added additional fine grained logging

Former-commit-id: 782dca3f3ed72da8e6c0b4eb9ee38783dd5690c8

dependency-check-ant/pom.xml

@@ -20,7 +20,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.2.6</version>
+        <version>1.2.7</version>
     </parent>
 
     <artifactId>dependency-check-ant</artifactId>

dependency-check-cli/pom.xml

@@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.2.6</version>
+        <version>1.2.7</version>
     </parent>
 
     <artifactId>dependency-check-cli</artifactId>

dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java

@@ -139,10 +139,13 @@ public final class CliParser {
             final String msg = String.format("Invalid '%s' argument: null", argumentName);
             throw new FileNotFoundException(msg);
         } else if (!path.contains("*") && !path.contains("?")) {
-            final File f = new File(path);
+            File f = new File(path);
             if ("o".equals(argumentName.substring(0, 1).toLowerCase()) && !"ALL".equals(this.getReportFormat().toUpperCase())) {
                 final String checkPath = path.toLowerCase();
                 if (checkPath.endsWith(".html") || checkPath.endsWith(".xml") || checkPath.endsWith(".htm")) {
+                    if (f.getParentFile() == null) {
+                        f = new File(".", path);
+                    }
                     if (!f.getParentFile().isDirectory()) {
                         isValid = false;
                         final String msg = String.format("Invalid '%s' argument: '%s'", argumentName, path);
@@ -664,8 +667,8 @@ public final class CliParser {
      */
     public void printVersionInfo() {
         final String version = String.format("%s version %s",
-                Settings.getString("application.name", "DependencyCheck"),
-                Settings.getString("application.version", "Unknown"));
+                Settings.getString(Settings.KEYS.APPLICATION_VAME, "dependency-check"),
+                Settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown"));
         System.out.println(version);
     }
 

dependency-check-cli/src/main/java/org/owasp/dependencycheck/InvalidScanPathException.java

@@ -1,17 +1,19 @@
 /*
- * Copyright 2014 OWASP.
+ * This file is part of dependency-check-cli.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      http://www.apache.org/licenses/LICENSE-2.0
+ *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
  */
 package org.owasp.dependencycheck;
 

dependency-check-core/pom.xml

@@ -20,7 +20,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.2.6</version>
+        <version>1.2.7</version>
     </parent>
 
     <artifactId>dependency-check-core</artifactId>
@@ -419,12 +419,12 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
             <version>4.3.1</version>
             <scope>test</scope>
         </dependency>
-        <!--dependency>
+        <dependency>
             <groupId>org.jmockit</groupId>
             <artifactId>jmockit</artifactId>
             <version>1.12</version>
             <scope>test</scope>
-        </dependency-->
+        </dependency>
         <dependency>
             <groupId>com.google.code.findbugs</groupId>
             <artifactId>annotations</artifactId>

dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java

@@ -18,7 +18,6 @@
 package org.owasp.dependencycheck;
 
 import java.io.File;
-import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.EnumMap;
 import java.util.HashSet;
@@ -32,8 +31,6 @@ import org.owasp.dependencycheck.analyzer.Analyzer;
 import org.owasp.dependencycheck.analyzer.AnalyzerService;
 import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer;
 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
-import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
-import org.owasp.dependencycheck.data.cpe.IndexException;
 import org.owasp.dependencycheck.data.nvdcve.ConnectionFactory;
 import org.owasp.dependencycheck.data.nvdcve.CveDB;
 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
@@ -53,28 +50,30 @@ import org.owasp.dependencycheck.utils.Settings;
  *
  * @author Jeremy Long <jeremy.long@owasp.org>
  */
-public class Engine implements Serializable {
+public class Engine {
 
     /**
      * The list of dependencies.
      */
-    private List<Dependency> dependencies;
+    private List<Dependency> dependencies = new ArrayList<Dependency>();
     /**
      * A Map of analyzers grouped by Analysis phase.
      */
-    private final transient EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
+    private EnumMap<AnalysisPhase, List<Analyzer>> analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
+
     /**
      * A Map of analyzers grouped by Analysis phase.
      */
-    private final transient Set<FileTypeAnalyzer> fileTypeAnalyzers;
+    private Set<FileTypeAnalyzer> fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
+
     /**
      * The ClassLoader to use when dynamically loading Analyzer and Update services.
      */
-    private transient ClassLoader serviceClassLoader;
+    private ClassLoader serviceClassLoader = Thread.currentThread().getContextClassLoader();
     /**
      * The Logger for use throughout the class.
      */
-    private static final transient Logger LOGGER = Logger.getLogger(Engine.class.getName());
+    private static final Logger LOGGER = Logger.getLogger(Engine.class.getName());
 
     /**
      * Creates a new Engine.
@@ -82,32 +81,27 @@ public class Engine implements Serializable {
      * @throws DatabaseException thrown if there is an error connecting to the database
      */
     public Engine() throws DatabaseException {
-        this(Thread.currentThread().getContextClassLoader());
+        initializeEngine();
+    }
+
+    /**
+     * Creates a new Engine.
+     *
+     * @param serviceClassLoader a reference the class loader being used
+     * @throws DatabaseException thrown if there is an error connecting to the database
+     */
+    public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
+        this.serviceClassLoader = serviceClassLoader;
+        initializeEngine();
     }
 
     /**
      * Creates a new Engine using the specified classloader to dynamically load Analyzer and Update services.
      *
-     * @param serviceClassLoader the ClassLoader to use when dynamically loading Analyzer and Update services
      * @throws DatabaseException thrown if there is an error connecting to the database
      */
-    public Engine(ClassLoader serviceClassLoader) throws DatabaseException {
-        this.dependencies = new ArrayList<Dependency>();
-        this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
-        this.fileTypeAnalyzers = new HashSet<FileTypeAnalyzer>();
-        this.serviceClassLoader = serviceClassLoader;
-
+    protected final void initializeEngine() throws DatabaseException {
         ConnectionFactory.initialize();
-
-        boolean autoUpdate = true;
-        try {
-            autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
-        } catch (InvalidSettingException ex) {
-            LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true.");
-        }
-        if (autoUpdate) {
-            doUpdates();
-        }
         loadAnalyzers();
     }
 
@@ -122,7 +116,9 @@ public class Engine implements Serializable {
      * Loads the analyzers specified in the configuration file (or system properties).
      */
     private void loadAnalyzers() {
-
+        if (analyzers.size() > 0) {
+            return;
+        }
         for (AnalysisPhase phase : AnalysisPhase.values()) {
             analyzers.put(phase, new ArrayList<Analyzer>());
         }
@@ -159,9 +155,6 @@ public class Engine implements Serializable {
 
     public void setDependencies(List<Dependency> dependencies) {
         this.dependencies = dependencies;
-        //for (Dependency dependency: dependencies) {
-        //    dependencies.add(dependency);
-        //}
     }
 
     /**
@@ -339,6 +332,16 @@ public class Engine implements Serializable {
      * Runs the analyzers against all of the dependencies.
      */
     public void analyzeDependencies() {
+        boolean autoUpdate = true;
+        try {
+            autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+        } catch (InvalidSettingException ex) {
+            LOGGER.log(Level.FINE, "Invalid setting for auto-update; using true.");
+        }
+        if (autoUpdate) {
+            doUpdates();
+        }
+
         //need to ensure that data exists
         try {
             ensureDataExists();
@@ -367,7 +370,7 @@ public class Engine implements Serializable {
             final List<Analyzer> analyzerList = analyzers.get(phase);
 
             for (Analyzer a : analyzerList) {
-                initializeAnalyzer(a);
+                a = initializeAnalyzer(a);
 
                 /* need to create a copy of the collection because some of the
                  * analyzers may modify it. This prevents ConcurrentModificationExceptions.
@@ -422,8 +425,9 @@ public class Engine implements Serializable {
      * Initializes the given analyzer.
      *
      * @param analyzer the analyzer to initialize
+     * @return the initialized analyzer
      */
-    private void initializeAnalyzer(Analyzer analyzer) {
+    protected Analyzer initializeAnalyzer(Analyzer analyzer) {
         try {
             final String msg = String.format("Initializing %s", analyzer.getName());
             LOGGER.log(Level.FINE, msg);
@@ -438,6 +442,7 @@ public class Engine implements Serializable {
                 LOGGER.log(Level.FINEST, null, ex1);
             }
         }
+        return analyzer;
     }
 
     /**
@@ -445,7 +450,7 @@ public class Engine implements Serializable {
      *
      * @param analyzer the analyzer to close
      */
-    private void closeAnalyzer(Analyzer analyzer) {
+    protected void closeAnalyzer(Analyzer analyzer) {
         final String msg = String.format("Closing Analyzer '%s'", analyzer.getName());
         LOGGER.log(Level.FINE, msg);
         try {
@@ -459,6 +464,7 @@ public class Engine implements Serializable {
      * Cycles through the cached web data sources and calls update on all of them.
      */
     private void doUpdates() {
+        LOGGER.info("Checking for updates");
         final UpdateService service = new UpdateService(serviceClassLoader);
         final Iterator<CachedWebDataSource> iterator = service.getDataSources();
         while (iterator.hasNext()) {
@@ -471,6 +477,7 @@ public class Engine implements Serializable {
                 LOGGER.log(Level.FINE, String.format("Unable to update details for %s", source.getClass().getName()), ex);
             }
         }
+        LOGGER.info("Check for updates complete");
     }
 
