
-333 PreparedStatement ps = null ;
-334 ResultSet rs = null ;
-335 try {
-336 ps = getConnection().prepareStatement(SELECT_PROPERTIES);
-337 rs = ps.executeQuery();
-338 while (rs.next()) {
-339 prop.setProperty(rs.getString(1), rs.getString(2));
-340 }
-341 } catch (SQLException ex) {
-342 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
-343 LOGGER.log(Level.SEVERE, msg);
-344 LOGGER.log(Level.FINE, null , ex);
-345 } finally {
-346 DBUtils.closeStatement(ps);
-347 DBUtils.closeResultSet(rs);
-348 }
-349 return prop;
-350 }
-351
-352
-353
-354
-355
-356
-357 void saveProperties(Properties props) {
-358 PreparedStatement updateProperty = null ;
-359 PreparedStatement insertProperty = null ;
-360 try {
-361 try {
-362 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
-363 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
-364 } catch (SQLException ex) {
-365 LOGGER.log(Level.WARNING, "Unable to save properties to the database" );
-366 LOGGER.log(Level.FINE, "Unable to save properties to the database" , ex);
-367 return ;
-368 }
-369 for (Entry<Object, Object> entry : props.entrySet()) {
-370 final String key = entry.getKey().toString();
-371 final String value = entry.getValue().toString();
-372 try {
-373 updateProperty.setString(1, value);
-374 updateProperty.setString(2, key);
-375 if (updateProperty.executeUpdate() == 0) {
-376 insertProperty.setString(1, key);
-377 insertProperty.setString(2, value);
-378 }
-379 } catch (SQLException ex) {
-380 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database" , key, value);
-381 LOGGER.log(Level.WARNING, msg);
-382 LOGGER.log(Level.FINE, null , ex);
-383 }
-384 }
-385 } finally {
-386 DBUtils.closeStatement(updateProperty);
-387 DBUtils.closeStatement(insertProperty);
-388 }
-389 }
-390
-391
-392
-393
-394
-395
-396
-397 void saveProperty(String key, String value) {
-398 PreparedStatement updateProperty = null ;
-399 PreparedStatement insertProperty = null ;
-400 try {
-401 try {
-402 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
-403 } catch (SQLException ex) {
-404 LOGGER.log(Level.WARNING, "Unable to save properties to the database" );
-405 LOGGER.log(Level.FINE, "Unable to save properties to the database" , ex);
-406 return ;
-407 }
-408 try {
-409 updateProperty.setString(1, value);
-410 updateProperty.setString(2, key);
-411 if (updateProperty.executeUpdate() == 0) {
-412 try {
-413 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
-414 } catch (SQLException ex) {
-415 LOGGER.log(Level.WARNING, "Unable to save properties to the database" );
-416 LOGGER.log(Level.FINE, "Unable to save properties to the database" , ex);
-417 return ;
-418 }
-419 insertProperty.setString(1, key);
-420 insertProperty.setString(2, value);
-421 insertProperty.execute();
-422 }
-423 } catch (SQLException ex) {
-424 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database" , key, value);
-425 LOGGER.log(Level.WARNING, msg);
-426 LOGGER.log(Level.FINE, null , ex);
-427 }
-428 } finally {
-429 DBUtils.closeStatement(updateProperty);
-430 DBUtils.closeStatement(insertProperty);
-431 }
-432 }
-433
-434
-435
-436
-437
-438
-439
-440
-441 public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException {
-442 ResultSet rs = null ;
-443 final VulnerableSoftware cpe = new VulnerableSoftware ();
-444 try {
-445 cpe.parseName(cpeStr);
-446 } catch (UnsupportedEncodingException ex) {
-447 LOGGER.log(Level.FINEST, null , ex);
-448 }
-449 final DependencyVersion detectedVersion = parseDependencyVersion(cpe);
-450 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
-451
-452 PreparedStatement ps;
-453 final HashSet<String> cveEntries = new HashSet<String>();
-454 try {
-455 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE);
-456 ps.setString(1, cpe.getVendor());
-457 ps.setString(2, cpe.getProduct());
-458 rs = ps.executeQuery();
-459 while (rs.next()) {
-460 final String cveId = rs.getString(1);
-461 final String cpeId = rs.getString(2);
-462 final String previous = rs.getString(3);
-463 if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) {
-464 cveEntries.add(cveId);
-465 final Vulnerability v = getVulnerability(cveId);
-466 v.setMatchedCPE(cpeId, previous);
-467 vulnerabilities.add(v);
-468 }
-469 }
-470 DBUtils.closeResultSet(rs);
-471 DBUtils.closeStatement(ps);
-472
-473
-474
-475
-476
-477 } catch (SQLException ex) {
-478 throw new DatabaseException ("Exception retrieving vulnerability for " + cpeStr, ex);
-479 } finally {
-480 DBUtils.closeResultSet(rs);
-481 }
-482 return vulnerabilities;
-483 }
-484
-485
-486
-487
-488
-489
-490
-491
-492 private Vulnerability getVulnerability(String cve) throws DatabaseException {
-493 PreparedStatement psV = null ;
-494 PreparedStatement psR = null ;
-495 PreparedStatement psS = null ;
-496 ResultSet rsV = null ;
-497 ResultSet rsR = null ;
-498 ResultSet rsS = null ;
-499 Vulnerability vuln = null ;
-500 try {
-501 psV = getConnection().prepareStatement(SELECT_VULNERABILITY);
-502 psV.setString(1, cve);
-503 rsV = psV.executeQuery();
-504 if (rsV.next()) {
-505 vuln = new Vulnerability ();
-506 vuln.setName(cve);
-507 vuln.setDescription(rsV.getString(2));
-508 String cwe = rsV.getString(3);
-509 if (cwe != null ) {
-510 final String name = CweDB.getCweName(cwe);
-511 if (name != null ) {
-512 cwe += " " + name;
-513 }
-514 }
-515 final int cveId = rsV.getInt(1);
-516 vuln.setCwe(cwe);
-517 vuln.setCvssScore(rsV.getFloat(4));
-518 vuln.setCvssAccessVector(rsV.getString(5));
-519 vuln.setCvssAccessComplexity(rsV.getString(6));
-520 vuln.setCvssAuthentication(rsV.getString(7));
-521 vuln.setCvssConfidentialityImpact(rsV.getString(8));
-522 vuln.setCvssIntegrityImpact(rsV.getString(9));
-523 vuln.setCvssAvailabilityImpact(rsV.getString(10));
-524
-525 psR = getConnection().prepareStatement(SELECT_REFERENCE);
-526 psR.setInt(1, cveId);
-527 rsR = psR.executeQuery();
-528 while (rsR.next()) {
-529 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
-530 }
-531 psS = getConnection().prepareStatement(SELECT_SOFTWARE);
-532 psS.setInt(1, cveId);
-533 rsS = psS.executeQuery();
-534 while (rsS.next()) {
-535 final String cpe = rsS.getString(1);
-536 final String prevVersion = rsS.getString(2);
-537 if (prevVersion == null ) {
-538 vuln.addVulnerableSoftware(cpe);
-539 } else {
-540 vuln.addVulnerableSoftware(cpe, prevVersion);
-541 }
-542 }
-543 }
-544 } catch (SQLException ex) {
-545 throw new DatabaseException ("Error retrieving " + cve, ex);
-546 } finally {
-547 DBUtils.closeResultSet(rsV);
-548 DBUtils.closeResultSet(rsR);
-549 DBUtils.closeResultSet(rsS);
-550 DBUtils.closeStatement(psV);
-551 DBUtils.closeStatement(psR);
-552 DBUtils.closeStatement(psS);
-553 }
-554 return vuln;
-555 }
-556
-557
-558
-559
-560
-561
-562
-563 public void updateVulnerability(Vulnerability vuln) throws DatabaseException {
-564 PreparedStatement selectVulnerabilityId = null ;
-565 PreparedStatement deleteVulnerability = null ;
-566 PreparedStatement deleteReferences = null ;
-567 PreparedStatement deleteSoftware = null ;
-568 PreparedStatement updateVulnerability = null ;
-569 PreparedStatement insertVulnerability = null ;
-570 PreparedStatement insertReference = null ;
-571 PreparedStatement selectCpeId = null ;
-572 PreparedStatement insertCpe = null ;
-573 PreparedStatement insertSoftware = null ;
-574
-575 try {
-576 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID);
-577 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY);
-578 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE);
-579 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE);
-580 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY);
-581 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS);
-582 insertReference = getConnection().prepareStatement(INSERT_REFERENCE);
-583 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID);
-584 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS);
-585 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE);
-586 int vulnerabilityId = 0;
-587 selectVulnerabilityId.setString(1, vuln.getName());
-588 ResultSet rs = selectVulnerabilityId.executeQuery();
-589 if (rs.next()) {
-590 vulnerabilityId = rs.getInt(1);
-591
-592 deleteReferences.setInt(1, vulnerabilityId);
-593 deleteReferences.execute();
-594 deleteSoftware.setInt(1, vulnerabilityId);
-595 deleteSoftware.execute();
-596 }
-597 DBUtils.closeResultSet(rs);
-598 rs = null ;
-599 if (vulnerabilityId != 0) {
-600 if (vuln.getDescription().contains("** REJECT **" )) {
-601 deleteVulnerability.setInt(1, vulnerabilityId);
-602 deleteVulnerability.executeUpdate();
-603 } else {
-604 updateVulnerability.setString(1, vuln.getDescription());
-605 updateVulnerability.setString(2, vuln.getCwe());
-606 updateVulnerability.setFloat(3, vuln.getCvssScore());
-607 updateVulnerability.setString(4, vuln.getCvssAccessVector());
-608 updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
-609 updateVulnerability.setString(6, vuln.getCvssAuthentication());
-610 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
-611 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
-612 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
-613 updateVulnerability.setInt(10, vulnerabilityId);
-614 updateVulnerability.executeUpdate();
-615 }
-616 } else {
-617 insertVulnerability.setString(1, vuln.getName());
-618 insertVulnerability.setString(2, vuln.getDescription());
-619 insertVulnerability.setString(3, vuln.getCwe());
-620 insertVulnerability.setFloat(4, vuln.getCvssScore());
-621 insertVulnerability.setString(5, vuln.getCvssAccessVector());
-622 insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
-623 insertVulnerability.setString(7, vuln.getCvssAuthentication());
-624 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
-625 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
-626 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
-627 insertVulnerability.execute();
-628 try {
-629 rs = insertVulnerability.getGeneratedKeys();
-630 rs.next();
-631 vulnerabilityId = rs.getInt(1);
-632 } catch (SQLException ex) {
-633 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'" , vuln.getName());
-634 throw new DatabaseException (msg, ex);
-635 } finally {
-636 DBUtils.closeResultSet(rs);
-637 rs = null ;
-638 }
-639 }
-640 insertReference.setInt(1, vulnerabilityId);
-641 for (Reference r : vuln.getReferences()) {
-642 insertReference.setString(2, r.getName());
-643 insertReference.setString(3, r.getUrl());
-644 insertReference.setString(4, r.getSource());
-645 insertReference.execute();
-646 }
-647 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
-648 int cpeProductId = 0;
-649 selectCpeId.setString(1, s.getName());
-650 try {
-651 rs = selectCpeId.executeQuery();
-652 if (rs.next()) {
-653 cpeProductId = rs.getInt(1);
-654 }
-655 } catch (SQLException ex) {
-656 throw new DatabaseException ("Unable to get primary key for new cpe: " + s.getName(), ex);
-657 } finally {
-658 DBUtils.closeResultSet(rs);
-659 rs = null ;
-660 }
-661
-662 if (cpeProductId == 0) {
-663 insertCpe.setString(1, s.getName());
-664 insertCpe.setString(2, s.getVendor());
-665 insertCpe.setString(3, s.getProduct());
-666 insertCpe.executeUpdate();
-667 cpeProductId = DBUtils.getGeneratedKey(insertCpe);
-668 }
-669 if (cpeProductId == 0) {
-670 throw new DatabaseException ("Unable to retrieve cpeProductId - no data returned" );
-671 }
-672
-673 insertSoftware.setInt(1, vulnerabilityId);
-674 insertSoftware.setInt(2, cpeProductId);
-675 if (s.getPreviousVersion() == null ) {
-676 insertSoftware.setNull(3, java.sql.Types.VARCHAR);
-677 } else {
-678 insertSoftware.setString(3, s.getPreviousVersion());
-679 }
-680 insertSoftware.execute();
-681 }
-682
-683 } catch (SQLException ex) {
-684 final String msg = String.format("Error updating '%s'" , vuln.getName());
-685 LOGGER.log(Level.FINE, null , ex);
-686 throw new DatabaseException (msg, ex);
-687 } finally {
-688 DBUtils.closeStatement(selectVulnerabilityId);
-689 DBUtils.closeStatement(deleteReferences);
-690 DBUtils.closeStatement(deleteSoftware);
-691 DBUtils.closeStatement(updateVulnerability);
-692 DBUtils.closeStatement(deleteVulnerability);
-693 DBUtils.closeStatement(insertVulnerability);
-694 DBUtils.closeStatement(insertReference);
-695 DBUtils.closeStatement(selectCpeId);
-696 DBUtils.closeStatement(insertCpe);
-697 DBUtils.closeStatement(insertSoftware);
-698 }
-699 }
-700
-701
-702
-703
-704
-705 public void cleanupDatabase() {
-706 PreparedStatement ps = null ;
-707 try {
-708 ps = getConnection().prepareStatement(CLEANUP_ORPHANS);
-709 if (ps != null ) {
-710 ps.executeUpdate();
-711 }
-712 } catch (SQLException ex) {
-713 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
-714 LOGGER.log(Level.SEVERE, msg);
-715 LOGGER.log(Level.FINE, null , ex);
-716 } finally {
-717 DBUtils.closeStatement(ps);
-718 }
-719 }
-720
-721
-722
-723
-724
-725
-726
-727
-728
-729
-730
-731
-732 private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) {
-733 boolean affected = false;
-734 final boolean isStruts = "apache" .equals(vendor) && "struts" .equals(product);
-735 final DependencyVersion v = parseDependencyVersion(cpeId);
-736 final boolean prevAffected = previous != null && !previous.isEmpty();
-737 if (v == null || "-" .equals(v.toString())) {
-738 affected = true ;
-739 } else if (identifiedVersion == null || "-" .equals(identifiedVersion.toString())) {
-740 if (prevAffected) {
-741 affected = true ;
-742 }
-743 } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) {
-744 if (isStruts) {
-745 if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
-746 affected = true ;
-747 }
-748 } else {
-749 affected = true ;
-750 }
-751 }
-752
-753
-754
-755
-756 return affected;
-757 }
-758
-759
-760
-761
-762
-763
-764
-765
-766 private DependencyVersion parseDependencyVersion(String cpeStr) {
-767 final VulnerableSoftware cpe = new VulnerableSoftware ();
-768 try {
-769 cpe.parseName(cpeStr);
-770 } catch (UnsupportedEncodingException ex) {
-771
-772 LOGGER.log(Level.FINEST, null , ex);
-773 }
-774 return parseDependencyVersion(cpe);
-775 }
-776
-777
-778
-779
-780
-781
-782
-783 private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) {
-784 DependencyVersion cpeVersion;
-785 if (cpe.getVersion() != null && cpe.getVersion().length() > 0) {
-786 String versionText;
-787 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) {
-788 versionText = String.format("%s.%s" , cpe.getVersion(), cpe.getRevision());
-789 } else {
-790 versionText = cpe.getVersion();
-791 }
-792 cpeVersion = DependencyVersionUtil.parseVersion(versionText);
-793 } else {
-794 cpeVersion = new DependencyVersion ("-" );
-795 }
-796 return cpeVersion;
-797 }
-798 }
+251 @SuppressWarnings("unused" )
+252 private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?" ;
+253
+254
+255
+256 private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)" ;
+257
+258
+259
+260 private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?" ;
+261
+262
+263
+264 @SuppressWarnings("unused" )
+265 private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?" ;
+266
+267
+268
+269
+270
+271
+272
+273
+274
+275
+276 public Set<VulnerableSoftware> getCPEs(String vendor, String product) {
+277 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>();
+278 ResultSet rs = null ;
+279 PreparedStatement ps = null ;
+280 try {
+281 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES);
+282 ps.setString(1, vendor);
+283 ps.setString(2, product);
+284 rs = ps.executeQuery();
+285
+286 while (rs.next()) {
+287 final VulnerableSoftware vs = new VulnerableSoftware ();
+288 vs.setCpe(rs.getString(1));
+289 cpe.add(vs);
+290 }
+291 } catch (SQLException ex) {
+292 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
+293 LOGGER.log(Level.SEVERE, msg);
+294 LOGGER.log(Level.FINE, null , ex);
+295 } finally {
+296 DBUtils.closeResultSet(rs);
+297 DBUtils.closeStatement(ps);
+298 }
+299 return cpe;
+300 }
+301
+302
+303
+304
+305
+306
+307
+308 public Set<Pair<String, String>> getVendorProductList() throws DatabaseException {
+309 final HashSet data = new HashSet<Pair<String, String>>();
+310 ResultSet rs = null ;
+311 PreparedStatement ps = null ;
+312 try {
+313 ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST);
+314 rs = ps.executeQuery();
+315 while (rs.next()) {
+316 data.add(new Pair (rs.getString(1), rs.getString(2)));
+317 }
+318 } catch (SQLException ex) {
+319 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
+320 throw new DatabaseException (msg, ex);
+321 } finally {
+322 DBUtils.closeResultSet(rs);
+323 DBUtils.closeStatement(ps);
+324 }
+325 return data;
+326 }
+327
+328
+329
+330
+331
+332
+333 Properties getProperties() {
+334 final Properties prop = new Properties();
+335 PreparedStatement ps = null ;
+336 ResultSet rs = null ;
+337 try {
+338 ps = getConnection().prepareStatement(SELECT_PROPERTIES);
+339 rs = ps.executeQuery();
+340 while (rs.next()) {
+341 prop.setProperty(rs.getString(1), rs.getString(2));
+342 }
+343 } catch (SQLException ex) {
+344 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
+345 LOGGER.log(Level.SEVERE, msg);
+346 LOGGER.log(Level.FINE, null , ex);
+347 } finally {
+348 DBUtils.closeStatement(ps);
+349 DBUtils.closeResultSet(rs);
+350 }
+351 return prop;
+352 }
+353
+354
+355
+356
+357
+358
+359 void saveProperties(Properties props) {
+360 PreparedStatement updateProperty = null ;
+361 PreparedStatement insertProperty = null ;
+362 try {
+363 try {
+364 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
+365 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
+366 } catch (SQLException ex) {
+367 LOGGER.log(Level.WARNING, "Unable to save properties to the database" );
+368 LOGGER.log(Level.FINE, "Unable to save properties to the database" , ex);
+369 return ;
+370 }
+371 for (Entry<Object, Object> entry : props.entrySet()) {
+372 final String key = entry.getKey().toString();
+373 final String value = entry.getValue().toString();
+374 try {
+375 updateProperty.setString(1, value);
+376 updateProperty.setString(2, key);
+377 if (updateProperty.executeUpdate() == 0) {
+378 insertProperty.setString(1, key);
+379 insertProperty.setString(2, value);
+380 }
+381 } catch (SQLException ex) {
+382 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database" , key, value);
+383 LOGGER.log(Level.WARNING, msg);
+384 LOGGER.log(Level.FINE, null , ex);
+385 }
+386 }
+387 } finally {
+388 DBUtils.closeStatement(updateProperty);
+389 DBUtils.closeStatement(insertProperty);
+390 }
+391 }
+392
+393
+394
+395
+396
+397
+398
+399 void saveProperty(String key, String value) {
+400 PreparedStatement updateProperty = null ;
+401 PreparedStatement insertProperty = null ;
+402 try {
+403 try {
+404 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
+405 } catch (SQLException ex) {
+406 LOGGER.log(Level.WARNING, "Unable to save properties to the database" );
+407 LOGGER.log(Level.FINE, "Unable to save properties to the database" , ex);
+408 return ;
+409 }
+410 try {
+411 updateProperty.setString(1, value);
+412 updateProperty.setString(2, key);
+413 if (updateProperty.executeUpdate() == 0) {
+414 try {
+415 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
+416 } catch (SQLException ex) {
+417 LOGGER.log(Level.WARNING, "Unable to save properties to the database" );
+418 LOGGER.log(Level.FINE, "Unable to save properties to the database" , ex);
+419 return ;
+420 }
+421 insertProperty.setString(1, key);
+422 insertProperty.setString(2, value);
+423 insertProperty.execute();
+424 }
+425 } catch (SQLException ex) {
+426 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database" , key, value);
+427 LOGGER.log(Level.WARNING, msg);
+428 LOGGER.log(Level.FINE, null , ex);
+429 }
+430 } finally {
+431 DBUtils.closeStatement(updateProperty);
+432 DBUtils.closeStatement(insertProperty);
+433 }
+434 }
+435
+436
+437
+438
+439
+440
+441
+442
+443 public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException {
+444 ResultSet rs = null ;
+445 final VulnerableSoftware cpe = new VulnerableSoftware ();
+446 try {
+447 cpe.parseName(cpeStr);
+448 } catch (UnsupportedEncodingException ex) {
+449 LOGGER.log(Level.FINEST, null , ex);
+450 }
+451 final DependencyVersion detectedVersion = parseDependencyVersion(cpe);
+452 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
+453
+454 PreparedStatement ps;
+455 final HashSet<String> cveEntries = new HashSet<String>();
+456 try {
+457 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE);
+458 ps.setString(1, cpe.getVendor());
+459 ps.setString(2, cpe.getProduct());
+460 rs = ps.executeQuery();
+461 while (rs.next()) {
+462 final String cveId = rs.getString(1);
+463 final String cpeId = rs.getString(2);
+464 final String previous = rs.getString(3);
+465 if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) {
+466 cveEntries.add(cveId);
+467 final Vulnerability v = getVulnerability(cveId);
+468 v.setMatchedCPE(cpeId, previous);
+469 vulnerabilities.add(v);
+470 }
+471 }
+472 DBUtils.closeResultSet(rs);
+473 DBUtils.closeStatement(ps);
+474
+475
+476
+477
+478
+479 } catch (SQLException ex) {
+480 throw new DatabaseException ("Exception retrieving vulnerability for " + cpeStr, ex);
+481 } finally {
+482 DBUtils.closeResultSet(rs);
+483 }
+484 return vulnerabilities;
+485 }
+486
+487
+488
+489
+490
+491
+492
+493
+494 private Vulnerability getVulnerability(String cve) throws DatabaseException {
+495 PreparedStatement psV = null ;
+496 PreparedStatement psR = null ;
+497 PreparedStatement psS = null ;
+498 ResultSet rsV = null ;
+499 ResultSet rsR = null ;
+500 ResultSet rsS = null ;
+501 Vulnerability vuln = null ;
+502 try {
+503 psV = getConnection().prepareStatement(SELECT_VULNERABILITY);
+504 psV.setString(1, cve);
+505 rsV = psV.executeQuery();
+506 if (rsV.next()) {
+507 vuln = new Vulnerability ();
+508 vuln.setName(cve);
+509 vuln.setDescription(rsV.getString(2));
