loadSuppressionFile(final SuppressionParser parser
deleteTempFile = true;
file = getSettings().getTempFile("suppression", "xml");
try {
- org.apache.commons.io.FileUtils.copyInputStreamToFile(suppressionFromClasspath, file);
+ Files.copy(suppressionFromClasspath, file.toPath());
} catch (IOException ex) {
throwSuppressionParseException("Unable to locate suppression file in classpath", ex, suppressionFilePath);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java
index 818ba2186c8..1dcaa3bafe9 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java
@@ -26,54 +26,127 @@ public enum AnalysisPhase {
/**
* Initialization phase.
+ * @implNote Bound analyzers are {@link ArchiveAnalyzer}
*/
INITIAL,
/**
* Pre information collection phase.
+ * @implNote Bound analyzers are {@link ElixirMixAuditAnalyzer},{@link RubyBundleAuditAnalyzer}
*/
PRE_INFORMATION_COLLECTION,
/**
* Information collection phase.
+ * @implNote Bound analyzers are
+ * {@link ArtifactoryAnalyzer}
+ * {@link AssemblyAnalyzer}
+ * {@link AutoconfAnalyzer}
+ * {@link CMakeAnalyzer}
+ * {@link CentralAnalyzer}
+ * {@link CarthageAnalyzer}
+ * {@link CocoaPodsAnalyzer}
+ * {@link ComposerLockAnalyzer}
+ * {@link DartAnalyzer}
+ * {@link FileNameAnalyzer}
+ * {@link GolangDepAnalyzer}
+ * {@link GolangModAnalyzer}
+ * {@link JarAnalyzer}
+ * {@link LibmanAnalyzer}
+ * {@link MSBuildProjectAnalyzer}
+ * {@link NexusAnalyzer}
+ * {@link NodeAuditAnalyzer}
+ * {@link NugetconfAnalyzer}
+ * {@link NuspecAnalyzer}
+ * {@link OpenSSLAnalyzer}
+ * {@link PinnedMavenInstallAnalyzer}
+ * {@link PipAnalyzer}
+ * {@link PipfileAnalyzer}
+ * {@link PipfilelockAnalyzer}
+ * {@link PoetryAnalyzer}
+ * {@link PythonDistributionAnalyzer}
+ * {@link PythonPackageAnalyzer}
+ * {@link RubyGemspecAnalyzer}
+ * {@link RubyBundlerAnalyzer}
+ * {@link SwiftPackageManagerAnalyzer}
+ * {@link SwiftPackageResolvedAnalyzer}
*/
INFORMATION_COLLECTION,
/**
* Information collection phase 2.
+ * @implNote Bound analyzers are
+ * {@link PEAnalyzer}
*/
INFORMATION_COLLECTION2,
/**
- * Post information collection phase.
+ * Post information collection phase 1.
+ * @implNote Bound analyzers are
+ * {@link DependencyMergingAnalyzer}
*/
- POST_INFORMATION_COLLECTION,
+ POST_INFORMATION_COLLECTION1,
+ /**
+ * Post information collection phase 2.
+ * @implNote Bound analyzers are
+ * {@link HintAnalyzer} (must run before {@link VersionFilterAnalyzer}, should run after {@link DependencyMergingAnalyzer})
+ */
+ POST_INFORMATION_COLLECTION2,
+ /**
+ * Post information collection phase 3.
+ * @implNote Bound analyzers are
+ * {@link VersionFilterAnalyzer}
+ */
+ POST_INFORMATION_COLLECTION3,
/**
* Pre identifier analysis phase.
+ * @implNote Bound analyzers are
+ * {@link NpmCPEAnalyzer} (must run in a separate phase from {@link CPEAnalyzer} due to singleton re-use)
*/
PRE_IDENTIFIER_ANALYSIS,
/**
* Identifier analysis phase.
+ * @implNote Bound analyzers are
+ * {@link CPEAnalyzer}
*/
IDENTIFIER_ANALYSIS,
/**
* Post identifier analysis phase.
+ * @implNote Bound analyzers are
+ * {@link CpeSuppressionAnalyzer}
+ * {@link FalsePositiveAnalyzer}
*/
POST_IDENTIFIER_ANALYSIS,
/**
* Pre finding analysis phase.
+ * @implNote No analyzers bound to this phase
*/
PRE_FINDING_ANALYSIS,
/**
* Finding analysis phase.
+ * @implNote Bound analyzers are
+ * {@link NodeAuditAnalyzer}
+ * {@link NvdCveAnalyzer}
+ * {@link PnpmAuditAnalyzer}
+ * {@link RetireJsAnalyzer}
+ * {@link YarnAuditAnalyzer}
+ *
*/
FINDING_ANALYSIS,
/**
* Finding analysis phase 2.
+ * @implNote Bound analyzers are
+ * {@link OssIndexAnalyzer}
*/
FINDING_ANALYSIS_PHASE2,
/**
* Post analysis phase.
+ * @implNote Bound analyzers are
+ * {@link KnownExploitedVulnerabilityAnalyzer}
+ * {@link VulnerabilitySuppressionAnalyzer}
*/
POST_FINDING_ANALYSIS,
/**
* The final analysis phase.
+ * @implNote Bound analyzers are
+ * {@link DependencyBundlingAnalyzer}
+ * {@link UnusedSuppressionRuleAnalyzer}
*/
FINAL
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
index 593b6d42500..7e7a113b6b0 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
@@ -17,41 +17,21 @@
*/
package org.owasp.dependencycheck.analyzer;
-import java.io.BufferedInputStream;
-import java.io.File;
-import java.io.FileFilter;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.Collections;
-import java.util.Enumeration;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-import javax.annotation.concurrent.ThreadSafe;
-
import org.apache.commons.compress.archivers.ArchiveEntry;
import org.apache.commons.compress.archivers.ArchiveInputStream;
import org.apache.commons.compress.archivers.cpio.CpioArchiveInputStream;
import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
-import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
import org.apache.commons.compress.archivers.zip.ZipFile;
import org.apache.commons.compress.compressors.CompressorInputStream;
import org.apache.commons.compress.compressors.bzip2.BZip2CompressorInputStream;
import org.apache.commons.compress.compressors.bzip2.BZip2Utils;
import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream;
import org.apache.commons.compress.compressors.gzip.GzipUtils;
-import org.apache.commons.compress.utils.IOUtils;
+import org.apache.commons.io.IOUtils;
import org.eclipse.packager.rpm.RpmTag;
import org.eclipse.packager.rpm.parse.RpmInputStream;
import org.owasp.dependencycheck.Engine;
-import static org.owasp.dependencycheck.analyzer.AbstractNpmAnalyzer.shouldProcess;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException;
import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
@@ -60,10 +40,30 @@
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.utils.Settings;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+
+import static org.owasp.dependencycheck.analyzer.AbstractNpmAnalyzer.shouldProcess;
+
/**
*
* An analyzer that extracts files from archives and ensures any supported files
@@ -360,7 +360,7 @@ private void addDisguisedJarsToDependencies(Dependency dependency, Engine engine
dependency.setMd5sum("");
dependency.setSha1sum("");
dependency.setSha256sum("");
- org.apache.commons.io.FileUtils.copyFile(dependency.getActualFile(), tmpLoc);
+ Files.copy(dependency.getActualFile().toPath(), tmpLoc.toPath());
final List dependencySet = findMoreDependencies(engine, tmpLoc);
if (dependencySet != null && !dependencySet.isEmpty()) {
dependencySet.forEach((d) -> {
@@ -460,7 +460,7 @@ private void extractFiles(File archive, File destination, Engine engine) throws
tin = new TarArchiveInputStream(in);
extractArchive(tin, destination, engine);
} else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) {
- final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
+ final String uncompressedName = GzipUtils.getUncompressedFileName(archive.getName());
final File f = new File(destination, uncompressedName);
if (engine.accept(f)) {
final String destPath = destination.getCanonicalPath();
@@ -475,7 +475,7 @@ private void extractFiles(File archive, File destination, Engine engine) throws
decompressFile(gin, f);
}
} else if ("bz2".equals(archiveExt) || "tbz2".equals(archiveExt)) {
- final String uncompressedName = BZip2Utils.getUncompressedFilename(archive.getName());
+ final String uncompressedName = BZip2Utils.getUncompressedFileName(archive.getName());
final File f = new File(destination, uncompressedName);
if (engine.accept(f)) {
final String destPath = destination.getCanonicalPath();
@@ -524,12 +524,11 @@ private void extractFiles(File archive, File destination, Engine engine) throws
* executable JAR is identified the input stream will be advanced to the
* start of the actual JAR file ( skipping the script).
*
- * @see
- * Installing
- * Spring Boot Applications
* @param archiveExt the file extension
* @param in the input stream
* @throws IOException thrown if there is an error reading the stream
+ * @see Installing
+ * Spring Boot Applications
*/
private void ensureReadableJar(final String archiveExt, BufferedInputStream in) throws IOException {
if (("war".equals(archiveExt) || "jar".equals(archiveExt)) && in.markSupported()) {
@@ -729,7 +728,7 @@ private boolean isZipFileActuallyJarFile(Dependency dependency) {
boolean isJar = false;
ZipFile zip = null;
try {
- zip = new ZipFile(dependency.getActualFilePath());
+ zip = ZipFile.builder().setFile(dependency.getActualFilePath()).get();
if (zip.getEntry("META-INF/MANIFEST.MF") != null
|| zip.getEntry("META-INF/maven") != null) {
final Enumeration entries = zip.getEntries();
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/ArtifactoryAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/ArtifactoryAnalyzer.java
index 0aaf21e7ac5..332323a0063 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/ArtifactoryAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/ArtifactoryAnalyzer.java
@@ -17,7 +17,6 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.artifactory.ArtifactorySearch;
@@ -30,8 +29,11 @@
import org.owasp.dependencycheck.utils.DownloadFailedException;
import org.owasp.dependencycheck.utils.Downloader;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.owasp.dependencycheck.xml.pom.PomUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -44,8 +46,6 @@
import java.net.URL;
import java.nio.file.Files;
import java.util.List;
-import org.owasp.dependencycheck.utils.ResourceNotFoundException;
-import org.owasp.dependencycheck.utils.TooManyRequestsException;
/**
* Analyzer which will attempt to locate a dependency, and the GAV information,
@@ -234,10 +234,10 @@ private void processPom(Dependency dependency, MavenArtifact ma) throws IOExcept
Files.delete(pomFile.toPath());
LOGGER.debug("Downloading {}", ma.getPomUrl());
//TODO add caching
- final Downloader downloader = new Downloader(getSettings());
- downloader.fetchFile(new URL(ma.getPomUrl()), pomFile,
+ Downloader.getInstance().fetchFile(new URL(ma.getPomUrl()), pomFile, true,
Settings.KEYS.ANALYZER_ARTIFACTORY_API_USERNAME,
- Settings.KEYS.ANALYZER_ARTIFACTORY_API_TOKEN);
+ Settings.KEYS.ANALYZER_ARTIFACTORY_API_TOKEN,
+ Settings.KEYS.ANALYZER_ARTIFACTORY_BEARER_TOKEN);
PomUtils.analyzePOM(dependency, pomFile);
} catch (DownloadFailedException ex) {
@@ -251,7 +251,7 @@ private void processPom(Dependency dependency, MavenArtifact ma) throws IOExcept
LOGGER.warn("pom.xml not found for {} from Artifactory; "
+ "this could result in undetected CPE/CVEs.", dependency.getFileName());
} finally {
- if (pomFile != null && pomFile.exists() && !FileUtils.deleteQuietly(pomFile)) {
+ if (pomFile != null && pomFile.exists() && !FileUtils.delete(pomFile)) {
LOGGER.debug("Failed to delete temporary pom file {}", pomFile);
pomFile.deleteOnExit();
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
index f3b2ec4c167..d9cd109f3ba 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java
@@ -284,20 +284,24 @@ private void updateDependency(final AssemblyData data, Dependency dependency) {
if (!StringUtils.isBlank(data.getCompanyName())) {
dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "CompanyName", data.getCompanyName(), Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "CompanyName", data.getCompanyName(), Confidence.LOW);
addMatchingValues(data.getNamespaces(), data.getCompanyName(), dependency, EvidenceType.VENDOR);
}
if (!StringUtils.isBlank(data.getProductName())) {
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "ProductName", data.getProductName(), Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "ProductName", data.getProductName(), Confidence.MEDIUM);
addMatchingValues(data.getNamespaces(), data.getProductName(), dependency, EvidenceType.PRODUCT);
}
if (!StringUtils.isBlank(data.getFileDescription())) {
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "FileDescription", data.getFileDescription(), Confidence.HIGH);
+ dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "FileDescription", data.getFileDescription(), Confidence.LOW);
addMatchingValues(data.getNamespaces(), data.getFileDescription(), dependency, EvidenceType.PRODUCT);
}
final String internalName = data.getInternalName();
if (!StringUtils.isBlank(internalName)) {
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "InternalName", internalName, Confidence.MEDIUM);
+ dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "InternalName", internalName, Confidence.LOW);
addMatchingValues(data.getNamespaces(), internalName, dependency, EvidenceType.PRODUCT);
addMatchingValues(data.getNamespaces(), internalName, dependency, EvidenceType.VENDOR);
if (dependency.getName() == null && StringUtils.containsIgnoreCase(dependency.getActualFile().getName(), internalName)) {
@@ -313,6 +317,7 @@ private void updateDependency(final AssemblyData data, Dependency dependency) {
final String originalFilename = data.getOriginalFilename();
if (!StringUtils.isBlank(originalFilename)) {
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "OriginalFilename", originalFilename, Confidence.MEDIUM);
+ dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "OriginalFilename", originalFilename, Confidence.LOW);
addMatchingValues(data.getNamespaces(), originalFilename, dependency, EvidenceType.PRODUCT);
if (dependency.getName() == null && StringUtils.containsIgnoreCase(dependency.getActualFile().getName(), originalFilename)) {
final String ext = FileUtils.getFileExtension(originalFilename);
@@ -355,7 +360,7 @@ public void prepareFileTypeAnalyzer(Engine engine) throws InitializationExceptio
+ "'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on "
+ "the path; either disable the Assembly Analyzer or add the path to dotnet "
+ "core in the configuration.");
- LOGGER.error("The dotnet 6.0 core runtime or SDK is required to analyze assemblies");
+ LOGGER.error("The dotnet 8.0 core runtime or SDK is required to analyze assemblies");
LOGGER.error("----------------------------------------------------");
return;
}
@@ -367,28 +372,28 @@ public void prepareFileTypeAnalyzer(Engine engine) throws InitializationExceptio
final String error = processReader.getError();
if (p.exitValue() != 1 || !StringUtils.isBlank(error)) {
LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details.\n"
- + "dependency-check requires dotnet 6.0 core runtime or sdk to be installed to analyze assemblies.");
+ + "dependency-check requires dotnet 8.0 core runtime or sdk to be installed to analyze assemblies.");
LOGGER.debug("GrokAssembly.dll is not working properly");
grokAssembly = null;
setEnabled(false);
- throw new InitializationException("Could not execute .NET AssemblyAnalyzer, is the dotnet 6.0 runtime or sdk installed?");
+ throw new InitializationException("Could not execute .NET AssemblyAnalyzer, is the dotnet 8.0 runtime or sdk installed?");
}
}
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
- + "dependency-check requires dotnet 6.0 core runtime or sdk to be installed to analyze assemblies;\n"
+ + "dependency-check requires dotnet 8.0 core runtime or sdk to be installed to analyze assemblies;\n"
+ "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details.");
LOGGER.debug("Could not execute GrokAssembly {}", e.getMessage());
setEnabled(false);
throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer", e);
} catch (IOException e) {
LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
- + "dependency-check requires dotnet 6.0 core to be installed to analyze assemblies;\n"
+ + "dependency-check requires dotnet 8.0 core to be installed to analyze assemblies;\n"
+ "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details.");
LOGGER.debug("Could not execute GrokAssembly {}", e.getMessage());
setEnabled(false);
- throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer, is the dotnet 6.0 runtime or sdk installed?", e);
+ throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer, is the dotnet 8.0 runtime or sdk installed?", e);
}
}
@@ -422,7 +427,9 @@ private File extractGrokAssembly() throws InitializationException {
*/
@Override
public void closeAnalyzer() throws Exception {
- FileUtils.delete(grokAssembly.getParentFile());
+ if (grokAssembly != null) {
+ FileUtils.delete(grokAssembly.getParentFile());
+ }
}
@Override
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java
index 303d775e58b..08c059b8a70 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java
@@ -17,11 +17,12 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.utils.UrlStringUtils;
@@ -29,11 +30,10 @@
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.exception.InitializationException;
/**
* Used to analyze Autoconf input files named configure.ac or configure.in.
@@ -187,7 +187,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine)
* @param contents the contents to analyze for evidence
*/
private void extractConfigureScriptEvidence(Dependency dependency,
- final String name, final String contents) {
+ final String name, final String contents) {
final Matcher matcher = PACKAGE_VAR.matcher(contents);
while (matcher.find()) {
final String variable = matcher.group(1);
@@ -195,12 +195,15 @@ private void extractConfigureScriptEvidence(Dependency dependency,
if (!value.isEmpty()) {
if (variable.endsWith("NAME")) {
dependency.addEvidence(EvidenceType.PRODUCT, name, variable, value, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, name, variable, value, Confidence.MEDIUM);
} else if ("VERSION".equals(variable)) {
dependency.addEvidence(EvidenceType.VERSION, name, variable, value, Confidence.HIGHEST);
} else if ("BUGREPORT".equals(variable)) {
dependency.addEvidence(EvidenceType.VENDOR, name, variable, value, Confidence.HIGH);
+ dependency.addEvidence(EvidenceType.PRODUCT, name, variable, value, Confidence.MEDIUM);
} else if ("URL".equals(variable)) {
dependency.addEvidence(EvidenceType.VENDOR, name, variable, value, Confidence.HIGH);
+ dependency.addEvidence(EvidenceType.PRODUCT, name, variable, value, Confidence.MEDIUM);
}
}
}
@@ -216,7 +219,7 @@ private void extractConfigureScriptEvidence(Dependency dependency,
private String getFileContents(final File actualFile)
throws AnalysisException {
try {
- return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
+ return new String(Files.readAllBytes(actualFile.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException(
"Problem occurred while reading dependency file.", e);
@@ -231,7 +234,7 @@ private String getFileContents(final File actualFile)
* @param contents the evidence to analyze
*/
private void gatherEvidence(Dependency dependency, final String name,
- String contents) {
+ String contents) {
final Matcher matcher = AC_INIT_PATTERN.matcher(contents);
if (matcher.find()) {
dependency.addEvidence(EvidenceType.PRODUCT, name, "Package", matcher.group(1), Confidence.HIGHEST);
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java
index 4b422c3d756..fdd36476954 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java
@@ -17,10 +17,10 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
import org.apache.commons.lang3.StringUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.EvidenceType;
@@ -30,14 +30,14 @@
import org.owasp.dependencycheck.utils.DependencyVersionUtil;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
@@ -45,7 +45,6 @@
import java.util.Objects;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
/**
*
@@ -101,9 +100,8 @@ public class CMakeAnalyzer extends AbstractFileTypeAnalyzer {
/**
* Regex to extract product and version information.
*
- * Group 1: Product
- *
- * Group 2: Version
+ *
Group 1: Product
+ * Group 2: Version
*/
private static final Pattern SET_VERSION = Pattern
.compile("^\\s*set\\s*\\(\\s*(\\w+)_version\\s+\"?([^\")]*)\\s*\"?\\)", REGEX_OPTIONS);
@@ -171,7 +169,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
final String name = file.getName();
final String contents;
try {
- contents = FileUtils.readFileToString(file, Charset.defaultCharset()).trim();
+ contents = new String(Files.readAllBytes(file.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException(
"Problem occurred while reading dependency file.", e);
@@ -349,8 +347,8 @@ protected String getAnalyzerEnabledSettingKey() {
* initialized by other variables and end up forming an unresolvable
* chain.
*
- * This method takes the resolved variables map as an input and will return
- * a new map, without the keys generate an infinite resolution chain.
+ * This method takes the resolved variables map as an input and will return
+ * a new map, without the keys generating an infinite resolution chain.
*
* @param vars variables initialization detected in the CMake build file
*
@@ -379,6 +377,9 @@ private boolean isVariableSelfReferencing(Map vars, String key)
break;
}
nextKey = matcher.group(2);
+ if (Objects.nonNull(nextKey) && resolutionChain.contains(nextKey)) {
+ return true;
+ }
resolutionChain.add(nextKey);
} while (Objects.nonNull(nextKey) && vars.containsKey(nextKey) && !key.equals(nextKey));
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
index e1c89c41c74..d2fe65a1460 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
@@ -20,8 +20,6 @@
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
-import java.io.UnsupportedEncodingException;
-import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Arrays;
@@ -49,6 +47,7 @@
import org.apache.lucene.search.ScoreDoc;
import org.apache.lucene.search.TopDocs;
import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
@@ -110,24 +109,7 @@ public class CPEAnalyzer extends AbstractAnalyzer {
* alpha characters.
*/
private static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*";
- /**
- * UTF-8 character set name.
- */
- private static final String UTF8 = StandardCharsets.UTF_8.name();
- /**
- * The URL to search the NVD CVE data at NIST. This is used by calling:
- * String.format(NVD_SEARCH_URL, vendor, product, version);
- */
- public static final String NVD_SEARCH_URL = "https://nvd.nist.gov/vuln/search/results?form_type=Advanced&"
- + "results_type=overview&search_type=all&cpe_vendor=cpe%%3A%%2F%%3A%1$s&cpe_product=cpe%%3A%%2F%%3A%1$s%%3A%2$s&"
- + "cpe_version=cpe%%3A%%2F%%3A%1$s%%3A%2$s%%3A%3$s";
- /**
- * The URL to search the NVD CVE data at NIST. This is used by calling:
- * String.format(NVD_SEARCH_URL, vendor, product);
- */
- public static final String NVD_SEARCH_BROAD_URL = "https://nvd.nist.gov/vuln/search/results?form_type=Advanced&"
- + "results_type=overview&search_type=all&cpe_vendor=cpe%%3A%%2F%%3A%1$s&cpe_product=cpe%%3A%%2F%%3A%1$s%%3A%2$s";
/**
* The CPE in memory index.
*/
@@ -805,12 +787,11 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
* analysis
* @return true if an identifier was added to the dependency;
* otherwise false
- * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported
* @throws AnalysisException thrown if the suppression rules failed
*/
@SuppressWarnings("StringSplitter")
protected boolean determineIdentifiers(Dependency dependency, String vendor, String product,
- Confidence currentConfidence) throws UnsupportedEncodingException, AnalysisException {
+ Confidence currentConfidence) throws AnalysisException {
final CpeBuilder cpeBuilder = new CpeBuilder();
@@ -831,7 +812,7 @@ protected boolean determineIdentifiers(Dependency dependency, String vendor, Str
String bestGuessURL = null;
final Set collected = new HashSet<>();
- considerDependencyVersion(dependency, vendor, product, currentConfidence, collected, bestGuess);
+ considerDependencyVersion(dependency, vendor, product, currentConfidence, collected);
//TODO the following algorithm incorrectly identifies things as a lower version
// if there lower confidence evidence when the current (highest) version number
@@ -863,8 +844,7 @@ protected boolean determineIdentifiers(Dependency dependency, String vendor, Str
dbVerUpdate = DependencyVersionUtil.parseVersion(vs.getVersion() + '.' + vs.getUpdate(), true);
}
if (dbVer == null) { //special case, no version specified - everything is vulnerable
- final String url = String.format(NVD_SEARCH_BROAD_URL, URLEncoder.encode(vs.getVendor(), UTF8),
- URLEncoder.encode(vs.getProduct(), UTF8));
+ final String url = CpeIdentifier.nvdProductSearchUrlFor(vs);
final IdentifierMatch match = new IdentifierMatch(vs, url, IdentifierConfidence.BROAD_MATCH, conf);
collected.add(match);
} else if (evVer.equals(dbVer)) {
@@ -874,8 +854,7 @@ protected boolean determineIdentifiers(Dependency dependency, String vendor, Str
bestGuessConf = conf;
bestGuess = dbVer;
bestGuessUpdate = evBaseVerUpdate;
- bestGuessURL = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getVendor(), UTF8),
- URLEncoder.encode(vs.getProduct(), UTF8), URLEncoder.encode(vs.getVersion(), UTF8));
+ bestGuessURL = CpeIdentifier.nvdSearchUrlFor(vs);
} else if (dbVerUpdate != null && evVer.getVersionParts().size() <= dbVerUpdate.getVersionParts().size()
&& evVer.matchesAtLeastThreeLevels(dbVerUpdate)) {
if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
@@ -982,14 +961,12 @@ protected boolean determineIdentifiers(Dependency dependency, String vendor, Str
* @param updateVersion the update version
* @param conf the current confidence
* @param collected a reference to the collected identifiers
- * @throws UnsupportedEncodingException thrown if UTF-8 is not supported
*/
private void addExactMatch(Cpe vs, String updateVersion, Confidence conf,
- final Set collected) throws UnsupportedEncodingException {
+ final Set collected) {
final CpeBuilder cpeBuilder = new CpeBuilder();
- final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getVendor(), UTF8),
- URLEncoder.encode(vs.getProduct(), UTF8), URLEncoder.encode(vs.getVersion(), UTF8));
+ final String url = CpeIdentifier.nvdSearchUrlFor(vs);
Cpe useCpe;
if (updateVersion != null && "*".equals(vs.getUpdate())) {
try {
@@ -1019,16 +996,13 @@ private void addExactMatch(Cpe vs, String updateVersion, Confidence conf,
* @param vendor the vendor name
* @param confidence the current confidence level
* @param collected a reference to the identifiers matched
- * @param bestGuess the current best guess as to the dependency version
* @throws AnalysisException thrown if aliens attacked and valid input could
* not be used to construct a CPE
- * @throws UnsupportedEncodingException thrown if run on a system that
- * doesn't support UTF-8
*/
private void considerDependencyVersion(Dependency dependency,
String vendor, String product, Confidence confidence,
- final Set collected, DependencyVersion bestGuess)
- throws AnalysisException, UnsupportedEncodingException {
+ final Set collected)
+ throws AnalysisException {
if (dependency.getVersion() != null && !dependency.getVersion().isEmpty()) {
final CpeBuilder cpeBuilder = new CpeBuilder();
@@ -1037,7 +1011,8 @@ private void considerDependencyVersion(Dependency dependency,
if (dependency.getName() != null && !dependency.getName().isEmpty()) {
final String name = dependency.getName();
for (String word : product.split("[^a-zA-Z0-9]")) {
- useDependencyVersion &= name.contains(word) || stopWords.contains(word);
+ useDependencyVersion &= name.contains(word) || stopWords.contains(word)
+ || wordMatchesEcosystem(dependency.getEcosystem(), word);
}
}
@@ -1050,18 +1025,37 @@ private void considerDependencyVersion(Dependency dependency,
addVersionAndUpdate(depVersion, cpeBuilder);
try {
final Cpe depCpe = cpeBuilder.build();
- final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vendor, UTF8),
- URLEncoder.encode(product, UTF8), URLEncoder.encode(depCpe.getVersion(), UTF8));
+ final String url = CpeIdentifier.nvdSearchUrlFor(vendor, product, depCpe.getVersion());
final IdentifierMatch match = new IdentifierMatch(depCpe, url, IdentifierConfidence.EXACT_MATCH, confidence);
collected.add(match);
} catch (CpeValidationException ex) {
- throw new AnalysisException(String.format("Unable to create a CPE for %s:%s:%s", vendor, product, bestGuess.toString()));
+ throw new AnalysisException(String.format("Unable to create a CPE for %s:%s:%s", vendor, product, depVersion));
}
}
}
}
}
+ /**
+ * If a CPE product word represents the ecosystem of a dependency it is not required
+ * to appear in the dependencyName to still consider the CPE product a match.
+ *
+ * @param ecosystem The ecosystem of the dependency
+ * @param word The word from the CPE product to check
+ * @return {@code true} when the CPE product word is known to match the ecosystem of the dependency
+ * @implNote This method is not intended to cover every possible case where the ecosystem is represented by the word. It is a
+ * best-effort attempt to prevent {@link #considerDependencyVersion(Dependency, String, String, Confidence, Set)}
+ * from not taking an exact-match versioned CPE into account because the ecosystem-related word does not appear in
+ * the dependencyName. It helps prevent false-positive cases like https://github.com/dependency-check/DependencyCheck/issues/5545
+ * @see #considerDependencyVersion(Dependency, String, String, Confidence, Set)
+ */
+ private boolean wordMatchesEcosystem(@Nullable String ecosystem, String word) {
+ if (Ecosystem.JAVA.equalsIgnoreCase(word)) {
+ return Ecosystem.JAVA.equals(ecosystem);
+ }
+ return false;
+ }
+
/**
*
* Returns the setting key to determine if the analyzer is enabled.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/CarthageAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/CarthageAnalyzer.java
new file mode 100644
index 00000000000..05d711a49d3
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/CarthageAnalyzer.java
@@ -0,0 +1,297 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2023 The OWASP Foundation. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import com.github.packageurl.MalformedPackageURLException;
+import com.github.packageurl.PackageURL;
+import com.github.packageurl.PackageURLBuilder;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
+import org.owasp.dependencycheck.dependency.Confidence;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
+import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.utils.Checksum;
+import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * This analyzer is used to analyze SWIFT and Objective-C packages by collecting
+ * information from Cartfile files. Carthage dependency manager see
+ * https://github.com/Carthage/Carthage.
+ *
+ * Based on CocoaPodsAnalyzer by Bianca Jiang.
+ *
+ * @author Alin Radut (https://github.com/alinradut)
+ */
+@Experimental
+@ThreadSafe
+public class CarthageAnalyzer extends AbstractFileTypeAnalyzer {
+
+ /**
+ * A descriptor for the type of dependencies processed or added by this
+ * analyzer.
+ */
+ public static final String DEPENDENCY_ECOSYSTEM = Ecosystem.IOS;
+
+ /**
+ * The logger.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(CarthageAnalyzer.class);
+ /**
+ * The name of the analyzer.
+ */
+ private static final String ANALYZER_NAME = "Carthage Package Analyzer";
+
+ /**
+ * The phase that this analyzer is intended to run in.
+ */
+ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+
+ /**
+ * The file name to scan.
+ */
+ public static final String CARTFILE_RESOLVED = "Cartfile.resolved";
+ /**
+ * Filter that detects files named "Cartfile.resolved".
+ */
+ private static final FileFilter CARTHAGE_FILTER = FileFilterBuilder.newInstance().addFilenames(CARTFILE_RESOLVED).build();
+
+ /**
+ * The capture group #1 is the dependency type, #2 is the name, #3 is
+ * dependency version. The version can be a commit ref, so we can't assume
+ * it's a number
+ *
+ * Example values:
+ *
+ * - binary "https://dl.google.com/geosdk/GoogleMaps.json" "7.2.0"
+ * - git "https://gitlab.matrix.org/matrix-org/olm.git" "3.2.16"
+ * - github "alinradut/SwiftEntryKit"
+ * "95f4a08f41ddcf2c02e2b22789038774c8c94df5"
+ * - github "CocoaLumberjack/CocoaLumberjack" "3.8.5"
+ * - github "realm/realm-swift" "v10.44.0"
+ *
+ */
+ private static final Pattern CARTFILE_RESOLVED_DEPENDENCY_PATTERN = Pattern.compile("(github|git|binary) \"([^\"]+)\" \"([^\"]+)\"");
+
+ /**
+ * The capture group #1 is the actual numerical version.
+ */
+ private static final Pattern CARTFILE_VERSION_PATTERN = Pattern.compile("^v?(\\d+(\\.\\d+){0,4})$");
+
+ /**
+ * Capture group #1 is the dependency name.
+ *
+ * Example values:
+ *
+ * - robbiehanson/XMPPFramework
+ * - CocoaLumberjack/CocoaLumberjack
+ *
+ */
+ private static final Pattern CARTFILE_RESOLVED_GITHUB_DEPENDENCY = Pattern.compile("[a-zA-Z0-9-_]+/([a-zA-Z0-9\\-_\\.]+)");
+
+ /**
+ * Capture group #1 is the dependency name.
+ */
+ private static final Pattern CARTFILE_RESOLVED_GIT_DEPENDENCY = Pattern.compile(".*?/([a-zA-Z0-9\\-_\\.]+).git");
+
+ /**
+ * Capture group #1 is the dependency name.
+ *
+ * Example values:
+ *
+ * - https://my.domain.com/release/MyFramework.json
+ * - file:///some/Path/MyFramework.json -
+ * relative/path/MyFramework.json
+ * - /absolute/path/MyFramework.json
+ *
+ */
+ private static final Pattern CARTFILE_RESOLVED_BINARY_DEPENDENCY = Pattern.compile("([a-zA-Z0-9\\-_\\.]+).json");
+
+ /**
+ * Returns the FileFilter
+ *
+ * @return the FileFilter
+ */
+ @Override
+ protected FileFilter getFileFilter() {
+ return CARTHAGE_FILTER;
+ }
+
+ @Override
+ protected void prepareFileTypeAnalyzer(Engine engine) {
+ // NO-OP
+ }
+
+ /**
+ * Returns the name of the analyzer.
+ *
+ * @return the name of the analyzer.
+ */
+ @Override
+ public String getName() {
+ return ANALYZER_NAME;
+ }
+
+ /**
+ * Returns the phase that the analyzer is intended to run in.
+ *
+ * @return the phase that the analyzer is intended to run in.
+ */
+ @Override
+ public AnalysisPhase getAnalysisPhase() {
+ return ANALYSIS_PHASE;
+ }
+
+ /**
+ * Returns the key used in the properties file to reference the analyzer's
+ * enabled property.
+ *
+ * @return the analyzer's enabled property setting key
+ */
+ @Override
+ protected String getAnalyzerEnabledSettingKey() {
+ return Settings.KEYS.ANALYZER_CARTHAGE_ENABLED;
+ }
+
+ @Override
+ protected void analyzeDependency(Dependency dependency, Engine engine)
+ throws AnalysisException {
+ if (CARTFILE_RESOLVED.equals(dependency.getFileName())) {
+ analyzeCartfileResolvedDependency(dependency, engine);
+ }
+ }
+
+ /**
+ * Analyzes the Cartfile.resolved and adds the evidence to the dependency.
+ *
+ * @param cartfileResolved the dependency
+ * @param engine a reference to the dependency-check engine
+ * @throws AnalysisException thrown if there is an error analyzing the
+ * Cartfile
+ */
+ private void analyzeCartfileResolvedDependency(Dependency cartfileResolved, Engine engine)
+ throws AnalysisException {
+ engine.removeDependency(cartfileResolved);
+
+ final String contents;
+ try {
+ contents = new String(Files.readAllBytes(cartfileResolved.getActualFile().toPath()), StandardCharsets.UTF_8);
+ } catch (IOException e) {
+ throw new AnalysisException(
+ "Problem occurred while reading dependency file.", e);
+ }
+
+ final Matcher matcher = CARTFILE_RESOLVED_DEPENDENCY_PATTERN.matcher(contents);
+ while (matcher.find()) {
+ final String type = matcher.group(1);
+ String name = matcher.group(2);
+ String version = matcher.group(3);
+
+ final Matcher versionMatcher = CARTFILE_VERSION_PATTERN.matcher(version);
+ if (versionMatcher.find()) {
+ version = versionMatcher.group(1);
+ } else {
+ // this is probably a git commit reference, so we'll default to 0.0.0.
+ // this will probably bubble up a ton of CVEs, but serves you right for
+ // not using semantic versioning.
+ version = "0.0.0";
+ }
+
+ if (type.contentEquals("git")) {
+ final Matcher nameMatcher = CARTFILE_RESOLVED_GIT_DEPENDENCY.matcher(name);
+ if (!nameMatcher.find()) {
+ continue;
+ }
+ name = nameMatcher.group(1);
+ } else if (type.contentEquals("github")) {
+ final Matcher nameMatcher = CARTFILE_RESOLVED_GITHUB_DEPENDENCY.matcher(name);
+ if (!nameMatcher.find()) {
+ continue;
+ }
+ name = nameMatcher.group(1);
+ } else if (type.contentEquals("binary")) {
+ final Matcher nameMatcher = CARTFILE_RESOLVED_BINARY_DEPENDENCY.matcher(name);
+ if (!nameMatcher.find()) {
+ continue;
+ }
+ name = nameMatcher.group(1);
+ }
+
+ final Dependency dependency = new Dependency(cartfileResolved.getActualFile(), true);
+ dependency.setEcosystem(DEPENDENCY_ECOSYSTEM);
+ dependency.setName(name);
+ dependency.setVersion(version);
+
+ try {
+ final PackageURLBuilder builder = PackageURLBuilder.aPackageURL().withType("carthage").withName(dependency.getName());
+ if (dependency.getVersion() != null) {
+ builder.withVersion(dependency.getVersion());
+ }
+ final PackageURL purl = builder.build();
+ dependency.addSoftwareIdentifier(new PurlIdentifier(purl, Confidence.HIGHEST));
+ } catch (MalformedPackageURLException ex) {
+ LOGGER.debug("Unable to build package url for carthage", ex);
+ final GenericIdentifier id;
+ if (dependency.getVersion() != null) {
+ id = new GenericIdentifier("carthage:" + dependency.getName() + "@" + dependency.getVersion(), Confidence.HIGHEST);
+ } else {
+ id = new GenericIdentifier("carthage:" + dependency.getName(), Confidence.HIGHEST);
+ }
+ dependency.addSoftwareIdentifier(id);
+ }
+
+ final String packagePath = String.format("%s:%s", name, version);
+ dependency.setPackagePath(packagePath);
+ dependency.setDisplayFileName(packagePath);
+ dependency.setSha1sum(Checksum.getSHA1Checksum(packagePath));
+ dependency.setSha256sum(Checksum.getSHA256Checksum(packagePath));
+ dependency.setMd5sum(Checksum.getMD5Checksum(packagePath));
+ dependency.addEvidence(EvidenceType.VENDOR, CARTFILE_RESOLVED, "name", name, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.PRODUCT, CARTFILE_RESOLVED, "name", name, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VERSION, CARTFILE_RESOLVED, "version", version, Confidence.HIGHEST);
+ engine.addDependency(dependency);
+ }
+ }
+
+ /**
+ * Sets the package path on the given dependency.