     /**
@@ -513,22 +520,16 @@ public class Engine implements Serializable {
      * @throws DatabaseException thrown if there is an exception opening the database
      */
     private void ensureDataExists() throws NoDataException, DatabaseException {
-        final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
         final CveDB cve = new CveDB();
-
         try {
             cve.open();
-            cpe.open(cve);
-        } catch (IndexException ex) {
-            throw new NoDataException(ex.getMessage(), ex);
+            if (!cve.dataExists()) {
+                throw new NoDataException("No documents exist");
+            }
         } catch (DatabaseException ex) {
             throw new NoDataException(ex.getMessage(), ex);
         } finally {
             cve.close();
         }
-        if (cpe.numDocs() <= 0) {
-            cpe.close();
-            throw new NoDataException("No documents exist");
-        }
     }
 }

dependency-check-core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java

@@ -440,6 +440,52 @@ public class DependencyCheckScanAgent {
         this.showSummary = showSummary;
     }
 
+    /**
+     * Whether or not the Maven Central analyzer is enabled.
+     */
+    private boolean centralAnalyzerEnabled = true;
+
+    /**
+     * Get the value of centralAnalyzerEnabled.
+     *
+     * @return the value of centralAnalyzerEnabled
+     */
+    public boolean isCentralAnalyzerEnabled() {
+        return centralAnalyzerEnabled;
+    }
+
+    /**
+     * Set the value of centralAnalyzerEnabled.
+     *
+     * @param centralAnalyzerEnabled new value of centralAnalyzerEnabled
+     */
+    public void setCentralAnalyzerEnabled(boolean centralAnalyzerEnabled) {
+        this.centralAnalyzerEnabled = centralAnalyzerEnabled;
+    }
+
+    /**
+     * The URL of Maven Central.
+     */
+    private String centralUrl;
+
+    /**
+     * Get the value of centralUrl.
+     *
+     * @return the value of centralUrl
+     */
+    public String getCentralUrl() {
+        return centralUrl;
+    }
+
+    /**
+     * Set the value of centralUrl.
+     *
+     * @param centralUrl new value of centralUrl
+     */
+    public void setCentralUrl(String centralUrl) {
+        this.centralUrl = centralUrl;
+    }
+
     /**
      * Whether or not the nexus analyzer is enabled.
      */
@@ -849,6 +895,10 @@ public class DependencyCheckScanAgent {
         if (suppressionFile != null && !suppressionFile.isEmpty()) {
             Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
         }
+        Settings.setBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, centralAnalyzerEnabled);
+        if (centralUrl != null && !centralUrl.isEmpty()) {
+            Settings.setString(Settings.KEYS.ANALYZER_CENTRAL_URL, centralUrl);
+        }
         Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
         if (nexusUrl != null && !nexusUrl.isEmpty()) {
             Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java

@@ -338,7 +338,7 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
             try {
                 fis.close();
             } catch (IOException ex) {
-                LOGGER.log(Level.FINEST, null, ex);
+                LOGGER.log(Level.FINE, null, ex);
             }
         }
     }
@@ -367,8 +367,10 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
                     final File file = new File(destination, entry.getName());
                     final String ext = FileUtils.getFileExtension(file.getName());
                     if (engine.supportsExtension(ext)) {
+                        final String extracting = String.format("Extracting '%s'", file.getPath());
+                        LOGGER.fine(extracting);
                         BufferedOutputStream bos = null;
-                        FileOutputStream fos;
+                        FileOutputStream fos = null;
                         try {
                             final File parent = file.getParentFile();
                             if (!parent.isDirectory()) {
@@ -401,6 +403,13 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
                                     LOGGER.log(Level.FINEST, null, ex);
                                 }
                             }
+                            if (fos != null) {
+                                try {
+                                    fos.close();
+                                } catch (IOException ex) {
+                                    LOGGER.log(Level.FINEST, null, ex);
+                                }
+                            }
                         }
                     }
                 }
@@ -428,6 +437,8 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
      * @throws ArchiveExtractionException thrown if there is an exception decompressing the file
      */
     private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
+        final String msg = String.format("Decompressing '%s'", outputFile.getPath());
+        LOGGER.fine(msg);
         FileOutputStream out = null;
         try {
             out = new FileOutputStream(outputFile);

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

@@ -120,11 +120,11 @@ public class AssemblyAnalyzer extends AbstractFileTypeAnalyzer {
             // Try evacuating the error stream
             rdr = new BufferedReader(new InputStreamReader(proc.getErrorStream(), "UTF-8"));
             String line = null;
-            // CheckStyle:VisibilityModifier OFF
+            // CHECKSTYLE:OFF
             while (rdr.ready() && (line = rdr.readLine()) != null) {
                 LOGGER.log(Level.WARNING, "analyzer.AssemblyAnalyzer.grokassembly.stderr", line);
             }
-            // CheckStyle:VisibilityModifier ON
+            // CHECKSTYLE:ON
             int rc = 0;
             doc = builder.parse(proc.getInputStream());
 
@@ -235,11 +235,11 @@ public class AssemblyAnalyzer extends AbstractFileTypeAnalyzer {
             final Process p = pb.start();
             // Try evacuating the error stream
             rdr = new BufferedReader(new InputStreamReader(p.getErrorStream(), "UTF-8"));
-            // CheckStyle:VisibilityModifier OFF
+            // CHECKSTYLE:OFF
             while (rdr.ready() && rdr.readLine() != null) {
                 // We expect this to complain
             }
-            // CheckStyle:VisibilityModifier ON
+            // CHECKSTYLE:ON
             final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
             final XPath xpath = XPathFactory.newInstance().newXPath();
             final String error = xpath.evaluate("/assembly/error", doc);

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CentralAnalyzer.java

@@ -99,7 +99,7 @@ public class CentralAnalyzer extends AbstractFileTypeAnalyzer {
             if (Settings.getBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED)) {
                 if (!Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)
                         || NexusAnalyzer.DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL))) {
-                    LOGGER.info("Enabling the Central analyzer");
+                    LOGGER.fine("Enabling the Central analyzer");
                     retval = true;
                 } else {
                     LOGGER.info("Nexus analyzer is enabled, disabling the Central Analyzer");

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java

@@ -55,7 +55,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
     /**
      * A pattern for obtaining the first part of a filename.
      */
-    private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*");
+    private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z0-9]*");
     /**
      * a flag indicating if this analyzer has run. This analyzer only runs once.
      */
@@ -107,7 +107,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
             //for (Dependency nextDependency : engine.getDependencies()) {
             while (mainIterator.hasNext()) {
                 final Dependency dependency = mainIterator.next();
-                if (mainIterator.hasNext()) {
+                if (mainIterator.hasNext() && !dependenciesToRemove.contains(dependency)) {
                     final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
                     while (subIterator.hasNext()) {
                         final Dependency nextDependency = subIterator.next();
@@ -116,12 +116,16 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
                                 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                             } else {
                                 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+                                break; //since we merged into the next dependency - skip forward to the next in mainIterator
                             }
                         } else if (isShadedJar(dependency, nextDependency)) {
                             if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {
-                                dependenciesToRemove.add(dependency);
+                                mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+                                nextDependency.getRelatedDependencies().remove(dependency);
+                                break;
                             } else {
-                                dependenciesToRemove.add(nextDependency);
+                                mergeDependencies(dependency, nextDependency, dependenciesToRemove);
+                                nextDependency.getRelatedDependencies().remove(nextDependency);
                             }
                         } else if (cpeIdentifiersMatch(dependency, nextDependency)
                                 && hasSameBasePath(dependency, nextDependency)
@@ -131,6 +135,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
                                 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                             } else {
                                 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+                                break; //since we merged into the next dependency - skip forward to the next in mainIterator
                             }
                         }
                     }
@@ -138,9 +143,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
             }
             //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions
             // was difficult because of the inner iterator.
-            for (Dependency d : dependenciesToRemove) {
-                engine.getDependencies().remove(d);
-            }
+            engine.getDependencies().removeAll(dependenciesToRemove);
         }
     }
 
@@ -201,26 +204,24 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
                 || dependency2 == null || dependency2.getFileName() == null) {
             return false;
         }
-        String fileName1 = dependency1.getFileName();
-        String fileName2 = dependency2.getFileName();
-
-        //update to deal with archive analyzer, the starting name maybe the same
-        // as this is incorrectly looking at the starting path
-        final File one = new File(fileName1);
-        final File two = new File(fileName2);
-        final String oneParent = one.getParent();
-        final String twoParent = two.getParent();
-        if (oneParent != null) {
-            if (oneParent.equals(twoParent)) {
-                fileName1 = one.getName();
-                fileName2 = two.getName();
-            } else {
-                return false;
-            }
-        } else if (twoParent != null) {
-            return false;
-        }
+        final String fileName1 = dependency1.getActualFile().getName();
+        final String fileName2 = dependency2.getActualFile().getName();
 
+//        //REMOVED because this is attempting to duplicate what is in the hasSameBasePath function.
+//        final File one = new File(fileName1);
+//        final File two = new File(fileName2);
+//        final String oneParent = one.getParent();
+//        final String twoParent = two.getParent();
+//        if (oneParent != null) {
+//            if (oneParent.equals(twoParent)) {
+//                fileName1 = one.getName();
+//                fileName2 = two.getName();
+//            } else {
+//                return false;
+//            }
+//        } else if (twoParent != null) {
+//            return false;
+//        }
         //version check
         final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
         final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
@@ -267,9 +268,11 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
         }
         if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
             for (Identifier i : dependency1.getIdentifiers()) {
-                matches |= dependency2.getIdentifiers().contains(i);
-                if (!matches) {
-                    break;
+                if ("cpe".equals(i.getType())) {
+                    matches |= dependency2.getIdentifiers().contains(i);
+                    if (!matches) {
+                        break;
+                    }
                 }
             }
         }
@@ -338,6 +341,10 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
                 || !rightName.contains("core") && leftName.contains("core")
                 || !rightName.contains("kernel") && leftName.contains("kernel")) {
             returnVal = true;
+//        } else if (leftName.matches(".*struts2\\-core.*") && rightName.matches(".*xwork\\-core.*")) {
+//            returnVal = true;
+//        } else if (rightName.matches(".*struts2\\-core.*") && leftName.matches(".*xwork\\-core.*")) {
+//            returnVal = false;
         } else {
             /*
              * considered splitting the names up and comparing the components,

