mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-15 08:13:43 +01:00
Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
a6faadcc74 | ||
|
|
1e7b45c00b | ||
|
|
9f21ea6a9d | ||
|
|
99c056e7f5 |
@@ -7,8 +7,8 @@ If found, it will generate a report linking to the associated CVE entries.
|
|||||||
Usage:
|
Usage:
|
||||||
$ mvn package
|
$ mvn package
|
||||||
$ cd target
|
$ cd target
|
||||||
$ java -jar DependencyCheck-0.2.2.jar -h
|
$ java -jar DependencyCheck-0.2.3.jar -h
|
||||||
$ java -jar DependencyCheck-0.2.2.jar -a Testing -out . -scan ./test-classes/org.mortbay.jetty.jar -scan ./test-classes/struts2-core-2.1.2.jar -scan ./lib
|
$ java -jar DependencyCheck-0.2.3.jar -a Testing -out . -scan ./test-classes/org.mortbay.jetty.jar -scan ./test-classes/struts2-core-2.1.2.jar -scan ./lib
|
||||||
|
|
||||||
Then load the resulting 'Testing.html' into your favorite browser.
|
Then load the resulting 'Testing.html' into your favorite browser.
|
||||||
|
|
||||||
|
|||||||
25
pom.xml
25
pom.xml
@@ -23,7 +23,7 @@ along with DependencyCheck. If not, see <http://www.gnu.org/licenses/>.
|
|||||||
|
|
||||||
<groupId>org.codesecure</groupId>
|
<groupId>org.codesecure</groupId>
|
||||||
<artifactId>DependencyCheck</artifactId>
|
<artifactId>DependencyCheck</artifactId>
|
||||||
<version>0.2.2</version>
|
<version>0.2.3</version>
|
||||||
<packaging>jar</packaging>
|
<packaging>jar</packaging>
|
||||||
|
|
||||||
<name>DependencyCheck</name>
|
<name>DependencyCheck</name>
|
||||||
@@ -206,13 +206,21 @@ along with DependencyCheck. If not, see <http://www.gnu.org/licenses/>.
|
|||||||
<value>${project.build.directory}/cobertura/cobertura.ser</value>
|
<value>${project.build.directory}/cobertura/cobertura.ser</value>
|
||||||
<workingDirectory>target</workingDirectory>
|
<workingDirectory>target</workingDirectory>
|
||||||
</property>
|
</property>
|
||||||
<property>
|
<!--<property>
|
||||||
<name>cve</name>
|
<name>cve</name>
|
||||||
<value>${project.build.directory}/data/cve</value>
|
<value>${project.build.directory}/data/cve</value>
|
||||||
</property>
|
</property>
|
||||||
<property>
|
<property>
|
||||||
<name>cpe</name>
|
<name>cpe</name>
|
||||||
<value>${project.build.directory}/data/cpe</value>
|
<value>${project.build.directory}/data/cpe</value>
|
||||||
|
</property>-->
|
||||||
|
<property>
|
||||||
|
<name>cve</name>
|
||||||
|
<value>target/data/cve</value>
|
||||||
|
</property>
|
||||||
|
<property>
|
||||||
|
<name>cpe</name>
|
||||||
|
<value>target/data/cpe</value>
|
||||||
</property>
|
</property>
|
||||||
</systemProperties>
|
</systemProperties>
|
||||||
<excludes>
|
<excludes>
|
||||||
@@ -224,6 +232,18 @@ along with DependencyCheck. If not, see <http://www.gnu.org/licenses/>.
|
|||||||
<groupId>org.apache.maven.plugins</groupId>
|
<groupId>org.apache.maven.plugins</groupId>
|
||||||
<artifactId>maven-failsafe-plugin</artifactId>
|
<artifactId>maven-failsafe-plugin</artifactId>
|
||||||
<version>2.12.4</version>
|
<version>2.12.4</version>
|
||||||
|
<configuration>
|
||||||
|
<systemProperties>
|
||||||
|
<property>
|
||||||
|
<name>cve</name>
|
||||||
|
<value>target/data/cve</value>
|
||||||
|
</property>
|
||||||
|
<property>
|
||||||
|
<name>cpe</name>
|
||||||
|
<value>target/data/cpe</value>
|
||||||
|
</property>
|
||||||
|
</systemProperties>
|
||||||
|
</configuration>
|
||||||
<executions>
|
<executions>
|
||||||
<execution>
|
<execution>
|
||||||
<goals>
|
<goals>
|
||||||
@@ -338,6 +358,7 @@ along with DependencyCheck. If not, see <http://www.gnu.org/licenses/>.