+510 String cwe = rsV.getString(3);
+511 if (cwe != null ) {
+512 final String name = CweDB.getCweName(cwe);
+513 if (name != null ) {
+514 cwe += " " + name;
+515 }
+516 }
+517 final int cveId = rsV.getInt(1);
+518 vuln.setCwe(cwe);
+519 vuln.setCvssScore(rsV.getFloat(4));
+520 vuln.setCvssAccessVector(rsV.getString(5));
+521 vuln.setCvssAccessComplexity(rsV.getString(6));
+522 vuln.setCvssAuthentication(rsV.getString(7));
+523 vuln.setCvssConfidentialityImpact(rsV.getString(8));
+524 vuln.setCvssIntegrityImpact(rsV.getString(9));
+525 vuln.setCvssAvailabilityImpact(rsV.getString(10));
+526
+527 psR = getConnection().prepareStatement(SELECT_REFERENCE);
+528 psR.setInt(1, cveId);
+529 rsR = psR.executeQuery();
+530 while (rsR.next()) {
+531 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
+532 }
+533 psS = getConnection().prepareStatement(SELECT_SOFTWARE);
+534 psS.setInt(1, cveId);
+535 rsS = psS.executeQuery();
+536 while (rsS.next()) {
+537 final String cpe = rsS.getString(1);
+538 final String prevVersion = rsS.getString(2);
+539 if (prevVersion == null ) {
+540 vuln.addVulnerableSoftware(cpe);
+541 } else {
+542 vuln.addVulnerableSoftware(cpe, prevVersion);
+543 }
+544 }
+545 }
+546 } catch (SQLException ex) {
+547 throw new DatabaseException ("Error retrieving " + cve, ex);
+548 } finally {
+549 DBUtils.closeResultSet(rsV);
+550 DBUtils.closeResultSet(rsR);
+551 DBUtils.closeResultSet(rsS);
+552 DBUtils.closeStatement(psV);
+553 DBUtils.closeStatement(psR);
+554 DBUtils.closeStatement(psS);
+555 }
+556 return vuln;
+557 }
+558
+559
+560
+561
+562
+563
+564
+565 public void updateVulnerability(Vulnerability vuln) throws DatabaseException {
+566 PreparedStatement selectVulnerabilityId = null ;
+567 PreparedStatement deleteVulnerability = null ;
+568 PreparedStatement deleteReferences = null ;
+569 PreparedStatement deleteSoftware = null ;
+570 PreparedStatement updateVulnerability = null ;
+571 PreparedStatement insertVulnerability = null ;
+572 PreparedStatement insertReference = null ;
+573 PreparedStatement selectCpeId = null ;
+574 PreparedStatement insertCpe = null ;
+575 PreparedStatement insertSoftware = null ;
+576
+577 try {
+578 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID);
+579 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY);
+580 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE);
+581 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE);
+582 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY);
+583 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS);
+584 insertReference = getConnection().prepareStatement(INSERT_REFERENCE);
+585 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID);
+586 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS);
+587 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE);
+588 int vulnerabilityId = 0;
+589 selectVulnerabilityId.setString(1, vuln.getName());
+590 ResultSet rs = selectVulnerabilityId.executeQuery();
+591 if (rs.next()) {
+592 vulnerabilityId = rs.getInt(1);
+593
+594 deleteReferences.setInt(1, vulnerabilityId);
+595 deleteReferences.execute();
+596 deleteSoftware.setInt(1, vulnerabilityId);
+597 deleteSoftware.execute();
+598 }
+599 DBUtils.closeResultSet(rs);
+600 rs = null ;
+601 if (vulnerabilityId != 0) {
+602 if (vuln.getDescription().contains("** REJECT **" )) {
+603 deleteVulnerability.setInt(1, vulnerabilityId);
+604 deleteVulnerability.executeUpdate();
+605 } else {
+606 updateVulnerability.setString(1, vuln.getDescription());
+607 updateVulnerability.setString(2, vuln.getCwe());
+608 updateVulnerability.setFloat(3, vuln.getCvssScore());
+609 updateVulnerability.setString(4, vuln.getCvssAccessVector());
+610 updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
+611 updateVulnerability.setString(6, vuln.getCvssAuthentication());
+612 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
+613 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
+614 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
+615 updateVulnerability.setInt(10, vulnerabilityId);
+616 updateVulnerability.executeUpdate();
+617 }
+618 } else {
+619 insertVulnerability.setString(1, vuln.getName());
+620 insertVulnerability.setString(2, vuln.getDescription());
+621 insertVulnerability.setString(3, vuln.getCwe());
+622 insertVulnerability.setFloat(4, vuln.getCvssScore());
+623 insertVulnerability.setString(5, vuln.getCvssAccessVector());
+624 insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
+625 insertVulnerability.setString(7, vuln.getCvssAuthentication());
+626 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
+627 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
+628 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
+629 insertVulnerability.execute();
+630 try {
+631 rs = insertVulnerability.getGeneratedKeys();
+632 rs.next();
+633 vulnerabilityId = rs.getInt(1);
+634 } catch (SQLException ex) {
+635 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'" , vuln.getName());
+636 throw new DatabaseException (msg, ex);
+637 } finally {
+638 DBUtils.closeResultSet(rs);
+639 rs = null ;
+640 }
+641 }
+642 insertReference.setInt(1, vulnerabilityId);
+643 for (Reference r : vuln.getReferences()) {
+644 insertReference.setString(2, r.getName());
+645 insertReference.setString(3, r.getUrl());
+646 insertReference.setString(4, r.getSource());
+647 insertReference.execute();
+648 }
+649 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
+650 int cpeProductId = 0;
+651 selectCpeId.setString(1, s.getName());
+652 try {
+653 rs = selectCpeId.executeQuery();
+654 if (rs.next()) {
+655 cpeProductId = rs.getInt(1);
+656 }
+657 } catch (SQLException ex) {
+658 throw new DatabaseException ("Unable to get primary key for new cpe: " + s.getName(), ex);
+659 } finally {
+660 DBUtils.closeResultSet(rs);
+661 rs = null ;
+662 }
+663
+664 if (cpeProductId == 0) {
+665 insertCpe.setString(1, s.getName());
+666 insertCpe.setString(2, s.getVendor());
+667 insertCpe.setString(3, s.getProduct());
+668 insertCpe.executeUpdate();
+669 cpeProductId = DBUtils.getGeneratedKey(insertCpe);
+670 }
+671 if (cpeProductId == 0) {
+672 throw new DatabaseException ("Unable to retrieve cpeProductId - no data returned" );
+673 }
+674
+675 insertSoftware.setInt(1, vulnerabilityId);
+676 insertSoftware.setInt(2, cpeProductId);
+677 if (s.getPreviousVersion() == null ) {
+678 insertSoftware.setNull(3, java.sql.Types.VARCHAR);
+679 } else {
+680 insertSoftware.setString(3, s.getPreviousVersion());
+681 }
+682 insertSoftware.execute();
+683 }
+684
+685 } catch (SQLException ex) {
+686 final String msg = String.format("Error updating '%s'" , vuln.getName());
+687 LOGGER.log(Level.FINE, null , ex);
+688 throw new DatabaseException (msg, ex);
+689 } finally {
+690 DBUtils.closeStatement(selectVulnerabilityId);
+691 DBUtils.closeStatement(deleteReferences);
+692 DBUtils.closeStatement(deleteSoftware);
+693 DBUtils.closeStatement(updateVulnerability);
+694 DBUtils.closeStatement(deleteVulnerability);
+695 DBUtils.closeStatement(insertVulnerability);
+696 DBUtils.closeStatement(insertReference);
+697 DBUtils.closeStatement(selectCpeId);
+698 DBUtils.closeStatement(insertCpe);
+699 DBUtils.closeStatement(insertSoftware);
+700 }
+701 }
+702
+703
+704
+705
+706
+707 public void cleanupDatabase() {
+708 PreparedStatement ps = null ;
+709 try {
+710 ps = getConnection().prepareStatement(CLEANUP_ORPHANS);
+711 if (ps != null ) {
+712 ps.executeUpdate();
+713 }
+714 } catch (SQLException ex) {
+715 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details." ;
+716 LOGGER.log(Level.SEVERE, msg);
+717 LOGGER.log(Level.FINE, null , ex);
+718 } finally {
+719 DBUtils.closeStatement(ps);
+720 }
+721 }
+722
+723
+724
+725
+726
+727
+728
+729
+730
+731
+732
+733
+734 private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) {
+735 boolean affected = false;
+736 final boolean isStruts = "apache" .equals(vendor) && "struts" .equals(product);
+737 final DependencyVersion v = parseDependencyVersion(cpeId);
+738 final boolean prevAffected = previous != null && !previous.isEmpty();
+739 if (v == null || "-" .equals(v.toString())) {
+740 affected = true ;
+741 } else if (identifiedVersion == null || "-" .equals(identifiedVersion.toString())) {
+742 if (prevAffected) {
+743 affected = true ;
+744 }
+745 } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) {
+746 if (isStruts) {
+747 if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
+748 affected = true ;
+749 }
+750 } else {
+751 affected = true ;
+752 }
+753 }
+754
+755
+756
+757
+758 return affected;
+759 }
+760
+761
+762
+763
+764
+765
+766
+767
+768 private DependencyVersion parseDependencyVersion(String cpeStr) {
+769 final VulnerableSoftware cpe = new VulnerableSoftware ();
+770 try {
+771 cpe.parseName(cpeStr);
+772 } catch (UnsupportedEncodingException ex) {
+773
+774 LOGGER.log(Level.FINEST, null , ex);
+775 }
+776 return parseDependencyVersion(cpe);
+777 }
+778
+779
+780
+781
+782
+783
+784
+785 private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) {
+786 DependencyVersion cpeVersion;
+787 if (cpe.getVersion() != null && cpe.getVersion().length() > 0) {
+788 String versionText;
+789 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) {
+790 versionText = String.format("%s.%s" , cpe.getVersion(), cpe.getRevision());
+791 } else {
+792 versionText = cpe.getVersion();
+793 }
+794 cpeVersion = DependencyVersionUtil.parseVersion(versionText);
+795 } else {
+796 cpeVersion = new DependencyVersion ("-" );
+797 }
+798 return cpeVersion;
+799 }
+800 }
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nvdcve
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.nvdcve
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.nvdcve
34 import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.MODIFIED;
35 import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
36 import org.owasp.dependencycheck.data.update.exception.UpdateException;
-37 import org.owasp.dependencycheck.data.update.task.CallableDownloadTask;
+37 import org.owasp.dependencycheck.data.update.task.DownloadTask;
38 import org.owasp.dependencycheck.data.update.task.ProcessTask;
39 import org.owasp.dependencycheck.utils.DownloadFailedException;
40 import org.owasp.dependencycheck.utils.InvalidSettingException;
@@ -130,7 +130,7 @@
122 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
123 for (NvdCveInfo cve : updateable) {
124 if (cve.getNeedsUpdate()) {
-125 final CallableDownloadTask call = new CallableDownloadTask (cve, processExecutor, cveDB, Settings.getInstance());
+125 final DownloadTask call = new DownloadTask (cve, processExecutor, cveDB, Settings.getInstance());
126 downloadFutures.add(downloadExecutors.submit(call));
127 }
128 }
@@ -212,14 +212,14 @@
204 } catch (InvalidDataException ex) {
205 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page" ;
206 LOGGER.log(Level.FINE, msg, ex);
-207 throw new DownloadFailedException (msg, ex);
+207 throw new DownloadFailedException(msg, ex);
208 } catch (InvalidSettingException ex) {
209 LOGGER.log(Level.FINE, "Invalid setting found when retrieving timestamps" , ex);
-210 throw new DownloadFailedException ("Invalid settings" , ex);
+210 throw new DownloadFailedException("Invalid settings" , ex);
211 }
212
213 if (updates == null ) {
-214 throw new DownloadFailedException ("Unable to retrieve the timestamps of the currently published NVD CVE data" );
+214 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data" );
215 }
216 if (!properties.isEmpty()) {
217 try {
@@ -274,7 +274,7 @@
266
267
268 private UpdateableNvdCve retrieveCurrentTimestampsFromWeb()
-269 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException {
+269 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException {
270
271 final UpdateableNvdCve updates = new UpdateableNvdCve ();
272 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL),
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html
index b3e6918d0..02621a0cb 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.exception
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.exception
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.exception
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.exception
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update
DownloadTask xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.data.update.task;
+19
+20 import java.io.File;
+21 import java.io.IOException;
+22 import java.net.URL;
+23 import java.util.concurrent.Callable;
+24 import java.util.concurrent.ExecutorService;
+25 import java.util.concurrent.Future;
+26 import java.util.logging.Level;
+27 import java.util.logging.Logger;
+28 import org.owasp.dependencycheck.data.nvdcve.CveDB;
+29 import org.owasp.dependencycheck.data.update.NvdCveInfo;
+30 import org.owasp.dependencycheck.data.update.exception.UpdateException;
+31 import org.owasp.dependencycheck.utils.DownloadFailedException;
+32 import org.owasp.dependencycheck.utils.Downloader;
+33 import org.owasp.dependencycheck.utils.Settings;
+34
+35
+36
+37
+38
+39
+40 public class DownloadTask implements Callable<Future<ProcessTask>> {
+41
+42
+43
+44
+45 private static final Logger LOGGER = Logger.getLogger(DownloadTask.class .getName());
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57 public DownloadTask (NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB, Settings settings) throws UpdateException {
+58 this .nvdCveInfo = nvdCveInfo;
+59 this .processorService = processor;
+60 this .cveDB = cveDB;
+61 this .settings = settings;
+62
+63 final File file1;
+64 final File file2;
+65
+66 try {
+67 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_" , ".xml" , Settings.getTempDirectory());
+68 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_" , ".xml" , Settings.getTempDirectory());
+69 } catch (IOException ex) {
+70 throw new UpdateException ("Unable to create temporary files" , ex);
+71 }
+72 this .first = file1;
+73 this .second = file2;
+74
+75 }
+76
+77
+78
+79 private CveDB cveDB;
+80
+81
+82
+83 private ExecutorService processorService;
+84
+85
+86
+87 private NvdCveInfo nvdCveInfo;
+88
+89
+90
+91 private Settings settings;
+92
+93
+94
+95
+96
+97
+98 public NvdCveInfo getNvdCveInfo() {
+99 return nvdCveInfo;
+100 }
+101
+102
+103
+104
+105
+106
+107 public void setNvdCveInfo(NvdCveInfo nvdCveInfo) {
+108 this .nvdCveInfo = nvdCveInfo;
+109 }
+110
+111
+112
+113 private File first;
+114
+115
+116
+117
+118
+119
+120 public File getFirst() {
+121 return first;
+122 }
+123
+124
+125
+126
+127
+128
+129 public void setFirst(File first) {
+130 this .first = first;
+131 }
+132
+133
+134
+135 private File second;
+136
+137
+138
+139
+140
+141
+142 public File getSecond() {
+143 return second;
+144 }
+145
+146
+147
+148
+149
+150
+151 public void setSecond(File second) {
+152 this .second = second;
+153 }
+154
+155
+156
+157 private Exception exception = null ;
+158
+159
+160
+161
+162
+163
+164 public Exception getException() {
+165 return exception;
+166 }
+167
+168
+169
+170
+171
+172
+173 public boolean hasException() {
+174 return exception != null ;
+175 }
+176
+177 @Override
+178 public Future<ProcessTask> call() throws Exception {
+179 try {
+180 Settings.setInstance(settings);
+181 final URL url1 = new URL(nvdCveInfo.getUrl());
+182 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl());
+183 String msg = String.format("Download Started for NVD CVE - %s" , nvdCveInfo.getId());
+184 LOGGER.log(Level.INFO, msg);
+185 try {
+186 Downloader.fetchFile(url1, first);
+187 Downloader.fetchFile(url2, second);
+188 } catch (DownloadFailedException ex) {
+189 msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported." , nvdCveInfo.getId());
+190 LOGGER.log(Level.WARNING, msg);
+191 LOGGER.log(Level.FINE, null , ex);
+192 return null ;
+193 }
+194
+195 msg = String.format("Download Complete for NVD CVE - %s" , nvdCveInfo.getId());
+196 LOGGER.log(Level.INFO, msg);
+197
+198 final ProcessTask task = new ProcessTask (cveDB, this , settings);
+199 return this .processorService.submit(task);
+200
+201 } catch (Throwable ex) {
+202 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported." , nvdCveInfo.getId());
+203 LOGGER.log(Level.WARNING, msg);
+204 LOGGER.log(Level.FINE, "Download Task Failed" , ex);
+205 } finally {
+206 Settings.cleanup(false);
+207 }
+208 return null ;
+209 }
+210
+211
+212
+213
+214 public void cleanup() {
+215 boolean deleted = false;
+216 try {
+217 if (first != null && first.exists()) {
+218 deleted = first.delete();
+219 }
+220 } finally {
+221 if (first != null && (first.exists() || !deleted)) {
+222 first.deleteOnExit();
+223 }
+224 }
+225 try {
+226 deleted = false;
+227 if (second != null && second.exists()) {
+228 deleted = second.delete();
+229 }
+230 } finally {
+231 if (second != null && (second.exists() || !deleted)) {
+232 second.deleteOnExit();
+233 }
+234 }
+235 }
+236 }
+
+79
80
81
-82 private final CallableDownloadTask filePair;
+82 private final DownloadTask filePair;
83
84
85
@@ -95,7 +95,7 @@
87
88
89
-90 private Settings settings;
+90 private Settings settings;
91
92
93
@@ -105,7 +105,7 @@
97
98
99
-100 public ProcessTask (final CveDB cveDB, final CallableDownloadTask filePair, Settings settings) {
+100 public ProcessTask (final CveDB cveDB, final DownloadTask filePair, Settings settings) {
101 this .cveDB = cveDB;
102 this .filePair = filePair;
103 this .properties = cveDB.getDatabaseProperties();
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html
index 710bd2493..12b1be25d 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.task
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.task
- CallableDownloadTask
+ DownloadTask
ProcessTask
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html
index a62d79967..a148e3dff 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.task
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.task
- CallableDownloadTask
+ DownloadTask
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html
index eadd82ec3..f01e8a033 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.data.update.xml
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.data.update.xml
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.dependency
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.dependency
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.exception
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.exception
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.exception
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.exception
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.jaxb.pom.generated
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.jaxb.pom
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.jaxb.pom
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.jaxb.pom
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.jaxb.pom
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.reporting
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.reporting
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.reporting
55
56 public static final String CWE = "cwe" ;
57
-58
+58
59
-60 public static final String CVSS_BELOW = "cvssBelow" ;
+60 public static final String GAV = "gav" ;
61
-62
+62
63
-64 private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
-65
-66
-67
-68
-69
-70
-71 public List<SuppressionRule> getSuppressionRules() {
-72 return suppressionRules;
-73 }
-74
-75
-76
-77 private SuppressionRule rule;
+64 public static final String CVSS_BELOW = "cvssBelow" ;
+65
+66
+67
+68 private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
+69
+70
+71
+72
+73
+74
+75 public List<SuppressionRule> getSuppressionRules() {
+76 return suppressionRules;
+77 }
78
-79
+79
80
-81 private Attributes currentAttributes;
+81 private SuppressionRule rule;
82
-83
+83
84
-85 private StringBuffer currentText;
-86
-87
-88
-89
-90
-91
-92
-93
-94
-95
-96 @Override
-97 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
-98 currentAttributes = null ;
-99 currentText = new StringBuffer();
-100
-101 if (SUPPRESS.equals(qName)) {
-102 rule = new SuppressionRule ();
-103 } else if (FILE_PATH.equals(qName)) {
-104 currentAttributes = attributes;
-105 }
-106 }
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116 @Override
-117 public void endElement(String uri, String localName, String qName) throws SAXException {
-118 if (SUPPRESS.equals(qName)) {
-119 suppressionRules.add(rule);
-120 rule = null ;
-121 } else if (FILE_PATH.equals(qName)) {
-122 final PropertyType pt = processPropertyType();
-123 rule.setFilePath(pt);
-124 } else if (SHA1.equals(qName)) {
-125 rule.setSha1(currentText.toString());
-126 } else if (CPE.equals(qName)) {
-127 final PropertyType pt = processPropertyType();
-128 rule.addCpe(pt);
-129 } else if (CWE.equals(qName)) {
-130 rule.addCwe(currentText.toString());
-131 } else if (CVE.equals(qName)) {
-132 rule.addCve(currentText.toString());
-133 } else if (CVSS_BELOW.equals(qName)) {
-134 final float cvss = Float.parseFloat(currentText.toString());
-135 rule.addCvssBelow(cvss);
-136 }
-137 }
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147 @Override
-148 public void characters(char [] ch, int start, int length) throws SAXException {
-149 currentText.append(ch, start, length);
-150 }
-151
-152
-153
-154
-155
-156
-157
-158 private PropertyType processPropertyType() {
-159 final PropertyType pt = new PropertyType ();
-160 pt.setValue(currentText.toString());
-161 if (currentAttributes != null && currentAttributes.getLength() > 0) {
-162 final String regex = currentAttributes.getValue("regex" );
-163 if (regex != null ) {
-164 pt.setRegex(Boolean.parseBoolean(regex));
-165 }
-166 final String caseSensitive = currentAttributes.getValue("caseSensitive" );
-167 if (caseSensitive != null ) {
-168 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
+85 private Attributes currentAttributes;
+86
+87
