updates to resolve #2055

jeremylong · Jul 10, 2019 · 7bc1edf · 7bc1edf
1 parent 1279d55
commit 7bc1edf
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 3 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
@@ -315,7 +315,7 @@ protected void determineCPE(Dependency dependency) throws CorruptIndexException,
     protected void collectTerms(Map<String, MutableInt> terms, Iterable<Evidence> evidence) {
         for (Evidence e : evidence) {
             String value = cleanseText(e.getValue());
-            if (value.isEmpty()) {
+            if (StringUtils.isBlank(value)) {
                 continue;
             }
             if (value.length() > 1000) {
@@ -484,6 +484,8 @@ private boolean appendWeightedSearch(StringBuilder sb, String field, Map<String,
         }
         sb.append(field).append(":(");
         boolean addSpace = false;
+        boolean addedTerm = false;
+
         for (Map.Entry<String, MutableInt> entry : terms.entrySet()) {
             final StringBuilder boostedTerms = new StringBuilder();
             final int weighting = entry.getValue().intValue();
@@ -497,6 +499,7 @@ private boolean appendWeightedSearch(StringBuilder sb, String field, Map<String,
                 } else {
                     addSpace = true;
                 }
+                addedTerm=true;
                 if (LuceneUtils.isKeyword(word)) {
                     sb.append("\"");
                     LuceneUtils.appendEscapedLuceneQuery(sb, word);
@@ -525,7 +528,7 @@ private boolean appendWeightedSearch(StringBuilder sb, String field, Map<String,
             }
         }
         sb.append(")");
-        return true;
+        return addedTerm;
     }
 
     /**

diff --git a/core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java b/core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
@@ -278,7 +278,8 @@ public synchronized TopDocs search(String searchString, int maxQueryResults) thr
      * analyzers
      */
     public synchronized Query parseQuery(String searchString) throws ParseException, IndexException {
-        if (searchString == null || searchString.trim().isEmpty()) {
+        if (searchString == null || searchString.trim().isEmpty() 
+                || "product:() AND vendor:()".equals(searchString)) {
             throw new ParseException("Query is null or empty");
         }
         LOGGER.debug(searchString);

diff --git a/core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.java b/core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.java
@@ -190,6 +190,16 @@ public void testAddEvidenceWithoutDuplicateTerms() {
         assertEquals(expValue, terms.get(expResult).intValue());
     }
 
+    @Test
+    public void testCollectTerms() {
+        Map<String, MutableInt> terms = new HashMap<>();
+        List<Evidence> evidence = new ArrayList<>();
+        evidence.add(new Evidence("\\@", "\\*", "\\+", Confidence.HIGHEST));
+        CPEAnalyzer instance = new CPEAnalyzer();
+        instance.collectTerms(terms, evidence);
+        assertTrue(terms.isEmpty());
+    }
+
     /**
      * Test of buildSearch method, of class CPEAnalyzer.
      */
@@ -267,4 +277,18 @@ public void testBuildSearch() {
         result = instance.buildSearch(vendor, product, vendorWeighting, productWeightings);
         assertEquals(expResult, result);
     }
+
+    @Test
+    public void testBuildSearchBlank() {
+        Map<String, MutableInt> vendor = new HashMap<>();
+        Map<String, MutableInt> product = new HashMap<>();
+        vendor.put("   ", new MutableInt(1));
+        product.put("   ", new MutableInt(1));
+        Set<String> vendorWeighting = new HashSet<>();
+        Set<String> productWeightings = new HashSet<>();
+
+        CPEAnalyzer instance = new CPEAnalyzer();
+        String result = instance.buildSearch(vendor, product, vendorWeighting, productWeightings);
+        assertNull(result);
+    }
 }