|
|||||||
<reportSet>
|
<reportSet>
|
||||||
<id>integration-tests</id>
|
<id>integration-tests</id>
|
||||||
<reports>
|
<reports>
|
||||||
|
<report>report-only</report>
|
||||||
<report>failsafe-report-only</report>
|
<report>failsafe-report-only</report>
|
||||||
</reports>
|
</reports>
|
||||||
</reportSet>
|
</reportSet>
|
||||||
|
|||||||
@@ -74,6 +74,7 @@ public class App {
|
|||||||
//Preferences.systemRoot().put("java.util.logging.config.file", "log.properties");
|
//Preferences.systemRoot().put("java.util.logging.config.file", "log.properties");
|
||||||
//System.getProperties().put("java.util.logging.config.file", "configuration/log.properties");
|
//System.getProperties().put("java.util.logging.config.file", "configuration/log.properties");
|
||||||
File dir = new File("logs");
|
File dir = new File("logs");
|
||||||
|
|
||||||
if (!dir.exists()) {
|
if (!dir.exists()) {
|
||||||
dir.mkdir();
|
dir.mkdir();
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -28,6 +28,7 @@ import java.io.OutputStream;
|
|||||||
import java.io.OutputStreamWriter;
|
import java.io.OutputStreamWriter;
|
||||||
import java.net.MalformedURLException;
|
import java.net.MalformedURLException;
|
||||||
import java.net.URL;
|
import java.net.URL;
|
||||||
|
import java.net.URLDecoder;
|
||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.Map;
|
import java.util.Map;
|
||||||
import java.util.Properties;
|
import java.util.Properties;
|
||||||
@@ -74,13 +75,34 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
* @throws IOException is thrown if an IOException occurs.
|
* @throws IOException is thrown if an IOException occurs.
|
||||||
*/
|
*/
|
||||||
public Directory getDirectory() throws IOException {
|
public Directory getDirectory() throws IOException {
|
||||||
String fileName = Settings.getString(Settings.KEYS.CPE_INDEX);
|
File path = getDataDirectory();
|
||||||
File path = new File(fileName);
|
|
||||||
Directory dir = FSDirectory.open(path);
|
Directory dir = FSDirectory.open(path);
|
||||||
|
|
||||||
return dir;
|
return dir;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Retrieves the directory that the JAR file exists in so that
|
||||||
|
* we can ensure we always use a common data directory.
|
||||||
|
*
|
||||||
|
* @return the data directory for this index.
|
||||||
|
* @throws IOException is thrown if an IOException occurs of course...
|
||||||
|
*/
|
||||||
|
protected File getDataDirectory() throws IOException {
|
||||||
|
String fileName = Settings.getString(Settings.KEYS.CPE_INDEX);
|
||||||
|
String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
|
||||||
|
String decodedPath = URLDecoder.decode(filePath, "UTF-8");
|
||||||
|
File exePath = new File(decodedPath);
|
||||||
|
if (exePath.getName().toLowerCase().endsWith(".jar")) {
|
||||||
|
exePath = exePath.getParentFile();
|
||||||
|
} else {
|
||||||
|
exePath = new File(".");
|
||||||
|
}
|
||||||
|
File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
|
||||||
|
path = new File(path.getCanonicalPath());
|
||||||
|
return path;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Creates an Analyzer for the CPE Index.
|
* Creates an Analyzer for the CPE Index.
|
||||||
*
|
*
|
||||||
@@ -153,8 +175,14 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
*
|
*
|
||||||
* @param timeStamp the timestamp to write.
|
* @param timeStamp the timestamp to write.
|
||||||
*/
|
*/
|
||||||
private void writeLastUpdatedPropertyFile(long timeStamp) {
|
private void writeLastUpdatedPropertyFile(long timeStamp) throws UpdateException {
|
||||||
String dir = Settings.getString(Settings.KEYS.CPE_INDEX);
|
String dir;
|
||||||
|
try {
|
||||||
|
dir = getDataDirectory().getCanonicalPath();
|
||||||
|
} catch (IOException ex) {
|
||||||
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to locate the last updated properties file.", ex);
|
||||||
|
}
|
||||||
File cpeProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
File cpeProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
||||||
Properties prop = new Properties();
|
Properties prop = new Properties();
|
||||||
prop.put(Index.LAST_UPDATED, String.valueOf(timeStamp));
|
prop.put(Index.LAST_UPDATED, String.valueOf(timeStamp));
|
||||||
@@ -193,8 +221,10 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
* is incorrect.
|
* is incorrect.
|
||||||
* @throws DownloadFailedException is thrown if there is an error
|
* @throws DownloadFailedException is thrown if there is an error
|
||||||
* downloading the cpe.meta data file.