+ *
+ * @param dep the dependency to update
+ */
+ private void setPackagePath(Dependency dep) {
+ final File file = new File(dep.getFilePath());
+ final String parent = file.getParent();
+ if (parent != null) {
+ dep.setPackagePath(parent);
+ }
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/CentralAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/CentralAnalyzer.java
index 1495bcb6b70..be270c96e8e 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/CentralAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/CentralAnalyzer.java
@@ -17,20 +17,34 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
+import org.apache.commons.jcs3.access.exception.CacheException;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
+import org.owasp.dependencycheck.data.cache.DataCache;
+import org.owasp.dependencycheck.data.cache.DataCacheFactory;
import org.owasp.dependencycheck.data.central.CentralSearch;
-import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.exception.InitializationException;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.FileUtils;
+import org.owasp.dependencycheck.utils.ForbiddenException;
+import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
+import org.owasp.dependencycheck.xml.pom.Model;
import org.owasp.dependencycheck.xml.pom.PomUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
import java.io.File;
import java.io.FileFilter;
import java.io.FileNotFoundException;
@@ -39,20 +53,6 @@
import java.net.URL;
import java.text.MessageFormat;
import java.util.List;
-import javax.annotation.concurrent.ThreadSafe;
-import org.apache.commons.jcs.access.exception.CacheException;
-import org.owasp.dependencycheck.data.cache.DataCache;
-import org.owasp.dependencycheck.data.cache.DataCacheFactory;
-
-import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.exception.InitializationException;
-import org.owasp.dependencycheck.utils.DownloadFailedException;
-import org.owasp.dependencycheck.utils.Downloader;
-import org.owasp.dependencycheck.utils.FileFilterBuilder;
-import org.owasp.dependencycheck.utils.InvalidSettingException;
-import org.owasp.dependencycheck.utils.ResourceNotFoundException;
-import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.xml.pom.Model;
/**
* Analyzer which will attempt to locate a dependency, and the GAV information,
@@ -242,12 +242,12 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
+ "this could result in undetected CPE/CVEs.", dependency.getFileName());
LOGGER.debug("Unable to delete temp file");
}
- final Downloader downloader = new Downloader(getSettings());
final int maxAttempts = this.getSettings().getInt(Settings.KEYS.ANALYZER_CENTRAL_RETRY_COUNT, 3);
int retryCount = 0;
long sleepingTimeBetweenRetriesInMillis = BASE_RETRY_WAIT;
boolean success = false;
Model model = null;
+ DownloadFailedException lastException = null;
if (cache != null) {
model = cache.get(ma.getPomUrl());
}
@@ -259,9 +259,10 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
do {
//CSOFF: NestedTryDepth
try {
- downloader.fetchFile(new URL(ma.getPomUrl()), pomFile);
+ Downloader.getInstance().fetchFile(new URL(ma.getPomUrl()), pomFile);
success = true;
} catch (DownloadFailedException ex) {
+ lastException = ex;
try {
Thread.sleep(sleepingTimeBetweenRetriesInMillis);
} catch (InterruptedException ex1) {
@@ -288,6 +289,10 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
} else {
LOGGER.warn("Unable to download pom.xml for {} from Central; "
+ "this could result in undetected CPE/CVEs.", dependency.getFileName());
+ setEnabled(false);
+ LOGGER.warn("Disabling the Central Analyzer due to repeated download failures; Central Search "
+ + "may be down see https://status.maven.org/\n Note that this could result in both false "
+ + "positives and false negatives", lastException);
}
} catch (AnalysisException ex) {
@@ -295,7 +300,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
+ "this could result in undetected CPE/CVEs.", dependency.getFileName()), ex);
} finally {
- if (pomFile != null && pomFile.exists() && !FileUtils.deleteQuietly(pomFile)) {
+ if (pomFile != null && pomFile.exists() && !FileUtils.delete(pomFile)) {
LOGGER.debug("Failed to delete temporary pom file {}", pomFile);
pomFile.deleteOnExit();
}
@@ -304,15 +309,25 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
}
} catch (TooManyRequestsException tre) {
this.setEnabled(false);
- final String message = "Connections to Central search refused. Analysis failed.";
+ final String message = "Connections to Central search refused. Analysis failed. Disabling Central analyzer - this " +
+ "could lead to both false positives and false negatives.";
LOGGER.error(message, tre);
throw new AnalysisException(message, tre);
} catch (IllegalArgumentException iae) {
LOGGER.info("invalid sha1-hash on {}", dependency.getFileName());
} catch (FileNotFoundException fnfe) {
LOGGER.debug("Artifact not found in repository: '{}", dependency.getFileName());
+ } catch (ForbiddenException e) {
+ this.setEnabled(false);
+ final String message = "Connection to Central search refused. This is most likely not a problem with " +
+ "Dependency-Check itself and is related to network connectivity. Please check " +
+ "https://central.sonatype.org/faq/403-error-central/.";
+ LOGGER.error(message);
+ throw new AnalysisException(message, e);
} catch (IOException ioe) {
- final String message = "Could not connect to Central search. Analysis failed.";
+ this.setEnabled(false);
+ final String message = "Could not connect to Central search. Analysis failed; disabling Central analyzer - this " +
+ "could lead to both false positives and false negatives.";
LOGGER.error(message, ioe);
throw new AnalysisException(message, ioe);
}
@@ -332,7 +347,8 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
* @throws TooManyRequestsException if Central has received too many
* requests.
*/
- protected List fetchMavenArtifacts(Dependency dependency) throws IOException, TooManyRequestsException {
+ protected List fetchMavenArtifacts(Dependency dependency) throws IOException,
+ TooManyRequestsException {
IOException lastException = null;
long sleepingTimeBetweenRetriesInMillis = BASE_RETRY_WAIT;
int triesLeft = numberOfRetries;
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/CocoaPodsAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/CocoaPodsAnalyzer.java
index 21be018850b..4b347bd3061 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/CocoaPodsAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/CocoaPodsAnalyzer.java
@@ -20,15 +20,6 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import java.io.File;
-import java.io.FileFilter;
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
@@ -37,12 +28,21 @@
import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.utils.Checksum;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.Checksum;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
/**
* This analyzer is used to analyze SWIFT and Objective-C packages by collecting
* information from .podspec files. CocoaPods dependency manager see
@@ -170,7 +170,7 @@ private void analyzePodfileLockDependencies(Dependency podfileLock, Engine engin
final String contents;
try {
- contents = FileUtils.readFileToString(podfileLock.getActualFile(), Charset.defaultCharset());
+ contents = new String(Files.readAllBytes(podfileLock.getActualFile().toPath()), StandardCharsets.UTF_8);
} catch (IOException e) {
throw new AnalysisException(
"Problem occurred while reading dependency file.", e);
@@ -229,7 +229,7 @@ private void analyzePodspecDependency(Dependency dependency)
dependency.setEcosystem(DEPENDENCY_ECOSYSTEM);
String contents;
try {
- contents = FileUtils.readFileToString(dependency.getActualFile(), Charset.defaultCharset());
+ contents = new String(Files.readAllBytes(dependency.getActualFile().toPath()), StandardCharsets.UTF_8);
} catch (IOException e) {
throw new AnalysisException(
"Problem occurred while reading dependency file.", e);
@@ -260,6 +260,7 @@ private void analyzePodspecDependency(Dependency dependency)
final String summary = determineEvidence(contents, blockVariable, "summary");
if (!summary.isEmpty()) {
dependency.addEvidence(EvidenceType.PRODUCT, PODSPEC, "summary", summary, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, PODSPEC, "summary", summary, Confidence.MEDIUM);
}
final String author = determineEvidence(contents, blockVariable, "authors?");
@@ -269,6 +270,7 @@ private void analyzePodspecDependency(Dependency dependency)
final String homepage = determineEvidence(contents, blockVariable, "homepage");
if (!homepage.isEmpty()) {
dependency.addEvidence(EvidenceType.VENDOR, PODSPEC, "homepage", homepage, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.PRODUCT, PODSPEC, "homepage", homepage, Confidence.LOW);
}
final String license = determineEvidence(contents, blockVariable, "licen[cs]es?");
if (!license.isEmpty()) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java
index 99f2c200dbf..43be4322194 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java
@@ -108,7 +108,8 @@ protected void prepareFileTypeAnalyzer(Engine engine) throws InitializationExcep
protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
engine.removeDependency(dependency);
try (FileInputStream fis = new FileInputStream(dependency.getActualFile())) {
- final ComposerLockParser clp = new ComposerLockParser(fis);
+ final boolean skipdev = getSettings().getBoolean(Settings.KEYS.ANALYZER_COMPOSER_LOCK_SKIP_DEV, false);
+ final ComposerLockParser clp = new ComposerLockParser(fis, skipdev);
LOGGER.debug("Checking composer.lock file {}", dependency.getActualFilePath());
clp.process();
clp.getDependencies().stream().map((dep) -> {
@@ -132,7 +133,9 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
d.setSha256sum(Checksum.getSHA256Checksum(filePath));
d.setMd5sum(Checksum.getMD5Checksum(filePath));
d.addEvidence(EvidenceType.VENDOR, COMPOSER_LOCK, "vendor", dep.getGroup(), Confidence.HIGHEST);
+ d.addEvidence(EvidenceType.PRODUCT, COMPOSER_LOCK, "vendor", dep.getGroup(), Confidence.MEDIUM);
d.addEvidence(EvidenceType.PRODUCT, COMPOSER_LOCK, "product", dep.getProject(), Confidence.HIGHEST);
+ d.addEvidence(EvidenceType.VENDOR, COMPOSER_LOCK, "product", dep.getProject(), Confidence.HIGH);
d.addEvidence(EvidenceType.VERSION, COMPOSER_LOCK, "version", dep.getVersion(), Confidence.HIGHEST);
return d;
}).forEach((d) -> {
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java
index 07c596275d0..432330fa88e 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java
@@ -47,7 +47,7 @@ public class DependencyMergingAnalyzer extends AbstractDependencyComparingAnalyz
/**
* The phase that this analyzer is intended to run in.
*/
- private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_INFORMATION_COLLECTION;
+ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_INFORMATION_COLLECTION1;
/**
* Used for synchronization when merging related dependencies.
*/
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/GolangModAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/GolangModAnalyzer.java
index b23a63932a3..b87d408cfee 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/GolangModAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/GolangModAnalyzer.java
@@ -32,7 +32,7 @@
import java.util.ArrayList;
import java.util.List;
-import javax.json.stream.JsonParsingException;
+import jakarta.json.stream.JsonParsingException;
import org.apache.commons.lang3.StringUtils;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
import org.owasp.dependencycheck.processing.GoModProcessor;
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
index 37787063628..2a4cd757dc5 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
@@ -17,22 +17,12 @@
*/
package org.owasp.dependencycheck.analyzer;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.List;
-import java.util.Set;
-import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Evidence;
import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.exception.InitializationException;
-import org.owasp.dependencycheck.xml.suppression.PropertyType;
import org.owasp.dependencycheck.utils.DownloadFailedException;
import org.owasp.dependencycheck.utils.Downloader;
import org.owasp.dependencycheck.utils.FileUtils;
@@ -40,14 +30,26 @@
import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.owasp.dependencycheck.xml.hints.EvidenceMatcher;
-import org.owasp.dependencycheck.xml.hints.VendorDuplicatingHintRule;
import org.owasp.dependencycheck.xml.hints.HintParseException;
import org.owasp.dependencycheck.xml.hints.HintParser;
import org.owasp.dependencycheck.xml.hints.HintRule;
+import org.owasp.dependencycheck.xml.hints.VendorDuplicatingHintRule;
+import org.owasp.dependencycheck.xml.suppression.PropertyType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.xml.sax.SAXException;
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.nio.file.Files;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+
/**
* This analyzer adds evidence to dependencies to enhance the accuracy of
* library identification.
@@ -80,7 +82,7 @@ public class HintAnalyzer extends AbstractAnalyzer {
/**
* The phase that this analyzer is intended to run in.
*/
- private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
+ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_INFORMATION_COLLECTION2;
/**
* Returns the name of the analyzer.
@@ -198,7 +200,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
for (VendorDuplicatingHintRule dhr : vendorHints) {
if (dhr.getValue().equalsIgnoreCase(e.getValue())) {
dependency.addEvidence(EvidenceType.VENDOR, new Evidence(e.getSource() + " (hint)",
- e.getName(), dhr.getDuplicate(), e.getConfidence()));
+ e.getName(), dhr.getDuplicate(), e.getConfidence(), true));
}
}
}
@@ -265,13 +267,12 @@ private void loadHintRules() throws HintParseException {
deleteTempFile = true;
file = getSettings().getTempFile("hint", "xml");
final URL url = new URL(filePath);
- final Downloader downloader = new Downloader(getSettings());
try {
- downloader.fetchFile(url, file, false);
+ Downloader.getInstance().fetchFile(url, file, false);
} catch (DownloadFailedException ex) {
try {
Thread.sleep(500);
- downloader.fetchFile(url, file, true);
+ Downloader.getInstance().fetchFile(url, file, true);
} catch (TooManyRequestsException ex1) {
throw new HintParseException("Unable to download hint file `" + file + "`; received 429 - too many requests", ex1);
} catch (ResourceNotFoundException ex1) {
@@ -291,7 +292,7 @@ private void loadHintRules() throws HintParseException {
try (InputStream fromClasspath = FileUtils.getResourceAsStream(filePath)) {
deleteTempFile = true;
file = getSettings().getTempFile("hint", "xml");
- org.apache.commons.io.FileUtils.copyInputStreamToFile(fromClasspath, file);
+ Files.copy(fromClasspath, file.toPath());
} catch (IOException ex) {
throw new HintParseException("Unable to locate hints file in classpath", ex);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
index 60e4185f905..8288148c119 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
@@ -54,7 +54,7 @@
import org.apache.commons.io.FilenameUtils;
import org.apache.commons.lang3.StringUtils;
-import org.h2.util.IOUtils;
+import org.apache.commons.io.IOUtils;
import org.jsoup.Jsoup;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
@@ -160,7 +160,8 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
"dstamp",
"eclipse-sourcereferences",
"kotlin-version",
- "require-capability");
+ "require-capability",
+ "require-bundle");
/**
* Deprecated Jar manifest attribute, that is, nonetheless, useful for
* analysis.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/LibmanAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/LibmanAnalyzer.java
new file mode 100644
index 00000000000..8013e704239
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/LibmanAnalyzer.java
@@ -0,0 +1,245 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2023 The OWASP Foundation. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import com.github.packageurl.MalformedPackageURLException;
+import com.github.packageurl.PackageURL;
+import com.github.packageurl.PackageURLBuilder;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
+import org.owasp.dependencycheck.dependency.Confidence;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
+import org.owasp.dependencycheck.utils.Checksum;
+import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.annotation.concurrent.ThreadSafe;
+import jakarta.json.Json;
+import jakarta.json.JsonArray;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Analyzer which parses a libman.json file to gather module information.
+ *
+ * @author Arjen Korevaar
+ */
+@ThreadSafe
+public class LibmanAnalyzer extends AbstractFileTypeAnalyzer {
+
+ /**
+ * A descriptor for the type of dependencies processed or added by this
+ * analyzer.
+ */
+ private static final String DEPENDENCY_ECOSYSTEM = Ecosystem.NODEJS;
+
+ /**
+ * The logger.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(LibmanAnalyzer.class);
+
+ /**
+ * The name of the analyzer.
+ */
+ private static final String ANALYZER_NAME = "Libman Analyzer";
+
+ /**
+ * The phase in which the analyzer runs.
+ */
+ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+
+ /**
+ * The file filter used to determine which files this analyzer supports.
+ */
+ private static final String FILE_NAME = "libman.json";
+
+ /**
+ * The file filter used to determine which files this analyzer supports.
+ */
+ private static final FileFilter FILTER = FileFilterBuilder.newInstance().addFilenames(FILE_NAME).build();
+
+ /**
+ * Regex used to match Library property.
+ */
+ private static final Pattern LIBRARY_REGEX = Pattern
+ .compile("(\\@(?[a-zA-Z]+)\\/)?(?.+)\\@(?.+)", Pattern.CASE_INSENSITIVE);
+
+ /**
+ * Initializes the analyzer once before any analysis is performed.
+ *
+ * @param engine a reference to the dependency-check engine
+ * @throws InitializationException if there's an error during initialization
+ */
+ @Override
+ public void prepareFileTypeAnalyzer(Engine engine) throws InitializationException {
+ // nothing to initialize
+ }
+
+ /**
+ * Returns the analyzer's name.
+ *
+ * @return the name of the analyzer
+ */
+ @Override
+ public String getName() {
+ return ANALYZER_NAME;
+ }
+
+ /**
+ * Returns the key used in the properties file to reference the analyzer's
+ * enabled property.
+ *
+ * @return the analyzer's enabled property setting key
+ */
+ @Override
+ protected String getAnalyzerEnabledSettingKey() {
+ return Settings.KEYS.ANALYZER_LIBMAN_ENABLED;
+ }
+
+ /**
+ * Returns the analysis phase under which the analyzer runs.
+ *
+ * @return the phase under which this analyzer runs
+ */
+ @Override
+ public AnalysisPhase getAnalysisPhase() {
+ return ANALYSIS_PHASE;
+ }
+
+ /**
+ * Returns the FileFilter
+ *
+ * @return the FileFilter
+ */
+ @Override
+ protected FileFilter getFileFilter() {
+ return FILTER;
+ }
+
+ /**
+ * Performs the analysis.
+ *
+ * @param dependency the dependency to analyze
+ * @param engine the engine
+ * @throws AnalysisException when there's an exception during analysis
+ */
+ @Override
+ public void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
+ LOGGER.debug("Checking file {}", dependency.getActualFilePath());
+
+ if (FILE_NAME.equals(dependency.getFileName()) && !dependency.isVirtual()) {
+ engine.removeDependency(dependency);
+ }
+
+ final File dependencyFile = dependency.getActualFile();
+
+ if (!dependencyFile.isFile() || dependencyFile.length() == 0) {
+ return;
+ }
+
+ try (JsonReader jsonReader = Json.createReader(Files.newInputStream(dependencyFile.toPath()))) {
+ final JsonObject json = jsonReader.readObject();
+
+ final String libmanVersion = json.getString("version");
+
+ if (!"1.0".equals(libmanVersion)) {
+ LOGGER.warn("The Libman analyzer currently only supports Libman version 1.0");
+ return;
+ }
+
+ final String defaultProvider = json.getString("defaultProvider");
+ final JsonArray libraries = json.getJsonArray("libraries");
+
+ libraries.forEach(e -> {
+ final JsonObject reference = (JsonObject) e;
+
+ final String provider = reference.getString("provider", defaultProvider);
+ final String library = reference.getString("library");
+
+ if ("filesystem".equals(provider)) {
+ LOGGER.warn("Unable to determine name and version for filesystem package: {}", library);
+ return;
+ }
+
+ final Matcher matcher = LIBRARY_REGEX.matcher(library);
+
+ if (!matcher.find()) {
+ LOGGER.warn("Unable to parse library, unknown format: {}", library);
+ return;
+ }
+
+ final String vendor = matcher.group("package");
+ final String name = matcher.group("name");
+ final String version = matcher.group("version");
+
+ LOGGER.debug("Found Libman package: vendor {}, name {}, version {}", vendor, name, version);
+
+ final Dependency child = new Dependency(dependency.getActualFile(), true);
+
+ child.setEcosystem(DEPENDENCY_ECOSYSTEM);
+ child.setName(name);
+ child.setVersion(version);
+
+ if (vendor != null) {
+ child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", vendor, Confidence.HIGHEST);
+ }
+ child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "name", name, Confidence.HIGH);
+ child.addEvidence(EvidenceType.PRODUCT, FILE_NAME, "name", name, Confidence.HIGHEST);
+ child.addEvidence(EvidenceType.VERSION, FILE_NAME, "version", version, Confidence.HIGHEST);
+
+ final String packagePath = String.format("%s:%s", name, version);
+
+ child.setSha1sum(Checksum.getSHA1Checksum(packagePath));
+ child.setSha256sum(Checksum.getSHA256Checksum(packagePath));
+ child.setMd5sum(Checksum.getMD5Checksum(packagePath));
+ child.setPackagePath(packagePath);
+
+ try {
+ final PackageURL purl = PackageURLBuilder.aPackageURL()
+ .withType("libman")
+ .withName(name)
+ .withVersion(version)
+ .build();
+ final PurlIdentifier id = new PurlIdentifier(purl, Confidence.HIGHEST);
+ child.addSoftwareIdentifier(id);
+ } catch (MalformedPackageURLException ex) {
+ LOGGER.warn("Unable to build package url for {}", ex.toString());
+ }
+
+ engine.addDependency(child);
+ });
+ } catch (JsonException e) {
+ LOGGER.warn(String.format("Failed to parse %s file", FILE_NAME), e);
+ } catch (IOException e) {
+ throw new AnalysisException("Problem occurred while reading dependency file", e);
+ }
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/MSBuildProjectAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/MSBuildProjectAnalyzer.java
index c7a69aef755..f68718e4947 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/MSBuildProjectAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/MSBuildProjectAnalyzer.java
@@ -150,7 +150,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
final List packages;
try (FileInputStream fis = new FileInputStream(dependency.getActualFilePath());
- BOMInputStream bis = new BOMInputStream(fis)) {
+ BOMInputStream bis = BOMInputStream.builder().setInputStream(fis).get()) {
//skip BOM if it exists
bis.getBOM();
packages = parser.parse(bis, props, centrallyManaged);
@@ -185,6 +185,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
child.setMd5sum(Checksum.getMD5Checksum(String.format("%s:%s", id, version)));
child.addEvidence(EvidenceType.PRODUCT, "msbuild", "id", id, Confidence.HIGHEST);
+ child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", id, Confidence.MEDIUM);
child.addEvidence(EvidenceType.VERSION, "msbuild", "version", version, Confidence.HIGHEST);
if (id.indexOf('.') > 0) {
@@ -193,10 +194,12 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
// example: Microsoft.EntityFrameworkCore
child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", parts[0], Confidence.MEDIUM);
child.addEvidence(EvidenceType.PRODUCT, "msbuild", "id", parts[1], Confidence.MEDIUM);
+ child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", parts[1], Confidence.LOW);
if (parts.length > 2) {
final String rest = id.substring(id.indexOf('.') + 1);
child.addEvidence(EvidenceType.PRODUCT, "msbuild", "id", rest, Confidence.MEDIUM);
+ child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", rest, Confidence.LOW);
}
} else {
// example: jQuery
@@ -315,7 +318,7 @@ private Map readDirectoryBuildProps(File directoryProps) throws
if (directoryProps != null && directoryProps.isFile()) {
final DirectoryBuildPropsParser parser = new DirectoryBuildPropsParser();
try (FileInputStream fis = new FileInputStream(directoryProps);
- BOMInputStream bis = new BOMInputStream(fis)) {
+ BOMInputStream bis = BOMInputStream.builder().setInputStream(fis).get()) {
//skip BOM if it exists
bis.getBOM();
entries = parser.parse(bis);
@@ -344,7 +347,7 @@ private Map loadCentrallyManaged(File folder, Properties props)
if (packages != null && packages.isFile()) {
final DirectoryPackagesPropsParser parser = new DirectoryPackagesPropsParser();
try (FileInputStream fis = new FileInputStream(packages);
- BOMInputStream bis = new BOMInputStream(fis)) {
+ BOMInputStream bis = BOMInputStream.builder().setInputStream(fis).get()) {
//skip BOM if it exists
bis.getBOM();
return parser.parse(bis, props);
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
index b5828678402..2b1014a113d 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
@@ -17,14 +17,17 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
+
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.data.nexus.NexusSearch;
+import org.owasp.dependencycheck.data.nexus.NexusV2Search;
+import org.owasp.dependencycheck.data.nexus.NexusV3Search;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.xml.pom.PomUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -35,6 +38,7 @@
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
+import java.util.Locale;
import javax.annotation.concurrent.ThreadSafe;
import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.exception.InitializationException;
@@ -169,17 +173,38 @@ public void prepareFileTypeAnalyzer(Engine engine) throws InitializationExceptio
if (isEnabled()) {
final boolean useProxy = useProxy();
LOGGER.debug("Using proxy: {}", useProxy);
- try {
- searcher = new NexusSearch(getSettings(), useProxy);
- if (!searcher.preflightRequest()) {
- setEnabled(false);
- throw new InitializationException("There was an issue getting Nexus status. Disabling analyzer.");
- }
- } catch (MalformedURLException mue) {
+ searcher = createNexusSearchOrDisable(useProxy);
+ }
+ }
+
+ /**
+ * Creates a NexusSearch for the appropriate Nexus version (Nexus V2 and V3 supported).
+ *
+ * If errors are encountered creating or validating the NexusSearch it disables this analyzer.
+ *
+ * @param useProxy Whether a proxy is to be used
+ * @return A NexusSearch appropriate for the configured ANALYZER_NEXUS_URL
+ * @throws InitializationException Upon errors creating of validating the ANALYZER_NEXUS_URL
+ */
+ private NexusSearch createNexusSearchOrDisable(boolean useProxy) throws InitializationException {
+ final Settings settings = getSettings();
+ final String nexusRootURL = settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+ final NexusSearch result;
+ try {
+ if (nexusRootURL.toLowerCase(Locale.ROOT).contains("service/local/")) {
+ result = new NexusV2Search(settings, useProxy);
+ } else {
+ result = new NexusV3Search(settings, useProxy);
+ }
+ if (!result.preflightRequest()) {
setEnabled(false);
- throw new InitializationException("Malformed URL to Nexus", mue);
+ throw new InitializationException("There was an error getting Nexus status. Disabling NexusAnalyzer.");
}
+ } catch (MalformedURLException mue) {
+ setEnabled(false);
+ throw new InitializationException("Malformed URL to Nexus. Disabling NexusAnalyzer", mue);
}
+ return result;
}
/**
@@ -257,8 +282,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
LOGGER.debug("Unable to delete temp file");
}
LOGGER.debug("Downloading {}", ma.getPomUrl());
- final Downloader downloader = new Downloader(getSettings());
- downloader.fetchFile(new URL(ma.getPomUrl()), pomFile);
+ Downloader.getInstance().fetchFile(new URL(ma.getPomUrl()), pomFile);
PomUtils.analyzePOM(dependency, pomFile);
} catch (DownloadFailedException ex) {
LOGGER.warn("Unable to download pom.xml for {} from Nexus repository; "
@@ -271,7 +295,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
LOGGER.warn("pom.xml not found for {} from nexus; "
+ "this could result in undetected CPE/CVEs.", dependency.getFileName());
} finally {
- if (pomFile != null && pomFile.exists() && !FileUtils.deleteQuietly(pomFile)) {
+ if (pomFile != null && pomFile.exists() && !FileUtils.delete(pomFile)) {
LOGGER.debug("Failed to delete temporary pom file {}", pomFile);
pomFile.deleteOnExit();
}
@@ -297,8 +321,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
*/
public boolean useProxy() {
try {
- return getSettings().getString(Settings.KEYS.PROXY_SERVER) != null
- && getSettings().getBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY);
+ return getSettings().getBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY);
} catch (InvalidSettingException ise) {
LOGGER.warn("Failed to parse proxy settings.", ise);
return false;
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java
index b186f0eadf1..c6de926ed56 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java
@@ -17,34 +17,34 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
+import org.apache.commons.collections4.MultiValuedMap;
+import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.analyzer.exception.SearchException;
+import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
import org.owasp.dependencycheck.data.nodeaudit.Advisory;
import org.owasp.dependencycheck.data.nodeaudit.NpmPayloadBuilder;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.URLConnectionFailureException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import us.springett.parsers.cpe.exceptions.CpeValidationException;
+
+import javax.annotation.concurrent.ThreadSafe;
+import jakarta.json.Json;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
+import java.nio.file.Files;
import java.util.List;
-import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-import org.apache.commons.collections4.MultiValuedMap;
-import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
-import org.owasp.dependencycheck.analyzer.exception.SearchException;
-import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
-import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
-import org.owasp.dependencycheck.utils.URLConnectionFailureException;
-import us.springett.parsers.cpe.exceptions.CpeValidationException;
-
/**
* Used to analyze Node Package Manager (npm) package-lock.json and
* npm-shrinkwrap.json files via NPM Audit API.
@@ -171,11 +171,11 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
* submitting the npm audit API payload
*/
private List analyzePackage(final File lockFile, final File packageFile,
- Dependency dependency, MultiValuedMap dependencyMap)
+ Dependency dependency, MultiValuedMap dependencyMap)
throws AnalysisException {
try {
- final JsonReader packageReader = Json.createReader(FileUtils.openInputStream(packageFile));
- final JsonReader lockReader = Json.createReader(FileUtils.openInputStream(lockFile));
+ final JsonReader packageReader = Json.createReader(Files.newInputStream(packageFile.toPath()));
+ final JsonReader lockReader = Json.createReader(Files.newInputStream(lockFile.toPath()));
// Retrieves the contents of package-lock.json from the Dependency
final JsonObject lockJson = lockReader.readObject();
// Retrieves the contents of package-lock.json from the Dependency
@@ -231,7 +231,7 @@ private List analyzePackage(final File lockFile, final File packageFil
private List legacyAnalysis(final File file, Dependency dependency, MultiValuedMap dependencyMap)
throws AnalysisException {
- try (JsonReader jsonReader = Json.createReader(FileUtils.openInputStream(file))) {
+ try (JsonReader jsonReader = Json.createReader(Files.newInputStream(file.toPath()))) {
// Retrieves the contents of package-lock.json from the Dependency
final JsonObject packageJson = jsonReader.readObject();
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
index 68e2eca3016..650bcf9ce8c 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
@@ -20,39 +20,39 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.Engine.Mode;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
+import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
+import org.owasp.dependencycheck.utils.Checksum;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.InvalidSettingException;
import org.owasp.dependencycheck.utils.Settings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import jakarta.json.Json;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import jakarta.json.JsonString;
+import jakarta.json.JsonValue;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
+import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Objects;
-import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonString;
-import javax.json.JsonReader;
-import javax.json.JsonValue;
-import org.owasp.dependencycheck.Engine.Mode;
-import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
-import org.owasp.dependencycheck.dependency.Confidence;
-import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
-import org.owasp.dependencycheck.exception.InitializationException;
-import org.owasp.dependencycheck.utils.Checksum;
-import org.owasp.dependencycheck.utils.InvalidSettingException;
/**
* Used to analyze Node Package Manager (npm) package.json files, and collect
@@ -93,7 +93,7 @@ public class NodePackageAnalyzer extends AbstractNpmAnalyzer {
*/
public static final String SHRINKWRAP_JSON = "npm-shrinkwrap.json";
/**
- * The name of the directory that contains node modules
+ * The name of the directory that contains node modules.
*/
public static final String NODE_MODULES_DIRNAME = "node_modules";
/**
@@ -196,7 +196,8 @@ private boolean isNodeAuditEnabled(Engine engine) {
try {
((AbstractNpmAnalyzer) a).prepareFileTypeAnalyzer(engine);
} catch (InitializationException ex) {
- LOGGER.debug("Error initializing the {}", a.getName());
+ String message = "Error initializing the " + a.getName();
+ LOGGER.debug(message, ex);
}
}
return a.isEnabled();
@@ -252,7 +253,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
return;
}
- try (JsonReader jsonReader = Json.createReader(FileUtils.openInputStream(dependencyFile))) {
+ try (JsonReader jsonReader = Json.createReader(Files.newInputStream(dependencyFile.toPath()))) {
final JsonObject json = jsonReader.readObject();
final String parentName = json.getString("name", "");
final String parentVersion = json.getString("version", "");
@@ -303,7 +304,7 @@ public static boolean shouldSkipDependency(String name, String version, boolean
// using a local node_module is not supported by npm audit, it crash
if (Objects.nonNull(version) && (version.startsWith("file:") || version.matches("^[.~]{0,2}/.*"))) {
LOGGER.warn("dependency skipped: package.json contain an local node_module for {} seems to be "
- + "located {} npm audit doesn't support locally referenced modules",
+ + "located {} npm audit doesn't support locally referenced modules",
name, version);
return true;
}
@@ -320,12 +321,12 @@ public static boolean shouldSkipDependency(String name, String version, boolean
/**
* Checks if the given dependency should be skipped.
*
- * @see NodePackageAnalyzer#shouldSkipDependency(java.lang.String,
- * java.lang.String, boolean, boolean)
* @param name the name of the dependency to test
* @param version the version of the dependency to test
* @return true if the dependency should be skipped; otherwise
* false
+ * @see NodePackageAnalyzer#shouldSkipDependency(java.lang.String,
+ * java.lang.String, boolean, boolean)
*/
public static boolean shouldSkipDependency(String name, String version) {
return shouldSkipDependency(name, version, false, true);
@@ -344,20 +345,20 @@ public static boolean shouldSkipDependency(String name, String version) {
* @throws AnalysisException thrown if there is an exception
*/
private void processDependencies(JsonObject json, File baseDir, File rootFile,
- String parentPackage, Engine engine) throws AnalysisException {
- final boolean skipDev = getSettings().getBoolean(Settings.KEYS.ANALYZER_NODE_PACKAGE_SKIPDEV, false);
- final JsonObject deps;
- final File modulesRoot = new File(rootFile.getParentFile(), "node_modules");
- final int lockJsonVersion = json.containsKey("lockfileVersion") ? json.getInt("lockfileVersion") : 1;
- if (lockJsonVersion >= 2) {
+ String parentPackage, Engine engine) throws AnalysisException {
+ final boolean skipDev = getSettings().getBoolean(Settings.KEYS.ANALYZER_NODE_PACKAGE_SKIPDEV, false);
+ final JsonObject deps;
+ final File modulesRoot = new File(rootFile.getParentFile(), "node_modules");
+ final int lockJsonVersion = json.containsKey("lockfileVersion") ? json.getInt("lockfileVersion") : 1;
+ if (lockJsonVersion >= 2) {
deps = json.getJsonObject("packages");
- } else if (json.containsKey("dependencies")) {
+ } else if (json.containsKey("dependencies")) {
deps = json.getJsonObject("dependencies");
- } else {
+ } else {
deps = null;
- }
+ }
- if (deps != null) {
+ if (deps != null) {
for (Map.Entry entry : deps.entrySet()) {
final String pathName = entry.getKey();
String name = pathName;
@@ -428,7 +429,7 @@ private void processDependencies(JsonObject json, File baseDir, File rootFile,
} catch (IOException | NoSuchAlgorithmException ex) {
LOGGER.debug("Error setting hashes:" + ex.getMessage(), ex);
}
- try (JsonReader jr = Json.createReader(FileUtils.openInputStream(f))) {
+ try (JsonReader jr = Json.createReader(Files.newInputStream(f.toPath()))) {
final JsonObject childJson = jr.readObject();
gatherEvidence(childJson, child);
} catch (JsonException e) {
@@ -458,18 +459,19 @@ private void processDependencies(JsonObject json, File baseDir, File rootFile,
LOGGER.debug("Unable to build package url for `" + packagePath + "`", ex);
}
}
-
- final Dependency existing = findDependency(engine, name, version);
- if (existing != null) {
- if (existing.isVirtual()) {
- DependencyMergingAnalyzer.mergeDependencies(child, existing, null);
- engine.removeDependency(existing);
- engine.addDependency(child);
+ synchronized (this) {
+ final Dependency existing = findDependency(engine, name, version);
+ if (existing != null) {
+ if (existing.isVirtual()) {
+ DependencyMergingAnalyzer.mergeDependencies(child, existing, null);
+ engine.removeDependency(existing);
+ engine.addDependency(child);
+ } else {
+ DependencyBundlingAnalyzer.mergeDependencies(existing, child, null);
+ }
} else {
- DependencyBundlingAnalyzer.mergeDependencies(existing, child, null);
+ engine.addDependency(child);
}
- } else {
- engine.addDependency(child);
}
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NpmCPEAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NpmCPEAnalyzer.java
index 0acce56f45c..530a5d669ad 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NpmCPEAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NpmCPEAnalyzer.java
@@ -49,7 +49,7 @@ public class NpmCPEAnalyzer extends CPEAnalyzer {
/**
* The Logger.
*/
- private static final Logger LOGGER = LoggerFactory.getLogger(CPEAnalyzer.class);
+ private static final Logger LOGGER = LoggerFactory.getLogger(NpmCPEAnalyzer.class);
/**
* Returns the analysis phase that this analyzer should run in.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NugetconfAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NugetconfAnalyzer.java
index 3e98913ef2e..11417208d6e 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NugetconfAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NugetconfAnalyzer.java
@@ -182,6 +182,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
child.setMd5sum(Checksum.getMD5Checksum(String.format("%s:%s", id, version)));
child.addEvidence(EvidenceType.VERSION, "packages.config", "version", np.getVersion(), Confidence.HIGHEST);
child.addEvidence(EvidenceType.PRODUCT, "packages.config", "id", np.getId(), Confidence.HIGHEST);
+ child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", np.getId(), Confidence.MEDIUM);
// handle package names the same way as the MSBuild analyzer
if (id.indexOf('.') > 0) {
@@ -190,10 +191,12 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
// example: Microsoft.EntityFrameworkCore
child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", parts[0], Confidence.MEDIUM);
child.addEvidence(EvidenceType.PRODUCT, "packages.config", "id", parts[1], Confidence.MEDIUM);
+ child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", parts[1], Confidence.LOW);
if (parts.length > 2) {
final String rest = id.substring(id.indexOf('.') + 1);
child.addEvidence(EvidenceType.PRODUCT, "packages.config", "id", rest, Confidence.MEDIUM);
+ child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", rest, Confidence.LOW);
}
} else {
// example: jQuery
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
index 5f3124dc0c4..44aeb555023 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
@@ -158,6 +158,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "authors", np.getAuthors(), Confidence.HIGH);
dependency.addEvidence(EvidenceType.VERSION, "nuspec", "version", np.getVersion(), Confidence.HIGHEST);
dependency.addEvidence(EvidenceType.PRODUCT, "nuspec", "id", np.getId(), Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "id", np.getId(), Confidence.HIGH);
dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "description", np.getDescription(), Confidence.LOW);
dependency.addEvidence(EvidenceType.PRODUCT, "nuspec", "description", np.getDescription(), Confidence.LOW);
dependency.setName(np.getId());
@@ -178,6 +179,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
}
if (np.getTitle() != null) {
dependency.addEvidence(EvidenceType.PRODUCT, "nuspec", "title", np.getTitle(), Confidence.MEDIUM);
+ dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "title", np.getTitle(), Confidence.LOW);
}
} catch (Throwable e) {
throw new AnalysisException(e);
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java
index 1ba5986dd07..bcb5ff6d816 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java
@@ -18,7 +18,9 @@
package org.owasp.dependencycheck.analyzer;
import java.util.ArrayList;
+import java.util.HashSet;
import java.util.List;
+import java.util.Set;
import javax.annotation.concurrent.ThreadSafe;
import org.owasp.dependencycheck.Engine;
@@ -150,17 +152,17 @@ private synchronized List filterEcosystem(String ecosystem, List<
final List remove = new ArrayList<>();
vulnerabilities.forEach((v) -> {
boolean found = false;
- final List removeSoftare = new ArrayList<>();
+ final Set removeSoftware = new HashSet<>();
for (VulnerableSoftware s : v.getVulnerableSoftware()) {
if (ecosystemMatchesTargetSoftware(ecosystem, s.getTargetSw())) {
found = true;
} else {
- removeSoftare.add(s);
+ removeSoftware.add(s);
}
}
if (found) {
- if (!removeSoftare.isEmpty()) {
- removeSoftare.forEach(v.getVulnerableSoftware()::remove);
+ if (!removeSoftware.isEmpty()) {
+ v.removeVulnerableSoftware(removeSoftware);
}
} else {
remove.add(v);
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/OpenSSLAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/OpenSSLAnalyzer.java
index b1ed360abe6..33f7ce947e0 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/OpenSSLAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/OpenSSLAnalyzer.java
@@ -20,27 +20,27 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
+import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
-import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
-import org.owasp.dependencycheck.exception.InitializationException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Used to analyze OpenSSL source code present in the file system.
@@ -72,7 +72,7 @@ public class OpenSSLAnalyzer extends AbstractFileTypeAnalyzer {
*/
private static final Pattern VERSION_PATTERN = Pattern.compile(
"define\\s+OPENSSL_VERSION_NUMBER\\s+0x([0-9a-zA-Z]{8})L", Pattern.DOTALL
- | Pattern.CASE_INSENSITIVE);
+ | Pattern.CASE_INSENSITIVE);
/**
* The offset of the major version number.
