Coverage Report

Coverage Report - org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer

Classes in this File

Line Coverage

Branch Coverage

Complexity

DependencyBundlingAnalyzer

43%

68/156

31%

51/160

7.5

 /*
  * This file is part of dependency-check-core.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
  */
 package org.owasp.dependencycheck.analyzer;
 
 import java.io.File;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.ListIterator;
 import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import org.owasp.dependencycheck.Engine;
 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
 import org.owasp.dependencycheck.dependency.Dependency;
 import org.owasp.dependencycheck.dependency.Identifier;
 import org.owasp.dependencycheck.utils.DependencyVersion;
 import org.owasp.dependencycheck.utils.DependencyVersionUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  * <p>
  * This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are grouped. An
  * example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the same relative path
  * then these should be grouped into a single dependency under the core/main library.</p>
  * <p>
  * Note, this grouping only works on dependencies with identified CVE entries</p>
  *
  * @author Jeremy Long
  */
 public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer {
 
     /**
      * The Logger.
      */
     private static final Logger LOGGER = LoggerFactory.getLogger(DependencyBundlingAnalyzer.class);
 
     //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables">
     /**
      * A pattern for obtaining the first part of a filename.
      */
     private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z0-9]*");
     /**
      * a flag indicating if this analyzer has run. This analyzer only runs once.
      */
     private boolean analyzed = false;
     //</editor-fold>
     //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
     /**
      * The name of the analyzer.
      */
     private static final String ANALYZER_NAME = "Dependency Bundling Analyzer";
     /**
      * The phase that this analyzer is intended to run in.
      */
     private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
 
     /**
      * Returns the name of the analyzer.
      *
      * @return the name of the analyzer.
      */
     @Override
     public String getName() {
         return ANALYZER_NAME;
     }
 
     /**
      * Returns the phase that the analyzer is intended to run in.
      *
      * @return the phase that the analyzer is intended to run in.
      */
     @Override
     public AnalysisPhase getAnalysisPhase() {
         return ANALYSIS_PHASE;
     }
     //</editor-fold>
 
     /**
      * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of identifiers they are
      * likely related. The related dependencies are bundled into a single reportable item.
      *
      * @param ignore this analyzer ignores the dependency being analyzed
      * @param engine the engine that is scanning the dependencies
      * @throws AnalysisException is thrown if there is an error reading the JAR file.
      */
     @Override
     public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
         if (!analyzed) {
             analyzed = true;
             final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
             final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
             //for (Dependency nextDependency : engine.getDependencies()) {
             while (mainIterator.hasNext()) {
                 final Dependency dependency = mainIterator.next();
                 if (mainIterator.hasNext() && !dependenciesToRemove.contains(dependency)) {
                     final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
                     while (subIterator.hasNext()) {
                         final Dependency nextDependency = subIterator.next();
                         if (hashesMatch(dependency, nextDependency) && !containedInWar(dependency.getFilePath())
                                 && !containedInWar(nextDependency.getFilePath())) {
                             if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) {
                                 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                             } else {
                                 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
                                 break; //since we merged into the next dependency - skip forward to the next in mainIterator
                             }
                         } else if (isShadedJar(dependency, nextDependency)) {
                             if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {
                                 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
                                 nextDependency.getRelatedDependencies().remove(dependency);
                                 break;
                             } else {
                                 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                                 dependency.getRelatedDependencies().remove(nextDependency);
                             }
                         } else if (cpeIdentifiersMatch(dependency, nextDependency)
                                 && hasSameBasePath(dependency, nextDependency)
                                 && fileNameMatch(dependency, nextDependency)) {
                             if (isCore(dependency, nextDependency)) {
                                 mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                             } else {
                                 mergeDependencies(nextDependency, dependency, dependenciesToRemove);
                                 break; //since we merged into the next dependency - skip forward to the next in mainIterator
                             }
                         }
                     }
                 }
             }
             //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions
             // was difficult because of the inner iterator.
             engine.getDependencies().removeAll(dependenciesToRemove);
         }
     }
 
