Add support for newer ODC

test/ParserSpec.scala

@@ -0,0 +1,60 @@
+import java.io.{ByteArrayOutputStream, InputStream}
+
+import org.specs2.mutable.Specification
+import com.ysoft.odc._
+
+class ParserSpec  extends Specification {
+  private def readStream(in: InputStream): Array[Byte] = {
+    val buff = new Array[Byte](1024)
+    val out = new ByteArrayOutputStream()
+    var n = 0
+    while({
+      n = in.read(buff)
+      n != -1
+    }){
+      out.write(buff, 0, n)
+    }
+    out.toByteArray
+  }
+
+  private def parseReport(reportResourceName: String) = {
+    val reportBytes: Array[Byte] = readStream(getClass.getResourceAsStream(reportResourceName))
+    OdcParser.parseXmlReport(reportBytes)
+  }
+
+  private def findDependency(identifierType: String, name: String)(implicit report: Analysis) = {
+    val found = report.dependencies.filter(_.identifiers.exists(i => i.identifierType == identifierType && i.name == name))
+    found.size match {
+      case 0 => sys.error(s"Dependency $identifierType: $name not found")
+      case 1 => (found.toSeq)(0)
+      case _ => sys.error(s"Multiple dependencies $identifierType: $name found: $found")
+    }
+  }
+
+  private def shouldHaveIdentifier(dep: Dependency, identifierType: String, name: String) = s"should have identifier $identifierType: $name" >> {
+    (dep.identifiers.exists((i: Identifier) => (i.identifierType == identifierType) && (i.name == name))) should beTrue
+  }
+
+
+  "Maven report" >> {
+    implicit val report = parseReport("dependency-check-report-maven.xml")
+    "groupId" >> {report.groupId shouldEqual "com.ysoft.security"}
+    println(report.dependencies.map(_.identifiers).mkString("\n\n"))
+    "commons-collections" >> {
+      val dep = findDependency("maven", "commons-collections:commons-collections:3.2.1")
+      dep.vulnerabilities.size shouldEqual 3
+      //shouldHaveIdentifier(dep, "cpe", "cpe:/a:apache:commons_collections:3.2.1")
+    }
+    "commons-cli" >> {
+      val dep = findDependency("maven", "commons-cli:commons-cli:1.4")
+      dep.vulnerabilities.size shouldEqual 0
+      //shouldHaveIdentifier(dep, "cpe", "cpe:/a:cli_project:cli:1.4")
+    }
+    "jackson-databind" >> {
+      val dep = findDependency("maven", "com.fasterxml.jackson.core:jackson-databind:2.9.7")
+      dep.vulnerabilities.size shouldEqual 15
+      //shouldHaveIdentifier(dep, "cpe", "cpe:/a:fasterxml:jackson:2.9.7")
+      //shouldHaveIdentifier(dep, "cpe", "cpe:/a:fasterxml:jackson-databind:2.9.7")
+    }
+  }
+}

test/VulnerabilitySpec.scala

@@ -4,7 +4,7 @@ import org.specs2.mutable.Specification
 //noinspection ScalaUnnecessaryParentheses
 class VulnerabilitySpec extends Specification {
 
-  val vuln = Vulnerability("some-vuln", None, CvssRating(None, None, None, None, None, None, None), "descr", Seq(
+  val vuln = Vulnerability("some-vuln", /*None,*/ CvssRating(None, None, None, None, None, None, None), "descr", Seq(
     VulnerableSoftware(allPreviousVersion = false, "cpe:/a:ftp:ftp"),
     VulnerableSoftware(allPreviousVersion = false, "cpe:/a:ssh:ssh:1.0"),
     VulnerableSoftware(allPreviousVersion = false, "cpe:/a:asd:asd:1.0")

