| Classes in this File | Line Coverage | Branch Coverage | Complexity | ||||
| Vulnerability |
|
| 1.3243243243243243;1.324 |
| 1 | /* | |
| 2 | * This file is part of dependency-check-core. | |
| 3 | * | |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); | |
| 5 | * you may not use this file except in compliance with the License. | |
| 6 | * You may obtain a copy of the License at | |
| 7 | * | |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 | |
| 9 | * | |
| 10 | * Unless required by applicable law or agreed to in writing, software | |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, | |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 13 | * See the License for the specific language governing permissions and | |
| 14 | * limitations under the License. | |
| 15 | * | |
| 16 | * Copyright (c) 2012 Jeremy Long. All Rights Reserved. | |
| 17 | */ | |
| 18 | package org.owasp.dependencycheck.dependency; | |
| 19 | ||
| 20 | import java.io.Serializable; | |
| 21 | import java.util.Set; | |
| 22 | import java.util.SortedSet; | |
| 23 | import java.util.TreeSet; | |
| 24 | import org.apache.commons.lang3.builder.CompareToBuilder; | |
| 25 | ||
| 26 | /** | |
| 27 | * Contains the information about a vulnerability. | |
| 28 | * | |
| 29 | * @author Jeremy Long | |
| 30 | */ | |
| 31 | 41 | public class Vulnerability implements Serializable, Comparable<Vulnerability> { |
| 32 | ||
| 33 | /** | |
| 34 | * The serial version uid. | |
| 35 | */ | |
| 36 | private static final long serialVersionUID = 307319490326651052L; | |
| 37 | ||
| 38 | /** | |
| 39 | * The name of the vulnerability. | |
| 40 | */ | |
| 41 | private String name; | |
| 42 | ||
| 43 | /** | |
| 44 | * Get the value of name. | |
| 45 | * | |
| 46 | * @return the value of name | |
| 47 | */ | |
| 48 | public String getName() { | |
| 49 | 90 | return name; |
| 50 | } | |
| 51 | ||
| 52 | /** | |
| 53 | * Set the value of name. | |
| 54 | * | |
| 55 | * @param name new value of name | |
| 56 | */ | |
| 57 | public void setName(String name) { | |
| 58 | 38 | this.name = name; |
| 59 | 38 | } |
| 60 | /** | |
| 61 | * the description of the vulnerability. | |
| 62 | */ | |
| 63 | private String description; | |
| 64 | ||
| 65 | /** | |
| 66 | * Get the value of description. | |
| 67 | * | |
| 68 | * @return the value of description | |
| 69 | */ | |
| 70 | public String getDescription() { | |
| 71 | 0 | return description; |
| 72 | } | |
| 73 | ||
| 74 | /** | |
| 75 | * Set the value of description. | |
| 76 | * | |
| 77 | * @param description new value of description | |
| 78 | */ | |
| 79 | public void setDescription(String description) { | |
| 80 | 37 | this.description = description; |
| 81 | 37 | } |
| 82 | /** | |
| 83 | * References for this vulnerability. | |
| 84 | */ | |
| 85 | 41 | private SortedSet<Reference> references = new TreeSet<Reference>(); |
| 86 | ||
| 87 | /** | |
| 88 | * Get the value of references. | |
| 89 | * | |
| 90 | * @return the value of references | |
| 91 | */ | |
| 92 | public Set<Reference> getReferences() { | |
| 93 | 0 | return references; |
| 94 | } | |
| 95 | ||
| 96 | /** | |
| 97 | * Set the value of references. | |