     /**
      * Adds the relatedDependency to the dependency's related dependencies.
      *
      * @param dependency the main dependency
      * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the source of
      * dependencies to remove
      * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this function
      * adds to this collection
      */
     private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
         dependency.addRelatedDependency(relatedDependency);
         final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
         while (i.hasNext()) {
             dependency.addRelatedDependency(i.next());
             i.remove();
         }
         if (dependency.getSha1sum().equals(relatedDependency.getSha1sum())) {
             dependency.addAllProjectReferences(relatedDependency.getProjectReferences());
         }
         dependenciesToRemove.add(relatedDependency);
     }
 
     /**
      * Attempts to trim a maven repo to a common base path. This is typically [drive]\[repo_location]\repository\[path1]\[path2].
      *
      * @param path the path to trim
      * @return a string representing the base path.
      */
     private String getBaseRepoPath(final String path) {
         int pos = path.indexOf("repository" + File.separator) + 11;
         if (pos < 0) {
             return path;
         }
         int tmp = path.indexOf(File.separator, pos);
         if (tmp <= 0) {
             return path;
         }
         if (tmp > 0) {
             pos = tmp + 1;
         }
         tmp = path.indexOf(File.separator, pos);
         if (tmp > 0) {
             pos = tmp + 1;
         }
         return path.substring(0, pos);
     }
 
     /**
      * Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar.
      *
      * @param dependency1 a dependency2 to compare
      * @param dependency2 a dependency2 to compare
      * @return true if the identifiers in the two supplied dependencies are equal
      */
     private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
         if (dependency1 == null || dependency1.getFileName() == null
                 || dependency2 == null || dependency2.getFileName() == null) {
             return false;
         }
         final String fileName1 = dependency1.getActualFile().getName();
         final String fileName2 = dependency2.getActualFile().getName();
 
         //version check
         final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
         final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
         if (version1 != null && version2 != null && !version1.equals(version2)) {
             return false;
         }
 
         //filename check
         final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
         final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
         if (match1.find() && match2.find()) {
             return match1.group().equals(match2.group());
         }
 
         return false;
     }
 
     /**
      * Returns true if the CPE identifiers in the two supplied dependencies are equal.
      *
      * @param dependency1 a dependency2 to compare
      * @param dependency2 a dependency2 to compare
      * @return true if the identifiers in the two supplied dependencies are equal
      */
     private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
         if (dependency1 == null || dependency1.getIdentifiers() == null
                 || dependency2 == null || dependency2.getIdentifiers() == null) {
             return false;
         }
         boolean matches = false;
         int cpeCount1 = 0;
         int cpeCount2 = 0;
         for (Identifier i : dependency1.getIdentifiers()) {
             if ("cpe".equals(i.getType())) {
                 cpeCount1 += 1;
             }
         }
         for (Identifier i : dependency2.getIdentifiers()) {
             if ("cpe".equals(i.getType())) {
                 cpeCount2 += 1;
             }
         }
         if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
             for (Identifier i : dependency1.getIdentifiers()) {
                 if ("cpe".equals(i.getType())) {
                     matches |= dependency2.getIdentifiers().contains(i);
                     if (!matches) {
                         break;
                     }
                 }
             }
         }
         LOGGER.debug("IdentifiersMatch={} ({}, {})", matches, dependency1.getFileName(), dependency2.getFileName());
         return matches;
     }
 
     /**
      * Determines if the two dependencies have the same base path.
      *
      * @param dependency1 a Dependency object
      * @param dependency2 a Dependency object
      * @return true if the base paths of the dependencies are identical
      */
     private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
         if (dependency1 == null || dependency2 == null) {
             return false;
         }
         final File lFile = new File(dependency1.getFilePath());
         String left = lFile.getParent();
         final File rFile = new File(dependency2.getFilePath());
         String right = rFile.getParent();
         if (left == null) {
             return right == null;
         }
         if (left.equalsIgnoreCase(right)) {
             return true;
         }
         if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) {
             left = getBaseRepoPath(left);
             right = getBaseRepoPath(right);
         }
         if (left.equalsIgnoreCase(right)) {
             return true;
         }
         //new code
         for (Dependency child : dependency2.getRelatedDependencies()) {
             if (hasSameBasePath(dependency1, child)) {
                 return true;
             }
         }
         return false;
     }
 