|
* downloading the cpe.meta data file.
|
||||||
|
* @throws UpdateException is thrown if there is an error locating the last updated
|
||||||
|
* properties file.
|
||||||
*/
|
*/
|
||||||
public long updateNeeded() throws MalformedURLException, DownloadFailedException {
|
public long updateNeeded() throws MalformedURLException, DownloadFailedException, UpdateException {
|
||||||
long retVal = 0;
|
long retVal = 0;
|
||||||
long lastUpdated = 0;
|
long lastUpdated = 0;
|
||||||
long currentlyPublishedDate = retrieveCurrentCPETimestampFromWeb();
|
long currentlyPublishedDate = retrieveCurrentCPETimestampFromWeb();
|
||||||
@@ -202,12 +232,24 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
throw new DownloadFailedException("Unable to retrieve valid timestamp from cpe.meta file");
|
throw new DownloadFailedException("Unable to retrieve valid timestamp from cpe.meta file");
|
||||||
}
|
}
|
||||||
|
|
||||||
String dir = Settings.getString(Settings.KEYS.CPE_INDEX);
|
//String dir = Settings.getString(Settings.KEYS.CPE_INDEX);
|
||||||
File f = new File(dir);
|
File f;
|
||||||
|
try {
|
||||||
|
f = getDataDirectory(); //new File(dir);
|
||||||
|
} catch (IOException ex) {
|
||||||
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to locate last updated properties file.", ex);
|
||||||
|
}
|
||||||
if (!f.exists()) {
|
if (!f.exists()) {
|
||||||
retVal = currentlyPublishedDate;
|
retVal = currentlyPublishedDate;
|
||||||
} else {
|
} else {
|
||||||
File cpeProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
File cpeProp;
|
||||||
|
try {
|
||||||
|
cpeProp = new File(f.getCanonicalPath() + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
||||||
|
} catch (IOException ex) {
|
||||||
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to find last updated properties file.", ex);
|
||||||
|
}
|
||||||
if (!cpeProp.exists()) {
|
if (!cpeProp.exists()) {
|
||||||
retVal = currentlyPublishedDate;
|
retVal = currentlyPublishedDate;
|
||||||
} else {
|
} else {
|
||||||
|
|||||||
@@ -21,6 +21,7 @@ package org.codesecure.dependencycheck.data.nvdcve;
|
|||||||
import java.io.*;
|
import java.io.*;
|
||||||
import java.net.MalformedURLException;
|
import java.net.MalformedURLException;
|
||||||
import java.net.URL;
|
import java.net.URL;
|
||||||
|
import java.net.URLDecoder;
|
||||||
import java.util.*;
|
import java.util.*;
|
||||||
import java.util.logging.Level;
|
import java.util.logging.Level;
|
||||||
import java.util.logging.Logger;
|
import java.util.logging.Logger;
|
||||||
@@ -66,18 +67,40 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
private static final String LAST_UPDATED_BASE = "lastupdated.";
|
private static final String LAST_UPDATED_BASE = "lastupdated.";
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Returns the directory that holds the NVD CVE Index.
|
* Returns the directory that holds the NVD CVE Index. Note, this
|
||||||
|
* returns the path where the class or jar file exists.
|
||||||
*
|
*
|
||||||
* @return the Directory containing the NVD CVE Index.
|
* @return the Directory containing the NVD CVE Index.
|
||||||
* @throws IOException is thrown if an IOException occurs.
|
* @throws IOException is thrown if an IOException occurs.
|
||||||
*/
|
*/
|
||||||
public Directory getDirectory() throws IOException {
|
public Directory getDirectory() throws IOException {
|
||||||
String fileName = Settings.getString(Settings.KEYS.CVE_INDEX);
|
File path = getDataDirectory();
|
||||||
File path = new File(fileName);
|
|
||||||
Directory dir = FSDirectory.open(path);
|
Directory dir = FSDirectory.open(path);
|
||||||
return dir;
|
return dir;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Retrieves the directory that the JAR file exists in so that
|
||||||
|
* we can ensure we always use a common data directory.
|
||||||
|
*
|
||||||
|
* @return the data directory for this index.
|
||||||
|
* @throws IOException is thrown if an IOException occurs of course...
