bjiang
83f83d4eee
add RubyBundlerAnalyzerTest
2016-05-06 17:45:40 -04:00
bjiang
b0f4ab9ba5
cleanup & Rakefile support placeholder
2016-05-06 17:25:08 -04:00
bjiang
06dad8f79c
javadoc
2016-05-06 17:22:39 -04:00
bjiang
83ab122ddf
disable RubyBundlerAnalyzer if RubyBundleAuditAnalyzer
2016-05-06 16:42:39 -04:00
bjiang
8a42fe4ae1
javadoc
2016-05-06 16:19:59 -04:00
bjiang
94c6778b89
better javadoc
2016-05-06 16:14:16 -04:00
bjiang
c0e5973517
rename RubyBundlerAnalyzer and javadoc
2016-05-06 15:50:35 -04:00
bjiang
4de3fb1f2a
javadoc
2016-05-06 10:25:49 -04:00
bjiang
189da08885
merge upstream
2016-05-03 13:05:56 -04:00
Jeremy Long
9e63ac6d5b
Merge pull request #493 from awhitford/CommIO25
...
Commons-IO 2.5 upgrade
2016-05-02 19:26:52 -04:00
Jeremy Long
4d7ab8b187
Merge pull request #491 from mwieczorek/MSSQL_Support
...
MSSQL Support
2016-05-02 19:25:39 -04:00
Jeremy Long
4de9818bee
original CVE used in test does not exist in the current default DB used for tests.
2016-05-01 20:16:30 -04:00
Jeremy Long
7a2e1fd221
updated bundle audit score to be more accurate
2016-05-01 15:39:12 -04:00
Jeremy Long
35ffd56ea9
fixed compile issues in PR
2016-04-30 11:20:26 -04:00
Jeremy Long
84b992d3a1
Merge branch 'fix-cvss-for-bundle-audit' of git://github.com/geramirez/DependencyCheck into geramirez-fix-cvss-for-bundle-audit
2016-04-30 11:02:16 -04:00
Jeremy Long
9e46364759
updated test cases to track down build issue
2016-04-30 10:56:50 -04:00
Dave Goddard
0f37c2b59c
Adding sinatra fixture
...
Signed-off-by: Gabriel Ramirez <gabriel.e.ramirez@gmail.com >
2016-04-29 16:17:51 -04:00
Michal Wieczorek
33852ea7e3
MSSQL Support
2016-04-27 23:35:05 +02:00
Anthony Whitford
4fbed1cdac
Added Charset to avoid deprecated FileUtils methods.
2016-04-27 01:37:00 -07:00
David Jahn
8c6b9f9c68
Fixed CVSS for Ruby.
...
this bug was discovered when scanning ruby applications and getting back
`-1` cvss. this turns out to be a problem with bundle-audit cve
database.
Our solution was to use the NVD database, which dependency check uses to
get the CVSS scores for Ruby only if the Criticality is missing from
bundle-audit output. Keep in mind there are compilation errors with the
commit atm.