*/
@@ -231,7 +231,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine)
private String getFileContents(final File actualFile)
throws AnalysisException {
try {
- return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
+ return new String(Files.readAllBytes(actualFile.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException(
"Problem occurred while reading dependency file.", e);
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java
index 344d6996c61..cae89d79467 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java
@@ -17,27 +17,29 @@
*/
package org.owasp.dependencycheck.analyzer;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV4;
import org.sonatype.ossindex.service.api.componentreport.ComponentReport;
import org.sonatype.ossindex.service.api.componentreport.ComponentReportVulnerability;
import org.sonatype.ossindex.service.api.cvss.Cvss2Severity;
import org.sonatype.ossindex.service.api.cvss.Cvss2Vector;
-import org.sonatype.ossindex.service.api.cvss.Cvss3Severity;
-import org.sonatype.ossindex.service.api.cvss.Cvss3Vector;
import org.sonatype.ossindex.service.api.cvss.CvssVector;
import org.sonatype.ossindex.service.api.cvss.CvssVectorFactory;
import org.sonatype.ossindex.service.client.OssindexClient;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.ossindex.OssindexClientFactory;
-import org.owasp.dependencycheck.dependency.CvssV2;
-import org.owasp.dependencycheck.dependency.CvssV3;
+
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
import org.owasp.dependencycheck.dependency.VulnerableSoftwareBuilder;
import org.owasp.dependencycheck.dependency.naming.Identifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.Settings.KEYS;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import us.springett.parsers.cpe.exceptions.CpeValidationException;
@@ -54,8 +56,11 @@
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+import java.net.SocketTimeoutException;
+
import javax.annotation.Nullable;
import org.apache.commons.lang3.StringUtils;
+import org.owasp.dependencycheck.utils.CvssUtil;
import org.sonatype.goodies.packageurl.InvalidException;
import org.sonatype.ossindex.service.client.transport.Transport.TransportException;
@@ -124,6 +129,17 @@ protected void closeAnalyzer() throws Exception {
}
}
+ @Override
+ protected void prepareAnalyzer(Engine engine) throws InitializationException {
+ synchronized (FETCH_MUTIX) {
+ if (StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_USER, StringUtils.EMPTY)) ||
+ StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_PASSWORD, StringUtils.EMPTY))) {
+ LOG.warn("Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required");
+ setEnabled(false);
+ }
+ }
+ }
+
@Override
protected void analyzeDependency(final Dependency dependency, final Engine engine) throws AnalysisException {
// batch request component-reports for all dependencies
@@ -132,31 +148,45 @@ protected void analyzeDependency(final Dependency dependency, final Engine engin
try {
requestDelay();
reports = requestReports(engine.getDependencies());
- } catch (TransportException ex) {
+ } catch (SocketTimeoutException e) {
+ final boolean warnOnly = getSettings().getBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, false);
+ this.setEnabled(false);
+ if (warnOnly) {
+ LOG.warn("OSS Index socket timeout, disabling the analyzer", e);
+ } else {
+ LOG.debug("OSS Index socket timeout", e);
+ throw new AnalysisException("Failed to establish socket to OSS Index", e);
+ }
+ } catch (Exception ex) {
final String message = ex.getMessage();
final boolean warnOnly = getSettings().getBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, false);
this.setEnabled(false);
- if (StringUtils.endsWith(message, "401")) {
- LOG.error("Invalid credentials for the OSS Index, disabling the analyzer");
- throw new AnalysisException("Invalid credentials provided for OSS Index", ex);
- } else if (StringUtils.endsWith(message, "403")) {
- LOG.error("OSS Index access forbidden, disabling the analyzer");
- throw new AnalysisException("OSS Index access forbidden", ex);
- } else if (StringUtils.endsWith(message, "429")) {
+ if (StringUtils.contains(message, "401")) {
+ if (warnOnly) {
+ LOG.warn("Invalid credentials for the OSS Index, disabling the analyzer");
+ } else {
+ LOG.error("Invalid credentials for the OSS Index, disabling the analyzer");
+ throw new AnalysisException("Invalid credentials provided for OSS Index", ex);
+ }
+ } else if (StringUtils.contains(message, "403")) {
+ if (warnOnly) {
+ LOG.warn("OSS Index access forbidden, disabling the analyzer");
+ } else {
+ LOG.error("OSS Index access forbidden, disabling the analyzer");
+ throw new AnalysisException("OSS Index access forbidden", ex);
+ }
+ } else if (StringUtils.contains(message, "429")) {
if (warnOnly) {
LOG.warn("OSS Index rate limit exceeded, disabling the analyzer", ex);
} else {
throw new AnalysisException("OSS Index rate limit exceeded, disabling the analyzer", ex);
}
} else if (warnOnly) {
- LOG.warn("Error requesting component reports, disabling the analyzer", ex);
+ LOG.warn("Error requesting component reports, disabling the analyzer. " + ex.getMessage(), ex);
} else {
LOG.debug("Error requesting component reports, disabling the analyzer", ex);
- throw new AnalysisException("Failed to request component-reports", ex);
+ throw new AnalysisException("Failed to request component-reports. " + ex.getMessage(), ex);
}
- } catch (Exception e) {
- LOG.debug("Error requesting component reports", e);
- throw new AnalysisException("Failed to request component-reports", e);
}
}
@@ -260,7 +290,7 @@ void enrich(final Dependency dependency) {
.orElse(null);
if (existing != null) {
//TODO - can we enhance anything other than the references?
- existing.getReferences().addAll(v.getReferences());
+ existing.addReferences(v.getReferences());
} else {
dependency.addVulnerability(v);
}
@@ -307,34 +337,63 @@ private Vulnerability transform(final ComponentReport report, final ComponentRep
result.setDescription(source.getDescription());
result.addCwe(source.getCwe());
- final float cvssScore = source.getCvssScore() != null ? source.getCvssScore() : -1;
+ final double cvssScore = source.getCvssScore() != null ? source.getCvssScore().doubleValue() : -1;
if (source.getCvssVector() != null) {
- if (source.getCvssVector().startsWith("CVSS:3")) {
- result.setCvssV3(new CvssV3(source.getCvssVector(), cvssScore));
+ if (source.getCvssVector().startsWith("CVSS:4")) {
+ result.setCvssV4(CvssUtil.vectorToCvssV4("ossindex", CvssV4.Type.PRIMARY, cvssScore, source.getCvssVector()));
+ } else if (source.getCvssVector().startsWith("CVSS:3")) {
+ result.setCvssV3(CvssUtil.vectorToCvssV3(source.getCvssVector(), cvssScore));
} else {
// convert cvss details
final CvssVector cvssVector = CvssVectorFactory.create(source.getCvssVector());
final Map metrics = cvssVector.getMetrics();
if (cvssVector instanceof Cvss2Vector) {
- result.setCvssV2(new CvssV2(
- cvssScore,
- metrics.get(Cvss2Vector.ACCESS_VECTOR),
- metrics.get(Cvss2Vector.ACCESS_COMPLEXITY),
- metrics.get(Cvss2Vector.AUTHENTICATION),
- metrics.get(Cvss2Vector.CONFIDENTIALITY_IMPACT),
- metrics.get(Cvss2Vector.INTEGRITY_IMPACT),
- metrics.get(Cvss2Vector.AVAILABILITY_IMPACT),
- Cvss2Severity.of(cvssScore).name()
- ));
+ String tmp = metrics.get(Cvss2Vector.ACCESS_VECTOR);
+ CvssV2Data.AccessVectorType accessVector = null;
+ if (tmp != null) {
+ accessVector = CvssV2Data.AccessVectorType.fromValue(tmp);
+ }
+ tmp = metrics.get(Cvss2Vector.ACCESS_COMPLEXITY);
+ CvssV2Data.AccessComplexityType accessComplexity = null;
+ if (tmp != null) {
+ accessComplexity = CvssV2Data.AccessComplexityType.fromValue(tmp);
+ }
+ tmp = metrics.get(Cvss2Vector.AUTHENTICATION);
+ CvssV2Data.AuthenticationType authentication = null;
+ if (tmp != null) {
+ authentication = CvssV2Data.AuthenticationType.fromValue(tmp);
+ }
+ tmp = metrics.get(Cvss2Vector.CONFIDENTIALITY_IMPACT);
+ CvssV2Data.CiaType confidentialityImpact = null;
+ if (tmp != null) {
+ confidentialityImpact = CvssV2Data.CiaType.fromValue(tmp);
+ }
+ tmp = metrics.get(Cvss2Vector.INTEGRITY_IMPACT);
+ CvssV2Data.CiaType integrityImpact = null;
+ if (tmp != null) {
+ integrityImpact = CvssV2Data.CiaType.fromValue(tmp);
+ }
+ tmp = metrics.get(Cvss2Vector.AVAILABILITY_IMPACT);
+ CvssV2Data.CiaType availabilityImpact = null;
+ if (tmp != null) {
+ availabilityImpact = CvssV2Data.CiaType.fromValue(tmp);
+ }
+ final String severity = Cvss2Severity.of((float) cvssScore).name().toUpperCase();
+ final CvssV2Data cvssData = new CvssV2Data(CvssV2Data.Version._2_0, source.getCvssVector(), accessVector,
+ accessComplexity, authentication, confidentialityImpact,
+ integrityImpact, availabilityImpact, cvssScore,
+ severity, null, null, null, null, null, null, null, null, null, null);
+ final CvssV2 cvssV2 = new CvssV2(null, null, cvssData, severity, null, null, null, null, null, null, null);
+ result.setCvssV2(cvssV2);
} else {
LOG.warn("Unsupported CVSS vector: {}", cvssVector);
- result.setUnscoredSeverity(Float.toString(cvssScore));
+ result.setUnscoredSeverity(Double.toString(cvssScore));
}
}
} else {
LOG.debug("OSS has no vector for {}", result.getName());
- result.setUnscoredSeverity(Float.toString(cvssScore));
+ result.setUnscoredSeverity(Double.toString(cvssScore));
}
// generate a reference to the vulnerability details on OSS Index
result.addReference(REFERENCE_TYPE, source.getTitle(), source.getReference().toString());
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PEAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PEAnalyzer.java
index d097daa7469..3d8f23c76b3 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PEAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PEAnalyzer.java
@@ -185,6 +185,7 @@ protected void analyzeDependency(final Dependency dependency, final Engine engin
break;
case "InternalName":
dependency.addEvidence(EvidenceType.PRODUCT, "PE Header", "InternalName", value, Confidence.MEDIUM);
+ dependency.addEvidence(EvidenceType.VENDOR, "PE Header", "InternalName", value, Confidence.LOW);
determineDependencyName(dependency, value);
break;
case "LegalCopyright":
@@ -201,6 +202,7 @@ protected void analyzeDependency(final Dependency dependency, final Engine engin
break;
case "ProductName":
dependency.addEvidence(EvidenceType.PRODUCT, "PE Header", "ProductName", value, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, "PE Header", "ProductName", value, Confidence.MEDIUM);
determineDependencyName(dependency, value);
break;
default:
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PerlCpanfileAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PerlCpanfileAnalyzer.java
index c2725fc9b64..954e300fa89 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PerlCpanfileAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PerlCpanfileAnalyzer.java
@@ -20,36 +20,35 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
+import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
+import org.owasp.dependencycheck.dependency.naming.Identifier;
+import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
+import org.owasp.dependencycheck.utils.Checksum;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
-import javax.annotation.concurrent.ThreadSafe;
-import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
-import org.owasp.dependencycheck.dependency.Confidence;
-import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
-import org.owasp.dependencycheck.exception.InitializationException;
-import org.owasp.dependencycheck.utils.Checksum;
-
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import java.nio.charset.Charset;
-
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
import static java.util.stream.Collectors.toCollection;
-import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
-import org.owasp.dependencycheck.dependency.naming.Identifier;
/**
*
@@ -127,7 +126,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
private String tryReadFile(File file) throws AnalysisException {
try {
- return FileUtils.readFileToString(file, Charset.defaultCharset()).trim();
+ return new String(Files.readAllBytes(file.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException("Problem occurred while reading dependency file.", e);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PinnedMavenInstallAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PinnedMavenInstallAnalyzer.java
index 34285b80a08..0be4239329f 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PinnedMavenInstallAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PinnedMavenInstallAnalyzer.java
@@ -19,11 +19,14 @@
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.ObjectReader;
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
+import java.util.Map;
+import java.util.stream.Collectors;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
@@ -118,26 +121,47 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
}
final DependencyTree tree;
+ List deps;
try {
- final InstallFile installFile = INSTALL_FILE_READER.readValue(dependencyFile);
- tree = installFile.getDependencyTree();
- } catch (IOException e) {
- return;
- }
+ final JsonNode jsonNode = MAPPER.readTree(dependencyFile);
+ final JsonNode v2Version = jsonNode.path("version");
+ final JsonNode v010Version = jsonNode.path("dependency_tree").path("version");
+
+ if (v2Version.isTextual()) {
+ final InstallFileV2 installFile = INSTALL_FILE_V2_READER.readValue(dependencyFile);
+ if (!Objects.equals(installFile.getAutogeneratedSentinel(), "THERE_IS_NO_DATA_ONLY_ZUUL")) {
+ return;
+ }
+ if (!Objects.equals(installFile.getVersion(), "2")) {
+ LOGGER.warn("Unsupported pinned maven_install.json version {}. Continuing optimistically.", installFile.getVersion());
+ }
+ deps = installFile.getArtifacts().entrySet().stream().map(entry -> new MavenDependency(
+ entry.getKey() + ":" + entry.getValue().getVersion()
+ )).collect(Collectors.toList());
+ } else if (v010Version.isTextual()) {
+ final InstallFile installFile = INSTALL_FILE_READER.readValue(dependencyFile);
+ tree = installFile.getDependencyTree();
+ if (tree == null) {
+ return;
+ } else if (!Objects.equals(tree.getAutogeneratedSentinel(), "THERE_IS_NO_DATA_ONLY_ZUUL")) {
+ return;
+ }
+ if (!Objects.equals(tree.getVersion(), "0.1.0")) {
+ LOGGER.warn("Unsupported pinned maven_install.json version {}. Continuing optimistically.", tree.getVersion());
+ }
+ deps = tree.getDependencies();
+ } else {
+ LOGGER.warn("No pinned maven_install.json version found. Cannot Parse");
+ return;
+ }
- if (tree == null) {
- return;
- } else if (!Objects.equals(tree.getAutogeneratedSentinel(), "THERE_IS_NO_DATA_ONLY_ZUUL")) {
+ } catch (IOException e) {
+ System.out.println("e");
return;
}
engine.removeDependency(dependency);
- if (!Objects.equals(tree.getVersion(), "0.1.0")) {
- LOGGER.warn("Unsupported pinned maven_install.json version {}. Continuing optimistically.", tree.getVersion());
- }
-
- List deps = tree.getDependencies();
if (deps == null) {
deps = Collections.emptyList();
}
@@ -183,6 +207,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
d.setEcosystem(Ecosystem.JAVA);
d.addEvidence(EvidenceType.VENDOR, "project", "groupid", group, Confidence.HIGHEST);
d.addEvidence(EvidenceType.PRODUCT, "project", "artifactid", artifact, Confidence.HIGHEST);
+ d.addEvidence(EvidenceType.VENDOR, "project", "artifactid", artifact, Confidence.HIGH);
d.addEvidence(EvidenceType.VERSION, "project", "version", version, Confidence.HIGHEST);
d.setName(String.format("%s:%s", group, artifact));
d.setFilePath(String.format("%s>>%s", dependency.getActualFile(), dep.getCoord()));
@@ -301,6 +326,12 @@ public String getVersion() {
*/
private static class MavenDependency {
+ MavenDependency(String coord) {
+ this.coord = coord;
+ }
+
+ MavenDependency() {
+ }
/**
* The standard Maven coordinate string
* {@code group:artifact[:optional classifier][:optional packaging]:version}.
@@ -322,10 +353,106 @@ public String getCoord() {
* A reusable reader for {@link InstallFile}.
*/
private static final ObjectReader INSTALL_FILE_READER;
+ /**
+ * A reusable reader for {@link InstallFileV2}.
+ */
+ private static final ObjectReader INSTALL_FILE_V2_READER;
+ /**
+ * A reusable object mapper.
+ */
+ private static final ObjectMapper MAPPER;
static {
- final ObjectMapper mapper = new ObjectMapper();
- mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
- INSTALL_FILE_READER = mapper.readerFor(InstallFile.class);
+ MAPPER = new ObjectMapper();
+ MAPPER.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+ INSTALL_FILE_READER = MAPPER.readerFor(InstallFile.class);
+ INSTALL_FILE_V2_READER = MAPPER.readerFor(InstallFileV2.class);
}
+
+ /**
+ * Represents the entire pinned Maven dependency set in an install.json
+ * file.
+ *
+ *
+ * At the time of writing, the latest version is 2, and the dependencies are
+ * stored in {@code .artifacts}.
+ *
+ *
+ * The top-level keys we care about are {@code .artifacts}.
+ * {@code .version}.
+ */
+ private static class InstallFileV2 {
+
+ /**
+ * The file format version.
+ */
+ @JsonProperty("version")
+ private String version;
+
+ /**
+ * A list of Maven dependencies made available. Note that this map is
+ * transitively closed and pinned to a specific version of each
+ * artifact.
+ *
+ * The key is the Maven coordinate string, less the version
+ * {@code group:artifact[:optional classifier][:optional packaging]}.
+ *
+ * The value contains the version of the artifact.
+ */
+ @JsonProperty("artifacts")
+ private Map artifacts;
+
+ /**
+ * A sentinel value placed in the file to indicate that it is an
+ * auto-generated pinned maven install file.
+ */
+ @JsonProperty("__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY")
+ private String autogeneratedSentinel;
+
+ /**
+ * Returns artifacts.
+ *
+ * @return artifacts
+ */
+ public Map getArtifacts() {
+ return artifacts;
+ }
+
+ /**
+ * Returns version.
+ *
+ * @return version
+ */
+ public String getVersion() {
+ return version;
+ }
+
+ /**
+ * Returns autogeneratedSentinel.
+ *
+ * @return autogeneratedSentinel
+ */
+ public String getAutogeneratedSentinel() {
+ return autogeneratedSentinel;
+ }
+ }
+
+ private static class Artifactv2 {
+
+ /**
+ * The version of the artifact.
+ */
+ @JsonProperty("version")
+ private String version;
+
+ /**
+ * Returns the value of version.
+ *
+ * @return the value of version
+ */
+ public String getVersion() {
+ return version;
+ }
+ }
+
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PipAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PipAnalyzer.java
index 90ef79c6491..e4ceb68bf25 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PipAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PipAnalyzer.java
@@ -17,7 +17,6 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
@@ -25,23 +24,25 @@
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
-import org.owasp.dependencycheck.utils.FileFilterBuilder;
-import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.Checksum;
+import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
import java.nio.charset.Charset;
+import java.nio.file.Files;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import java.util.stream.Collectors;
/**
* Used to analyze pip dependency files named requirements.txt.
@@ -74,7 +75,7 @@ public class PipAnalyzer extends AbstractFileTypeAnalyzer {
/**
* o * Matches AC_INIT variables in the output configure script.
*/
- private static final Pattern PACKAGE_VERSION = Pattern.compile("^([^#].*?)(?:[=>]=([\\.\\*0-9]+?))?$", Pattern.MULTILINE);
+ private static final Pattern PACKAGE_VERSION = Pattern.compile("^([^#].*?)(?:[=~>]=([\\.\\*0-9]+?))?$", Pattern.MULTILINE);
/**
* The file filter used to determine which files this analyzer supports.
@@ -174,7 +175,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
}
/**
- * Retrieves the contents of a given file.
+ * Retrieves the contents of a given file without blank lines.
*
* @param actualFile the file to read
* @return the contents of the file
@@ -182,7 +183,9 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
*/
private String getFileContents(final File actualFile) throws AnalysisException {
try {
- return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
+ return Files.lines(actualFile.toPath(), Charset.defaultCharset())
+ .filter(line -> !line.trim().isEmpty())
+ .collect(Collectors.joining("\n"));
} catch (IOException e) {
throw new AnalysisException("Problem occurred while reading dependency file.", e);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfileAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfileAnalyzer.java
index 76905edf0bb..bb5c66fc75e 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfileAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfileAnalyzer.java
@@ -17,7 +17,6 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
@@ -25,23 +24,24 @@
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
-import org.owasp.dependencycheck.utils.FileFilterBuilder;
-import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.Checksum;
+import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Used to analyze dependencies defined in Pipfile. This analyzer works in
@@ -81,7 +81,7 @@ public class PipfileAnalyzer extends AbstractFileTypeAnalyzer {
/**
* o * Matches AC_INIT variables in the output configure script.
*/
- private static final Pattern PACKAGE_VERSION = Pattern.compile("^([^#].*?) = \"(?:[=>]=([\\.\\*0-9]+?))?\"$", Pattern.MULTILINE);
+ private static final Pattern PACKAGE_VERSION = Pattern.compile("^([^#].*?) = \"(?:[=~>]=([\\.\\*0-9]+?))?\"$", Pattern.MULTILINE);
/**
* The file filter used to determine which files this analyzer supports.
@@ -192,7 +192,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
*/
private String getFileContents(final File actualFile) throws AnalysisException {
try {
- return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
+ return new String(Files.readAllBytes(actualFile.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException("Problem occurred while reading dependency file.", e);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfilelockAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfilelockAnalyzer.java
index 525cdcfb6fa..d2a3f8f4719 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfilelockAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PipfilelockAnalyzer.java
@@ -17,39 +17,38 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import java.io.BufferedInputStream;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
-import org.owasp.dependencycheck.utils.FileFilterBuilder;
-import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.Checksum;
+import org.owasp.dependencycheck.utils.FileFilterBuilder;
+import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import jakarta.json.Json;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileFilter;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.Set;
-import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Used to analyze dependencies defined in Pipfile.lock. This analyzer works in
@@ -199,7 +198,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
*/
private String getFileContents(final File actualFile) throws AnalysisException {
try {
- return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
+ return new String(Files.readAllBytes(actualFile.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException("Problem occurred while reading dependency file.", e);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PnpmAuditAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PnpmAuditAnalyzer.java
index ef2a9c7ba79..74202cdc85c 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PnpmAuditAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PnpmAuditAnalyzer.java
@@ -17,7 +17,8 @@
*/
package org.owasp.dependencycheck.analyzer;
-import org.apache.commons.io.FileUtils;
+import org.apache.commons.collections4.MultiValuedMap;
+import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
import org.apache.commons.lang3.StringUtils;
import org.jetbrains.annotations.NotNull;
import org.json.JSONException;
@@ -42,10 +43,9 @@
import java.io.FileFilter;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.List;
-import org.apache.commons.collections4.MultiValuedMap;
-import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
@ThreadSafe
public class PnpmAuditAnalyzer extends AbstractNpmAnalyzer {
@@ -219,7 +219,7 @@ private JSONObject fetchPnpmAuditJson(Dependency dependency, boolean skipDevDepe
if (!StringUtils.isBlank(errOutput)) {
LOGGER.error("Process error output: {}", errOutput);
}
- String verboseJson = FileUtils.readFileToString(tmpFile, StandardCharsets.UTF_8);
+ String verboseJson = new String(Files.readAllBytes(tmpFile.toPath()), StandardCharsets.UTF_8);
// Workaround implicit creation of .pnpm-debug.log, see https://github.com/pnpm/pnpm/issues/3832
// affects usage of docker container to analyze mounted directories without privileges
if (verboseJson.contains("EACCES: permission denied, open 'node_modules/.pnpm-debug.log'")) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java
index 0d29b5f8875..87be9cda21a 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PoetryAnalyzer.java
@@ -12,8 +12,6 @@
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
- *
- * Copyright (c) 2019 Nima Yahyazadeh. All Rights Reserved.
*/
package org.owasp.dependencycheck.analyzer;
@@ -36,6 +34,8 @@
import com.moandjiezana.toml.Toml;
import java.io.File;
+import java.util.Optional;
+
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
@@ -147,14 +147,24 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
//do not report on the build file itself
engine.removeDependency(dependency);
+ final Optional potentiallyParsedToml = parseDependencyFile(dependency);
+ if (potentiallyParsedToml.isEmpty()) {
+ LOGGER.warn("toml file skipped: {} could not be parsed", dependency.getActualFilePath());
+ return;
+ }
+ final Toml result = potentiallyParsedToml.get();
if (PYPROJECT_TOML.equals(dependency.getActualFile().getName())) {
+ if (result.getTable("tool.poetry") == null) {
+ LOGGER.debug("skipping {} as it does not contain `tool.poetry`", dependency.getDisplayFileName());
+ return;
+ }
+
final File parentPath = dependency.getActualFile().getParentFile();
ensureLock(parentPath);
//exit as we can't analyze pyproject.toml - insufficient version information
return;
}
- final Toml result = new Toml().read(dependency.getActualFile());
final List projectsLocks = result.getTables("package");
if (projectsLocks == null) {
return;
@@ -195,6 +205,30 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
});
}
+ private Optional parseDependencyFile(Dependency dependency) {
+ try {
+ final Toml toml = new Toml().read(dependency.getActualFile());
+ return Optional.of(toml);
+ } catch (RuntimeException e) {
+ final Optional unparsableFileErrorMessage = Optional.ofNullable(e.getCause())
+ .filter(c -> c instanceof IllegalStateException)
+ .map(Throwable::getMessage)
+ .filter(PoetryAnalyzer::isInvalidKeyErrorMessage);
+
+ if (unparsableFileErrorMessage.isPresent()) {
+ final String message = String.format("Invalid toml file, cannot parse '%s'", dependency.getActualFile());
+ LOGGER.debug(message, e);
+ return Optional.empty();
+ }
+
+ throw e;
+ }
+ }
+
+ private static boolean isInvalidKeyErrorMessage(String m) {
+ return m.startsWith("Invalid key");
+ }
+
private void ensureLock(File parent) throws AnalysisException {
final File lock = new File(parent, POETRY_LOCK);
final File requirements = new File(parent, "requirements.txt");
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/PythonPackageAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/PythonPackageAnalyzer.java
index ecd7c727c85..8396fb8f6e2 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/PythonPackageAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/PythonPackageAnalyzer.java
@@ -20,31 +20,31 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import org.apache.commons.io.FileUtils;
import org.apache.commons.io.filefilter.NameFileFilter;
import org.apache.commons.io.filefilter.SuffixFileFilter;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.EvidenceType;
+import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
+import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.FileFilterBuilder;
import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.utils.UrlStringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
import java.io.File;
import java.io.FileFilter;
import java.io.IOException;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
-import org.owasp.dependencycheck.dependency.EvidenceType;
-import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
-import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
-import org.owasp.dependencycheck.exception.InitializationException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Used to analyze a Python package, and collect information that can be used to
@@ -211,6 +211,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine)
//"The __init__.py files are required to make Python treat the directories as containing packages"
//see section "6.4 Packages" from https://docs.python.org/2/tutorial/modules.html;
dependency.addEvidence(EvidenceType.PRODUCT, file.getName(), "PackageName", parentName, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, file.getName(), "PackageName", parentName, Confidence.MEDIUM);
dependency.setName(parentName);
final File[] fileList = parent.listFiles(PY_FILTER);
@@ -237,13 +238,13 @@ private void analyzeFileContents(Dependency dependency, File file)
throws AnalysisException {
final String contents;
try {
- contents = FileUtils.readFileToString(file, Charset.defaultCharset()).trim();
+ contents = new String(Files.readAllBytes(file.toPath()), StandardCharsets.UTF_8).trim();
} catch (IOException e) {
throw new AnalysisException("Problem occurred while reading dependency file.", e);
}
if (!contents.isEmpty()) {
final String source = file.getName();
- gatherEvidence(dependency, EvidenceType.VERSION, VERSION_PATTERN, contents,
+ gatherEvidence(dependency, EvidenceType.VERSION, VERSION_PATTERN, contents,
source, "SourceVersion", Confidence.MEDIUM);
addSummaryInfo(dependency, SUMMARY_PATTERN, 4, contents,
source, "summary");
@@ -292,7 +293,7 @@ private void analyzeFileContents(Dependency dependency, File file)
* @param key the key name to use when recording the evidence
*/
private void addSummaryInfo(Dependency dependency, Pattern pattern,
- int group, String contents, String source, String key) {
+ int group, String contents, String source, String key) {
final Matcher matcher = pattern.matcher(contents);
final boolean found = matcher.find();
if (found) {
@@ -312,7 +313,7 @@ private void addSummaryInfo(Dependency dependency, Pattern pattern,
* @param contents the home page URL
*/
private void gatherHomePageEvidence(Dependency dependency, EvidenceType type, Pattern pattern,
- String source, String name, String contents) {
+ String source, String name, String contents) {
final Matcher matcher = pattern.matcher(contents);
if (matcher.find()) {
final String url = matcher.group(4);
@@ -335,7 +336,7 @@ private void gatherHomePageEvidence(Dependency dependency, EvidenceType type, Pa
* @param confidence in evidence
*/
private void gatherEvidence(Dependency dependency, EvidenceType type, Pattern pattern, String contents,
- String source, String name, Confidence confidence) {
+ String source, String name, Confidence confidence) {
final Matcher matcher = pattern.matcher(contents);
final boolean found = matcher.find();
if (found) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzer.java
index 7961f8f77c5..0c329a9e729 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzer.java
@@ -182,7 +182,7 @@ public void initialize(Settings settings) {
protected void prepareFileTypeAnalyzer(Engine engine) throws InitializationException {
// RetireJS outputs a bunch of repeated output like the following for
// vulnerable dependencies, with little context:
- //
+ //
// INFO: Vulnerability found: jquery below 1.6.3
//
// This logging is suppressed because it isn't particularly useful, and
@@ -216,7 +216,7 @@ protected void prepareFileTypeAnalyzer(Engine engine) throws InitializationExcep
try {
ds.update(engine);
} catch (UpdateException ex) {
- throw new InitializationException("Unable to initialize the Retire JS respository", ex);
+ throw new InitializationException("Unable to initialize the Retire JS repository", ex);
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/RubyGemspecAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/RubyGemspecAnalyzer.java
index 002eb6dc283..ab5c54a3e8d 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/RubyGemspecAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/RubyGemspecAnalyzer.java
@@ -20,16 +20,6 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import java.io.File;
-import java.io.FileFilter;
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.List;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
@@ -44,6 +34,16 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
/**
* Used to analyze Ruby Gem specifications and collect information that can be
* used to determine the associated CPE. Regular expressions are used to parse
@@ -143,7 +143,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
dependency.setEcosystem(DEPENDENCY_ECOSYSTEM);
String contents;
try {
- contents = FileUtils.readFileToString(dependency.getActualFile(), Charset.defaultCharset());
+ contents = new String(Files.readAllBytes(dependency.getActualFile().toPath()), StandardCharsets.UTF_8);
} catch (IOException e) {
throw new AnalysisException(
"Problem occurred while reading dependency file.", e);
@@ -265,7 +265,7 @@ private String addEvidenceFromVersionFile(Dependency dependency, EvidenceType ty
}
for (File f : matchingFiles) {
try {
- final List lines = FileUtils.readLines(f, Charset.defaultCharset());
+ final List lines = Files.readAllLines(f.toPath(), StandardCharsets.UTF_8);
if (lines.size() == 1) { //TODO other checking?
final String value = lines.get(0).trim();
if (version == null || !version.equals(value)) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageManagerAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageManagerAnalyzer.java
index 805a32a8c49..7e9baaeef61 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageManagerAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageManagerAnalyzer.java
@@ -20,15 +20,6 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import java.io.File;
-import java.io.FileFilter;
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
@@ -42,6 +33,15 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
/**
* This analyzer is used to analyze the SWIFT Package Manager
* (https://swift.org/package-manager/). It collects information about a package
@@ -158,7 +158,7 @@ private void analyzeSpmFileDependency(Dependency dependency)
throws AnalysisException, IOException {
dependency.setEcosystem(DEPENDENCY_ECOSYSTEM);
- final String contents = FileUtils.readFileToString(dependency.getActualFile(), Charset.defaultCharset());
+ final String contents = new String(Files.readAllBytes(dependency.getActualFile().toPath()), StandardCharsets.UTF_8);
final Matcher matcher = SPM_BLOCK_PATTERN.matcher(contents);
if (matcher.find()) {
@@ -220,7 +220,7 @@ private void analyzeSpmFileDependency(Dependency dependency)
* @return the string that was added as evidence
*/
private String addStringEvidence(Dependency dependency, EvidenceType type,
- String packageDescription, String field, String fieldPattern, Confidence confidence) {
+ String packageDescription, String field, String fieldPattern, Confidence confidence) {
String value = "";
final Matcher matcher = Pattern.compile(
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageResolvedAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageResolvedAnalyzer.java
index 575aaa597ce..ccd10ec48d1 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageResolvedAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/SwiftPackageResolvedAnalyzer.java
@@ -20,16 +20,6 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import java.io.FileFilter;
-import java.io.IOException;
-import java.io.InputStream;
-import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonArray;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-
-import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
@@ -44,6 +34,16 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.annotation.concurrent.ThreadSafe;
+import jakarta.json.Json;
+import jakarta.json.JsonArray;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+
/**
* This analyzer is used to analyze the SWIFT Package Resolved
* (https://swift.org/package-manager/). It collects information about a package
@@ -155,8 +155,8 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
private void analyzeSpmResolvedDependencies(Dependency spmResolved, Engine engine)
throws AnalysisException, IOException {
- try (InputStream in = FileUtils.openInputStream(spmResolved.getActualFile());
- JsonReader resolved = Json.createReader(in)) {
+ try (InputStream in = Files.newInputStream(spmResolved.getActualFile().toPath());
+ JsonReader resolved = Json.createReader(in)) {
final JsonObject file = resolved.readObject();
final int fileVersion = file.getInt("version");
@@ -165,7 +165,8 @@ private void analyzeSpmResolvedDependencies(Dependency spmResolved, Engine engin
analyzeSpmResolvedDependenciesV1(spmResolved, engine, file);
break;
case 2:
- analyzeSpmResolvedDependenciesV2(spmResolved, engine, file);
+ case 3:
+ analyzeSpmResolvedDependenciesV2And3(spmResolved, engine, file);
break;
default:
return;
@@ -209,14 +210,14 @@ private void analyzeSpmResolvedDependenciesV1(Dependency spmResolved, Engine eng
}
/**
- * Analyzes the version 2 of the Package.resolved file to extract evidence
+ * Analyzes the versions 2 and 3 of the Package.resolved file to extract evidence
* for the dependency.
*
* @param spmResolved the dependency to analyze
* @param engine the analysis engine
* @param resolved the json object of the file to analyze
*/
- private void analyzeSpmResolvedDependenciesV2(Dependency spmResolved, Engine engine, JsonObject resolved) {
+ private void analyzeSpmResolvedDependenciesV2And3(Dependency spmResolved, Engine engine, JsonObject resolved) {
final JsonArray pins = resolved.getJsonArray("pins");
if (pins == null) {
return;
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/UnusedSuppressionRuleAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/UnusedSuppressionRuleAnalyzer.java
index 4c95fdbb78d..9f5188e06ad 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/UnusedSuppressionRuleAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/UnusedSuppressionRuleAnalyzer.java
@@ -34,6 +34,11 @@
*/
public class UnusedSuppressionRuleAnalyzer extends AbstractAnalyzer {
+ /**
+ * Exception message.
+ */
+ protected static final String EXCEPTION_MSG = "There are %d unused suppression rule(s): check logs.";
+
/**
* The Logger for use throughout the class.
*/
@@ -43,27 +48,54 @@ public class UnusedSuppressionRuleAnalyzer extends AbstractAnalyzer {
* been reported.
*/
private boolean reported = false;
+ /**
+ * A flag indicating whether build should fail on unused suppression rule
+ */
+ private boolean shouldFailForUnusedSuppressionRule = false;
+ /**
+ * unused suppression rule count
+ */
+ private int unusedSuppressionRuleCount = 0;
+
+ @Override
+ public synchronized void initialize(Settings settings) {
+ super.initialize(settings);
+ if (settings.getBoolean(Settings.KEYS.FAIL_ON_UNUSED_SUPPRESSION_RULE, false)) {
+ this.shouldFailForUnusedSuppressionRule = true;
+ }
+ }
@Override
protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
if (!reported) {
- logUnusedRules(engine);
+ checkUnusedRules(engine);
reported = true;
+ if (unusedSuppressionRuleCount > 0 && failsForUnusedSuppressionRule()) {
+ final String message = String.format(EXCEPTION_MSG, unusedSuppressionRuleCount);
+ LOGGER.error(message);
+ throw new AnalysisException(message);
+ }
}
}
/**
- * Logs unused suppression RULES.
+ * check unused suppression RULES.
*
* @param engine a reference to the ODC engine
*/
- private void logUnusedRules(Engine engine) {
+ protected void checkUnusedRules(Engine engine) {
if (engine.hasObject(SUPPRESSION_OBJECT_KEY)) {
@SuppressWarnings("unchecked")
final List rules = (List) engine.getObject(SUPPRESSION_OBJECT_KEY);
rules.forEach((rule) -> {
if (!rule.isMatched() && !rule.isBase()) {
- LOGGER.info("Suppression Rule had zero matches: {}", rule.toString());
+ final String message = String.format("Suppression Rule had zero matches: %s", rule);
+ if (failsForUnusedSuppressionRule()) {
+ LOGGER.error(message);
+ } else {
+ LOGGER.info(message);
+ }
+ increaseUnusedSuppressionRuleCount();
}
});
}
@@ -89,4 +121,25 @@ public AnalysisPhase getAnalysisPhase() {
public boolean supportsParallelProcessing() {
return false;
}
+
+ /**
+ * increases the count of unused suppression rules.
+ */
+ public void increaseUnusedSuppressionRuleCount() {
+ unusedSuppressionRuleCount++;
+ }
+
+ /**
+ * @return the count of unused suppression rules.
+ */
+ public int getUnusedSuppressionRuleCount() {
+ return unusedSuppressionRuleCount;
+ }
+
+ /**
+ * @return whether the analyzer will fail for a unused suppression rule.
+ */
+ public boolean failsForUnusedSuppressionRule() {
+ return shouldFailForUnusedSuppressionRule;
+ }
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java
index 584b9b2a163..1cd1ad432f2 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java
@@ -86,7 +86,7 @@ public class VersionFilterAnalyzer extends AbstractAnalyzer {
/**
* The phase that this analyzer is intended to run in.
*/
- private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_INFORMATION_COLLECTION;
+ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_INFORMATION_COLLECTION3;
//
//
@@ -136,7 +136,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
final Set remove;
if (dependency.getVersion() != null) {
remove = dependency.getEvidence(EvidenceType.VERSION).stream()
- .filter(e -> !dependency.getVersion().equals(e.getValue()))
+ .filter(e -> !e.isFromHint() && !dependency.getVersion().equals(e.getValue()))
.collect(Collectors.toSet());
} else {
remove = new HashSet<>();
@@ -165,7 +165,8 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
LOGGER.debug("filtering evidence from {}", dependency.getFileName());
for (Evidence e : dependency.getEvidence(EvidenceType.VERSION)) {
- if (!(pomMatch && VERSION.equals(e.getName())
+ if (!e.isFromHint()
+ && !(pomMatch && VERSION.equals(e.getName())
&& (NEXUS.equals(e.getSource()) || CENTRAL.equals(e.getSource()) || POM.equals(e.getSource())))
&& !(fileMatch && VERSION.equals(e.getName()) && FILE.equals(e.getSource()))
&& !(manifestMatch && MANIFEST.equals(e.getSource()) && IMPLEMENTATION_VERSION.equals(e.getName()))) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java
index 2e52ad8bc43..25c7f0b58e6 100644
--- a/core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java
+++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java
@@ -17,25 +17,12 @@
*/
package org.owasp.dependencycheck.analyzer;
-import java.io.File;
-import java.io.FileFilter;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
import org.apache.commons.collections4.MultiValuedMap;
import org.apache.commons.collections4.multimap.HashSetValuedHashMap;
-
-import org.apache.commons.io.FileUtils;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.StringUtils;
+import org.json.JSONException;
+import org.json.JSONObject;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.analyzer.exception.SearchException;
@@ -48,18 +35,41 @@
import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.utils.URLConnectionFailureException;
import org.owasp.dependencycheck.utils.processing.ProcessReader;
+import org.semver4j.Semver;
+import org.semver4j.SemverException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import us.springett.parsers.cpe.exceptions.CpeValidationException;
+import jakarta.json.Json;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+
+import javax.annotation.concurrent.ThreadSafe;
+import java.io.File;
+import java.io.FileFilter;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Stream;
+
@ThreadSafe
public class YarnAuditAnalyzer extends AbstractNpmAnalyzer {
/**
- * The logger.
+ * The Logger for use throughout the class.
*/
private static final Logger LOGGER = LoggerFactory.getLogger(YarnAuditAnalyzer.class);
+ /**
+ * The major version of the Yarn Classic CLI.
+ */
+ private static final int YARN_CLASSIC_MAJOR_VERSION = 1;
+
/**
* The file name to scan.
*/
@@ -83,34 +93,6 @@ public class YarnAuditAnalyzer extends AbstractNpmAnalyzer {
*/
private String yarnPath;
- /**
- * Analyzes the yarn lock file to determine vulnerable dependencies. Uses
- * yarn audit --offline to generate the payload to be sent to the NPM API.