|
||||||
|
*/
|
||||||
|
protected File getDataDirectory() throws IOException {
|
||||||
|
String fileName = Settings.getString(Settings.KEYS.CVE_INDEX);
|
||||||
|
String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
|
||||||
|
String decodedPath = URLDecoder.decode(filePath, "UTF-8");
|
||||||
|
File exePath = new File(decodedPath);
|
||||||
|
if (exePath.getName().toLowerCase().endsWith(".jar")) {
|
||||||
|
exePath = exePath.getParentFile();
|
||||||
|
} else {
|
||||||
|
exePath = new File(".");
|
||||||
|
}
|
||||||
|
File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
|
||||||
|
path = new File(path.getCanonicalPath());
|
||||||
|
return path;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Creates an Analyzer for the NVD VULNERABLE_CPE Index.
|
* Creates an Analyzer for the NVD VULNERABLE_CPE Index.
|
||||||
*
|
*
|
||||||
@@ -165,8 +188,14 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
*
|
*
|
||||||
* @param timeStamp the timestamp to write.
|
* @param timeStamp the timestamp to write.
|
||||||
*/
|
*/
|
||||||
private void writeLastUpdatedPropertyFile(Map<String, NvdCveUrl> updated) {
|
private void writeLastUpdatedPropertyFile(Map<String, NvdCveUrl> updated) throws UpdateException {
|
||||||
String dir = Settings.getString(Settings.KEYS.CVE_INDEX);
|
String dir;
|
||||||
|
try {
|
||||||
|
dir = getDataDirectory().getCanonicalPath();
|
||||||
|
} catch (IOException ex) {
|
||||||
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to locate last updated properties file.", ex);
|
||||||
|
}
|
||||||
File cveProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
File cveProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
||||||
Properties prop = new Properties();
|
Properties prop = new Properties();
|
||||||
|
|
||||||
@@ -181,8 +210,10 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
prop.store(out, dir);
|
prop.store(out, dir);
|
||||||
} catch (FileNotFoundException ex) {
|
} catch (FileNotFoundException ex) {
|
||||||
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to find last updated properties file.", ex);
|
||||||
} catch (IOException ex) {
|
} catch (IOException ex) {
|
||||||
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to update last updated properties file.", ex);
|
||||||
} finally {
|
} finally {
|
||||||
try {
|
try {
|
||||||
os.flush();
|
os.flush();
|
||||||
@@ -206,10 +237,11 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
* @return the NvdCveUrl of the files that need to be updated.
|
* @return the NvdCveUrl of the files that need to be updated.
|
||||||
* @throws MalformedURLException is thrown if the URL for the NVD CVE Meta
|
* @throws MalformedURLException is thrown if the URL for the NVD CVE Meta
|
||||||
* data is incorrect.
|
* data is incorrect.
|
||||||
* @throws DownloadFailedException is thrown if there is an error
|
* @throws DownloadFailedException is thrown if there is an error.
|
||||||
* downloading the nvd cve download data file.
|
* downloading the nvd cve download data file.
|
||||||
|
* @throws UpdateException Is thrown if there is an issue with the last updated properties file.
|
||||||
*/
|
*/
|
||||||
public Map<String, NvdCveUrl> updateNeeded() throws MalformedURLException, DownloadFailedException {
|
public Map<String, NvdCveUrl> updateNeeded() throws MalformedURLException, DownloadFailedException, UpdateException {
|
||||||
|
|
||||||
Map<String, NvdCveUrl> currentlyPublished;
|
Map<String, NvdCveUrl> currentlyPublished;
|
||||||
try {
|
try {
|
||||||
@@ -221,7 +253,14 @@ public class Index extends AbstractIndex implements CachedWebDataSource {
|
|||||||
if (currentlyPublished == null) {
|
if (currentlyPublished == null) {
|
||||||
throw new DownloadFailedException("Unable to retrieve valid timestamp from nvd cve downloads page");
|
throw new DownloadFailedException("Unable to retrieve valid timestamp from nvd cve downloads page");
|
||||||
}
|
}
|
||||||
String dir = Settings.getString(Settings.KEYS.CVE_INDEX);
|
String dir;
|
||||||
|
try {
|
||||||
|
dir = getDataDirectory().getCanonicalPath();
|
||||||
|
} catch (IOException ex) {
|
||||||
|
Logger.getLogger(Index.class.getName()).log(Level.SEVERE, null, ex);
|
||||||
|
throw new UpdateException("Unable to locate last updated properties file.", ex);
|
||||||
|
}
|
||||||
|
|
||||||
File f = new File(dir);
|
File f = new File(dir);
|
||||||
if (f.exists()) {
|
if (f.exists()) {
|
||||||
File cveProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
File cveProp = new File(dir + File.separatorChar + UPDATE_PROPERTIES_FILE);
|
||||||
|
|||||||
@@ -93,17 +93,20 @@ public final class CliParser {
|
|||||||
validatePathExists(getScanFiles());
|
validatePathExists(getScanFiles());
|
||||||
if (!line.hasOption(ArgumentName.OUT)) {
|
if (!line.hasOption(ArgumentName.OUT)) {
|
||||||
//TODO - need a new exception type here, this isn't really a parseexception.