test/resources/dependency-check-report-maven.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0"?><analysis xmlns="https://jeremylong.github.io/DependencyCheck/dependency-check.2.2.xsd"><scanInfo><engineVersion>5.2.4</engineVersion><dataSource><name>NVD CVE Checked</name><timestamp>2019-11-21T13:01:40</timestamp></dataSource><dataSource><name>NVD CVE Modified</name><timestamp>2019-11-21T07:03:50</timestamp></dataSource></scanInfo><projectInfo><name>java-demo-project</name><groupID>com.ysoft.security</groupID>        <artifactID>java-demo-project</artifactID><version>1.0-SNAPSHOT</version><reportDate>2020-01-28T12:41:14.891858Z</reportDate><credits>This report contains data retrieved from the National Vulnerability Database: https://nvd.nist.gov, NPM Public Advisories: https://www.npmjs.com/advisories, and the RetireJS community.</credits></projectInfo><dependencies><dependency isVirtual="false"><fileName>commons-collections-3.2.1.jar</fileName><filePath>/home/user/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar</filePath><md5>13bc641afd7fd95e09b260f69c1e4c91</md5><sha1>761ea405b9b37ced573d2df0d1e3a4e0f9edc668</sha1><sha256>87363a4c94eaabeefd8b930cb059f66b64c9f7d632862f23de3012da7660047b</sha256><description>Types that extend and augment the Java Collections Framework.</description><license>http://www.apache.org/licenses/LICENSE-2.0.txt</license><projectReferences><projectReference>java-demo-project:compile</projectReference></projectReferences><evidenceCollected><evidence type="vendor" confidence="MEDIUM"><source>Manifest</source><name>Implementation-Vendor-Id</name><value>org.apache</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>specification-vendor</name><value>The Apache Software Foundation</value></evidence><evidence type="vendor" confidence="HIGH"><source>Manifest</source><name>Implementation-Vendor</name><value>The Apache Software Foundation</value></evidence><evidence type="vendor" confidence="HIGH"><source>pom</source><name>name</name><value>Commons Collections</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>bundle-docurl</name><value>http://commons.apache.org/collections/</value></evidence><evidence type="vendor" confidence="LOW"><source>pom</source><name>artifactid</name><value>commons-collections</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>pom</source><name>parent-groupid</name><value>org.apache.commons</value></evidence><evidence type="vendor" confidence="LOW"><source>pom</source><name>parent-artifactid</name><value>commons-parent</value></evidence><evidence type="vendor" confidence="HIGH"><source>file</source><name>name</name><value>commons-collections</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>apache</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>Manifest</source><name>bundle-symbolicname</name><value>org.apache.commons.collections</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>url</name><value>http://commons.apache.org/collections/</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>commons</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>collections</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>groupid</name><value>commons-collections</value></evidence><evidence type="product" confidence="HIGH"><source>pom</source><name>name</name><value>Commons Collections</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>bundle-docurl</name><value>http://commons.apache.org/collections/</value></evidence><evidence type="product" confidence="HIGH"><source>Manifest</source><name>Implementation-Title</name><value>Commons Collections</value></evidence><evidence type="product" confidence="LOW"><source>pom</source><name>parent-groupid</name><value>org.apache.commons</value></evidence><evidence type="product" confidence="MEDIUM"><source>pom</source><name>parent-artifactid</name><value>commons-parent</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>Bundle-Name</name><value>Commons Collections</value></evidence><evidence type="product" confidence="HIGHEST"><source>pom</source><name>artifactid</name><value>commons-collections</value></evidence><evidence type="product" confidence="HIGH"><source>file</source><name>name</name><value>commons-collections</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>specification-title</name><value>Commons Collections</value></evidence><evidence type="product" confidence="HIGHEST"><source>jar</source><name>package name</name><value>apache</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>bundle-symbolicname</name><value>org.apache.comLine truncated
+&gt; 
+&gt; -- [redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1279330)</description><references><reference><source>OSSINDEX</source><url>https://ossindex.sonatype.org/vuln/ed5505cd-2b5b-4ca6-ab51-28ca91263b4e</url><name>Remote code execution</name></reference></references><vulnerableSoftware><software vulnerabilityIdMatched="true">cpe:2.3:a:commons-collections:commons-collections:3.2.1:*:*:*:*:*:*:*</software></vulnerableSoftware></vulnerability></vulnerabilities></dependency><dependency isVirtual="false"><fileName>commons-cli-1.4.jar</fileName><filePath>/home/user/.m2/repository/commons-cli/commons-cli/1.4/commons-cli-1.4.jar</filePath><md5>c966d7e03507c834d5b09b848560174e</md5><sha1>c51c00206bb913cd8612b24abd9fa98ae89719b1</sha1><sha256>fd3c7c9545a9cdb2051d1f9155c4f76b1e4ac5a57304404a6eedb578ffba7328</sha256><description>