- *
- * @param dependency the yarn lock file
- * @param engine the analysis engine
- * @throws AnalysisException thrown if there is an error analyzing the file
- */
- @Override
- protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
- if (dependency.getDisplayFileName().equals(dependency.getFileName())) {
- engine.removeDependency(dependency);
- }
- final File packageLock = dependency.getActualFile();
- if (!packageLock.isFile() || packageLock.length() == 0 || !shouldProcess(packageLock)) {
- return;
- }
- final File packageJson = new File(packageLock.getParentFile(), "package.json");
- final List advisories;
- final MultiValuedMap dependencyMap = new HashSetValuedHashMap<>();
- advisories = analyzePackage(packageLock, packageJson, dependency, dependencyMap);
- try {
- processResults(advisories, engine, dependency, dependencyMap);
- } catch (CpeValidationException ex) {
- throw new UnexpectedAnalysisException(ex);
- }
- }
-
@Override
protected String getAnalyzerEnabledSettingKey() {
return Settings.KEYS.ANALYZER_YARN_AUDIT_ENABLED;
@@ -131,6 +113,49 @@ public AnalysisPhase getAnalysisPhase() {
return AnalysisPhase.FINDING_ANALYSIS;
}
+ /**
+ * Extracts the major version from a version string.
+ *
+ * @param dependency the dependency to extract the yarn version from
+ * @return the major version (e.g., `4` from "4.2.1")
+ */
+ private int getYarnMajorVersion(Dependency dependency) {
+ final var yarnVersion = getYarnVersion(dependency);
+ try {
+ final var semver = Semver.coerce(yarnVersion);
+ return semver.getMajor();
+ } catch (SemverException e) {
+ throw new IllegalStateException("Invalid version string format", e);
+ }
+ }
+
+ private String getYarnVersion(Dependency dependency) {
+ final List args = new ArrayList<>();
+ args.add(getYarn());
+ args.add("--version");
+ final ProcessBuilder builder = new ProcessBuilder(args);
+ builder.directory(getDependencyDirectory(dependency));
+ LOGGER.debug("Launching: {}", args);
+ try {
+ final Process process = builder.start();
+ try (ProcessReader processReader = new ProcessReader(process)) {
+ processReader.readAll();
+ final int exitValue = process.waitFor();
+ if (exitValue != 0) {
+ throw new IllegalStateException("Unable to determine yarn version, unexpected response.");
+ }
+ final var yarnVersion = processReader.getOutput();
+ if (StringUtils.isBlank(yarnVersion)) {
+ throw new IllegalStateException("Unable to determine yarn version, blank output.");
+ }
+ return yarnVersion;
+ }
+ } catch (Exception ex) {
+ throw new IllegalStateException("Unable to determine yarn version.", ex);
+ }
+ }
+
+
/**
* Initializes the analyzer once before any analysis is performed.
*
@@ -163,12 +188,14 @@ protected void prepareFileTypeAnalyzer(Engine engine) throws InitializationExcep
case yarnExecutableNotFoundExitValue:
default:
this.setEnabled(false);
- LOGGER.warn("The {} has been disabled. Yarn executable was not found.", getName());
+ LOGGER.warn("The {} has been disabled after receiving exit value {}. Yarn executable was not " +
+ "found or received a non-zero exit value.", getName(), exitValue);
}
}
} catch (Exception ex) {
this.setEnabled(false);
- LOGGER.warn("The {} has been disabled. Yarn executable was not found.", getName());
+ LOGGER.warn("The {} has been disabled after receiving an exception. This can occur when Yarn executable " +
+ "is not found.", getName());
throw new InitializationException("Unable to read yarn audit output.", ex);
}
}
@@ -200,30 +227,15 @@ private String getYarn() {
return value;
}
- private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDependencies) throws AnalysisException {
- final File folder = dependency.getActualFile().getParentFile();
- if (!folder.isDirectory()) {
- throw new AnalysisException(String.format("%s should have been a directory.", folder.getAbsolutePath()));
- }
+ /**
+ * Workaround 64k limitation of InputStream, redirect stdout to a file that we will read later
+ * instead of reading directly stdout from Process's InputStream which is topped at 64k
+ *
+ * @param builder a reference to the process builder
+ * @return returns the standard out from the process
+ */
+ private String startAndReadStdoutToString(ProcessBuilder builder) throws AnalysisException {
try {
- final List args = new ArrayList<>();
-
- args.add(getYarn());
- args.add("audit");
- //offline audit is not supported - but the audit request is generated in the verbose output
- args.add("--offline");
- if (skipDevDependencies) {
- args.add("--groups");
- args.add("dependencies");
- }
- args.add("--json");
- args.add("--verbose");
- final ProcessBuilder builder = new ProcessBuilder(args);
- builder.directory(folder);
- LOGGER.debug("Launching: {}", args);
- // Workaround 64k limitation of InputStream, redirect stdout to a file that we will read later
- // instead of reading directly stdout from Process's InputStream which is topped at 64k
-
final File tmpFile = getSettings().getTempFile("yarn_audit", "json");
builder.redirectOutput(tmpFile);
final Process process = builder.start();
@@ -235,19 +247,7 @@ private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDepe
LOGGER.debug("Process Error Out: {}", errOutput);
LOGGER.debug("Process Out: {}", processReader.getOutput());
}
- final String verboseJson = FileUtils.readFileToString(tmpFile, StandardCharsets.UTF_8);
- final String auditRequestJson = Arrays.stream(verboseJson.split("\n"))
- .filter(line -> line.contains("Audit Request"))
- .findFirst().get();
- String auditRequest;
- try (JsonReader reader = Json.createReader(IOUtils.toInputStream(auditRequestJson, StandardCharsets.UTF_8))) {
- final JsonObject jsonObject = reader.readObject();
- auditRequest = jsonObject.getString("data");
- auditRequest = auditRequest.substring(15);
- }
- LOGGER.debug("Audit Request: {}", auditRequest);
-
- return Json.createReader(IOUtils.toInputStream(auditRequest, StandardCharsets.UTF_8)).readObject();
+ return new String(Files.readAllBytes(tmpFile.toPath()), StandardCharsets.UTF_8);
} catch (InterruptedException ex) {
Thread.currentThread().interrupt();
throw new AnalysisException("Yarn audit process was interrupted.", ex);
@@ -257,6 +257,80 @@ private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDepe
}
}
+ /**
+ * Analyzes the yarn lock file to determine vulnerable dependencies. Uses
+ * yarn audit --offline to generate the payload to be sent to the NPM API.
+ *
+ * @param dependency the yarn lock file
+ * @param engine the analysis engine
+ * @throws AnalysisException thrown if there is an error analyzing the file
+ */
+ @Override
+ protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
+ if (dependency.getDisplayFileName().equals(dependency.getFileName())) {
+ engine.removeDependency(dependency);
+ }
+ final File packageLock = dependency.getActualFile();
+ if (!packageLock.isFile() || packageLock.length() == 0 || !shouldProcess(packageLock)) {
+ return;
+ }
+ final File packageJson = new File(packageLock.getParentFile(), "package.json");
+ final List advisories;
+ final MultiValuedMap dependencyMap = new HashSetValuedHashMap<>();
+ final var yarnMajorVersion = getYarnMajorVersion(dependency);
+ if (YARN_CLASSIC_MAJOR_VERSION < yarnMajorVersion) {
+ LOGGER.info("Analyzing using Yarn Berry audit");
+ advisories = analyzePackageWithYarnBerry(dependency);
+ } else {
+ LOGGER.info("Analyzing using Yarn Classic audit");
+ advisories = analyzePackageWithYarnClassic(packageLock, packageJson, dependency, dependencyMap);
+ }
+ try {
+ processResults(advisories, engine, dependency, dependencyMap);
+ } catch (CpeValidationException ex) {
+ throw new UnexpectedAnalysisException(ex);
+ }
+ }
+
+ private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDependencies) throws AnalysisException {
+ final List args = new ArrayList<>();
+ args.add(getYarn());
+ args.add("audit");
+ //offline audit is not supported - but the audit request is generated in the verbose output
+ args.add("--offline");
+ if (skipDevDependencies) {
+ args.add("--groups");
+ args.add("dependencies");
+ }
+ args.add("--json");
+ args.add("--verbose");
+ final ProcessBuilder builder = new ProcessBuilder(args);
+ builder.directory(getDependencyDirectory(dependency));
+ LOGGER.debug("Launching: {}", args);
+
+ final String verboseJson = startAndReadStdoutToString(builder);
+ final String auditRequestJson = Arrays.stream(verboseJson.split("\n"))
+ .filter(line -> line.contains("Audit Request"))
+ .findFirst().get();
+ String auditRequest;
+ try (JsonReader reader = Json.createReader(IOUtils.toInputStream(auditRequestJson, StandardCharsets.UTF_8))) {
+ final JsonObject jsonObject = reader.readObject();
+ auditRequest = jsonObject.getString("data");
+ auditRequest = auditRequest.substring(15);
+ }
+ LOGGER.debug("Audit Request: {}", auditRequest);
+
+ return Json.createReader(IOUtils.toInputStream(auditRequest, StandardCharsets.UTF_8)).readObject();
+ }
+
+ private static File getDependencyDirectory(Dependency dependency) {
+ final File folder = dependency.getActualFile().getParentFile();
+ if (!folder.isDirectory()) {
+ throw new IllegalArgumentException(String.format("%s should have been a directory.", folder.getAbsolutePath()));
+ }
+ return folder;
+ }
+
/**
* Analyzes the package and yarn lock files by extracting dependency
* information, creating a payload to submit to the npm audit API,
@@ -272,17 +346,18 @@ private JsonObject fetchYarnAuditJson(Dependency dependency, boolean skipDevDepe
* @throws AnalysisException thrown when there is an error creating or
* submitting the npm audit API payload
*/
- private List analyzePackage(final File lockFile, final File packageFile,
- Dependency dependency, MultiValuedMap dependencyMap)
+ private List analyzePackageWithYarnClassic(final File lockFile, final File packageFile,
+ Dependency dependency, MultiValuedMap dependencyMap)
throws AnalysisException {
try {
final boolean skipDevDependencies = getSettings().getBoolean(Settings.KEYS.ANALYZER_NODE_AUDIT_SKIPDEV, false);
// Retrieves the contents of package-lock.json from the Dependency
final JsonObject lockJson = fetchYarnAuditJson(dependency, skipDevDependencies);
// Retrieves the contents of package-lock.json from the Dependency
- final JsonReader packageReader = Json.createReader(FileUtils.openInputStream(packageFile));
- final JsonObject packageJson = packageReader.readObject();
-
+ final JsonObject packageJson;
+ try (JsonReader packageReader = Json.createReader(Files.newInputStream(packageFile.toPath()))) {
+ packageJson = packageReader.readObject();
+ }
// Modify the payload to meet the NPM Audit API requirements
final JsonObject payload = NpmPayloadBuilder.build(lockJson, packageJson, dependencyMap, skipDevDependencies);
@@ -306,4 +381,106 @@ private List analyzePackage(final File lockFile, final File packageFil
throw ex;
}
}
+
+ private List fetchYarnAdvisories(Dependency dependency, boolean skipDevDependencies) throws AnalysisException {
+ final List args = new ArrayList<>();
+
+ args.add(getYarn());
+ args.add("npm");
+ args.add("audit");
+ if (skipDevDependencies) {
+ args.add("--environment");
+ args.add("production");
+ }
+ args.add("--all");
+ args.add("--recursive");
+ args.add("--json");
+ final ProcessBuilder builder = new ProcessBuilder(args);
+ builder.directory(getDependencyDirectory(dependency));
+
+ final String advisoriesJsons = startAndReadStdoutToString(builder);
+
+ LOGGER.debug("Advisories JSON: {}", advisoriesJsons);
+ final String[] advisoriesJsonArray = Stream.of(advisoriesJsons.split("\n"))
+ .filter(s -> !s.isBlank())
+ .toArray(String[]::new);
+ try {
+ final List advisories = new ArrayList<>();
+ for (String advisoriesJson : advisoriesJsonArray) {
+ advisories.add(new JSONObject(advisoriesJson));
+ }
+
+ return advisories;
+ } catch (JSONException e) {
+ throw new AnalysisException("Failed to parse the response from NPM Audit API "
+ + "(YarnBerryAuditAnalyzer).", e);
+ }
+ }
+
+ /**
+ * Analyzes the package and yarn lock files by calling yarn npm audit and returning the identified advisories.
+ *
+ * @param dependency a reference to the dependency-object for the yarn.lock
+ * @return a list of advisories
+ */
+ private List analyzePackageWithYarnBerry(Dependency dependency) throws AnalysisException {
+ try {
+ final var skipDevDependencies = getSettings().getBoolean(Settings.KEYS.ANALYZER_NODE_AUDIT_SKIPDEV, false);
+ final var advisoryJsons = fetchYarnAdvisories(dependency, skipDevDependencies);
+ return parseAdvisoryJsons(advisoryJsons);
+ } catch (JSONException e) {
+ throw new AnalysisException("Failed to parse the response from NPM Audit API "
+ + "(YarnBerryAuditAnalyzer).", e);
+ } catch (SearchException ex) {
+ LOGGER.error("YarnBerryAuditAnalyzer failed on {}", dependency.getActualFilePath());
+ throw ex;
+ }
+ }
+
+ private static List parseAdvisoryJsons(List advisoryJsons) throws JSONException {
+ final List advisories = new ArrayList<>();
+ for (JSONObject advisoryJson : advisoryJsons) {
+ final var advisory = new Advisory();
+ final var object = advisoryJson.getJSONObject("children");
+ final var moduleName = advisoryJson.optString("value", null);
+ final var id = object.getString("ID");
+ final var url = object.optString("URL", null);
+ final var ghsaId = extractGhsaId(url);
+ final var issue = object.optString("Issue", null);
+ final var severity = object.optString("Severity", null);
+ final var vulnerableVersions = object.optString("Vulnerable Versions", null);
+ final var treeVersions = object.optJSONArray("Tree Versions");
+ final var treeVersionsLength = treeVersions == null ? 0 : treeVersions.length();
+ final var versions = new ArrayList();
+ for (int i = 0; i < treeVersionsLength; i++) {
+ versions.add(treeVersions.getString(i));
+ }
+ if (versions.isEmpty()) {
+ versions.add(null);
+ }
+ for (String version : versions) {
+ advisory.setGhsaId(ghsaId);
+ advisory.setTitle(issue);
+ advisory.setOverview("URL:" + url + "ID: " + id);
+ advisory.setSeverity(severity);
+ advisory.setVulnerableVersions(vulnerableVersions);
+ advisory.setModuleName(moduleName);
+ advisory.setVersion(version);
+ advisory.setCwes(new ArrayList<>());
+ advisories.add(advisory);
+ }
+ }
+ return advisories;
+ }
+
+ private static String extractGhsaId(String url) {
+ if (url == null || url.isEmpty()) {
+ return null;
+ }
+ final int lastSlashIndex = url.lastIndexOf('/');
+ if (lastSlashIndex == -1 || lastSlashIndex == url.length() - 1) {
+ return null;
+ }
+ return url.substring(lastSlashIndex + 1);
+ }
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearch.java b/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearch.java
index ef895fc7800..630e8af0d0b 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearch.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearch.java
@@ -19,59 +19,51 @@
import java.io.FileNotFoundException;
import java.io.IOException;
-import java.io.InputStreamReader;
-import java.net.HttpURLConnection;
import java.net.MalformedURLException;
+import java.net.URISyntaxException;
import java.net.URL;
import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.Base64;
import java.util.List;
import java.util.UUID;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
import javax.annotation.concurrent.ThreadSafe;
+import org.apache.hc.core5.http.message.BasicHeader;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.utils.Checksum;
-import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ForbiddenException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.URLConnectionFactory;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.ObjectReader;
/**
* Class of methods to search Artifactory for hashes and determine Maven GAV
* from there.
*
- * Data classes copied from JFrog's artifactory-client-java project.
+ * Data classes copied from JFrog's artifactory-client-java project.
*
* @author nhenneaux
*/
@ThreadSafe
-@SuppressWarnings("squid:S2647")
public class ArtifactorySearch {
/**
- * Used for logging.
+ * Required to add all extra information of the found artifact.
+ * Source: https://jfrog.com/help/r/jfrog-rest-apis/property-search
*/
- private static final Logger LOGGER = LoggerFactory.getLogger(ArtifactorySearch.class);
+ @SuppressWarnings("JavadocLinkAsPlainText")
+ public static final String X_RESULT_DETAIL_HEADER = "X-Result-Detail";
/**
- * Pattern to match the path returned by the Artifactory AQL API.
- */
- private static final Pattern PATH_PATTERN = Pattern.compile("^/(?.+)/(?[^/]+)/(?[^/]+)/[^/]+$");
- /**
- * Extracted duplicateArtifactorySearchIT.java comment.
+ * Used for logging.
*/
- private static final String WHILE_ACTUAL_IS = " while actual is ";
+ private static final Logger LOGGER = LoggerFactory.getLogger(ArtifactorySearch.class);
+
/**
* The URL for the Central service.
*/
@@ -80,25 +72,15 @@ public class ArtifactorySearch {
/**
* Whether to use the Proxy when making requests.
*/
- private final boolean useProxy;
+ private final boolean allowUsingProxy;
- /**
- * The configured settings.
- */
- private final Settings settings;
/**
- * Search result reader
- */
- private final ObjectReader objectReader;
-
- /**
- * Creates a NexusSearch for the given repository URL.
+ * Creates a ArtifactorySearch for the given repository URL.
*
* @param settings the configured settings
*/
public ArtifactorySearch(Settings settings) {
- this.settings = settings;
final String searchUrl = settings.getString(Settings.KEYS.ANALYZER_ARTIFACTORY_URL);
@@ -106,20 +88,13 @@ public ArtifactorySearch(Settings settings) {
LOGGER.debug("Artifactory Search URL {}", searchUrl);
if (null != settings.getString(Settings.KEYS.PROXY_SERVER)) {
- boolean useProxySettings = false;
- try {
- useProxySettings = settings.getBoolean(Settings.KEYS.ANALYZER_ARTIFACTORY_USES_PROXY);
- } catch (InvalidSettingException e) {
- LOGGER.error("Settings {} is invalid, only, true/false is valid", Settings.KEYS.ANALYZER_ARTIFACTORY_USES_PROXY, e);
- }
- this.useProxy = useProxySettings;
- LOGGER.debug("Using proxy? {}", useProxy);
+ this.allowUsingProxy = settings.getBoolean(Settings.KEYS.ANALYZER_ARTIFACTORY_USES_PROXY, false);
+ LOGGER.debug("Using proxy configuration? {}", allowUsingProxy);
} else {
- useProxy = false;
- LOGGER.debug("Not using proxy");
+ this.allowUsingProxy = settings.getBoolean(Settings.KEYS.ANALYZER_ARTIFACTORY_USES_PROXY, true);
+ LOGGER.debug("Using default non-legacy proxy configuration");
}
- objectReader = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false).readerFor(FileImpl.class);
}
/**
@@ -137,50 +112,25 @@ public List search(Dependency dependency) throws IOException {
final String sha1sum = dependency.getSha1sum();
final URL url = buildUrl(sha1sum);
- final HttpURLConnection conn = connect(url);
- final int responseCode = conn.getResponseCode();
- if (responseCode == 200) {
- return processResponse(dependency, conn);
- }
- throw new IOException("Could not connect to Artifactory " + url + " (" + responseCode + "): " + conn.getResponseMessage());
-
- }
-
- /**
- * Makes an connection to the given URL.
- *
- * @param url the URL to connect to
- * @return the HTTP URL Connection
- * @throws IOException thrown if there is an error making the connection
- */
- private HttpURLConnection connect(URL url) throws IOException {
- LOGGER.debug("Searching Artifactory url {}", url);
-
- // Determine if we need to use a proxy. The rules:
- // 1) If the proxy is set, AND the setting is set to true, use the proxy
- // 2) Otherwise, don't use the proxy (either the proxy isn't configured,
- // or proxy is specifically set to false)
- final URLConnectionFactory factory = new URLConnectionFactory(settings);
- final HttpURLConnection conn = factory.createHttpURLConnection(url, useProxy);
- conn.setDoOutput(true);
-
- conn.addRequestProperty("X-Result-Detail", "info");
-
- final String username = settings.getString(Settings.KEYS.ANALYZER_ARTIFACTORY_API_USERNAME);
- final String apiToken = settings.getString(Settings.KEYS.ANALYZER_ARTIFACTORY_API_TOKEN);
- if (username != null && apiToken != null) {
- final String userpassword = username + ":" + apiToken;
- final String encodedAuthorization = Base64.getEncoder().encodeToString(userpassword.getBytes(StandardCharsets.UTF_8));
- conn.addRequestProperty("Authorization", "Basic " + encodedAuthorization);
- } else {
- final String bearerToken = settings.getString(Settings.KEYS.ANALYZER_ARTIFACTORY_BEARER_TOKEN);
- if (bearerToken != null) {
- conn.addRequestProperty("Authorization", "Bearer " + bearerToken);
- }
+ final StringBuilder msg = new StringBuilder("Could not connect to Artifactory at")
+ .append(url);
+ try {
+ final BasicHeader artifactoryResultDetail = new BasicHeader(X_RESULT_DETAIL_HEADER, "info");
+ return Downloader.getInstance().fetchAndHandle(
+ url,
+ new ArtifactorySearchResponseHandler(url, dependency),
+ List.of(artifactoryResultDetail),
+ allowUsingProxy
+ );
+ } catch (TooManyRequestsException e) {
+ throw new IOException(msg.append(" (429): Too manu requests").toString(), e);
+ } catch (URISyntaxException e) {
+ throw new IOException(msg.append(" (400): Invalid URL").toString(), e);
+ } catch (ResourceNotFoundException e) {
+ throw new IOException(msg.append(" (404): Not found").toString(), e);
+ } catch (ForbiddenException e) {
+ throw new IOException(msg.append(" (403): Forbidden").toString(), e);
}
-
- conn.connect();
- return conn;
}
/**
@@ -196,99 +146,6 @@ private URL buildUrl(String sha1sum) throws MalformedURLException {
return new URL(rootURL + "/api/search/checksum?sha1=" + sha1sum);
}
- /**
- * Process the Artifactory response.
- *
- * @param dependency the dependency
- * @param conn the HTTP URL Connection
- * @return a list of the Maven Artifact information
- * @throws IOException thrown if there is an I/O error
- */
- protected List processResponse(Dependency dependency, HttpURLConnection conn) throws IOException {
- final List result = new ArrayList<>();
-
- try (InputStreamReader streamReader = new InputStreamReader(conn.getInputStream(), StandardCharsets.UTF_8);
- JsonParser parser = objectReader.getFactory().createParser(streamReader)) {
-
- if (init(parser) && parser.nextToken() == com.fasterxml.jackson.core.JsonToken.START_OBJECT) {
- // at least one result
- do {
- final FileImpl file = objectReader.readValue(parser);
-
- checkHashes(dependency, file.getChecksums());
-
- final Matcher pathMatcher = PATH_PATTERN.matcher(file.getPath());
- if (!pathMatcher.matches()) {
- throw new IllegalStateException("Cannot extract the Maven information from the path "
- + "retrieved in Artifactory " + file.getPath());
- }
-
- final String groupId = pathMatcher.group("groupId").replace('/', '.');
- final String artifactId = pathMatcher.group("artifactId");
- final String version = pathMatcher.group("version");
-
- result.add(new MavenArtifact(groupId, artifactId, version, file.getDownloadUri(),
- MavenArtifact.derivePomUrl(artifactId, version, file.getDownloadUri())));
-
- } while (parser.nextToken() == com.fasterxml.jackson.core.JsonToken.START_OBJECT);
- } else {
- throw new FileNotFoundException("Artifact " + dependency + " not found in Artifactory");
- }
- }
-
- return result;
- }
-
- protected boolean init(JsonParser parser) throws IOException {
- com.fasterxml.jackson.core.JsonToken nextToken = parser.nextToken();
- if (nextToken != com.fasterxml.jackson.core.JsonToken.START_OBJECT) {
- throw new IOException("Expected " + com.fasterxml.jackson.core.JsonToken.START_OBJECT + ", got " + nextToken);
- }
-
- do {
- nextToken = parser.nextToken();
- if (nextToken == null) {
- break;
- }
-
- if (nextToken.isStructStart()) {
- if (nextToken == com.fasterxml.jackson.core.JsonToken.START_ARRAY && "results".equals(parser.currentName())) {
- return true;
- } else {
- parser.skipChildren();
- }
- }
- } while (true);
-
- return false;
- }
-
- /**
- * Validates the hashes of the dependency.
- *
- * @param dependency the dependency
- * @param checksums the collection of checksums (md5, sha1, sha256)
- * @throws FileNotFoundException thrown if one of the checksums does not
- * match
- */
- private void checkHashes(Dependency dependency, ChecksumsImpl checksums) throws FileNotFoundException {
- final String md5sum = dependency.getMd5sum();
- if (!checksums.getMd5().equals(md5sum)) {
- throw new FileNotFoundException("Artifact found by API is not matching the md5 "
- + "of the artifact (repository hash is " + checksums.getMd5() + WHILE_ACTUAL_IS + md5sum + ") !");
- }
- final String sha1sum = dependency.getSha1sum();
- if (!checksums.getSha1().equals(sha1sum)) {
- throw new FileNotFoundException("Artifact found by API is not matching the SHA1 "
- + "of the artifact (repository hash is " + checksums.getSha1() + WHILE_ACTUAL_IS + sha1sum + ") !");
- }
- final String sha256sum = dependency.getSha256sum();
- if (checksums.getSha256() != null && !checksums.getSha256().equals(sha256sum)) {
- throw new FileNotFoundException("Artifact found by API is not matching the SHA-256 "
- + "of the artifact (repository hash is " + checksums.getSha256() + WHILE_ACTUAL_IS + sha256sum + ") !");
- }
- }
-
/**
* Performs a pre-flight request to ensure the Artifactory service is
* reachable.
@@ -297,17 +154,20 @@ private void checkHashes(Dependency dependency, ChecksumsImpl checksums) throws
* false.
*/
public boolean preflightRequest() {
+ URL url = null;
try {
- final URL url = buildUrl(Checksum.getSHA1Checksum(UUID.randomUUID().toString()));
- final HttpURLConnection connection = connect(url);
- if (connection.getResponseCode() != 200) {
- LOGGER.warn("Expected 200 result from Artifactory ({}), got {}", url, connection.getResponseCode());
- return false;
- }
+ url = buildUrl(Checksum.getSHA1Checksum(UUID.randomUUID().toString()));
+ Downloader.getInstance().fetchContent(url, StandardCharsets.UTF_8);
return true;
} catch (IOException e) {
LOGGER.error("Cannot connect to Artifactory", e);
return false;
+ } catch (TooManyRequestsException e) {
+ LOGGER.warn("Expected 200 result from Artifactory ({}), got 429", url);
+ return false;
+ } catch (ResourceNotFoundException e) {
+ LOGGER.warn("Expected 200 result from Artifactory ({}), got 404", url);
+ return false;
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearchResponseHandler.java b/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearchResponseHandler.java
new file mode 100644
index 00000000000..711bfc657e0
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/artifactory/ArtifactorySearchResponseHandler.java
@@ -0,0 +1,219 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2018 - 2024 Nicolas Henneaux; Hans Aikema. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.artifactory;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.ObjectReader;
+import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.io.HttpClientResponseHandler;
+import org.owasp.dependencycheck.data.nexus.MavenArtifact;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.owasp.dependencycheck.data.artifactory.ArtifactorySearch.X_RESULT_DETAIL_HEADER;
+
+class ArtifactorySearchResponseHandler implements HttpClientResponseHandler> {
+ /**
+ * Pattern to match the path returned by the Artifactory AQL API.
+ */
+ private static final Pattern PATH_PATTERN = Pattern.compile("^/(?.+)/(?[^/]+)/(?[^/]+)/[^/]+$");
+
+ /**
+ * Used for logging.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(ArtifactorySearchResponseHandler.class);
+
+ /**
+ * Search result reader
+ */
+ private final ObjectReader fileImplReader;
+
+ /**
+ * The dependency that is expected to be in the response from Artifactory (if found)
+ */
+ private final Dependency expectedDependency;
+
+ /**
+ * The search request URL i.e., the location at which to search artifacts with checksum information
+ */
+ private final URL sourceUrl;
+
+ /**
+ * Creates a response handler for the response on a single dependency-search attempt.
+ *
+ * @param sourceUrl The search request URL
+ * @param dependency The dependency that is expected to be in the response when found (for validating the FileItem(s) in the response)
+ */
+ ArtifactorySearchResponseHandler(URL sourceUrl, Dependency dependency) {
+ this.fileImplReader = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false).readerFor(FileImpl.class);
+ this.expectedDependency = dependency;
+ this.sourceUrl = sourceUrl;
+ }
+
+ protected boolean init(JsonParser parser) throws IOException {
+ com.fasterxml.jackson.core.JsonToken nextToken = parser.nextToken();
+ if (nextToken != com.fasterxml.jackson.core.JsonToken.START_OBJECT) {
+ throw new IOException("Expected " + com.fasterxml.jackson.core.JsonToken.START_OBJECT + ", got " + nextToken);
+ }
+
+ do {
+ nextToken = parser.nextToken();
+ if (nextToken == null) {
+ break;
+ }
+
+ if (nextToken.isStructStart()) {
+ if (nextToken == com.fasterxml.jackson.core.JsonToken.START_ARRAY && "results".equals(parser.currentName())) {
+ return true;
+ } else {
+ parser.skipChildren();
+ }
+ }
+ } while (true);
+
+ return false;
+ }
+
+ /**
+ * Validates the hashes of the dependency.
+ *
+ * @param checksums the collection of checksums (md5, sha1, [sha256])
+ * @return Whether all available hashes match
+ */
+ private boolean checkHashes(ChecksumsImpl checksums) {
+ final String md5sum = expectedDependency.getMd5sum();
+ final String hashMismatchFormat = "Artifact found by API is not matching the {} of the artifact (repository hash is {} while actual is {}) !";
+ boolean match = true;
+ if (!checksums.getMd5().equals(md5sum)) {
+ LOGGER.warn(hashMismatchFormat, "md5", md5sum, checksums.getMd5());
+ match = false;
+ }
+ final String sha1sum = expectedDependency.getSha1sum();
+ if (!checksums.getSha1().equals(sha1sum)) {
+ LOGGER.warn(hashMismatchFormat, "sha1", sha1sum, checksums.getSha1());
+ match = false;
+ }
+ final String sha256sum = expectedDependency.getSha256sum();
+ /* For SHA-256, we need to validate that the checksum is non-null in the artifactory response.
+ * Extract from Artifactory documentation:
+ * New artifacts that are uploaded to Artifactory 5.5 and later will automatically have their SHA-256 checksum calculated.
+ * However, artifacts that were already hosted in Artifactory before the upgrade will not have their SHA-256 checksum in the database yet.
+ * To make full use of Artifactory's SHA-256 capabilities, you need to Migrate the Database to Include SHA-256 making sure that the record
+ * for each artifact includes its SHA-256 checksum.
+ */
+ if (checksums.getSha256() != null && !checksums.getSha256().equals(sha256sum)) {
+ LOGGER.warn(hashMismatchFormat, "sha256", sha256sum, checksums.getSha256());
+ match = false;
+ }
+ return match;
+ }
+
+ /**
+ * Process the Artifactory response.
+ *
+ * @param response the HTTP response
+ * @return a list of the Maven Artifact information that matches the searched dependency hash
+ * @throws FileNotFoundException When a matching artifact is not found
+ * @throws IOException thrown if there is an I/O error
+ */
+ @Override
+ public List handleResponse(ClassicHttpResponse response) throws IOException {
+ final List result = new ArrayList<>();
+
+ try (InputStreamReader streamReader = new InputStreamReader(response.getEntity().getContent(), StandardCharsets.UTF_8);
+ JsonParser parser = fileImplReader.getFactory().createParser(streamReader)) {
+
+ if (init(parser) && parser.nextToken() == JsonToken.START_OBJECT) {
+ // at least one result
+ do {
+ final FileImpl file = fileImplReader.readValue(parser);
+
+ if (file.getChecksums() == null) {
+ LOGGER.warn(
+ "No checksums found in Artifactory search result for '{}'. " +
+ "Specifically, the result set contains URI '{}' but it is missing the 'checksums' property. " +
+ "Please make sure that the '{}' header is retained on any (reverse-)proxy, load-balancer or Web Application Firewall in the network path to your Artifactory server.",
+ sourceUrl, file.getUri(), X_RESULT_DETAIL_HEADER);
+ continue;
+ }
+
+ final Optional validationResult = validateUsability(file);
+ if (validationResult.isEmpty()) {
+ continue;
+ }
+ final Matcher pathMatcher = validationResult.get();
+
+ final String groupId = pathMatcher.group("groupId").replace('/', '.');
+ final String artifactId = pathMatcher.group("artifactId");
+ final String version = pathMatcher.group("version");
+
+ result.add(new MavenArtifact(groupId, artifactId, version, file.getDownloadUri(),
+ MavenArtifact.derivePomUrl(artifactId, version, file.getDownloadUri())));
+
+ } while (parser.nextToken() == JsonToken.START_OBJECT);
+ } else {
+ throw new FileNotFoundException("Artifact " + expectedDependency + " not found in Artifactory");
+ }
+ }
+ if (result.isEmpty()) {
+ throw new FileNotFoundException("Artifact " + expectedDependency
+ + " not found in Artifactory; discovered SHA1 hits not recognized as matching Maven artifacts");
+ }
+ return result;
+ }
+
+ /**
+ * Validate the FileImpl result for usability as a dependency.
+ *
+ * Checks that the file actually matches all known hashes and the path appears to match a maven repository G/A/V pattern.
+ *
+ * @param file The FileImpl from an Artifactory search response
+ * @return An Optional with the Matcher for the file path to retrieve the Maven G/A/V coordinates in case the result is usable for further
+ * processing, otherwise an empty Optional.
+ */
+ private Optional validateUsability(FileImpl file) {
+ final Optional result;
+ if (!checkHashes(file.getChecksums())) {
+ result = Optional.empty();
+ } else {
+ final Matcher pathMatcher = PATH_PATTERN.matcher(file.getPath());
+ if (!pathMatcher.matches()) {
+ LOGGER.debug("Cannot extract the Maven information from the path retrieved in Artifactory {}", file.getPath());
+ result = Optional.empty();
+ } else {
+ result = Optional.of(pathMatcher);
+ }
+ }
+ return result;
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCache.java b/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCache.java
index 9a86e1e74e5..d82f8482d42 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCache.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCache.java
@@ -17,7 +17,7 @@
*/
package org.owasp.dependencycheck.data.cache;
-import org.apache.commons.jcs.access.CacheAccess;
+import org.apache.commons.jcs3.access.CacheAccess;
/**
* A generic wrapper for the Java Caching System (JCS).
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCacheFactory.java b/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCacheFactory.java
index a0c63862f75..b5e8f6b8ddc 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCacheFactory.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/cache/DataCacheFactory.java
@@ -22,11 +22,11 @@
import java.io.InputStream;
import java.util.List;
import java.util.Properties;
-import org.apache.commons.jcs.JCS;
-import org.apache.commons.jcs.access.CacheAccess;
-import org.apache.commons.jcs.access.exception.CacheException;
-import org.apache.commons.jcs.engine.CompositeCacheAttributes;
-import org.apache.commons.jcs.engine.behavior.ICompositeCacheAttributes;
+import org.apache.commons.jcs3.JCS;
+import org.apache.commons.jcs3.access.CacheAccess;
+import org.apache.commons.jcs3.access.exception.CacheException;
+import org.apache.commons.jcs3.engine.CompositeCacheAttributes;
+import org.apache.commons.jcs3.engine.behavior.ICompositeCacheAttributes;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.data.nodeaudit.Advisory;
import org.owasp.dependencycheck.utils.FileUtils;
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java b/core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
index 2ad37f41906..3ee1135a1ec 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
@@ -17,34 +17,35 @@
*/
package org.owasp.dependencycheck.data.central;
+import org.apache.hc.client5.http.impl.classic.AbstractHttpClientResponseHandler;
+import org.apache.hc.core5.http.message.BasicHeader;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ForbiddenException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
import org.owasp.dependencycheck.utils.TooManyRequestsException;
import java.io.FileNotFoundException;
import java.io.IOException;
-import java.net.HttpURLConnection;
import java.net.MalformedURLException;
import java.net.URISyntaxException;
import java.net.URL;
import java.util.ArrayList;
import java.util.List;
import javax.annotation.concurrent.ThreadSafe;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.ParserConfigurationException;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
-import org.apache.commons.jcs.access.exception.CacheException;
+import org.apache.commons.jcs3.access.exception.CacheException;
import org.owasp.dependencycheck.data.cache.DataCache;
import org.owasp.dependencycheck.data.cache.DataCacheFactory;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.URLConnectionFactory;
-import org.owasp.dependencycheck.utils.XmlUtils;
+import org.owasp.dependencycheck.utils.ToXMLDocumentResponseHandler;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
import org.w3c.dom.NodeList;
-import org.xml.sax.SAXException;
/**
* Class of methods to search Maven Central via Central.
@@ -105,7 +106,7 @@ public CentralSearch(Settings settings) throws MalformedURLException {
}
this.query = queryStr;
LOGGER.debug("Central Search Full URL: {}", String.format(query, rootURL, "[SHA1]"));
- if (null != settings.getString(Settings.KEYS.PROXY_SERVER)) {
+ if (null != settings.getString(Settings.KEYS.PROXY_SERVER) || null != System.getProperty("https.proxyHost")) {
useProxy = true;
LOGGER.debug("Using proxy");
} else {
@@ -135,14 +136,14 @@ public CentralSearch(Settings settings) throws MalformedURLException {
* @throws TooManyRequestsException if Central has received too many
* requests.