|
//TODO - need a new exception type here, this isn't really a parseexception.
|
||||||
throw new ParseException("Scan cannot be run without specifying a directory to write the reports to via the 'out' argument.");
|
throw new ParseException("Scan cannot be run without specifying a directory "
|
||||||
|
+ "to write the reports to via the 'out' argument.");
|
||||||
} else {
|
} else {
|
||||||
String p = line.getOptionValue(ArgumentName.OUT, "");
|
String p = line.getOptionValue(ArgumentName.OUT, "");
|
||||||
File f = new File(p);
|
File f = new File(p);
|
||||||
if ("".equals(p) || !(f.exists() && f.isDirectory())) {
|
if ("".equals(p) || !(f.exists() && f.isDirectory())) {
|
||||||
//TODO - need a new exception type here, this isn't really a parseexception.
|
//TODO - need a new exception type here, this isn't really a parseexception.
|
||||||
throw new ParseException("A valid directory name must be specified for the 'out' argument.");
|
throw new ParseException("A valid directory name must be specified for "
|
||||||
|
+ "the 'out' argument.");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if (!line.hasOption(ArgumentName.APPNAME)) {
|
if (!line.hasOption(ArgumentName.APPNAME)) {
|
||||||
throw new ParseException("Scan cannot be run without specifying an application name via the 'app' argument.");
|
throw new ParseException("Scan cannot be run without specifying an application "
|
||||||
|
+ "name via the 'app' argument.");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -160,15 +163,25 @@ public final class CliParser {
|
|||||||
Option noupdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
|
Option noupdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
|
||||||
false, "disables the automatic updating of the CPE data.");
|
false, "disables the automatic updating of the CPE data.");
|
||||||
|
|
||||||
Option appname = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APPNAME).withDescription("the name of the application being scanned.").create(ArgumentName.APPNAME_SHORT);
|
Option appname = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APPNAME)
|
||||||
|
.withDescription("the name of the application being scanned.")
|
||||||
|
.create(ArgumentName.APPNAME_SHORT);
|
||||||
|
|
||||||
Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN).withDescription("the path to scan - this option can be specified multiple times.").create(ArgumentName.SCAN_SHORT);
|
Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
|
||||||
|
.withDescription("the path to scan - this option can be specified multiple times.")
|
||||||
|
.create(ArgumentName.SCAN_SHORT);
|
||||||
|
|
||||||
Option load = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.CPE).withDescription("load the CPE xml file.").create(ArgumentName.CPE_SHORT);
|
Option load = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.CPE)
|
||||||
|
.withDescription("load the CPE xml file.")
|
||||||
|
.create(ArgumentName.CPE_SHORT);
|
||||||
|
|
||||||
Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP).withDescription("a property file to load.").create(ArgumentName.PROP_SHORT);
|
Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP)
|
||||||
|
.withDescription("a property file to load.")
|
||||||
|
.create(ArgumentName.PROP_SHORT);
|
||||||
|
|
||||||
Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT).withDescription("the folder to write reports to.").create(ArgumentName.OUT_SHORT);
|
Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT)
|
||||||
|
.withDescription("the folder to write reports to.")
|
||||||
|
.create(ArgumentName.OUT_SHORT);
|
||||||
|
|
||||||
//TODO add the ability to load a properties file to override the defaults...
|
//TODO add the ability to load a properties file to override the defaults...
|
||||||
|
|
||||||
@@ -237,7 +250,8 @@ public final class CliParser {
|
|||||||
+ "using the -p <file> argument or by passing them in as system properties." + nl
|
+ "using the -p <file> argument or by passing them in as system properties." + nl
|
||||||
+ nl + " " + Settings.KEYS.PROXY_URL + "\t\t the proxy URL to use when downloading resources."
|
+ nl + " " + Settings.KEYS.PROXY_URL + "\t\t the proxy URL to use when downloading resources."
|
||||||
+ nl + " " + Settings.KEYS.PROXY_PORT + "\t\t the proxy port to use when downloading resources."
|
+ nl + " " + Settings.KEYS.PROXY_PORT + "\t\t the proxy port to use when downloading resources."
