Coverage Report

Coverage Report - org.owasp.dependencycheck.suppression.SuppressionRule

Classes in this File

Line Coverage

Branch Coverage

Complexity

SuppressionRule

70%

92/130

66%

72/108

3.036

 /*
  * This file is part of dependency-check-core.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
  */
 package org.owasp.dependencycheck.suppression;
 
 import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
 import org.owasp.dependencycheck.dependency.Dependency;
 import org.owasp.dependencycheck.dependency.Identifier;
 import org.owasp.dependencycheck.dependency.Vulnerability;
 
 /**
  *
  * @author Jeremy Long <jeremy.long@owasp.org>
  */
 public class SuppressionRule {
 
     /**
      * The file path for the suppression.
      */
     private PropertyType filePath;
 
     /**
      * Get the value of filePath.
      *
      * @return the value of filePath
      */
     public PropertyType getFilePath() {
         return filePath;
     }
 
     /**
      * Set the value of filePath.
      *
      * @param filePath new value of filePath
      */
     public void setFilePath(PropertyType filePath) {
         this.filePath = filePath;
     }
     /**
      * The sha1 hash.
      */
     private String sha1;
 
     /**
      * Get the value of sha1.
      *
      * @return the value of sha1
      */
     public String getSha1() {
         return sha1;
     }
 
     /**
      * Set the value of sha1.
      *
      * @param sha1 new value of sha1
      */
     public void setSha1(String sha1) {
         this.sha1 = sha1;
     }
     /**
      * A list of CPEs to suppression
      */
     private List<PropertyType> cpe = new ArrayList<PropertyType>();
 
     /**
      * Get the value of cpe.
      *
      * @return the value of cpe
      */
     public List<PropertyType> getCpe() {
         return cpe;
     }
 
     /**
      * Set the value of cpe.
      *
      * @param cpe new value of cpe
      */
     public void setCpe(List<PropertyType> cpe) {
         this.cpe = cpe;
     }
 
     /**
      * Adds the cpe to the cpe list.
      *
      * @param cpe the cpe to add
      */
     public void addCpe(PropertyType cpe) {
         this.cpe.add(cpe);
     }
 
     /**
      * Returns whether or not this suppression rule as CPE entries.
      *
      * @return whether or not this suppression rule as CPE entries
      */
     public boolean hasCpe() {
         return cpe.size() > 0;
     }
     /**
      * The list of cvssBelow scores.
      */
     private List<Float> cvssBelow = new ArrayList<Float>();
 
     /**
      * Get the value of cvssBelow.
      *
      * @return the value of cvssBelow
      */
     public List<Float> getCvssBelow() {
         return cvssBelow;
     }
 
     /**
      * Set the value of cvssBelow.
      *
      * @param cvssBelow new value of cvssBelow
      */
     public void setCvssBelow(List<Float> cvssBelow) {
         this.cvssBelow = cvssBelow;
     }
 
     /**
      * Adds the cvss to the cvssBelow list.
      *
      * @param cvss the cvss to add
      */
     public void addCvssBelow(Float cvss) {
         this.cvssBelow.add(cvss);
     }
 
     /**
      * Returns whether or not this suppression rule has cvss suppressions.
      *
      * @return whether or not this suppression rule has cvss suppressions
      */
     public boolean hasCvssBelow() {
         return cvssBelow.size() > 0;
     }
     /**
      * The list of cwe entries to suppress.
      */
     private List<String> cwe = new ArrayList<String>();
 
     /**
      * Get the value of cwe.
      *
      * @return the value of cwe
      */
     public List<String> getCwe() {
         return cwe;
     }
 
     /**
      * Set the value of cwe.
      *
      * @param cwe new value of cwe
      */
     public void setCwe(List<String> cwe) {
         this.cwe = cwe;
     }
 
     /**
      * Adds the cwe to the cwe list.
      *
      * @param cwe the cwe to add
      */
     public void addCwe(String cwe) {
         this.cwe.add(cwe);
     }
 
     /**
      * Returns whether this suppression rule has CWE entries.
      *
      * @return whether this suppression rule has CWE entries
      */
     public boolean hasCwe() {
         return cwe.size() > 0;
     }
     /**
      * The list of cve entries to suppress.
      */
     private List<String> cve = new ArrayList<String>();
 
     /**
      * Get the value of cve.
      *
      * @return the value of cve
      */
     public List<String> getCve() {
         return cve;
     }
 
     /**
      * Set the value of cve.
      *
      * @param cve new value of cve
      */
     public void setCve(List<String> cve) {
         this.cve = cve;
     }
 
