mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-03-18 07:14:09 +01:00
442 lines
45 KiB
HTML
442 lines
45 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
|
|
<title>Coverage Report</title>
|
|
<link title="Style" type="text/css" rel="stylesheet" href="css/main.css"/>
|
|
<script type="text/javascript" src="js/popup.js"></script>
|
|
</head>
|
|
<body>
|
|
<h5>Coverage Report - org.owasp.dependencycheck.analyzer.NvdCveAnalyzer</h5>
|
|
<div class="separator"> </div>
|
|
<table class="report">
|
|
<thead><tr> <td class="heading">Classes in this File</td> <td class="heading"><a class="dfn" href="help.html" onclick="popupwindow('help.html'); return false;">Line Coverage</a></td> <td class="heading"><a class="dfn" href="help.html" onclick="popupwindow('help.html'); return false;">Branch Coverage</a></td> <td class="heading"><a class="dfn" href="help.html" onclick="popupwindow('help.html'); return false;">Complexity</a></td></tr></thead>
|
|
<tr><td><a href="org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html">NvdCveAnalyzer</a></td><td><table cellpadding="0px" cellspacing="0px" class="percentgraph"><tr class="percentgraph"><td align="right" class="percentgraph" width="40">74%</td><td class="percentgraph"><div class="percentgraph"><div class="greenbar" style="width:74px"><span class="text">20/27</span></div></div></td></tr></table></td><td><table cellpadding="0px" cellspacing="0px" class="percentgraph"><tr class="percentgraph"><td align="right" class="percentgraph" width="40">37%</td><td class="percentgraph"><div class="percentgraph"><div class="greenbar" style="width:37px"><span class="text">3/8</span></div></div></td></tr></table></td><td class="value"><span class="hidden">1.5;</span>1.5</td></tr>
|
|
|
|
</table>
|
|
<div class="separator"> </div>
|
|
<table cellspacing="0" cellpadding="0" class="src">
|
|
<tr> <td class="numLine"> 1</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/*</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 2</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * This file is part of dependency-check-core.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 3</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 4</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Dependency-check-core is free software: you can redistribute it and/or modify it</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 5</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * under the terms of the GNU General Public License as published by the Free</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 6</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Software Foundation, either version 3 of the License, or (at your option) any</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 7</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * later version.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 8</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 9</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Dependency-check-core is distributed in the hope that it will be useful, but</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 10</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 11</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 12</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * details.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 13</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 14</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * You should have received a copy of the GNU General Public License along with</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 15</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * dependency-check-core. If not, see http://www.gnu.org/licenses/.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 16</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 17</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Copyright (c) 2012 Jeremy Long. All Rights Reserved.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 18</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 19</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">package</span> org.owasp.dependencycheck.analyzer;</pre></td></tr>
|
|
<tr> <td class="numLine"> 20</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 21</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> java.io.IOException;</pre></td></tr>
|
|
<tr> <td class="numLine"> 22</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> java.sql.SQLException;</pre></td></tr>
|
|
<tr> <td class="numLine"> 23</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> java.util.List;</pre></td></tr>
|
|
<tr> <td class="numLine"> 24</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> java.util.Set;</pre></td></tr>
|
|
<tr> <td class="numLine"> 25</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> org.owasp.dependencycheck.Engine;</pre></td></tr>
|
|
<tr> <td class="numLine"> 26</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> org.owasp.dependencycheck.dependency.Dependency;</pre></td></tr>
|
|
<tr> <td class="numLine"> 27</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> org.owasp.dependencycheck.dependency.Vulnerability;</pre></td></tr>
|
|
<tr> <td class="numLine"> 28</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> org.owasp.dependencycheck.dependency.Identifier;</pre></td></tr>
|
|
<tr> <td class="numLine"> 29</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> org.owasp.dependencycheck.data.nvdcve.CveDB;</pre></td></tr>
|
|
<tr> <td class="numLine"> 30</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">import</span> org.owasp.dependencycheck.data.nvdcve.DatabaseException;</pre></td></tr>
|
|
<tr> <td class="numLine"> 31</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 32</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 33</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * NvdCveAnalyzer is a utility class that takes a project dependency and</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 34</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * attempts to discern if there is an associated CVEs. It uses the the</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 35</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * identifiers found by other analyzers to lookup the CVE data.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 36</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 37</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @author Jeremy Long (jeremy.long@owasp.org)</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 38</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 39</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">class</span> NvdCveAnalyzer <span class="keyword">implements</span> Analyzer {</pre></td></tr>
|
|
<tr> <td class="numLine"> 40</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 41</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 42</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * The maximum number of query results to return.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 43</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 44</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">static</span> <span class="keyword">final</span> <span class="keyword">int</span> MAX_QUERY_RESULTS = 100;</pre></td></tr>
|
|
<tr> <td class="numLine"> 45</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 46</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * The CVE Index.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 47</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 48</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">private</span> CveDB cveDB;</pre></td></tr>