|
||||||
+ nl + " " + Settings.KEYS.CONNECTION_TIMEOUT + "\t the cconnection timeout (in milliseconds) to use" + nl + "\t\t\t when downloading resources.";
|
+ nl + " " + Settings.KEYS.CONNECTION_TIMEOUT + "\t the cconnection timeout (in milliseconds) to use"
|
||||||
|
+ nl + "\t\t\t when downloading resources.";
|
||||||
}
|
}
|
||||||
|
|
||||||
formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
|
formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
|
||||||
|
|||||||
@@ -20,4 +20,4 @@ java.util.logging.FileHandler.level=FINEST
|
|||||||
# %g - generation number for rotating logs
|
# %g - generation number for rotating logs
|
||||||
# %u - unique number to avoid conflicts
|
# %u - unique number to avoid conflicts
|
||||||
# FileHandler writes to %h/demo0.log by default.
|
# FileHandler writes to %h/demo0.log by default.
|
||||||
java.util.logging.FileHandler.pattern=./logs/DependencyCheck%g.log
|
java.util.logging.FileHandler.pattern=./logs/DependencyCheck%u.log
|
||||||
@@ -9,6 +9,8 @@ import java.io.BufferedOutputStream;
|
|||||||
import java.io.File;
|
import java.io.File;
|
||||||
import java.io.FileInputStream;
|
import java.io.FileInputStream;
|
||||||
import java.io.FileOutputStream;
|
import java.io.FileOutputStream;
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.net.URLDecoder;
|
||||||
import java.util.zip.ZipEntry;
|
import java.util.zip.ZipEntry;
|
||||||
import java.util.zip.ZipInputStream;
|
import java.util.zip.ZipInputStream;
|
||||||
import junit.framework.TestCase;
|
import junit.framework.TestCase;
|
||||||
@@ -30,8 +32,24 @@ public abstract class BaseIndexTestCase extends TestCase {
|
|||||||
ensureIndexExists();
|
ensureIndexExists();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
protected static File getDataDirectory() throws IOException {
|
||||||
|
String fileName = Settings.getString(Settings.KEYS.CPE_INDEX);
|
||||||
|
String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
|
||||||
|
String decodedPath = URLDecoder.decode(filePath, "UTF-8");
|
||||||
|
File exePath = new File(decodedPath);
|
||||||
|
if (exePath.getName().toLowerCase().endsWith(".jar")) {
|
||||||
|
exePath = exePath.getParentFile();
|
||||||
|
} else {
|
||||||
|
exePath = new File(".");
|
||||||
|
}
|
||||||
|
File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
|
||||||
|
path = new File(path.getCanonicalPath());
|
||||||
|
return path;
|
||||||
|
}
|
||||||
|
|
||||||
public static void ensureIndexExists() throws Exception {
|
public static void ensureIndexExists() throws Exception {
|
||||||
String indexPath = Settings.getString(Settings.KEYS.CPE_INDEX);
|
//String indexPath = Settings.getString(Settings.KEYS.CPE_INDEX);
|
||||||
|
String indexPath = getDataDirectory().getCanonicalPath();
|
||||||
java.io.File f = new File(indexPath);
|
java.io.File f = new File(indexPath);
|
||||||
if (!f.exists()) {
|
if (!f.exists()) {
|
||||||
f.mkdirs();
|
f.mkdirs();
|
||||||
|
|||||||
@@ -13,8 +13,6 @@ import org.apache.lucene.index.CorruptIndexException;
|
|||||||
import org.apache.lucene.queryParser.ParseException;
|
import org.apache.lucene.queryParser.ParseException;
|
||||||
import org.codesecure.dependencycheck.dependency.Dependency;
|
import org.codesecure.dependencycheck.dependency.Dependency;
|
||||||
import org.codesecure.dependencycheck.analyzer.JarAnalyzer;
|
import org.codesecure.dependencycheck.analyzer.JarAnalyzer;
|
||||||
import org.codesecure.dependencycheck.dependency.Evidence;
|
|
||||||
import org.codesecure.dependencycheck.dependency.Evidence.Confidence;
|
|
||||||
import org.junit.Test;
|
import org.junit.Test;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -133,6 +131,7 @@ public class CPEAnalyzerTest extends BaseIndexTestCase {
|
|||||||
expResult = "cpe:/a:apache:struts:2.3.1.2";
|
expResult = "cpe:/a:apache:struts:2.3.1.2";
|
||||||
result = instance.searchCPE(vendor, product, version);
|
result = instance.searchCPE(vendor, product, version);
|
||||||
assertEquals(expResult, result.get(0).getName());
|
assertEquals(expResult, result.get(0).getName());
|
||||||
|
|
||||||
instance.close();
|
instance.close();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -40,35 +40,6 @@ public class IndexIntegrationTest extends BaseIndexTestCase {
|
|||||||
public void tearDown() {
|
public void tearDown() {
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Test of open method, of class Index.