     /**
      * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison to the
      * 'right' library.
      *
      * @param left the dependency to test
      * @param right the dependency to test against
      * @return a boolean indicating whether or not the left dependency should be considered the "core" version.
      */
     boolean isCore(Dependency left, Dependency right) {
         final String leftName = left.getFileName().toLowerCase();
         final String rightName = right.getFileName().toLowerCase();
 
         final boolean returnVal;
         if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
                 || rightName.contains("core") && !leftName.contains("core")
                 || rightName.contains("kernel") && !leftName.contains("kernel")) {
             returnVal = false;
         } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
                 || !rightName.contains("core") && leftName.contains("core")
                 || !rightName.contains("kernel") && leftName.contains("kernel")) {
             returnVal = true;
 //        } else if (leftName.matches(".*struts2\\-core.*") && rightName.matches(".*xwork\\-core.*")) {
 //            returnVal = true;
 //        } else if (rightName.matches(".*struts2\\-core.*") && leftName.matches(".*xwork\\-core.*")) {
 //            returnVal = false;
         } else {
             /*
              * considered splitting the names up and comparing the components,
              * but decided that the file name length should be sufficient as the
              * "core" component, if this follows a normal naming protocol should
              * be shorter:
              * axis2-saaj-1.4.1.jar
              * axis2-1.4.1.jar       <-----
              * axis2-kernel-1.4.1.jar
              */
             returnVal = leftName.length() <= rightName.length();
         }
         LOGGER.debug("IsCore={} ({}, {})", returnVal, left.getFileName(), right.getFileName());
         return returnVal;
     }
 
     /**
      * Compares the SHA1 hashes of two dependencies to determine if they are equal.
      *
      * @param dependency1 a dependency object to compare
      * @param dependency2 a dependency object to compare
      * @return true if the sha1 hashes of the two dependencies match; otherwise false
      */
     private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
         if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) {
             return false;
         }
         return dependency1.getSha1sum().equals(dependency2.getSha1sum());
     }
 
     /**
      * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml dependency
      * should be removed.
      *
      * @param dependency a dependency to check
      * @param nextDependency another dependency to check
      * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match; otherwise false
      */
     private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
         final String mainName = dependency.getFileName().toLowerCase();
         final String nextName = nextDependency.getFileName().toLowerCase();
         if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) {
             return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
         } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) {
             return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
         }
         return false;
     }
 
     /**
      * Determines which path is shortest; if path lengths are equal then we use compareTo of the string method to determine if the
      * first path is smaller.
      *
      * @param left the first path to compare
      * @param right the second path to compare
      * @return <code>true</code> if the leftPath is the shortest; otherwise <code>false</code>
      */
     protected boolean firstPathIsShortest(String left, String right) {
         final String leftPath = left.replace('\\', '/');
         final String rightPath = right.replace('\\', '/');
 
         final int leftCount = countChar(leftPath, '/');
         final int rightCount = countChar(rightPath, '/');
         if (leftCount == rightCount) {
             return leftPath.compareTo(rightPath) <= 0;
         } else {
             return leftCount < rightCount;
         }
     }
 
     /**
      * Counts the number of times the character is present in the string.
      *
      * @param string the string to count the characters in
      * @param c the character to count
      * @return the number of times the character is present in the string
      */
     private int countChar(String string, char c) {
         int count = 0;
         final int max = string.length();
         for (int i = 0; i < max; i++) {
             if (c == string.charAt(i)) {
                 count++;
             }
         }
         return count;
     }
 