     /**
      * Adds the cve to the cve list.
      *
      * @param cve the cve to add
      */
     public void addCve(String cve) {
         this.cve.add(cve);
     }
 
     /**
      * Returns whether this suppression rule has CVE entries.
      *
      * @return whether this suppression rule has CVE entries
      */
     public boolean hasCve() {
         return cve.size() > 0;
     }
     /**
      * A Maven GAV to suppression.
      */
     private PropertyType gav = null;
 
     /**
      * Get the value of Maven GAV.
      *
      * @return the value of gav
      */
     public PropertyType getGav() {
         return gav;
     }
 
     /**
      * Set the value of Maven GAV.
      *
      * @param gav new value of Maven gav
      */
     public void setGav(PropertyType gav) {
         this.gav = gav;
     }
 
     /**
      * Returns whether or not this suppression rule as GAV entries.
      *
      * @return whether or not this suppression rule as GAV entries
      */
     public boolean hasGav() {
         return gav != null;
     }
 
     /**
      * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any
      * should be, they are removed from the dependency.
      *
      * @param dependency a project dependency to analyze
      */
     public void process(Dependency dependency) {
         if (filePath != null && !filePath.matches(dependency.getFilePath())) {
             return;
         }
         if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
             return;
         }
         if (gav != null) {
             final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
             boolean gavFound = false;
             while (itr.hasNext()) {
                 final Identifier i = itr.next();
                 if (identifierMatches("maven", this.gav, i)) {
                     gavFound = true;
                     break;
                 }
             }
             if (!gavFound) {
                 return;
             }
         }
 
         if (this.hasCpe()) {
             final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
             while (itr.hasNext()) {
                 final Identifier i = itr.next();
                 for (PropertyType c : this.cpe) {
                     if (identifierMatches("cpe", c, i)) {
                         dependency.addSuppressedIdentifier(i);
                         itr.remove();
                         break;
                     }
                 }
             }
         }
         if (hasCve() || hasCwe() || hasCvssBelow()) {
             final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
             while (itr.hasNext()) {
                 boolean remove = false;
                 final Vulnerability v = itr.next();
                 for (String entry : this.cve) {
                     if (entry.equalsIgnoreCase(v.getName())) {
                         remove = true;
                         break;
                     }
                 }
                 if (!remove) {
                     for (String entry : this.cwe) {
                         if (v.getCwe() != null) {
                             final String toMatch = String.format("CWE-%s ", entry);
                             final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
                             if (toTest.equals(toMatch)) {
                                 remove = true;
                                 break;
                             }
                         }
                     }
                 }
                 if (!remove) {
                     for (float cvss : this.cvssBelow) {
                         if (v.getCvssScore() < cvss) {
                             remove = true;
                             break;
                         }
                     }
                 }
                 if (remove) {
                     dependency.addSuppressedVulnerability(v);
                     itr.remove();
                 }
             }
         }
     }
 
     /**
      * Identifies if the cpe specified by the cpe suppression rule does not specify a version.
      *
      * @param c a suppression rule identifier
      * @return true if the property type does not specify a version; otherwise false
      */
     boolean cpeHasNoVersion(PropertyType c) {
         if (c.isRegex()) {
             return false;
         }
         if (countCharacter(c.getValue(), ':') == 3) {
             return true;
         }
         return false;
     }
 
     /**
      * Counts the number of occurrences of the character found within the string.
      *
      * @param str the string to check
      * @param c the character to count
      * @return the number of times the character is found in the string
      */
     int countCharacter(String str, char c) {
         int count = 0;
         int pos = str.indexOf(c) + 1;
         while (pos > 0) {
             count += 1;
             pos = str.indexOf(c, pos) + 1;
         }
         return count;
     }
 
     /**
      * Determines if the cpeEntry specified as a PropertyType matches the given Identifier.
      *
      * @param identifierType the type of identifier ("cpe", "maven", etc.)
      * @param suppressionEntry a suppression rule entry
      * @param identifier a CPE identifier to check
      * @return true if the entry matches; otherwise false
      */
     boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) {
         if (identifierType.equals(identifier.getType())) {
             if (suppressionEntry.matches(identifier.getValue())) {
                 return true;
             } else if ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) {
                 if (suppressionEntry.isCaseSensitive()) {
                     return identifier.getValue().startsWith(suppressionEntry.getValue());
                 } else {
                     final String id = identifier.getValue().toLowerCase();
                     final String check = suppressionEntry.getValue().toLowerCase();
                     return id.startsWith(check);
                 }
             }
         }
         return false;
     }
 