|
|
||||||
*/
|
|
||||||
@Test
|
|
||||||
public void testOpen() {
|
|
||||||
System.out.println("open");
|
|
||||||
Index instance = new Index();
|
|
||||||
try {
|
|
||||||
instance.open();
|
|
||||||
} catch (IOException ex) {
|
|
||||||
fail(ex.getMessage());
|
|
||||||
}
|
|
||||||
instance.close();
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Test of getDirectory method, of class Index.
|
|
||||||
*/
|
|
||||||
@Test
|
|
||||||
public void testGetDirectory() throws Exception {
|
|
||||||
System.out.println("getDirectory");
|
|
||||||
Index index = new Index();
|
|
||||||
Directory result = index.getDirectory();
|
|
||||||
|
|
||||||
String exp = File.separatorChar + "target" + File.separatorChar + "data" + File.separatorChar + "cpe";
|
|
||||||
// TODO review the generated test code and remove the default call to fail.
|
|
||||||
assertTrue(result.toString().contains(exp));
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Test of update method, of class Index.
|
* Test of update method, of class Index.
|
||||||
*/
|
*/
|
||||||
|
|||||||
@@ -0,0 +1,71 @@
|
|||||||
|
/*
|
||||||
|
* To change this template, choose Tools | Templates
|
||||||
|
* and open the template in the editor.
|
||||||
|
*/
|
||||||
|
package org.codesecure.dependencycheck.data.cpe;
|
||||||
|
|
||||||
|
import java.io.File;
|
||||||
|
import java.io.IOException;
|
||||||
|
import org.apache.lucene.store.Directory;
|
||||||
|
import org.junit.After;
|
||||||
|
import org.junit.AfterClass;
|
||||||
|
import org.junit.Before;
|
||||||
|
import org.junit.BeforeClass;
|
||||||
|
import org.junit.Test;
|
||||||
|
import static org.junit.Assert.*;
|
||||||
|
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||||
|
*/
|
||||||
|
public class IndexTest extends BaseIndexTestCase {
|
||||||
|
|
||||||
|
public IndexTest(String testCase) {
|
||||||
|
super(testCase);
|
||||||
|
}
|
||||||
|
|
||||||
|
@BeforeClass
|
||||||
|
public static void setUpClass() throws Exception {
|
||||||
|
}
|
||||||
|
|
||||||
|
@AfterClass
|
||||||
|
public static void tearDownClass() throws Exception {
|
||||||
|
}
|
||||||
|
|
||||||
|
@Before
|
||||||
|
public void setUp() {
|
||||||
|
}
|
||||||
|
|
||||||
|
@After
|
||||||
|
public void tearDown() {
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Test of open method, of class Index.
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testOpen() {
|
||||||
|
System.out.println("open");
|
||||||
|
Index instance = new Index();
|
||||||
|
try {
|
||||||
|
instance.open();
|
||||||
|
} catch (IOException ex) {
|
||||||
|
fail(ex.getMessage());
|
||||||
|
}
|
||||||
|
instance.close();
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Test of getDirectory method, of class Index.
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testGetDirectory() throws Exception {
|
||||||
|
System.out.println("getDirectory");
|
||||||
|
Index index = new Index();
|
||||||
|
Directory result = index.getDirectory();
|
||||||
|
|
||||||
|
String exp = File.separatorChar + "target" + File.separatorChar + "data" + File.separatorChar + "cpe";
|
||||||
|
// TODO review the generated test code and remove the default call to fail.