+88
+89 private StringBuffer currentText;
+90
+91
+92
+93
+94
+95
+96
+97
+98
+99
+100 @Override
+101 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
+102 currentAttributes = attributes;
+103 currentText = new StringBuffer();
+104 if (SUPPRESS.equals(qName)) {
+105 rule = new SuppressionRule ();
+106 }
+107 }
+108
+109
+110
+111
+112
+113
+114
+115
+116
+117 @Override
+118 public void endElement(String uri, String localName, String qName) throws SAXException {
+119 if (SUPPRESS.equals(qName)) {
+120 suppressionRules.add(rule);
+121 rule = null ;
+122 } else if (FILE_PATH.equals(qName)) {
+123 final PropertyType pt = processPropertyType();
+124 rule.setFilePath(pt);
+125 } else if (SHA1.equals(qName)) {
+126 rule.setSha1(currentText.toString());
+127 } else if (GAV.equals(qName)) {
+128 final PropertyType pt = processPropertyType();
+129 rule.setGav(pt);
+130 } else if (CPE.equals(qName)) {
+131 final PropertyType pt = processPropertyType();
+132 rule.addCpe(pt);
+133 } else if (CWE.equals(qName)) {
+134 rule.addCwe(currentText.toString());
+135 } else if (CVE.equals(qName)) {
+136 rule.addCve(currentText.toString());
+137 } else if (CVSS_BELOW.equals(qName)) {
+138 final float cvss = Float.parseFloat(currentText.toString());
+139 rule.addCvssBelow(cvss);
+140 }
+141 }
+142
+143
+144
+145
+146
+147
+148
+149
+150
+151 @Override
+152 public void characters(char [] ch, int start, int length) throws SAXException {
+153 currentText.append(ch, start, length);
+154 }
+155
+156
+157
+158
+159
+160
+161
+162 private PropertyType processPropertyType() {
+163 final PropertyType pt = new PropertyType ();
+164 pt.setValue(currentText.toString());
+165 if (currentAttributes != null && currentAttributes.getLength() > 0) {
+166 final String regex = currentAttributes.getValue("regex" );
+167 if (regex != null ) {
+168 pt.setRegex(Boolean.parseBoolean(regex));
169 }
-170 }
-171 return pt;
-172 }
-173 }
+170 final String caseSensitive = currentAttributes.getValue("caseSensitive" );
+171 if (caseSensitive != null ) {
+172 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
+173 }
+174 }
+175 return pt;
+176 }
+177 }
234 public boolean hasCve() {
235 return cve.size() > 0;
236 }
-237
-238
-239
-240
-241
-242
-243
-244 public void process(Dependency dependency) {
-245 if (filePath != null && !filePath.matches(dependency.getFilePath())) {
-246 return ;
-247 }
-248 if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
-249 return ;
-250 }
-251 if (this .hasCpe()) {
-252 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
-253 while (itr.hasNext()) {
-254 final Identifier i = itr.next();
-255 for (PropertyType c : this .cpe) {
-256 if (cpeMatches(c, i)) {
-257 dependency.addSuppressedIdentifier(i);
-258 itr.remove();
-259 break ;
-260 }
-261 }
-262 }
-263 }
-264 if (hasCve() || hasCwe() || hasCvssBelow()) {
-265 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
-266 while (itr.hasNext()) {
-267 boolean remove = false;
-268 final Vulnerability v = itr.next();
-269 for (String entry : this .cve) {
-270 if (entry.equalsIgnoreCase(v.getName())) {
-271 remove = true ;
-272 break ;
-273 }
-274 }
-275 if (!remove) {
-276 for (String entry : this .cwe) {
-277 if (v.getCwe() != null ) {
-278 final String toMatch = String.format("CWE-%s " , entry);
-279 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
-280 if (toTest.equals(toMatch)) {
-281 remove = true ;
-282 break ;
-283 }
-284 }
-285 }
-286 }
-287 if (!remove) {
-288 for (float cvss : this .cvssBelow) {
-289 if (v.getCvssScore() < cvss) {
-290 remove = true ;
-291 break ;
-292 }
-293 }
-294 }
-295 if (remove) {
-296 dependency.addSuppressedVulnerability(v);
-297 itr.remove();
-298 }
-299 }
-300 }
-301 }
-302
-303
-304
-305
-306
-307
-308
-309 boolean cpeHasNoVersion(PropertyType c) {
-310 if (c.isRegex()) {
-311 return false;
-312 }
-313 if (countCharacter(c.getValue(), ':') == 3) {
-314 return true ;
-315 }
-316 return false;
-317 }
-318
-319
-320
-321
-322
-323
-324
-325
-326 int countCharacter(String str, char c) {
-327 int count = 0;
-328 int pos = str.indexOf(c) + 1;
-329 while (pos > 0) {
-330 count += 1;
-331 pos = str.indexOf(c, pos) + 1;
-332 }
-333 return count;
-334 }
-335
-336
-337
-338
-339
-340
-341
-342
-343 boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) {
-344 if (cpeEntry.matches(identifier.getValue())) {
-345 return true ;
-346 } else if (cpeHasNoVersion(cpeEntry)) {
-347 if (cpeEntry.isCaseSensitive()) {
-348 if (identifier.getValue().startsWith(cpeEntry.getValue())) {
-349 return true ;
-350 }
-351 } else {
-352 final String id = identifier.getValue().toLowerCase();
-353 final String check = cpeEntry.getValue().toLowerCase();
-354 if (id.startsWith(check)) {
-355 return true ;
-356 }
-357 }
+237
+238
+239
+240 private PropertyType gav = null ;
+241
+242
+243
+244
+245
+246
+247 public PropertyType getGav() {
+248 return gav;
+249 }
+250
+251
+252
+253
+254
+255
+256 public void setGav(PropertyType gav) {
+257 this .gav = gav;
+258 }
+259
+260
+261
+262
+263
+264
+265 public boolean hasGav() {
+266 return gav != null ;
+267 }
+268
+269
+270
+271
+272
+273
+274
+275 public void process(Dependency dependency) {
+276 if (filePath != null && !filePath.matches(dependency.getFilePath())) {
+277 return ;
+278 }
+279 if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
+280 return ;
+281 }
+282 if (gav != null ) {
+283 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+284 boolean gavFound = false;
+285 while (itr.hasNext()) {
+286 final Identifier i = itr.next();
+287 if (identifierMatches("maven" , this .gav, i)) {
+288 gavFound = true ;
+289 break ;
+290 }
+291 }
+292 if (!gavFound) {
+293 return ;
+294 }
+295 }
+296
+297 if (this .hasCpe()) {
+298 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
+299 while (itr.hasNext()) {
+300 final Identifier i = itr.next();
+301 for (PropertyType c : this .cpe) {
+302 if (identifierMatches("cpe" , c, i)) {
+303 dependency.addSuppressedIdentifier(i);
+304 itr.remove();
+305 break ;
+306 }
+307 }
+308 }
+309 }
+310 if (hasCve() || hasCwe() || hasCvssBelow()) {
+311 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
+312 while (itr.hasNext()) {
+313 boolean remove = false;
+314 final Vulnerability v = itr.next();
+315 for (String entry : this .cve) {
+316 if (entry.equalsIgnoreCase(v.getName())) {
+317 remove = true ;
+318 break ;
+319 }
+320 }
+321 if (!remove) {
+322 for (String entry : this .cwe) {
+323 if (v.getCwe() != null ) {
+324 final String toMatch = String.format("CWE-%s " , entry);
+325 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
+326 if (toTest.equals(toMatch)) {
+327 remove = true ;
+328 break ;
+329 }
+330 }
+331 }
+332 }
+333 if (!remove) {
+334 for (float cvss : this .cvssBelow) {
+335 if (v.getCvssScore() < cvss) {
+336 remove = true ;
+337 break ;
+338 }
+339 }
+340 }
+341 if (remove) {
+342 dependency.addSuppressedVulnerability(v);
+343 itr.remove();
+344 }
+345 }
+346 }
+347 }
+348
+349
+350
+351
+352
+353
+354
+355 boolean cpeHasNoVersion(PropertyType c) {
+356 if (c.isRegex()) {
+357 return false;
358 }
-359 return false;
-360 }
-361 }
+359 if (countCharacter(c.getValue(), ':') == 3) {
+360 return true ;
+361 }
+362 return false;
+363 }
+364
+365
+366
+367
+368
+369
+370
+371
+372 int countCharacter(String str, char c) {
+373 int count = 0;
+374 int pos = str.indexOf(c) + 1;
+375 while (pos > 0) {
+376 count += 1;
+377 pos = str.indexOf(c, pos) + 1;
+378 }
+379 return count;
+380 }
+381
+382
+383
+384
+385
+386
+387
+388
+389
+390 boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) {
+391 if (identifierType.equals(identifier.getType())) {
+392 if (suppressionEntry.matches(identifier.getValue())) {
+393 return true ;
+394 } else if ("cpe" .equals(identifierType) && cpeHasNoVersion(suppressionEntry)) {
+395 if (suppressionEntry.isCaseSensitive()) {
+396 return identifier.getValue().startsWith(suppressionEntry.getValue());
+397 } else {
+398 final String id = identifier.getValue().toLowerCase();
+399 final String check = suppressionEntry.getValue().toLowerCase();
+400 return id.startsWith(check);
+401 }
+402 }
+403 }
+404 return false;
+405 }
+406
+407
+408
+409
+410
+411
+412 @Override
+413 public String toString() {
+414 final StringBuilder sb = new StringBuilder();
+415 sb.append("SuppressionRule{" );
+416 if (filePath != null ) {
+417 sb.append("filePath=" ).append(filePath).append("," );
+418 }
+419 if (sha1 != null ) {
+420 sb.append("sha1=" ).append(sha1).append("," );
+421 }
+422 if (gav != null ) {
+423 sb.append("gav=" ).append(gav).append("," );
+424 }
+425 if (cpe != null && cpe.size() > 0) {
+426 sb.append("cpe={" );
+427 for (PropertyType pt : cpe) {
+428 sb.append(pt).append("," );
+429 }
+430 sb.append("}" );
+431 }
+432 if (cwe != null && cwe.size() > 0) {
+433 sb.append("cwe={" );
+434 for (String s : cwe) {
+435 sb.append(s).append("," );
+436 }
+437 sb.append("}" );
+438 }
+439 if (cve != null && cve.size() > 0) {
+440 sb.append("cve={" );
+441 for (String s : cve) {
+442 sb.append(s).append("," );
+443 }
+444 sb.append("}" );
+445 }
+446 if (cvssBelow != null && cvssBelow.size() > 0) {
+447 sb.append("cvssBelow={" );
+448 for (Float s : cvssBelow) {
+449 sb.append(s).append("," );
+450 }
+451 sb.append("}" );
+452 }
+453 sb.append("}" );
+454 return sb.toString();
+455 }
+456 }
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.suppression
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.suppression
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.suppression
ExtractionUtil xref
+
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18 package org.owasp.dependencycheck.utils;
+19
+20 import java.io.BufferedInputStream;
+21 import java.io.BufferedOutputStream;
+22 import java.io.File;
+23 import java.io.FileInputStream;
+24 import java.io.FileNotFoundException;
+25 import java.io.FileOutputStream;
+26 import java.io.IOException;
+27 import java.util.logging.Level;
+28 import java.util.logging.Logger;
+29 import java.util.zip.ZipEntry;
+30 import java.util.zip.ZipInputStream;
+31 import org.owasp.dependencycheck.Engine;
+32 import static org.owasp.dependencycheck.utils.FileUtils.getFileExtension;
+33
+34
+35
+36
+37
+38 public final class ExtractionUtil {
+39
+40
+41
+42
+43 private static final Logger LOGGER = Logger.getLogger(ExtractionUtil.class .getName());
+44
+45
+46
+47 private static final int BUFFER_SIZE = 4096;
+48
+49
+50
+51
+52 private ExtractionUtil () {
+53 }
+54
+55
+56
+57
+58
+59
+60
+61
+62 public static void extractFiles(File archive, File extractTo) throws ExtractionException {
+63 extractFiles(archive, extractTo, null );
+64 }
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
+76 public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
+77 if (archive == null || extractTo == null ) {
+78 return ;
+79 }
+80
+81 FileInputStream fis = null ;
+82 ZipInputStream zis = null ;
+83
+84 try {
+85 fis = new FileInputStream(archive);
+86 } catch (FileNotFoundException ex) {
+87 LOGGER.log(Level.FINE, null , ex);
+88 throw new ExtractionException("Archive file was not found." , ex);
+89 }
+90 zis = new ZipInputStream(new BufferedInputStream(fis));
+91 ZipEntry entry;
+92 try {
+93 while ((entry = zis.getNextEntry()) != null ) {
+94 if (entry.isDirectory()) {
+95 final File d = new File(extractTo, entry.getName());
+96 if (!d.exists() && !d.mkdirs()) {
+97 final String msg = String.format("Unable to create '%s'." , d.getAbsolutePath());
+98 throw new ExtractionException(msg);
+99 }
+100 } else {
+101 final File file = new File(extractTo, entry.getName());
+102 final String ext = getFileExtension(file.getName());
+103 if (engine == null || engine.supportsExtension(ext)) {
+104 BufferedOutputStream bos = null ;
+105 FileOutputStream fos;
+106 try {
+107 fos = new FileOutputStream(file);
+108 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
+109 int count;
+110 final byte data[] = new byte[BUFFER_SIZE];
+111 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
+112 bos.write(data, 0, count);
+113 }
+114 bos.flush();
+115 } catch (FileNotFoundException ex) {
+116 LOGGER.log(Level.FINE, null , ex);
+117 final String msg = String.format("Unable to find file '%s'." , file.getName());
+118 throw new ExtractionException(msg, ex);
+119 } catch (IOException ex) {
+120 LOGGER.log(Level.FINE, null , ex);
+121 final String msg = String.format("IO Exception while parsing file '%s'." , file.getName());
+122 throw new ExtractionException(msg, ex);
+123 } finally {
+124 if (bos != null ) {
+125 try {
+126 bos.close();
+127 } catch (IOException ex) {
+128 LOGGER.log(Level.FINEST, null , ex);
+129 }
+130 }
+131 }
+132 }
+133 }
+134 }
+135 } catch (IOException ex) {
+136 final String msg = String.format("Exception reading archive '%s'." , archive.getName());
+137 LOGGER.log(Level.FINE, msg, ex);
+138 throw new ExtractionException(msg, ex);
+139 } finally {
+140 try {
+141 zis.close();
+142 } catch (IOException ex) {
+143 LOGGER.log(Level.FINEST, null , ex);
+144 }
+145 }
+146 }
+147 }
+
+Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.utils
DependencyVersionUtil
- DownloadFailedException
-
-
- Downloader
-
-
- ExtractionException
-
-
- FileUtils
+ ExtractionUtil
Filter
FilterIterator
-
-
- InvalidSettingException
-
-
- KEYS
-
-
- LogFilter
-
-
- LogUtils
NonClosingStream
Pair
-
-
- Settings
-
-
- URLConnectionFactory
-
-
- URLConnectionFailureException
UrlStringUtils
diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html
index a8390c0cb..800c1ea20 100644
--- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html
+++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference Package org.owasp.dependencycheck.utils
+ Dependency-Check Core 1.2.2 Reference Package org.owasp.dependencycheck.utils
- DownloadFailedException
-
-
-
-
- Downloader
-
-
-
-
- ExtractionException
-
-
-
-
- FileUtils
+ ExtractionUtil
@@ -84,26 +69,6 @@
FilterIterator
-
-
-
- InvalidSettingException
-
-
-
-
- KEYS
-
-
-
-
- LogFilter
-
-
-
-
- LogUtils
-
@@ -114,21 +79,6 @@
Pair
-
-
-
- Settings
-
-
-
-
- URLConnectionFactory
-
-
-
-
- URLConnectionFailureException
-
diff --git a/dependency-check-core/xref/overview-frame.html b/dependency-check-core/xref/overview-frame.html
index 992402ff2..183a3e716 100644
--- a/dependency-check-core/xref/overview-frame.html
+++ b/dependency-check-core/xref/overview-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
Dependency-Check Core 1.2.1 Reference
+ Dependency-Check Core 1.2.2 Reference
diff --git a/dependency-check-jenkins/index.html b/dependency-check-jenkins/index.html
index 8c259e647..a5a4340ed 100644
--- a/dependency-check-jenkins/index.html
+++ b/dependency-check-jenkins/index.html
@@ -1,13 +1,13 @@
dependency-check-jenkins -
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-jenkins/license.html b/dependency-check-jenkins/license.html
index 8c7e9e5e6..8e864fb76 100644
--- a/dependency-check-jenkins/license.html
+++ b/dependency-check-jenkins/license.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project License
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-jenkins/project-info.html b/dependency-check-jenkins/project-info.html
index 6657022f7..f2ef32539 100644
--- a/dependency-check-jenkins/project-info.html
+++ b/dependency-check-jenkins/project-info.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Information
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-jenkins/project-summary.html b/dependency-check-jenkins/project-summary.html
index cc0d307ad..713ef519a 100644
--- a/dependency-check-jenkins/project-summary.html
+++ b/dependency-check-jenkins/project-summary.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Summary
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -196,7 +196,7 @@
dependency-check-jenkins
Version
-1.2.1
+1.2.2
Type
pom
diff --git a/dependency-check-maven/apidocs/allclasses-frame.html b/dependency-check-maven/apidocs/allclasses-frame.html
index fe2e5fc6d..1eafec38d 100644
--- a/dependency-check-maven/apidocs/allclasses-frame.html
+++ b/dependency-check-maven/apidocs/allclasses-frame.html
@@ -2,10 +2,10 @@
-
+
All Classes (Dependency-Check Maven Plugin 1.2.1 API)
-All Classes (Dependency-Check Maven Plugin 1.2.2 API)
+All Classes (Dependency-Check Maven Plugin 1.2.1 API)
-All Classes (Dependency-Check Maven Plugin 1.2.2 API)
+Constant Field Values (Dependency-Check Maven Plugin 1.2.1 API)
-Constant Field Values (Dependency-Check Maven Plugin 1.2.2 API)
+Deprecated List (Dependency-Check Maven Plugin 1.2.1 API)
-Deprecated List (Dependency-Check Maven Plugin 1.2.2 API)
+API Help (Dependency-Check Maven Plugin 1.2.1 API)
-API Help (Dependency-Check Maven Plugin 1.2.2 API)
+Index (Dependency-Check Maven Plugin 1.2.1 API)
-Index (Dependency-Check Maven Plugin 1.2.2 API)
+Dependency-Check Maven Plugin 1.2.1 API
+Dependency-Check Maven Plugin 1.2.2 API
diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html
index bdbef346d..8ba42ba29 100644
--- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html
+++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html
@@ -2,16 +2,16 @@
-
+
HelpMojo (Dependency-Check Maven Plugin 1.2.1 API)
-HelpMojo (Dependency-Check Maven Plugin 1.2.2 API)
+Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.2.1 API)
-Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.2.2 API)
+Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.2.1 API)
-Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.2.2 API)
+org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.1 API)
-org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.2 API)
+org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.1 API)
-org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.2 API)
+org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.2.1 API)
-org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.2.2 API)
+Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.1 API)
-Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.2.2 API)
+Class Hierarchy (Dependency-Check Maven Plugin 1.2.1 API)
-Class Hierarchy (Dependency-Check Maven Plugin 1.2.2 API)
+dependency-check-maven -
dependency-check:check
@@ -55,7 +55,7 @@
-
+
/
@@ -69,9 +69,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -165,7 +165,7 @@
Full name :
-org.owasp:dependency-check-maven:1.2.1:check
+org.owasp:dependency-check-maven:1.2.2:check
Description :
@@ -561,28 +561,6 @@ Reports page.Default value is : Dependency-Check .U
-proxyPassword String - Deprecated. Please use mavenSettings insteadUser property is : proxyPassword .
-
-
-
-proxyPort String - Deprecated. Please use mavenSettings insteadUser property is : proxyPort .
-
-
-
proxyUrl String Default value is : Dependency-Check .U
-proxyUsername String - Deprecated. Please use mavenSettings insteadUser property is : proxyUsername .
-
-
-
showSummary boolean Default value is : Dependency-Check .U
Flag indicating whether or not to show a summary in the output.Default value is : true .User property is : showSummary .
-
+
skipProvidedScope Default value is : Dependency-Check .U
Skip Analysis for Provided Scope Dependencies.Default value is : false .User property is : skipProvidedScope .
-
+
skipRuntimeScope Default value is : Dependency-Check .U
Skip Analysis for Runtime Scope Dependencies.Default value is : false .User property is : skipRuntimeScope .
-
+
skipTestScope Default value is : Dependency-Check .U
Skip Analysis for Test Scope Dependencies.Default value is : true .User property is : skipTestScope .
-
+
suppressionFile Default value is : Dependency-Check .U
The path to the suppression file.User property is : suppressionFile .
-
+
zipExtensions User Property : pathToMono proxyPassword :
-
-Deprecated. Please use mavenSettings instead
-
-The Proxy password.
-
-
-
-Type : java.lang.String Required : No User Property : proxyPassword proxyPort :
-
-Deprecated. Please use mavenSettings instead
-
-The Proxy Port.
-
-
-
-Type : java.lang.String Required : No User Property : proxyPort proxyUrl :
Deprecated. Please use mavenSettings instead
@@ -1098,20 +1037,6 @@ Reports page.
User Property : proxyUrl proxyUsername :
-
-Deprecated. Please use mavenSettings instead
-
-The Proxy username.
-
-
-
-Type : java.lang.String Required : No User Property : proxyUsername reportOutputDirectory :
Specifies the destination directory for the generated
diff --git a/dependency-check-maven/checkstyle.html b/dependency-check-maven/checkstyle.html
index cc968ef94..9304041f4 100644
--- a/dependency-check-maven/checkstyle.html
+++ b/dependency-check-maven/checkstyle.html
@@ -1,13 +1,13 @@
-
+
dependency-check-maven - Checkstyle Results
@@ -54,7 +54,7 @@
-
+
/
@@ -67,9 +67,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -246,7 +246,7 @@
15
0
0
-
23
+20
+20
Details
@@ -280,55 +280,63 @@
'}' is not preceded with whitespace.
-155
+
154
'}' is not preceded with whitespace.
-163
+
161
'}' is not preceded with whitespace.
-170
+
168
'}' is not preceded with whitespace.
-179
+
174
'}' is not preceded with whitespace.
-188
+
180
'}' is not preceded with whitespace.
-197
+
187
'}' is not preceded with whitespace.
-204
+
194
'}' is not preceded with whitespace.
-210
+
201
'}' is not preceded with whitespace.
-216
+
208
'}' is not preceded with whitespace.
-223
+
215
'}' is not preceded with whitespace.
-230
+
221
'}' is not preceded with whitespace.
-237
+
227
'}' is not preceded with whitespace.
-244
+
233
+
+'}' is not preceded with whitespace.
+239
+
+'}' is not preceded with whitespace.
+245
'}' is not preceded with whitespace.
@@ -340,27 +348,7 @@
'}' is not preceded with whitespace.
-263
-
-'}' is not preceded with whitespace.
-269
-
-'}' is not preceded with whitespace.
-275
-
-'}' is not preceded with whitespace.
-281
-
-'}' is not preceded with whitespace.
-287
-
-'}' is not preceded with whitespace.
-293
+320 ©2013 - 2014 OWASP
-
File: 15,
- Errors: 23,
+ Errors: 20,
Warnings: 0,
Infos: 0
@@ -83,7 +83,7 @@ under the License.