| 98 | * | |
| 99 | * @param references new value of references | |
| 100 | */ | |
| 101 | public void setReferences(SortedSet<Reference> references) { | |
| 102 | 0 | this.references = references; |
| 103 | 0 | } |
| 104 | ||
| 105 | /** | |
| 106 | * Adds a reference to the references collection. | |
| 107 | * | |
| 108 | * @param ref a reference for the vulnerability | |
| 109 | */ | |
| 110 | public void addReference(Reference ref) { | |
| 111 | 95 | this.references.add(ref); |
| 112 | 95 | } |
| 113 | ||
| 114 | /** | |
| 115 | * Adds a reference. | |
| 116 | * | |
| 117 | * @param referenceSource the source of the reference | |
| 118 | * @param referenceName the referenceName of the reference | |
| 119 | * @param referenceUrl the url of the reference | |
| 120 | */ | |
| 121 | public void addReference(String referenceSource, String referenceName, String referenceUrl) { | |
| 122 | 71 | final Reference ref = new Reference(); |
| 123 | 71 | ref.setSource(referenceSource); |
| 124 | 71 | ref.setName(referenceName); |
| 125 | 71 | ref.setUrl(referenceUrl); |
| 126 | 71 | this.references.add(ref); |
| 127 | 71 | } |
| 128 | /** | |
| 129 | * A set of vulnerable software. | |
| 130 | */ | |
| 131 | 41 | private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>(); |
| 132 | ||
| 133 | /** | |
| 134 | * Get the value of vulnerableSoftware. | |
| 135 | * | |
| 136 | * @return the value of vulnerableSoftware | |
| 137 | */ | |
| 138 | public Set<VulnerableSoftware> getVulnerableSoftware() { | |
| 139 | 3 | return vulnerableSoftware; |
| 140 | } | |
| 141 | ||
| 142 | /** | |
| 143 | * Set the value of vulnerableSoftware. | |
| 144 | * | |
| 145 | * @param vulnerableSoftware new value of vulnerableSoftware | |
| 146 | */ | |
| 147 | public void setVulnerableSoftware(SortedSet<VulnerableSoftware> vulnerableSoftware) { | |
| 148 | 0 | this.vulnerableSoftware = vulnerableSoftware; |
| 149 | 0 | } |
| 150 | ||
| 151 | /** | |
| 152 | * Adds an entry for vulnerable software. | |
| 153 | * | |
| 154 | * @param cpe string representation of a CPE entry | |
| 155 | * @return if the add succeeded | |
| 156 | */ | |
| 157 | public boolean addVulnerableSoftware(String cpe) { | |
| 158 | 907 | return addVulnerableSoftware(cpe, null); |
| 159 | } | |
| 160 | ||
| 161 | /** | |
| 162 | * Adds an entry for vulnerable software. | |
| 163 | * | |
| 164 | * @param cpe string representation of a cpe | |
| 165 | * @param previousVersion the previous version (previousVersion - cpe would | |
| 166 | * be considered vulnerable) | |
| 167 | * @return if the add succeeded | |
| 168 | */ | |
| 169 | public boolean addVulnerableSoftware(String cpe, String previousVersion) { | |
| 170 | 979 | final VulnerableSoftware vs = new VulnerableSoftware(); |
| 171 | 979 | vs.setCpe(cpe); |
| 172 | 979 | if (previousVersion != null) { |
| 173 | 10 | vs.setPreviousVersion(previousVersion); |
| 174 | } | |
| 175 | 979 | return updateVulnerableSoftware(vs); |
| 176 | } | |
| 177 | ||
| 178 | /** | |
| 179 | * Adds or updates a vulnerable software entry. | |
| 180 | * | |
| 181 | * @param vulnSoftware the vulnerable software | |