     /**
      * Checks if the given file path is contained within a war or ear file.
      *
      * @param filePath the file path to check
      * @return true if the path contains '.war\' or '.ear\'.
      */
     private boolean containedInWar(String filePath) {
         return filePath == null ? false : filePath.matches(".*\\.(ear|war)[\\\\/].*");
     }
 }

1		/*
2		* This file is part of dependency-check-core.
3		*
4		* Licensed under the Apache License, Version 2.0 (the "License");
5		* you may not use this file except in compliance with the License.
6		* You may obtain a copy of the License at
7		*
8		* http://www.apache.org/licenses/LICENSE-2.0
9		*
10		* Unless required by applicable law or agreed to in writing, software
11		* distributed under the License is distributed on an "AS IS" BASIS,
12		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13		* See the License for the specific language governing permissions and
14		* limitations under the License.
15		*
16		* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
17		*/
18		package org.owasp.dependencycheck.analyzer;
19
20		import java.io.File;
21		import java.util.HashSet;
22		import java.util.Iterator;
23		import java.util.ListIterator;
24		import java.util.Set;
25		import java.util.regex.Matcher;
26		import java.util.regex.Pattern;
27		import org.owasp.dependencycheck.Engine;
28		import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
29		import org.owasp.dependencycheck.dependency.Dependency;
30		import org.owasp.dependencycheck.dependency.Identifier;
31		import org.owasp.dependencycheck.utils.DependencyVersion;
32		import org.owasp.dependencycheck.utils.DependencyVersionUtil;
33		import org.slf4j.Logger;
34		import org.slf4j.LoggerFactory;
35
36		/**
37		* <p>
38		* This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are grouped. An
39		* example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the same relative path
40		* then these should be grouped into a single dependency under the core/main library.</p>
41		* <p>
42		* Note, this grouping only works on dependencies with identified CVE entries</p>
43		*
44		* @author Jeremy Long
45		*/
46	8	public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer {
47
48		/**
49		* The Logger.
50		*/
51	1	private static final Logger LOGGER = LoggerFactory.getLogger(DependencyBundlingAnalyzer.class);
52
53		//<editor-fold defaultstate="collapsed" desc="Constants and Member Variables">
54		/**
55		* A pattern for obtaining the first part of a filename.
56		*/
57	1	private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z0-9]*");
58		/**
59		* a flag indicating if this analyzer has run. This analyzer only runs once.
60		*/
61	8	private boolean analyzed = false;
62		//</editor-fold>
63		//<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
64		/**
65		* The name of the analyzer.
66		*/
67		private static final String ANALYZER_NAME = "Dependency Bundling Analyzer";
68		/**
69		* The phase that this analyzer is intended to run in.
70		*/
71	1	private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
72
73		/**
74		* Returns the name of the analyzer.
75		*
76		* @return the name of the analyzer.
77		*/
78		@Override
79		public String getName() {
80	5	return ANALYZER_NAME;
81		}
82
83		/**
84		* Returns the phase that the analyzer is intended to run in.
85		*
86		* @return the phase that the analyzer is intended to run in.
87		*/
88		@Override
89		public AnalysisPhase getAnalysisPhase() {
90	4	return ANALYSIS_PHASE;
91		}
92		//</editor-fold>
93
94		/**
95		* Analyzes a set of dependencies. If they have been found to have the same base path and the same set of identifiers they are
96		* likely related. The related dependencies are bundled into a single reportable item.
97		*
98		* @param ignore this analyzer ignores the dependency being analyzed
99		* @param engine the engine that is scanning the dependencies
100		* @throws AnalysisException is thrown if there is an error reading the JAR file.
101		*/
102		@Override
103		public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
104	2	if (!analyzed) {
105	1	analyzed = true;
106	1	final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