0
- 23
+ 20
diff --git a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html
index 32327b0c0..2cae55abf 100644
--- a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html
+++ b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html
@@ -16,7 +16,7 @@
-
+
diff --git a/dependency-check-maven/cobertura/frame-summary.html b/dependency-check-maven/cobertura/frame-summary.html
index cab145ccd..a173fc943 100644
--- a/dependency-check-maven/cobertura/frame-summary.html
+++ b/dependency-check-maven/cobertura/frame-summary.html
@@ -16,8 +16,8 @@
-
+
diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html
index a38c9b9e5..09ac615d0 100644
--- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html
+++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html
@@ -12,7 +12,7 @@
@@ -309,1579 +309,1520 @@
149
private boolean externalReport = false ;
150
-
+ 151
-
+ 152
-
- 153
-
- 154
-
- 155 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 156
- @Parameter(property = "proxyUrl" , defaultValue = "" , required = false )
- 157
- @Deprecated
- 158
- private String proxyUrl = null ;
- 159
-
- 160
-
- 161
- 162
+ 153
- 163
+ 154
@SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 164
+ 155
@Parameter(property = "mavenSettings" , defaultValue = "${settings}" , required = false )
- 165
+ 156
private org.apache.maven.settings.Settings mavenSettings;
- 166
+ 157
- 167
+ 158
- 168
+ 159
- 169
+ 160
- 170
+ 161
@SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 171
+ 162
@Parameter(property = "mavenSettingsProxyId" , required = false )
- 172
+ 163
private String mavenSettingsProxyId;
- 173
+ 164
- 174
+ 165
- 175
-
- 176
-
- 177
-
- 178
-
- 179 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 180
- @Parameter(property = "proxyPort" , defaultValue = "" , required = false )
- 181
- @Deprecated
- 182
- private String proxyPort = null ;
- 183
-
- 184
-
- 185
-
- 186
-
- 187
-
- 188 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 189
- @Parameter(property = "proxyUsername" , defaultValue = "" , required = false )
- 190
- @Deprecated
- 191
- private String proxyUsername = null ;
- 192
-
- 193
-
- 194
-
- 195
-
- 196
-
- 197 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 198
- @Parameter(property = "proxyPassword" , defaultValue = "" , required = false )
- 199
- @Deprecated
- 200
- private String proxyPassword = null ;
- 201
-
- 202
+ 166
- 203
+ 167
- 204 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 205
+ 168 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 169
@Parameter(property = "connectionTimeout" , defaultValue = "" , required = false )
- 206
+ 170
private String connectionTimeout = null ;
- 207
+ 171
- 208
+ 172
- 209
+ 173
- 210 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 211
+ 174 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 175
@Parameter(property = "suppressionFile" , defaultValue = "" , required = false )
- 212
+ 176
private String suppressionFile = null ;
- 213
+ 177
- 214
+ 178
- 215
+ 179
- 216 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 217
+ 180 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 181
@Parameter(property = "showSummary" , defaultValue = "true" , required = false )
- 218
+ 182
private boolean showSummary = true ;
- 219
+ 183
- 220
+ 184
- 221
+ 185
- 222
+ 186
- 223 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 224
+ 187 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 188
@Parameter(property = "jarAnalyzerEnabled" , defaultValue = "true" , required = false )
- 225
+ 189
private boolean jarAnalyzerEnabled = true ;
- 226
+ 190
- 227
+ 191
- 228
+ 192
- 229
+ 193
- 230 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 231
+ 194 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 195
@Parameter(property = "archiveAnalyzerEnabled" , defaultValue = "true" , required = false )
- 232
+ 196
private boolean archiveAnalyzerEnabled = true ;
- 233
+ 197
- 234
+ 198
- 235
+ 199
- 236
+ 200
- 237 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 238
+ 201 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 202
@Parameter(property = "assemblyAnalyzerEnabled" , defaultValue = "true" , required = false )
- 239
+ 203
private boolean assemblyAnalyzerEnabled = true ;
- 240
+ 204
- 241
+ 205
- 242
+ 206
- 243
+ 207
- 244 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 245
+ 208 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 209
@Parameter(property = "nuspecAnalyzerEnabled" , defaultValue = "true" , required = false )
- 246
+ 210
private boolean nuspecAnalyzerEnabled = true ;
- 247
+ 211
+ 212
+
+ 213
+
+ 214
+
+ 215 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 216
+ @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false )
+ 217
+ private boolean nexusAnalyzerEnabled = true ;
+ 218
+
+ 219
+
+ 220
+
+ 221
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 222
+ @Parameter(property = "nexusUrl" , defaultValue = "" , required = false )
+ 223
+ private String nexusUrl;
+ 224
+
+ 225
+
+ 226
+
+ 227 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 228
+ @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false )
+ 229
+ private boolean nexusUsesProxy = true ;
+ 230
+
+ 231
+
+ 232
+
+ 233
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 234
+ @Parameter(property = "connectionString" , defaultValue = "" , required = false )
+ 235
+ private String connectionString;
+ 236
+
+ 237
+
+ 238
+
+ 239
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 240
+ @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false )
+ 241
+ private String databaseDriverName;
+ 242
+
+ 243
+
+ 244
+
+ 245
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 246
+ @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false )
+ 247
+ private String databaseDriverPath;
248
249
-
+ 250
- 251 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 251
+ @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
252
- @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false )
+ @Parameter(property = "databaseUser" , defaultValue = "" , required = false ) 253
- private boolean nexusAnalyzerEnabled = true ;
+ private String databaseUser; 254
255
-
+ 256
257
@SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
258
- @Parameter(property = "nexusUrl" , defaultValue = "" , required = false )
+ @Parameter(property = "databasePassword" , defaultValue = "" , required = false ) 259
- private String nexusUrl;
+ private String databasePassword; 260
261
-
+ 262
- 263 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 264
- @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false )
- 265
- private boolean nexusUsesProxy = true ;
- 266
-
- 267
-
- 268
-
- 269
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 270
- @Parameter(property = "connectionString" , defaultValue = "" , required = false )
- 271
- private String connectionString;
- 272
-
- 273
-
- 274
-
- 275
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 276
- @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false )
- 277
- private String databaseDriverName;
- 278
-
- 279
-
- 280
-
- 281
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 282
- @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false )
- 283
- private String databaseDriverPath;
- 284
-
- 285
-
- 286
-
- 287
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 288
- @Parameter(property = "databaseUser" , defaultValue = "" , required = false )
- 289
- private String databaseUser;
- 290
-
- 291
-
- 292
-
- 293
- @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
- 294
- @Parameter(property = "databasePassword" , defaultValue = "" , required = false )
- 295
- private String databasePassword;
- 296
-
- 297
-
- 298
-
- 299
+ 263
@Parameter(property = "zipExtensions" , required = false )
- 300
+ 264
private String zipExtensions;
- 301
+ 265
- 302
+ 266
- 303
+ 267
- 304 0 @SuppressWarnings("CanBeFinal" )
- 305
+ 268 0 @SuppressWarnings("CanBeFinal" )
+ 269
@Parameter(property = "skipTestScope" , defaultValue = "true" , required = false )
- 306
+ 270
private boolean skipTestScope = true ;
- 307
+ 271
- 308
+ 272
- 309
+ 273
- 310 0 @SuppressWarnings("CanBeFinal" )
- 311
+ 274 0 @SuppressWarnings("CanBeFinal" )
+ 275
@Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false )
- 312
+ 276
private boolean skipRuntimeScope = false ;
- 313
+ 277
- 314
+ 278
- 315
+ 279
- 316 0 @SuppressWarnings("CanBeFinal" )
- 317
+ 280 0 @SuppressWarnings("CanBeFinal" )
+ 281
@Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false )
- 318
+ 282
private boolean skipProvidedScope = false ;
- 319
+ 283
- 320
+ 284
- 321
+ 285
- 322
+ 286
@Parameter(property = "dataDirectory" , defaultValue = "" , required = false )
- 323
+ 287
private String dataDirectory;
- 324
+ 288
- 325
+ 289
- 326
+ 290
- 327
+ 291
@Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false )
- 328
+ 292
private String cveUrl12Modified;
- 329
+ 293
- 330
+ 294
+ 295
+
+ 296
+ @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false )
+ 297
+ private String cveUrl20Modified;
+ 298
+
+ 299
+
+ 300
+
+ 301
+ @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false )
+ 302
+ private String cveUrl12Base;
+ 303
+
+ 304
+
+ 305
+
+ 306
+ @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false )
+ 307
+ private String cveUrl20Base;
+ 308
+
+ 309
+
+ 310
+
+ 311
+
+ 312
+ @Parameter(property = "pathToMono" , defaultValue = "" , required = false )
+ 313
+ private String pathToMono;
+ 314
+
+ 315
+
+ 316
+
+ 317
+
+ 318
+
+ 319
+
+ 320 0 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+ 321
+ @Parameter(property = "proxyUrl" , defaultValue = "" , required = false )
+ 322
+ @Deprecated
+ 323
+ private String proxyUrl = null ;
+ 324
+
+ 325
+
+ 326
+
+ 327
+
+ 328
+
+ 329
+
+ 330
+
331
332
- @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false )
- 333
- private String cveUrl20Modified;
- 334
-
- 335
-
- 336
-
- 337
- @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false )
- 338
- private String cveUrl12Base;
- 339
-
- 340
-
- 341
-
- 342
- @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false )
- 343
- private String cveUrl20Base;
- 344
-
- 345
-
- 346
-
- 347
-
- 348
- @Parameter(property = "pathToMono" , defaultValue = "" , required = false )
- 349
- private String pathToMono;
- 350
-
- 351
-
- 352
-
- 353
-
- 354
-
- 355
-
- 356
-
- 357
-
- 358
private Engine executeDependencyCheck() throws DatabaseException {
+ 333
+
+ 334 0 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+ 335 0 LogUtils.prepareLogger(in, logFile);
+ 336
+
+ 337 0 populateSettings();
+ 338 0 final Engine engine = new Engine();
+ 339
+
+ 340 0 final Set<Artifact> artifacts = project.getArtifacts();
+ 341 0 for (Artifact a : artifacts) {
+ 342 0 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
+ 343 0 continue ;
+ 344
+ }
+ 345
+
+ 346 0 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
+ 347 0 continue ;
+ 348
+ }
+ 349
+
+ 350 0 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
+ 351 0 continue ;
+ 352
+ }
+ 353
+
+ 354 0 engine.scan(a.getFile().getAbsolutePath());
+ 355 0 }
+ 356 0 engine.analyzeDependencies();
+ 357
+
+ 358 0 return engine;
359
+ }
+ 360
- 360 0 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
- 361 0 LogUtils.prepareLogger(in, logFile);
+ 361
+
362
-
- 363 0 populateSettings();
- 364 0 final Engine engine = new Engine();
- 365
-
- 366 0 final Set<Artifact> artifacts = project.getArtifacts();
- 367 0 for (Artifact a : artifacts) {
- 368 0 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
- 369 0 continue ;
- 370
- }
- 371
-
- 372 0 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
- 373 0 continue ;
- 374
- }
- 375
-
- 376 0 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
- 377 0 continue ;
- 378
- }
- 379
-
- 380 0 engine.scan(a.getFile().getAbsolutePath());
- 381 0 }
- 382 0 engine.analyzeDependencies();
- 383
-
- 384 0 return engine;
- 385
- }
- 386
-
- 387
-
- 388
- 389
+ 363
- 390
+ 364
- 391
+ 365
- 392
+ 366
- 393
+ 367
private void generateExternalReports(Engine engine, File outDirectory) {
- 394 0 DatabaseProperties prop = null ;
- 395 0 CveDB cve = null ;
+ 368 0 DatabaseProperties prop = null ;
+ 369 0 CveDB cve = null ;
+ 370
+ try {
+ 371 0 cve = new CveDB();
+ 372 0 cve.open();
+ 373 0 prop = cve.getDatabaseProperties();
+ 374 0 } catch (DatabaseException ex) {
+ 375 0 logger.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+ 376
+ } finally {
+ 377 0 if (cve != null ) {
+ 378 0 cve.close();
+ 379
+ }
+ 380
+ }
+ 381 0 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
+ 382
+ try {
+ 383 0 r.generateReports(outDirectory.getCanonicalPath(), format);
+ 384 0 } catch (IOException ex) {
+ 385 0 logger.log(Level.SEVERE,
+ 386
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 387 0 logger.log(Level.FINE, null , ex);
+ 388 0 } catch (Throwable ex) {
+ 389 0 logger.log(Level.SEVERE,
+ 390
+ "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+ 391 0 logger.log(Level.FINE, null , ex);
+ 392 0 }
+ 393 0 }
+ 394
+
+ 395
+
396
- try {
- 397 0 cve = new CveDB();
- 398 0 cve.open();
- 399 0 prop = cve.getDatabaseProperties();
- 400 0 } catch (DatabaseException ex) {
- 401 0 logger.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
- 402
- } finally {
- 403 0 if (cve != null ) {
- 404 0 cve.close();
- 405
- }
- 406
- }
- 407 0 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
- 408
- try {
- 409 0 r.generateReports(outDirectory.getCanonicalPath(), format);
- 410 0 } catch (IOException ex) {
- 411 0 logger.log(Level.SEVERE,
- 412
- "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 413 0 logger.log(Level.FINE, null , ex);
- 414 0 } catch (Throwable ex) {
- 415 0 logger.log(Level.SEVERE,
- 416
- "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
- 417 0 logger.log(Level.FINE, null , ex);
- 418 0 }
- 419 0 }
- 420
-
- 421
-
- 422
- 423
+ 397
- 424
+ 398
- 425
+ 399
- 426
+ 400
- 427
+ 401
private void generateMavenSiteReport(final Engine engine, Sink sink) {
- 428 0 final List<Dependency> dependencies = engine.getDependencies();
- 429
+ 402 0 final List<Dependency> dependencies = engine.getDependencies();
+ 403
- 430 0 writeSiteReportHeader(sink, project.getName());
- 431 0 writeSiteReportTOC(sink, dependencies);
- 432
+ 404 0 writeSiteReportHeader(sink, project.getName());
+ 405 0 writeSiteReportTOC(sink, dependencies);
+ 406
- 433 0 int cnt = 0;
- 434 0 for (Dependency d : dependencies) {
- 435 0 writeSiteReportDependencyHeader(sink, d);
- 436 0 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
- 437 0 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
- 438 0 writeSiteReportDependencyIdentifiers(d, sink);
- 439 0 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
- 440 0 }
- 441 0 sink.body_();
- 442 0 }
- 443
+ 407 0 int cnt = 0;
+ 408 0 for (Dependency d : dependencies) {
+ 409 0 writeSiteReportDependencyHeader(sink, d);
+ 410 0 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
+ 411 0 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
+ 412 0 writeSiteReportDependencyIdentifiers(d, sink);
+ 413 0 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
+ 414 0 }
+ 415 0 sink.body_();
+ 416 0 }
+ 417
- 444
+ 418
- 445
+ 419
- 446
+ 420
- 447
+ 421
- 448
+ 422
- 449
+ 423
- 450
+ 424
- 451
+ 425
- 452
+ 426
private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
- 453 0 int cnt = collapsibleHeaderCount;
- 454 0 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
- 455 0 for (Vulnerability v : d.getVulnerabilities()) {
- 456
+ 427 0 int cnt = collapsibleHeaderCount;
+ 428 0 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
+ 429 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 430
- 457 0 sink.paragraph();
- 458 0 sink.bold();
- 459
+ 431 0 sink.paragraph();
+ 432 0 sink.bold();
+ 433
try {
- 460 0 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
- 461 0 sink.text(v.getName());
- 462 0 sink.link_();
- 463 0 sink.bold_();
- 464 0 } catch (UnsupportedEncodingException ex) {
- 465 0 sink.text(v.getName());
- 466 0 sink.bold_();
- 467 0 sink.lineBreak();
- 468 0 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
- 469 0 }
- 470 0 sink.paragraph_();
- 471 0 sink.paragraph();
- 472 0 sink.text("Severity: " );
- 473 0 if (v.getCvssScore() < 4.0) {
- 474 0 sink.text("Low" );
- 475
+ 434 0 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
+ 435 0 sink.text(v.getName());
+ 436 0 sink.link_();
+ 437 0 sink.bold_();
+ 438 0 } catch (UnsupportedEncodingException ex) {
+ 439 0 sink.text(v.getName());
+ 440 0 sink.bold_();
+ 441 0 sink.lineBreak();
+ 442 0 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
+ 443 0 }
+ 444 0 sink.paragraph_();
+ 445 0 sink.paragraph();
+ 446 0 sink.text("Severity: " );
+ 447 0 if (v.getCvssScore() < 4.0) {
+ 448 0 sink.text("Low" );
+ 449
} else {
- 476 0 if (v.getCvssScore() >= 7.0) {
- 477 0 sink.text("High" );
- 478
+ 450 0 if (v.getCvssScore() >= 7.0) {
+ 451 0 sink.text("High" );
+ 452
} else {
- 479 0 sink.text("Medium" );
- 480
+ 453 0 sink.text("Medium" );
+ 454
}
- 481
+ 455
}
- 482 0 sink.lineBreak();
- 483 0 sink.text("CVSS Score: " + v.getCvssScore());
- 484 0 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
- 485 0 sink.lineBreak();
- 486 0 sink.text("CWE: " );
- 487 0 sink.text(v.getCwe());
- 488
+ 456 0 sink.lineBreak();
+ 457 0 sink.text("CVSS Score: " + v.getCvssScore());
+ 458 0 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
+ 459 0 sink.lineBreak();
+ 460 0 sink.text("CWE: " );
+ 461 0 sink.text(v.getCwe());
+ 462
}
- 489 0 sink.paragraph_();
- 490 0 sink.paragraph();
- 491 0 sink.text(v.getDescription());
- 492 0 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
- 493 0 sink.list();
- 494 0 for (Reference ref : v.getReferences()) {
- 495 0 sink.listItem();
- 496 0 sink.text(ref.getSource());
- 497 0 sink.text(" - " );
- 498 0 sink.link(ref.getUrl());
- 499 0 sink.text(ref.getName());
- 500 0 sink.link_();
- 501 0 sink.listItem_();
- 502 0 }
- 503 0 sink.list_();
- 504
+ 463 0 sink.paragraph_();
+ 464 0 sink.paragraph();
+ 465 0 sink.text(v.getDescription());
+ 466 0 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
+ 467 0 sink.list();
+ 468 0 for (Reference ref : v.getReferences()) {
+ 469 0 sink.listItem();
+ 470 0 sink.text(ref.getSource());
+ 471 0 sink.text(" - " );
+ 472 0 sink.link(ref.getUrl());
+ 473 0 sink.text(ref.getName());
+ 474 0 sink.link_();
+ 475 0 sink.listItem_();
+ 476 0 }
+ 477 0 sink.list_();
+ 478
}
- 505 0 sink.paragraph_();
- 506 0 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
- 507 0 sink.paragraph();
- 508
+ 479 0 sink.paragraph_();
+ 480 0 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
+ 481 0 sink.paragraph();
+ 482
- 509 0 cnt += 1;
- 510 0 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
- 511 0 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
- 512 0 sink.list();
- 513 0 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
- 514 0 sink.listItem();
- 515
+ 483 0 cnt += 1;
+ 484 0 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
+ 485 0 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
+ 486 0 sink.list();
+ 487 0 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
+ 488 0 sink.listItem();
+ 489
try {
- 516 0 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
- 517 0 sink.text(vs.getName());
- 518 0 sink.link_();
- 519 0 if (vs.hasPreviousVersion()) {
- 520 0 sink.text(" and all previous versions." );
- 521
+ 490 0 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
+ 491 0 sink.text(vs.getName());
+ 492 0 sink.link_();
+ 493 0 if (vs.hasPreviousVersion()) {
+ 494 0 sink.text(" and all previous versions." );
+ 495
}
- 522 0 } catch (UnsupportedEncodingException ex) {
- 523 0 sink.text(vs.getName());
- 524 0 if (vs.hasPreviousVersion()) {
- 525 0 sink.text(" and all previous versions." );
- 526
+ 496 0 } catch (UnsupportedEncodingException ex) {
+ 497 0 sink.text(vs.getName());
+ 498 0 if (vs.hasPreviousVersion()) {
+ 499 0 sink.text(" and all previous versions." );
+ 500
}
- 527 0 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
- 528 0 }
- 529
+ 501 0 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
+ 502 0 }
+ 503
- 530 0 sink.listItem_();
- 531 0 }
- 532 0 sink.list_();
- 533 0 sink.rawText("</div>" );
- 534 0 sink.paragraph_();
- 535
+ 504 0 sink.listItem_();
+ 505 0 }
+ 506 0 sink.list_();
+ 507 0 sink.rawText("</div>" );
+ 508 0 sink.paragraph_();
+ 509
}
- 536 0 }
- 537
+ 510 0 }
+ 511
}
- 538 0 }
- 539
+ 512 0 }
+ 513
- 540
+ 514
- 541
+ 515
- 542
+ 516
- 543
+ 517
- 544
+ 518
- 545
+ 519
- 546
+ 520
private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
- 547 0 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
- 548 0 sink.sectionTitle4();
- 549 0 sink.text("Identifiers" );
- 550 0 sink.sectionTitle4_();
- 551 0 sink.list();
- 552 0 for (Identifier i : d.getIdentifiers()) {
- 553 0 sink.listItem();
- 554 0 sink.text(i.getType());
- 555 0 sink.text(": " );
- 556 0 if (i.getUrl() != null && i.getUrl().length() > 0) {
- 557 0 sink.link(i.getUrl());
- 558 0 sink.text(i.getValue());
- 559 0 sink.link_();
- 560
+ 521 0 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
+ 522 0 sink.sectionTitle4();
+ 523 0 sink.text("Identifiers" );
+ 524 0 sink.sectionTitle4_();
+ 525 0 sink.list();
+ 526 0 for (Identifier i : d.getIdentifiers()) {
+ 527 0 sink.listItem();
+ 528 0 sink.text(i.getType());
+ 529 0 sink.text(": " );
+ 530 0 if (i.getUrl() != null && i.getUrl().length() > 0) {
+ 531 0 sink.link(i.getUrl());
+ 532 0 sink.text(i.getValue());
+ 533 0 sink.link_();
+ 534
} else {
- 561 0 sink.text(i.getValue());
- 562
+ 535 0 sink.text(i.getValue());
+ 536
}
- 563 0 if (i.getDescription() != null && i.getDescription().length() > 0) {
- 564 0 sink.lineBreak();
- 565 0 sink.text(i.getDescription());
- 566
+ 537 0 if (i.getDescription() != null && i.getDescription().length() > 0) {
+ 538 0 sink.lineBreak();
+ 539 0 sink.text(i.getDescription());
+ 540
}
- 567 0 sink.listItem_();
- 568 0 }
- 569 0 sink.list_();
- 570
+ 541 0 sink.listItem_();
+ 542 0 }
+ 543 0 sink.list_();
+ 544
}
- 571 0 }
- 572
+ 545 0 }
+ 546
- 573
+ 547
- 574
+ 548
- 575
+ 549
- 576
+ 550
- 577
+ 551
- 578
+ 552
- 579
+ 553
- 580
+ 554
- 581
+ 555
private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
- 582 0 int cnt = collapsibleHeaderCount;
- 583 0 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
- 584 0 cnt += 1;
- 585 0 sink.sectionTitle4();
- 586 0 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
- 587 0 sink.sectionTitle4_();
- 588 0 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
- 589 0 sink.list();
- 590 0 for (Dependency r : d.getRelatedDependencies()) {
- 591 0 sink.listItem();
- 592 0 sink.text(r.getFileName());
- 593 0 sink.list();
- 594 0 writeListItem(sink, "File Path: " + r.getFilePath());
- 595 0 writeListItem(sink, "SHA1: " + r.getSha1sum());
- 596 0 writeListItem(sink, "MD5: " + r.getMd5sum());
- 597 0 sink.list_();
- 598 0 sink.listItem_();
- 599 0 }
- 600 0 sink.list_();
- 601 0 sink.rawText("</div>" );
- 602
+ 556 0 int cnt = collapsibleHeaderCount;
+ 557 0 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
+ 558 0 cnt += 1;
+ 559 0 sink.sectionTitle4();
+ 560 0 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
+ 561 0 sink.sectionTitle4_();
+ 562 0 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
+ 563 0 sink.list();
+ 564 0 for (Dependency r : d.getRelatedDependencies()) {
+ 565 0 sink.listItem();
+ 566 0 sink.text(r.getFileName());
+ 567 0 sink.list();
+ 568 0 writeListItem(sink, "File Path: " + r.getFilePath());
+ 569 0 writeListItem(sink, "SHA1: " + r.getSha1sum());
+ 570 0 writeListItem(sink, "MD5: " + r.getMd5sum());
+ 571 0 sink.list_();
+ 572 0 sink.listItem_();
+ 573 0 }
+ 574 0 sink.list_();
+ 575 0 sink.rawText("</div>" );
+ 576
}
- 603 0 return cnt;
- 604
+ 577 0 return cnt;
+ 578
}
- 605
+ 579
- 606
+ 580
- 607
+ 581
- 608
+ 582
- 609
+ 583
- 610
+ 584
- 611
+ 585
- 612
+ 586
- 613
+ 587
- 614
+ 588
private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
- 615 0 int cnt = collapsibleHeaderCount;
- 616 0 final Set<Evidence> evidence = d.getEvidenceForDisplay();
- 617 0 if (evidence != null && evidence.size() > 0) {
- 618 0 cnt += 1;
- 619 0 sink.sectionTitle4();
- 620 0 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
- 621 0 sink.sectionTitle4_();
- 622 0 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
- 623 0 sink.table();
- 624 0 sink.tableRow();
- 625 0 writeTableHeaderCell(sink, "Source" );
- 626 0 writeTableHeaderCell(sink, "Name" );
- 627 0 writeTableHeaderCell(sink, "Value" );
- 628 0 sink.tableRow_();
- 629 0 for (Evidence e : evidence) {
- 630 0 sink.tableRow();
- 631 0 writeTableCell(sink, e.getSource());
- 632 0 writeTableCell(sink, e.getName());
- 633 0 writeTableCell(sink, e.getValue());
- 634 0 sink.tableRow_();
- 635 0 }
- 636 0 sink.table_();
- 637 0 sink.rawText("</div>" );
- 638
+ 589 0 int cnt = collapsibleHeaderCount;
+ 590 0 final Set<Evidence> evidence = d.getEvidenceForDisplay();
+ 591 0 if (evidence != null && evidence.size() > 0) {
+ 592 0 cnt += 1;
+ 593 0 sink.sectionTitle4();
+ 594 0 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
+ 595 0 sink.sectionTitle4_();
+ 596 0 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
+ 597 0 sink.table();
+ 598 0 sink.tableRow();
+ 599 0 writeTableHeaderCell(sink, "Source" );
+ 600 0 writeTableHeaderCell(sink, "Name" );
+ 601 0 writeTableHeaderCell(sink, "Value" );
+ 602 0 sink.tableRow_();
+ 603 0 for (Evidence e : evidence) {
+ 604 0 sink.tableRow();
+ 605 0 writeTableCell(sink, e.getSource());
+ 606 0 writeTableCell(sink, e.getName());
+ 607 0 writeTableCell(sink, e.getValue());
+ 608 0 sink.tableRow_();
+ 609 0 }
+ 610 0 sink.table_();
+ 611 0 sink.rawText("</div>" );
+ 612
}
- 639 0 return cnt;
- 640
+ 613 0 return cnt;
+ 614
}
- 641
+ 615
- 642
+ 616
- 643
+ 617
- 644
+ 618
- 645
+ 619
- 646
+ 620
- 647
+ 621
- 648
+ 622
private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
- 649 0 sink.sectionTitle2();
- 650 0 sink.anchor("sha1" + d.getSha1sum());
- 651 0 sink.text(d.getFileName());
- 652 0 sink.anchor_();
- 653 0 sink.sectionTitle2_();
- 654 0 if (d.getDescription() != null && d.getDescription().length() > 0) {
- 655 0 sink.paragraph();
- 656 0 sink.bold();
- 657 0 sink.text("Description: " );