| 182 | * @return if the update succeeded | |
| 183 | */ | |
| 184 | public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) { | |
| 185 | 980 | if (vulnerableSoftware.contains(vulnSoftware)) { |
| 186 | 3 | vulnerableSoftware.remove(vulnSoftware); |
| 187 | } | |
| 188 | 980 | return vulnerableSoftware.add(vulnSoftware); |
| 189 | } | |
| 190 | /** | |
| 191 | * The CWE for the vulnerability. | |
| 192 | */ | |
| 193 | private String cwe; | |
| 194 | ||
| 195 | /** | |
| 196 | * Get the value of cwe. | |
| 197 | * | |
| 198 | * @return the value of cwe | |
| 199 | */ | |
| 200 | public String getCwe() { | |
| 201 | 2 | return cwe; |
| 202 | } | |
| 203 | ||
| 204 | /** | |
| 205 | * Set the value of cwe. | |
| 206 | * | |
| 207 | * @param cwe new value of cwe | |
| 208 | */ | |
| 209 | public void setCwe(String cwe) { | |
| 210 | 30 | this.cwe = cwe; |
| 211 | 30 | } |
| 212 | /** | |
| 213 | * CVSS Score. | |
| 214 | */ | |
| 215 | private float cvssScore; | |
| 216 | ||
| 217 | /** | |
| 218 | * Get the value of cvssScore. | |
| 219 | * | |
| 220 | * @return the value of cvssScore | |
| 221 | */ | |
| 222 | public float getCvssScore() { | |
| 223 | 3 | return cvssScore; |
| 224 | } | |
| 225 | ||
| 226 | /** | |
| 227 | * Set the value of cvssScore. | |
| 228 | * | |
| 229 | * @param cvssScore new value of cvssScore | |
| 230 | */ | |
| 231 | public void setCvssScore(float cvssScore) { | |
| 232 | 37 | this.cvssScore = cvssScore; |
| 233 | 37 | } |
| 234 | /** | |
| 235 | * CVSS Access Vector. | |
| 236 | */ | |
| 237 | private String cvssAccessVector; | |
| 238 | ||
| 239 | /** | |
| 240 | * Get the value of cvssAccessVector. | |
| 241 | * | |
| 242 | * @return the value of cvssAccessVector | |
| 243 | */ | |
| 244 | public String getCvssAccessVector() { | |
| 245 | 0 | return cvssAccessVector; |
| 246 | } | |
| 247 | ||
| 248 | /** | |
| 249 | * Set the value of cvssAccessVector. | |
| 250 | * | |
| 251 | * @param cvssAccessVector new value of cvssAccessVector | |
| 252 | */ | |
| 253 | public void setCvssAccessVector(String cvssAccessVector) { | |
| 254 | 36 | this.cvssAccessVector = cvssAccessVector; |
| 255 | 36 | } |
| 256 | /** | |
| 257 | * CVSS Access Complexity. | |
| 258 | */ | |
| 259 | private String cvssAccessComplexity; | |
| 260 | ||
| 261 | /** | |
| 262 | * Get the value of cvssAccessComplexity. | |
| 263 | * | |
| 264 | * @return the value of cvssAccessComplexity | |
| 265 | */ | |
| 266 | public String getCvssAccessComplexity() { | |
| 267 | 0 | return cvssAccessComplexity; |
| 268 | } | |
| 269 | ||
| 270 | /** | |
| 271 | * Set the value of cvssAccessComplexity. | |
| 272 | * | |
| 273 | * @param cvssAccessComplexity new value of cvssAccessComplexity | |
| 274 | */ | |
| 275 | public void setCvssAccessComplexity(String cvssAccessComplexity) { | |
| 276 | 36 | this.cvssAccessComplexity = cvssAccessComplexity; |
| 277 | 36 | } |
| 278 | /** | |
| 279 | * CVSS Authentication. | |
| 280 | */ | |
| 281 | private String cvssAuthentication; | |
| 282 | ||
| 283 | /** | |
| 284 | * Get the value of cvssAuthentication. | |
| 285 | * | |
| 286 | * @return the value of cvssAuthentication | |
| 287 | */ | |