*/
- public List searchSha1(String sha1) throws IOException, TooManyRequestsException {
+ public List searchSha1(String sha1) throws IOException, TooManyRequestsException, ForbiddenException {
if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
throw new IllegalArgumentException("Invalid SHA1 format");
}
if (cache != null) {
final List cached = cache.get(sha1);
if (cached != null) {
- LOGGER.debug("cache hit for Central: " + sha1);
+ LOGGER.debug("cache hit for Central: {}", sha1);
if (cached.isEmpty()) {
throw new FileNotFoundException("Artifact not found in Central");
}
@@ -154,68 +155,13 @@ public List searchSha1(String sha1) throws IOException, TooManyRe
LOGGER.trace("Searching Central url {}", url);
- // Determine if we need to use a proxy. The rules:
- // 1) If the proxy is set, AND the setting is set to true, use the proxy
- // 2) Otherwise, don't use the proxy (either the proxy isn't configured,
- // or proxy is specifically set to false)
- final URLConnectionFactory factory = new URLConnectionFactory(settings);
- final HttpURLConnection conn = factory.createHttpURLConnection(url, useProxy);
-
- conn.setDoOutput(true);
-
// JSON would be more elegant, but there's not currently a dependency
// on JSON, so don't want to add one just for this
- conn.addRequestProperty("Accept", "application/xml");
- conn.connect();
-
- if (conn.getResponseCode() == 200) {
- boolean missing = false;
- try {
- final DocumentBuilder builder = XmlUtils.buildSecureDocumentBuilder();
- final Document doc = builder.parse(conn.getInputStream());
- final XPath xpath = XPathFactory.newInstance().newXPath();
- final String numFound = xpath.evaluate("/response/result/@numFound", doc);
- if ("0".equals(numFound)) {
- missing = true;
- } else {
- final NodeList docs = (NodeList) xpath.evaluate("/response/result/doc", doc, XPathConstants.NODESET);
- for (int i = 0; i < docs.getLength(); i++) {
- final String g = xpath.evaluate("./str[@name='g']", docs.item(i));
- LOGGER.trace("GroupId: {}", g);
- final String a = xpath.evaluate("./str[@name='a']", docs.item(i));
- LOGGER.trace("ArtifactId: {}", a);
- final String v = xpath.evaluate("./str[@name='v']", docs.item(i));
- final NodeList attributes = (NodeList) xpath.evaluate("./arr[@name='ec']/str", docs.item(i), XPathConstants.NODESET);
- boolean pomAvailable = false;
- boolean jarAvailable = false;
- for (int x = 0; x < attributes.getLength(); x++) {
- final String tmp = xpath.evaluate(".", attributes.item(x));
- if (".pom".equals(tmp)) {
- pomAvailable = true;
- } else if (".jar".equals(tmp)) {
- jarAvailable = true;
- }
- }
- final String centralContentUrl = settings.getString(Settings.KEYS.CENTRAL_CONTENT_URL);
- String artifactUrl = null;
- String pomUrl = null;
- if (jarAvailable) {
- //org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.pom
- artifactUrl = centralContentUrl + g.replace('.', '/') + '/' + a + '/'
- + v + '/' + a + '-' + v + ".jar";
- }
- if (pomAvailable) {
- //org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.pom
- pomUrl = centralContentUrl + g.replace('.', '/') + '/' + a + '/'
- + v + '/' + a + '-' + v + ".pom";
- }
- result.add(new MavenArtifact(g, a, v, artifactUrl, pomUrl));
- }
- }
- } catch (ParserConfigurationException | IOException | SAXException | XPathExpressionException e) {
- // Anything else is jacked up XML stuff that we really can't recover from well
- throw new IOException(e.getMessage(), e);
- }
+ final BasicHeader acceptHeader = new BasicHeader("Accept", "application/xml");
+ final AbstractHttpClientResponseHandler handler = new ToXMLDocumentResponseHandler();
+ try {
+ final Document doc = Downloader.getInstance().fetchAndHandle(url, handler, List.of(acceptHeader), useProxy);
+ final boolean missing = addMavenArtifacts(doc, result);
if (missing) {
if (cache != null) {
@@ -223,12 +169,21 @@ public List searchSha1(String sha1) throws IOException, TooManyRe
}
throw new FileNotFoundException("Artifact not found in Central");
}
- } else if (conn.getResponseCode() == 429) {
+ } catch (XPathExpressionException e) {
+ final String errorMessage = "Failed to parse MavenCentral XML Response: " + e.getMessage();
+ throw new IOException(errorMessage, e);
+ } catch (TooManyRequestsException e) {
final String errorMessage = "Too many requests sent to MavenCentral; additional requests are being rejected.";
- throw new TooManyRequestsException(errorMessage);
- } else {
- final String errorMessage = "Could not connect to MavenCentral (" + conn.getResponseCode() + "): " + conn.getResponseMessage();
- throw new IOException(errorMessage);
+ throw new TooManyRequestsException(errorMessage, e);
+ } catch (ResourceNotFoundException | DownloadFailedException e) {
+ final String errorMessage = "Could not connect to MavenCentral " + e.getMessage();
+ throw new IOException(errorMessage, e);
+ } catch (URISyntaxException e) {
+ final String errorMessage = "Could not convert central search URL to a URI " + e.getMessage();
+ throw new IOException(errorMessage, e);
+ } catch (ForbiddenException e) {
+ final String errorMessage = "Forbidden access to MavenCentral " + e.getMessage();
+ throw new ForbiddenException(errorMessage, e);
}
if (cache != null) {
cache.put(sha1, result);
@@ -236,6 +191,56 @@ public List searchSha1(String sha1) throws IOException, TooManyRe
return result;
}
+ /**
+ * Collect the artifacts from a MavenCentral search result and add them to the list.
+ * @param doc The Document received in response to the SHA1 search-request
+ * @param result The list of MavenArtifacts to which found artifacts will be added
+ * @return Whether the given document holds no search results
+ */
+ private boolean addMavenArtifacts(Document doc, List result) throws XPathExpressionException {
+ boolean missing = false;
+ final XPath xpath = XPathFactory.newInstance().newXPath();
+ final String numFound = xpath.evaluate("/response/result/@numFound", doc);
+ if ("0".equals(numFound)) {
+ missing = true;
+ } else {
+ final NodeList docs = (NodeList) xpath.evaluate("/response/result/doc", doc, XPathConstants.NODESET);
+ for (int i = 0; i < docs.getLength(); i++) {
+ final String g = xpath.evaluate("./str[@name='g']", docs.item(i));
+ LOGGER.trace("GroupId: {}", g);
+ final String a = xpath.evaluate("./str[@name='a']", docs.item(i));
+ LOGGER.trace("ArtifactId: {}", a);
+ final String v = xpath.evaluate("./str[@name='v']", docs.item(i));
+ final NodeList attributes = (NodeList) xpath.evaluate("./arr[@name='ec']/str", docs.item(i), XPathConstants.NODESET);
+ boolean pomAvailable = false;
+ boolean jarAvailable = false;
+ for (int x = 0; x < attributes.getLength(); x++) {
+ final String tmp = xpath.evaluate(".", attributes.item(x));
+ if (".pom".equals(tmp)) {
+ pomAvailable = true;
+ } else if (".jar".equals(tmp)) {
+ jarAvailable = true;
+ }
+ }
+ final String centralContentUrl = settings.getString(Settings.KEYS.CENTRAL_CONTENT_URL);
+ String artifactUrl = null;
+ String pomUrl = null;
+ if (jarAvailable) {
+ //org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.pom
+ artifactUrl = centralContentUrl + g.replace('.', '/') + '/' + a + '/'
+ + v + '/' + a + '-' + v + ".jar";
+ }
+ if (pomAvailable) {
+ //org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.pom
+ pomUrl = centralContentUrl + g.replace('.', '/') + '/' + a + '/'
+ + v + '/' + a + '-' + v + ".pom";
+ }
+ result.add(new MavenArtifact(g, a, v, artifactUrl, pomUrl));
+ }
+ }
+ return missing;
+ }
+
/**
* Tests to determine if the given URL is invalid.
*
@@ -252,4 +257,5 @@ private boolean isInvalidURL(String url) {
}
return false;
}
+
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java b/core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
index e3b4bae65f5..2155b30fcef 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
@@ -20,19 +20,20 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import javax.json.Json;
-import javax.json.JsonArray;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-import javax.json.stream.JsonParsingException;
+import jakarta.json.Json;
+import jakarta.json.JsonArray;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import jakarta.json.stream.JsonParsingException;
import java.io.InputStream;
import java.util.ArrayList;
import java.util.List;
import javax.annotation.concurrent.NotThreadSafe;
/**
- * Parses a Composer.lock file from an input stream. In a separate class so it can hopefully be injected.
+ * Parses a Composer.lock file from an input stream. In a separate class so it
+ * can hopefully be injected.
*
* @author colezlaw
*/
@@ -43,12 +44,14 @@ public class ComposerLockParser {
* The JsonReader for parsing JSON
*/
private final JsonReader jsonReader;
-
/**
* The List of ComposerDependencies found
*/
private final List composerDependencies;
-
+ /**
+ * Whether to skip dev dependencies.
+ */
+ private final boolean skipDev;
/**
* The LOGGER
*/
@@ -58,11 +61,13 @@ public class ComposerLockParser {
* Creates a ComposerLockParser from a JsonReader and an InputStream.
*
* @param inputStream the InputStream to parse
+ * @param skipDev whether to skip dev dependencies
*/
- public ComposerLockParser(InputStream inputStream) {
+ public ComposerLockParser(InputStream inputStream, boolean skipDev) {
LOGGER.debug("Creating a ComposerLockParser");
this.jsonReader = Json.createReader(inputStream);
this.composerDependencies = new ArrayList<>();
+ this.skipDev = skipDev;
}
/**
@@ -76,26 +81,14 @@ public void process() {
LOGGER.debug("Found packages");
final JsonArray packages = composer.getJsonArray("packages");
for (JsonObject pkg : packages.getValuesAs(JsonObject.class)) {
- if (pkg.containsKey("name")) {
- final String groupName = pkg.getString("name");
- if (groupName.indexOf('/') >= 0 && groupName.indexOf('/') <= groupName.length() - 1) {
- if (pkg.containsKey("version")) {
- final String group = groupName.substring(0, groupName.indexOf('/'));
- final String project = groupName.substring(groupName.indexOf('/') + 1);
- String version = pkg.getString("version");
- // Some version numbers begin with v - which doesn't end up matching CPE's
- if (version.startsWith("v")) {
- version = version.substring(1);
- }
- LOGGER.debug("Got package {}/{}/{}", group, project, version);
- composerDependencies.add(new ComposerDependency(group, project, version));
- } else {
- LOGGER.debug("Group/package {} does not have a version", groupName);
- }
- } else {
- LOGGER.debug("Got a dependency with no name");
- }
- }
+ processPackageEntry(pkg);
+ }
+ }
+ if (composer.containsKey("packages-dev") && !skipDev) {
+ LOGGER.debug("Found packages-dev");
+ final JsonArray devPackages = composer.getJsonArray("packages-dev");
+ for (JsonObject pkg : devPackages.getValuesAs(JsonObject.class)) {
+ processPackageEntry(pkg);
}
}
} catch (JsonParsingException jsonpe) {
@@ -109,6 +102,29 @@ public void process() {
}
}
+ protected void processPackageEntry(JsonObject pkg) {
+ if (pkg.containsKey("name")) {
+ final String groupName = pkg.getString("name");
+ if (groupName.indexOf('/') >= 0 && groupName.indexOf('/') <= groupName.length() - 1) {
+ if (pkg.containsKey("version")) {
+ final String group = groupName.substring(0, groupName.indexOf('/'));
+ final String project = groupName.substring(groupName.indexOf('/') + 1);
+ String version = pkg.getString("version");
+ // Some version numbers begin with v - which doesn't end up matching CPE's
+ if (version.startsWith("v")) {
+ version = version.substring(1);
+ }
+ LOGGER.debug("Got package {}/{}/{}", group, project, version);
+ composerDependencies.add(new ComposerDependency(group, project, version));
+ } else {
+ LOGGER.debug("Group/package {} does not have a version", groupName);
+ }
+ } else {
+ LOGGER.debug("Got a dependency with no name");
+ }
+ }
+ }
+
/**
* Gets the list of dependencies.
*
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/cpe/AbstractMemoryIndex.java b/core/src/main/java/org/owasp/dependencycheck/data/cpe/AbstractMemoryIndex.java
index d3613a73c8c..5f1b35c5fff 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/cpe/AbstractMemoryIndex.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/cpe/AbstractMemoryIndex.java
@@ -50,6 +50,7 @@
import org.owasp.dependencycheck.utils.Settings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import org.slf4j.bridge.SLF4JBridgeHandler;
/**
*
@@ -67,6 +68,12 @@
@ThreadSafe
public abstract class AbstractMemoryIndex implements MemoryIndex {
+ static {
+ // Ensure Lucene uses SLF4J for logging
+ SLF4JBridgeHandler.removeHandlersForRootLogger();
+ SLF4JBridgeHandler.install();
+ }
+
/**
* The logger.
*/
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/elixir/MixAuditJsonParser.java b/core/src/main/java/org/owasp/dependencycheck/data/elixir/MixAuditJsonParser.java
index c6c85dab80f..3832cf0d82e 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/elixir/MixAuditJsonParser.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/elixir/MixAuditJsonParser.java
@@ -23,16 +23,16 @@
import javax.annotation.concurrent.NotThreadSafe;
-import javax.json.stream.JsonParsingException;
+import jakarta.json.stream.JsonParsingException;
import java.io.Reader;
import java.util.ArrayList;
import java.util.List;
-import javax.json.Json;
-import javax.json.JsonArray;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-import javax.json.JsonString;
+import jakarta.json.Json;
+import jakarta.json.JsonArray;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import jakarta.json.JsonString;
/**
* Parses json output from `mix_audit --format json`.
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModDependency.java b/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModDependency.java
index 9975329210d..4fa77a00cef 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModDependency.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModDependency.java
@@ -19,13 +19,6 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURLBuilder;
-import java.io.File;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
-import org.apache.commons.io.FileUtils;
import org.apache.commons.lang3.StringUtils;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
@@ -33,12 +26,20 @@
import org.owasp.dependencycheck.dependency.naming.GenericIdentifier;
import org.owasp.dependencycheck.dependency.naming.Identifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
+import org.owasp.dependencycheck.utils.Checksum;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
import static org.owasp.dependencycheck.analyzer.GolangModAnalyzer.DEPENDENCY_ECOSYSTEM;
import static org.owasp.dependencycheck.analyzer.GolangModAnalyzer.GO_MOD;
-import org.owasp.dependencycheck.utils.Checksum;
/**
* Represents a Go module dependency.
@@ -185,7 +186,6 @@ private Dependency createDependency(Dependency parentDependency, String name, St
* Extracts the content of the license file into the dependency's license
* field.
*
- *
* @param dependency the dependency being analyzed
* @param file the license file
*/
@@ -195,7 +195,7 @@ private void extractLicense(Dependency dependency, File file) {
for (File f : files) {
if (LICENSE_FILES.contains(f.getName().toUpperCase())) {
try {
- final String license = FileUtils.readFileToString(f, StandardCharsets.UTF_8);
+ final String license = new String(Files.readAllBytes(f.toPath()), StandardCharsets.UTF_8);
dependency.setLicense(license);
break;
} catch (IOException ex) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModJsonParser.java b/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModJsonParser.java
index 17d9d9d1a40..7f683295cea 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModJsonParser.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/golang/GoModJsonParser.java
@@ -23,13 +23,13 @@
import java.util.List;
import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonArray;
-import javax.json.JsonException;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-import javax.json.JsonReaderFactory;
-import javax.json.stream.JsonParsingException;
+import jakarta.json.Json;
+import jakarta.json.JsonArray;
+import jakarta.json.JsonException;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import jakarta.json.JsonReaderFactory;
+import jakarta.json.stream.JsonParsingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericFilter.java b/core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericFilter.java
index ae0e8862dea..aa5b326248c 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericFilter.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/lucene/AlphaNumericFilter.java
@@ -28,9 +28,10 @@
/**
* A simple alphanumeric filter that removes non-alphanumeric characters from
* the terms. If a term contains a non-alphanumeric character it may be split
- * into multiple terms:
+ * into multiple terms.
*
- *
+ *
+ * Filtering examples
* | term | results in |
|---|
* | bob | bob |
* | bob-cat | bob cat |
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java b/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
index 4670966fe19..264d0a84c09 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
@@ -13,76 +13,13 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*
- * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ * Copyright (c) 2023 Jeremy Long. All Rights Reserved.
*/
package org.owasp.dependencycheck.data.nexus;
-import java.io.FileNotFoundException;
import java.io.IOException;
-import java.net.HttpURLConnection;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.nio.charset.StandardCharsets;
-import java.util.Base64;
-import javax.annotation.concurrent.ThreadSafe;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.xpath.XPath;
-import javax.xml.xpath.XPathExpressionException;
-import javax.xml.xpath.XPathFactory;
-import org.owasp.dependencycheck.utils.Settings;
-
-import org.owasp.dependencycheck.utils.URLConnectionFactory;
-import org.owasp.dependencycheck.utils.XmlUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.w3c.dom.Document;
-import org.xml.sax.SAXException;
-
-/**
- * Class of methods to search Nexus repositories.
- *
- * @author colezlaw
- */
-@ThreadSafe
-public class NexusSearch {
-
- /**
- * The root URL for the Nexus repository service.
- */
- private final URL rootURL;
-
- /**
- * Whether to use the Proxy when making requests.
- */
- private final boolean useProxy;
- /**
- * The configured settings.
- */
- private final Settings settings;
- /**
- * Used for logging.
- */
- private static final Logger LOGGER = LoggerFactory.getLogger(NexusSearch.class);
-
- /**
- * Creates a NexusSearch for the given repository URL.
- *
- * @param settings the configured settings
- * @param useProxy flag indicating if the proxy settings should be used
- * @throws java.net.MalformedURLException thrown if the configured URL is
- * invalid
- */
- public NexusSearch(Settings settings, boolean useProxy) throws MalformedURLException {
- this.settings = settings;
- this.useProxy = useProxy;
-
- final String searchUrl = settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
- LOGGER.debug("Nexus Search URL: {}", searchUrl);
- this.rootURL = new URL(searchUrl);
-
- }
+public interface NexusSearch {
/**
* Searches the configured Nexus repository for the given sha1 hash. If the
* artifact is found, a MavenArtifact is populated with the
@@ -91,135 +28,14 @@ public NexusSearch(Settings settings, boolean useProxy) throws MalformedURLExcep
* @param sha1 The SHA-1 hash string for which to search
* @return the populated Maven coordinates
* @throws IOException if it's unable to connect to the specified repository
- * or if the specified artifact is not found.
+ * or if the specified artifact is not found.
*/
- public MavenArtifact searchSha1(String sha1) throws IOException {
- if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
- throw new IllegalArgumentException("Invalid SHA1 format");
- }
-
- final URL url = new URL(rootURL, String.format("identify/sha1/%s",
- sha1.toLowerCase()));
-
- LOGGER.debug("Searching Nexus url {}", url);
-
- // Determine if we need to use a proxy. The rules:
- // 1) If the proxy is set, AND the setting is set to true, use the proxy
- // 2) Otherwise, don't use the proxy (either the proxy isn't configured,
- // or proxy is specifically set to false
- final HttpURLConnection conn;
- final URLConnectionFactory factory = new URLConnectionFactory(settings);
- conn = factory.createHttpURLConnection(url, useProxy);
- conn.setDoOutput(true);
- final String authHeader = buildHttpAuthHeaderValue();
- if (!authHeader.isEmpty()) {
- conn.addRequestProperty("Authorization", authHeader);
- }
-
- // JSON would be more elegant, but there's not currently a dependency
- // on JSON, so don't want to add one just for this
- conn.addRequestProperty("Accept", "application/xml");
- conn.connect();
-
- switch (conn.getResponseCode()) {
- case 200:
- try {
- final DocumentBuilder builder = XmlUtils.buildSecureDocumentBuilder();
- final Document doc = builder.parse(conn.getInputStream());
- final XPath xpath = XPathFactory.newInstance().newXPath();
- final String groupId = xpath
- .evaluate(
- "/org.sonatype.nexus.rest.model.NexusArtifact/groupId",
- doc);
- final String artifactId = xpath.evaluate(
- "/org.sonatype.nexus.rest.model.NexusArtifact/artifactId",
- doc);
- final String version = xpath
- .evaluate(
- "/org.sonatype.nexus.rest.model.NexusArtifact/version",
- doc);
- final String link = xpath
- .evaluate(
- "/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink",
- doc);
- final String pomLink = xpath
- .evaluate(
- "/org.sonatype.nexus.rest.model.NexusArtifact/pomLink",
- doc);
- final MavenArtifact ma = new MavenArtifact(groupId, artifactId, version);
- if (link != null && !link.isEmpty()) {
- ma.setArtifactUrl(link);
- }
- if (pomLink != null && !pomLink.isEmpty()) {
- ma.setPomUrl(pomLink);
- }
- return ma;
- } catch (ParserConfigurationException | IOException | SAXException | XPathExpressionException e) {
- // Anything else is jacked-up XML stuff that we really can't recover
- // from well
- throw new IOException(e.getMessage(), e);
- }
- case 404:
- throw new FileNotFoundException("Artifact not found in Nexus");
- default:
- LOGGER.debug("Could not connect to Nexus received response code: {} {}",
- conn.getResponseCode(), conn.getResponseMessage());
- throw new IOException("Could not connect to Nexus");
- }
- }
+ MavenArtifact searchSha1(String sha1) throws IOException;
/**
* Do a preflight request to see if the repository is actually working.
*
- * @return whether the repository is listening and returns the /status URL
- * correctly
- */
- public boolean preflightRequest() {
- final HttpURLConnection conn;
- try {
- final URL url = new URL(rootURL, "status");
- final URLConnectionFactory factory = new URLConnectionFactory(settings);
- conn = factory.createHttpURLConnection(url, useProxy);
- conn.addRequestProperty("Accept", "application/xml");
- final String authHeader = buildHttpAuthHeaderValue();
- if (!authHeader.isEmpty()) {
- conn.addRequestProperty("Authorization", authHeader);
- }
- conn.connect();
- if (conn.getResponseCode() != 200) {
- LOGGER.warn("Expected 200 result from Nexus, got {}", conn.getResponseCode());
- return false;
- }
- final DocumentBuilder builder = XmlUtils.buildSecureDocumentBuilder();
-
- final Document doc = builder.parse(conn.getInputStream());
- if (!"status".equals(doc.getDocumentElement().getNodeName())) {
- LOGGER.warn("Expected root node name of status, got {}", doc.getDocumentElement().getNodeName());
- return false;
- }
- } catch (IOException | ParserConfigurationException | SAXException e) {
- LOGGER.warn("Pre-flight request to Nexus failed: ", e);
- return false;
- }
- return true;
- }
-
- /**
- * Constructs the base64 encoded basic authentication header value.
- *
- * @return the base64 encoded basic authentication header value
+ * @return whether the repository is listening and returns the expected status response
*/
- private String buildHttpAuthHeaderValue() {
- final String user = settings.getString(Settings.KEYS.ANALYZER_NEXUS_USER, "");
- final String pass = settings.getString(Settings.KEYS.ANALYZER_NEXUS_PASSWORD, "");
- String result = "";
- if (user.isEmpty() || pass.isEmpty()) {
- LOGGER.debug("Skip authentication as user and/or password for nexus is empty");
- } else {
- final String auth = user + ':' + pass;
- final String base64Auth = Base64.getEncoder().encodeToString(auth.getBytes(StandardCharsets.UTF_8));
- result = "Basic " + base64Auth;
- }
- return result;
- }
+ boolean preflightRequest();
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV2Search.java b/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV2Search.java
new file mode 100644
index 00000000000..9e2401fc3e8
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV2Search.java
@@ -0,0 +1,174 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nexus;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.net.MalformedURLException;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.util.List;
+import javax.annotation.concurrent.ThreadSafe;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathExpressionException;
+import javax.xml.xpath.XPathFactory;
+
+import org.apache.hc.client5.http.HttpResponseException;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.message.BasicHeader;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ForbiddenException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
+import org.owasp.dependencycheck.utils.Settings;
+
+import org.owasp.dependencycheck.utils.ToXMLDocumentResponseHandler;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.w3c.dom.Document;
+
+/**
+ * Class of methods to search Nexus repositories.
+ *
+ * @author colezlaw
+ */
+@ThreadSafe
+public class NexusV2Search implements NexusSearch {
+
+ /**
+ * The root URL for the Nexus repository service.
+ */
+ private final URL rootURL;
+
+ /**
+ * Whether to use the Proxy when making requests.
+ */
+ private final boolean useProxy;
+ /**
+ * The configured settings.
+ */
+ private final Settings settings;
+ /**
+ * Used for logging.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(NexusV2Search.class);
+
+ /**
+ * Creates a NexusSearch for the given repository URL.
+ *
+ * @param settings the configured settings
+ * @param useProxy flag indicating if the proxy settings should be used
+ * @throws java.net.MalformedURLException thrown if the configured URL is
+ * invalid
+ */
+ public NexusV2Search(Settings settings, boolean useProxy) throws MalformedURLException {
+ this.settings = settings;
+ this.useProxy = useProxy;
+
+ final String searchUrl = settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+ LOGGER.debug("Nexus Search URL: {}", searchUrl);
+ this.rootURL = new URL(searchUrl);
+
+ }
+
+ @Override
+ public MavenArtifact searchSha1(String sha1) throws IOException {
+ if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
+ throw new IllegalArgumentException("Invalid SHA1 format");
+ }
+
+ final URL url = new URL(rootURL, String.format("identify/sha1/%s",
+ sha1.toLowerCase()));
+
+ LOGGER.debug("Searching Nexus url {}", url);
+
+ try {
+ // JSON would be more elegant, but there's not currently a dependency
+ // on JSON, so don't want to add one just for this
+ final ToXMLDocumentResponseHandler handler = new ToXMLDocumentResponseHandler();
+ final Document doc = Downloader.getInstance().fetchAndHandle(url, handler, List.of(new BasicHeader(HttpHeaders.ACCEPT,
+ ContentType.APPLICATION_XML)));
+ final XPath xpath = XPathFactory.newInstance().newXPath();
+ final String groupId = xpath
+ .evaluate(
+ "/org.sonatype.nexus.rest.model.NexusArtifact/groupId",
+ doc);
+ final String artifactId = xpath.evaluate(
+ "/org.sonatype.nexus.rest.model.NexusArtifact/artifactId",
+ doc);
+ final String version = xpath
+ .evaluate(
+ "/org.sonatype.nexus.rest.model.NexusArtifact/version",
+ doc);
+ final String link = xpath
+ .evaluate(
+ "/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink",
+ doc);
+ final String pomLink = xpath
+ .evaluate(
+ "/org.sonatype.nexus.rest.model.NexusArtifact/pomLink",
+ doc);
+ final MavenArtifact ma = new MavenArtifact(groupId, artifactId, version);
+ if (link != null && !link.isEmpty()) {
+ ma.setArtifactUrl(link);
+ }
+ if (pomLink != null && !pomLink.isEmpty()) {
+ ma.setPomUrl(pomLink);
+ }
+ return ma;
+ } catch (DownloadFailedException | TooManyRequestsException e) {
+ if (LOGGER.isDebugEnabled()) {
+ int responseCode = -1;
+ String responseMessage = "";
+ if (e.getCause() instanceof HttpResponseException) {
+ final HttpResponseException cause = (HttpResponseException) e.getCause();
+ responseCode = cause.getStatusCode();
+ responseMessage = cause.getReasonPhrase();
+ }
+ LOGGER.debug("Could not connect to Nexus received response code: {} {}",
+ responseCode, responseMessage);
+ }
+ throw new IOException("Could not connect to Nexus");
+ } catch (ResourceNotFoundException e) {
+ throw new FileNotFoundException("Artifact not found in Nexus");
+ } catch (XPathExpressionException | URISyntaxException | ForbiddenException e) {
+ throw new IOException(e.getMessage(), e);
+ }
+ }
+
+ @Override
+ public boolean preflightRequest() {
+ try {
+ final URL url = new URL(rootURL, "status");
+ final ToXMLDocumentResponseHandler handler = new ToXMLDocumentResponseHandler();
+ final Document doc = Downloader.getInstance().fetchAndHandle(url, handler, List.of(new BasicHeader(HttpHeaders.ACCEPT,
+ ContentType.APPLICATION_XML)));
+ if (!"status".equals(doc.getDocumentElement().getNodeName())) {
+ LOGGER.warn("Pre-flight request to Nexus failed; expected root node name of status, got {}", doc.getDocumentElement().getNodeName());
+ return false;
+ }
+ } catch (IOException | TooManyRequestsException | ResourceNotFoundException | URISyntaxException e) {
+ LOGGER.warn("Pre-flight request to Nexus failed: ", e);
+ return false;
+ }
+ return true;
+ }
+
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV3Search.java b/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV3Search.java
new file mode 100644
index 00000000000..8bb31bc7573
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusV3Search.java
@@ -0,0 +1,287 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2023 Hans Aikema. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.nexus;
+
+import org.apache.hc.client5.http.HttpResponseException;
+import org.apache.hc.client5.http.impl.classic.AbstractHttpClientResponseHandler;
+import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.message.BasicHeader;
+import org.jetbrains.annotations.Nullable;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ForbiddenException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.annotation.concurrent.ThreadSafe;
+import jakarta.json.Json;
+import jakarta.json.JsonArray;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import java.io.BufferedReader;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.StringReader;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+/**
+ * Class of methods to search Nexus v3 repositories.
+ *
+ * @author Hans Aikema
+ */
+@ThreadSafe
+public class NexusV3Search implements NexusSearch {
+
+ /**
+ * By default, NexusV3Search accepts only classifier-less artifacts.
+ *
+ * This prevents, among others, sha1-collisions for empty jars on empty javadoc/sources jars.
+ * See e.g. issues #5559 and #5118
+ */
+ private final Set acceptedClassifiers = new HashSet<>();
+
+ /**
+ * The root URL for the Nexus repository service.
+ */
+ private final URL rootURL;
+
+ /**
+ * Whether to use the Proxy when making requests.
+ */
+ private final boolean useProxy;
+ /**
+ * The configured settings.
+ */
+ private final Settings settings;
+ /**
+ * Used for logging.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(NexusV3Search.class);
+
+ /**
+ * Creates a NexusV3Search for the given repository URL.
+ *
+ * @param settings the configured settings
+ * @param useProxy flag indicating if the proxy settings should be used
+ * @throws MalformedURLException thrown if the configured URL is
+ * invalid
+ */
+ public NexusV3Search(Settings settings, boolean useProxy) throws MalformedURLException {
+ this.settings = settings;
+ this.useProxy = useProxy;
+ this.acceptedClassifiers.add(null);
+ final String searchUrl = settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+ LOGGER.debug("Nexus Search URL: {}", searchUrl);
+ this.rootURL = new URL(searchUrl);
+
+ }
+
+ @Override
+ public MavenArtifact searchSha1(String sha1) throws IOException {
+ if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
+ throw new IllegalArgumentException("Invalid SHA1 format");
+ }
+
+ final List collectedMatchingArtifacts = new ArrayList<>(1);
+ try (CloseableHttpClient client = Downloader.getInstance().getHttpClient(useProxy)) {
+ String continuationToken = retrievePageAndAddMatchingArtifact(client, collectedMatchingArtifacts, sha1, null);
+ while (continuationToken != null && collectedMatchingArtifacts.isEmpty()) {
+ continuationToken = retrievePageAndAddMatchingArtifact(client, collectedMatchingArtifacts, sha1, continuationToken);
+ }
+ }
+ if (collectedMatchingArtifacts.isEmpty()) {
+ throw new FileNotFoundException("Artifact not found in Nexus");
+ } else {
+ return collectedMatchingArtifacts.get(0);
+ }
+ }
+
+ private String retrievePageAndAddMatchingArtifact(CloseableHttpClient client, List collectedMatchingArtifacts, String sha1,
+ @Nullable String continuationToken) throws IOException {
+ final URL url;
+ LOGGER.debug("Search with continuation token {}", continuationToken);
+ if (continuationToken == null) {
+ url = new URL(rootURL, String.format("v1/search/?sha1=%s",
+ sha1.toLowerCase()));
+ } else {
+ url = new URL(rootURL, String.format("v1/search/?sha1=%s&continuationToken=%s",
+ sha1.toLowerCase(), continuationToken));
+ }
+
+ LOGGER.debug("Searching Nexus url {}", url);
+ // Determine if we need to use a proxy. The rules:
+ // 1) If the proxy is set, AND the setting is set to true, use the proxy
+ // 2) Otherwise, don't use the proxy (either the proxy isn't configured,
+ // or proxy is specifically set to false
+ final NexusV3SearchResponseHandler handler = new NexusV3SearchResponseHandler(collectedMatchingArtifacts, sha1, acceptedClassifiers);
+ try {
+ return Downloader.getInstance().fetchAndHandle(client, url, handler, List.of(new BasicHeader(HttpHeaders.ACCEPT,
+ ContentType.APPLICATION_JSON)));
+ } catch (TooManyRequestsException | ResourceNotFoundException | DownloadFailedException | ForbiddenException e) {
+ if (LOGGER.isDebugEnabled()) {
+ int responseCode = -1;
+ String responseMessage = "";
+ if (e.getCause() instanceof HttpResponseException) {
+ final HttpResponseException cause = (HttpResponseException) e.getCause();
+ responseCode = cause.getStatusCode();
+ responseMessage = cause.getReasonPhrase();
+ }
+ LOGGER.debug("Could not connect to Nexus received response code: {} {}",
+ responseCode, responseMessage);
+ }
+ throw new IOException("Could not connect to Nexus", e);
+ }
+ }
+
+ private static final class NexusV3SearchResponseHandler extends AbstractHttpClientResponseHandler {
+
+ /**
+ * The list to which matching artifacts are to be added
+ */
+ private final List matchingArtifacts;
+ /**
+ * The sha1 for which the search results are being handled
+ */
+ private final String sha1;
+ /**
+ * The classifiers to be accepted
+ */
+ private final Set acceptedClassifiers;
+
+ private NexusV3SearchResponseHandler(List matchingArtifacts, String sha1, Set acceptedClassifiers) {
+ this.matchingArtifacts = matchingArtifacts;
+ this.sha1 = sha1;
+ this.acceptedClassifiers = acceptedClassifiers;
+ }
+
+ @Override
+ public @Nullable String handleEntity(HttpEntity entity) throws IOException {
+ try (InputStream in = entity.getContent();
+ InputStreamReader isReader = new InputStreamReader(in, StandardCharsets.UTF_8);
+ BufferedReader reader = new BufferedReader(isReader);
+ ) {
+ final String jsonString = reader.lines().collect(Collectors.joining("\n"));
+ LOGGER.debug("JSON String was >>>{}<<<", jsonString);
+ final JsonObject jsonResponse;
+ try (
+ StringReader stringReader = new StringReader(jsonString);
+ JsonReader jsonReader = Json.createReader(stringReader)
+ ) {
+ jsonResponse = jsonReader.readObject();
+ }
+ LOGGER.debug("Response: {}", jsonResponse);
+ final JsonArray components = jsonResponse.getJsonArray("items");
+ LOGGER.debug("Items: {}", components);
+ final String continuationToken = jsonResponse.getString("continuationToken", null);
+ boolean found = false;
+ for (int i = 0; i < components.size() && !found; i++) {
+ boolean jarFound = false;
+ boolean pomFound = false;
+ String downloadUrl = null;
+ String groupId = null;
+ String artifactId = null;
+ String version = null;
+ String pomUrl = null;
+
+ final JsonObject component = components.getJsonObject(i);
+
+ final String format = component.getString("format", "unknown");
+ if ("maven2".equals(format)) {
+ LOGGER.debug("Checking Maven2 artifact for {}", component);
+ final JsonArray assets = component.getJsonArray("assets");
+ for (int j = 0; !found && j < assets.size(); j++) {
+ final JsonObject asset = assets.getJsonObject(j);
+ LOGGER.debug("Checking {}", asset);
+ final JsonObject checksums = asset.getJsonObject("checksum");
+ final JsonObject maven2 = asset.getJsonObject("maven2");
+ if (maven2 != null) {
+ // logical names for the jar acceptance routine
+ final boolean shaMatch = checksums != null && sha1.equals(checksums.getString("sha1", null));
+ final boolean hasAcceptedClassifier = acceptedClassifiers.contains(maven2.getString("classifier", null));
+ final boolean isAJar = "jar".equals(maven2.getString("extension", null));
+ LOGGER.debug("shaMatch {}", shaMatch);
+ LOGGER.debug("hasAcceptedClassifier {}", hasAcceptedClassifier);
+ LOGGER.debug("isAJar {}", isAJar);
+ if (
+ isAJar
+ && hasAcceptedClassifier
+ && shaMatch
+ ) {
+ downloadUrl = asset.getString("downloadUrl");
+ groupId = maven2.getString("groupId");
+ artifactId = maven2.getString("artifactId");
+ version = maven2.getString("version");
+
+ jarFound = true;
+ } else if ("pom".equals(maven2.getString("extension"))) {
+ LOGGER.debug("pom found {}", asset);
+ pomFound = true;
+ pomUrl = asset.getString("downloadUrl");
+ }
+ }
+ if (pomFound && jarFound) {
+ found = true;
+ }
+ }
+ if (found) {
+ matchingArtifacts.add(new MavenArtifact(groupId, artifactId, version, downloadUrl, pomUrl));
+ } else if (jarFound) {
+ final MavenArtifact ma = new MavenArtifact(groupId, artifactId, version, downloadUrl);
+ ma.setPomUrl(MavenArtifact.derivePomUrl(artifactId, version, downloadUrl));
+ matchingArtifacts.add(ma);
+ found = true;
+ }
+ }
+ }
+ return continuationToken;
+ }
+ }
+ }
+
+ @Override
+ public boolean preflightRequest() {
+ try {
+ final URL url = new URL(rootURL, "v1/status");
+ final String response = Downloader.getInstance().fetchContent(url, useProxy, StandardCharsets.UTF_8);
+ if (response == null || !response.isEmpty()) {
+ LOGGER.warn("Expected empty OK response (content-length 0), got {}", response == null ? "null" : response.length());
+ return false;
+ }
+ } catch (IOException | TooManyRequestsException | ResourceNotFoundException e) {
+ LOGGER.warn("Pre-flight request to Nexus failed: ", e);
+ return false;
+ }
+ return true;
+ }
+
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/Advisory.java b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/Advisory.java
index a6f044f9dbe..97fab27f268 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/Advisory.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/Advisory.java
@@ -17,8 +17,9 @@
*/
package org.owasp.dependencycheck.data.nodeaudit;
-import org.owasp.dependencycheck.dependency.CvssV3;
+
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
import java.io.Serializable;
import java.util.List;
import javax.annotation.concurrent.ThreadSafe;
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java
index 2d4b7aefbbb..c1f058ca6eb 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java
@@ -17,29 +17,32 @@
*/
package org.owasp.dependencycheck.data.nodeaudit;
-import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.net.HttpURLConnection;
import java.net.MalformedURLException;
+import java.net.URISyntaxException;
import java.net.URL;
-import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
+import java.util.ArrayList;
import java.util.List;
import javax.annotation.concurrent.ThreadSafe;
+import org.apache.hc.client5.http.HttpResponseException;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.Header;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.message.BasicHeader;
+import org.json.JSONException;
import org.json.JSONObject;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.URLConnectionFactory;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import javax.json.Json;
-import javax.json.JsonObject;
-import javax.json.JsonReader;
-import org.apache.commons.jcs.access.exception.CacheException;
+import jakarta.json.JsonObject;
+import org.apache.commons.jcs3.access.exception.CacheException;
import static org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.DEFAULT_URL;
@@ -48,7 +51,6 @@
import org.owasp.dependencycheck.data.cache.DataCache;
import org.owasp.dependencycheck.data.cache.DataCacheFactory;
import org.owasp.dependencycheck.utils.Checksum;
-import org.owasp.dependencycheck.utils.URLConnectionFailureException;
/**
* Class of methods to search via Node Audit API.