- 658 0 sink.bold_();
- 659 0 sink.text(d.getDescription());
- 660 0 sink.paragraph_();
- 661
+ 623 0 sink.sectionTitle2();
+ 624 0 sink.anchor("sha1" + d.getSha1sum());
+ 625 0 sink.text(d.getFileName());
+ 626 0 sink.anchor_();
+ 627 0 sink.sectionTitle2_();
+ 628 0 if (d.getDescription() != null && d.getDescription().length() > 0) {
+ 629 0 sink.paragraph();
+ 630 0 sink.bold();
+ 631 0 sink.text("Description: " );
+ 632 0 sink.bold_();
+ 633 0 sink.text(d.getDescription());
+ 634 0 sink.paragraph_();
+ 635
}
- 662 0 if (d.getLicense() != null && d.getLicense().length() > 0) {
- 663 0 sink.paragraph();
- 664 0 sink.bold();
- 665 0 sink.text("License: " );
- 666 0 sink.bold_();
- 667 0 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
- 668 0 sink.link(d.getLicense());
- 669 0 sink.text(d.getLicense());
- 670 0 sink.link_();
- 671
+ 636 0 if (d.getLicense() != null && d.getLicense().length() > 0) {
+ 637 0 sink.paragraph();
+ 638 0 sink.bold();
+ 639 0 sink.text("License: " );
+ 640 0 sink.bold_();
+ 641 0 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
+ 642 0 sink.link(d.getLicense());
+ 643 0 sink.text(d.getLicense());
+ 644 0 sink.link_();
+ 645
} else {
- 672 0 sink.text(d.getLicense());
- 673
+ 646 0 sink.text(d.getLicense());
+ 647
}
- 674 0 sink.paragraph_();
- 675
+ 648 0 sink.paragraph_();
+ 649
}
- 676 0 }
- 677
+ 650 0 }
+ 651
- 678
+ 652
- 679
+ 653
- 680
+ 654
- 681
+ 655
- 682
+ 656
- 683
+ 657
- 684
+ 658
private void writeListItem(Sink sink, String text) {
- 685 0 sink.listItem();
- 686 0 sink.text(text);
- 687 0 sink.listItem_();
- 688 0 }
- 689
+ 659 0 sink.listItem();
+ 660 0 sink.text(text);
+ 661 0 sink.listItem_();
+ 662 0 }
+ 663
- 690
+ 664
- 691
+ 665
- 692
+ 666
- 693
+ 667
- 694
+ 668
- 695
+ 669
- 696
+ 670
private void writeTableCell(Sink sink, String text) {
- 697 0 sink.tableCell();
- 698 0 sink.text(text);
- 699 0 sink.tableCell_();
- 700 0 }
- 701
+ 671 0 sink.tableCell();
+ 672 0 sink.text(text);
+ 673 0 sink.tableCell_();
+ 674 0 }
+ 675
- 702
+ 676
- 703
+ 677
- 704
+ 678
- 705
+ 679
- 706
+ 680
- 707
+ 681
- 708
+ 682
private void writeTableHeaderCell(Sink sink, String text) {
- 709 0 sink.tableHeaderCell();
- 710 0 sink.text(text);
- 711 0 sink.tableHeaderCell_();
- 712 0 }
- 713
+ 683 0 sink.tableHeaderCell();
+ 684 0 sink.text(text);
+ 685 0 sink.tableHeaderCell_();
+ 686 0 }
+ 687
- 714
+ 688
- 715
+ 689
- 716
+ 690
- 717
+ 691
- 718
+ 692
- 719
+ 693
- 720
+ 694
private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
- 721 0 sink.list();
- 722 0 for (Dependency d : dependencies) {
- 723 0 sink.listItem();
- 724 0 sink.link("#sha1" + d.getSha1sum());
- 725 0 sink.text(d.getFileName());
- 726 0 sink.link_();
- 727 0 if (!d.getVulnerabilities().isEmpty()) {
- 728 0 sink.rawText(" <font style=\"color:red\">•</font>" );
- 729
+ 695 0 sink.list();
+ 696 0 for (Dependency d : dependencies) {
+ 697 0 sink.listItem();
+ 698 0 sink.link("#sha1" + d.getSha1sum());
+ 699 0 sink.text(d.getFileName());
+ 700 0 sink.link_();
+ 701 0 if (!d.getVulnerabilities().isEmpty()) {
+ 702 0 sink.rawText(" <font style=\"color:red\">•</font>" );
+ 703
}
- 730 0 if (!d.getRelatedDependencies().isEmpty()) {
- 731 0 sink.list();
- 732 0 for (Dependency r : d.getRelatedDependencies()) {
- 733 0 writeListItem(sink, r.getFileName());
- 734 0 }
- 735 0 sink.list_();
- 736
+ 704 0 if (!d.getRelatedDependencies().isEmpty()) {
+ 705 0 sink.list();
+ 706 0 for (Dependency r : d.getRelatedDependencies()) {
+ 707 0 writeListItem(sink, r.getFileName());
+ 708 0 }
+ 709 0 sink.list_();
+ 710
}
- 737 0 sink.listItem_();
- 738 0 }
- 739 0 sink.list_();
- 740 0 }
- 741
+ 711 0 sink.listItem_();
+ 712 0 }
+ 713 0 sink.list_();
+ 714 0 }
+ 715
- 742
+ 716
- 743
+ 717
- 744
+ 718
- 745
+ 719
- 746
+ 720
- 747
+ 721
- 748
+ 722
private void writeSiteReportHeader(Sink sink, String projectName) {
- 749 0 sink.head();
- 750 0 sink.title();
- 751 0 sink.text("Dependency-Check Report: " + projectName);
- 752 0 sink.title_();
- 753 0 sink.head_();
- 754 0 sink.body();
- 755 0 sink.rawText("<script type=\"text/javascript\">" );
- 756 0 sink.rawText("function toggleElement(el, targetId) {" );
- 757 0 sink.rawText("if (el.innerText == '[+]') {" );
- 758 0 sink.rawText(" el.innerText = '[-]';" );
- 759 0 sink.rawText(" document.getElementById(targetId).style.display='block';" );
- 760 0 sink.rawText("} else {" );
- 761 0 sink.rawText(" el.innerText = '[+]';" );
- 762 0 sink.rawText(" document.getElementById(targetId).style.display='none';" );
- 763 0 sink.rawText("}" );
- 764
+ 723 0 sink.head();
+ 724 0 sink.title();
+ 725 0 sink.text("Dependency-Check Report: " + projectName);
+ 726 0 sink.title_();
+ 727 0 sink.head_();
+ 728 0 sink.body();
+ 729 0 sink.rawText("<script type=\"text/javascript\">" );
+ 730 0 sink.rawText("function toggleElement(el, targetId) {" );
+ 731 0 sink.rawText("if (el.innerText == '[+]') {" );
+ 732 0 sink.rawText(" el.innerText = '[-]';" );
+ 733 0 sink.rawText(" document.getElementById(targetId).style.display='block';" );
+ 734 0 sink.rawText("} else {" );
+ 735 0 sink.rawText(" el.innerText = '[+]';" );
+ 736 0 sink.rawText(" document.getElementById(targetId).style.display='none';" );
+ 737 0 sink.rawText("}" );
+ 738
- 765 0 sink.rawText("}" );
- 766 0 sink.rawText("</script>" );
- 767 0 sink.section1();
- 768 0 sink.sectionTitle1();
- 769 0 sink.text("Project: " + projectName);
- 770 0 sink.sectionTitle1_();
- 771 0 sink.date();
- 772 0 final Date now = new Date();
- 773 0 sink.text(DateFormat.getDateTimeInstance().format(now));
- 774 0 sink.date_();
- 775 0 sink.section1_();
- 776 0 }
- 777
+ 739 0 sink.rawText("}" );
+ 740 0 sink.rawText("</script>" );
+ 741 0 sink.section1();
+ 742 0 sink.sectionTitle1();
+ 743 0 sink.text("Project: " + projectName);
+ 744 0 sink.sectionTitle1_();
+ 745 0 sink.date();
+ 746 0 final Date now = new Date();
+ 747 0 sink.text(DateFormat.getDateTimeInstance().format(now));
+ 748 0 sink.date_();
+ 749 0 sink.section1_();
+ 750 0 }
+ 751
- 778
+ 752
- 779
+ 753
- 780
-
- 781
+ 754
+
+ 755
- 782
+ 756
- 783
+ 757
- 784
+ 758
- 785
- private String getMavenSettingsProxyUrl(Proxy proxy) {
- 786 0 return new StringBuilder(proxy.getProtocol()).append("://" ).append(proxy.getHost()).toString();
- 787
+ 759
+ private String getMavenSettingsProxyServer(Proxy proxy) {
+ 760 0 return new StringBuilder(proxy.getProtocol()).append("://" ).append(proxy.getHost()).toString();
+ 761
}
- 788
+ 762
- 789
+ 763
- 790
+ 764
- 791
+ 765
- 792
+ 766
- 793
+ 767
- 794
+ 768
private Proxy getMavenProxy() {
- 795 0 if (mavenSettings != null ) {
- 796 0 final List<Proxy> proxies = mavenSettings.getProxies();
- 797 0 if (proxies != null && proxies.size() > 0) {
- 798 0 if (mavenSettingsProxyId != null ) {
- 799 0 for (Proxy proxy : proxies) {
- 800 0 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
- 801 0 return proxy;
- 802
+ 769 0 if (mavenSettings != null ) {
+ 770 0 final List<Proxy> proxies = mavenSettings.getProxies();
+ 771 0 if (proxies != null && proxies.size() > 0) {
+ 772 0 if (mavenSettingsProxyId != null ) {
+ 773 0 for (Proxy proxy : proxies) {
+ 774 0 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
+ 775 0 return proxy;
+ 776
}
- 803 0 }
- 804 0 } else if (proxies.size() == 1) {
- 805 0 return proxies.get(0);
- 806
+ 777 0 }
+ 778 0 } else if (proxies.size() == 1) {
+ 779 0 return proxies.get(0);
+ 780
} else {
- 807 0 throw new IllegalStateException("Ambiguous proxy definition" );
- 808
+ 781 0 throw new IllegalStateException("Ambiguous proxy definition" );
+ 782
}
- 809
+ 783
}
- 810
+ 784
}
- 811 0 return null ;
- 812
+ 785 0 return null ;
+ 786
}
- 813
+ 787
- 814
+ 788
- 815
+ 789
- 816
+ 790
- 817
+ 791
- 818
+ 792
private void populateSettings() {
- 819 0 Settings.initialize();
- 820 0 InputStream mojoProperties = null ;
- 821
+ 793 0 Settings.initialize();
+ 794 0 InputStream mojoProperties = null ;
+ 795
try {
- 822 0 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
- 823 0 Settings.mergeProperties(mojoProperties);
- 824 0 } catch (IOException ex) {
- 825 0 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
- 826 0 logger.log(Level.FINE, null , ex);
- 827
+ 796 0 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+ 797 0 Settings.mergeProperties(mojoProperties);
+ 798 0 } catch (IOException ex) {
+ 799 0 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
+ 800 0 logger.log(Level.FINE, null , ex);
+ 801
} finally {
- 828 0 if (mojoProperties != null ) {
- 829
+ 802 0 if (mojoProperties != null ) {
+ 803
try {
- 830 0 mojoProperties.close();
- 831 0 } catch (IOException ex) {
- 832 0 logger.log(Level.FINEST, null , ex);
- 833 0 }
+ 804 0 mojoProperties.close();
+ 805 0 } catch (IOException ex) {
+ 806 0 logger.log(Level.FINEST, null , ex);
+ 807 0 }
+ 808
+ }
+ 809
+ }
+ 810
+
+ 811 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+ 812
+
+ 813 0 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+ 814 0 logger.warning("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings to configure the proxy instead" );
+ 815
+ }
+ 816
+
+ 817 0 final Proxy proxy = getMavenProxy();
+ 818 0 if (proxy != null ) {
+ 819 0 Settings.setString(Settings.KEYS.PROXY_SERVER, getMavenSettingsProxyServer(proxy));
+ 820 0 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
+ 821 0 final String userName = proxy.getUsername();
+ 822 0 final String password = proxy.getPassword();
+ 823 0 if (userName != null && password != null ) {
+ 824 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
+ 825 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
+ 826
+ }
+ 827
+ }
+ 828
+
+ 829 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+ 830 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+ 831
+ }
+ 832 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+ 833 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
834
- }
+ } 835
- }
+ 836
-
- 837 0 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
- 838
-
- 839 0 final Proxy proxy = getMavenProxy();
- 840 0 if (proxy != null ) {
- 841 0 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy));
- 842 0 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
- 843 0 final String userName = proxy.getUsername();
- 844 0 final String password = proxy.getPassword();
- 845 0 if (userName != null && password != null ) {
- 846 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
- 847 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
- 848
- }
- 849
+
+ 837
+
+ 838 0 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
+ 839
+
+ 840 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
+ 841
+
+ 842 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+ 843 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+ 844 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ 845
}
- 850
-
- 851 0 if (proxyUrl != null && !proxyUrl.isEmpty()) {
- 852 0 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
- 853
+ 846 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+ 847
+
+ 848 0 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
+ 849 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+ 850 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+ 851
}
- 854 0 if (proxyPort != null && !proxyPort.isEmpty()) {
- 855 0 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+ 852
+
+ 853 0 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
+ 854 0 if (pathToMono != null && !pathToMono.isEmpty()) {
+ 855 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
856
}
- 857 0 if (proxyUsername != null && !proxyUsername.isEmpty()) {
- 858 0 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
- 859
- }
- 860 0 if (proxyPassword != null && !proxyPassword.isEmpty()) {
- 861 0 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
- 862
- }
- 863 0 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
- 864 0 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
- 865
- }
- 866 0 if (suppressionFile != null && !suppressionFile.isEmpty()) {
- 867 0 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
- 868
- }
- 869
+ 857
+ 858
+
+ 859 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+ 860 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+ 861
+ }
+ 862 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+ 863 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+ 864
+ }
+ 865 0 if (connectionString != null && !connectionString.isEmpty()) {
+ 866 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 867
+ }
+ 868 0 if (databaseUser != null && !databaseUser.isEmpty()) {
+ 869 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
870
-
- 871
-
- 872 0 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
+ } 871 0 if (databasePassword != null && !databasePassword.isEmpty()) {
+ 872 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
873
-
- 874 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
- 875
-
- 876 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
- 877 0 if (nexusUrl != null && !nexusUrl.isEmpty()) {
- 878 0 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+ } 874
+
+ 875 0 if (dataDirectory != null && !dataDirectory.isEmpty()) {
+ 876 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+ 877
+ }
+ 878
+
879
+
+ 880 0 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
+ 881 0 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
+ 882 0 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
+ 883
+
+ 884
+
+ 885 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+ 886 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+ 887
}
- 880 0 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
- 881
-
- 882 0 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
- 883 0 if (zipExtensions != null && !zipExtensions.isEmpty()) {
- 884 0 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
- 885
- }
- 886
-
- 887 0 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
- 888 0 if (pathToMono != null && !pathToMono.isEmpty()) {
- 889 0 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+ 888 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+ 889 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
890
}
- 891
+ 891 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+ 892 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+ 893
+ }
+ 894 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+ 895 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+ 896
+ }
+ 897
- 892
-
- 893 0 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
- 894 0 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
- 895
- }
- 896 0 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
- 897 0 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
- 898
- }
- 899 0 if (connectionString != null && !connectionString.isEmpty()) {
- 900 0 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+ 898 0 }
+ 899
+
+ 900
+
901
- }
- 902 0 if (databaseUser != null && !databaseUser.isEmpty()) {
- 903 0 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
- 904
- }
- 905 0 if (databasePassword != null && !databasePassword.isEmpty()) {
- 906 0 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
- 907
- }
- 908
-
- 909 0 if (dataDirectory != null && !dataDirectory.isEmpty()) {
- 910 0 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
- 911
- }
- 912
-
- 913
-
- 914 0 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
- 915 0 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
- 916 0 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
- 917
-
- 918
-
- 919 0 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
- 920 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
- 921
- }
- 922 0 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
- 923 0 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
- 924
- }
- 925 0 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
- 926 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
- 927
- }
- 928 0 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
- 929 0 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
- 930
- }
- 931
-
- 932 0 }
- 933
-
- 934
-
- 935
- 936
+ 902
- 937
+ 903
- 938
+ 904
- 939
+ 905
- 940
+ 906
public void execute() throws MojoExecutionException, MojoFailureException {
- 941 0 Engine engine = null ;
- 942
+ 907 0 Engine engine = null ;
+ 908
try {
- 943 0 engine = executeDependencyCheck();
- 944 0 generateExternalReports(engine, outputDirectory);
- 945 0 if (this .showSummary) {
- 946 0 showSummary(engine.getDependencies());
- 947
+ 909 0 engine = executeDependencyCheck();
+ 910 0 generateExternalReports(engine, outputDirectory);
+ 911 0 if (this .showSummary) {
+ 912 0 showSummary(engine.getDependencies());
+ 913
}
- 948 0 if (this .failBuildOnCVSS <= 10) {
- 949 0 checkForFailure(engine.getDependencies());
- 950
+ 914 0 if (this .failBuildOnCVSS <= 10) {
+ 915 0 checkForFailure(engine.getDependencies());
+ 916
}
- 951 0 } catch (DatabaseException ex) {
- 952 0 logger.log(Level.SEVERE,
- 953
+ 917 0 } catch (DatabaseException ex) {
+ 918 0 logger.log(Level.SEVERE,
+ 919
"Unable to connect to the dependency-check database; analysis has stopped" );
- 954 0 logger.log(Level.FINE, "" , ex);
- 955
+ 920 0 logger.log(Level.FINE, "" , ex);
+ 921
} finally {
- 956 0 Settings.cleanup(true );
- 957 0 if (engine != null ) {
- 958 0 engine.cleanup();
- 959
+ 922 0 Settings.cleanup(true );
+ 923 0 if (engine != null ) {
+ 924 0 engine.cleanup();
+ 925
}
- 960
+ 926
}
- 961 0 }
- 962
+ 927 0 }
+ 928
- 963
+ 929
- 964
+ 930
- 965
+ 931
- 966
+ 932
- 967
+ 933
- 968
+ 934
- 969
+ 935
- 970
+ 936
public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
- 971
+ 937
Locale locale) throws MavenReportException {
- 972 0 generate((Sink) sink, null , locale);
- 973 0 }
- 974
+ 938 0 generate((Sink) sink, null , locale);
+ 939 0 }
+ 940
- 975
+ 941
- 976
+ 942
- 977
+ 943
- 978
+ 944
- 979
+ 945
- 980
+ 946
- 981
+ 947
- 982
+ 948
- 983
+ 949
public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
- 984 0 Engine engine = null ;
- 985
+ 950 0 Engine engine = null ;
+ 951
try {
- 986 0 engine = executeDependencyCheck();
- 987 0 if (this .externalReport) {
- 988 0 generateExternalReports(engine, reportOutputDirectory);
- 989
+ 952 0 engine = executeDependencyCheck();
+ 953 0 if (this .externalReport) {
+ 954 0 generateExternalReports(engine, reportOutputDirectory);
+ 955
} else {
- 990 0 generateMavenSiteReport(engine, sink);
- 991
+ 956 0 generateMavenSiteReport(engine, sink);
+ 957
}
- 992 0 } catch (DatabaseException ex) {
- 993 0 logger.log(Level.SEVERE,
- 994
+ 958 0 } catch (DatabaseException ex) {
+ 959 0 logger.log(Level.SEVERE,
+ 960
"Unable to connect to the dependency-check database; analysis has stopped" );
- 995 0 logger.log(Level.FINE, "" , ex);
- 996
+ 961 0 logger.log(Level.FINE, "" , ex);
+ 962
} finally {
- 997 0 Settings.cleanup(true );
- 998 0 if (engine != null ) {
- 999 0 engine.cleanup();
- 1000
+ 963 0 Settings.cleanup(true );
+ 964 0 if (engine != null ) {
+ 965 0 engine.cleanup();
+ 966
}
- 1001
+ 967
}
- 1002 0 }
- 1003
+ 968 0 }
+ 969
- 1004
+ 970
- 1005
+ 971
- 1006
+ 972
- 1007
+ 973
- 1008
+ 974
- 1009
+ 975
- 1010
+ 976
public String getOutputName() {
- 1011 0 if ("HTML" .equalsIgnoreCase(this .format)
- 1012
+ 977 0 if ("HTML" .equalsIgnoreCase(this .format)
+ 978
|| "ALL" .equalsIgnoreCase(this .format)) {
- 1013 0 return "dependency-check-report" ;
- 1014 0 } else if ("XML" .equalsIgnoreCase(this .format)) {
- 1015 0 return "dependency-check-report.xml#" ;
- 1016 0 } else if ("VULN" .equalsIgnoreCase(this .format)) {
- 1017 0 return "dependency-check-vulnerability" ;
- 1018
+ 979 0 return "dependency-check-report" ;
+ 980 0 } else if ("XML" .equalsIgnoreCase(this .format)) {
+ 981 0 return "dependency-check-report.xml#" ;
+ 982 0 } else if ("VULN" .equalsIgnoreCase(this .format)) {
+ 983 0 return "dependency-check-vulnerability" ;
+ 984
} else {
- 1019 0 logger.log(Level.WARNING, "Unknown report format used during site generation." );
- 1020 0 return "dependency-check-report" ;
- 1021
+ 985 0 logger.log(Level.WARNING, "Unknown report format used during site generation." );
+ 986 0 return "dependency-check-report" ;
+ 987
}
- 1022
+ 988
}
- 1023
+ 989
- 1024
+ 990
- 1025
+ 991
- 1026
+ 992
- 1027
+ 993
- 1028
+ 994
- 1029
+ 995
public String getCategoryName() {
- 1030 0 return MavenReport.CATEGORY_PROJECT_REPORTS;
- 1031
+ 996 0 return MavenReport.CATEGORY_PROJECT_REPORTS;
+ 997
}
- 1032
+ 998
- 1033
+ 999
- 1034
+ 1000
- 1035
+ 1001
- 1036
+ 1002
- 1037
+ 1003
- 1038
+ 1004
- 1039
+ 1005
public String getName(Locale locale) {
- 1040 0 return name;
- 1041
+ 1006 0 return name;
+ 1007
}
- 1042
+ 1008
- 1043
+ 1009
- 1044
+ 1010
- 1045
+ 1011
- 1046
+ 1012
- 1047
+ 1013
- 1048
+ 1014
public void setReportOutputDirectory(File directory) {
- 1049 0 reportOutputDirectory = directory;
- 1050 0 }
- 1051
+ 1015 0 reportOutputDirectory = directory;
+ 1016 0 }
+ 1017
- 1052
+ 1018
- 1053
+ 1019
- 1054
+ 1020
- 1055
+ 1021
- 1056
+ 1022
- 1057
+ 1023
public File getReportOutputDirectory() {
- 1058 0 return reportOutputDirectory;
- 1059
+ 1024 0 return reportOutputDirectory;
+ 1025
}
- 1060
+ 1026
- 1061
+ 1027
- 1062
+ 1028
- 1063
+ 1029
- 1064
+ 1030
- 1065
+ 1031
- 1066
+ 1032
- 1067
+ 1033
public String getDescription(Locale locale) {
- 1068 0 return description;
- 1069
+ 1034 0 return description;
+ 1035
}
- 1070
+ 1036
- 1071
+ 1037
- 1072
+ 1038
- 1073
+ 1039
- 1074
+ 1040
- 1075
+ 1041
- 1076
+ 1042
public boolean isExternalReport() {
- 1077 0 return externalReport;
- 1078
+ 1043 0 return externalReport;
+ 1044
}
- 1079
+ 1045
- 1080
+ 1046
- 1081
+ 1047
- 1082
+ 1048
- 1083
+ 1049
- 1084
+ 1050
- 1085
+ 1051
public boolean canGenerateReport() {
- 1086 0 return true ;
- 1087
+ 1052 0 return true ;
+ 1053
}
- 1088
+ 1054
- 1089
+ 1055
- 1090
+ 1056
- 1091
+ 1057
- 1092
+ 1058
- 1093
+ 1059
- 1094
+ 1060
- 1095
+ 1061
- 1096
+ 1062
- 1097
+ 1063
private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
- 1098 0 final StringBuilder ids = new StringBuilder();
- 1099 0 for (Dependency d : dependencies) {
- 1100 0 boolean addName = true ;
- 1101 0 for (Vulnerability v : d.getVulnerabilities()) {
- 1102 0 if (v.getCvssScore() >= failBuildOnCVSS) {
- 1103 0 if (addName) {
- 1104 0 addName = false ;
- 1105 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
- 1106 0 ids.append(v.getName());
- 1107
+ 1064 0 final StringBuilder ids = new StringBuilder();
+ 1065 0 for (Dependency d : dependencies) {
+ 1066 0 boolean addName = true ;
+ 1067 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 1068 0 if (v.getCvssScore() >= failBuildOnCVSS) {
+ 1069 0 if (addName) {
+ 1070 0 addName = false ;
+ 1071 0 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+ 1072 0 ids.append(v.getName());
+ 1073
} else {
- 1108 0 ids.append(", " ).append(v.getName());
- 1109
+ 1074 0 ids.append(", " ).append(v.getName());
+ 1075
}
- 1110
+ 1076
}
- 1111 0 }
- 1112 0 }
- 1113 0 if (ids.length() > 0) {
- 1114 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
- 1115
+ 1077 0 }
+ 1078 0 }
+ 1079 0 if (ids.length() > 0) {
+ 1080 0 final String msg = String.format("%n%nDependency-Check Failure:%n"
+ 1081
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
- 1116
+ 1082
+ "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
- 1117 0 throw new MojoFailureException(msg);
- 1118
+ 1083 0 throw new MojoFailureException(msg);
+ 1084
}
- 1119 0 }
- 1120
+ 1085 0 }
+ 1086
- 1121
+ 1087
- 1122
+ 1088
- 1123
+ 1089
- 1124
+ 1090
- 1125
+ 1091
- 1126
+ 1092
private void showSummary(List<Dependency> dependencies) {
- 1127 0 final StringBuilder summary = new StringBuilder();
- 1128 0 for (Dependency d : dependencies) {
- 1129 0 boolean firstEntry = true ;
- 1130 0 final StringBuilder ids = new StringBuilder();
- 1131 0 for (Vulnerability v : d.getVulnerabilities()) {
- 1132 0 if (firstEntry) {
- 1133 0 firstEntry = false ;
- 1134
+ 1093 0 final StringBuilder summary = new StringBuilder();
+ 1094 0 for (Dependency d : dependencies) {
+ 1095 0 boolean firstEntry = true ;
+ 1096 0 final StringBuilder ids = new StringBuilder();
+ 1097 0 for (Vulnerability v : d.getVulnerabilities()) {
+ 1098 0 if (firstEntry) {
+ 1099 0 firstEntry = false ;
+ 1100
} else {
- 1135 0 ids.append(", " );
- 1136
+ 1101 0 ids.append(", " );
+ 1102
}
- 1137 0 ids.append(v.getName());
- 1138 0 }
- 1139 0 if (ids.length() > 0) {
- 1140 0 summary.append(d.getFileName()).append(" (" );
- 1141 0 firstEntry = true ;
- 1142 0 for (Identifier id : d.getIdentifiers()) {
- 1143 0 if (firstEntry) {
- 1144 0 firstEntry = false ;
- 1145
+ 1103 0 ids.append(v.getName());
+ 1104 0 }
+ 1105 0 if (ids.length() > 0) {
+ 1106 0 summary.append(d.getFileName()).append(" (" );
+ 1107 0 firstEntry = true ;
+ 1108 0 for (Identifier id : d.getIdentifiers()) {
+ 1109 0 if (firstEntry) {
+ 1110 0 firstEntry = false ;
+ 1111
} else {
- 1146 0 summary.append(", " );
- 1147
+ 1112 0 summary.append(", " );
+ 1113
}
- 1148 0 summary.append(id.getValue());
- 1149 0 }
- 1150 0 summary.append(") : " ).append(ids).append(NEW_LINE);
- 1151
+ 1114 0 summary.append(id.getValue());
+ 1115 0 }
+ 1116 0 summary.append(") : " ).append(ids).append(NEW_LINE);
+ 1117
}
- 1152 0 }
- 1153 0 if (summary.length() > 0) {
- 1154 0 final String msg = String.format("%n%n"
- 1155
+ 1118 0 }
+ 1119 0 if (summary.length() > 0) {
+ 1120 0 final String msg = String.format("%n%n"
+ 1121
+ "One or more dependencies were identified with known vulnerabilities:%n%n%s"
- 1156
+ 1122
+ "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
- 1157 0 logger.log(Level.WARNING, msg);
- 1158
+ 1123 0 logger.log(Level.WARNING, msg);
+ 1124
}
- 1159 0 }
- 1160
+ 1125 0 }
+ 1126
}
-
+
diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html
index e9f3fc1d9..9cd431734 100644
--- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html
+++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html
@@ -744,6 +744,6 @@
} dependency-check-maven - Configuration
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -476,60 +476,8 @@
-Deprecated Configuration
-The following properties have been deprecated. These can still be set in the dependency-check-maven plugin’s configuration. However, future versions will remove these properties. Instead using these properties you should use Maven’s settings to configure a proxy.