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java

@@ -101,7 +101,7 @@ public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
                 LOGGER.info("Enabling Nexus analyzer");
                 retval = true;
             } else {
-                LOGGER.info("Nexus analyzer disabled, using Central instead");
+                LOGGER.fine("Nexus analyzer disabled, using Central instead");
             }
         } catch (InvalidSettingException ise) {
             LOGGER.warning("Invalid setting. Disabling Nexus analyzer");

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java

@@ -17,6 +17,7 @@
  */
 package org.owasp.dependencycheck.data.nvdcve;
 
+import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.sql.Connection;
 import java.sql.PreparedStatement;
@@ -39,6 +40,7 @@ import org.owasp.dependencycheck.utils.DBUtils;
 import org.owasp.dependencycheck.utils.DependencyVersion;
 import org.owasp.dependencycheck.utils.DependencyVersionUtil;
 import org.owasp.dependencycheck.utils.Pair;
+import org.owasp.dependencycheck.utils.Settings;
 
 /**
  * The database holding information about the NVD CVE data.
@@ -87,7 +89,9 @@ public class CveDB {
      * @throws DatabaseException thrown if there is an error opening the database connection
      */
     public final void open() throws DatabaseException {
-        conn = ConnectionFactory.getConnection();
+        if (!isOpen()) {
+            conn = ConnectionFactory.getConnection();
+        }
     }
 
     /**
@@ -700,6 +704,43 @@ public class CveDB {
         }
     }
 
+    /**
+     * Checks to see if data exists so that analysis can be performed.
+     *
+     * @return <code>true</code> if data exists; otherwise <code>false</code>
+     */
+    public boolean dataExists() {
+        Statement cs = null;
+        ResultSet rs = null;
+        try {
+            cs = conn.createStatement();
+            rs = cs.executeQuery("SELECT COUNT(*) records FROM cpeEntry");
+            if (rs.next()) {
+                if (rs.getInt(1) > 0) {
+                    return true;
+                }
+            }
+        } catch (SQLException ex) {
+            String dd;
+            try {
+                dd = Settings.getDataDirectory().getAbsolutePath();
+            } catch (IOException ex1) {
+                dd = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+            }
+            final String msg = String.format("Unable to access the local database.%n%nEnsure that '%s' is a writable directory. "
+                    + "If the problem persist try deleting the files in '%s' and running %s again. If the problem continues, please "
+                    + "create a log file (see documentation at http://jeremylong.github.io/DependencyCheck/) and open a ticket at "
+                    + "https://github.com/jeremylong/DependencyCheck/issues and include the log file.%n%n",
+                    dd, dd, Settings.getString(Settings.KEYS.APPLICATION_VAME));
+            LOGGER.log(Level.SEVERE, msg);
+            LOGGER.log(Level.FINE, "", ex);
+        } finally {
+            DBUtils.closeResultSet(rs);
+            DBUtils.closeStatement(cs);
+        }
+        return false;
+    }
+
     /**
      * It is possible that orphaned rows may be generated during database updates. This should be called after all
      * updates have been completed to ensure orphan entries are removed.

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java

@@ -91,7 +91,7 @@ public class DatabaseProperties {
     }
 
     /**
-     * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
+     * Saves the last updated information to the properties file.
      *
      * @param updatedValue the updated NVD CVE entry
      * @throws UpdateException is thrown if there is an update exception
@@ -100,8 +100,19 @@ public class DatabaseProperties {
         if (updatedValue == null) {
             return;
         }
-        properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
-        cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+        save(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+    }
+
+    /**
+     * Saves the key value pair to the properties store.
+     *
+     * @param key the property key
+     * @param value the property value
+     * @throws UpdateException is thrown if there is an update exception
+     */
+    public void save(String key, String value) throws UpdateException {
+        properties.put(key, value);
+        cveDB.saveProperty(key, value);
     }
 
     /**

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java

@@ -0,0 +1,214 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Date;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.commons.io.IOUtils;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+import org.owasp.dependencycheck.data.update.exception.UpdateException;
+import org.owasp.dependencycheck.utils.DateUtil;
+import org.owasp.dependencycheck.utils.DependencyVersion;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.URLConnectionFactory;
+import org.owasp.dependencycheck.utils.URLConnectionFailureException;
+
+/**
+ *
+ * @author Jeremy Long <jeremy.long@owasp.org>
+ */
+public class EngineVersionCheck implements CachedWebDataSource {
+
+    /**
+     * Static logger.
+     */
+    private static final Logger LOGGER = Logger.getLogger(EngineVersionCheck.class.getName());
+    /**
+     * The property key indicating when the last version check occurred.
+     */
+    public static final String ENGINE_VERSION_CHECKED_ON = "VersionCheckOn";
+    /**
+     * The property key indicating when the last version check occurred.
+     */
+    public static final String CURRENT_ENGINE_RELEASE = "CurrentEngineRelease";
+    /**
+     * Reference to the Cve Database.
+     */
+    private CveDB cveDB = null;
+
+    /**
+     * The version retrieved from the database properties or web to check against.
+     */
+    private String updateToVersion;
+
+    /**
+     * Getter for updateToVersion - only used for testing. Represents the version retrieved from the database.
+     *
+     * @return the version to test
+     */
+    protected String getUpdateToVersion() {
+        return updateToVersion;
+    }
+
+    /**
+     * Setter for updateToVersion - only used for testing. Represents the version retrieved from the database.
+     *
+     * @param version the version to test
+     */
+    protected void setUpdateToVersion(String version) {
+        updateToVersion = version;
+    }
+
+    @Override
+    public void update() throws UpdateException {
+        try {
+            openDatabase();
+            LOGGER.fine("Begin Engine Version Check");
+            final DatabaseProperties properties = cveDB.getDatabaseProperties();
+            final long lastChecked = Long.parseLong(properties.getProperty(ENGINE_VERSION_CHECKED_ON, "0"));
+            final long now = (new Date()).getTime();
+            updateToVersion = properties.getProperty(CURRENT_ENGINE_RELEASE, "");
+            final String currentVersion = Settings.getString(Settings.KEYS.APPLICATION_VERSION, "0.0.0");
+            LOGGER.fine("Last checked: " + lastChecked);
+            LOGGER.fine("Now: " + now);
+            LOGGER.fine("Current version: " + currentVersion);
+            final boolean updateNeeded = shouldUpdate(lastChecked, now, properties, currentVersion);
+            if (updateNeeded) {
+                final String msg = String.format("A new version of dependency-check is available. Consider updating to version %s.",
+                        updateToVersion);
+                LOGGER.warning(msg);
+            }
+        } catch (DatabaseException ex) {
+            LOGGER.log(Level.FINE, "Database Exception opening databases to retrieve properties", ex);
+            throw new UpdateException("Error occured updating database properties.");
+        } finally {
+            closeDatabase();
+        }
+    }
+
+    /**
+     * Determines if a new version of the dependency-check engine has been released.
+     *
+     * @param lastChecked the epoch time of the last version check
+     * @param now the current epoch time
+     * @param properties the database properties object
+     * @param currentVersion the current version of dependency-check
+     * @return <code>true</code> if a newer version of the database has been released; otherwise <code>false</code>
+     * @throws UpdateException thrown if there is an error connecting to the github documentation site or accessing the
+     * local database.
+     */
+    protected boolean shouldUpdate(final long lastChecked, final long now, final DatabaseProperties properties,
+            String currentVersion) throws UpdateException {
+        //check every 30 days if we know there is an update, otherwise check every 7 days
+        int checkRange = 30;
+        if (updateToVersion.isEmpty()) {
+            checkRange = 7;
+        }
+        if (!DateUtil.withinDateRange(lastChecked, now, checkRange)) {
+            LOGGER.fine("Checking web for new version.");
+            final String currentRelease = getCurrentReleaseVersion();
+            if (currentRelease != null) {
+                final DependencyVersion v = new DependencyVersion(currentRelease);
+                if (v.getVersionParts() != null && v.getVersionParts().size() >= 3) {
+                    updateToVersion = v.toString();
+                    if (!currentRelease.equals(updateToVersion)) {
+                        properties.save(CURRENT_ENGINE_RELEASE, updateToVersion);
+                    } else {
+                        properties.save(CURRENT_ENGINE_RELEASE, "");
+                    }
+                    properties.save(ENGINE_VERSION_CHECKED_ON, Long.toString(now));
+                }
+            }
+            LOGGER.log(Level.FINE, "Current Release: {0}", updateToVersion);
+        }
+        final DependencyVersion running = new DependencyVersion(currentVersion);
+        final DependencyVersion released = new DependencyVersion(updateToVersion);
+        if (running.compareTo(released) < 0) {
+            LOGGER.fine("Upgrade recommended");
+            return true;
+        }
+        LOGGER.fine("Upgrade not needed");
+        return false;
+    }
+
+    /**
+     * Opens the CVE and CPE data stores.
+     *
+     * @throws DatabaseException thrown if a data store cannot be opened
+     */
+    protected final void openDatabase() throws DatabaseException {
+        if (cveDB != null) {
+            return;
+        }
+        cveDB = new CveDB();
+        cveDB.open();
+    }
+
+    /**
+     * Closes the CVE and CPE data stores.
+     */
+    protected void closeDatabase() {
+        if (cveDB != null) {
+            try {
+                cveDB.close();
+            } catch (Throwable ignore) {
+                LOGGER.log(Level.FINEST, "Error closing the cveDB", ignore);
+            }
+        }
+    }
+
+    /**
+     * Retrieves the current released version number from the github documentation site.
+     *
+     * @return the current released version number
+     */
+    protected String getCurrentReleaseVersion() {
+        HttpURLConnection conn = null;
+        try {
+            final String str = Settings.getString(Settings.KEYS.ENGINE_VERSION_CHECK_URL, "http://jeremylong.github.io/DependencyCheck/current.txt");
+            final URL url = new URL(str);
+            conn = URLConnectionFactory.createHttpURLConnection(url);
+            conn.connect();
+            if (conn.getResponseCode() != 200) {
+                return null;
+            }
+            final String releaseVersion = IOUtils.toString(conn.getInputStream(), "UTF-8");
+            if (releaseVersion != null) {
+                return releaseVersion.trim();
+            }
+        } catch (MalformedURLException ex) {
+            LOGGER.log(Level.FINE, "unable to retrieve current release version of dependency-check", ex);
+        } catch (URLConnectionFailureException ex) {
+            LOGGER.log(Level.FINE, "unable to retrieve current release version of dependency-check", ex);
+        } catch (IOException ex) {
+            LOGGER.log(Level.FINE, "unable to retrieve current release version of dependency-check", ex);
+        } finally {
+            if (conn != null) {
+                conn.disconnect();
+            }
+        }
+        return null;
+    }
+}