@@ -146,80 +148,64 @@ public List submitPackage(JsonObject packageJson) throws SearchExcepti
* @throws IOException if it's unable to connect to Node Audit API
*/
private List submitPackage(JsonObject packageJson, String key, int count) throws SearchException, IOException {
- try {
- if (LOGGER.isTraceEnabled()) {
- LOGGER.trace("----------------------------------------");
- LOGGER.trace("Node Audit Payload:");
- LOGGER.trace(packageJson.toString());
- LOGGER.trace("----------------------------------------");
- LOGGER.trace("----------------------------------------");
- }
- final byte[] packageDatabytes = packageJson.toString().getBytes(StandardCharsets.UTF_8);
- final URLConnectionFactory factory = new URLConnectionFactory(settings);
- final HttpURLConnection conn = factory.createHttpURLConnection(nodeAuditUrl, useProxy);
- conn.setDoOutput(true);
- conn.setDoInput(true);
- conn.setRequestMethod("POST");
- conn.setRequestProperty("user-agent", "npm/6.1.0 node/v10.5.0 linux x64");
- conn.setRequestProperty("npm-in-ci", "false");
- conn.setRequestProperty("npm-scope", "");
- conn.setRequestProperty("npm-session", generateRandomSession());
- conn.setRequestProperty("content-type", "application/json");
- conn.setRequestProperty("Content-Length", Integer.toString(packageDatabytes.length));
- conn.connect();
+ if (LOGGER.isTraceEnabled()) {
+ LOGGER.trace("----------------------------------------");
+ LOGGER.trace("Node Audit Payload:");
+ LOGGER.trace(packageJson.toString());
+ LOGGER.trace("----------------------------------------");
+ LOGGER.trace("----------------------------------------");
+ }
+ final List additionalHeaders = new ArrayList<>();
+ additionalHeaders.add(new BasicHeader(HttpHeaders.USER_AGENT, "npm/6.1.0 node/v10.5.0 linux x64"));
+ additionalHeaders.add(new BasicHeader("npm-in-ci", "false"));
+ additionalHeaders.add(new BasicHeader("npm-scope", ""));
+ additionalHeaders.add(new BasicHeader("npm-session", generateRandomSession()));
- try (OutputStream os = new BufferedOutputStream(conn.getOutputStream())) {
- os.write(packageDatabytes);
- os.flush();
+ try {
+ final String response = Downloader.getInstance().postBasedFetchContent(nodeAuditUrl.toURI(),
+ packageJson.toString(), ContentType.APPLICATION_JSON, additionalHeaders);
+ final JSONObject jsonResponse = new JSONObject(response);
+ final NpmAuditParser parser = new NpmAuditParser();
+ final List advisories = parser.parse(jsonResponse);
+ if (cache != null) {
+ cache.put(key, advisories);
}
-
- switch (conn.getResponseCode()) {
- case 200:
- try (InputStream in = new BufferedInputStream(conn.getInputStream());
- JsonReader jsonReader = Json.createReader(in)) {
- final JSONObject jsonResponse = new JSONObject(jsonReader.readObject().toString());
- final NpmAuditParser parser = new NpmAuditParser();
- final List advisories = parser.parse(jsonResponse);
- if (cache != null) {
- cache.put(key, advisories);
- }
- return advisories;
- } catch (Exception ex) {
- LOGGER.debug("Error connecting to Node Audit API. Error: {}",
- ex.getMessage());
- throw new SearchException("Could not connect to Node Audit API: " + ex.getMessage(), ex);
- }
- case 503:
- LOGGER.debug("Node Audit API returned `{} {}` - retrying request.",
- conn.getResponseCode(), conn.getResponseMessage());
- if (count < 5) {
- final int next = count + 1;
- try {
- Thread.sleep(1500L * next);
- } catch (InterruptedException ex) {
- Thread.currentThread().interrupt();
- throw new UnexpectedAnalysisException(ex);
+ return advisories;
+ } catch (RuntimeException | URISyntaxException | JSONException | TooManyRequestsException | ResourceNotFoundException ex) {
+ LOGGER.debug("Error connecting to Node Audit API. Error: {}",
+ ex.getMessage());
+ throw new SearchException("Could not connect to Node Audit API: " + ex.getMessage(), ex);
+ } catch (DownloadFailedException e) {
+ if (e.getCause() instanceof HttpResponseException) {
+ final HttpResponseException hre = (HttpResponseException) e.getCause();
+ switch (hre.getStatusCode()) {
+ case 503:
+ LOGGER.debug("Node Audit API returned `{} {}` - retrying request.",
+ hre.getStatusCode(), hre.getReasonPhrase());
+ if (count < 5) {
+ final int next = count + 1;
+ try {
+ Thread.sleep(1500L * next);
+ } catch (InterruptedException ex) {
+ Thread.currentThread().interrupt();
+ throw new UnexpectedAnalysisException(ex);
+ }
+ return submitPackage(packageJson, key, next);
}
- return submitPackage(packageJson, key, next);
- }
- throw new SearchException("Could not perform Node Audit analysis - service returned a 503.");
- case 400:
- LOGGER.debug("Invalid payload submitted to Node Audit API. Received response code: {} {}",
- conn.getResponseCode(), conn.getResponseMessage());
- throw new SearchException("Could not perform Node Audit analysis. Invalid payload submitted to Node Audit API.");
- default:
- LOGGER.debug("Could not connect to Node Audit API. Received response code: {} {}",
- conn.getResponseCode(), conn.getResponseMessage());
- throw new IOException("Could not connect to Node Audit API");
- }
- } catch (IOException ex) {
- if (ex instanceof javax.net.ssl.SSLHandshakeException
- && ex.getMessage().contains("unable to find valid certification path to requested target")) {
- final String msg = String.format("Unable to connect to '%s' - the Java trust store does not contain a trusted root for the cert. "
- + " Please see https://github.com/jeremylong/InstallCert for one method of updating the trusted certificates.", nodeAuditUrl);
- throw new URLConnectionFailureException(msg, ex);
+ throw new SearchException("Could not perform Node Audit analysis - service returned a 503.", e);
+ case 400:
+ LOGGER.debug("Invalid payload submitted to Node Audit API. Received response code: {} {}",
+ hre.getStatusCode(), hre.getReasonPhrase());
+ throw new SearchException("Could not perform Node Audit analysis. Invalid payload submitted to Node Audit API.", e);
+ default:
+ LOGGER.debug("Could not connect to Node Audit API. Received response code: {} {}",
+ hre.getStatusCode(), hre.getReasonPhrase());
+ throw new IOException("Could not connect to Node Audit API", e);
+ }
+ } else {
+ LOGGER.debug("Could not connect to Node Audit API. Received generic DownloadException", e);
+ throw new IOException("Could not connect to Node Audit API", e);
}
- throw ex;
}
}
@@ -235,6 +221,6 @@ private String generateRandomSession() {
while (sb.length() < length) {
sb.append(Integer.toHexString(r.nextInt()));
}
- return sb.toString().substring(0, length);
+ return sb.substring(0, length);
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmAuditParser.java b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmAuditParser.java
index 5f0cf87d155..5c5b01fc416 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmAuditParser.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmAuditParser.java
@@ -17,15 +17,17 @@
*/
package org.owasp.dependencycheck.data.nodeaudit;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
import org.json.JSONArray;
import org.json.JSONObject;
-import org.owasp.dependencycheck.dependency.CvssV3;
+
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import org.json.JSONException;
+import org.owasp.dependencycheck.utils.CvssUtil;
/**
* Parser for NPM Audit API response. This parser is derived from:
@@ -118,7 +120,7 @@ private Advisory parseAdvisory(JSONObject object) throws JSONException {
}
final JSONObject jsonCvss = object.optJSONObject("cvss");
if (jsonCvss != null) {
- float baseScore = -1.0f;
+ double baseScore = -1.0;
final String score = jsonCvss.optString("score");
if (score != null) {
try {
@@ -130,17 +132,17 @@ private Advisory parseAdvisory(JSONObject object) throws JSONException {
}
if (baseScore >= 0.0) {
final String vector = jsonCvss.optString("vectorString");
- if (vector != null) {
+ if (vector != null && !"null".equals(vector)) {
if (vector.startsWith("CVSS:3") && baseScore >= 0.0) {
try {
- final CvssV3 cvss = new CvssV3(vector, baseScore);
+ final CvssV3 cvss = CvssUtil.vectorToCvssV3(vector, baseScore);
advisory.setCvssV3(cvss);
} catch (IllegalArgumentException iae) {
- LOGGER.warn("Invalid CVSS vector format encountered in NPM Audit results '{}' ", vector, iae);
+ LOGGER.warn("Invalid CVSS vector format encountered in NPM Audit results '{}': {} ", vector, iae.getMessage());
}
} else {
LOGGER.warn("Unsupported CVSS vector format in NPM Audit results, please file a feature "
- + "request at https://github.com/jeremylong/DependencyCheck/issues/new/choose to "
+ + "request at https://github.com/dependency-check/DependencyCheck/issues/new/choose to "
+ "support vector format '{}' ", vector);
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilder.java b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilder.java
index 982c9896585..478c1d5f2bc 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilder.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilder.java
@@ -24,11 +24,11 @@
import java.util.Optional;
import java.util.TreeMap;
import java.util.stream.Collectors;
-import javax.json.Json;
-import javax.json.JsonObject;
-import javax.json.JsonObjectBuilder;
-import javax.json.JsonString;
-import javax.json.JsonValue;
+import jakarta.json.Json;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonObjectBuilder;
+import jakarta.json.JsonString;
+import jakarta.json.JsonValue;
import javax.annotation.concurrent.ThreadSafe;
import org.apache.commons.collections4.MultiValuedMap;
@@ -40,6 +40,7 @@
*/
@ThreadSafe
public final class NpmPayloadBuilder {
+
/**
* Private constructor for utility class.
*/
@@ -108,13 +109,23 @@ public static JsonObject build(JsonObject lockJson, JsonObject packageJson,
}
if (dependencies != null) {
- dependencies.forEach((key, value) -> {
+ dependencies.forEach((k, value) -> {
+ String key = k;
final int indexOfNodeModule = key.lastIndexOf(NodePackageAnalyzer.NODE_MODULES_DIRNAME + "/");
if (indexOfNodeModule >= 0) {
key = key.substring(indexOfNodeModule + NodePackageAnalyzer.NODE_MODULES_DIRNAME.length() + 1);
}
- final JsonObject dep = ((JsonObject) value);
+ JsonObject dep = ((JsonObject) value);
+
+ //After Version 3, dependencies can't be taken directly from package-lock.json
+ if (lockJsonVersion > 2 && dep.containsKey("dependencies") && dep.get("dependencies") instanceof JsonObject) {
+ final JsonObjectBuilder depBuilder = Json.createObjectBuilder(dep);
+ depBuilder.remove("dependencies");
+ depBuilder.add("requires", dep.get("dependencies"));
+ dep = depBuilder.build();
+ }
+
final String version = dep.getString("version", "");
final boolean isDev = dep.getBoolean("dev", false);
if (skipDevDependencies && isDev) {
@@ -144,7 +155,7 @@ public static JsonObject build(JsonObject lockJson, JsonObject packageJson,
* @return the JSON payload for NPN Audit
*/
public static JsonObject build(JsonObject packageJson, MultiValuedMap dependencyMap,
- final boolean skipDevDependencies) {
+ final boolean skipDevDependencies) {
final JsonObjectBuilder payloadBuilder = Json.createObjectBuilder();
addProjectInfo(packageJson, payloadBuilder);
@@ -236,15 +247,23 @@ private static void addConstantElements(final JsonObjectBuilder payloadBuilder)
private static JsonObject buildDependencies(JsonObject dep, MultiValuedMap dependencyMap) {
final JsonObjectBuilder depBuilder = Json.createObjectBuilder();
Optional.ofNullable(dep.getJsonString("version"))
- .map(JsonString::getString)
- .ifPresent(version -> depBuilder.add("version", version));
+ .map(JsonString::getString)
+ .ifPresent(version -> depBuilder.add("version", version));
//not installed package (like, dependency of an optional dependency) doesn't contains integrity
if (dep.containsKey("integrity")) {
depBuilder.add("integrity", dep.getString("integrity"));
}
if (dep.containsKey("requires")) {
- depBuilder.add("requires", dep.getJsonObject("requires"));
+ final JsonObjectBuilder requiresBuilder = Json.createObjectBuilder();
+ dep.getJsonObject("requires").forEach((key, value) -> {
+ if (NodePackageAnalyzer.shouldSkipDependency(key, ((JsonString) value).getString())) {
+ return;
+ }
+
+ requiresBuilder.add(key, value);
+ });
+ depBuilder.add("requires", requiresBuilder.build());
}
if (dep.containsKey("dependencies")) {
final JsonObjectBuilder dependeciesBuilder = Json.createObjectBuilder();
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/CveEcosystemMapper.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/CveEcosystemMapper.java
index 8424707b425..f201ffddae7 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/CveEcosystemMapper.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/CveEcosystemMapper.java
@@ -13,18 +13,17 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*
- * Copyright (c) 2020 The OWASP Foundation. All Rights Reserved.
+ * Copyright (c) 2023 Jeremy Long. All Rights Reserved.
*/
package org.owasp.dependencycheck.data.nvd.ecosystem;
+import io.github.jeremylong.openvulnerability.client.nvd.Config;
+import io.github.jeremylong.openvulnerability.client.nvd.CpeMatch;
+import io.github.jeremylong.openvulnerability.client.nvd.Node;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
import java.util.List;
import java.util.stream.Collectors;
import javax.annotation.concurrent.NotThreadSafe;
-import org.owasp.dependencycheck.data.nvd.json.CpeMatchStreamCollector;
-import org.owasp.dependencycheck.data.nvd.json.DefCpeMatch;
-
-import org.owasp.dependencycheck.data.nvd.json.DefCveItem;
-import org.owasp.dependencycheck.data.nvd.json.NodeFlatteningCollector;
/**
* Utility for mapping CVEs to their ecosystems.
@@ -83,17 +82,23 @@ public String getEcosystem(DefCveItem cve) {
* null
*/
private boolean hasMultipleVendorProductConfigurations(DefCveItem cve) {
- final List cpeEntries = cve.getConfigurations().getNodes().stream()
- .collect(NodeFlatteningCollector.getInstance())
- .collect(CpeMatchStreamCollector.getInstance())
- .filter(defCpeMatch -> defCpeMatch.getCpe23Uri() != null)
- .collect(Collectors.toList());
- if (!cpeEntries.isEmpty() && cpeEntries.size() > 1) {
- final DefCpeMatch firstMatch = cpeEntries.get(0);
- final String uri = firstMatch.getCpe23Uri();
- final int pos = uri.indexOf(":", uri.indexOf(":", 10) + 1);
- final String match = uri.substring(0, pos + 1);
- return !cpeEntries.stream().allMatch(e -> e.getCpe23Uri().startsWith(match));
+ if (cve.getCve().getConfigurations() != null && !cve.getCve().getConfigurations().isEmpty()) {
+ final List cpeEntries = cve.getCve().getConfigurations().stream()
+ .filter(config -> config.getNodes() != null)
+ .map(Config::getNodes)
+ .flatMap(List::stream)
+ .filter(cpe -> cpe.getCpeMatch() != null)
+ .map(Node::getCpeMatch)
+ .flatMap(List::stream)
+ .filter(match -> match.getCriteria() != null)
+ .collect(Collectors.toList());
+ if (!cpeEntries.isEmpty() && cpeEntries.size() > 1) {
+ final CpeMatch firstMatch = cpeEntries.get(0);
+ final String uri = firstMatch.getCriteria();
+ final int pos = uri.indexOf(":", uri.indexOf(":", 10) + 1);
+ final String match = uri.substring(0, pos + 1);
+ return !cpeEntries.stream().allMatch(e -> e.getCriteria().startsWith(match));
+ }
}
return false;
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/DescriptionEcosystemMapper.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/DescriptionEcosystemMapper.java
index d4dae989047..1d325ec8bff 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/DescriptionEcosystemMapper.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/DescriptionEcosystemMapper.java
@@ -18,7 +18,7 @@
package org.owasp.dependencycheck.data.nvd.ecosystem;
import org.apache.commons.lang3.StringUtils;
-import org.owasp.dependencycheck.data.nvd.json.DefCveItem;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
import java.util.HashMap;
import java.util.Map;
@@ -179,7 +179,7 @@ protected void increment(int i, int[] ecosystemMap) {
*/
public String getEcosystem(DefCveItem cve) {
final int[] ecosystemMap = new int[ECOSYSTEMS.length];
- cve.getCve().getDescription().getDescriptionData().stream()
+ cve.getCve().getDescriptions().stream()
.filter((langString) -> (langString.getLang().equals("en")))
.forEachOrdered((langString) -> search(langString.getValue(), ecosystemMap));
return getResult(ecosystemMap);
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/UrlEcosystemMapper.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/UrlEcosystemMapper.java
index 8721ed54b1c..bd48613e95f 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/UrlEcosystemMapper.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/UrlEcosystemMapper.java
@@ -23,13 +23,13 @@
import javax.annotation.concurrent.NotThreadSafe;
-import org.owasp.dependencycheck.data.nvd.json.CVEJSON40Min11;
-import org.owasp.dependencycheck.data.nvd.json.DefCveItem;
-import org.owasp.dependencycheck.data.nvd.json.Reference;
-import org.owasp.dependencycheck.data.nvd.json.References;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
+import io.github.jeremylong.openvulnerability.client.nvd.Reference;
import com.hankcs.algorithm.AhoCorasickDoubleArrayTrie;
import com.hankcs.algorithm.AhoCorasickDoubleArrayTrie.Hit;
+import io.github.jeremylong.openvulnerability.client.nvd.CveItem;
+import java.util.List;
@NotThreadSafe
public class UrlEcosystemMapper {
@@ -69,14 +69,13 @@ public UrlEcosystemMapper() {
* @return the ecosystem
*/
public String getEcosystem(DefCveItem cve) {
- final References references = Optional.ofNullable(cve)
+ final List references = Optional.ofNullable(cve)
.map(DefCveItem::getCve)
- .map(CVEJSON40Min11::getReferences)
+ .map(CveItem::getReferences)
.orElse(null);
if (Objects.nonNull(references)) {
- for (Reference r : references.getReferenceData()) {
-
+ for (Reference r : references) {
final Hit ecosystem = search.findFirst(r.getUrl());
if (ecosystem != null) {
return ecosystem.value;
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/CpeMatchStreamCollector.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/CpeMatchStreamCollector.java
deleted file mode 100644
index 652e45a2ef2..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/CpeMatchStreamCollector.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2018 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.nvd.json;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.EnumSet;
-import java.util.Set;
-import java.util.function.BiConsumer;
-import java.util.function.BinaryOperator;
-import java.util.function.Function;
-import java.util.function.Supplier;
-import java.util.stream.Collector;
-import java.util.stream.Stream;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-/**
- *
- * @author Jeremy Long
- *
- */
-@ThreadSafe
-public final class CpeMatchStreamCollector implements Collector, Stream> {
-
- /**
- * The singleton instance.
- */
- private static final CpeMatchStreamCollector INSTANCE;
-
- static {
- INSTANCE = new CpeMatchStreamCollector();
- }
-
- public static CpeMatchStreamCollector getInstance() {
- return INSTANCE;
- }
-
- private CpeMatchStreamCollector() {
- }
-
- @Override
- public Supplier> supplier() {
- return ArrayList::new;
- }
-
- @Override
- public BiConsumer, DefNode> accumulator() {
- return (match, nodes) -> match.addAll(nodes.getCpeMatch());
- }
-
- @Override
- public BinaryOperator> combiner() {
- return (map, other) -> {
- map.addAll(other);
- return map;
- };
- }
-
- @Override
- public Function, Stream> finisher() {
- return Collection::stream;
- }
-
- @Override
- public Set characteristics() {
- return EnumSet.of(Characteristics.UNORDERED);
- }
-
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java
deleted file mode 100644
index 322ba5c02da..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2019 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.nvd.json;
-
-import java.io.IOException;
-import java.io.Reader;
-import java.io.StringReader;
-import java.time.ZonedDateTime;
-import java.time.format.DateTimeFormatter;
-import java.time.format.DateTimeParseException;
-import java.util.Properties;
-import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
-
-/**
- * Meta properties object to hold information about the NVD CVE data.
- *
- * @author Jeremy Long
- */
-public class MetaProperties {
-
- /**
- * The SHA256 of the NVD file.
- */
- private final String sha256;
- /**
- * The last modified date of the NVD file in epoch time.
- */
- private final long lastModifiedDate;
- /**
- * The size of the NVD file.
- */
- private final long size;
- /**
- * The size of the zipped NVD file.
- */
- private final long zipSize;
- /**
- * The size of the gzipped NVD file.
- */
- private final long gzSize;
-
- /**
- * Get the value of gzSize.
- *
- * @return the value of gzSize
- */
- public long getGzSize() {
- return gzSize;
- }
-
- /**
- * Get the value of zipSize.
- *
- * @return the value of zipSize
- */
- public long getZipSize() {
- return zipSize;
- }
-
- /**
- * Get the value of size.
- *
- * @return the value of size
- */
- public long getSize() {
- return size;
- }
-
- /**
- * Get the value of lastModifiedDate in epoch time.
- *
- * @return the value of lastModifiedDate
- */
- public long getLastModifiedDate() {
- return lastModifiedDate;
- }
-
- /**
- * Get the value of SHA256.
- *
- * @return the value of SHA256
- */
- public String getSha256() {
- return sha256;
- }
-
- /**
- * Constructs a new MetaProperties object to hold information about the NVD
- * data.
- *
- * @param contents the contents of the meta file
- * @throws InvalidDataException thrown if the meta file contents cannot be
- * parsed
- */
- public MetaProperties(String contents) throws InvalidDataException {
- final Properties properties = new Properties();
- try (Reader r = new StringReader(contents)) {
- properties.load(r);
- } catch (IOException ex) {
- throw new InvalidDataException("Unable to parse meta file data", ex);
- }
- this.sha256 = properties.getProperty("sha256");
- try {
- final String date = properties.getProperty("lastModifiedDate");
- if (date == null) {
- throw new InvalidDataException("lastModifiedDate not found in meta file");
- }
- this.lastModifiedDate = ZonedDateTime.parse(date, DateTimeFormatter.ISO_OFFSET_DATE_TIME).toEpochSecond();
- } catch (DateTimeParseException ex) {
- throw new InvalidDataException("Meta file lastModifiedDate cannot be parsed: "
- + properties.getProperty("lastModifiedDate"), ex);
- }
- try {
- this.zipSize = Long.parseLong(properties.getProperty("zipSize"));
- } catch (NumberFormatException ex) {
- throw new InvalidDataException("Meta file zip size cannot be parsed: "
- + properties.getProperty("zipSize"), ex);
- }
- try {
- this.gzSize = Long.parseLong(properties.getProperty("gzSize"));
- } catch (NumberFormatException ex) {
- throw new InvalidDataException("Meta file gz size cannot be parsed: "
- + properties.getProperty("gzSize"), ex);
- }
- try {
- this.size = Long.parseLong(properties.getProperty("size"));
- } catch (NumberFormatException ex) {
- throw new InvalidDataException("Meta file size cannot be parsed: "
- + properties.getProperty("size"), ex);
- }
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/NodeFlatteningCollector.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/NodeFlatteningCollector.java
deleted file mode 100644
index 7dfe7e291ff..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/NodeFlatteningCollector.java
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2018 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.nvd.json;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.EnumSet;
-import java.util.List;
-import java.util.Set;
-import java.util.function.BiConsumer;
-import java.util.function.BinaryOperator;
-import java.util.function.Function;
-import java.util.function.Supplier;
-import java.util.stream.Collector;
-import java.util.stream.Stream;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-/**
- * Used to flatten a hierarchical list of nodes with children.
- *
- * @author Jeremy Long
- */
-@ThreadSafe
-public final class NodeFlatteningCollector implements Collector, Stream> {
-
- /**
- * Singleton instance variable.
- */
- private static final NodeFlatteningCollector INSTANCE;
-
- static {
- INSTANCE = new NodeFlatteningCollector();
- }
-
- public static NodeFlatteningCollector getInstance() {
- return INSTANCE;
- }
-
- private NodeFlatteningCollector() {
- }
-
- /**
- * Flattens the hierarchical list of nodes.
- *
- * @param node the node with children to flatten
- * @return the flattened list of nodes
- */
- private List flatten(DefNode node) {
- final List result = new ArrayList<>();
- result.add(node);
- return flatten(result, node.getChildren());
- }
-
- /**
- * Flattens the hierarchical list of nodes.
- *
- * @param result the results
- * @param nodes the nodes
- * @return the flattened list of nodes
- */
- private List flatten(List result, List nodes) {
- nodes.forEach(n -> {
- flatten(result, n.getChildren());
- result.add(n);
- });
- return result;
- }
-
- @Override
- public Supplier> supplier() {
- return ArrayList::new;
- }
-
- @Override
- public BiConsumer, DefNode> accumulator() {
- return (nodes, n) -> nodes.addAll(flatten(n));
- }
-
- @Override
- public BinaryOperator> combiner() {
- return (map, other) -> {
- map.addAll(other);
- return map;
- };
- }
-
- @Override
- public Function, Stream> finisher() {
- return Collection::stream;
- }
-
- @Override
- public Set characteristics() {
- return EnumSet.of(Characteristics.UNORDERED);
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/package-info.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/package-info.java
deleted file mode 100644
index cd090a6f6c0..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/package-info.java
+++ /dev/null
@@ -1,5 +0,0 @@
-/**
- * Contains utility classes used to work with the generated code from the
- * NVD CVE JSON data.
- */
-package org.owasp.dependencycheck.data.nvd.json;
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
index 752597623ef..1e4b64baff1 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
@@ -20,7 +20,9 @@
import com.google.common.io.Resources;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-import org.apache.commons.collections.map.ReferenceMap;
+import io.github.jeremylong.openvulnerability.client.nvd.Config;
+import io.github.jeremylong.openvulnerability.client.nvd.CpeMatch;
+import org.apache.commons.collections4.map.ReferenceMap;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
import org.owasp.dependencycheck.utils.*;
@@ -42,24 +44,24 @@
import java.util.stream.Collectors;
import org.anarres.jdiagnostics.DefaultQuery;
-import static org.apache.commons.collections.map.AbstractReferenceMap.HARD;
-import static org.apache.commons.collections.map.AbstractReferenceMap.SOFT;
+import static org.apache.commons.collections4.map.AbstractReferenceMap.ReferenceStrength.HARD;
+import static org.apache.commons.collections4.map.AbstractReferenceMap.ReferenceStrength.SOFT;
import org.owasp.dependencycheck.analyzer.exception.LambdaExceptionWrapper;
import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
-import org.owasp.dependencycheck.data.nvd.json.BaseMetricV2;
-import org.owasp.dependencycheck.data.nvd.json.BaseMetricV3;
-import org.owasp.dependencycheck.data.nvd.json.CpeMatchStreamCollector;
-import org.owasp.dependencycheck.data.nvd.json.DefCpeMatch;
-import org.owasp.dependencycheck.data.nvd.json.DefCveItem;
-import org.owasp.dependencycheck.data.nvd.json.LangString;
-import org.owasp.dependencycheck.data.nvd.json.NodeFlatteningCollector;
-import org.owasp.dependencycheck.data.nvd.json.ProblemtypeDatum;
-import org.owasp.dependencycheck.data.nvd.json.Reference;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
import static org.owasp.dependencycheck.data.nvdcve.CveDB.PreparedStatementCveDb.*;
import org.owasp.dependencycheck.data.update.cpe.CpeEcosystemCache;
import org.owasp.dependencycheck.data.update.cpe.CpePlus;
-import org.owasp.dependencycheck.dependency.CvssV2;
-import org.owasp.dependencycheck.dependency.CvssV3;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV3Data;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV4;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data;
+import io.github.jeremylong.openvulnerability.client.nvd.LangString;
+import io.github.jeremylong.openvulnerability.client.nvd.Node;
+import io.github.jeremylong.openvulnerability.client.nvd.Reference;
+import io.github.jeremylong.openvulnerability.client.nvd.Weakness;
import org.owasp.dependencycheck.dependency.VulnerableSoftwareBuilder;
import us.springett.parsers.cpe.Cpe;
import us.springett.parsers.cpe.CpeBuilder;
@@ -143,8 +145,7 @@ public int updateEcosystemCache() {
final URL url = Resources.getResource(DB_ECOSYSTEM_CACHE);
final List sql = Resources.readLines(url, StandardCharsets.UTF_8);
- try (Connection conn = databaseManager.getConnection();
- Statement statement = conn.createStatement()) {
+ try (Connection conn = databaseManager.getConnection(); Statement statement = conn.createStatement()) {
for (String single : sql) {
updateCount += statement.executeUpdate(single);
}
@@ -461,8 +462,7 @@ DatabaseProperties reloadProperties() {
*/
public Set getCPEs(String vendor, String product) {
final Set cpe = new HashSet<>();
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement ps = getPreparedStatement(conn, SELECT_CPE_ENTRIES)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement ps = getPreparedStatement(conn, SELECT_CPE_ENTRIES)) {
//part, vendor, product, version, update_version, edition,
//lang, sw_edition, target_sw, target_hw, other, ecosystem
ps.setString(1, vendor);
@@ -567,8 +567,7 @@ public Properties getProperties() {
*/
public void saveProperty(String key, String value) {
clearCache();
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement mergeProperty = getPreparedStatement(conn, MERGE_PROPERTY)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement mergeProperty = getPreparedStatement(conn, MERGE_PROPERTY)) {
if (mergeProperty != null) {
mergeProperty.setString(1, key);
mergeProperty.setString(2, value);
@@ -623,8 +622,7 @@ public List getVulnerabilities(Cpe cpe) throws DatabaseException
}
final List vulnerabilities = new ArrayList<>();
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement ps = getPreparedStatement(conn, SELECT_CVE_FROM_SOFTWARE)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement ps = getPreparedStatement(conn, SELECT_CVE_FROM_SOFTWARE)) {
ps.setString(1, cpe.getVendor());
ps.setString(2, cpe.getProduct());
try (ResultSet rs = ps.executeQuery()) {
@@ -714,8 +712,7 @@ public Vulnerability getVulnerability(String cve, Connection conn) throws Databa
final VulnerableSoftwareBuilder vulnerableSoftwareBuilder = new VulnerableSoftwareBuilder();
Vulnerability vuln = null;
try {
- try (PreparedStatement psV = getPreparedStatement(conn, SELECT_VULNERABILITY, cve);
- ResultSet rsV = psV.executeQuery()) {
+ try (PreparedStatement psV = getPreparedStatement(conn, SELECT_VULNERABILITY, cve); ResultSet rsV = psV.executeQuery()) {
if (rsV.next()) {
//1.id, 2.description,
cveId = rsV.getInt(1);
@@ -729,44 +726,320 @@ public Vulnerability getVulnerability(String cve, Connection conn) throws Databa
//12.v2AccessVector, 13.v2AccessComplexity, 14.v2Authentication, 15.v2ConfidentialityImpact,
//16.v2IntegrityImpact, 17.v2AvailabilityImpact, 18.v2Version,
if (rsV.getObject(11) != null) {
- final CvssV2 cvss = new CvssV2(rsV.getFloat(11), rsV.getString(12),
- rsV.getString(13), rsV.getString(14), rsV.getString(15),
- rsV.getString(16), rsV.getString(17), rsV.getString(3),
- getFloatValue(rsV, 4), getFloatValue(rsV, 5),
- getBooleanValue(rsV, 6), getBooleanValue(rsV, 7), getBooleanValue(rsV, 8),
- getBooleanValue(rsV, 9), getBooleanValue(rsV, 10), rsV.getString(18));
+
+ final CvssV2Data.AccessVectorType accessVector = CvssV2Data.AccessVectorType.fromValue(rsV.getString(12));
+ final CvssV2Data.AccessComplexityType accessComplexity = CvssV2Data.AccessComplexityType.fromValue(rsV.getString(13));
+ final CvssV2Data.AuthenticationType authentication = CvssV2Data.AuthenticationType.fromValue(rsV.getString(14));
+ final CvssV2Data.CiaType confidentialityImpact = CvssV2Data.CiaType.fromValue(rsV.getString(15));
+ final CvssV2Data.CiaType integrityImpact = CvssV2Data.CiaType.fromValue(rsV.getString(16));
+ final CvssV2Data.CiaType availabilityImpact = CvssV2Data.CiaType.fromValue(rsV.getString(17));
+ final String vector = String.format("/AV:%s/AC:%s/Au:%s/C:%s/I:%s/A:%s",
+ accessVector == null ? "" : accessVector.value().substring(0, 1),
+ accessComplexity == null ? "" : accessComplexity.value().substring(0, 1),
+ authentication == null ? "" : authentication.value().substring(0, 1),
+ confidentialityImpact == null ? "" : confidentialityImpact.value().substring(0, 1),
+ integrityImpact == null ? "" : integrityImpact.value().substring(0, 1),
+ availabilityImpact == null ? "" : availabilityImpact.value().substring(0, 1));
+
+ final CvssV2Data cvssData = new CvssV2Data(CvssV2Data.Version._2_0, vector, accessVector,
+ accessComplexity, authentication, confidentialityImpact,
+ integrityImpact, availabilityImpact, rsV.getDouble(11), rsV.getString(3),
+ null, null, null, null, null, null, null, null, null, null);
+ final CvssV2 cvss = new CvssV2(null, CvssV2.Type.PRIMARY, cvssData, rsV.getString(3),
+ rsV.getDouble(4), rsV.getDouble(5), rsV.getBoolean(6), rsV.getBoolean(7),
+ rsV.getBoolean(8), rsV.getBoolean(9), rsV.getBoolean(10));
vuln.setCvssV2(cvss);
}
//19.v3ExploitabilityScore, 20.v3ImpactScore, 21.v3AttackVector, 22.v3AttackComplexity, 23.v3PrivilegesRequired,
//24.v3UserInteraction, 25.v3Scope, 26.v3ConfidentialityImpact, 27.v3IntegrityImpact, 28.v3AvailabilityImpact,
- //29.v3BaseScore, 30.v3BaseSeverity, 21.v3Version
+ //29.v3BaseScore, 30.v3BaseSeverity, 31.v3Version
if (rsV.getObject(21) != null) {
- final CvssV3 cvss = new CvssV3(rsV.getString(21), rsV.getString(22),
- rsV.getString(23), rsV.getString(24), rsV.getString(25),
- rsV.getString(26), rsV.getString(27), rsV.getString(28),
- rsV.getFloat(29), rsV.getString(30), getFloatValue(rsV, 19),
- getFloatValue(rsV, 20), rsV.getString(31));
+ //some older test data may not correctly have the version set.
+ String cveVersion = "3.1";
+ if (rsV.getString(31) != null) {
+ cveVersion = rsV.getString(31);
+ }
+ final CvssV3Data.Version version = CvssV3Data.Version.fromValue(cveVersion);
+ final CvssV3Data.AttackVectorType attackVector = CvssV3Data.AttackVectorType.fromValue(rsV.getString(21));
+ final CvssV3Data.AttackComplexityType attackComplexity = CvssV3Data.AttackComplexityType.fromValue(rsV.getString(22));
+ final CvssV3Data.PrivilegesRequiredType privilegesRequired = CvssV3Data.PrivilegesRequiredType.fromValue(rsV.getString(23));
+ final CvssV3Data.UserInteractionType userInteraction = CvssV3Data.UserInteractionType.fromValue(rsV.getString(24));
+ final CvssV3Data.ScopeType scope = CvssV3Data.ScopeType.fromValue(rsV.getString(25));
+ final CvssV3Data.CiaType confidentialityImpact = CvssV3Data.CiaType.fromValue(rsV.getString(26));
+ final CvssV3Data.CiaType integrityImpact = CvssV3Data.CiaType.fromValue(rsV.getString(27));
+ final CvssV3Data.CiaType availabilityImpact = CvssV3Data.CiaType.fromValue(rsV.getString(28));
+ final CvssV3Data.SeverityType baseSeverity = CvssV3Data.SeverityType.fromValue(rsV.getString(30));
+ final String vector = String.format("CVSS:%s/AV:%s/AC:%s/PR:%s/UI:%s/S:%s/C:%s/I:%s/A:%s",
+ version == null ? "" : version,
+ attackVector == null ? "" : attackVector.value().substring(0, 1),
+ attackComplexity == null ? "" : attackComplexity.value().substring(0, 1),
+ privilegesRequired == null ? "" : privilegesRequired.value().substring(0, 1),
+ userInteraction == null ? "" : userInteraction.value().substring(0, 1),
+ scope == null ? "" : scope.value().substring(0, 1),
+ confidentialityImpact == null ? "" : confidentialityImpact.value().substring(0, 1),
+ integrityImpact == null ? "" : integrityImpact.value().substring(0, 1),
+ availabilityImpact == null ? "" : availabilityImpact.value().substring(0, 1));
+
+ final CvssV3Data cvssData = new CvssV3Data(version, vector, attackVector, attackComplexity, privilegesRequired,
+ userInteraction, scope, confidentialityImpact, integrityImpact, availabilityImpact,
+ rsV.getDouble(29), baseSeverity, CvssV3Data.ExploitCodeMaturityType.PROOF_OF_CONCEPT,
+ CvssV3Data.RemediationLevelType.NOT_DEFINED, CvssV3Data.ConfidenceType.REASONABLE, 0.0,
+ CvssV3Data.SeverityType.MEDIUM, CvssV3Data.CiaRequirementType.NOT_DEFINED,
+ CvssV3Data.CiaRequirementType.NOT_DEFINED, CvssV3Data.CiaRequirementType.NOT_DEFINED,
+ CvssV3Data.ModifiedAttackVectorType.ADJACENT_NETWORK, CvssV3Data.ModifiedAttackComplexityType.NOT_DEFINED,
+ CvssV3Data.ModifiedPrivilegesRequiredType.NOT_DEFINED, CvssV3Data.ModifiedUserInteractionType.NOT_DEFINED,
+ CvssV3Data.ModifiedScopeType.NOT_DEFINED, CvssV3Data.ModifiedCiaType.NOT_DEFINED,
+ CvssV3Data.ModifiedCiaType.NOT_DEFINED, CvssV3Data.ModifiedCiaType.NOT_DEFINED, 1.0,
+ CvssV3Data.SeverityType.NONE);
+ final CvssV3 cvss = new CvssV3(null, null, cvssData, rsV.getDouble(19), rsV.getDouble(20));
vuln.setCvssV3(cvss);
}
+// 32.v4version, 33.v4attackVector, 34.v4attackComplexity, 35.v4attackRequirements, 36.v4privilegesRequired,
+// 37.v4userInteraction, 38.v4vulnConfidentialityImpact, 39.v4vulnIntegrityImpact, 40.v4vulnAvailabilityImpact,
+// 41.v4subConfidentialityImpact, 42.v4subIntegrityImpact, 43.v4subAvailabilityImpact, 44.v4exploitMaturity,
+// 45.v4confidentialityRequirement, 46.v4integrityRequirement, 47.v4availabilityRequirement, 48.v4modifiedAttackVector,
+// 49.v4modifiedAttackComplexity, 50.v4modifiedAttackRequirements, 51.v4modifiedPrivilegesRequired, 52.v4modifiedUserInteraction,
+// 53.v4modifiedVulnConfidentialityImpact, 54.v4modifiedVulnIntegrityImpact, 55.v4modifiedVulnAvailabilityImpact,
+// 56.v4modifiedSubConfidentialityImpact, 57.v4modifiedSubIntegrityImpact, 58.v4modifiedSubAvailabilityImpact,
+// 59.v4safety, 60.v4automatable, 61.v4recovery, 62.v4valueDensity, 63.v4vulnerabilityResponseEffort, 64.v4providerUrgency,
+// 65.v4baseScore, 66.v4baseSeverity, 67.v4threatScore, 68.v4threatSeverity, 69.v4environmentalScore, 70.v4environmentalSeverity
+// 71.v4source, 72.v4type
+ if (rsV.getObject(33) != null) {
+ String vectorString = null;
+
+ String value = rsV.getString(32);
+ final CvssV4Data.Version version = CvssV4Data.Version.fromValue(value);
+ CvssV4Data.AttackVectorType attackVector = null;
+ value = rsV.getString(33);
+ if (value != null) {
+ attackVector = CvssV4Data.AttackVectorType.fromValue(value);
+ }
+ CvssV4Data.AttackComplexityType attackComplexity = null;
+ value = rsV.getString(34);
+ if (value != null) {
+ attackComplexity = CvssV4Data.AttackComplexityType.fromValue(value);
+ }
+ CvssV4Data.AttackRequirementsType attackRequirements = null;
+ value = rsV.getString(35);
+ if (value != null) {
+ attackRequirements = CvssV4Data.AttackRequirementsType.fromValue(value);
+ }
+ CvssV4Data.PrivilegesRequiredType privilegesRequired = null;
+ value = rsV.getString(36);
+ if (value != null) {
+ privilegesRequired = CvssV4Data.PrivilegesRequiredType.fromValue(value);
+ }
+ CvssV4Data.UserInteractionType userInteraction = null;
+ value = rsV.getString(37);
+ if (value != null) {
+ userInteraction = CvssV4Data.UserInteractionType.fromValue(value);
+ }
+ CvssV4Data.CiaType vulnConfidentialityImpact = null;
+ value = rsV.getString(38);
+ if (value != null) {
+ vulnConfidentialityImpact = CvssV4Data.CiaType.fromValue(value);
+ }
+ CvssV4Data.CiaType vulnIntegrityImpact = null;
+ value = rsV.getString(39);
+ if (value != null) {
+ vulnIntegrityImpact = CvssV4Data.CiaType.fromValue(value);
+ }
+ CvssV4Data.CiaType vulnAvailabilityImpact = null;
+ value = rsV.getString(40);
+ if (value != null) {
+ vulnAvailabilityImpact = CvssV4Data.CiaType.fromValue(value);
+ }
+ CvssV4Data.CiaType subConfidentialityImpact = null;
+ value = rsV.getString(41);
+ if (value != null) {
+ subConfidentialityImpact = CvssV4Data.CiaType.fromValue(value);
+ }
+ CvssV4Data.CiaType subIntegrityImpact = null;
+ value = rsV.getString(42);
+ if (value != null) {
+ subIntegrityImpact = CvssV4Data.CiaType.fromValue(value);
+ }
+ CvssV4Data.CiaType subAvailabilityImpact = null;
+ value = rsV.getString(43);
+ if (value != null) {
+ subAvailabilityImpact = CvssV4Data.CiaType.fromValue(value);
+ }
+ CvssV4Data.ExploitMaturityType exploitMaturity = null;
+ value = rsV.getString(44);
+ if (value != null) {
+ exploitMaturity = CvssV4Data.ExploitMaturityType.fromValue(value);
+ }
+ CvssV4Data.CiaRequirementType confidentialityRequirement = null;
+ value = rsV.getString(45);
+ if (value != null) {
+ confidentialityRequirement = CvssV4Data.CiaRequirementType.fromValue(value);
+ }
+ CvssV4Data.CiaRequirementType integrityRequirement = null;
+ value = rsV.getString(46);
+ if (value != null) {
+ integrityRequirement = CvssV4Data.CiaRequirementType.fromValue(value);
+ }
+ CvssV4Data.CiaRequirementType availabilityRequirement = null;
+ value = rsV.getString(47);
+ if (value != null) {
+ availabilityRequirement = CvssV4Data.CiaRequirementType.fromValue(value);
+ }
+ CvssV4Data.ModifiedAttackVectorType modifiedAttackVector = null;
+ value = rsV.getString(48);
+ if (value != null) {
+ modifiedAttackVector = CvssV4Data.ModifiedAttackVectorType.fromValue(value);
+ }
+ CvssV4Data.ModifiedAttackComplexityType modifiedAttackComplexity = null;
+ value = rsV.getString(49);
+ if (value != null) {
+ modifiedAttackComplexity = CvssV4Data.ModifiedAttackComplexityType.fromValue(value);
+ }
+ CvssV4Data.ModifiedAttackRequirementsType modifiedAttackRequirements = null;
+ value = rsV.getString(50);
+ if (value != null) {
+ modifiedAttackRequirements = CvssV4Data.ModifiedAttackRequirementsType.fromValue(value);
+ }
+ CvssV4Data.ModifiedPrivilegesRequiredType modifiedPrivilegesRequired = null;
+ value = rsV.getString(51);
+ if (value != null) {
+ modifiedPrivilegesRequired = CvssV4Data.ModifiedPrivilegesRequiredType.fromValue(value);
+ }
+ CvssV4Data.ModifiedUserInteractionType modifiedUserInteraction = null;
+ value = rsV.getString(52);
+ if (value != null) {
+ modifiedUserInteraction = CvssV4Data.ModifiedUserInteractionType.fromValue(value);
+ }
+ CvssV4Data.ModifiedCiaType modifiedVulnConfidentialityImpact = null;
+ value = rsV.getString(53);
+ if (value != null) {
+ modifiedVulnConfidentialityImpact = CvssV4Data.ModifiedCiaType.fromValue(value);
+ }
+ CvssV4Data.ModifiedCiaType modifiedVulnIntegrityImpact = null;
+ value = rsV.getString(54);
+ if (value != null) {
+ modifiedVulnIntegrityImpact = CvssV4Data.ModifiedCiaType.fromValue(value);
+ }
+ CvssV4Data.ModifiedCiaType modifiedVulnAvailabilityImpact = null;
+ value = rsV.getString(55);
+ if (value != null) {
+ modifiedVulnAvailabilityImpact = CvssV4Data.ModifiedCiaType.fromValue(value);
+ }
+ CvssV4Data.ModifiedSubCType modifiedSubConfidentialityImpact = null;
+ value = rsV.getString(56);
+ if (value != null) {
+ modifiedSubConfidentialityImpact = CvssV4Data.ModifiedSubCType.fromValue(value);
+ }
+ CvssV4Data.ModifiedSubIaType modifiedSubIntegrityImpact = null;
+ value = rsV.getString(57);
+ if (value != null) {
+ modifiedSubIntegrityImpact = CvssV4Data.ModifiedSubIaType.fromValue(value);
+ }
+ CvssV4Data.ModifiedSubIaType modifiedSubAvailabilityImpact = null;
+ value = rsV.getString(58);
+ if (value != null) {
+ modifiedSubAvailabilityImpact = CvssV4Data.ModifiedSubIaType.fromValue(value);
+ }
+ CvssV4Data.SafetyType safety = null;
+ value = rsV.getString(59);
+ if (value != null) {
+ safety = CvssV4Data.SafetyType.fromValue(value);
+ }
+ CvssV4Data.AutomatableType automatable = null;
+ value = rsV.getString(60);
+ if (value != null) {
+ automatable = CvssV4Data.AutomatableType.fromValue(value);
+ }
+ CvssV4Data.RecoveryType recovery = null;
+ value = rsV.getString(61);
+ if (value != null) {
+ recovery = CvssV4Data.RecoveryType.fromValue(value);
+ }
+ CvssV4Data.ValueDensityType valueDensity = null;
+ value = rsV.getString(62);
+ if (value != null) {
+ valueDensity = CvssV4Data.ValueDensityType.fromValue(value);
+ }
+ CvssV4Data.VulnerabilityResponseEffortType vulnerabilityResponseEffort = null;
+ value = rsV.getString(63);
+ if (value != null) {
+ vulnerabilityResponseEffort = CvssV4Data.VulnerabilityResponseEffortType.fromValue(value);
+ }
+ CvssV4Data.ProviderUrgencyType providerUrgency = null;
+ value = rsV.getString(64);
+ if (value != null) {
+ providerUrgency = CvssV4Data.ProviderUrgencyType.fromValue(value);
+ }
+ Double baseScore = null;
+ if (rsV.getObject(65) != null) {
+ baseScore = rsV.getDouble(65);
+ }
+ CvssV4Data.SeverityType baseSeverity = null;
+ value = rsV.getString(66);
+ if (value != null) {
+ baseSeverity = CvssV4Data.SeverityType.fromValue(value);
+ }
+ Double threatScore = null;
+ if (rsV.getObject(67) != null) {
+ threatScore = rsV.getDouble(67);
+ }
+ CvssV4Data.SeverityType threatSeverity = null;
+ value = rsV.getString(68);
+ if (value != null) {
+ threatSeverity = CvssV4Data.SeverityType.fromValue(value);
+ }
+ Double environmentalScore = null;
+ if (rsV.getObject(69) != null) {
+ environmentalScore = rsV.getDouble(69);
+ }
+ CvssV4Data.SeverityType environmentalSeverity = null;
+ value = rsV.getString(70);
+ if (value != null) {
+ environmentalSeverity = CvssV4Data.SeverityType.fromValue(value);
+ }
+ //initializing data twice to get the vector string. I really should have designed the object better...