Fixes #485
Signed-off-by: Gabriel Ramirez <gabriel.e.ramirez@gmail.com >
2016-04-25 09:40:54 -04:00
Jeremy Long
abebecac4a
updated parser and tests to revert to old suppression schema if new schema fails
2016-04-24 09:06:00 -04:00
Jeremy Long
87efe429da
fixed broken schema
2016-04-24 09:05:26 -04:00
Jeremy Long
deda02f879
updated suppression schema to require a CPE, CVE, or CVSS Below per issue #488
2016-04-24 07:20:11 -04:00
bjiang
da82f975e4
Add test for project url from pom.xml
2016-04-15 12:30:14 -04:00
bjiang
48af120db8
add project URL evidence from pom
2016-04-15 11:28:33 -04:00
Jeremy Long
53776936ca
fix FP per issue #469
2016-04-09 11:27:08 -04:00
bjiang
739f595f13
improve python package identification
2016-04-05 16:12:14 -04:00
bjiang
33bbb50b43
Ruby .gemspec must before bundler analyzer to get proper package grouping
2016-04-02 13:51:15 -04:00
bjiang
f89d7df305
improve vendor evidences for .gemspec analyzer
2016-04-02 13:49:50 -04:00
bjiang
3b02cd0e39
bundling same Ruby packages from .gemspec and bundler analyzers
2016-04-02 13:48:25 -04:00
bjiang
52cd50e0a8
keep delimitor space in array value
2016-04-01 14:08:41 -04:00
bjiang
996a970081
fix version evidence name
2016-04-01 14:07:03 -04:00
bjiang
6c0b65acd4
capture licenses and homepage in Ruby bundler analyzer
2016-04-01 13:30:36 -04:00
bjiang
8c659acc82
new Ruby bundler analyzer
2016-03-30 20:20:10 -04:00
bjiang
7aba2429af
merge from upstream
2016-03-28 14:23:09 -04:00
bjiang
ab48d2c2ff
multiple improvements
2016-03-28 14:06:30 -04:00
Jeremy Long
0b699d45bf
Merge pull request #467 from colezlaw/python-init
...
Patch for jeremylong/DependencyCheck/#466
2016-03-25 19:35:06 -04:00
Jeremy Long
54beafa262
Merge pull request #475 from biancajiang/master
...
Fix test to skip the proper test case when bundle-audit is not available
2016-03-25 19:34:34 -04:00
Jeremy Long
531d4923eb
Merge pull request #470 from MrBerg/suppress-osvdb
...
Make it possible to suppress vulnerabilities from OSVDB
2016-03-25 19:33:43 -04:00
Swapnil S. Mahajan
ca54daf456
Added primary key to "software" table
...
"software" is a bridge table so there should always be only one record for a pair of cpeEntryId and cveid.
2016-03-25 16:55:53 +05:30
bjiang
a22fc550b3
#472 fix test to only skip the proper test case.
2016-03-21 11:38:52 -04:00
bjiang
343a78917c
Fixed #472 . Disable RubyBundleAuditAnalyzer if exception during initialize.
...
changes:
1. disable self during initialize before bubbling exception
2. new test case RubyBundleAuditAnalyzerTest#testMissingBundleAudit()
2016-03-20 17:06:03 -04:00
bjiang
ff7d0fdb9d
#472 first fix and improve RubyBundleAuditAnalyzerTest.java
...
Test were failing b/c Gemfile.lock and Gemfile were missing.
The files were missing b/c parent .gitignore them.
Changes:
1. Force added new test files, and updated test with more result
validation.
2. Added error logging from bundle-audit.
3. place holder for bundle-audit install directory in test
dependencycheck.properties.
2016-03-20 15:54:24 -04:00
Jonas Berg
db26b46be0
Make it possible to suppress vulnerabilities from OSVDB
2016-03-16 13:59:23 +02:00
Will Stranathan
d77a70c360
Patch for jeremylong/DependencyCheck/#466
...
This does two things:
1) Updates the PythonPackageAnalyzer to HIGH evidence for __init__.py
2) Removes evidence from the FileNameAnalyzer for __init__.py[co]?
TODO: Need for the PythonPackageAnalyzer to still add evidence for
__init__.py[co] even though it won't be able to analyze the contents of
it. Also, need to work up the tree for __init__.py files to get the
parent folders (not sure why subfolders are not being inspected).
2016-03-12 15:09:43 -05:00
Chad Van Wyhe
ac04c173a8
fixed trigger compilation and added version number
2016-03-07 12:55:18 -06:00
Jeremy Long
cdc07047aa
doclint fixes
2016-03-05 13:18:37 -05:00
Jeremy Long
c832c2da28
doclint fixes
2016-03-05 13:18:37 -05:00
Jeremy Long
8daa713639
doclint fixes
2016-03-05 13:18:36 -05:00
Jeremy Long
e0a2966706
doclint fixes
2016-03-05 13:18:36 -05:00