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java

@@ -36,6 +36,7 @@ import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
 import org.owasp.dependencycheck.data.update.exception.UpdateException;
 import org.owasp.dependencycheck.data.update.task.DownloadTask;
 import org.owasp.dependencycheck.data.update.task.ProcessTask;
+import org.owasp.dependencycheck.utils.DateUtil;
 import org.owasp.dependencycheck.utils.DownloadFailedException;
 import org.owasp.dependencycheck.utils.InvalidSettingException;
 import org.owasp.dependencycheck.utils.Settings;
@@ -220,7 +221,7 @@ public class StandardUpdate {
                 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
                 if (lastUpdated == updates.getTimeStamp(MODIFIED)) {
                     updates.clear(); //we don't need to update anything.
-                } else if (withinRange(lastUpdated, now.getTime(), days)) {
+                } else if (DateUtil.withinDateRange(lastUpdated, now.getTime(), days)) {
                     for (NvdCveInfo entry : updates) {
                         if (MODIFIED.equals(entry.getId())) {
                             entry.setNeedsUpdate(true);
@@ -317,19 +318,4 @@ public class StandardUpdate {
             throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details.");
         }
     }
-
-    /**
-     * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the
-     * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date
-     * is considered valid.
-     *
-     * @param date the date to be checked.
-     * @param compareTo the date to compare to.
-     * @param range the range in days to be considered valid.
-     * @return whether or not the date is within the range.
-     */
-    protected boolean withinRange(long date, long compareTo, int range) {
-        final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
-        return differenceInDays < range;
-    }
 }

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/DownloadTask.java

@@ -262,8 +262,8 @@ public class DownloadTask implements Callable<Future<ProcessTask>> {
     private void extractGzip(File file) throws FileNotFoundException, IOException {
         final String originalPath = file.getPath();
         File gzip = new File(originalPath + ".gz");
-        if (gzip.isFile()) {
-            gzip.delete();
+        if (gzip.isFile() && !gzip.delete()) {
+            gzip.deleteOnExit();
         }
         if (!file.renameTo(gzip)) {
             throw new IOException("Unable to rename '" + file.getPath() + "'");
@@ -284,10 +284,18 @@ public class DownloadTask implements Callable<Future<ProcessTask>> {
             }
         } finally {
             if (cin != null) {
-                cin.close();
+                try {
+                    cin.close();
+                } catch (IOException ex) {
+                    LOGGER.log(Level.FINEST, "ignore", ex);
+                }
             }
             if (out != null) {
-                out.close();
+                try {
+                    out.close();
+                } catch (IOException ex) {
+                    LOGGER.log(Level.FINEST, "ignore", ex);
+                }
             }
             if (gzip.isFile()) {
                 FileUtils.deleteQuietly(gzip);

dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java

@@ -25,6 +25,15 @@ import java.io.Serializable;
  */
 public class Identifier implements Serializable, Comparable<Identifier> {
 
+    /**
+     * Default constructor. Should only be used for automatic class
+     * creation as is the case with many XML parsers (for the parsing
+     * of the Dependency-Check XML report). For all other use-cases,
+     * please use the non-default constructors.
+     */
+    public Identifier() {
+    }
+
     /**
      * Constructs a new Identifier with the specified data.
      *

dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java

@@ -113,7 +113,7 @@ public class ReportGenerator {
         context.put("scanDate", scanDate);
         context.put("scanDateXML", scanDateXML);
         context.put("enc", enc);
-        context.put("version", Settings.getString("application.version", "Unknown"));
+        context.put("version", Settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown"));
     }
 
     /**
@@ -137,6 +137,26 @@ public class ReportGenerator {
         return new VelocityContext();
     }
 
+    /**
+     * Generates the Dependency Reports for the identified dependencies.
+     *
+     * @param outputStream the OutputStream to send the generated report to
+     * @param format the format the report should be written in
+     * @throws IOException is thrown when the template file does not exist
+     * @throws Exception is thrown if there is an error writing out the reports.
+     */
+    public void generateReports(OutputStream outputStream, Format format) throws IOException, Exception {
+        if (format == Format.XML || format == Format.ALL) {
+            generateReport("XmlReport", outputStream);
+        }
+        if (format == Format.HTML || format == Format.ALL) {
+            generateReport("HtmlReport", outputStream);
+        }
+        if (format == Format.VULN || format == Format.ALL) {
+            generateReport("VulnerabilityReport", outputStream);
+        }
+    }
+
     /**
      * Generates the Dependency Reports for the identified dependencies.
      *
@@ -202,11 +222,11 @@ public class ReportGenerator {
      * template file.
      *
      * @param templateName the name of the template to load.
-     * @param outFileName the filename and path to write the report to.
+     * @param outputStream the OutputStream to write the report to.
      * @throws IOException is thrown when the template file does not exist.
      * @throws Exception is thrown when an exception occurs.
      */
-    protected void generateReport(String templateName, String outFileName) throws IOException, Exception {
+    protected void generateReport(String templateName, OutputStream outputStream) throws IOException, Exception {
         InputStream input = null;
         String templatePath = null;
         final File f = new File(templateName);
@@ -229,18 +249,8 @@ public class ReportGenerator {
 
         final InputStreamReader reader = new InputStreamReader(input, "UTF-8");
         OutputStreamWriter writer = null;
-        OutputStream outputStream = null;
 
         try {
-            final File outDir = new File(outFileName).getParentFile();
-            if (!outDir.exists()) {
-                final boolean created = outDir.mkdirs();
-                if (!created) {
-                    throw new Exception("Unable to create directory '" + outDir.getAbsolutePath() + "'.");
-                }
-            }
-
-            outputStream = new FileOutputStream(outFileName);
             writer = new OutputStreamWriter(outputStream, "UTF-8");
 
             if (!engine.evaluate(context, writer, templatePath, reader)) {
@@ -269,4 +279,41 @@ public class ReportGenerator {
             }
         }
     }
+
+    /**
+     * Generates a report from a given Velocity Template. The template name provided can be the name of a template
+     * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a
+     * template file.
+     *
+     * @param templateName the name of the template to load.
+     * @param outFileName the filename and path to write the report to.
+     * @throws IOException is thrown when the template file does not exist.
+     * @throws Exception is thrown when an exception occurs.
+     */
+    protected void generateReport(String templateName, String outFileName) throws Exception {
+        File outFile = new File(outFileName);
+        if (outFile.getParentFile() == null) {
+            outFile = new File(".", outFileName);
+        }
+        if (!outFile.getParentFile().exists()) {
+            final boolean created = outFile.getParentFile().mkdirs();
+            if (!created) {
+                throw new Exception("Unable to create directory '" + outFile.getParentFile().getAbsolutePath() + "'.");
+            }
+        }
+
+        OutputStream outputSteam = null;
+        try {
+            outputSteam = new FileOutputStream(outFile);
+            generateReport(templateName, outputSteam);
+        } finally {
+            if (outputSteam != null) {
+                try {
+                    outputSteam.close();
+                } catch (IOException ex) {
+                    LOGGER.log(Level.FINEST, "ignore", ex);
+                }
+            }
+        }
+    }
 }

dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java

@@ -0,0 +1,46 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.utils;
+
+/**
+ *
+ * @author Jeremy Long <jeremy.long@owasp.org>
+ */
+public final class DateUtil {
+
+    /**
+     * Private constructor for utility class.
+     */
+    private DateUtil() {
+    }
+
+    /**
+     * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the
+     * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date
+     * is considered valid.
+     *
+     * @param date the date to be checked.
+     * @param compareTo the date to compare to.
+     * @param range the range in days to be considered valid.
+     * @return whether or not the date is within the range.
+     */
+    public static boolean withinDateRange(long date, long compareTo, int range) {
+        final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
+        return differenceInDays < range;
+    }
+}

dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource

@@ -1 +1,2 @@
-org.owasp.dependencycheck.data.update.NvdCveUpdater
+org.owasp.dependencycheck.data.update.NvdCveUpdater
+org.owasp.dependencycheck.data.update.EngineVersionCheck

dependency-check-core/src/main/resources/dependencycheck.properties

@@ -3,6 +3,9 @@ application.version=${pom.version}
 autoupdate=true
 max.download.threads=3
 