+ CvssV4Data data = new CvssV4Data(version, vectorString, attackVector, attackComplexity, attackRequirements, privilegesRequired,
+ userInteraction, vulnConfidentialityImpact, vulnIntegrityImpact, vulnAvailabilityImpact, subConfidentialityImpact,
+ subIntegrityImpact, subAvailabilityImpact, exploitMaturity, confidentialityRequirement, integrityRequirement,
+ availabilityRequirement, modifiedAttackVector, modifiedAttackComplexity, modifiedAttackRequirements,
+ modifiedPrivilegesRequired, modifiedUserInteraction, modifiedVulnConfidentialityImpact, modifiedVulnIntegrityImpact,
+ modifiedVulnAvailabilityImpact, modifiedSubConfidentialityImpact, modifiedSubIntegrityImpact,
+ modifiedSubAvailabilityImpact, safety, automatable, recovery, valueDensity, vulnerabilityResponseEffort,
+ providerUrgency, baseScore, baseSeverity, threatScore, threatSeverity, environmentalScore, environmentalSeverity);
+ vectorString = data.toString();
+ data = new CvssV4Data(version, vectorString, attackVector, attackComplexity, attackRequirements, privilegesRequired,
+ userInteraction, vulnConfidentialityImpact, vulnIntegrityImpact, vulnAvailabilityImpact, subConfidentialityImpact,
+ subIntegrityImpact, subAvailabilityImpact, exploitMaturity, confidentialityRequirement, integrityRequirement,
+ availabilityRequirement, modifiedAttackVector, modifiedAttackComplexity, modifiedAttackRequirements,
+ modifiedPrivilegesRequired, modifiedUserInteraction, modifiedVulnConfidentialityImpact, modifiedVulnIntegrityImpact,
+ modifiedVulnAvailabilityImpact, modifiedSubConfidentialityImpact, modifiedSubIntegrityImpact,
+ modifiedSubAvailabilityImpact, safety, automatable, recovery, valueDensity, vulnerabilityResponseEffort,
+ providerUrgency, baseScore, baseSeverity, threatScore, threatSeverity, environmentalScore, environmentalSeverity);
+
+ final String source = rsV.getString(71);
+ CvssV4.Type cvssType = null;
+ value = rsV.getString(72);
+ if (value != null) {
+ cvssType = CvssV4.Type.fromValue(value);
+ }
+ final CvssV4 cvssv4 = new CvssV4(source, cvssType, data);
+ vuln.setCvssV4(cvssv4);
+ }
} else {
LOGGER.debug(cve + " does not exist in the database");
return null;
}
}
- try (PreparedStatement psCWE = getPreparedStatement(conn, SELECT_VULNERABILITY_CWE, cveId);
- ResultSet rsC = psCWE.executeQuery()) {
+ try (PreparedStatement psCWE = getPreparedStatement(conn, SELECT_VULNERABILITY_CWE, cveId); ResultSet rsC = psCWE.executeQuery()) {
while (rsC.next()) {
vuln.addCwe(rsC.getString(1));
}
}
- try (PreparedStatement psR = getPreparedStatement(conn, SELECT_REFERENCES, cveId);
- ResultSet rsR = psR.executeQuery()) {
+ try (PreparedStatement psR = getPreparedStatement(conn, SELECT_REFERENCES, cveId); ResultSet rsR = psR.executeQuery()) {
while (rsR.next()) {
vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
}
}
- try (PreparedStatement psS = getPreparedStatement(conn, SELECT_SOFTWARE, cveId);
- ResultSet rsS = psS.executeQuery()) {
+ try (PreparedStatement psS = getPreparedStatement(conn, SELECT_SOFTWARE, cveId); ResultSet rsS = psS.executeQuery()) {
//1 part, 2 vendor, 3 product, 4 version, 5 update_version, 6 edition, 7 lang,
//8 sw_edition, 9 target_sw, 10 target_hw, 11 other, 12 versionEndExcluding,
//13 versionEndIncluding, 14 versionStartExcluding, 15 versionStartIncluding, 16 vulnerable
@@ -810,13 +1083,13 @@ public Vulnerability getVulnerability(String cve, Connection conn) throws Databa
*/
public void updateVulnerability(DefCveItem cve, String baseEcosystem) {
clearCache();
- final String cveId = cve.getCve().getCVEDataMeta().getId();
+ final String cveId = cve.getCve().getId();
try {
- final String description = cveItemConverter.extractDescription(cve);
- if (cveItemConverter.isRejected(description)) {
+ if (cve.getCve().getVulnStatus() != null && cve.getCve().getVulnStatus().toUpperCase().startsWith("REJECT")) {
deleteVulnerability(cveId);
} else {
if (cveItemConverter.testCveCpeStartWithFilter(cve)) {
+ final String description = cveItemConverter.extractDescription(cve);
final int vulnerabilityId = updateOrInsertVulnerability(cve, description);
updateVulnerabilityInsertCwe(vulnerabilityId, cve);
updateVulnerabilityInsertReferences(vulnerabilityId, cve);
@@ -825,15 +1098,14 @@ public void updateVulnerability(DefCveItem cve, String baseEcosystem) {
updateVulnerabilityInsertSoftware(vulnerabilityId, cveId, software, baseEcosystem);
}
}
-
} catch (SQLException ex) {
- final String msg = String.format("Error updating '%s'", cveId);
+ final String msg = String.format("Error updating '%s'; %s", cveId, ex.getMessage());
LOGGER.debug(msg, ex);
- throw new DatabaseException(msg, ex);
+ throw new DatabaseException(msg);
} catch (CpeValidationException ex) {
- final String msg = String.format("Error parsing CPE entry from '%s'", cveId);
+ final String msg = String.format("Error parsing CPE entry from '%s'; %s", cveId, ex.getMessage());
LOGGER.debug(msg, ex);
- throw new DatabaseException(msg, ex);
+ throw new DatabaseException(msg);
}
}
@@ -858,8 +1130,7 @@ private void loadCpeEcosystemCache() {
private void saveCpeEcosystemCache() {
final Map, String> map = CpeEcosystemCache.getChanged();
if (map != null && !map.isEmpty()) {
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement ps = getPreparedStatement(conn, MERGE_CPE_ECOSYSTEM)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement ps = getPreparedStatement(conn, MERGE_CPE_ECOSYSTEM)) {
for (Map.Entry, String> entry : map.entrySet()) {
ps.setString(1, entry.getKey().getLeft());
ps.setString(2, entry.getKey().getRight());
@@ -894,8 +1165,7 @@ private int updateOrInsertVulnerability(DefCveItem cve, String description) {
loadCpeEcosystemCache();
}
final int vulnerabilityId;
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement callUpdate = getPreparedStatement(conn, UPDATE_VULNERABILITY)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement callUpdate = getPreparedStatement(conn, UPDATE_VULNERABILITY)) {
// String 1.cve, String 2.description, String 3.v2Severity, Float 4.v2ExploitabilityScore,
// Float 5.v2ImpactScore, Boolean 6.v2AcInsufInfo, Boolean 7.v2ObtainAllPrivilege,
// Boolean 8.v2ObtainUserPrivilege, Boolean 9.v2ObtainOtherPrivilege, Boolean 10.v2UserInteractionRequired,
@@ -906,88 +1176,213 @@ private int updateOrInsertVulnerability(DefCveItem cve, String description) {
// String 23.v3PrivilegesRequired, String 24.v3UserInteraction, String 25.v3Scope,
// String 26.v3ConfidentialityImpact, String 27.v3IntegrityImpact, String 28.v3AvailabilityImpact,
// Float 29.v3BaseScore, String 30.v3BaseSeverity, String 31.v3Version
- callUpdate.setString(1, cve.getCve().getCVEDataMeta().getId());
+// . String 32.v4version, String 33.v4attackVector, String 34.v4attackComplexity, String 35.v4attackRequirements,
+// String 36.v4privilegesRequired, String 37.v4userInteraction, String 38.v4vulnConfidentialityImpact,
+// String 39.v4vulnIntegrityImpact, String 40.v4vulnAvailabilityImpact, String 41.v4subConfidentialityImpact,
+// String 42.v4subIntegrityImpact, String 43.v4subAvailabilityImpact, String 44.v4exploitMaturity,
+// String 45.v4confidentialityRequirement, String 46.v4integrityRequirement, String 47.v4availabilityRequirement,
+// String 48.v4modifiedAttackVector, String 49.v4modifiedAttackComplexity, String 50.v4modifiedAttackRequirements,
+// String 51.v4modifiedPrivilegesRequired, String 52.v4modifiedUserInteraction, String 53.v4modifiedVulnConfidentialityImpact,
+// String 54.v4modifiedVulnIntegrityImpact, String 55.v4modifiedVulnAvailabilityImpact, String 56.v4modifiedSubConfidentialityImpact,
+// String 57.v4modifiedSubIntegrityImpact, String 58.v4modifiedSubAvailabilityImpact, String 59.v4safety,
+// String 60.v4automatable, String 61.v4recovery, String 62.v4valueDensity, String 63.v4vulnerabilityResponseEffort,
+// String 64.v4providerUrgency, Float 65.v4baseScore, String 66.v4baseSeverity, Float 67.v4threatScore,
+// String 68.v4threatSeverity, Float 69.v4environmentalScore, String 70.v4environmentalSeverity
+// . String 71.v4Source, String 72.v4type
+ callUpdate.setString(1, cve.getCve().getId());
callUpdate.setString(2, description);
- if (cve.getImpact().getBaseMetricV2() != null) {
- final BaseMetricV2 cvssv2 = cve.getImpact().getBaseMetricV2();
- Map props = cvssv2.getAdditionalProperties();
- callUpdate.setString(3, cvssv2.getSeverity());
- setFloatValue(callUpdate, 4, props, "exploitabilityScore");
- setFloatValue(callUpdate, 5, props, "impactScore");
- setBooleanValue(callUpdate, 6, props, "acInsufInfo");
- setBooleanValue(callUpdate, 7, props, "obtainAllPrivilege");
- setBooleanValue(callUpdate, 8, props, "obtainUserPrivilege");
- setBooleanValue(callUpdate, 9, props, "obtainOtherPrivilege");
- setBooleanValue(callUpdate, 10, props, "userInteractionRequired");
- callUpdate.setFloat(11, cvssv2.getCvssV2().getBaseScore().floatValue());
- callUpdate.setString(12, cvssv2.getCvssV2().getAccessVector().value());
- callUpdate.setString(13, cvssv2.getCvssV2().getAccessComplexity().value());
- callUpdate.setString(14, cvssv2.getCvssV2().getAuthentication().value());
- callUpdate.setString(15, cvssv2.getCvssV2().getConfidentialityImpact().value());
- callUpdate.setString(16, cvssv2.getCvssV2().getIntegrityImpact().value());
- callUpdate.setString(17, cvssv2.getCvssV2().getAvailabilityImpact().value());
- props = cvssv2.getCvssV2().getAdditionalProperties();
- setStringValue(callUpdate, 18, props, "version");
+ Optional optCvssv2 = null;
+ if (cve.getCve().getMetrics() != null && cve.getCve().getMetrics().getCvssMetricV2() != null) {
+ optCvssv2 = cve.getCve().getMetrics().getCvssMetricV2().stream().sorted(Comparator.comparing(CvssV2::getType)).findFirst();
+ }
+ if (optCvssv2 != null && optCvssv2.isPresent()) {
+ final CvssV2 cvssv2 = optCvssv2.get();
+ setUpdateColumn(callUpdate, 3, cvssv2.getBaseSeverity());
+ setUpdateColumn(callUpdate, 4, cvssv2.getExploitabilityScore());
+ setUpdateColumn(callUpdate, 5, cvssv2.getImpactScore());
+ setUpdateColumn(callUpdate, 6, cvssv2.getAcInsufInfo());
+ setUpdateColumn(callUpdate, 7, cvssv2.getObtainAllPrivilege());
+ setUpdateColumn(callUpdate, 8, cvssv2.getObtainUserPrivilege());
+ setUpdateColumn(callUpdate, 9, cvssv2.getObtainOtherPrivilege());
+ setUpdateColumn(callUpdate, 10, cvssv2.getUserInteractionRequired());
+ setUpdateColumn(callUpdate, 11, cvssv2.getCvssData().getBaseScore());
+ setUpdateColumn(callUpdate, 12, cvssv2.getCvssData().getAccessVector());
+ setUpdateColumn(callUpdate, 13, cvssv2.getCvssData().getAccessComplexity());
+ setUpdateColumn(callUpdate, 14, cvssv2.getCvssData().getAuthentication());
+ setUpdateColumn(callUpdate, 15, cvssv2.getCvssData().getConfidentialityImpact());
+ setUpdateColumn(callUpdate, 16, cvssv2.getCvssData().getIntegrityImpact());
+ setUpdateColumn(callUpdate, 17, cvssv2.getCvssData().getAvailabilityImpact());
+ setUpdateColumn(callUpdate, 18, cvssv2.getCvssData().getVersion());
+ } else {
+ callUpdate.setNull(3, java.sql.Types.VARCHAR);
+ callUpdate.setNull(4, java.sql.Types.DOUBLE);
+ callUpdate.setNull(5, java.sql.Types.DOUBLE);
+ callUpdate.setNull(6, java.sql.Types.VARCHAR);
+ //TODO this is may also be an issue for MS SQL, if an issue is created we'll just need
+ // to create an isMsSQL flag. See todo below in setUpdateColum
+ if (isOracle) {
+ callUpdate.setNull(7, java.sql.Types.BIT);
+ callUpdate.setNull(8, java.sql.Types.BIT);
+ callUpdate.setNull(9, java.sql.Types.BIT);
+ callUpdate.setNull(10, java.sql.Types.BIT);
+ } else {
+ callUpdate.setNull(7, java.sql.Types.BOOLEAN);
+ callUpdate.setNull(8, java.sql.Types.BOOLEAN);
+ callUpdate.setNull(9, java.sql.Types.BOOLEAN);
+ callUpdate.setNull(10, java.sql.Types.BOOLEAN);
+ }
+ callUpdate.setNull(11, java.sql.Types.DOUBLE);
+ callUpdate.setNull(12, java.sql.Types.VARCHAR);
+ callUpdate.setNull(13, java.sql.Types.VARCHAR);
+ callUpdate.setNull(14, java.sql.Types.VARCHAR);
+ callUpdate.setNull(15, java.sql.Types.VARCHAR);
+ callUpdate.setNull(16, java.sql.Types.VARCHAR);
+ callUpdate.setNull(17, java.sql.Types.VARCHAR);
+ callUpdate.setNull(18, java.sql.Types.VARCHAR);
+ }
+ Optional optCvssv30 = Optional.empty();
+ if (cve.getCve().getMetrics() != null && cve.getCve().getMetrics().getCvssMetricV30() != null) {
+ optCvssv30 = cve.getCve().getMetrics().getCvssMetricV30().stream().sorted(Comparator.comparing(CvssV3::getType)).findFirst();
+ }
+ Optional optCvssv31 = Optional.empty();
+ if (cve.getCve().getMetrics() != null && cve.getCve().getMetrics().getCvssMetricV31() != null) {
+ optCvssv31 = cve.getCve().getMetrics().getCvssMetricV31().stream().sorted(Comparator.comparing(CvssV3::getType)).findFirst();
+ }
+
+ CvssV3 cvssv3 = null;
+ if (optCvssv31.isPresent()) {
+ cvssv3 = optCvssv31.get();
+ } else if (optCvssv30.isPresent()) {
+ cvssv3 = optCvssv30.get();
+ }
+ if (cvssv3 != null) {
+ setUpdateColumn(callUpdate, 19, cvssv3.getExploitabilityScore());
+ setUpdateColumn(callUpdate, 20, cvssv3.getImpactScore());
+ setUpdateColumn(callUpdate, 21, cvssv3.getCvssData().getAttackVector());
+ setUpdateColumn(callUpdate, 22, cvssv3.getCvssData().getAttackComplexity());
+ setUpdateColumn(callUpdate, 23, cvssv3.getCvssData().getPrivilegesRequired());
+ setUpdateColumn(callUpdate, 24, cvssv3.getCvssData().getUserInteraction());
+ setUpdateColumn(callUpdate, 25, cvssv3.getCvssData().getScope());
+ setUpdateColumn(callUpdate, 26, cvssv3.getCvssData().getConfidentialityImpact());
+ setUpdateColumn(callUpdate, 27, cvssv3.getCvssData().getIntegrityImpact());
+ setUpdateColumn(callUpdate, 28, cvssv3.getCvssData().getAvailabilityImpact());
+ setUpdateColumn(callUpdate, 29, cvssv3.getCvssData().getBaseScore());
+ setUpdateColumn(callUpdate, 30, cvssv3.getCvssData().getBaseSeverity());
+ setUpdateColumn(callUpdate, 31, cvssv3.getCvssData().getVersion());
} else {
- callUpdate.setNull(3, java.sql.Types.NULL);
- callUpdate.setNull(4, java.sql.Types.NULL);
- callUpdate.setNull(5, java.sql.Types.NULL);
- callUpdate.setNull(6, java.sql.Types.NULL);
- callUpdate.setNull(7, java.sql.Types.NULL);
- callUpdate.setNull(8, java.sql.Types.NULL);
- callUpdate.setNull(9, java.sql.Types.NULL);
- callUpdate.setNull(10, java.sql.Types.NULL);
- callUpdate.setNull(11, java.sql.Types.NULL);
- callUpdate.setNull(12, java.sql.Types.NULL);
- callUpdate.setNull(13, java.sql.Types.NULL);
- callUpdate.setNull(14, java.sql.Types.NULL);
- callUpdate.setNull(15, java.sql.Types.NULL);
- callUpdate.setNull(16, java.sql.Types.NULL);
- callUpdate.setNull(17, java.sql.Types.NULL);
- callUpdate.setNull(18, java.sql.Types.NULL);
+ callUpdate.setNull(19, java.sql.Types.DOUBLE);
+ callUpdate.setNull(20, java.sql.Types.DOUBLE);
+ callUpdate.setNull(21, java.sql.Types.VARCHAR);
+ callUpdate.setNull(22, java.sql.Types.VARCHAR);
+ callUpdate.setNull(23, java.sql.Types.VARCHAR);
+ callUpdate.setNull(24, java.sql.Types.VARCHAR);
+ callUpdate.setNull(25, java.sql.Types.VARCHAR);
+ callUpdate.setNull(26, java.sql.Types.VARCHAR);
+ callUpdate.setNull(27, java.sql.Types.VARCHAR);
+ callUpdate.setNull(28, java.sql.Types.VARCHAR);
+ callUpdate.setNull(29, java.sql.Types.DOUBLE);
+ callUpdate.setNull(30, java.sql.Types.VARCHAR);
+ callUpdate.setNull(31, java.sql.Types.VARCHAR);
}
- if (cve.getImpact().getBaseMetricV3() != null) {
- final BaseMetricV3 cvssv3 = cve.getImpact().getBaseMetricV3();
- Map props = cvssv3.getAdditionalProperties();
- setFloatValue(callUpdate, 19, props, "exploitabilityScore");
- setFloatValue(callUpdate, 20, props, "impactScore");
-
- callUpdate.setString(21, cvssv3.getCvssV3().getAttackVector().value());
- callUpdate.setString(22, cvssv3.getCvssV3().getAttackComplexity().value());
- callUpdate.setString(23, cvssv3.getCvssV3().getPrivilegesRequired().value());
- callUpdate.setString(24, cvssv3.getCvssV3().getUserInteraction().value());
- callUpdate.setString(25, cvssv3.getCvssV3().getScope().value());
- callUpdate.setString(26, cvssv3.getCvssV3().getConfidentialityImpact().value());
- callUpdate.setString(27, cvssv3.getCvssV3().getIntegrityImpact().value());
- callUpdate.setString(28, cvssv3.getCvssV3().getAvailabilityImpact().value());
- callUpdate.setFloat(29, cvssv3.getCvssV3().getBaseScore().floatValue());
- callUpdate.setString(30, cvssv3.getCvssV3().getBaseSeverity().value());
-
- props = cvssv3.getCvssV3().getAdditionalProperties();
- setStringValue(callUpdate, 31, props, "version");
+
+ Optional optCvssv4 = null;
+ if (cve.getCve().getMetrics() != null && cve.getCve().getMetrics().getCvssMetricV40() != null) {
+ optCvssv4 = cve.getCve().getMetrics().getCvssMetricV40().stream().sorted(Comparator.comparing(CvssV4::getType)).findFirst();
+ }
+ if (optCvssv4 != null && optCvssv4.isPresent()) {
+ final CvssV4 cvssv4 = optCvssv4.get();
+ setUpdateColumn(callUpdate, 32, cvssv4.getCvssData().getVersion());
+ setUpdateColumn(callUpdate, 33, cvssv4.getCvssData().getAttackVector());
+ setUpdateColumn(callUpdate, 34, cvssv4.getCvssData().getAttackComplexity());
+ setUpdateColumn(callUpdate, 35, cvssv4.getCvssData().getAttackRequirements());
+ setUpdateColumn(callUpdate, 36, cvssv4.getCvssData().getPrivilegesRequired());
+ setUpdateColumn(callUpdate, 37, cvssv4.getCvssData().getUserInteraction());
+ setUpdateColumn(callUpdate, 38, cvssv4.getCvssData().getVulnConfidentialityImpact());
+ setUpdateColumn(callUpdate, 39, cvssv4.getCvssData().getVulnIntegrityImpact());
+ setUpdateColumn(callUpdate, 40, cvssv4.getCvssData().getVulnAvailabilityImpact());
+ setUpdateColumn(callUpdate, 41, cvssv4.getCvssData().getSubConfidentialityImpact());
+ setUpdateColumn(callUpdate, 42, cvssv4.getCvssData().getSubIntegrityImpact());
+ setUpdateColumn(callUpdate, 43, cvssv4.getCvssData().getSubAvailabilityImpact());
+ setUpdateColumn(callUpdate, 44, cvssv4.getCvssData().getExploitMaturity());
+ setUpdateColumn(callUpdate, 45, cvssv4.getCvssData().getConfidentialityRequirement());
+ setUpdateColumn(callUpdate, 46, cvssv4.getCvssData().getIntegrityRequirement());
+ setUpdateColumn(callUpdate, 47, cvssv4.getCvssData().getAvailabilityRequirement());
+ setUpdateColumn(callUpdate, 48, cvssv4.getCvssData().getModifiedAttackVector());
+ setUpdateColumn(callUpdate, 49, cvssv4.getCvssData().getModifiedAttackComplexity());
+ setUpdateColumn(callUpdate, 50, cvssv4.getCvssData().getModifiedAttackRequirements());
+ setUpdateColumn(callUpdate, 51, cvssv4.getCvssData().getModifiedPrivilegesRequired());
+ setUpdateColumn(callUpdate, 52, cvssv4.getCvssData().getModifiedUserInteraction());
+ setUpdateColumn(callUpdate, 53, cvssv4.getCvssData().getModifiedVulnConfidentialityImpact());
+ setUpdateColumn(callUpdate, 54, cvssv4.getCvssData().getModifiedVulnIntegrityImpact());
+ setUpdateColumn(callUpdate, 55, cvssv4.getCvssData().getModifiedVulnAvailabilityImpact());
+ setUpdateColumn(callUpdate, 56, cvssv4.getCvssData().getModifiedSubConfidentialityImpact());
+ setUpdateColumn(callUpdate, 57, cvssv4.getCvssData().getModifiedSubIntegrityImpact());
+ setUpdateColumn(callUpdate, 58, cvssv4.getCvssData().getModifiedSubAvailabilityImpact());
+ setUpdateColumn(callUpdate, 59, cvssv4.getCvssData().getSafety());
+ setUpdateColumn(callUpdate, 60, cvssv4.getCvssData().getAutomatable());
+ setUpdateColumn(callUpdate, 61, cvssv4.getCvssData().getRecovery());
+ setUpdateColumn(callUpdate, 62, cvssv4.getCvssData().getValueDensity());
+ setUpdateColumn(callUpdate, 63, cvssv4.getCvssData().getVulnerabilityResponseEffort());
+ setUpdateColumn(callUpdate, 64, cvssv4.getCvssData().getProviderUrgency());
+ setUpdateColumn(callUpdate, 65, cvssv4.getCvssData().getBaseScore());
+ setUpdateColumn(callUpdate, 66, cvssv4.getCvssData().getBaseSeverity());
+ setUpdateColumn(callUpdate, 67, cvssv4.getCvssData().getThreatScore());
+ setUpdateColumn(callUpdate, 68, cvssv4.getCvssData().getThreatSeverity());
+ setUpdateColumn(callUpdate, 69, cvssv4.getCvssData().getEnvironmentalScore());
+ setUpdateColumn(callUpdate, 70, cvssv4.getCvssData().getEnvironmentalSeverity());
+ setUpdateColumn(callUpdate, 71, cvssv4.getSource());
+ setUpdateColumn(callUpdate, 72, cvssv4.getType());
} else {
- callUpdate.setNull(19, java.sql.Types.NULL);
- callUpdate.setNull(20, java.sql.Types.NULL);
- callUpdate.setNull(21, java.sql.Types.NULL);
- callUpdate.setNull(22, java.sql.Types.NULL);
- callUpdate.setNull(23, java.sql.Types.NULL);
- callUpdate.setNull(24, java.sql.Types.NULL);
- callUpdate.setNull(25, java.sql.Types.NULL);
- callUpdate.setNull(26, java.sql.Types.NULL);
- callUpdate.setNull(27, java.sql.Types.NULL);
- callUpdate.setNull(28, java.sql.Types.NULL);
- callUpdate.setNull(29, java.sql.Types.NULL);
- callUpdate.setNull(30, java.sql.Types.NULL);
- callUpdate.setNull(31, java.sql.Types.NULL);
+ callUpdate.setNull(32, java.sql.Types.VARCHAR);
+ callUpdate.setNull(33, java.sql.Types.VARCHAR);
+ callUpdate.setNull(34, java.sql.Types.VARCHAR);
+ callUpdate.setNull(35, java.sql.Types.VARCHAR);
+ callUpdate.setNull(36, java.sql.Types.VARCHAR);
+ callUpdate.setNull(37, java.sql.Types.VARCHAR);
+ callUpdate.setNull(38, java.sql.Types.VARCHAR);
+ callUpdate.setNull(39, java.sql.Types.VARCHAR);
+ callUpdate.setNull(40, java.sql.Types.VARCHAR);
+ callUpdate.setNull(41, java.sql.Types.VARCHAR);
+ callUpdate.setNull(42, java.sql.Types.VARCHAR);
+ callUpdate.setNull(43, java.sql.Types.VARCHAR);
+ callUpdate.setNull(44, java.sql.Types.VARCHAR);
+ callUpdate.setNull(45, java.sql.Types.VARCHAR);
+ callUpdate.setNull(46, java.sql.Types.VARCHAR);
+ callUpdate.setNull(47, java.sql.Types.VARCHAR);
+ callUpdate.setNull(48, java.sql.Types.VARCHAR);
+ callUpdate.setNull(49, java.sql.Types.VARCHAR);
+ callUpdate.setNull(50, java.sql.Types.VARCHAR);
+ callUpdate.setNull(51, java.sql.Types.VARCHAR);
+ callUpdate.setNull(52, java.sql.Types.VARCHAR);
+ callUpdate.setNull(53, java.sql.Types.VARCHAR);
+ callUpdate.setNull(54, java.sql.Types.VARCHAR);
+ callUpdate.setNull(55, java.sql.Types.VARCHAR);
+ callUpdate.setNull(56, java.sql.Types.VARCHAR);
+ callUpdate.setNull(57, java.sql.Types.VARCHAR);
+ callUpdate.setNull(58, java.sql.Types.VARCHAR);
+ callUpdate.setNull(59, java.sql.Types.VARCHAR);
+ callUpdate.setNull(60, java.sql.Types.VARCHAR);
+ callUpdate.setNull(61, java.sql.Types.VARCHAR);
+ callUpdate.setNull(62, java.sql.Types.VARCHAR);
+ callUpdate.setNull(63, java.sql.Types.VARCHAR);
+ callUpdate.setNull(64, java.sql.Types.VARCHAR);
+ callUpdate.setNull(65, java.sql.Types.DOUBLE);
+ callUpdate.setNull(66, java.sql.Types.VARCHAR);
+ callUpdate.setNull(67, java.sql.Types.DOUBLE);
+ callUpdate.setNull(68, java.sql.Types.VARCHAR);
+ callUpdate.setNull(69, java.sql.Types.DOUBLE);
+ callUpdate.setNull(70, java.sql.Types.VARCHAR);
+ callUpdate.setNull(71, java.sql.Types.VARCHAR);
+ callUpdate.setNull(72, java.sql.Types.VARCHAR);
}
if (isOracle) {
try {
final CallableStatement cs = (CallableStatement) callUpdate;
- cs.registerOutParameter(32, JDBCType.INTEGER);
+ cs.registerOutParameter(73, JDBCType.INTEGER);
cs.executeUpdate();
- vulnerabilityId = cs.getInt(32);
+ vulnerabilityId = cs.getInt(73);
} catch (SQLException ex) {
- final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", cve.getCve().getCVEDataMeta().getId());
+ final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", cve.getCve().getId());
throw new DatabaseException(msg, ex);
}
} else {
@@ -995,7 +1390,7 @@ private int updateOrInsertVulnerability(DefCveItem cve, String description) {
rs.next();
vulnerabilityId = rs.getInt(1);
} catch (SQLException ex) {
- final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", cve.getCve().getCVEDataMeta().getId());
+ final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", cve.getCve().getId());
throw new DatabaseException(msg, ex);
}
}
@@ -1013,22 +1408,24 @@ private int updateOrInsertVulnerability(DefCveItem cve, String description) {
* @throws SQLException thrown if there is an error inserting the data
*/
private void updateVulnerabilityInsertCwe(int vulnerabilityId, DefCveItem cve) throws SQLException {
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement insertCWE = getPreparedStatement(conn, INSERT_CWE, vulnerabilityId)) {
- for (ProblemtypeDatum datum : cve.getCve().getProblemtype().getProblemtypeData()) {
- for (LangString desc : datum.getDescription()) {
- if ("en".equals(desc.getLang())) {
- insertCWE.setString(2, desc.getValue());
- if (isBatchInsertEnabled()) {
- insertCWE.addBatch();
- } else {
- insertCWE.execute();
+ if (cve.getCve() != null && cve.getCve().getWeaknesses() != null) {
+ try (Connection conn = databaseManager.getConnection();
+ PreparedStatement insertCWE = getPreparedStatement(conn, INSERT_CWE, vulnerabilityId)) {
+ for (Weakness weakness : cve.getCve().getWeaknesses()) {
+ for (LangString desc : weakness.getDescription()) {
+ if ("en".equals(desc.getLang())) {
+ insertCWE.setString(2, desc.getValue());
+ if (isBatchInsertEnabled()) {
+ insertCWE.addBatch();
+ } else {
+ insertCWE.execute();
+ }
}
}
}
- }
- if (isBatchInsertEnabled()) {
- insertCWE.executeBatch();
+ if (isBatchInsertEnabled()) {
+ insertCWE.executeBatch();
+ }
}
}
}
@@ -1112,8 +1509,7 @@ public void updateKnownExploitedVulnerabilities(
private void updateVulnerabilityInsertSoftware(int vulnerabilityId, String cveId,
List software, String baseEcosystem)
throws DatabaseException, SQLException {
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement insertSoftware = getPreparedStatement(conn, INSERT_SOFTWARE)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement insertSoftware = getPreparedStatement(conn, INSERT_SOFTWARE)) {
for (VulnerableSoftware parsedCpe : software) {
insertSoftware.setInt(1, vulnerabilityId);
insertSoftware.setString(2, parsedCpe.getPart().getAbbreviation());
@@ -1167,14 +1563,29 @@ private void updateVulnerabilityInsertSoftware(int vulnerabilityId, String cveId
* @throws SQLException thrown if there is an error inserting the data
*/
private void updateVulnerabilityInsertReferences(int vulnerabilityId, DefCveItem cve) throws SQLException {
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement insertReference = getPreparedStatement(conn, INSERT_REFERENCE)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement insertReference = getPreparedStatement(conn, INSERT_REFERENCE)) {
if (cve.getCve().getReferences() != null) {
- for (Reference r : cve.getCve().getReferences().getReferenceData()) {
+ for (Reference r : cve.getCve().getReferences()) {
insertReference.setInt(1, vulnerabilityId);
- insertReference.setString(2, r.getName());
- insertReference.setString(3, r.getUrl());
- insertReference.setString(4, r.getRefsource());
+ String name = null;
+ if (r.getTags() != null) {
+ name = r.getTags().stream().sorted().collect(Collectors.joining(",")).toUpperCase().replaceAll("\\s", "_");
+ }
+ if (name != null) {
+ insertReference.setString(2, name);
+ } else {
+ insertReference.setNull(2, java.sql.Types.VARCHAR);
+ }
+ if (r.getUrl() != null && !r.getUrl().isEmpty()) {
+ insertReference.setString(3, r.getUrl());
+ } else {
+ insertReference.setNull(3, java.sql.Types.VARCHAR);
+ }
+ if (r.getSource() != null && !r.getSource().isEmpty()) {
+ insertReference.setString(4, r.getSource());
+ } else {
+ insertReference.setNull(4, java.sql.Types.VARCHAR);
+ }
if (isBatchInsertEnabled()) {
insertReference.addBatch();
} else {
@@ -1198,20 +1609,24 @@ private void updateVulnerabilityInsertReferences(int vulnerabilityId, DefCveItem
*/
private List parseCpes(DefCveItem cve) throws CpeValidationException {
final List software = new ArrayList<>();
- final List cpeEntries = cve.getConfigurations().getNodes().stream()
- .collect(NodeFlatteningCollector.getInstance())
- .collect(CpeMatchStreamCollector.getInstance())
- .filter(predicate -> predicate.getCpe23Uri() != null)
- .filter(predicate -> predicate.getCpe23Uri().startsWith(cpeStartsWithFilter))
+
+ final List cpeEntries = cve.getCve().getConfigurations().stream()
+ .filter(config -> config.getNodes() != null)
+ .map(Config::getNodes)
+ .flatMap(List::stream)
+ .map(Node::getCpeMatch)
+ .flatMap(List::stream)
+ .filter(predicate -> predicate.getCriteria() != null)
+ .filter(predicate -> predicate.getCriteria().startsWith(cpeStartsWithFilter))
//this single CPE entry causes nearly 100% FP - so filtering it at the source.