     /**
      * Standard toString implementation.
      *
      * @return a string representation of this object
      */
     @Override
     public String toString() {
         final StringBuilder sb = new StringBuilder();
         sb.append("SuppressionRule{");
         if (filePath != null) {
             sb.append("filePath=").append(filePath).append(",");
         }
         if (sha1 != null) {
             sb.append("sha1=").append(sha1).append(",");
         }
         if (gav != null) {
             sb.append("gav=").append(gav).append(",");
         }
         if (cpe != null && cpe.size() > 0) {
             sb.append("cpe={");
             for (PropertyType pt : cpe) {
                 sb.append(pt).append(",");
             }
             sb.append("}");
         }
         if (cwe != null && cwe.size() > 0) {
             sb.append("cwe={");
             for (String s : cwe) {
                 sb.append(s).append(",");
             }
             sb.append("}");
         }
         if (cve != null && cve.size() > 0) {
             sb.append("cve={");
             for (String s : cve) {
                 sb.append(s).append(",");
             }
             sb.append("}");
         }
         if (cvssBelow != null && cvssBelow.size() > 0) {
             sb.append("cvssBelow={");
             for (Float s : cvssBelow) {
                 sb.append(s).append(",");
             }
             sb.append("}");
         }
         sb.append("}");
         return sb.toString();
     }
 }