107	1	final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
108		//for (Dependency nextDependency : engine.getDependencies()) {
109	3	while (mainIterator.hasNext()) {
110	2	final Dependency dependency = mainIterator.next();
111	2	if (mainIterator.hasNext() && !dependenciesToRemove.contains(dependency)) {
112	1	final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
113	2	while (subIterator.hasNext()) {
114	1	final Dependency nextDependency = subIterator.next();
115	1	if (hashesMatch(dependency, nextDependency) && !containedInWar(dependency.getFilePath())
116	0	&& !containedInWar(nextDependency.getFilePath())) {
117	0	if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) {
118	0	mergeDependencies(dependency, nextDependency, dependenciesToRemove);
119		} else {
120	0	mergeDependencies(nextDependency, dependency, dependenciesToRemove);
121	0	break; //since we merged into the next dependency - skip forward to the next in mainIterator
122		}
123	1	} else if (isShadedJar(dependency, nextDependency)) {
124	0	if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {
125	0	mergeDependencies(nextDependency, dependency, dependenciesToRemove);
126	0	nextDependency.getRelatedDependencies().remove(dependency);
127	0	break;
128		} else {
129	0	mergeDependencies(dependency, nextDependency, dependenciesToRemove);
130	0	dependency.getRelatedDependencies().remove(nextDependency);
131		}
132	1	} else if (cpeIdentifiersMatch(dependency, nextDependency)
133	0	&& hasSameBasePath(dependency, nextDependency)
134	0	&& fileNameMatch(dependency, nextDependency)) {
135	0	if (isCore(dependency, nextDependency)) {
136	0	mergeDependencies(dependency, nextDependency, dependenciesToRemove);
137		} else {
138	0	mergeDependencies(nextDependency, dependency, dependenciesToRemove);
139	0	break; //since we merged into the next dependency - skip forward to the next in mainIterator
140		}
141		}
142	1	}
143		}
144	2	}
145		//removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions
146		// was difficult because of the inner iterator.
147	1	engine.getDependencies().removeAll(dependenciesToRemove);
148		}
149	2	}
150
151		/**
152		* Adds the relatedDependency to the dependency's related dependencies.
153		*
154		* @param dependency the main dependency
155		* @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the source of
156		* dependencies to remove
157		* @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this function
158		* adds to this collection
159		*/
160		private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
161	0	dependency.addRelatedDependency(relatedDependency);
162	0	final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
163	0	while (i.hasNext()) {
164	0	dependency.addRelatedDependency(i.next());
165	0	i.remove();
166		}
167	0	if (dependency.getSha1sum().equals(relatedDependency.getSha1sum())) {
168	0	dependency.addAllProjectReferences(relatedDependency.getProjectReferences());
169		}
170	0	dependenciesToRemove.add(relatedDependency);
171	0	}
172
173		/**
174		* Attempts to trim a maven repo to a common base path. This is typically [drive]\[repo_location]\repository\[path1]\[path2].
175		*
176		* @param path the path to trim
177		* @return a string representing the base path.
178		*/
179		private String getBaseRepoPath(final String path) {
180	0	int pos = path.indexOf("repository" + File.separator) + 11;
181	0	if (pos < 0) {
182	0	return path;
183		}
184	0	int tmp = path.indexOf(File.separator, pos);
185	0	if (tmp <= 0) {
186	0	return path;
187		}
188	0	if (tmp > 0) {
189	0	pos = tmp + 1;
190		}
191	0	tmp = path.indexOf(File.separator, pos);
192	0	if (tmp > 0) {
193	0	pos = tmp + 1;
194		}
195	0	return path.substring(0, pos);
196		}
197
198		/**
199		* Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar.
200		*
201		* @param dependency1 a dependency2 to compare
202		* @param dependency2 a dependency2 to compare
203		* @return true if the identifiers in the two supplied dependencies are equal
204		*/
205		private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
206	0	if (dependency1 == null \|\| dependency1.getFileName() == null
207	0	\|\| dependency2 == null \|\| dependency2.getFileName() == null) {