|
|
<tr> <td class="numLine"> 49</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 50</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 51</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Opens the data source.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 52</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 53</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws SQLException thrown when there is a SQL Exception</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 54</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws IOException thrown when there is an IO Exception</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 55</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws DatabaseException thrown when there is a database exceptions</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 56</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws ClassNotFoundException thrown if the h2 database driver cannot be</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 57</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * loaded</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 58</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 59</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">void</span> open() <span class="keyword">throws</span> SQLException, IOException, DatabaseException, ClassNotFoundException {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 60</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> cveDB = <span class="keyword">new</span> CveDB();</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 61</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> cveDB.open();</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 62</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 63</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 64</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 65</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Closes the data source.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 66</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 67</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">void</span> close() {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 68</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> cveDB.close();</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 69</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> cveDB = <span class="keyword">null</span>;</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 70</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 71</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 72</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 73</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Returns the status of the data source - is the database open.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 74</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 75</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @return true or false.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 76</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 77</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">boolean</span> isOpen() {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 78</td> <td class="nbHitsUncovered"><a title="Line 78: Conditional coverage 0% (0/2)."> 0</a></td> <td class="src"><pre class="src"><span class="srcUncovered"> <a title="Line 78: Conditional coverage 0% (0/2)."> <span class="keyword">return</span> (cveDB != <span class="keyword">null</span>);</a></span></pre></td></tr>
|
|
<tr> <td class="numLine"> 79</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 80</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 81</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 82</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Ensures that the CVE Database is closed.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 83</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 84</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws Throwable when a throwable is thrown.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 85</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 86</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> @Override</pre></td></tr>
|
|
<tr> <td class="numLine"> 87</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">protected</span> <span class="keyword">void</span> finalize() <span class="keyword">throws</span> Throwable {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 88</td> <td class="nbHitsUncovered"> 0</td> <td class="src"><pre class="src"><span class="srcUncovered"> <span class="keyword">super</span>.finalize();</span></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 89</td> <td class="nbHitsUncovered"><a title="Line 89: Conditional coverage 0% (0/2)."> 0</a></td> <td class="src"><pre class="src"><span class="srcUncovered"> <a title="Line 89: Conditional coverage 0% (0/2)."> <span class="keyword">if</span> (isOpen()) {</a></span></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 90</td> <td class="nbHitsUncovered"> 0</td> <td class="src"><pre class="src"><span class="srcUncovered"> close();</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 91</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 92</td> <td class="nbHitsUncovered"> 0</td> <td class="src"><pre class="src"><span class="srcUncovered"> }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 93</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 94</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 95</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Analyzes a dependency and attempts to determine if there are any CPE</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 96</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * identifiers for this dependency.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 97</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 98</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @param dependency The Dependency to analyze</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 99</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @param engine The analysis engine</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 100</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws AnalysisException is thrown if there is an issue analyzing the</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 101</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * dependency</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 102</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 103</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">void</span> analyze(Dependency dependency, Engine engine) <span class="keyword">throws</span> AnalysisException {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 104</td> <td class="nbHitsCovered"><a title="Line 104: Conditional coverage 100% (2/2)."> 3</a></td> <td class="src"><pre class="src"> <a title="Line 104: Conditional coverage 100% (2/2)."> <span class="keyword">for</span> (Identifier id : dependency.getIdentifiers()) {</a></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 105</td> <td class="nbHitsUncovered"><a title="Line 105: Conditional coverage 50% (1/2)."> 6</a></td> <td class="src"><pre class="src"><span class="srcUncovered"> <a title="Line 105: Conditional coverage 50% (1/2)."> <span class="keyword">if</span> (<span class="string">"cpe"</span>.equals(id.getType())) {</a></span></pre></td></tr>