-
-
-
-
-
-
-Property
-
-Description
-
-Default Value
-
-
-
-
-
-
-proxyUrl
-
-The Proxy URL.
-
-
-
-
-
-
-proxyPort
-
-The Proxy Port.
-
-
-
-
-
-
-proxyUsername
-
-Defines the proxy user name.
-
-
-
-
-
-
-proxyPassword
-
-Defines the proxy password.
-
-
-
-
-
+Proxy Configuration
+Use Maven’s settings to configure a proxy server.
diff --git a/dependency-check-maven/dependency-updates-report.html b/dependency-check-maven/dependency-updates-report.html
index b1fbe5176..da7bba0ca 100644
--- a/dependency-check-maven/dependency-updates-report.html
+++ b/dependency-check-maven/dependency-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-maven - Dependency Updates Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -238,7 +238,7 @@
# of dependencies using the latest version available
-3
+4
# of dependencies where the next version available is smaller than an incremental version update
@@ -373,7 +373,7 @@
org.owasp
dependency-check-core
-1.2.1
+1.2.2
compile
jar
@@ -382,6 +382,18 @@
+org.owasp
+dependency-check-utils
+1.2.2
+compile
+jar
+
+
Status
Group Id
Artifact Id
@@ -399,25 +411,25 @@
junit:junit
-
+
Status
-
+
Group Id
junit
-
+
Artifact Id
junit
-
+
Current Version
4.11
-
+
Scope
test
-
+
Classifier
-
+
Type
jar
@@ -620,7 +632,31 @@
dependency-check-core
Current Version
-1.2.1
+1.2.2
+
+Scope
+compile
+
+Classifier
+
+
+Type
+jar
+
+
org.owasp:dependency-check-utils
+
+
+Status
+
+
+Group Id
+org.owasp
+
+Artifact Id
+dependency-check-utils
+
+Current Version
+1.2.2
Scope
compile
diff --git a/dependency-check-maven/findbugs.html b/dependency-check-maven/findbugs.html
index 96509f725..691d94cde 100644
--- a/dependency-check-maven/findbugs.html
+++ b/dependency-check-maven/findbugs.html
@@ -1,13 +1,13 @@
dependency-check-maven - FindBugs Bug Detector Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-maven/help-mojo.html b/dependency-check-maven/help-mojo.html
index 53114c73c..92861ae1e 100644
--- a/dependency-check-maven/help-mojo.html
+++ b/dependency-check-maven/help-mojo.html
@@ -1,13 +1,13 @@
dependency-check-maven -
dependency-check:help
@@ -55,7 +55,7 @@
-
+
/
@@ -69,9 +69,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -163,7 +163,7 @@
Full name :
-org.owasp:dependency-check-maven:1.2.1:help
+org.owasp:dependency-check-maven:1.2.2:help
Description :
diff --git a/dependency-check-maven/index.html b/dependency-check-maven/index.html
index 8c259e647..a5a4340ed 100644
--- a/dependency-check-maven/index.html
+++ b/dependency-check-maven/index.html
@@ -1,13 +1,13 @@
dependency-check-jenkins -
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-maven/license.html b/dependency-check-maven/license.html
index 8c7e9e5e6..8e864fb76 100644
--- a/dependency-check-maven/license.html
+++ b/dependency-check-maven/license.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project License
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-maven/plugin-info.html b/dependency-check-maven/plugin-info.html
index 4f2b2ec9c..6b2e04d23 100644
--- a/dependency-check-maven/plugin-info.html
+++ b/dependency-check-maven/plugin-info.html
@@ -1,13 +1,13 @@
dependency-check-maven - Plugin Documentation
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -279,7 +279,7 @@ Call mvn dependency-check:help -Ddetail=true
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
</plugin>
...
</plugins>
@@ -289,7 +289,7 @@ Call mvn dependency-check:help -Ddetail=true
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
</plugin>
...
</plugins>
@@ -301,7 +301,7 @@ Call mvn dependency-check:help -Ddetail=true
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
</plugin>
...
</plugins>
diff --git a/dependency-check-maven/plugin-updates-report.html b/dependency-check-maven/plugin-updates-report.html
index 8aaa767f4..000b1958a 100644
--- a/dependency-check-maven/plugin-updates-report.html
+++ b/dependency-check-maven/plugin-updates-report.html
@@ -1,13 +1,13 @@
dependency-check-maven - Plugin Updates Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-maven/project-info.html b/dependency-check-maven/project-info.html
index 6657022f7..f2ef32539 100644
--- a/dependency-check-maven/project-info.html
+++ b/dependency-check-maven/project-info.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Information
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-maven/project-reports.html b/dependency-check-maven/project-reports.html
index 7337efe14..ee6d83114 100644
--- a/dependency-check-maven/project-reports.html
+++ b/dependency-check-maven/project-reports.html
@@ -1,13 +1,13 @@
dependency-check-maven - Generated Reports
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
diff --git a/dependency-check-maven/project-summary.html b/dependency-check-maven/project-summary.html
index cc0d307ad..713ef519a 100644
--- a/dependency-check-maven/project-summary.html
+++ b/dependency-check-maven/project-summary.html
@@ -1,13 +1,13 @@
dependency-check-jenkins - Project Summary
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -196,7 +196,7 @@
dependency-check-jenkins
Version
-1.2.1
+1.2.2
Type
pom
dependency-check-maven - Surefire Report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -267,7 +267,7 @@ function toggleDisplay(elementId) {
0
0
100%
-0.08 0.211 Note: failures are anticipated and checked for with assertions while errors are unanticipated.
Package List
@@ -288,7 +288,7 @@ function toggleDisplay(elementId) {
0
0
100%
-
0.08
+
0.211
Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.
org.owasp.dependencycheck.maven
@@ -310,7 +310,7 @@ function toggleDisplay(elementId) {
0
0
100%
-
0.08
+0.211
Test Cases [Summary ] [Package List ] [Test Cases ]
@@ -320,7 +320,7 @@ function toggleDisplay(elementId) {
testGenerate_Sink_SinkFactory_Locale
-0.002 0 dependency-check-maven - Tag List report
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -240,12 +240,12 @@
Total number of occurrences
Tag strings used by tag class
-Todo Work Todo Work 12
todo, FIXME
Each tag is detailed below:
-
+
Number of occurrences found in the code: 12
diff --git a/dependency-check-maven/usage.html b/dependency-check-maven/usage.html
index a54193296..ebf73ef24 100644
--- a/dependency-check-maven/usage.html
+++ b/dependency-check-maven/usage.html
@@ -1,13 +1,13 @@
dependency-check-maven - Usage
-
+
/
@@ -67,9 +67,9 @@
- | Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,7 +169,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
<executions>
<execution>
<goals>
@@ -197,7 +197,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
<configuration>
<failBuildOnCVSS>8</failBuildOnCVSS>
</configuration>
@@ -233,7 +233,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
<configuration>
<externalReport>false</externalReport>
</configuration>
@@ -260,7 +260,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
<configuration>
<skipProvidedScope>true</skipProvidedScope>
<skipRuntimeScope>true</skipRuntimeScope>
@@ -292,7 +292,7 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
- <version>1.2.1</version>
+ <version>1.2.2</version>
<configuration>
<cveUrl12Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-modified.xml</cveUrl12Modified>
<cveUrl20Modified>http://internal-mirror.mycorp.com/downloads/nist/nvdcve-2.0-modified.xml</cveUrl20Modified>
diff --git a/dependency-check-maven/xref-test/index.html b/dependency-check-maven/xref-test/index.html
index 12ee224b0..45de795c2 100644
--- a/dependency-check-maven/xref-test/index.html
+++ b/dependency-check-maven/xref-test/index.html
@@ -4,7 +4,7 @@
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
index 699aa298d..ce1782b8b 100644
--- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
+++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html
@@ -3,7 +3,7 @@
Dependency-Check Maven Plugin 1.2.1 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.2.2 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.2.1 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.2.2 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
diff --git a/dependency-check-maven/xref/index.html b/dependency-check-maven/xref/index.html
index 12ee224b0..45de795c2 100644
--- a/dependency-check-maven/xref/index.html
+++ b/dependency-check-maven/xref/index.html
@@ -4,7 +4,7 @@
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html
index e7e077297..7f5d537b3 100644
--- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html
+++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html
@@ -155,1017 +155,983 @@
147 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
148 @Parameter(property = "externalReport" , defaultValue = "false" , required = true )
149 private boolean externalReport = false;
-150
-151
-152
-153
-154
-155 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-156 @Parameter(property = "proxyUrl" , defaultValue = "" , required = false)
-157 @Deprecated
-158 private String proxyUrl = null ;
-159
-160
-161
-162
-163 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-164 @Parameter(property = "mavenSettings" , defaultValue = "${settings}" , required = false)
-165 private org.apache.maven.settings.Settings mavenSettings;
-166
-167
-168
-169
-170 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-171 @Parameter(property = "mavenSettingsProxyId" , required = false)
-172 private String mavenSettingsProxyId;
-173
-174
-175
-176
-177
-178
-179 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-180 @Parameter(property = "proxyPort" , defaultValue = "" , required = false)
-181 @Deprecated
-182 private String proxyPort = null ;
-183
-184
-185
-186
-187
-188 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-189 @Parameter(property = "proxyUsername" , defaultValue = "" , required = false)
-190 @Deprecated
-191 private String proxyUsername = null ;
-192
-193
-194
-195
-196
-197 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-198 @Parameter(property = "proxyPassword" , defaultValue = "" , required = false)
-199 @Deprecated
-200 private String proxyPassword = null ;
-201
-202
-203
-204 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-205 @Parameter(property = "connectionTimeout" , defaultValue = "" , required = false)
-206 private String connectionTimeout = null ;
-207
-208
-209
-210 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-211 @Parameter(property = "suppressionFile" , defaultValue = "" , required = false)
-212 private String suppressionFile = null ;
-213
-214
-215
-216 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-217 @Parameter(property = "showSummary" , defaultValue = "true" , required = false)
-218 private boolean showSummary = true ;
-219
-220
-221
-222
-223 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-224 @Parameter(property = "jarAnalyzerEnabled" , defaultValue = "true" , required = false)
-225 private boolean jarAnalyzerEnabled = true ;
-226
-227
-228
-229
-230 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-231 @Parameter(property = "archiveAnalyzerEnabled" , defaultValue = "true" , required = false)
-232 private boolean archiveAnalyzerEnabled = true ;
-233
-234
-235
-236
-237 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-238 @Parameter(property = "assemblyAnalyzerEnabled" , defaultValue = "true" , required = false)
-239 private boolean assemblyAnalyzerEnabled = true ;
-240
-241
-242
-243
-244 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-245 @Parameter(property = "nuspecAnalyzerEnabled" , defaultValue = "true" , required = false)
-246 private boolean nuspecAnalyzerEnabled = true ;
-247
+150
+151
+152
+153
+154 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+155 @Parameter(property = "mavenSettings" , defaultValue = "${settings}" , required = false)
+156 private org.apache.maven.settings.Settings mavenSettings;
+157
+158
+159
+160
+161 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+162 @Parameter(property = "mavenSettingsProxyId" , required = false)
+163 private String mavenSettingsProxyId;
+164
+165
+166
+167
+168 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+169 @Parameter(property = "connectionTimeout" , defaultValue = "" , required = false)
+170 private String connectionTimeout = null ;
+171
+172
+173
+174 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+175 @Parameter(property = "suppressionFile" , defaultValue = "" , required = false)
+176 private String suppressionFile = null ;
+177
+178
+179
+180 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+181 @Parameter(property = "showSummary" , defaultValue = "true" , required = false)
+182 private boolean showSummary = true ;
+183
+184
+185
+186
+187 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+188 @Parameter(property = "jarAnalyzerEnabled" , defaultValue = "true" , required = false)
+189 private boolean jarAnalyzerEnabled = true ;
+190
+191
+192
+193
+194 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+195 @Parameter(property = "archiveAnalyzerEnabled" , defaultValue = "true" , required = false)
+196 private boolean archiveAnalyzerEnabled = true ;
+197
+198
+199
+200
+201 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+202 @Parameter(property = "assemblyAnalyzerEnabled" , defaultValue = "true" , required = false)
+203 private boolean assemblyAnalyzerEnabled = true ;
+204
+205
+206
+207
+208 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+209 @Parameter(property = "nuspecAnalyzerEnabled" , defaultValue = "true" , required = false)
+210 private boolean nuspecAnalyzerEnabled = true ;
+211
+212
+213
+214
+215 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+216 @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false)
+217 private boolean nexusAnalyzerEnabled = true ;
+218
+219
+220
+221 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+222 @Parameter(property = "nexusUrl" , defaultValue = "" , required = false)
+223 private String nexusUrl;
+224
+225
+226
+227 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+228 @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false)
+229 private boolean nexusUsesProxy = true ;
+230
+231
+232
+233 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+234 @Parameter(property = "connectionString" , defaultValue = "" , required = false)
+235 private String connectionString;
+236
+237
+238
+239 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+240 @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false)
+241 private String databaseDriverName;
+242
+243
+244
+245 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+246 @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false)
+247 private String databaseDriverPath;
248
-249
+249
250
251 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-252 @Parameter(property = "nexusAnalyzerEnabled" , defaultValue = "true" , required = false)
-253 private boolean nexusAnalyzerEnabled = true ;
+252 @Parameter(property = "databaseUser" , defaultValue = "" , required = false)
+253 private String databaseUser;
254
-255
+255
256
257 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-258 @Parameter(property = "nexusUrl" , defaultValue = "" , required = false)
-259 private String nexusUrl;
+258 @Parameter(property = "databasePassword" , defaultValue = "" , required = false)
+259 private String databasePassword;
260
-261
+261
262
-263 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-264 @Parameter(property = "nexusUsesProxy" , defaultValue = "true" , required = false)
-265 private boolean nexusUsesProxy = true ;
-266
-267
-268
-269 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-270 @Parameter(property = "connectionString" , defaultValue = "" , required = false)
-271 private String connectionString;
-272
-273
-274
-275 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-276 @Parameter(property = "databaseDriverName" , defaultValue = "" , required = false)
-277 private String databaseDriverName;
-278
-279
-280
-281 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-282 @Parameter(property = "databaseDriverPath" , defaultValue = "" , required = false)
-283 private String databaseDriverPath;
-284
-285
-286
-287 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-288 @Parameter(property = "databaseUser" , defaultValue = "" , required = false)
-289 private String databaseUser;
-290
-291
-292
-293 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
-294 @Parameter(property = "databasePassword" , defaultValue = "" , required = false)
-295 private String databasePassword;
-296
-297
-298
-299 @Parameter(property = "zipExtensions" , required = false)
-300 private String zipExtensions;
-301
-302
-303
-304 @SuppressWarnings("CanBeFinal" )
-305 @Parameter(property = "skipTestScope" , defaultValue = "true" , required = false)
-306 private boolean skipTestScope = true ;
-307
-308
-309
-310 @SuppressWarnings("CanBeFinal" )
-311 @Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false)
-312 private boolean skipRuntimeScope = false;
-313
-314
-315
-316 @SuppressWarnings("CanBeFinal" )
-317 @Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false)
-318 private boolean skipProvidedScope = false;
-319
-320
-321
-322 @Parameter(property = "dataDirectory" , defaultValue = "" , required = false)
-323 private String dataDirectory;
-324
-325
-326
-327 @Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false)
-328 private String cveUrl12Modified;
-329
-330
+263 @Parameter(property = "zipExtensions" , required = false)
+264 private String zipExtensions;
+265
+266
+267
+268 @SuppressWarnings("CanBeFinal" )
+269 @Parameter(property = "skipTestScope" , defaultValue = "true" , required = false)
+270 private boolean skipTestScope = true ;
+271
+272
+273
+274 @SuppressWarnings("CanBeFinal" )
+275 @Parameter(property = "skipRuntimeScope" , defaultValue = "false" , required = false)
+276 private boolean skipRuntimeScope = false;
+277
+278
+279
+280 @SuppressWarnings("CanBeFinal" )
+281 @Parameter(property = "skipProvidedScope" , defaultValue = "false" , required = false)
+282 private boolean skipProvidedScope = false;
+283
+284
+285
+286 @Parameter(property = "dataDirectory" , defaultValue = "" , required = false)
+287 private String dataDirectory;
+288
+289
+290
+291 @Parameter(property = "cveUrl12Modified" , defaultValue = "" , required = false)
+292 private String cveUrl12Modified;
+293
+294
+295
+296 @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false)
+297 private String cveUrl20Modified;
+298
+299
+300
+301 @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false)
+302 private String cveUrl12Base;
+303
+304
+305
+306 @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false)
+307 private String cveUrl20Base;
+308
+309
+310
+311
+312 @Parameter(property = "pathToMono" , defaultValue = "" , required = false)
+313 private String pathToMono;
+314
+315
+316
+317
+318
+319
+320 @SuppressWarnings({"CanBeFinal" , "FieldCanBeLocal" })
+321 @Parameter(property = "proxyUrl" , defaultValue = "" , required = false)
+322 @Deprecated
+323 private String proxyUrl = null ;
+324
+325
+326
+327
+328
+329
+330
331
-332 @Parameter(property = "cveUrl20Modified" , defaultValue = "" , required = false)
-333 private String cveUrl20Modified;
-334
-335
-336
-337 @Parameter(property = "cveUrl12Base" , defaultValue = "" , required = false)
-338 private String cveUrl12Base;
-339
-340
-341
-342 @Parameter(property = "cveUrl20Base" , defaultValue = "" , required = false)
-343 private String cveUrl20Base;
-344
-345
-346
-347
-348 @Parameter(property = "pathToMono" , defaultValue = "" , required = false)
-349 private String pathToMono;
-350
-351
-352
-353
-354
-355
-356
-357
-358 private Engine executeDependencyCheck() throws DatabaseException {
-359
-360 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
-361 LogUtils.prepareLogger(in, logFile);
-362
-363 populateSettings();
-364 final Engine engine = new Engine();
-365
-366 final Set<Artifact> artifacts = project.getArtifacts();
-367 for (Artifact a : artifacts) {
-368 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
-369 continue ;
-370 }
-371
-372 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
-373 continue ;
-374 }
-375
-376 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
-377 continue ;
-378 }
-379
-380 engine.scan(a.getFile().getAbsolutePath());
-381 }
-382 engine.analyzeDependencies();
-383
-384 return engine;
-385 }
-386
-387
-388
-389
-390
-391
-392
-393 private void generateExternalReports(Engine engine, File outDirectory) {
-394 DatabaseProperties prop = null ;
-395 CveDB cve = null ;
-396 try {
-397 cve = new CveDB();
-398 cve.open();
-399 prop = cve.getDatabaseProperties();
-400 } catch (DatabaseException ex) {
-401 logger.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
-402 } finally {
-403 if (cve != null ) {
-404 cve.close();
-405 }
-406 }
-407 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
-408 try {
-409 r.generateReports(outDirectory.getCanonicalPath(), format);
-410 } catch (IOException ex) {
-411 logger.log(Level.SEVERE,
-412 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
-413 logger.log(Level.FINE, null , ex);
-414 } catch (Throwable ex) {
-415 logger.log(Level.SEVERE,
-416 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
-417 logger.log(Level.FINE, null , ex);
-418 }
-419 }
-420
-421
-422
-423
-424
-425
-426
-427 private void generateMavenSiteReport(final Engine engine, Sink sink) {
-428 final List<Dependency> dependencies = engine.getDependencies();
-429
-430 writeSiteReportHeader(sink, project.getName());
-431 writeSiteReportTOC(sink, dependencies);
-432
-433 int cnt = 0;
-434 for (Dependency d : dependencies) {
-435 writeSiteReportDependencyHeader(sink, d);
-436 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
-437 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
-438 writeSiteReportDependencyIdentifiers(d, sink);
-439 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
-440 }
-441 sink.body_();
-442 }
-443
-444
-445
-446
-447
-448
-449
-450
-451
-452 private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
-453 int cnt = collapsibleHeaderCount;
-454 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
-455 for (Vulnerability v : d.getVulnerabilities()) {
-456
-457 sink.paragraph();
-458 sink.bold();
-459 try {
-460 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
-461 sink.text(v.getName());
-462 sink.link_();
-463 sink.bold_();
-464 } catch (UnsupportedEncodingException ex) {
-465 sink.text(v.getName());
-466 sink.bold_();
-467 sink.lineBreak();
-468 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
-469 }
-470 sink.paragraph_();
-471 sink.paragraph();
-472 sink.text("Severity: " );
-473 if (v.getCvssScore() < 4.0) {
-474 sink.text("Low" );
-475 } else {
-476 if (v.getCvssScore() >= 7.0) {
-477 sink.text("High" );
-478 } else {
-479 sink.text("Medium" );