+    Apache Commons CLI provides a simple API for presenting, processing and validating a command line interface.
+  </description><license>https://www.apache.org/licenses/LICENSE-2.0.txt</license><projectReferences><projectReference>java-demo-project:compile</projectReference></projectReferences><evidenceCollected><evidence type="vendor" confidence="MEDIUM"><source>Manifest</source><name>Implementation-Vendor-Id</name><value>org.apache</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>specification-vendor</name><value>The Apache Software Foundation</value></evidence><evidence type="vendor" confidence="HIGH"><source>pom</source><name>name</name><value>Apache Commons CLI</value></evidence><evidence type="vendor" confidence="HIGH"><source>Manifest</source><name>Implementation-Vendor</name><value>The Apache Software Foundation</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>groupid</name><value>commons-cli</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>require-capability</name><value>osgi.ee;filter:=&quot;(&amp;(osgi.ee=JavaSE)(version=1.5))&quot;</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>url</name><value>http://commons.apache.org/proper/commons-cli/</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>pom</source><name>parent-groupid</name><value>org.apache.commons</value></evidence><evidence type="vendor" confidence="LOW"><source>pom</source><name>parent-artifactid</name><value>commons-parent</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>implementation-url</name><value>http://commons.apache.org/proper/commons-cli/</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>cli</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>apache</value></evidence><evidence type="vendor" confidence="LOW"><source>pom</source><name>artifactid</name><value>commons-cli</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>implementation-build</name><value>tags/cli-1.4-RC1@r1786159; 2017-03-09 13:01:35+0000</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>commons</value></evidence><evidence type="vendor" confidence="HIGH"><source>file</source><name>name</name><value>commons-cli</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>Manifest</source><name>bundle-symbolicname</name><value>org.apache.commons.cli</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>bundle-docurl</name><value>http://commons.apache.org/proper/commons-cli/</value></evidence><evidence type="product" confidence="LOW"><source>pom</source><name>groupid</name><value>commons-cli</value></evidence><evidence type="product" confidence="HIGH"><source>pom</source><name>name</name><value>Apache Commons CLI</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>require-capability</name><value>osgi.ee;filter:=&quot;(&amp;(osgi.ee=JavaSE)(version=1.5))&quot;</value></evidence><evidence type="product" confidence="MEDIUM"><source>pom</source><name>url</name><value>http://commons.apache.org/proper/commons-cli/</value></evidence><evidence type="product" confidence="LOW"><source>pom</source><name>parent-groupid</name><value>org.apache.commons</value></evidence><evidence type="product" confidence="MEDIUM"><source>pom</source><name>parent-artifactid</name><value>commons-parent</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>implementation-url</name><value>http://commons.apache.org/proper/commons-cli/</value></evidence><evidence type="product" confidence="HIGHEST"><source>jar</source><name>package name</name><value>cli</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>Bundle-Name</name><value>Apache Commons CLI</value></evidence><evidence type="product" confidence="HIGHEST"><source>jar</source><name>package name</name><value>apache</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>specification-title</name><value>Apache Commons CLI</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>implementation-build</name><value>tags/cli-1.4-RC1@r1786159; 2017-03-09 13:01:35+0000</value></evidence><evidence type="product" confidence="HIGHEST"><source>jar</source><name>package name</name><value>commons</value></evidence><evidence type="product" confidence="HIGHEST"><source>pom</source><name>artifactid</name><value>commons-cli</value></evidence><evidence type="product" confidence="HIGH"><source>file</source><name>name</name><value>commons-cli</value></evidence><evidence type="product" confidence="HIGH"><source>Manifest</source><name>Implementation-Title</name><value>Apache Commons CLI</value></evidencLine truncated