208	0	return false;
209		}
210	0	final String fileName1 = dependency1.getActualFile().getName();
211	0	final String fileName2 = dependency2.getActualFile().getName();
212
213		//version check
214	0	final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
215	0	final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
216	0	if (version1 != null && version2 != null && !version1.equals(version2)) {
217	0	return false;
218		}
219
220		//filename check
221	0	final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
222	0	final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
223	0	if (match1.find() && match2.find()) {
224	0	return match1.group().equals(match2.group());
225		}
226
227	0	return false;
228		}
229
230		/**
231		* Returns true if the CPE identifiers in the two supplied dependencies are equal.
232		*
233		* @param dependency1 a dependency2 to compare
234		* @param dependency2 a dependency2 to compare
235		* @return true if the identifiers in the two supplied dependencies are equal
236		*/
237		private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
238	1	if (dependency1 == null \|\| dependency1.getIdentifiers() == null
239	1	\|\| dependency2 == null \|\| dependency2.getIdentifiers() == null) {
240	0	return false;
241		}
242	1	boolean matches = false;
243	1	int cpeCount1 = 0;
244	1	int cpeCount2 = 0;
245	1	for (Identifier i : dependency1.getIdentifiers()) {
246	0	if ("cpe".equals(i.getType())) {
247	0	cpeCount1 += 1;
248		}
249	0	}
250	1	for (Identifier i : dependency2.getIdentifiers()) {
251	3	if ("cpe".equals(i.getType())) {
252	3	cpeCount2 += 1;
253		}
254	3	}
255	1	if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
256	0	for (Identifier i : dependency1.getIdentifiers()) {
257	0	if ("cpe".equals(i.getType())) {
258	0	matches \|= dependency2.getIdentifiers().contains(i);
259	0	if (!matches) {
260	0	break;
261		}
262		}
263	0	}
264		}
265	1	LOGGER.debug("IdentifiersMatch={} ({}, {})", matches, dependency1.getFileName(), dependency2.getFileName());
266	1	return matches;
267		}
268
269		/**
270		* Determines if the two dependencies have the same base path.
271		*
272		* @param dependency1 a Dependency object
273		* @param dependency2 a Dependency object
274		* @return true if the base paths of the dependencies are identical
275		*/
276		private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
277	0	if (dependency1 == null \|\| dependency2 == null) {
278	0	return false;
279		}
280	0	final File lFile = new File(dependency1.getFilePath());
281	0	String left = lFile.getParent();
282	0	final File rFile = new File(dependency2.getFilePath());
283	0	String right = rFile.getParent();
284	0	if (left == null) {
285	0	return right == null;
286		}
287	0	if (left.equalsIgnoreCase(right)) {
288	0	return true;
289		}
290	0	if (left.matches(".[/\\\\]repository[/\\\\].") && right.matches(".[/\\\\]repository[/\\\\].")) {
291	0	left = getBaseRepoPath(left);
292	0	right = getBaseRepoPath(right);
293		}
294	0	if (left.equalsIgnoreCase(right)) {
295	0	return true;
296		}
297		//new code
298	0	for (Dependency child : dependency2.getRelatedDependencies()) {
299	0	if (hasSameBasePath(dependency1, child)) {
300	0	return true;
301		}
302	0	}
303	0	return false;
304		}
305
306		/**
307		* This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison to the
308		* 'right' library.
309		*
310		* @param left the dependency to test
311		* @param right the dependency to test against
312		* @return a boolean indicating whether or not the left dependency should be considered the "core" version.
313		*/
314		boolean isCore(Dependency left, Dependency right) {
315	2	final String leftName = left.getFileName().toLowerCase();
316	2	final String rightName = right.getFileName().toLowerCase();
317
318		final boolean returnVal;
319	2	if (!rightName.matches(".\\.(tar\|tgz\|gz\|zip\|ear\|war).+") && leftName.matches(".\\.(tar\|tgz\|gz\|zip\|ear\|war).+")
320	2	\|\| rightName.contains("core") && !leftName.contains("core")
321	2	\|\| rightName.contains("kernel") && !leftName.contains("kernel")) {
322	0	returnVal = false;
323	2	} else if (rightName.matches(".\\.(tar\|tgz\|gz\|zip\|ear\|war).+") && !leftName.matches(".\\.(tar\|tgz\|gz\|zip\|ear\|war).+")