-480 }
-481 }
-482 sink.lineBreak();
-483 sink.text("CVSS Score: " + v.getCvssScore());
-484 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
-485 sink.lineBreak();
-486 sink.text("CWE: " );
-487 sink.text(v.getCwe());
-488 }
-489 sink.paragraph_();
-490 sink.paragraph();
-491 sink.text(v.getDescription());
-492 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
-493 sink.list();
-494 for (Reference ref : v.getReferences()) {
-495 sink.listItem();
-496 sink.text(ref.getSource());
-497 sink.text(" - " );
-498 sink.link(ref.getUrl());
-499 sink.text(ref.getName());
-500 sink.link_();
-501 sink.listItem_();
-502 }
-503 sink.list_();
-504 }
-505 sink.paragraph_();
-506 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
-507 sink.paragraph();
-508
-509 cnt += 1;
-510 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
-511 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
-512 sink.list();
-513 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
-514 sink.listItem();
-515 try {
-516 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
-517 sink.text(vs.getName());
-518 sink.link_();
-519 if (vs.hasPreviousVersion()) {
-520 sink.text(" and all previous versions." );
-521 }
-522 } catch (UnsupportedEncodingException ex) {
-523 sink.text(vs.getName());
-524 if (vs.hasPreviousVersion()) {
-525 sink.text(" and all previous versions." );
-526 }
-527 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
-528 }
-529
-530 sink.listItem_();
-531 }
-532 sink.list_();
-533 sink.rawText("</div>" );
-534 sink.paragraph_();
-535 }
-536 }
-537 }
-538 }
-539
-540
-541
-542
-543
-544
-545
-546 private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
-547 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
-548 sink.sectionTitle4();
-549 sink.text("Identifiers" );
-550 sink.sectionTitle4_();
-551 sink.list();
-552 for (Identifier i : d.getIdentifiers()) {
-553 sink.listItem();
-554 sink.text(i.getType());
-555 sink.text(": " );
-556 if (i.getUrl() != null && i.getUrl().length() > 0) {
-557 sink.link(i.getUrl());
-558 sink.text(i.getValue());
-559 sink.link_();
-560 } else {
-561 sink.text(i.getValue());
-562 }
-563 if (i.getDescription() != null && i.getDescription().length() > 0) {
-564 sink.lineBreak();
-565 sink.text(i.getDescription());
-566 }
-567 sink.listItem_();
-568 }
-569 sink.list_();
-570 }
-571 }
-572
-573
-574
-575
-576
-577
-578
-579
-580
-581 private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
-582 int cnt = collapsibleHeaderCount;
-583 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
-584 cnt += 1;
-585 sink.sectionTitle4();
-586 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
-587 sink.sectionTitle4_();
-588 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
-589 sink.list();
-590 for (Dependency r : d.getRelatedDependencies()) {
-591 sink.listItem();
-592 sink.text(r.getFileName());
-593 sink.list();
-594 writeListItem(sink, "File Path: " + r.getFilePath());
-595 writeListItem(sink, "SHA1: " + r.getSha1sum());
-596 writeListItem(sink, "MD5: " + r.getMd5sum());
-597 sink.list_();
-598 sink.listItem_();
-599 }
-600 sink.list_();
-601 sink.rawText("</div>" );
-602 }
-603 return cnt;
-604 }
-605
-606
-607
-608
-609
-610
-611
-612
-613
-614 private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
-615 int cnt = collapsibleHeaderCount;
-616 final Set<Evidence> evidence = d.getEvidenceForDisplay();
-617 if (evidence != null && evidence.size() > 0) {
-618 cnt += 1;
-619 sink.sectionTitle4();
-620 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
-621 sink.sectionTitle4_();
-622 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
-623 sink.table();
-624 sink.tableRow();
-625 writeTableHeaderCell(sink, "Source" );
-626 writeTableHeaderCell(sink, "Name" );
-627 writeTableHeaderCell(sink, "Value" );
-628 sink.tableRow_();
-629 for (Evidence e : evidence) {
-630 sink.tableRow();
-631 writeTableCell(sink, e.getSource());
-632 writeTableCell(sink, e.getName());
-633 writeTableCell(sink, e.getValue());
-634 sink.tableRow_();
-635 }
-636 sink.table_();
-637 sink.rawText("</div>" );
-638 }
-639 return cnt;
-640 }
-641
-642
-643
-644
-645
-646
-647
-648 private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
-649 sink.sectionTitle2();
-650 sink.anchor("sha1" + d.getSha1sum());
-651 sink.text(d.getFileName());
-652 sink.anchor_();
-653 sink.sectionTitle2_();
-654 if (d.getDescription() != null && d.getDescription().length() > 0) {
-655 sink.paragraph();
-656 sink.bold();
-657 sink.text("Description: " );
-658 sink.bold_();
-659 sink.text(d.getDescription());
-660 sink.paragraph_();
-661 }
-662 if (d.getLicense() != null && d.getLicense().length() > 0) {
-663 sink.paragraph();
-664 sink.bold();
-665 sink.text("License: " );
-666 sink.bold_();
-667 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
-668 sink.link(d.getLicense());
-669 sink.text(d.getLicense());
-670 sink.link_();
-671 } else {
-672 sink.text(d.getLicense());
-673 }
-674 sink.paragraph_();
-675 }
-676 }
-677
-678
-679
-680
-681
-682
-683
-684 private void writeListItem(Sink sink, String text) {
-685 sink.listItem();
-686 sink.text(text);
-687 sink.listItem_();
-688 }
-689
-690
-691
-692
-693
-694
-695
-696 private void writeTableCell(Sink sink, String text) {
-697 sink.tableCell();
-698 sink.text(text);
-699 sink.tableCell_();
-700 }
-701
-702
-703
-704
-705
-706
-707
-708 private void writeTableHeaderCell(Sink sink, String text) {
-709 sink.tableHeaderCell();
-710 sink.text(text);
-711 sink.tableHeaderCell_();
-712 }
-713
-714
-715
-716
-717
-718
-719
-720 private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
-721 sink.list();
-722 for (Dependency d : dependencies) {
-723 sink.listItem();
-724 sink.link("#sha1" + d.getSha1sum());
-725 sink.text(d.getFileName());
-726 sink.link_();
-727 if (!d.getVulnerabilities().isEmpty()) {
-728 sink.rawText(" <font style=\"color:red\">•</font>" );
-729 }
-730 if (!d.getRelatedDependencies().isEmpty()) {
-731 sink.list();
-732 for (Dependency r : d.getRelatedDependencies()) {
-733 writeListItem(sink, r.getFileName());
-734 }
-735 sink.list_();
-736 }
-737 sink.listItem_();
-738 }
-739 sink.list_();
-740 }
-741
-742
-743
-744
-745
-746
-747
-748 private void writeSiteReportHeader(Sink sink, String projectName) {
-749 sink.head();
-750 sink.title();
-751 sink.text("Dependency-Check Report: " + projectName);
-752 sink.title_();
-753 sink.head_();
-754 sink.body();
-755 sink.rawText("<script type=\"text/javascript\">" );
-756 sink.rawText("function toggleElement(el, targetId) {" );
-757 sink.rawText("if (el.innerText == '[+]') {" );
-758 sink.rawText(" el.innerText = '[-]';" );
-759 sink.rawText(" document.getElementById(targetId).style.display='block';" );
-760 sink.rawText("} else {" );
-761 sink.rawText(" el.innerText = '[+]';" );
-762 sink.rawText(" document.getElementById(targetId).style.display='none';" );
-763 sink.rawText("}" );
-764
-765 sink.rawText("}" );
-766 sink.rawText("</script>" );
-767 sink.section1();
-768 sink.sectionTitle1();
-769 sink.text("Project: " + projectName);
-770 sink.sectionTitle1_();
-771 sink.date();
-772 final Date now = new Date();
-773 sink.text(DateFormat.getDateTimeInstance().format(now));
-774 sink.date_();
-775 sink.section1_();
-776 }
-777
-778
-779
-780
-781
-782
-783
-784
-785 private String getMavenSettingsProxyUrl(Proxy proxy) {
-786 return new StringBuilder(proxy.getProtocol()).append("://" ).append(proxy.getHost()).toString();
-787 }
-788
-789
-790
-791
-792
-793
-794 private Proxy getMavenProxy() {
-795 if (mavenSettings != null ) {
-796 final List<Proxy> proxies = mavenSettings.getProxies();
-797 if (proxies != null && proxies.size() > 0) {
-798 if (mavenSettingsProxyId != null ) {
-799 for (Proxy proxy : proxies) {
-800 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
-801 return proxy;
-802 }
-803 }
-804 } else if (proxies.size() == 1) {
-805 return proxies.get(0);
-806 } else {
-807 throw new IllegalStateException("Ambiguous proxy definition" );
-808 }
-809 }
-810 }
-811 return null ;
-812 }
-813
-814
-815
-816
-817
-818 private void populateSettings() {
-819 Settings.initialize();
-820 InputStream mojoProperties = null ;
-821 try {
-822 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
-823 Settings.mergeProperties(mojoProperties);
-824 } catch (IOException ex) {
-825 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
-826 logger.log(Level.FINE, null , ex);
-827 } finally {
-828 if (mojoProperties != null ) {
-829 try {
-830 mojoProperties.close();
-831 } catch (IOException ex) {
-832 logger.log(Level.FINEST, null , ex);
-833 }
-834 }
-835 }
-836
-837 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
-838
-839 final Proxy proxy = getMavenProxy();
-840 if (proxy != null ) {
-841 Settings.setString(Settings.KEYS.PROXY_URL, getMavenSettingsProxyUrl(proxy));
-842 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
-843 final String userName = proxy.getUsername();
-844 final String password = proxy.getPassword();
-845 if (userName != null && password != null ) {
-846 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
-847 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
-848 }
-849 }
-850
-851 if (proxyUrl != null && !proxyUrl.isEmpty()) {
-852 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
-853 }
-854 if (proxyPort != null && !proxyPort.isEmpty()) {
-855 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
+332 private Engine executeDependencyCheck() throws DatabaseException {
+333
+334 final InputStream in = DependencyCheckMojo.class .getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+335 LogUtils.prepareLogger(in, logFile);
+336
+337 populateSettings();
+338 final Engine engine = new Engine();
+339
+340 final Set<Artifact> artifacts = project.getArtifacts();
+341 for (Artifact a : artifacts) {
+342 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
+343 continue ;
+344 }
+345
+346 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
+347 continue ;
+348 }
+349
+350 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
+351 continue ;
+352 }
+353
+354 engine.scan(a.getFile().getAbsolutePath());
+355 }
+356 engine.analyzeDependencies();
+357
+358 return engine;
+359 }
+360
+361
+362
+363
+364
+365
+366
+367 private void generateExternalReports(Engine engine, File outDirectory) {
+368 DatabaseProperties prop = null ;
+369 CveDB cve = null ;
+370 try {
+371 cve = new CveDB();
+372 cve.open();
+373 prop = cve.getDatabaseProperties();
+374 } catch (DatabaseException ex) {
+375 logger.log(Level.FINE, "Unable to retrieve DB Properties" , ex);
+376 } finally {
+377 if (cve != null ) {
+378 cve.close();
+379 }
+380 }
+381 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
+382 try {
+383 r.generateReports(outDirectory.getCanonicalPath(), format);
+384 } catch (IOException ex) {
+385 logger.log(Level.SEVERE,
+386 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+387 logger.log(Level.FINE, null , ex);
+388 } catch (Throwable ex) {
+389 logger.log(Level.SEVERE,
+390 "Unexpected exception occurred during analysis; please see the verbose error log for more details." );
+391 logger.log(Level.FINE, null , ex);
+392 }
+393 }
+394
+395
+396
+397
+398
+399
+400
+401 private void generateMavenSiteReport(final Engine engine, Sink sink) {
+402 final List<Dependency> dependencies = engine.getDependencies();
+403
+404 writeSiteReportHeader(sink, project.getName());
+405 writeSiteReportTOC(sink, dependencies);
+406
+407 int cnt = 0;
+408 for (Dependency d : dependencies) {
+409 writeSiteReportDependencyHeader(sink, d);
+410 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
+411 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
+412 writeSiteReportDependencyIdentifiers(d, sink);
+413 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
+414 }
+415 sink.body_();
+416 }
+417
+418
+419
+420
+421
+422
+423
+424
+425
+426 private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
+427 int cnt = collapsibleHeaderCount;
+428 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
+429 for (Vulnerability v : d.getVulnerabilities()) {
+430
+431 sink.paragraph();
+432 sink.bold();
+433 try {
+434 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII" ));
+435 sink.text(v.getName());
+436 sink.link_();
+437 sink.bold_();
+438 } catch (UnsupportedEncodingException ex) {
+439 sink.text(v.getName());
+440 sink.bold_();
+441 sink.lineBreak();
+442 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
+443 }
+444 sink.paragraph_();
+445 sink.paragraph();
+446 sink.text("Severity: " );
+447 if (v.getCvssScore() < 4.0) {
+448 sink.text("Low" );
+449 } else {
+450 if (v.getCvssScore() >= 7.0) {
+451 sink.text("High" );
+452 } else {
+453 sink.text("Medium" );
+454 }
+455 }
+456 sink.lineBreak();
+457 sink.text("CVSS Score: " + v.getCvssScore());
+458 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
+459 sink.lineBreak();
+460 sink.text("CWE: " );
+461 sink.text(v.getCwe());
+462 }
+463 sink.paragraph_();
+464 sink.paragraph();
+465 sink.text(v.getDescription());
+466 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
+467 sink.list();
+468 for (Reference ref : v.getReferences()) {
+469 sink.listItem();
+470 sink.text(ref.getSource());
+471 sink.text(" - " );
+472 sink.link(ref.getUrl());
+473 sink.text(ref.getName());
+474 sink.link_();
+475 sink.listItem_();
+476 }
+477 sink.list_();
+478 }
+479 sink.paragraph_();
+480 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
+481 sink.paragraph();
+482
+483 cnt += 1;
+484 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>" );
+485 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">" );
+486 sink.list();
+487 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
+488 sink.listItem();
+489 try {
+490 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII" ));
+491 sink.text(vs.getName());
+492 sink.link_();
+493 if (vs.hasPreviousVersion()) {
+494 sink.text(" and all previous versions." );
+495 }
+496 } catch (UnsupportedEncodingException ex) {
+497 sink.text(vs.getName());
+498 if (vs.hasPreviousVersion()) {
+499 sink.text(" and all previous versions." );
+500 }
+501 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")" );
+502 }
+503
+504 sink.listItem_();
+505 }
+506 sink.list_();
+507 sink.rawText("</div>" );
+508 sink.paragraph_();
+509 }
+510 }
+511 }
+512 }
+513
+514
+515
+516
+517
+518
+519
+520 private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
+521 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
+522 sink.sectionTitle4();
+523 sink.text("Identifiers" );
+524 sink.sectionTitle4_();
+525 sink.list();
+526 for (Identifier i : d.getIdentifiers()) {
+527 sink.listItem();
+528 sink.text(i.getType());
+529 sink.text(": " );
+530 if (i.getUrl() != null && i.getUrl().length() > 0) {
+531 sink.link(i.getUrl());
+532 sink.text(i.getValue());
+533 sink.link_();
+534 } else {
+535 sink.text(i.getValue());
+536 }
+537 if (i.getDescription() != null && i.getDescription().length() > 0) {
+538 sink.lineBreak();
+539 sink.text(i.getDescription());
+540 }
+541 sink.listItem_();
+542 }
+543 sink.list_();
+544 }
+545 }
+546
+547
+548
+549
+550
+551
+552
+553
+554
+555 private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
+556 int cnt = collapsibleHeaderCount;
+557 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
+558 cnt += 1;
+559 sink.sectionTitle4();
+560 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>" );
+561 sink.sectionTitle4_();
+562 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">" );
+563 sink.list();
+564 for (Dependency r : d.getRelatedDependencies()) {
+565 sink.listItem();
+566 sink.text(r.getFileName());
+567 sink.list();
+568 writeListItem(sink, "File Path: " + r.getFilePath());
+569 writeListItem(sink, "SHA1: " + r.getSha1sum());
+570 writeListItem(sink, "MD5: " + r.getMd5sum());
+571 sink.list_();
+572 sink.listItem_();
+573 }
+574 sink.list_();
+575 sink.rawText("</div>" );
+576 }
+577 return cnt;
+578 }
+579
+580
+581
+582
+583
+584
+585
+586
+587
+588 private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
+589 int cnt = collapsibleHeaderCount;
+590 final Set<Evidence> evidence = d.getEvidenceForDisplay();
+591 if (evidence != null && evidence.size() > 0) {
+592 cnt += 1;
+593 sink.sectionTitle4();
+594 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>" );
+595 sink.sectionTitle4_();
+596 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">" );
+597 sink.table();
+598 sink.tableRow();
+599 writeTableHeaderCell(sink, "Source" );
+600 writeTableHeaderCell(sink, "Name" );
+601 writeTableHeaderCell(sink, "Value" );
+602 sink.tableRow_();
+603 for (Evidence e : evidence) {
+604 sink.tableRow();
+605 writeTableCell(sink, e.getSource());
+606 writeTableCell(sink, e.getName());
+607 writeTableCell(sink, e.getValue());
+608 sink.tableRow_();
+609 }
+610 sink.table_();
+611 sink.rawText("</div>" );
+612 }
+613 return cnt;
+614 }
+615
+616
+617
+618
+619
+620
+621
+622 private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
+623 sink.sectionTitle2();
+624 sink.anchor("sha1" + d.getSha1sum());
+625 sink.text(d.getFileName());
+626 sink.anchor_();
+627 sink.sectionTitle2_();
+628 if (d.getDescription() != null && d.getDescription().length() > 0) {
+629 sink.paragraph();
+630 sink.bold();
+631 sink.text("Description: " );
+632 sink.bold_();
+633 sink.text(d.getDescription());
+634 sink.paragraph_();
+635 }
+636 if (d.getLicense() != null && d.getLicense().length() > 0) {
+637 sink.paragraph();
+638 sink.bold();
+639 sink.text("License: " );
+640 sink.bold_();
+641 if (d.getLicense().startsWith("http://" ) && !d.getLicense().contains(" " )) {
+642 sink.link(d.getLicense());
+643 sink.text(d.getLicense());
+644 sink.link_();
+645 } else {
+646 sink.text(d.getLicense());
+647 }
+648 sink.paragraph_();
+649 }
+650 }
+651
+652
+653
+654
+655
+656
+657
+658 private void writeListItem(Sink sink, String text) {
+659 sink.listItem();
+660 sink.text(text);
+661 sink.listItem_();
+662 }
+663
+664
+665
+666
+667
+668
+669
+670 private void writeTableCell(Sink sink, String text) {
+671 sink.tableCell();
+672 sink.text(text);
+673 sink.tableCell_();
+674 }
+675
+676
+677
+678
+679
+680
+681
+682 private void writeTableHeaderCell(Sink sink, String text) {
+683 sink.tableHeaderCell();
+684 sink.text(text);
+685 sink.tableHeaderCell_();
+686 }
+687
+688
+689
+690
+691
+692
+693
+694 private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
+695 sink.list();
+696 for (Dependency d : dependencies) {
+697 sink.listItem();
+698 sink.link("#sha1" + d.getSha1sum());
+699 sink.text(d.getFileName());
+700 sink.link_();
+701 if (!d.getVulnerabilities().isEmpty()) {
+702 sink.rawText(" <font style=\"color:red\">•</font>" );
+703 }
+704 if (!d.getRelatedDependencies().isEmpty()) {
+705 sink.list();
+706 for (Dependency r : d.getRelatedDependencies()) {
+707 writeListItem(sink, r.getFileName());
+708 }
+709 sink.list_();
+710 }
+711 sink.listItem_();
+712 }
+713 sink.list_();
+714 }
+715
+716
+717
+718
+719
+720
+721
+722 private void writeSiteReportHeader(Sink sink, String projectName) {
+723 sink.head();
+724 sink.title();
+725 sink.text("Dependency-Check Report: " + projectName);
+726 sink.title_();
+727 sink.head_();
+728 sink.body();
+729 sink.rawText("<script type=\"text/javascript\">" );
+730 sink.rawText("function toggleElement(el, targetId) {" );
+731 sink.rawText("if (el.innerText == '[+]') {" );
+732 sink.rawText(" el.innerText = '[-]';" );
+733 sink.rawText(" document.getElementById(targetId).style.display='block';" );
+734 sink.rawText("} else {" );
+735 sink.rawText(" el.innerText = '[+]';" );
+736 sink.rawText(" document.getElementById(targetId).style.display='none';" );
+737 sink.rawText("}" );
+738
+739 sink.rawText("}" );
+740 sink.rawText("</script>" );
+741 sink.section1();
+742 sink.sectionTitle1();
+743 sink.text("Project: " + projectName);
+744 sink.sectionTitle1_();
+745 sink.date();
+746 final Date now = new Date();
+747 sink.text(DateFormat.getDateTimeInstance().format(now));
+748 sink.date_();
+749 sink.section1_();
+750 }
+751
+752
+753
+754
+755
+756
+757
+758
+759 private String getMavenSettingsProxyServer(Proxy proxy) {
+760 return new StringBuilder(proxy.getProtocol()).append("://" ).append(proxy.getHost()).toString();
+761 }
+762
+763
+764
+765
+766
+767
+768 private Proxy getMavenProxy() {
+769 if (mavenSettings != null ) {
+770 final List<Proxy> proxies = mavenSettings.getProxies();
+771 if (proxies != null && proxies.size() > 0) {
+772 if (mavenSettingsProxyId != null ) {
+773 for (Proxy proxy : proxies) {
+774 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
+775 return proxy;
+776 }
+777 }
+778 } else if (proxies.size() == 1) {
+779 return proxies.get(0);
+780 } else {
+781 throw new IllegalStateException("Ambiguous proxy definition" );
+782 }
+783 }
+784 }
+785 return null ;
+786 }
+787
+788
+789
+790
+791
+792 private void populateSettings() {
+793 Settings.initialize();
+794 InputStream mojoProperties = null ;
+795 try {
+796 mojoProperties = this .getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
+797 Settings.mergeProperties(mojoProperties);
+798 } catch (IOException ex) {
+799 logger.log(Level.WARNING, "Unable to load the dependency-check ant task.properties file." );
+800 logger.log(Level.FINE, null , ex);
+801 } finally {
+802 if (mojoProperties != null ) {
+803 try {
+804 mojoProperties.close();
+805 } catch (IOException ex) {
+806 logger.log(Level.FINEST, null , ex);
+807 }
+808 }
+809 }
+810
+811 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
+812
+813 if (proxyUrl != null && !proxyUrl.isEmpty()) {
+814 logger.warning("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings to configure the proxy instead" );
+815 }
+816
+817 final Proxy proxy = getMavenProxy();
+818 if (proxy != null ) {
+819 Settings.setString(Settings.KEYS.PROXY_SERVER, getMavenSettingsProxyServer(proxy));
+820 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
+821 final String userName = proxy.getUsername();
+822 final String password = proxy.getPassword();
+823 if (userName != null && password != null ) {
+824 Settings.setString(Settings.KEYS.PROXY_USERNAME, userName);
+825 Settings.setString(Settings.KEYS.PROXY_PASSWORD, password);
+826 }
+827 }
+828
+829 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
+830 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
+831 }
+832 if (suppressionFile != null && !suppressionFile.isEmpty()) {
+833 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
+834 }
+835
+836
+837
+838 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
+839
+840 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
+841
+842 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