+  </description><license>http://www.apache.org/licenses/LICENSE-2.0.txt</license><projectReferences><projectReference>java-demo-project:compile</projectReference></projectReferences><evidenceCollected><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>groupid</name><value>com.fasterxml.jackson.core</value></evidence><evidence type="vendor" confidence="HIGH"><source>Manifest</source><name>Implementation-Vendor</name><value>FasterXML</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>fasterxml</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>require-capability</name><value>osgi.ee;filter:=&quot;(&amp;(osgi.ee=JavaSE)(version=1.6))&quot;</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>implementation-build-date</name><value>2017-07-30 03:53:23+0000</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>jar</source><name>package name</name><value>jackson</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>url</name><value>http://github.com/FasterXML/jackson</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>pom</source><name>parent-groupid</name><value>com.fasterxml.jackson</value></evidence><evidence type="vendor" confidence="HIGH"><source>pom</source><name>name</name><value>Jackson-annotations</value></evidence><evidence type="vendor" confidence="HIGHEST"><source>pom</source><name>groupid</name><value>fasterxml.jackson.core</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>Manifest</source><name>Implementation-Vendor-Id</name><value>com.fasterxml.jackson.core</value></evidence><evidence type="vendor" confidence="MEDIUM"><source>Manifest</source><name>bundle-symbolicname</name><value>com.fasterxml.jackson.core.jackson-annotations</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>bundle-docurl</name><value>http://github.com/FasterXML/jackson</value></evidence><evidence type="vendor" confidence="HIGH"><source>file</source><name>name</name><value>jackson-annotations</value></evidence><evidence type="vendor" confidence="LOW"><source>pom</source><name>artifactid</name><value>jackson-annotations</value></evidence><evidence type="vendor" confidence="LOW"><source>Manifest</source><name>specification-vendor</name><value>FasterXML</value></evidence><evidence type="vendor" confidence="LOW"><source>pom</source><name>parent-artifactid</name><value>jackson-parent</value></evidence><evidence type="product" confidence="HIGHEST"><source>jar</source><name>package name</name><value>fasterxml</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>require-capability</name><value>osgi.ee;filter:=&quot;(&amp;(osgi.ee=JavaSE)(version=1.6))&quot;</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>implementation-build-date</name><value>2017-07-30 03:53:23+0000</value></evidence><evidence type="product" confidence="HIGHEST"><source>jar</source><name>package name</name><value>jackson</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>Bundle-Name</name><value>Jackson-annotations</value></evidence><evidence type="product" confidence="MEDIUM"><source>pom</source><name>url</name><value>http://github.com/FasterXML/jackson</value></evidence><evidence type="product" confidence="HIGH"><source>pom</source><name>name</name><value>Jackson-annotations</value></evidence><evidence type="product" confidence="LOW"><source>pom</source><name>parent-groupid</name><value>com.fasterxml.jackson</value></evidence><evidence type="product" confidence="LOW"><source>pom</source><name>groupid</name><value>fasterxml.jackson.core</value></evidence><evidence type="product" confidence="HIGH"><source>Manifest</source><name>Implementation-Title</name><value>Jackson-annotations</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>bundle-symbolicname</name><value>com.fasterxml.jackson.core.jackson-annotations</value></evidence><evidence type="product" confidence="LOW"><source>Manifest</source><name>bundle-docurl</name><value>http://github.com/FasterXML/jackson</value></evidence><evidence type="product" confidence="MEDIUM"><source>Manifest</source><name>specification-title</name><value>Jackson-annotations</value></evidence><evidence type="product" confidence="HIGHEST"><source>pom</source><name>artifactid</name><value>jackson-annotations</value></evidence><evidence type="product" confidence="HIGH"><source>file</source><name>name</name><value>jackson-annotations</value></evidence><evidence type="product" confidence="MEDIUM"><source>pom</source><name>parent-artifactid</name><value>jackson-parent</value></evidence><evidence type="version" confidence="HIGHEST"><source>file</source><name>version</name><value>2.9.0</value></evidenLine truncated

test/resources/pom.xml

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.ysoft.security</groupId>
+    <artifactId>java-demo-project</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>
+
+    <dependencies>
+		<dependency>
+			<groupId>commons-collections</groupId>
+			<artifactId>commons-collections</artifactId>
+			<version>3.2.1</version>
+		</dependency>
+        <dependency>
+            <groupId>commons-cli</groupId>
+            <artifactId>commons-cli</artifactId>
+            <version>1.4</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.9.7</version>
+        </dependency>
+    </dependencies>
+
+</project>