+# the url to obtain the current engine version from
+engine.version.url=http://jeremylong.github.io/DependencyCheck/current.txt
+
 #temp.directory defaults to System.getProperty("java.io.tmpdir")
 #temp.directory=[path to temp directory]
 

dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/EngineVersionCheckTest.java

@@ -0,0 +1,144 @@
+/*
+ * Copyright 2014 OWASP.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.owasp.dependencycheck.data.update;
+
+import java.text.DateFormat;
+import java.text.SimpleDateFormat;
+import java.util.Properties;
+import mockit.Mock;
+import mockit.MockUp;
+import static org.junit.Assert.assertEquals;
+import org.junit.Test;
+import org.owasp.dependencycheck.BaseTest;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+import org.owasp.dependencycheck.data.update.exception.UpdateException;
+import org.owasp.dependencycheck.utils.DependencyVersion;
+
+/**
+ *
+ * @author Jeremy Long <jeremy.long@owasp.org>
+ */
+public class EngineVersionCheckTest extends BaseTest {
+
+//    /**
+//     * Test of update method, of class EngineVersionCheck.
+//     */
+//    @Test
+//    public void testUpdate() throws Exception {
+//        EngineVersionCheck instance = new EngineVersionCheck();
+//        instance.update();
+//    }
+    /**
+     * Test of shouldUpdate method, of class EngineVersionCheck.
+     */
+    @Test
+    public void testShouldUpdate() throws Exception {
+        DatabaseProperties properties = new MockUp<DatabaseProperties>() {
+            final private Properties properties = new Properties();
+
+            @Mock
+            public void save(String key, String value) throws UpdateException {
+                properties.setProperty(key, value);
+            }
+
+            @Mock
+            public String getProperty(String key) {
+                return properties.getProperty(key);
+            }
+
+        }.getMockInstance();
+
+        DateFormat df = new SimpleDateFormat("yyyy-MM-dd");
+
+        String updateToVersion = "1.2.6";
+        String currentVersion = "1.2.6";
+        long lastChecked = df.parse("2014-12-01").getTime();
+        long now = df.parse("2014-12-01").getTime();
+
+        EngineVersionCheck instance = new EngineVersionCheck();
+        boolean expResult = false;
+        instance.setUpdateToVersion(updateToVersion);
+        boolean result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+
+        updateToVersion = "1.2.5";
+        currentVersion = "1.2.5";
+        lastChecked = df.parse("2014-10-01").getTime();
+        now = df.parse("2014-12-01").getTime();
+        expResult = true;
+        instance.setUpdateToVersion(updateToVersion);
+        result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+        //System.out.println(properties.getProperty(CURRENT_ENGINE_RELEASE));
+
+        updateToVersion = "1.2.5";
+        currentVersion = "1.2.5";
+        lastChecked = df.parse("2014-12-01").getTime();
+        now = df.parse("2014-12-03").getTime();
+        expResult = false;
+        instance.setUpdateToVersion(updateToVersion);
+        result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+
+        updateToVersion = "1.2.6";
+        currentVersion = "1.2.5";
+        lastChecked = df.parse("2014-12-01").getTime();
+        now = df.parse("2014-12-03").getTime();
+        expResult = true;
+        instance.setUpdateToVersion(updateToVersion);
+        result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+
+        updateToVersion = "1.2.5";
+        currentVersion = "1.2.6";
+        lastChecked = df.parse("2014-12-01").getTime();
+        now = df.parse("2014-12-08").getTime();
+        expResult = false;
+        instance.setUpdateToVersion(updateToVersion);
+        result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+
+        updateToVersion = "";
+        currentVersion = "1.2.5";
+        lastChecked = df.parse("2014-12-01").getTime();
+        now = df.parse("2014-12-03").getTime();
+        expResult = false;
+        instance.setUpdateToVersion(updateToVersion);
+        result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+
+        updateToVersion = "";
+        currentVersion = "1.2.5";
+        lastChecked = df.parse("2014-12-01").getTime();
+        now = df.parse("2014-12-08").getTime();
+        expResult = true;
+        instance.setUpdateToVersion(updateToVersion);
+        result = instance.shouldUpdate(lastChecked, now, properties, currentVersion);
+        assertEquals(expResult, result);
+    }
+
+    /**
+     * Test of getCurrentReleaseVersion method, of class EngineVersionCheck.
+     */
+    @Test
+    public void testGetCurrentReleaseVersion() {
+        EngineVersionCheck instance = new EngineVersionCheck();
+        DependencyVersion expResult = new DependencyVersion("1.2.6");
+        String release = instance.getCurrentReleaseVersion();
+        DependencyVersion result = new DependencyVersion(release);
+        assertEquals(expResult, result);
+    }
+}

dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.java

@@ -18,8 +18,6 @@
 package org.owasp.dependencycheck.data.update;
 
 import java.net.MalformedURLException;
-import java.util.Calendar;
-import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import org.junit.Test;
 import org.owasp.dependencycheck.BaseTest;
@@ -47,26 +45,6 @@ public class StandardUpdateIntegrationTest extends BaseTest {
         instance.closeDataStores();
     }
 
-    /**
-     * Test of withinRange method, of class StandardUpdate.
-     */
-    @Test
-    public void testWithinRange() throws Exception {
-        Calendar c = Calendar.getInstance();
-
-        long current = c.getTimeInMillis();
-        long lastRun = c.getTimeInMillis() - (3 * (1000 * 60 * 60 * 24));
-        int range = 7; // 7 days
-        StandardUpdate instance = getStandardUpdateTask();
-        boolean expResult = true;
-        boolean result = instance.withinRange(lastRun, current, range);
-        assertEquals(expResult, result);
-
-        lastRun = c.getTimeInMillis() - (8 * (1000 * 60 * 60 * 24));
-        expResult = false;
-        result = instance.withinRange(lastRun, current, range);
-        assertEquals(expResult, result);
-    }
 // test removed as it is duplicative of the EngineIntegrationTest and the NvdCveUpdaterIntergraionTest
 //    /**
 //     * Test of update method, of class StandardUpdate.
@@ -77,7 +55,6 @@ public class StandardUpdateIntegrationTest extends BaseTest {
 //        instance.update();
 //        //TODO make this an actual test
 //    }
-
     /**
      * Test of updatesNeeded method, of class StandardUpdate.
      */

dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/DateUtilTest.java

@@ -0,0 +1,71 @@
+/*
+ * Copyright 2014 OWASP.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.owasp.dependencycheck.utils;
+
+import java.util.Calendar;
+import org.junit.After;
+import org.junit.AfterClass;
+import static org.junit.Assert.assertEquals;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+/**
+ *
+ * @author Jeremy Long <jeremy.long@owasp.org>
+ */
+public class DateUtilTest {
+
+    public DateUtilTest() {
+    }
+
+    @BeforeClass
+    public static void setUpClass() {
+    }
+
+    @AfterClass
+    public static void tearDownClass() {
+    }
+
+    @Before
+    public void setUp() {
+    }
+
+    @After
+    public void tearDown() {
+    }
+
+    /**
+     * Test of withinDateRange method, of class DateUtil.
+     */
+    @Test
+    public void testWithinDateRange() {
+        Calendar c = Calendar.getInstance();
+
+        long current = c.getTimeInMillis();
+        long lastRun = c.getTimeInMillis() - (3 * (1000 * 60 * 60 * 24));
+        int range = 7; // 7 days
+        boolean expResult = true;
+        boolean result = DateUtil.withinDateRange(lastRun, current, range);
+        assertEquals(expResult, result);
+
+        lastRun = c.getTimeInMillis() - (8 * (1000 * 60 * 60 * 24));
+        expResult = false;
+        result = DateUtil.withinDateRange(lastRun, current, range);
+        assertEquals(expResult, result);
+    }
+
+}

dependency-check-core/src/test/resources/dependencycheck.properties

@@ -3,6 +3,9 @@ application.version=${pom.version}
 autoupdate=true
 max.download.threads=3
 
+# the url to obtain the current engine version from
+engine.version.url=http://jeremylong.github.io/DependencyCheck/current.txt
+
 #temp.directory defaults to System.getProperty("java.io.tmpdir")
 #temp.directory=[path to temp directory]
 

dependency-check-jenkins/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.2.6</version>
+        <version>1.2.7</version>
     </parent>
     <groupId>org.owasp</groupId>
     <artifactId>dependency-check-jenkins</artifactId>

dependency-check-maven/pom.xml

@@ -22,7 +22,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.2.6</version>
+        <version>1.2.7</version>
     </parent>
 
     <artifactId>dependency-check-maven</artifactId>

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java

@@ -43,7 +43,6 @@ import org.apache.maven.project.MavenProject;
 import org.apache.maven.reporting.MavenReport;
 import org.apache.maven.reporting.MavenReportException;
 import org.apache.maven.settings.Proxy;
-import org.owasp.dependencycheck.Engine;
 import org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer;
 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
 import org.owasp.dependencycheck.data.nexus.MavenArtifact;
@@ -96,7 +95,8 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
     /**
      * The path to the verbose log.
      */
-    @Parameter(property = "logfile", defaultValue = "")
+    @SuppressWarnings("CanBeFinal")
+    @Parameter(property = "logFile", defaultValue = "")
     private String logFile = null;
     /**
      * The output directory. This generally maps to "target".
@@ -119,13 +119,13 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
     private boolean autoUpdate = true;
     /**
      * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
-     * within the Site plugin unless the externalReport is set to true. Default is HTML.
+     * within the Site plug-in unless the externalReport is set to true. Default is HTML.
      */
     @SuppressWarnings("CanBeFinal")
     @Parameter(property = "format", defaultValue = "HTML", required = true)
     private String format = "HTML";
     /**
-     * The maven settings.
+     * The Maven settings.
      */
     @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false)
     private org.apache.maven.settings.Settings mavenSettings;
@@ -300,14 +300,6 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
     private String externalReport = null;
 