+843 if (nexusUrl != null && !nexusUrl.isEmpty()) {
+844 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
+845 }
+846 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
+847
+848 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
+849 if (zipExtensions != null && !zipExtensions.isEmpty()) {
+850 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
+851 }
+852
+853 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
+854 if (pathToMono != null && !pathToMono.isEmpty()) {
+855 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
856 }
-857 if (proxyUsername != null && !proxyUsername.isEmpty()) {
-858 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
-859 }
-860 if (proxyPassword != null && !proxyPassword.isEmpty()) {
-861 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
-862 }
-863 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
-864 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
-865 }
-866 if (suppressionFile != null && !suppressionFile.isEmpty()) {
-867 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
-868 }
-869
-870
-871
-872 Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
-873
-874 Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
-875
-876 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
-877 if (nexusUrl != null && !nexusUrl.isEmpty()) {
-878 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
-879 }
-880 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
-881
-882 Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
-883 if (zipExtensions != null && !zipExtensions.isEmpty()) {
-884 Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
-885 }
-886
-887 Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
-888 if (pathToMono != null && !pathToMono.isEmpty()) {
-889 Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
+857
+858
+859 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
+860 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
+861 }
+862 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
+863 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
+864 }
+865 if (connectionString != null && !connectionString.isEmpty()) {
+866 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
+867 }
+868 if (databaseUser != null && !databaseUser.isEmpty()) {
+869 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
+870 }
+871 if (databasePassword != null && !databasePassword.isEmpty()) {
+872 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
+873 }
+874
+875 if (dataDirectory != null && !dataDirectory.isEmpty()) {
+876 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
+877 }
+878
+879
+880 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
+881 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
+882 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
+883
+884
+885 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
+886 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
+887 }
+888 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
+889 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
890 }
-891
-892
-893 if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
-894 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
-895 }
-896 if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
-897 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
-898 }
-899 if (connectionString != null && !connectionString.isEmpty()) {
-900 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
-901 }
-902 if (databaseUser != null && !databaseUser.isEmpty()) {
-903 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
-904 }
-905 if (databasePassword != null && !databasePassword.isEmpty()) {
-906 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
-907 }
-908
-909 if (dataDirectory != null && !dataDirectory.isEmpty()) {
-910 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
-911 }
-912
-913
-914 Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope);
-915 Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope);
-916 Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope);
-917
-918
-919 if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) {
-920 Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
-921 }
-922 if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) {
-923 Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
-924 }
-925 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
-926 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
-927 }
-928 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
-929 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
-930 }
-931
-932 }
-933
-934
-935
-936
-937
-938
-939
-940 public void execute() throws MojoExecutionException, MojoFailureException {
-941 Engine engine = null ;
-942 try {
-943 engine = executeDependencyCheck();
-944 generateExternalReports(engine, outputDirectory);
-945 if (this .showSummary) {
-946 showSummary(engine.getDependencies());
-947 }
-948 if (this .failBuildOnCVSS <= 10) {
-949 checkForFailure(engine.getDependencies());
-950 }
-951 } catch (DatabaseException ex) {
-952 logger.log(Level.SEVERE,
-953 "Unable to connect to the dependency-check database; analysis has stopped" );
-954 logger.log(Level.FINE, "" , ex);
-955 } finally {
-956 Settings.cleanup(true );
-957 if (engine != null ) {
-958 engine.cleanup();
-959 }
-960 }
-961 }
-962
-963
-964
-965
-966
-967
-968
-969
-970 public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
-971 Locale locale) throws MavenReportException {
-972 generate((Sink) sink, null , locale);
-973 }
-974
-975
-976
-977
-978
-979
-980
-981
-982
-983 public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
-984 Engine engine = null ;
-985 try {
-986 engine = executeDependencyCheck();
-987 if (this .externalReport) {
-988 generateExternalReports(engine, reportOutputDirectory);
-989 } else {
-990 generateMavenSiteReport(engine, sink);
-991 }
-992 } catch (DatabaseException ex) {
-993 logger.log(Level.SEVERE,
-994 "Unable to connect to the dependency-check database; analysis has stopped" );
-995 logger.log(Level.FINE, "" , ex);
-996 } finally {
-997 Settings.cleanup(true );
-998 if (engine != null ) {
-999 engine.cleanup();
-1000 }
-1001 }
-1002 }
-1003
-1004
-1005
-1006
-1007
-1008
-1009
-1010 public String getOutputName() {
-1011 if ("HTML" .equalsIgnoreCase(this .format)
-1012 || "ALL" .equalsIgnoreCase(this .format)) {
-1013 return "dependency-check-report" ;
-1014 } else if ("XML" .equalsIgnoreCase(this .format)) {
-1015 return "dependency-check-report.xml#" ;
-1016 } else if ("VULN" .equalsIgnoreCase(this .format)) {
-1017 return "dependency-check-vulnerability" ;
-1018 } else {
-1019 logger.log(Level.WARNING, "Unknown report format used during site generation." );
-1020 return "dependency-check-report" ;
-1021 }
-1022 }
-1023
-1024
-1025
-1026
-1027
-1028
-1029 public String getCategoryName() {
-1030 return MavenReport.CATEGORY_PROJECT_REPORTS;
-1031 }
-1032
-1033
-1034
-1035
-1036
-1037
-1038
-1039 public String getName(Locale locale) {
-1040 return name;
-1041 }
-1042
-1043
-1044
-1045
-1046
-1047
-1048 public void setReportOutputDirectory(File directory) {
-1049 reportOutputDirectory = directory;
-1050 }
-1051
-1052
-1053
-1054
-1055
-1056
-1057 public File getReportOutputDirectory() {
-1058 return reportOutputDirectory;
-1059 }
-1060
-1061
-1062
-1063
-1064
-1065
-1066
-1067 public String getDescription(Locale locale) {
-1068 return description;
-1069 }
-1070
-1071
-1072
-1073
-1074
-1075
-1076 public boolean isExternalReport() {
-1077 return externalReport;
-1078 }
-1079
-1080
-1081
-1082
-1083
-1084
-1085 public boolean canGenerateReport() {
-1086 return true ;
-1087 }
-1088
-1089
-1090
-1091
-1092
-1093
-1094
-1095
-1096
-1097 private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
-1098 final StringBuilder ids = new StringBuilder();
-1099 for (Dependency d : dependencies) {
-1100 boolean addName = true ;
-1101 for (Vulnerability v : d.getVulnerabilities()) {
-1102 if (v.getCvssScore() >= failBuildOnCVSS) {
-1103 if (addName) {
-1104 addName = false;
-1105 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
-1106 ids.append(v.getName());
-1107 } else {
-1108 ids.append(", " ).append(v.getName());
-1109 }
-1110 }
-1111 }
-1112 }
-1113 if (ids.length() > 0) {
-1114 final String msg = String.format("%n%nDependency-Check Failure:%n"
-1115 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
-1116 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
-1117 throw new MojoFailureException(msg);
+891 if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) {
+892 Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
+893 }
+894 if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) {
+895 Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
+896 }
+897
+898 }
+899
+900
+901
+902
+903
+904
+905
+906 public void execute() throws MojoExecutionException, MojoFailureException {
+907 Engine engine = null ;
+908 try {
+909 engine = executeDependencyCheck();
+910 generateExternalReports(engine, outputDirectory);
+911 if (this .showSummary) {
+912 showSummary(engine.getDependencies());
+913 }
+914 if (this .failBuildOnCVSS <= 10) {
+915 checkForFailure(engine.getDependencies());
+916 }
+917 } catch (DatabaseException ex) {
+918 logger.log(Level.SEVERE,
+919 "Unable to connect to the dependency-check database; analysis has stopped" );
+920 logger.log(Level.FINE, "" , ex);
+921 } finally {
+922 Settings.cleanup(true );
+923 if (engine != null ) {
+924 engine.cleanup();
+925 }
+926 }
+927 }
+928
+929
+930
+931
+932
+933
+934
+935
+936 public void generate(@SuppressWarnings("deprecation" ) org.codehaus.doxia.sink.Sink sink,
+937 Locale locale) throws MavenReportException {
+938 generate((Sink) sink, null , locale);
+939 }
+940
+941
+942
+943
+944
+945
+946
+947
+948
+949 public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
+950 Engine engine = null ;
+951 try {
+952 engine = executeDependencyCheck();
+953 if (this .externalReport) {
+954 generateExternalReports(engine, reportOutputDirectory);
+955 } else {
+956 generateMavenSiteReport(engine, sink);
+957 }
+958 } catch (DatabaseException ex) {
+959 logger.log(Level.SEVERE,
+960 "Unable to connect to the dependency-check database; analysis has stopped" );
+961 logger.log(Level.FINE, "" , ex);
+962 } finally {
+963 Settings.cleanup(true );
+964 if (engine != null ) {
+965 engine.cleanup();
+966 }
+967 }
+968 }
+969
+970
+971
+972
+973
+974
+975
+976 public String getOutputName() {
+977 if ("HTML" .equalsIgnoreCase(this .format)
+978 || "ALL" .equalsIgnoreCase(this .format)) {
+979 return "dependency-check-report" ;
+980 } else if ("XML" .equalsIgnoreCase(this .format)) {
+981 return "dependency-check-report.xml#" ;
+982 } else if ("VULN" .equalsIgnoreCase(this .format)) {
+983 return "dependency-check-vulnerability" ;
+984 } else {
+985 logger.log(Level.WARNING, "Unknown report format used during site generation." );
+986 return "dependency-check-report" ;
+987 }
+988 }
+989
+990
+991
+992
+993
+994
+995 public String getCategoryName() {
+996 return MavenReport.CATEGORY_PROJECT_REPORTS;
+997 }
+998
+999
+1000
+1001
+1002
+1003
+1004
+1005 public String getName(Locale locale) {
+1006 return name;
+1007 }
+1008
+1009
+1010
+1011
+1012
+1013
+1014 public void setReportOutputDirectory(File directory) {
+1015 reportOutputDirectory = directory;
+1016 }
+1017
+1018
+1019
+1020
+1021
+1022
+1023 public File getReportOutputDirectory() {
+1024 return reportOutputDirectory;
+1025 }
+1026
+1027
+1028
+1029
+1030
+1031
+1032
+1033 public String getDescription(Locale locale) {
+1034 return description;
+1035 }
+1036
+1037
+1038
+1039
+1040
+1041
+1042 public boolean isExternalReport() {
+1043 return externalReport;
+1044 }
+1045
+1046
+1047
+1048
+1049
+1050
+1051 public boolean canGenerateReport() {
+1052 return true ;
+1053 }
+1054
+1055
+1056
+1057
+1058
+1059
+1060
+1061
+1062
+1063 private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
+1064 final StringBuilder ids = new StringBuilder();
+1065 for (Dependency d : dependencies) {
+1066 boolean addName = true ;
+1067 for (Vulnerability v : d.getVulnerabilities()) {
+1068 if (v.getCvssScore() >= failBuildOnCVSS) {
+1069 if (addName) {
+1070 addName = false;
+1071 ids.append(NEW_LINE).append(d.getFileName()).append(": " );
+1072 ids.append(v.getName());
+1073 } else {
+1074 ids.append(", " ).append(v.getName());
+1075 }
+1076 }
+1077 }
+1078 }
+1079 if (ids.length() > 0) {
+1080 final String msg = String.format("%n%nDependency-Check Failure:%n"
+1081 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
+1082 + "See the dependency-check report for more details.%n%n" , failBuildOnCVSS, ids.toString());
+1083 throw new MojoFailureException(msg);
+1084 }
+1085 }
+1086
+1087
+1088
+1089
+1090
+1091
+1092 private void showSummary(List<Dependency> dependencies) {
+1093 final StringBuilder summary = new StringBuilder();
+1094 for (Dependency d : dependencies) {
+1095 boolean firstEntry = true ;
+1096 final StringBuilder ids = new StringBuilder();
+1097 for (Vulnerability v : d.getVulnerabilities()) {
+1098 if (firstEntry) {
+1099 firstEntry = false;
+1100 } else {
+1101 ids.append(", " );
+1102 }
+1103 ids.append(v.getName());
+1104 }
+1105 if (ids.length() > 0) {
+1106 summary.append(d.getFileName()).append(" (" );
+1107 firstEntry = true ;
+1108 for (Identifier id : d.getIdentifiers()) {
+1109 if (firstEntry) {
+1110 firstEntry = false;
+1111 } else {
+1112 summary.append(", " );
+1113 }
+1114 summary.append(id.getValue());
+1115 }
+1116 summary.append(") : " ).append(ids).append(NEW_LINE);
+1117 }
1118 }
-1119 }
-1120
-1121
-1122
-1123
-1124
-1125
-1126 private void showSummary(List<Dependency> dependencies) {
-1127 final StringBuilder summary = new StringBuilder();
-1128 for (Dependency d : dependencies) {
-1129 boolean firstEntry = true ;
-1130 final StringBuilder ids = new StringBuilder();
-1131 for (Vulnerability v : d.getVulnerabilities()) {
-1132 if (firstEntry) {
-1133 firstEntry = false;
-1134 } else {
-1135 ids.append(", " );
-1136 }
-1137 ids.append(v.getName());
-1138 }
-1139 if (ids.length() > 0) {
-1140 summary.append(d.getFileName()).append(" (" );
-1141 firstEntry = true ;
-1142 for (Identifier id : d.getIdentifiers()) {
-1143 if (firstEntry) {
-1144 firstEntry = false;
-1145 } else {
-1146 summary.append(", " );
-1147 }
-1148 summary.append(id.getValue());
-1149 }
-1150 summary.append(") : " ).append(ids).append(NEW_LINE);
-1151 }
-1152 }
-1153 if (summary.length() > 0) {
-1154 final String msg = String.format("%n%n"
-1155 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
-1156 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
-1157 logger.log(Level.WARNING, msg);
-1158 }
-1159 }
-1160 }
+1119 if (summary.length() > 0) {
+1120 final String msg = String.format("%n%n"
+1121 + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
+1122 + "%n%nSee the dependency-check report for more details.%n%n" , summary.toString());
+1123 logger.log(Level.WARNING, msg);
+1124 }
+1125 }
+1126 }
Dependency-Check Maven Plugin 1.2.1 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.2.2 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.2.1 Reference Package org.owasp.dependencycheck.maven
+ Dependency-Check Maven Plugin 1.2.2 Reference Package org.owasp.dependencycheck.maven
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
Dependency-Check Maven Plugin 1.2.1 Reference
+ Dependency-Check Maven Plugin 1.2.2 Reference
diff --git a/index.html b/index.html
index 29965998c..22ba809fa 100644
--- a/index.html
+++ b/index.html
@@ -1,13 +1,13 @@
dependency-check - About
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/issue-tracking.html b/issue-tracking.html
index 3e4b11ee9..d2c62d8f3 100644
--- a/issue-tracking.html
+++ b/issue-tracking.html
@@ -1,13 +1,13 @@
dependency-check - Issue Tracking
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/jar-analyzer.html b/jar-analyzer.html
new file mode 100644
index 000000000..3eda2995d
--- /dev/null
+++ b/jar-analyzer.html
@@ -0,0 +1,253 @@
+
+
+
+
+ dependency-check - Jar Analyzer
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /
+
+ Jar Analyzer
+
+
+
+ | Last Published: 2014-06-22
+ Version: 1.2.2
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Jar Analyzer
+
Dependency-check includes an analyzer that scans JAR files and collect as much information it can about the file as it can. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform Enumeration (CPE) identifiers that apply. Additionally, if a POM is present the analyzer will add the Maven group, artifact, and version (GAV).
+
Files Types Scanned: JAR, WAR
+
+
+
+
+
+
Copyright © 2012–2014
+ OWASP .
+ All rights reserved.
+
+
+
+
+
+
+
+
+
diff --git a/license.html b/license.html
index 57617c5c4..5c2e70e74 100644
--- a/license.html
+++ b/license.html
@@ -1,13 +1,13 @@
dependency-check - Project License
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/mail-lists.html b/mail-lists.html
index 683b7e5a8..8bef2716b 100644
--- a/mail-lists.html
+++ b/mail-lists.html
@@ -1,13 +1,13 @@
dependency-check - Project Mailing Lists
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/modules.html b/modules.html
index 0fb6af3bc..19da9a1cb 100644
--- a/modules.html
+++ b/modules.html
@@ -1,13 +1,13 @@
dependency-check - Project Modules
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
@@ -276,7 +305,10 @@
Dependency-Check-Maven is a Maven Plugin that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
Dependency-Check Jenkins Plugin This plug-in can independently execute a Dependency-Check analysis and visualize the results.
+This plug-in can independently execute a Dependency-Check analysis and visualize the results.
+
+Dependency-Check Utils Dependency-check-utils a collection of common utlity classes used within dependency-check.
diff --git a/nexus-analyzer.html b/nexus-analyzer.html
index 78febf0e1..23ecde22a 100644
--- a/nexus-analyzer.html
+++ b/nexus-analyzer.html
@@ -1,13 +1,13 @@
dependency-check - Nexus Analyzer
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -113,12 +113,41 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -198,7 +227,7 @@
Nexus Analyzer
-
Dependency Check includes an analyzer which will check for the Maven GAV (Group/Artifact/Version) information for artifacts in the scanned area. By default the information comes from Maven Central , but can be configured to use a local repository if necessary. If the artifact’s hash is found in the configured Nexus repository, its GAV is recorded as an Identifier and the Group is collected as Vendor evidence, the Artifact is collected as Product evidence, and the Version is collected as Version evidence.
+
Dependency-check includes an analyzer that will check for the Maven GAV (Group/Artifact/Version) information for artifacts in the scanned area. By default the information comes from Maven Central , but can be configured to use a local repository if necessary. If the artifact’s hash is found in the configured Nexus repository, its GAV is recorded as an Identifier and the Group is collected as Vendor evidence, the Artifact is collected as Product evidence, and the Version is collected as Version evidence.
Default Configuration
By default, the Nexus analyzer uses the Sonatype Nexus Repository to search for SHA-1 hashes of dependencies. If the proxy is configured for Dependency Check, that proxy is used in order to connect to the Nexus Central repository. So if you’re using --proxyurl on the command-line, the proxyUrl setting in the Maven plugin, or the proxyUrl attribute in the Ant task, that proxy will be used by default. Also, the proxy port, user, and password configured globally are used as well.
diff --git a/nuspec-analyzer.html b/nuspec-analyzer.html
new file mode 100644
index 000000000..bc0b96769
--- /dev/null
+++ b/nuspec-analyzer.html
@@ -0,0 +1,254 @@
+
+
+
+
+
+
+
+
+
dependency-check - Nuspec Analyzer
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /
+
+ Nuspec Analyzer
+
+
+
+ | Last Published: 2014-06-22
+ Version: 1.2.2
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Nuspec Analyzer
+
Dependency-check includes an analyzer that will scan NuGet’s Nuspec file to collect information about the component being used. The evidence collected is used by other analyzers to determine if there are any known vulnerabilities associated with the component.
+
Note, the Nuspec Analyzer does not scan dependencies defined. However, if the dependencies have been downloaded and may be included in the scan depending on configuration.
+
Files Types Scanned: NUSPEC
+
+
+
+
+
+
+
+
+
+
Copyright © 2012–2014
+ OWASP .
+ All rights reserved.
+
+
+
+
+
+
+
+
+
diff --git a/project-info.html b/project-info.html
index 112d47343..604ab595c 100644
--- a/project-info.html
+++ b/project-info.html
@@ -1,13 +1,13 @@
-
+
dependency-check - Project Information
@@ -62,9 +62,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/project-summary.html b/project-summary.html
index 478264726..0a291b138 100644
--- a/project-summary.html
+++ b/project-summary.html
@@ -1,13 +1,13 @@
-
+
dependency-check - Project Summary
@@ -62,9 +62,9 @@
-
| Last Published: 2014-05-10
+
| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
@@ -298,7 +327,7 @@
dependency-check-parent
Version
-1.2.1
+1.2.2
Type
pom
dependency-check - Source Repository
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/suppression.html b/suppression.html
index 58b955d42..35c945640 100644
--- a/suppression.html
+++ b/suppression.html
@@ -1,13 +1,13 @@
dependency-check - Suppressing False Positives
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -111,6 +111,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -118,6 +133,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
@@ -256,6 +285,15 @@
]]></notes>
<cvssBelow>7</cvssBelow>
</suppress>
+ <suppress>
+ <notes><![CDATA[
+ This suppresses false positives identified on spring security.
+ ]]></notes>
+ <gav regex="true">org\.springframework\.security:spring.*</gav>
+ <cpe>cpe:/a:vmware:springsource_spring_framework</cpe>
+ <cpe>cpe:/a:springsource:spring_framework</cpe>
+ <cpe>cpe:/a:mod_security:mod_security</cpe>
+ </suppress>
</suppressions>
The full schema for suppression files can be found here: suppression.xsd
diff --git a/team-list.html b/team-list.html
index 1ad52e884..9f2c6ff26 100644
--- a/team-list.html
+++ b/team-list.html
@@ -1,13 +1,13 @@
dependency-check - Team list
| Last Published: 2014-05-10| Last Published: 2014-06-22
- Version: 1.2.1
+ Version: 1.2.2
@@ -169,6 +169,21 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -176,6 +191,20 @@
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+ 
+ 
+ 