324	1	\|\| !rightName.contains("core") && leftName.contains("core")
325	1	\|\| !rightName.contains("kernel") && leftName.contains("kernel")) {
326	2	returnVal = true;
327		// } else if (leftName.matches(".struts2\\-core.") && rightName.matches(".xwork\\-core.")) {
328		// returnVal = true;
329		// } else if (rightName.matches(".struts2\\-core.") && leftName.matches(".xwork\\-core.")) {
330		// returnVal = false;
331		} else {
332		/*
333		* considered splitting the names up and comparing the components,
334		* but decided that the file name length should be sufficient as the
335		* "core" component, if this follows a normal naming protocol should
336		* be shorter:
337		* axis2-saaj-1.4.1.jar
338		* axis2-1.4.1.jar <-----
339		* axis2-kernel-1.4.1.jar
340		*/
341	0	returnVal = leftName.length() <= rightName.length();
342		}
343	2	LOGGER.debug("IsCore={} ({}, {})", returnVal, left.getFileName(), right.getFileName());
344	2	return returnVal;
345		}
346
347		/**
348		* Compares the SHA1 hashes of two dependencies to determine if they are equal.
349		*
350		* @param dependency1 a dependency object to compare
351		* @param dependency2 a dependency object to compare
352		* @return true if the sha1 hashes of the two dependencies match; otherwise false
353		*/
354		private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
355	1	if (dependency1 == null \|\| dependency2 == null \|\| dependency1.getSha1sum() == null \|\| dependency2.getSha1sum() == null) {
356	0	return false;
357		}
358	1	return dependency1.getSha1sum().equals(dependency2.getSha1sum());
359		}
360
361		/**
362		* Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml dependency
363		* should be removed.
364		*
365		* @param dependency a dependency to check
366		* @param nextDependency another dependency to check
367		* @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match; otherwise false
368		*/
369		private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
370	1	final String mainName = dependency.getFileName().toLowerCase();
371	1	final String nextName = nextDependency.getFileName().toLowerCase();
372	1	if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) {
373	0	return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
374	1	} else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) {
375	0	return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
376		}
377	1	return false;
378		}
379
380		/**
381		* Determines which path is shortest; if path lengths are equal then we use compareTo of the string method to determine if the
382		* first path is smaller.
383		*
384		* @param left the first path to compare
385		* @param right the second path to compare
386		* @return <code>true</code> if the leftPath is the shortest; otherwise <code>false</code>
387		*/
388		protected boolean firstPathIsShortest(String left, String right) {
389	5	final String leftPath = left.replace('\\', '/');
390	5	final String rightPath = right.replace('\\', '/');
391
392	5	final int leftCount = countChar(leftPath, '/');
393	5	final int rightCount = countChar(rightPath, '/');
394	5	if (leftCount == rightCount) {
395	3	return leftPath.compareTo(rightPath) <= 0;
396		} else {
397	2	return leftCount < rightCount;
398		}
399		}
400
401		/**
402		* Counts the number of times the character is present in the string.
403		*
404		* @param string the string to count the characters in
405		* @param c the character to count
406		* @return the number of times the character is present in the string
407		*/
408		private int countChar(String string, char c) {
409	10	int count = 0;
410	10	final int max = string.length();
411	116	for (int i = 0; i < max; i++) {
412	106	if (c == string.charAt(i)) {
413	28	count++;
414		}
415		}
416	10	return count;
417		}
418
419		/**
420		* Checks if the given file path is contained within a war or ear file.
421		*
422		* @param filePath the file path to check
423		* @return true if the path contains '.war\' or '.ear\'.
424		*/
425		private boolean containedInWar(String filePath) {
426	0	return filePath == null ? false : filePath.matches(".\\.(ear\|war)[\\\\/].");
427		}
428		}