     // </editor-fold>
-    /**
-     * Constructs a new dependency-check-mojo.
-     */
-    public DependencyCheckMojo() {
-        final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
-        LogUtils.prepareLogger(in, logFile);
-    }
-
     /**
      * Executes the Dependency-Check on the dependent libraries.
      *
@@ -326,7 +318,12 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
      * @throws DatabaseException thrown if there is an exception connecting to the database
      */
     private Engine executeDependencyCheck(MavenProject project) throws DatabaseException {
-        final Engine localEngine = initializeEngine();
+        final Engine localEngine;
+        if (engine == null) {
+            localEngine = initializeEngine(project);
+        } else {
+            localEngine = engine;
+        }
 
         final Set<Artifact> artifacts = project.getArtifacts();
         for (Artifact a : artifacts) {
@@ -356,12 +353,13 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
     /**
      * Initializes a new <code>Engine</code> that can be used for scanning.
      *
+     * @param project the current MavenProject
      * @return a newly instantiated <code>Engine</code>
      * @throws DatabaseException thrown if there is a database exception
      */
-    private Engine initializeEngine() throws DatabaseException {
+    private Engine initializeEngine(MavenProject project) throws DatabaseException {
         populateSettings();
-        final Engine localEngine = new Engine();
+        final Engine localEngine = new Engine(project);
         return localEngine;
     }
 
@@ -530,6 +528,15 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
     }
 
     //</editor-fold>
+    /**
+     * Initialize the mojo.
+     */
+    @Override
+    protected void initialize() {
+        final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+        LogUtils.prepareLogger(in, logFile);
+    }
+
     /**
      * Executes the dependency-check and generates the report.
      *
@@ -590,11 +597,12 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
      */
     @Override
     protected void executeNonAggregateReport(Locale locale) throws MavenReportException {
-
         final List<Dependency> deps = readDataFile();
         if (deps != null) {
             try {
-                engine = initializeEngine();
+                if (engine != null) {
+                    engine = initializeEngine(getProject());
+                }
                 engine.getDependencies().addAll(deps);
             } catch (DatabaseException ex) {
                 final String msg = String.format("An unrecoverable exception with the dependency-check initialization occured while scanning %s",
@@ -618,7 +626,9 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
         List<Dependency> deps = readDataFile(project);
         if (deps != null) {
             try {
-                engine = initializeEngine();
+                if (engine != null) {
+                    engine = initializeEngine(project);
+                }
                 engine.getDependencies().addAll(deps);
             } catch (DatabaseException ex) {
                 final String msg = String.format("An unrecoverable exception with the dependency-check initialization occured while scanning %s",
@@ -936,4 +946,5 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
         return ret;
     }
     //</editor-fold>
+
 }

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/Engine.java

@@ -0,0 +1,161 @@
+/*
+ * This file is part of dependency-check-maven.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.maven;
+
+import java.util.logging.Logger;
+import org.apache.maven.project.MavenProject;
+import org.owasp.dependencycheck.analyzer.Analyzer;
+import org.owasp.dependencycheck.analyzer.CPEAnalyzer;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+import org.owasp.dependencycheck.utils.Settings;
+
+/**
+ * A modified version of the core engine specifically designed to persist some data between multiple executions of a
+ * multi-module Maven project.
+ *
+ * @author Jeremy Long <jeremy.long@owasp.org>
+ */
+public class Engine extends org.owasp.dependencycheck.Engine {
+
+    /**
+     * The logger.
+     */
+    private static final transient Logger LOGGER = Logger.getLogger(Engine.class.getName());
+    /**
+     * A key used to persist an object in the MavenProject.
+     */
+    private static final String CPE_ANALYZER_KEY = "dependency-check-CPEAnalyzer";
+    /**
+     * The current MavenProject.
+     */
+    private MavenProject currentProject;
+
+    /**
+     * Creates a new Engine to perform anyalsis on dependencies.
+     *
+     * @param project the current Maven project
+     * @throws DatabaseException thrown if there is an issue connecting to the database
+     */
+    public Engine(MavenProject project) throws DatabaseException {
+        this.currentProject = project;
+        final MavenProject parent = getRootParent();
+        if (parent != null && parent.getContextValue("dependency-check-data-was-updated") != null) {
+            System.setProperty(Settings.KEYS.AUTO_UPDATE, Boolean.FALSE.toString());
+        }
+        initializeEngine();
+        if (parent != null) {
+            parent.setContextValue("dependency-check-data-was-updated", Boolean.valueOf(true));
+        }
+    }
+
+    /**
+     * This constructor should not be called. Use Engine(MavenProject) instead.
+     *
+     * @throws DatabaseException thrown if there is an issue connecting to the database
+     */
+    private Engine() throws DatabaseException {
+    }
+
+    /**
+     * Initializes the given analyzer. This skips the initialization of the CPEAnalyzer if it has been initialized by a
+     * previous execution.
+     *
+     * @param analyzer the analyzer to initialize
+     * @return the initialized analyzer
+     */
+    @Override
+    protected Analyzer initializeAnalyzer(Analyzer analyzer) {
+        if ((analyzer instanceof CPEAnalyzer)) {
+            CPEAnalyzer cpe = getPreviouslyLoadedAnalyzer();
+            if (cpe != null) {
+                return cpe;
+            }
+            cpe = (CPEAnalyzer) super.initializeAnalyzer(analyzer);
+            storeCPEAnalyzer(cpe);
+        }
+        return super.initializeAnalyzer(analyzer);
+    }
+
+    /**
+     * Closes the given analyzer. This skips closing the CPEAnalyzer.
+     *
+     * @param analyzer the analyzer to close
+     */
+    @Override
+    protected void closeAnalyzer(Analyzer analyzer) {
+        if ((analyzer instanceof CPEAnalyzer)) {
+            if (getPreviouslyLoadedAnalyzer() == null) {
+                super.closeAnalyzer(analyzer);
+            }
+        } else {
+            super.closeAnalyzer(analyzer);
+        }
+    }
+
+    /**
+     * Closes the CPEAnalyzer if it has been created and persisted in the root parent MavenProject context.
+     */
+    public void cleanupFinal() {
+        final CPEAnalyzer cpe = getPreviouslyLoadedAnalyzer();
+        if (cpe != null) {
+            cpe.close();
+        }
+    }
+
+    /**
+     * Gets the CPEAnalyzer from the root Maven Project.
+     *
+     * @return an initialized CPEAnalyzer
+     */
+    private CPEAnalyzer getPreviouslyLoadedAnalyzer() {
+        CPEAnalyzer cpe = null;
+        final MavenProject project = getRootParent();
+        if (project != null) {
+            cpe = (CPEAnalyzer) project.getContextValue(CPE_ANALYZER_KEY);
+        }
+        return cpe;
+    }
+
+    /**
+     * Stores a CPEAnalyzer in the root Maven Project.
+     *
+     * @param cpe the CPEAnalyzer to store
+     */
+    private void storeCPEAnalyzer(CPEAnalyzer cpe) {
+        final MavenProject p = getRootParent();
+        if (p != null) {
+            p.setContextValue(CPE_ANALYZER_KEY, cpe);
+        }
+    }
+
+    /**
+     * Returns the root Maven Project.
+     *
+     * @return the root Maven Project
+     */
+    private MavenProject getRootParent() {
+        if (this.currentProject == null) {
+            return null;
+        }
+        MavenProject p = this.currentProject;
+        while (p.getParent() != null) {
+            p = p.getParent();
+        }
+        return p;
+    }
+}

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ReportAggregationMojo.java

@@ -138,6 +138,11 @@ public abstract class ReportAggregationMojo extends AbstractMojo implements Mave
         return true;
     }
 
+    /**
+     * Initializes the mojo.
+     */
+    protected abstract void initialize();
+
     /**
      * The collection of child projects.
      */
@@ -204,6 +209,7 @@ public abstract class ReportAggregationMojo extends AbstractMojo implements Mave
      */
     public final void execute() throws MojoExecutionException, MojoFailureException {
         try {
+            initialize();
             preExecute();
             performExecute();
         } finally {
@@ -273,22 +279,22 @@ public abstract class ReportAggregationMojo extends AbstractMojo implements Mave
      */
     public final void generate(Sink sink, Locale locale) throws MavenReportException {
         try {
+            initialize();
             preGenerate();
             if (canGenerateNonAggregateReport()) {
                 executeNonAggregateReport(locale);
             }
-
-            if (canGenerateAggregateReport()) {
-                for (MavenProject proj : reactorProjects) {
-                    if (!isMultiModule(proj)) {
-                        continue;
-                    }
-                    executeAggregateReport(proj, locale);
-                }
-            }
         } finally {
             postGenerate();
         }
+        if (canGenerateAggregateReport()) {
+            for (MavenProject proj : reactorProjects) {
+                if (!isMultiModule(proj)) {
+                    continue;
+                }
+                executeAggregateReport(proj, locale);
+            }
+        }
     }
 