1		/*
2		* This file is part of dependency-check-core.
3		*
4		* Licensed under the Apache License, Version 2.0 (the "License");
5		* you may not use this file except in compliance with the License.
6		* You may obtain a copy of the License at
7		*
8		* http://www.apache.org/licenses/LICENSE-2.0
9		*
10		* Unless required by applicable law or agreed to in writing, software
11		* distributed under the License is distributed on an "AS IS" BASIS,
12		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13		* See the License for the specific language governing permissions and
14		* limitations under the License.
15		*
16		* Copyright (c) 2013 Jeremy Long. All Rights Reserved.
17		*/
18		package org.owasp.dependencycheck.suppression;
19
20		import java.util.ArrayList;
21		import java.util.Iterator;
22		import java.util.List;
23		import org.owasp.dependencycheck.dependency.Dependency;
24		import org.owasp.dependencycheck.dependency.Identifier;
25		import org.owasp.dependencycheck.dependency.Vulnerability;
26
27		/**
28		*
29		* @author Jeremy Long <jeremy.long@owasp.org>
30		*/
31	176	public class SuppressionRule {
32
33		/**
34		* The file path for the suppression.
35		*/
36		private PropertyType filePath;
37
38		/**
39		* Get the value of filePath.
40		*
41		* @return the value of filePath
42		*/
43		public PropertyType getFilePath() {
44		return filePath;
45		}
46
47		/**
48		* Set the value of filePath.
49		*
50		* @param filePath new value of filePath
51		*/
52		public void setFilePath(PropertyType filePath) {
53		this.filePath = filePath;
54		}
55		/**
56		* The sha1 hash.
57		*/
58		private String sha1;
59
60		/**
61		* Get the value of sha1.
62		*
63		* @return the value of sha1
64		*/
65		public String getSha1() {
66		return sha1;
67		}
68
69		/**
70		* Set the value of sha1.
71		*
72		* @param sha1 new value of sha1
73		*/
74		public void setSha1(String sha1) {
75		this.sha1 = sha1;
76		}
77		/**
78		* A list of CPEs to suppression
79		*/
80	176	private List<PropertyType> cpe = new ArrayList<PropertyType>();
81
82		/**
83		* Get the value of cpe.
84		*
85		* @return the value of cpe
86		*/
87		public List<PropertyType> getCpe() {
88		return cpe;
89		}
90
91		/**
92		* Set the value of cpe.
93		*
94		* @param cpe new value of cpe
95		*/
96		public void setCpe(List<PropertyType> cpe) {
97		this.cpe = cpe;
98		}
99
100		/**
101		* Adds the cpe to the cpe list.
102		*
103		* @param cpe the cpe to add
104		*/
105		public void addCpe(PropertyType cpe) {
106	140	this.cpe.add(cpe);
107	140	}
108
109		/**
110		* Returns whether or not this suppression rule as CPE entries.
111		*
112		* @return whether or not this suppression rule as CPE entries
113		*/
114		public boolean hasCpe() {
115	44	return cpe.size() > 0;
116		}
117		/**
118		* The list of cvssBelow scores.
119		*/
120	176	private List<Float> cvssBelow = new ArrayList<Float>();
121
122		/**
123		* Get the value of cvssBelow.
124		*
125		* @return the value of cvssBelow
126		*/
127		public List<Float> getCvssBelow() {
128		return cvssBelow;
129		}
130
131		/**
132		* Set the value of cvssBelow.
133		*
134		* @param cvssBelow new value of cvssBelow
135		*/
136		public void setCvssBelow(List<Float> cvssBelow) {
137		this.cvssBelow = cvssBelow;
138		}
139
140		/**
141		* Adds the cvss to the cvssBelow list.
142		*
143		* @param cvss the cvss to add
144		*/
145		public void addCvssBelow(Float cvss) {
146	28	this.cvssBelow.add(cvss);
147	28	}
148
149		/**
150		* Returns whether or not this suppression rule has cvss suppressions.
151		*
152		* @return whether or not this suppression rule has cvss suppressions
153		*/
154		public boolean hasCvssBelow() {
155	32	return cvssBelow.size() > 0;
156		}
157		/**
158		* The list of cwe entries to suppress.
159		*/
160	176	private List<String> cwe = new ArrayList<String>();
161
162		/**
163		* Get the value of cwe.
164		*
165		* @return the value of cwe
166		*/
167		public List<String> getCwe() {
168		return cwe;
169		}
170
171		/**
172		* Set the value of cwe.
173		*
174		* @param cwe new value of cwe
175		*/
176		public void setCwe(List<String> cwe) {
177		this.cwe = cwe;
178		}
179
180		/**
181		* Adds the cwe to the cwe list.
182		*
183		* @param cwe the cwe to add
184		*/
185		public void addCwe(String cwe) {
186	8	this.cwe.add(cwe);
187	8	}
188
189		/**
190		* Returns whether this suppression rule has CWE entries.
191		*
192		* @return whether this suppression rule has CWE entries
193		*/
194		public boolean hasCwe() {
195	36	return cwe.size() > 0;
196		}
197		/**
198		* The list of cve entries to suppress.
199		*/
200	176	private List<String> cve = new ArrayList<String>();
201
202		/**
203		* Get the value of cve.
204		*
205		* @return the value of cve
206		*/
207		public List<String> getCve() {
208		return cve;
209		}
210
211		/**
212		* Set the value of cve.
213		*
214		* @param cve new value of cve
215		*/
216		public void setCve(List<String> cve) {
217		this.cve = cve;
218		}
219
220		/**
221		* Adds the cve to the cve list.
222		*
223		* @param cve the cve to add
224		*/
225		public void addCve(String cve) {
226	44	this.cve.add(cve);
227	44	}
228
229		/**
230		* Returns whether this suppression rule has CVE entries.
231		*
232		* @return whether this suppression rule has CVE entries
233		*/
234		public boolean hasCve() {
235	44	return cve.size() > 0;
236		}
237		/**
238		* A Maven GAV to suppression.
239		*/
240	176	private PropertyType gav = null;
241
242		/**
243		* Get the value of Maven GAV.
244		*
245		* @return the value of gav
246		*/
247		public PropertyType getGav() {
248		return gav;
249		}
250
251		/**
252		* Set the value of Maven GAV.
253		*
254		* @param gav new value of Maven gav
255		*/