|
|
<tr> <td class="numLine"> 106</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">try</span> {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 107</td> <td class="nbHitsCovered"> 6</td> <td class="src"><pre class="src"> <span class="keyword">final</span> String value = id.getValue();</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 108</td> <td class="nbHitsCovered"> 6</td> <td class="src"><pre class="src"> <span class="keyword">final</span> List<Vulnerability> vulns = cveDB.getVulnerabilities(value);</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 109</td> <td class="nbHitsCovered"> 6</td> <td class="src"><pre class="src"> dependency.getVulnerabilities().addAll(vulns);</pre></td></tr>
|
|
<tr> <td class="numLine"> 110</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//TODO - remove this comment block after additional testing is completed</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 111</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//note - valid match functionality has been moved into the CveDB class.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 112</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// for (Vulnerability v : vulns) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 113</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (isValidMatch(dependency, v)) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 114</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// dependency.addVulnerability(v);</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 115</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 116</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 117</td> <td class="nbHitsUncovered"> 0</td> <td class="src"><pre class="src"><span class="srcUncovered"> } <span class="keyword">catch</span> (DatabaseException ex) {</span></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 118</td> <td class="nbHitsUncovered"> 0</td> <td class="src"><pre class="src"><span class="srcUncovered"> <span class="keyword">throw</span> <span class="keyword">new</span> AnalysisException(ex);</span></pre></td></tr>
|
|
<tr> <td class="numLineCover"> 119</td> <td class="nbHitsCovered"> 6</td> <td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 120</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 121</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 122</td> <td class="nbHitsCovered"> 3</td> <td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 123</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 124</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 125</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Returns true because this analyzer supports all dependency types.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 126</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 127</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @return true.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 128</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 129</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> Set<String> getSupportedExtensions() {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 130</td> <td class="nbHitsCovered"> 129</td> <td class="src"><pre class="src"> <span class="keyword">return</span> <span class="keyword">null</span>;</pre></td></tr>
|
|
<tr> <td class="numLine"> 131</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 132</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 133</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 134</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Returns the name of this analyzer.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 135</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 136</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @return the name of this analyzer.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 137</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 138</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> String getName() {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 139</td> <td class="nbHitsCovered"> 3</td> <td class="src"><pre class="src"> <span class="keyword">return</span> <span class="string">"NVD CVE Analyzer"</span>;</pre></td></tr>
|
|
<tr> <td class="numLine"> 140</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 141</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 142</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 143</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Returns true because this analyzer supports all dependency types.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 144</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 145</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @param extension the file extension of the dependency being analyzed.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 146</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @return true.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 147</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 148</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">boolean</span> supportsExtension(String extension) {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 149</td> <td class="nbHitsCovered"> 3</td> <td class="src"><pre class="src"> <span class="keyword">return</span> <span class="keyword">true</span>;</pre></td></tr>
|
|
<tr> <td class="numLine"> 150</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 151</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 152</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 153</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Returns the analysis phase that this analyzer should run in.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 154</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 155</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @return the analysis phase that this analyzer should run in.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 156</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 157</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> AnalysisPhase getAnalysisPhase() {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 158</td> <td class="nbHitsCovered"> 3</td> <td class="src"><pre class="src"> <span class="keyword">return</span> AnalysisPhase.FINDING_ANALYSIS;</pre></td></tr>
|
|
<tr> <td class="numLine"> 159</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 160</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> </pre></td></tr>
|
|
<tr> <td class="numLine"> 161</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">/**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 162</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * Opens the NVD CVE Lucene Index.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 163</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 164</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> * @throws Exception is thrown if there is an issue opening the index.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 165</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment"> */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 166</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="keyword">public</span> <span class="keyword">void</span> initialize() <span class="keyword">throws</span> Exception {</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 167</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> <span class="keyword">this</span>.open();</pre></td></tr>
|
|
<tr> <td class="numLineCover"> 168</td> <td class="nbHitsCovered"> 1</td> <td class="src"><pre class="src"> }</pre></td></tr>