     /**

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ReportingUtil.java

@@ -28,7 +28,6 @@ import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.apache.maven.doxia.sink.Sink;
-import org.owasp.dependencycheck.Engine;
 import org.owasp.dependencycheck.data.nvdcve.CveDB;
 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;

dependency-check-utils/pom.xml

@@ -21,7 +21,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.2.6</version>
+        <version>1.2.7</version>
     </parent>
 
     <artifactId>dependency-check-utils</artifactId>

dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/LogUtils.java

@@ -75,7 +75,7 @@ public final class LogUtils {
             if (in != null) {
                 try {
                     in.close();
-                } catch (Throwable ex) {
+                } catch (IOException ex) {
                     LOGGER.log(Level.FINEST, "Error closing resource stream", ex);
                 }
             }

dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java

@@ -50,6 +50,18 @@ public final class Settings {
         private KEYS() {
             //do nothing
         }
+        /**
+         * The key to obtain the application name.
+         */
+        public static final String APPLICATION_VAME = "application.name";
+        /**
+         * The key to obtain the application version.
+         */
+        public static final String APPLICATION_VERSION = "application.version";
+        /**
+         * The key to obtain the URL to retrieve the current release version from.
+         */
+        public static final String ENGINE_VERSION_CHECK_URL = "engine.version.url";
         /**
          * The properties key indicating whether or not the cached data sources should be updated.
          */

dependency-check-utils/src/test/resources/dependencycheck.properties

@@ -3,6 +3,9 @@ application.version=${pom.version}
 autoupdate=true
 max.download.threads=3
 
+# the url to obtain the current engine version from
+engine.version.url=http://jeremylong.github.io/DependencyCheck/current.txt
+
 #temp.directory defaults to System.getProperty("java.io.tmpdir")
 #temp.directory=[path to temp directory]
 

pom.xml

@@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long
 
     <groupId>org.owasp</groupId>
     <artifactId>dependency-check-parent</artifactId>
-    <version>1.2.6</version>
+    <version>1.2.7</version>
     <packaging>pom</packaging>
 
     <modules>
@@ -141,6 +141,31 @@ Copyright (c) 2012 - Jeremy Long
                     <target>1.6</target>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <version>2.7</version>
+                <executions>
+                    <execution>
+                        <id>site-filtering-hack</id>
+                        <phase>pre-site</phase>
+                        <goals>
+                            <goal>copy-resources</goal>
+                        </goals>
+                        <inherited>false</inherited>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/site/</outputDirectory>
+                            <resources>
+                                <resource>
+                                    <directory>src/main/site-resources/</directory>
+                                    <filtering>true</filtering>
+                                </resource>
+                            </resources>
+                            <encoding>UTF-8</encoding>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <!-- begin copy from http://minds.coremedia.com/2012/09/11/problem-solved-deploy-multi-module-maven-project-site-as-github-pages/ -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -183,7 +208,6 @@ Copyright (c) 2012 - Jeremy Long
                                         <report>project-team</report>
                                         <report>scm</report>
                                         <report>license</report>
-                                        <report>help</report>
                                     </reports>
                                 </reportSet>
                             </reportSets>

src/main/config/checkstyle-checks.xml

@@ -9,215 +9,215 @@
       names will be relative to the specified directory. See
       http://checkstyle.sourceforge.net/5.x/config.html#Checker
 
-      <property name="basedir" value="${basedir}"/>
-  -->
+        <property name="basedir" value="${basedir}"/>
+    -->
 
-  <property name="severity" value="error"/>
+    <property name="severity" value="error"/>
 
-  <module name="SuppressionFilter">
-    <property name="file" value="${checkstyle.suppressions.file}"/>
-  </module>
-
-  <module name="JavadocPackage">
-    <property name="allowLegacy" value="false"/>
-  </module>
-
-  <module name="Translation">
-    <property name="severity" value="warning"/>
-  </module>
-
-  <module name="FileTabCharacter">
-    <property name="eachLine" value="false"/>
-  </module>
-
-  <module name="FileLength">
-    <property name="fileExtensions" value="java"/>
-  </module>
-
-  <module name="NewlineAtEndOfFile">
-  <property name="fileExtensions" value="java"/>
-  <property name="lineSeparator" value="lf"/>
-  </module>
-
-  <module name="RegexpHeader">
-    <property name="headerFile" value="${checkstyle.header.file}"/>
-    <property name="fileExtensions" value="java"/>
-    <property name="id" value="header"/>
-  </module>
-
-  <module name="RegexpSingleline">
-    <property name="format" value="\s+$"/>
-    <property name="minimum" value="0"/>
-    <property name="maximum" value="0"/>
-  </module>
-
-  <module name="TreeWalker">
-    <property name="tabWidth" value="4"/>
-
-    <module name="AvoidStarImport"/>
-    <module name="ConstantName"/>
-    <module name="EmptyBlock"/>
-    <module name="EmptyForIteratorPad"/>
-    <module name="EqualsHashCode"/>
-    <module name="OneStatementPerLine"/>
-
-    <!-- module name="IllegalCatch"/ -->
-    <!--module name="ImportControl">
-      <property name="file" value="${checkstyle.importcontrol.file}"/>
-    </module-->
-    <module name="IllegalImport"/>
-    <module name="IllegalInstantiation"/>
-    <module name="IllegalThrows"/>
-    <module name="InnerAssignment"/>
-    <module name="JavadocType">
-      <property name="authorFormat" value="\S"/>
-    </module>
-    <module name="JavadocMethod">
-      <property name="allowUndeclaredRTE" value="true"/>
-      <property name="allowThrowsTagsForSubclasses" value="true"/>
-      <property name="allowMissingPropertyJavadoc" value="true"/>
-    </module>
-    <module name="JavadocVariable"/>
-    <module name="JavadocStyle">
-      <property name="scope" value="public"/>
+    <module name="SuppressionFilter">
+        <property name="file" value="${checkstyle.suppressions.file}"/>
     </module>
 
-    <module name="LeftCurly">
-      <property name="option" value="eol"/>
-      <property name="tokens" value="CLASS_DEF"/>
-      <property name="tokens" value="CTOR_DEF"/>
-      <property name="tokens" value="INTERFACE_DEF"/>
-      <property name="tokens" value="METHOD_DEF"/>
-      <property name="tokens" value="LITERAL_CATCH"/>
-      <property name="tokens" value="LITERAL_DO"/>
-      <property name="tokens" value="LITERAL_ELSE"/>
-      <property name="tokens" value="LITERAL_FINALLY"/>
-      <property name="tokens" value="LITERAL_FOR"/>
-      <property name="tokens" value="LITERAL_IF"/>
-      <property name="tokens" value="LITERAL_SWITCH"/>
-      <property name="tokens" value="LITERAL_SYNCHRONIZED"/>
-      <property name="tokens" value="LITERAL_TRY"/>
-      <property name="tokens" value="LITERAL_WHILE"/>
+    <module name="JavadocPackage">
+        <property name="allowLegacy" value="false"/>
     </module>
 
-    <module name="OuterTypeNumber"/>
-    <module name="LineLength">
-      <property name="ignorePattern" value="^ *\* *[^ ]+$"/>
-    <property name="max" value="150"/>
+    <module name="Translation">
+        <property name="severity" value="warning"/>
     </module>
 
-    <module name="MethodCount">
-      <property name="maxTotal" value="40"/>
+    <module name="FileTabCharacter">
+        <property name="eachLine" value="false"/>
     </module>
 
-    <module name="LocalFinalVariableName"/>
-    <module name="LocalVariableName"/>
-    <module name="MemberName">
-      <property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
-    </module>
-    <module name="MethodLength">
-        <property name="max" value="160"/>
-        <property name="countEmpty" value="false"/>
-    </module>
-    <module name="MethodName"/>
-    <module name="MethodParamPad"/>
-    <module name="ModifierOrder"/>
-    <module name="NeedBraces"/>
-    <module name="NoWhitespaceAfter">
-      <property name="tokens" value="ARRAY_INIT"/>
-      <property name="tokens" value="BNOT"/>
-      <property name="tokens" value="DEC"/>
-      <property name="tokens" value="DOT"/>
-      <property name="tokens" value="INC"/>
-      <property name="tokens" value="LNOT"/>
-      <property name="tokens" value="UNARY_MINUS"/>
-      <property name="tokens" value="UNARY_PLUS"/>
+    <module name="FileLength">
+        <property name="fileExtensions" value="java"/>
     </module>
 
-    <module name="NoWhitespaceBefore"/>
-    <module name="NoWhitespaceBefore">
-      <property name="tokens" value="DOT"/>
-      <property name="allowLineBreaks" value="true"/>
+    <module name="NewlineAtEndOfFile">
+        <property name="fileExtensions" value="java"/>
+        <property name="lineSeparator" value="lf"/>
     </module>
 