| 288 | public String getCvssAuthentication() { | |
| 289 | 0 | return cvssAuthentication; |
| 290 | } | |
| 291 | ||
| 292 | /** | |
| 293 | * Set the value of cvssAuthentication. | |
| 294 | * | |
| 295 | * @param cvssAuthentication new value of cvssAuthentication | |
| 296 | */ | |
| 297 | public void setCvssAuthentication(String cvssAuthentication) { | |
| 298 | 36 | this.cvssAuthentication = cvssAuthentication; |
| 299 | 36 | } |
| 300 | /** | |
| 301 | * CVSS Confidentiality Impact. | |
| 302 | */ | |
| 303 | private String cvssConfidentialityImpact; | |
| 304 | ||
| 305 | /** | |
| 306 | * Get the value of cvssConfidentialityImpact. | |
| 307 | * | |
| 308 | * @return the value of cvssConfidentialityImpact | |
| 309 | */ | |
| 310 | public String getCvssConfidentialityImpact() { | |
| 311 | 0 | return cvssConfidentialityImpact; |
| 312 | } | |
| 313 | ||
| 314 | /** | |
| 315 | * Set the value of cvssConfidentialityImpact. | |
| 316 | * | |
| 317 | * @param cvssConfidentialityImpact new value of cvssConfidentialityImpact | |
| 318 | */ | |
| 319 | public void setCvssConfidentialityImpact(String cvssConfidentialityImpact) { | |
| 320 | 36 | this.cvssConfidentialityImpact = cvssConfidentialityImpact; |
| 321 | 36 | } |
| 322 | /** | |
| 323 | * CVSS Integrity Impact. | |
| 324 | */ | |
| 325 | private String cvssIntegrityImpact; | |
| 326 | ||
| 327 | /** | |
| 328 | * Get the value of cvssIntegrityImpact. | |
| 329 | * | |
| 330 | * @return the value of cvssIntegrityImpact | |
| 331 | */ | |
| 332 | public String getCvssIntegrityImpact() { | |
| 333 | 0 | return cvssIntegrityImpact; |
| 334 | } | |
| 335 | ||
| 336 | /** | |
| 337 | * Set the value of cvssIntegrityImpact. | |
| 338 | * | |
| 339 | * @param cvssIntegrityImpact new value of cvssIntegrityImpact | |
| 340 | */ | |
| 341 | public void setCvssIntegrityImpact(String cvssIntegrityImpact) { | |
| 342 | 36 | this.cvssIntegrityImpact = cvssIntegrityImpact; |
| 343 | 36 | } |
| 344 | /** | |
| 345 | * CVSS Availability Impact. | |
| 346 | */ | |
| 347 | private String cvssAvailabilityImpact; | |
| 348 | ||
| 349 | /** | |
| 350 | * Get the value of cvssAvailabilityImpact. | |
| 351 | * | |
| 352 | * @return the value of cvssAvailabilityImpact | |
| 353 | */ | |
| 354 | public String getCvssAvailabilityImpact() { | |
| 355 | 0 | return cvssAvailabilityImpact; |
| 356 | } | |
| 357 | ||
| 358 | /** | |
| 359 | * Set the value of cvssAvailabilityImpact. | |
| 360 | * | |
| 361 | * @param cvssAvailabilityImpact new value of cvssAvailabilityImpact | |
| 362 | */ | |
| 363 | public void setCvssAvailabilityImpact(String cvssAvailabilityImpact) { | |
| 364 | 36 | this.cvssAvailabilityImpact = cvssAvailabilityImpact; |
| 365 | 36 | } |
| 366 | ||
| 367 | @Override | |
| 368 | public boolean equals(Object obj) { | |
| 369 | 0 | if (obj == null) { |
| 370 | 0 | return false; |
| 371 | } | |
| 372 | 0 | if (getClass() != obj.getClass()) { |
| 373 | 0 | return false; |
| 374 | } | |
| 375 | 0 | final Vulnerability other = (Vulnerability) obj; |
| 376 | 0 | if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) { |
| 377 | 0 | return false; |
| 378 | } | |