|
|
<tr> <td class="numLine"> 169</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//TODO - remove this comment block after additional testing is completed</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 170</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">// The following check has been moved into the CveDB class.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 171</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// /**</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 172</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * <p>Determines if this is a valid vulnerability match for the given</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 173</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * dependency. Specifically, this is concerned with ensuring the version</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 174</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * numbers are correct.</p></span></pre></td></tr>
|
|
<tr> <td class="numLine"> 175</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * <p>Currently, this is focused on the issues with the versions for Struts</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 176</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * 1 and Struts 2. In the future this will due better matching on more</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 177</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * version numbers.</p></span></pre></td></tr>
|
|
<tr> <td class="numLine"> 178</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// *</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 179</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * @param dependency the dependency</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 180</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * @param v the vulnerability</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 181</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// * @return returns true if the vulnerability is for the given dependency</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 182</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// */</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 183</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// private boolean isValidMatch(final Dependency dependency, final Vulnerability v) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 184</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// //right now I only know of the issue with Struts1/2</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 185</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// // start with fixing this problem.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 186</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">////</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 187</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// //TODO extend this solution to do better version matching for the vulnerable software.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 188</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// boolean struts1 = false;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 189</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// boolean struts2 = false;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 190</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// for (Identifier i : dependency.getIdentifiers()) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 191</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (i.getValue().startsWith("cpe:/a:apache:struts:")) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 192</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// final char version = i.getValue().charAt(21);</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 193</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (version == '1') {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 194</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// struts1 = true;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 195</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 196</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (version == '2') {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 197</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// struts2 = true;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 198</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 199</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 200</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 201</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (!struts1 && !struts2) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 202</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// return true; //we are not looking at struts, so return true.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 203</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 204</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (struts1 && struts2) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 205</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// return true; //there is a mismatch here, but we can't solve it here so we return valid.</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 206</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 207</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (struts1) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 208</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// boolean hasStruts1Vuln = false;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 209</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// boolean hasStruts2PreviousVersion = false;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 210</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// for (VulnerableSoftware vs : v.getVulnerableSoftware()) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 211</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// //TODO FIX THIS</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 212</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// //hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2';</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 213</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// //hasStruts1Vuln |= vs.getName().charAt(21) == '1';</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 214</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 215</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// if (!hasStruts1Vuln && hasStruts2PreviousVersion) {</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 216</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// return false;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 217</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 218</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 219</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">////</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 220</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// return true;</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 221</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> <span class="comment">//// }</span></pre></td></tr>
|
|
<tr> <td class="numLine"> 222</td> <td class="nbHits"> </td>
|
|
<td class="src"><pre class="src"> }</pre></td></tr>
|
|
</table>
|
|
|
|
<div class="footer">Report generated by <a href="http://cobertura.sourceforge.net/" target="_top">Cobertura</a> 1.9.4.1 on 10/20/13 9:38 PM.</div>
|
|
</body>
|
|
</html>
|