|
||||||
|
assertTrue(result.toString().contains(exp));
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -10,6 +10,8 @@ import java.io.BufferedOutputStream;
|
|||||||
import java.io.File;
|
import java.io.File;
|
||||||
import java.io.FileInputStream;
|
import java.io.FileInputStream;
|
||||||
import java.io.FileOutputStream;
|
import java.io.FileOutputStream;
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.net.URLDecoder;
|
||||||
import java.util.zip.ZipEntry;
|
import java.util.zip.ZipEntry;
|
||||||
import java.util.zip.ZipInputStream;
|
import java.util.zip.ZipInputStream;
|
||||||
import junit.framework.TestCase;
|
import junit.framework.TestCase;
|
||||||
@@ -31,8 +33,25 @@ public abstract class BaseIndexTestCase extends TestCase {
|
|||||||
ensureIndexExists();
|
ensureIndexExists();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
protected static File getDataDirectory() throws IOException {
|
||||||
|
String fileName = Settings.getString(Settings.KEYS.CVE_INDEX);
|
||||||
|
String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
|
||||||
|
String decodedPath = URLDecoder.decode(filePath, "UTF-8");
|
||||||
|
File exePath = new File(decodedPath);
|
||||||
|
if (exePath.getName().toLowerCase().endsWith(".jar")) {
|
||||||
|
exePath = exePath.getParentFile();
|
||||||
|
} else {
|
||||||
|
exePath = new File( "." );
|
||||||
|
}
|
||||||
|
File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
|
||||||
|
path = new File(path.getCanonicalPath());
|
||||||
|
return path;
|
||||||
|
}
|
||||||
|
|
||||||
public static void ensureIndexExists() throws Exception {
|
public static void ensureIndexExists() throws Exception {
|
||||||
String indexPath = Settings.getString(Settings.KEYS.CVE_INDEX);
|
//String indexPath = Settings.getString(Settings.KEYS.CVE_INDEX);
|
||||||
|
String indexPath = getDataDirectory().getCanonicalPath();
|
||||||
java.io.File f = new File(indexPath);
|
java.io.File f = new File(indexPath);
|
||||||
if (!f.exists()) {
|
if (!f.exists()) {
|
||||||
f.mkdirs();
|
f.mkdirs();
|
||||||
|
|||||||
@@ -4,11 +4,8 @@
|
|||||||
*/
|
*/
|
||||||
package org.codesecure.dependencycheck.data.nvdcve;
|
package org.codesecure.dependencycheck.data.nvdcve;
|
||||||
|
|
||||||
import java.io.File;
|
|
||||||
import java.util.Map;
|
import java.util.Map;
|
||||||
import org.apache.lucene.store.Directory;
|
|
||||||
import static org.junit.Assert.assertEquals;
|
|
||||||
import static org.junit.Assert.assertTrue;
|
|
||||||
import org.junit.*;
|
import org.junit.*;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -48,18 +45,6 @@ public class IndexIntegrationTest extends BaseIndexTestCase {
|
|||||||
assertEquals(12, result.size());
|
assertEquals(12, result.size());
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Test of getDirectory method, of class Index.
|
|
||||||
*/
|
|
||||||
@Test
|
|
||||||
public void testGetDirectory() throws Exception {
|
|
||||||
System.out.println("getDirectory");
|
|
||||||
Index instance = new Index();
|
|
||||||
String exp = File.separatorChar + "target" + File.separatorChar + "data" + File.separatorChar + "cve";
|
|
||||||
Directory result = instance.getDirectory();
|
|
||||||
assertTrue(result.toString().contains(exp));
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Test of update method, of class Index.
|
* Test of update method, of class Index.
|
||||||
*/
|
*/
|
||||||
@@ -81,5 +66,4 @@ public class IndexIntegrationTest extends BaseIndexTestCase {
|
|||||||
//if an exception is thrown this test fails. However, because it depends on the
|
//if an exception is thrown this test fails. However, because it depends on the
|
||||||
// order of the tests what this will return I am just testing for the exception.
|
// order of the tests what this will return I am just testing for the exception.
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,50 @@
|
|||||||
|
/*
|
||||||
|
* To change this template, choose Tools | Templates
|
||||||
|
* and open the template in the editor.
|
||||||
|
*/
|
||||||
|
package org.codesecure.dependencycheck.data.nvdcve;
|
||||||
|
|
||||||
|
import java.io.File;
|
||||||
|
import org.apache.lucene.store.Directory;
|
||||||
|
import static org.junit.Assert.assertTrue;
|
||||||
|
import org.junit.*;
|
||||||
|
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
* @author Jeremy
|
||||||
|
*/
|
||||||
|
public class IndexTest extends BaseIndexTestCase {
|
||||||
|
|
||||||
|
public IndexTest(String testName) {
|
||||||
|
super(testName);
|
||||||
|
}
|
||||||
|
|
||||||
|
@BeforeClass
|
||||||
|
public static void setUpClass() throws Exception {
|
||||||
|
}
|
||||||
|
|
||||||
|
@AfterClass
|
||||||
|
public static void tearDownClass() throws Exception {
|
||||||
|
}
|
||||||
|
|
||||||
|
@Before
|
||||||
|
public void setUp() {
|
||||||
|
}
|
||||||
|
|
||||||
|
@After
|
||||||
|
public void tearDown() {
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Test of getDirectory method, of class Index.
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testGetDirectory() throws Exception {
|
||||||
|
System.out.println("getDirectory");
|
||||||
|
Index instance = new Index();
|
||||||
|
String exp = File.separatorChar + "target" + File.separatorChar + "data" + File.separatorChar + "cve";
|
||||||
|
Directory result = instance.getDirectory();
|
||||||
|
|
||||||
|
assertTrue(result.toString().contains(exp));
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user