| 379 | 0 | return true; |
| 380 | } | |
| 381 | ||
| 382 | @Override | |
| 383 | public int hashCode() { | |
| 384 | 9 | int hash = 5; |
| 385 | 9 | hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0); |
| 386 | 9 | return hash; |
| 387 | } | |
| 388 | ||
| 389 | @Override | |
| 390 | public String toString() { | |
| 391 | 0 | final StringBuilder sb = new StringBuilder("Vulnerability "); |
| 392 | 0 | sb.append(this.name); |
| 393 | 0 | sb.append("\nReferences:\n"); |
| 394 | 0 | for (Reference reference : this.references) { |
| 395 | 0 | sb.append("=> "); |
| 396 | 0 | sb.append(reference); |
| 397 | 0 | sb.append("\n"); |
| 398 | 0 | } |
| 399 | 0 | sb.append("\nSoftware:\n"); |
| 400 | 0 | for (VulnerableSoftware software : this.vulnerableSoftware) { |
| 401 | 0 | sb.append("=> "); |
| 402 | 0 | sb.append(software); |
| 403 | 0 | sb.append("\n"); |
| 404 | 0 | } |
| 405 | 0 | return sb.toString(); |
| 406 | } | |
| 407 | ||
| 408 | /** | |
| 409 | * Compares two vulnerabilities. | |
| 410 | * | |
| 411 | * @param v a vulnerability to be compared | |
| 412 | * @return a negative integer, zero, or a positive integer as this object is | |
| 413 | * less than, equal to, or greater than the specified vulnerability | |
| 414 | */ | |
| 415 | @Override | |
| 416 | public int compareTo(Vulnerability v) { | |
| 417 | 0 | return new CompareToBuilder() |
| 418 | 0 | .append(this.name, v.name) |
| 419 | 0 | .toComparison(); |
| 420 | //return v.getName().compareTo(this.getName()); | |
| 421 | } | |
| 422 | ||
| 423 | /** | |
| 424 | * The CPE id that caused this vulnerability to be flagged. | |
| 425 | */ | |
| 426 | private String matchedCPE; | |
| 427 | /** | |
| 428 | * Whether or not all previous versions were affected. | |
| 429 | */ | |
| 430 | private String matchedAllPreviousCPE; | |
| 431 | ||
| 432 | /** | |
| 433 | * Sets the CPE that caused this vulnerability to be flagged. | |
| 434 | * | |
| 435 | * @param cpeId a CPE identifier | |
| 436 | * @param previous a flag indicating whether or not all previous versions | |
| 437 | * were affected (any non-null value is considered true) | |
| 438 | */ | |
| 439 | public void setMatchedCPE(String cpeId, String previous) { | |
| 440 | 9 | matchedCPE = cpeId; |
| 441 | 9 | matchedAllPreviousCPE = previous; |
| 442 | 9 | } |
| 443 | ||
| 444 | /** | |
| 445 | * Get the value of matchedCPE. | |
| 446 | * | |
| 447 | * @return the value of matchedCPE | |
| 448 | */ | |
| 449 | public String getMatchedCPE() { | |
| 450 | 0 | return matchedCPE; |
| 451 | } | |
| 452 | ||
| 453 | /** | |
| 454 | * Get the value of matchedAllPreviousCPE. | |
| 455 | * | |
| 456 | * @return the value of matchedAllPreviousCPE | |
| 457 | */ | |
| 458 | public String getMatchedAllPreviousCPE() { | |
| 459 | 0 | return matchedAllPreviousCPE; |
| 460 | } | |
| 461 | ||
| 462 | /** | |
| 463 | * Determines whether or not matchedAllPreviousCPE has been set. | |
| 464 | * | |
| 465 | * @return true if matchedAllPreviousCPE is not null; otherwise false | |
| 466 | */ | |
| 467 | public boolean hasMatchedAllPreviousCPE() { | |
| 468 | 0 | return matchedAllPreviousCPE != null; |
| 469 | } | |
| 470 | } |