-    <module name="OperatorWrap"/>
-    <module name="OperatorWrap">
-      <property name="tokens" value="ASSIGN"/>
-      <property name="tokens" value="DIV_ASSIGN"/>
-      <property name="tokens" value="PLUS_ASSIGN"/>
-      <property name="tokens" value="MINUS_ASSIGN"/>
-      <property name="tokens" value="STAR_ASSIGN"/>
-      <property name="tokens" value="MOD_ASSIGN"/>
-      <property name="tokens" value="SR_ASSIGN"/>
-      <property name="tokens" value="BSR_ASSIGN"/>
-      <property name="tokens" value="SL_ASSIGN"/>
-      <property name="tokens" value="BXOR_ASSIGN"/>
-      <property name="tokens" value="BOR_ASSIGN"/>
-      <property name="tokens" value="BAND_ASSIGN"/>
-      <property name="option" value="eol"/>
-    </module>
-    <module name="PackageName"/>
-    <module name="ParameterName">
-      <property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
-    </module>
-    <module name="ParameterNumber">
-      <property name="id" value="paramNum"/>
-    </module>
-    <module name="ParenPad"/>
-    <module name="TypecastParenPad"/>
-    <module name="RedundantImport"/>
-    <module name="RedundantModifier"/>
-    <module name="RightCurly">
-      <property name="option" value="same"/>
-    </module>
-    <module name="SimplifyBooleanExpression"/>
-    <module name="SimplifyBooleanReturn"/>
-    <module name="StaticVariableName">
-      <property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
-    </module>
-    <module name="TypeName"/>
-    <module name="UnusedImports"/>
-    <module name="UpperEll"/>
-    <module name="VisibilityModifier"/>
-    <module name="WhitespaceAfter"/>
-    <module name="WhitespaceAround"/>
-    <module name="GenericWhitespace"/>
-    <module name="FinalClass"/>
-    <module name="MissingSwitchDefault"/>
-    <!--module name="MagicNumber"/-->
-    <!--module name="Indentation">
-      <property name="basicOffset" value="4"/>
-      <property name="braceAdjustment" value="0"/>
-      <property name="caseIndent" value="0"/>
-    </module-->
-    <module name="ArrayTrailingComma"/>
-    <module name="FinalLocalVariable"/>
-    <module name="EqualsAvoidNull"/>
-    <module name="ParameterAssignment"/>
-
-    <!-- Generates quite a few errors -->
-    <module name="CyclomaticComplexity">
-      <property name="severity" value="ignore"/>
+    <module name="RegexpHeader">
+        <property name="headerFile" value="${checkstyle.header.file}"/>
+        <property name="fileExtensions" value="java"/>
+        <property name="id" value="header"/>
     </module>
 
-    <module name="NestedForDepth">
-      <property name="max" value="2"/>
+    <module name="RegexpSingleline">
+        <property name="format" value="\s+$"/>
+        <property name="minimum" value="0"/>
+        <property name="maximum" value="0"/>
     </module>
-    <module name="NestedIfDepth">
-      <property name="max" value="4"/>
+
+    <module name="TreeWalker">
+        <property name="tabWidth" value="4"/>
+
+        <module name="AvoidStarImport"/>
+        <module name="ConstantName"/>
+        <module name="EmptyBlock"/>
+        <module name="EmptyForIteratorPad"/>
+        <module name="EqualsHashCode"/>
+        <module name="OneStatementPerLine"/>
+
+        <!-- module name="IllegalCatch"/ -->
+        <!--module name="ImportControl">
+          <property name="file" value="${checkstyle.importcontrol.file}"/>
+        </module-->
+        <module name="IllegalImport"/>
+        <module name="IllegalInstantiation"/>
+        <module name="IllegalThrows"/>
+        <module name="InnerAssignment"/>
+        <module name="JavadocType">
+            <property name="authorFormat" value="\S"/>
+        </module>
+        <module name="JavadocMethod">
+            <property name="allowUndeclaredRTE" value="true"/>
+            <property name="allowThrowsTagsForSubclasses" value="true"/>
+            <property name="allowMissingPropertyJavadoc" value="true"/>
+        </module>
+        <module name="JavadocVariable"/>
+        <module name="JavadocStyle">
+            <property name="scope" value="public"/>
+        </module>
+
+        <module name="LeftCurly">
+            <property name="option" value="eol"/>
+            <property name="tokens" value="CLASS_DEF"/>
+            <property name="tokens" value="CTOR_DEF"/>
+            <property name="tokens" value="INTERFACE_DEF"/>
+            <property name="tokens" value="METHOD_DEF"/>
+            <property name="tokens" value="LITERAL_CATCH"/>
+            <property name="tokens" value="LITERAL_DO"/>
+            <property name="tokens" value="LITERAL_ELSE"/>
+            <property name="tokens" value="LITERAL_FINALLY"/>
+            <property name="tokens" value="LITERAL_FOR"/>
+            <property name="tokens" value="LITERAL_IF"/>
+            <property name="tokens" value="LITERAL_SWITCH"/>
+            <property name="tokens" value="LITERAL_SYNCHRONIZED"/>
+            <property name="tokens" value="LITERAL_TRY"/>
+            <property name="tokens" value="LITERAL_WHILE"/>
+        </module>
+
+        <module name="OuterTypeNumber"/>
+        <module name="LineLength">
+            <property name="ignorePattern" value="^ *\* *[^ ]+$"/>
+            <property name="max" value="150"/>
+        </module>
+
+        <module name="MethodCount">
+            <property name="maxTotal" value="40"/>
+        </module>
+
+        <module name="LocalFinalVariableName"/>
+        <module name="LocalVariableName"/>
+        <module name="MemberName">
+            <property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
+        </module>
+        <module name="MethodLength">
+            <property name="max" value="160"/>
+            <property name="countEmpty" value="false"/>
+        </module>
+        <module name="MethodName"/>
+        <module name="MethodParamPad"/>
+        <module name="ModifierOrder"/>
+        <module name="NeedBraces"/>
+        <module name="NoWhitespaceAfter">
+            <property name="tokens" value="ARRAY_INIT"/>
+            <property name="tokens" value="BNOT"/>
+            <property name="tokens" value="DEC"/>
+            <property name="tokens" value="DOT"/>
+            <property name="tokens" value="INC"/>
+            <property name="tokens" value="LNOT"/>
+            <property name="tokens" value="UNARY_MINUS"/>
+            <property name="tokens" value="UNARY_PLUS"/>
+        </module>
+
+        <module name="NoWhitespaceBefore"/>
+        <module name="NoWhitespaceBefore">
+            <property name="tokens" value="DOT"/>
+            <property name="allowLineBreaks" value="true"/>
+        </module>
+
+        <module name="OperatorWrap"/>
+        <module name="OperatorWrap">
+            <property name="tokens" value="ASSIGN"/>
+            <property name="tokens" value="DIV_ASSIGN"/>
+            <property name="tokens" value="PLUS_ASSIGN"/>
+            <property name="tokens" value="MINUS_ASSIGN"/>
+            <property name="tokens" value="STAR_ASSIGN"/>
+            <property name="tokens" value="MOD_ASSIGN"/>
+            <property name="tokens" value="SR_ASSIGN"/>
+            <property name="tokens" value="BSR_ASSIGN"/>
+            <property name="tokens" value="SL_ASSIGN"/>
+            <property name="tokens" value="BXOR_ASSIGN"/>
+            <property name="tokens" value="BOR_ASSIGN"/>
+            <property name="tokens" value="BAND_ASSIGN"/>
+            <property name="option" value="eol"/>
+        </module>
+        <module name="PackageName"/>
+        <module name="ParameterName">
+            <property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
+        </module>
+        <module name="ParameterNumber">
+            <property name="id" value="paramNum"/>
+        </module>
+        <module name="ParenPad"/>
+        <module name="TypecastParenPad"/>
+        <module name="RedundantImport"/>
+        <module name="RedundantModifier"/>
+        <module name="RightCurly">
+            <property name="option" value="same"/>
+        </module>
+        <module name="SimplifyBooleanExpression"/>
+        <module name="SimplifyBooleanReturn"/>
+        <module name="StaticVariableName">
+            <property name="format" value="^[a-z][a-zA-Z0-9]*$"/>
+        </module>
+        <module name="TypeName"/>
+        <module name="UnusedImports"/>
+        <module name="UpperEll"/>
+        <module name="VisibilityModifier"/>
+        <module name="WhitespaceAfter"/>
+        <module name="WhitespaceAround"/>
+        <module name="GenericWhitespace"/>
+        <module name="FinalClass"/>
+        <module name="MissingSwitchDefault"/>
+        <!--module name="MagicNumber"/-->
+        <!--module name="Indentation">
+          <property name="basicOffset" value="4"/>
+          <property name="braceAdjustment" value="0"/>
+          <property name="caseIndent" value="0"/>
+        </module-->
+        <module name="ArrayTrailingComma"/>
+        <module name="FinalLocalVariable"/>
+        <module name="EqualsAvoidNull"/>
+        <module name="ParameterAssignment"/>
+
+        <!-- Generates quite a few errors -->
+        <module name="CyclomaticComplexity">
+            <property name="severity" value="ignore"/>
+        </module>
+
+        <module name="NestedForDepth">
+            <property name="max" value="2"/>
+        </module>
+        <module name="NestedIfDepth">
+            <property name="max" value="4"/>
+        </module>
+        <module name="NestedTryDepth">
+            <property name="max" value="2"/>
+        </module>
+        <!--module name="ExplicitInitialization"/-->
+        <module name="AnnotationUseStyle"/>
+        <module name="MissingDeprecated"/>
+        <module name="MissingOverride">
+            <property name="javaFiveCompatibility" value="true"/>
+        </module>
+        <module name="PackageAnnotation"/>
+        <module name="SuppressWarnings"/>
+        <module name="OuterTypeFilename"/>
+        <module name="HideUtilityClassConstructor"/>
     </module>
-    <module name="NestedTryDepth">
-        <property name="max" value="2"/>
-    </module>
-    <!--module name="ExplicitInitialization"/-->
-    <module name="AnnotationUseStyle"/>
-    <module name="MissingDeprecated"/>
-    <module name="MissingOverride">
-      <property name="javaFiveCompatibility" value="true"/>
-    </module>
-    <module name="PackageAnnotation"/>
-    <module name="SuppressWarnings"/>
-    <module name="OuterTypeFilename"/>
-    <module name="HideUtilityClassConstructor"/>
-  </module>
 </module>

src/main/site-resources/current.txt

@@ -0,0 +1 @@
+${project.version}