256		public void setGav(PropertyType gav) {
257		this.gav = gav;
258		}
259
260		/**
261		* Returns whether or not this suppression rule as GAV entries.
262		*
263		* @return whether or not this suppression rule as GAV entries
264		*/
265		public boolean hasGav() {
266	0	return gav != null;
267		}
268
269		/**
270		* Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any
271		* should be, they are removed from the dependency.
272		*
273		* @param dependency a project dependency to analyze
274		*/
275		public void process(Dependency dependency) {
276	72	if (filePath != null && !filePath.matches(dependency.getFilePath())) {
277	0	return;
278		}
279	72	if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
280	4	return;
281		}
282	68	if (gav != null) {
283	36	final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
284	36	boolean gavFound = false;
285	84	while (itr.hasNext()) {
286	52	final Identifier i = itr.next();
287	52	if (identifierMatches("maven", this.gav, i)) {
288	4	gavFound = true;
289	4	break;
290		}
291	48	}
292	36	if (!gavFound) {
293	32	return;
294		}
295		}
296
297	36	if (this.hasCpe()) {
298	16	final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
299	56	while (itr.hasNext()) {
300	40	final Identifier i = itr.next();
301	40	for (PropertyType c : this.cpe) {
302	84	if (identifierMatches("cpe", c, i)) {
303	28	dependency.addSuppressedIdentifier(i);
304	28	itr.remove();
305	28	break;
306		}
307	56	}
308	40	}
309		}
310	36	if (hasCve() \|\| hasCwe() \|\| hasCvssBelow()) {
311	20	final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
312	40	while (itr.hasNext()) {
313	20	boolean remove = false;
314	20	final Vulnerability v = itr.next();
315	20	for (String entry : this.cve) {
316	12	if (entry.equalsIgnoreCase(v.getName())) {
317	4	remove = true;
318	4	break;
319		}
320	8	}
321	20	if (!remove) {
322	16	for (String entry : this.cwe) {
323	4	if (v.getCwe() != null) {
324	4	final String toMatch = String.format("CWE-%s ", entry);
325	4	final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
326	4	if (toTest.equals(toMatch)) {
327	4	remove = true;
328	4	break;
329		}
330		}
331	0	}
332		}
333	20	if (!remove) {
334	12	for (float cvss : this.cvssBelow) {
335	12	if (v.getCvssScore() < cvss) {
336	4	remove = true;
337	4	break;
338		}
339	8	}
340		}
341	20	if (remove) {
342	12	dependency.addSuppressedVulnerability(v);
343	12	itr.remove();
344		}
345	20	}
346		}
347	36	}
348
349		/**
350		* Identifies if the cpe specified by the cpe suppression rule does not specify a version.
351		*
352		* @param c a suppression rule identifier
353		* @return true if the property type does not specify a version; otherwise false
354		*/
355		boolean cpeHasNoVersion(PropertyType c) {
356	92	if (c.isRegex()) {
357	8	return false;
358		}
359	84	if (countCharacter(c.getValue(), ':') == 3) {
360	48	return true;
361		}
362	36	return false;
363		}
364
365		/**
366		* Counts the number of occurrences of the character found within the string.
367		*
368		* @param str the string to check
369		* @param c the character to count
370		* @return the number of times the character is found in the string
371		*/
372		int countCharacter(String str, char c) {
373	96	int count = 0;
374	96	int pos = str.indexOf(c) + 1;
375	408	while (pos > 0) {
376	312	count += 1;
377	312	pos = str.indexOf(c, pos) + 1;
378		}
379	96	return count;
380		}
381
382		/**
383		* Determines if the cpeEntry specified as a PropertyType matches the given Identifier.
384		*
385		* @param identifierType the type of identifier ("cpe", "maven", etc.)
386		* @param suppressionEntry a suppression rule entry
387		* @param identifier a CPE identifier to check
388		* @return true if the entry matches; otherwise false
389		*/
390		boolean identifierMatches(String identifierType, PropertyType suppressionEntry, Identifier identifier) {
391	172	if (identifierType.equals(identifier.getType())) {
392	112	if (suppressionEntry.matches(identifier.getValue())) {
393	28	return true;
394	84	} else if ("cpe".equals(identifierType) && cpeHasNoVersion(suppressionEntry)) {
395	44	if (suppressionEntry.isCaseSensitive()) {
396	0	return identifier.getValue().startsWith(suppressionEntry.getValue());
397		} else {
398	44	final String id = identifier.getValue().toLowerCase();
399	44	final String check = suppressionEntry.getValue().toLowerCase();
400	44	return id.startsWith(check);
401		}
402		}
403		}
404	100	return false;
405		}
406
407		/**
408		* Standard toString implementation.
409		*
410		* @return a string representation of this object
411		*/
412		@Override
413		public String toString() {
414	0	final StringBuilder sb = new StringBuilder();
415	0	sb.append("SuppressionRule{");
416	0	if (filePath != null) {
417	0	sb.append("filePath=").append(filePath).append(",");
418		}
419	0	if (sha1 != null) {
420	0	sb.append("sha1=").append(sha1).append(",");
421		}
422	0	if (gav != null) {
423	0	sb.append("gav=").append(gav).append(",");
424		}
425	0	if (cpe != null && cpe.size() > 0) {
426	0	sb.append("cpe={");
427	0	for (PropertyType pt : cpe) {
428	0	sb.append(pt).append(",");
429	0	}
430	0	sb.append("}");
431		}
432	0	if (cwe != null && cwe.size() > 0) {
433	0	sb.append("cwe={");
434	0	for (String s : cwe) {
435	0	sb.append(s).append(",");
436	0	}
437	0	sb.append("}");
438		}
439	0	if (cve != null && cve.size() > 0) {
440	0	sb.append("cve={");
441	0	for (String s : cve) {
442	0	sb.append(s).append(",");
443	0	}
444	0	sb.append("}");
445		}
446	0	if (cvssBelow != null && cvssBelow.size() > 0) {
447	0	sb.append("cvssBelow={");
448	0	for (Float s : cvssBelow) {
449	0	sb.append(s).append(",");
450	0	}
451	0	sb.append("}");
452		}
453	0	sb.append("}");
454	0	return sb.toString();
455		}
456		}