- .filter(entry -> !("CVE-2009-0754".equals(cve.getCve().getCVEDataMeta().getId())
- && "cpe:2.3:a:apache:apache:*:*:*:*:*:*:*:*".equals(entry.getCpe23Uri())))
+ .filter(entry -> !("CVE-2009-0754".equals(cve.getCve().getId())
+ && "cpe:2.3:a:apache:apache:*:*:*:*:*:*:*:*".equals(entry.getCriteria())))
.collect(Collectors.toList());
final VulnerableSoftwareBuilder builder = new VulnerableSoftwareBuilder();
try {
cpeEntries.forEach(entry -> {
- builder.cpe(parseCpe(entry, cve.getCve().getCVEDataMeta().getId()))
+ builder.cpe(parseCpe(entry, cve.getCve().getId()))
.versionEndExcluding(entry.getVersionEndExcluding())
.versionStartExcluding(entry.getVersionStartExcluding())
.versionEndIncluding(entry.getVersionEndIncluding())
@@ -1240,22 +1655,14 @@ private List parseCpes(DefCveItem cve) throws CpeValidationE
* @throws DatabaseException thrown if there is an error converting the
* CpeMatch into a CPE object
*/
- private Cpe parseCpe(DefCpeMatch cpe, String cveId) throws DatabaseException {
- Cpe parsedCpe;
+ private Cpe parseCpe(CpeMatch cpe, String cveId) throws DatabaseException {
+ final Cpe parsedCpe;
try {
//the replace is a hack as the NVD does not properly escape backslashes in their JSON
- parsedCpe = CpeParser.parse(cpe.getCpe23Uri(), true);
+ parsedCpe = CpeParser.parse(cpe.getCriteria(), true);
} catch (CpeParsingException ex) {
- LOGGER.debug("NVD (" + cveId + ") contain an invalid 2.3 CPE: " + cpe.getCpe23Uri());
- if (cpe.getCpe22Uri() != null && !cpe.getCpe22Uri().isEmpty()) {
- try {
- parsedCpe = CpeParser.parse(cpe.getCpe22Uri(), true);
- } catch (CpeParsingException ex2) {
- throw new DatabaseException("Unable to parse CPE: " + cpe.getCpe23Uri(), ex);
- }
- } else {
- throw new DatabaseException("Unable to parse CPE: " + cpe.getCpe23Uri(), ex);
- }
+ LOGGER.debug("NVD (" + cveId + ") contain an invalid 2.3 CPE: " + cpe.getCriteria());
+ throw new DatabaseException("Unable to parse CPE: " + cpe.getCriteria(), ex);
}
return parsedCpe;
}
@@ -1336,8 +1743,8 @@ public boolean dataExists() {
}
LOGGER.error("Unable to access the local database.\n\nEnsure that '{}' is a writable directory. "
+ "If the problem persist try deleting the files in '{}' and running {} again. If the problem continues, please "
- + "create a log file (see documentation at https://jeremylong.github.io/DependencyCheck/) and open a ticket at "
- + "https://github.com/jeremylong/DependencyCheck/issues and include the log file.\n\n",
+ + "create a log file (see documentation at https://dependency-check.github.io/DependencyCheck/) and open a ticket at "
+ + "https://github.com/dependency-check/DependencyCheck/issues and include the log file.\n\n",
dd, dd, settings.getString(Settings.KEYS.APPLICATION_NAME));
LOGGER.debug("", ex);
}
@@ -1399,8 +1806,7 @@ public void persistEcosystemCache() {
public void defrag() {
if (isH2) {
final long start = System.currentTimeMillis();
- try (Connection conn = databaseManager.getConnection();
- CallableStatement psCompaxt = conn.prepareCall("SHUTDOWN DEFRAG")) {
+ try (Connection conn = databaseManager.getConnection(); CallableStatement psCompaxt = conn.prepareCall("SHUTDOWN DEFRAG")) {
LOGGER.info("Begin database defrag");
psCompaxt.execute();
final long millis = System.currentTimeMillis() - start;
@@ -1447,8 +1853,7 @@ VulnerableSoftware getMatchingSoftware(Cpe cpe, Set vulnerab
*/
public void deleteUnusedCpe() {
clearCache();
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement ps = getPreparedStatement(conn, DELETE_UNUSED_DICT_CPE)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement ps = getPreparedStatement(conn, DELETE_UNUSED_DICT_CPE)) {
ps.executeUpdate();
} catch (SQLException ex) {
LOGGER.error("Unable to delete CPE dictionary entries", ex);
@@ -1468,8 +1873,7 @@ public void deleteUnusedCpe() {
*/
public void addCpe(String cpe, String vendor, String product) {
clearCache();
- try (Connection conn = databaseManager.getConnection();
- PreparedStatement ps = getPreparedStatement(conn, ADD_DICT_CPE)) {
+ try (Connection conn = databaseManager.getConnection(); PreparedStatement ps = getPreparedStatement(conn, ADD_DICT_CPE)) {
ps.setString(1, cpe);
ps.setString(2, vendor);
ps.setString(3, product);
@@ -1528,6 +1932,340 @@ private void addNullableStringParameter(PreparedStatement ps, int pos, String va
}
}
+ private void setUpdateColumn(PreparedStatement ps, int i, Double value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.DOUBLE);
+ } else {
+ ps.setDouble(i, value);
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV2Data.AuthenticationType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV2Data.CiaType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV2Data.Version value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV2Data.AccessComplexityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV2Data.AccessVectorType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, String value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value);
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4.Type value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, Boolean value) throws SQLException {
+ if (value == null) {
+ //TODO this is may also be an issue for MS SQL, if an issue is created we'll just need
+ // to create an isMsSQL flag. See todo above in updateOrInsertVulnerability.
+ if (isOracle) {
+ ps.setNull(i, java.sql.Types.BIT);
+ } else {
+ ps.setNull(i, java.sql.Types.BOOLEAN);
+ }
+ } else {
+ ps.setBoolean(i, value);
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.AttackVectorType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.AttackComplexityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.PrivilegesRequiredType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.UserInteractionType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.ScopeType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.SeverityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.CiaType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV3Data.Version value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.Version value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.AttackVectorType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.AttackComplexityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.AttackRequirementsType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.PrivilegesRequiredType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.UserInteractionType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.CiaType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ExploitMaturityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.CiaRequirementType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedAttackVectorType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedAttackComplexityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedAttackRequirementsType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedPrivilegesRequiredType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedUserInteractionType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedCiaType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedSubCType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ModifiedSubIaType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.SafetyType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.AutomatableType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.RecoveryType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ValueDensityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.VulnerabilityResponseEffortType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.ProviderUrgencyType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
+ private void setUpdateColumn(PreparedStatement ps, int i, CvssV4Data.SeverityType value) throws SQLException {
+ if (value == null) {
+ ps.setNull(i, java.sql.Types.VARCHAR);
+ } else {
+ ps.setString(i, value.value());
+ }
+ }
+
/**
* Sets the float parameter on a prepared statement from a properties map.
*
@@ -1542,10 +2280,10 @@ private void setFloatValue(PreparedStatement ps, int i, Map prop
try {
ps.setFloat(i, Float.parseFloat(props.get(key).toString()));
} catch (NumberFormatException nfe) {
- ps.setNull(i, java.sql.Types.NULL);
+ ps.setNull(i, java.sql.Types.FLOAT);
}
} else {
- ps.setNull(i, java.sql.Types.NULL);
+ ps.setNull(i, java.sql.Types.FLOAT);
}
}
@@ -1562,7 +2300,7 @@ private void setStringValue(PreparedStatement ps, int i, Map pro
if (props != null && props.containsKey(key)) {
ps.setString(i, props.get(key).toString());
} else {
- ps.setNull(i, java.sql.Types.NULL);
+ ps.setNull(i, java.sql.Types.VARCHAR);
}
}
@@ -1579,7 +2317,7 @@ private void setBooleanValue(PreparedStatement ps, int i, Map pr
if (props != null && props.containsKey(key)) {
ps.setBoolean(i, Boolean.parseBoolean(props.get(key).toString()));
} else {
- ps.setNull(i, java.sql.Types.NULL);
+ ps.setNull(i, java.sql.Types.BOOLEAN);
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveItemOperator.java b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveItemOperator.java
index 87866186e72..9d22ec4093b 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveItemOperator.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveItemOperator.java
@@ -17,13 +17,16 @@
*/
package org.owasp.dependencycheck.data.nvdcve;
+import io.github.jeremylong.openvulnerability.client.nvd.Config;
+
+import java.util.Objects;
import java.util.stream.Collectors;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
-import org.owasp.dependencycheck.data.nvd.json.CpeMatchStreamCollector;
-import org.owasp.dependencycheck.data.nvd.json.DefCveItem;
-import org.owasp.dependencycheck.data.nvd.json.LangString;
-import org.owasp.dependencycheck.data.nvd.json.NodeFlatteningCollector;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
+import io.github.jeremylong.openvulnerability.client.nvd.LangString;
+import io.github.jeremylong.openvulnerability.client.nvd.Node;
+import java.util.List;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
/**
@@ -57,7 +60,7 @@ public CveItemOperator(String cpeStartsWithFilter) {
* @return the English descriptions from the CVE object
*/
public String extractDescription(DefCveItem cve) {
- return cve.getCve().getDescription().getDescriptionData().stream().filter((desc)
+ return cve.getCve().getDescriptions().stream().filter((desc)
-> "en".equals(desc.getLang())).map(LangString::getValue).collect(Collectors.joining(" "));
}
@@ -215,12 +218,20 @@ public boolean isRejected(String description) {
* @return true if the CVE affects CPEs identified by the
* configured CPE Starts with filter
*/
- protected boolean testCveCpeStartWithFilter(final DefCveItem cve) {
- //cycle through to see if this is a CPE we care about (use the CPE filters
- return cve.getConfigurations().getNodes().stream()
- .collect(NodeFlatteningCollector.getInstance())
- .collect(CpeMatchStreamCollector.getInstance())
- .filter(cpe -> cpe.getCpe23Uri() != null)
- .anyMatch(cpe -> cpe.getCpe23Uri().startsWith(cpeStartsWithFilter));
+ boolean testCveCpeStartWithFilter(final DefCveItem cve) {
+ if (cve.getCve().getConfigurations() != null) {
+ //cycle through to see if this is a CPE we care about (use the CPE filters
+ return cve.getCve().getConfigurations().stream()
+ .filter(config -> config.getNodes() != null)
+ .map(Config::getNodes)
+ .flatMap(List::stream)
+ .filter(Objects::nonNull)
+ .map(Node::getCpeMatch)
+ .filter(Objects::nonNull)
+ .flatMap(List::stream)
+ .filter(cpe -> cpe != null && cpe.getCriteria() != null)
+ .anyMatch(cpe -> cpe.getCriteria().startsWith(cpeStartsWithFilter));
+ }
+ return false;
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseManager.java b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseManager.java
index f2ad3472e4f..b1553ebf988 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseManager.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseManager.java
@@ -70,7 +70,7 @@ public final class DatabaseManager {
/**
* The URL that discusses upgrading non-H2 databases.
*/
- public static final String UPGRADE_HELP_URL = "https://jeremylong.github.io/DependencyCheck/data/upgrade.html";
+ public static final String UPGRADE_HELP_URL = "https://dependency-check.github.io/DependencyCheck/data/upgrade.html";
/**
* The database driver used to connect to the database.
*/
@@ -197,6 +197,10 @@ private void initialize() throws DatabaseException {
LOGGER.debug("Unable to connect to the database", ex);
throw new DatabaseException("Unable to connect to the database", ex);
}
+ } else if (isH2 && ex.getMessage().contains("file version or invalid file header")) {
+ LOGGER.error("Incompatible or corrupt database found. To resolve this issue please remove the existing "
+ + "database by running purge");
+ throw new DatabaseException("Incompatible or corrupt database found; run the purge command to resolve the issue");
} else {
LOGGER.debug("Unable to connect to the database", ex);
throw new DatabaseException("Unable to connect to the database", ex);
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
index f1ef704d3f1..698e0bcd749 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
@@ -17,8 +17,6 @@
*/
package org.owasp.dependencycheck.data.nvdcve;
-import java.time.Instant;
-import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Map;
@@ -27,8 +25,7 @@
import java.util.TreeMap;
import javax.annotation.concurrent.ThreadSafe;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
-import org.owasp.dependencycheck.data.update.exception.UpdateException;
+import org.owasp.dependencycheck.utils.DateUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -46,26 +43,21 @@ public class DatabaseProperties {
*/
private static final Logger LOGGER = LoggerFactory.getLogger(DatabaseProperties.class);
/**
- * Modified key word, used as a key to store information about the modified
- * file (i.e. the containing the last 8 days of updates)..
+ * The last modified request data for the NVD API.
*/
- public static final String MODIFIED = "Modified";
+ public static final String NVD_API_LAST_MODIFIED = "nvd.api.last.modified";
/**
- * The properties file key for the last checked field - used to store the
- * last check time of the Modified NVD CVE xml file.
+ * The date the NVD API was last checked for an update.
*/
- public static final String LAST_CHECKED = "NVD CVE Checked";
+ public static final String NVD_API_LAST_CHECKED = "nvd.api.last.checked";
/**
- * The properties file key for the last updated field - used to store the
- * last updated time of the Modified NVD CVE xml file.
+ * The date the NVD cache was last checked for an update.
*/
- public static final String LAST_UPDATED = "NVD CVE Modified";
+ public static final String NVD_CACHE_LAST_CHECKED = "nvd.cache.last.checked";
/**
- * Stores the last updated time for each of the NVD CVE files. These
- * timestamps should be updated if we process the modified file within 7
- * days of the last update.
+ * The date the NVD cache data was last modified/updated.
*/
- public static final String LAST_UPDATED_BASE = "NVD CVE ";
+ public static final String NVD_CACHE_LAST_MODIFIED = "nvd.cache.last.modified";
/**
* The key for the last time the CPE data was updated.
*/
@@ -74,7 +66,6 @@ public class DatabaseProperties {
* The key for the database schema version.
*/
public static final String VERSION = "version";
-
/**
* The key for the last check time for the Known Exploited Vulnerabilities.
*/
@@ -83,7 +74,6 @@ public class DatabaseProperties {
* The key for the version the Known Exploited Vulnerabilities.
*/
public static final String KEV_VERSION = "kev.version";
-
/**
* A collection of properties about the data.
*/
@@ -112,27 +102,13 @@ public synchronized boolean isEmpty() {
return properties == null || properties.isEmpty();
}
- /**
- * Saves the last updated information to the properties file.
- *
- * @param updatedValue the updated NVD CVE entry
- * @throws UpdateException is thrown if there is an update exception
- */
- public synchronized void save(NvdCveInfo updatedValue) throws UpdateException {
- if (updatedValue == null) {
- return;
- }
- save(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
- }
-
/**
* Saves the key value pair to the properties store.
*
* @param key the property key
* @param value the property value
- * @throws UpdateException is thrown if there is an update exception
*/
- public synchronized void save(String key, String value) throws UpdateException {
+ public synchronized void save(String key, String value) {
properties.put(key, value);
cveDB.saveProperty(key, value);
}
@@ -181,21 +157,100 @@ public synchronized Map getMetaData() {
for (Entry entry : properties.entrySet()) {
final String key = (String) entry.getKey();
if (!"version".equals(key)) {
- if ("NVD CVE Modified".equals(key) || "NVD CVE Checked".equals(key) || "VersionCheckOn".equals(key)) {
- try {
- final long epoch = Long.parseLong((String) entry.getValue());
- final ZonedDateTime dateTime = Instant.ofEpochSecond(epoch).atZone(ZoneId.systemDefault());
- final String formatted = DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(dateTime);
- map.put(key, formatted);
- } catch (Throwable ex) { //deliberately being broad in this catch clause
- LOGGER.debug("Unable to parse timestamp from DB", ex);
- map.put(key, (String) entry.getValue());
- }
- } else if (!key.startsWith("NVD CVE ")) {
- map.put(key, (String) entry.getValue());
+ if (DatabaseProperties.NVD_API_LAST_CHECKED.equals(key)) {
+ map.put("NVD API Last Checked", entry.getValue().toString());
+
+ } else if (DatabaseProperties.NVD_API_LAST_MODIFIED.equals(key)) {
+ map.put("NVD API Last Modified", entry.getValue().toString());
+
+ } else if (DatabaseProperties.NVD_CACHE_LAST_CHECKED.equals(key)) {
+ map.put("NVD Cache Last Checked", entry.getValue().toString());
+
+ } else if (DatabaseProperties.NVD_CACHE_LAST_MODIFIED.equals(key)) {
+ map.put("NVD Cache Last Modified", entry.getValue().toString());
}
}
}
return map;
}
+
+ /**
+ * Retrieves a zoned date time.
+ *
+ * @param key the property key
+ * @return the zoned date time
+ */
+ public ZonedDateTime getTimestamp(String key) {
+ return DatabaseProperties.getTimestamp(properties, key);
+ }
+
+ /**
+ * Stores a timestamp.
+ *
+ * @param key the property key
+ * @param timestamp the zoned date time
+ */
+ public void save(String key, ZonedDateTime timestamp) {
+ final DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
+ save(key, dtf.format(timestamp));
+ }
+
+ /**
+ * Stores a timestamp in the properties file.
+ *
+ * @param properties the properties to store the timestamp
+ * @param key the property key
+ * @param timestamp the zoned date time
+ */
+ public static void setTimestamp(Properties properties, String key, ZonedDateTime timestamp) {
+ final DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
+ properties.put(key, dtf.format(timestamp));
+ }
+
+ /**
+ * Retrieves a zoned date time.
+ *
+ * @param properties the properties file containing the date time
+ * @param key the property key
+ * @return the zoned date time
+ */
+ public static ZonedDateTime getTimestamp(Properties properties, String key) {
+ final DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
+ final String val = properties.getProperty(key);
+ if (val != null) {
+ final String value = properties.getProperty(key);
+ return ZonedDateTime.parse(value, dtf);
+ }
+ return null;
+ }
+
+ /**
+ * Retrieves a zoned date time.
+ *
+ * @param properties the properties file containing the date time
+ * @param key the property key
+ * @return the zoned date time
+ */
+ public static ZonedDateTime getIsoTimestamp(Properties properties, String key) {
+ //final DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
+ final DateTimeFormatter dtf = DateTimeFormatter.ISO_DATE_TIME;
+ final String val = properties.getProperty(key);
+ if (val != null) {
+ final String value = properties.getProperty(key);
+ return ZonedDateTime.parse(value, dtf);
+ }
+ return null;
+ }
+
+ /**
+ * Returns the database property value in seconds.
+ *
+ * @param key the key to the property
+ * @return the property value in seconds
+ */
+ public long getPropertyInSeconds(String key) {
+ final String value = getProperty(key, "0");
+ return DateUtil.getEpochValueInSeconds(value);
+ }
+
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/H2Functions.java b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/H2Functions.java
index 4032248b9b6..edb46a4efe2 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/H2Functions.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/H2Functions.java
@@ -178,6 +178,47 @@ public static void insertSoftware(final Connection conn, int vulnerabilityId, St
* @param v3BaseScore the CVSS v3 base score
* @param v3BaseSeverity the CVSS v3 base severity
* @param v3Version the CVSS v3 version
+ * @param v4version CVSS v4 data
+ * @param v4attackVector CVSS v4 data
+ * @param v4attackComplexity CVSS v4 data
+ * @param v4attackRequirements CVSS v4 data
+ * @param v4privilegesRequired CVSS v4 data
+ * @param v4userInteraction CVSS v4 data
+ * @param v4vulnConfidentialityImpact CVSS v4 data
+ * @param v4vulnIntegrityImpact CVSS v4 data
+ * @param v4vulnAvailabilityImpact CVSS v4 data
+ * @param v4subConfidentialityImpact CVSS v4 data
+ * @param v4subIntegrityImpact CVSS v4 data
+ * @param v4subAvailabilityImpact CVSS v4 data
+ * @param v4exploitMaturity CVSS v4 data
+ * @param v4confidentialityRequirement CVSS v4 data
+ * @param v4integrityRequirement CVSS v4 data
+ * @param v4availabilityRequirement CVSS v4 data
+ * @param v4modifiedAttackVector CVSS v4 data
+ * @param v4modifiedAttackComplexity CVSS v4 data
+ * @param v4modifiedAttackRequirements CVSS v4 data
+ * @param v4modifiedPrivilegesRequired CVSS v4 data
+ * @param v4modifiedUserInteraction CVSS v4 data
+ * @param v4modifiedVulnConfidentialityImpact CVSS v4 data
+ * @param v4modifiedVulnIntegrityImpact CVSS v4 data
+ * @param v4modifiedVulnAvailabilityImpact CVSS v4 data
+ * @param v4modifiedSubConfidentialityImpact CVSS v4 data
+ * @param v4modifiedSubIntegrityImpact CVSS v4 data
+ * @param v4modifiedSubAvailabilityImpact CVSS v4 data
+ * @param v4safety CVSS v4 data
+ * @param v4automatable CVSS v4 data
+ * @param v4recovery CVSS v4 data
+ * @param v4valueDensity CVSS v4 data
+ * @param v4vulnerabilityResponseEffort CVSS v4 data
+ * @param v4providerUrgency CVSS v4 data
+ * @param v4baseScore CVSS v4 data
+ * @param v4baseSeverity CVSS v4 data
+ * @param v4threatScore CVSS v4 data
+ * @param v4threatSeverity CVSS v4 data
+ * @param v4environmentalScore CVSS v4 data
+ * @param v4environmentalSeverity CVSS v4 data
+ * @param v4source CVSS v4 data
+ * @param v4type CVSS v4 data
* @return a result set containing the vulnerability id
* @throws SQLException thrown if there is an error updating or inserting
* the vulnerability
@@ -192,7 +233,20 @@ public static ResultSet updateVulnerability(final Connection conn, String cve,
Float v3ImpactScore, String v3AttackVector, String v3AttackComplexity,
String v3PrivilegesRequired, String v3UserInteraction, String v3Scope,
String v3ConfidentialityImpact, String v3IntegrityImpact, String v3AvailabilityImpact,
- Float v3BaseScore, String v3BaseSeverity, String v3Version) throws SQLException {
+ Float v3BaseScore, String v3BaseSeverity, String v3Version, String v4version,
+ String v4attackVector, String v4attackComplexity, String v4attackRequirements,
+ String v4privilegesRequired, String v4userInteraction, String v4vulnConfidentialityImpact,
+ String v4vulnIntegrityImpact, String v4vulnAvailabilityImpact, String v4subConfidentialityImpact,
+ String v4subIntegrityImpact, String v4subAvailabilityImpact, String v4exploitMaturity,
+ String v4confidentialityRequirement, String v4integrityRequirement, String v4availabilityRequirement,
+ String v4modifiedAttackVector, String v4modifiedAttackComplexity, String v4modifiedAttackRequirements,
+ String v4modifiedPrivilegesRequired, String v4modifiedUserInteraction, String v4modifiedVulnConfidentialityImpact,
+ String v4modifiedVulnIntegrityImpact, String v4modifiedVulnAvailabilityImpact, String v4modifiedSubConfidentialityImpact,
+ String v4modifiedSubIntegrityImpact, String v4modifiedSubAvailabilityImpact, String v4safety,
+ String v4automatable, String v4recovery, String v4valueDensity, String v4vulnerabilityResponseEffort,
+ String v4providerUrgency, Float v4baseScore, String v4baseSeverity, Float v4threatScore,
+ String v4threatSeverity, Float v4environmentalScore, String v4environmentalSeverity,
+ String v4source, String v4type) throws SQLException {
final SimpleResultSet ret = new SimpleResultSet();
ret.addColumn("id", Types.INTEGER, 10, 0);
@@ -240,7 +294,22 @@ public static ResultSet updateVulnerability(final Connection conn, String cve,
+ "v3ImpactScore=?, v3AttackVector=?, v3AttackComplexity=?, "
+ "v3PrivilegesRequired=?, v3UserInteraction=?, v3Scope=?, "
+ "v3ConfidentialityImpact=?, v3IntegrityImpact=?, v3AvailabilityImpact=?, "
- + "v3BaseScore=?, v3BaseSeverity=?, v3Version=? "
+ + "v3BaseScore=?, v3BaseSeverity=?, v3Version=?, v4version=?, v4attackVector=?, "
+ + "v4attackComplexity=?, v4attackRequirements=?, v4privilegesRequired=?, "
+ + "v4userInteraction=?, v4vulnConfidentialityImpact=?, v4vulnIntegrityImpact=?, "
+ + "v4vulnAvailabilityImpact=?, v4subConfidentialityImpact=?, v4subIntegrityImpact=?, "
+ + "v4subAvailabilityImpact=?, v4exploitMaturity=?, "
+ + "v4confidentialityRequirement=?, v4integrityRequirement=?, "
+ + "v4availabilityRequirement=?, v4modifiedAttackVector=?, "
+ + "v4modifiedAttackComplexity=?, v4modifiedAttackRequirements=?, "
+ + "v4modifiedPrivilegesRequired=?, v4modifiedUserInteraction=?, "
+ + "v4modifiedVulnConfidentialityImpact=?, v4modifiedVulnIntegrityImpact=?, "
+ + "v4modifiedVulnAvailabilityImpact=?, v4modifiedSubConfidentialityImpact=?, "
+ + "v4modifiedSubIntegrityImpact=?, v4modifiedSubAvailabilityImpact=?, "
+ + "v4safety=?, v4automatable=?, v4recovery=?, v4valueDensity=?, "
+ + "v4vulnerabilityResponseEffort=?, v4providerUrgency=?, v4baseScore=?, "
+ + "v4baseSeverity=?, v4threatScore=?, v4threatSeverity=?, v4environmentalScore=?, "
+ + "v4environmentalSeverity=?, v4source=?, v4type=?"
+ "WHERE id=?");
} else {
//just do insert
@@ -255,8 +324,22 @@ public static ResultSet updateVulnerability(final Connection conn, String cve,
+ "v3ImpactScore, v3AttackVector, v3AttackComplexity, "
+ "v3PrivilegesRequired, v3UserInteraction, v3Scope, "
+ "v3ConfidentialityImpact, v3IntegrityImpact, v3AvailabilityImpact, "
- + "v3BaseScore, v3BaseSeverity, v3Version, cve) VALUES (?, ?, ?, ?, ?, ?, "
- + "?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+ + "v3BaseScore, v3BaseSeverity, v3Version, v4version, v4attackVector, "
+ + "v4attackComplexity, v4attackRequirements, v4privilegesRequired, "
+ + "v4userInteraction, v4vulnConfidentialityImpact, v4vulnIntegrityImpact, "
+ + "v4vulnAvailabilityImpact, v4subConfidentialityImpact, v4subIntegrityImpact, "
+ + "v4subAvailabilityImpact, v4exploitMaturity,v4confidentialityRequirement, "
+ + "v4integrityRequirement, v4availabilityRequirement,v4modifiedAttackVector, "
+ + "v4modifiedAttackComplexity, v4modifiedAttackRequirements,v4modifiedPrivilegesRequired, "
+ + "v4modifiedUserInteraction, v4modifiedVulnConfidentialityImpact,v4modifiedVulnIntegrityImpact, "
+ + "v4modifiedVulnAvailabilityImpact, v4modifiedSubConfidentialityImpact,v4modifiedSubIntegrityImpact, "
+ + "v4modifiedSubAvailabilityImpact, v4safety, v4automatable, v4recovery, v4valueDensity, "
+ + "v4vulnerabilityResponseEffort, v4providerUrgency, v4baseScore, v4baseSeverity, "
+ + "v4threatScore,v4threatSeverity, v4environmentalScore, v4environmentalSeverity, "
+ + "v4source, v4type, cve) VALUES (?, ?, ?, ?, ?, ?, "
+ + "?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, "
+ + "?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, "
+ + "?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
returnedColumns);
}
@@ -292,11 +375,55 @@ public static ResultSet updateVulnerability(final Connection conn, String cve,
setStringOrNull(merge, 29, v3BaseSeverity);
setStringOrNull(merge, 30, v3Version);
+ setStringOrNull(merge, 31, v4version);
+ setStringOrNull(merge, 32, v4attackVector);
+ setStringOrNull(merge, 33, v4attackComplexity);
+ setStringOrNull(merge, 34, v4attackRequirements);
+ setStringOrNull(merge, 35, v4privilegesRequired);
+ setStringOrNull(merge, 36, v4userInteraction);
+ setStringOrNull(merge, 37, v4vulnConfidentialityImpact);
+ setStringOrNull(merge, 38, v4vulnIntegrityImpact);
+ setStringOrNull(merge, 39, v4vulnAvailabilityImpact);
+ setStringOrNull(merge, 40, v4subConfidentialityImpact);
+ setStringOrNull(merge, 41, v4subIntegrityImpact);
+ setStringOrNull(merge, 42, v4subAvailabilityImpact);
+ setStringOrNull(merge, 43, v4exploitMaturity);
+ setStringOrNull(merge, 44, v4confidentialityRequirement);
+ setStringOrNull(merge, 45, v4integrityRequirement);
+ setStringOrNull(merge, 46, v4availabilityRequirement);
+ setStringOrNull(merge, 47, v4modifiedAttackVector);
+ setStringOrNull(merge, 48, v4modifiedAttackComplexity);
+ setStringOrNull(merge, 49, v4modifiedAttackRequirements);
+ setStringOrNull(merge, 50, v4modifiedPrivilegesRequired);
+ setStringOrNull(merge, 51, v4modifiedUserInteraction);
+ setStringOrNull(merge, 52, v4modifiedVulnConfidentialityImpact);
+ setStringOrNull(merge, 53, v4modifiedVulnIntegrityImpact);
+ setStringOrNull(merge, 54, v4modifiedVulnAvailabilityImpact);
+ setStringOrNull(merge, 55, v4modifiedSubConfidentialityImpact);
+ setStringOrNull(merge, 56, v4modifiedSubIntegrityImpact);
+ setStringOrNull(merge, 57, v4modifiedSubAvailabilityImpact);
+ setStringOrNull(merge, 58, v4safety);
+ setStringOrNull(merge, 59, v4automatable);
+ setStringOrNull(merge, 60, v4recovery);
+ setStringOrNull(merge, 61, v4valueDensity);
+ setStringOrNull(merge, 62, v4vulnerabilityResponseEffort);
+ setStringOrNull(merge, 63, v4providerUrgency);
+ setFloatOrNull(merge, 64, v4baseScore);
+ setStringOrNull(merge, 65, v4baseSeverity);
+ setFloatOrNull(merge, 66, v4threatScore);
+ setStringOrNull(merge, 67, v4threatSeverity);
+ setFloatOrNull(merge, 68, v4environmentalScore);
+ setStringOrNull(merge, 69, v4environmentalSeverity);
+ setStringOrNull(merge, 70, v4source);
+ setStringOrNull(merge, 71, v4type);
+
+ //cve must be the last entry
if (vulnerabilityId == 0) {
- merge.setString(31, cve);
+ merge.setString(72, cve);
} else {
- merge.setInt(31, vulnerabilityId);
+ merge.setInt(72, vulnerabilityId);
}
+
final int count = merge.executeUpdate();
if (vulnerabilityId == 0) {
try (ResultSet rs = merge.getGeneratedKeys()) {
@@ -329,7 +456,8 @@ public static ResultSet updateVulnerability(final Connection conn, String cve,
* @param requiredAction the action required
* @param dueDate the due date
* @param notes notes
- * @throws SQLException
+ * @throws SQLException thrown if there is a database error merging the
+ * Known Exploited information to the database
*/
public static void mergeKnownExploited(final Connection conn, String cveId,
String vendorProject, String product, String vulnerabilityName,
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/ossindex/ODCConnectionTransport.java b/core/src/main/java/org/owasp/dependencycheck/data/ossindex/ODCConnectionTransport.java
index 64701c8ef34..0e766b78625 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/ossindex/ODCConnectionTransport.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/ossindex/ODCConnectionTransport.java
@@ -18,13 +18,21 @@
package org.owasp.dependencycheck.data.ossindex;
import java.io.IOException;
-import java.net.HttpURLConnection;
-import java.net.URL;
-import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.URLConnectionFactory;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.Header;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.message.BasicHeader;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.sonatype.ossindex.service.client.OssindexClientConfiguration;
import org.sonatype.ossindex.service.client.transport.BasicAuthHelper;
-import org.sonatype.ossindex.service.client.transport.HttpUrlConnectionTransport;
+import org.sonatype.ossindex.service.client.transport.Transport;
import org.sonatype.ossindex.service.client.transport.UserAgentSupplier;
/**
@@ -33,20 +41,12 @@
*
* @author Jeremy Long
*/
-public class ODCConnectionTransport extends HttpUrlConnectionTransport {
+public class ODCConnectionTransport implements Transport {
- /**
- * The authorization header.
- */
- private static final String AUTHORIZATION = "Authorization";
/**
* The OSS Index client configuration.
*/
private final OssindexClientConfiguration configuration;
- /**
- * The URL Connection factory.
- */
- private final URLConnectionFactory connectionFactory;
/**
* The user agent to send in the HTTP connection.
*/
@@ -55,27 +55,40 @@ public class ODCConnectionTransport extends HttpUrlConnectionTransport {
/**
* Constructs a new transport object to connect to the OSS Index.
*
- * @param settings the ODC settings
* @param config the OSS client configuration
* @param userAgent the user agent to send to OSS Index
*/
- public ODCConnectionTransport(Settings settings, OssindexClientConfiguration config, UserAgentSupplier userAgent) {
- super(userAgent);
+ public ODCConnectionTransport(OssindexClientConfiguration config, UserAgentSupplier userAgent) {
this.userAgent = userAgent;
this.configuration = config;
- connectionFactory = new URLConnectionFactory(settings);
}
@Override
- protected HttpURLConnection connect(final URL url) throws IOException {
- final HttpURLConnection connection = connectionFactory.createHttpURLConnection(url);
- connection.setRequestProperty("User-Agent", userAgent.get());
+ public void init(OssindexClientConfiguration configuration) {
+ // no initialisation needed
+ }
- final String authorization = BasicAuthHelper.authorizationHeader(configuration.getAuthConfiguration());
- if (authorization != null) {
- connection.setRequestProperty(AUTHORIZATION, authorization);
+ @Override
+ public String post(URI url, String payloadType, String payload, String acceptType) throws TransportException, IOException {
+ try {
+ final List headers = new ArrayList<>(3);
+ headers.add(new BasicHeader(HttpHeaders.ACCEPT, acceptType));
+ headers.add(new BasicHeader(HttpHeaders.USER_AGENT, userAgent.get()));
+ // TODO consider to promote pre-emptive authentication by default to the Downloader and also load the OSSIndex credentials there.
+ final String authorization = BasicAuthHelper.authorizationHeader(configuration.getAuthConfiguration());
+ if (authorization != null) {
+ headers.add(new BasicHeader(HttpHeaders.AUTHORIZATION, authorization));
+ }
+ return Downloader.getInstance().postBasedFetchContent(url, payload, ContentType.create(payloadType, StandardCharsets.UTF_8), headers);
+ } catch (TooManyRequestsException e) {
+ throw new TransportException("Too many requests for " + url.toString() + " HTTP status 429", e);
+ } catch (ResourceNotFoundException e) {
+ throw new TransportException("Not found for " + url.toString() + "HTTP status 404", e);
}
- return connection;
}
+ @Override
+ public void close() throws Exception {
+ // no resource closure needed; fully delegated to HTTPClient
+ }
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/ossindex/OssindexClientFactory.java b/core/src/main/java/org/owasp/dependencycheck/data/ossindex/OssindexClientFactory.java
index 78026f58ebb..6502be6e9dd 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/ossindex/OssindexClientFactory.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/ossindex/OssindexClientFactory.java
@@ -85,12 +85,6 @@ public static OssindexClient create(final Settings settings) {
final int batchSize = settings.getInt(Settings.KEYS.ANALYZER_OSSINDEX_BATCH_SIZE, OssindexClientConfiguration.DEFAULT_BATCH_SIZE);
config.setBatchSize(batchSize);
- // proxy likely does not need to be configured here as we are using the
- // URLConnectionFactory#createHttpURLConnection() which automatically configures
- // the proxy on the connection.
-// ProxyConfiguration proxy = new ProxyConfiguration();
-// settings.getString(Settings.KEYS.PROXY_PASSWORD);
-// config.setProxyConfiguration(proxy);
if (settings.getBoolean(Settings.KEYS.ANALYZER_OSSINDEX_USE_CACHE, true)) {
final DirectoryCache.Configuration cache = new DirectoryCache.Configuration();
final File data;
@@ -101,7 +95,7 @@ public static OssindexClient create(final Settings settings) {
cache.setBaseDir(cacheDir.toPath());
cache.setExpireAfter(Duration.standardHours(24));
config.setCacheConfiguration(cache);
- LOGGER.debug("OSS Index Cache: " + cache);
+ LOGGER.debug("OSS Index Cache: {}", cache);
} else {
LOGGER.warn("Unable to use a cache for the OSS Index");
}
@@ -115,7 +109,7 @@ public static OssindexClient create(final Settings settings) {
settings.getString(Settings.KEYS.APPLICATION_VERSION, "unknown")
);
- final Transport transport = new ODCConnectionTransport(settings, config, userAgent);
+ final Transport transport = new ODCConnectionTransport(config, userAgent);
final Marshaller marshaller = new GsonMarshaller();
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java b/core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
index c81d8c7a740..ae8fd3c1d9f 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
@@ -18,13 +18,12 @@
package org.owasp.dependencycheck.data.update;
import java.io.IOException;
-import java.io.InputStream;
-import java.net.HttpURLConnection;
import java.net.MalformedURLException;
import java.net.URL;
import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
import javax.annotation.concurrent.ThreadSafe;
-import org.apache.commons.io.IOUtils;
+
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
@@ -32,9 +31,10 @@
import org.owasp.dependencycheck.data.update.exception.UpdateException;
import org.owasp.dependencycheck.utils.DateUtil;
import org.owasp.dependencycheck.utils.DependencyVersion;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.URLConnectionFactory;
-import org.owasp.dependencycheck.utils.URLConnectionFailureException;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -123,14 +123,14 @@ public boolean update(Engine engine) throws UpdateException {
final CveDB db = engine.getDatabase();
final boolean autoupdate = settings.getBoolean(Settings.KEYS.AUTO_UPDATE, true);
final boolean enabled = settings.getBoolean(Settings.KEYS.UPDATE_VERSION_CHECK_ENABLED, true);
- final String original = settings.getString(Settings.KEYS.CVE_ORIGINAL_JSON);
- final String current = settings.getString(Settings.KEYS.CVE_MODIFIED_JSON);
+ final String datafeed = settings.getString(Settings.KEYS.NVD_API_DATAFEED_URL);
/*
* Only update if auto-update is enabled, the engine check is
- * enabled, and the NVD CVE URLs have not been modified (i.e. the
- * user has not configured them to point to an internal source).
+ * enabled, and the NVD DataFeed is being used (i.e. the user
+ * is likely on a private network). This check is not really needed
+ * so we are okay skipping it.
*/
- if (enabled && autoupdate && original != null && original.equals(current)) {
+ if (enabled && autoupdate && datafeed != null) {
LOGGER.debug("Begin Engine Version Check");
final DatabaseProperties properties = db.getDatabaseProperties();
@@ -169,13 +169,21 @@ public boolean update(Engine engine) throws UpdateException {
* github documentation site or accessing the local database.
*/
protected boolean shouldUpdate(final long lastChecked, final long now, final DatabaseProperties properties,
- String currentVersion) throws UpdateException {
+ String currentVersion) throws UpdateException {
//check every 30 days if we know there is an update, otherwise check every 7 days
final int checkRange = 30;
if (!DateUtil.withinDateRange(lastChecked, now, checkRange)) {
LOGGER.debug("Checking web for new version.");
- final String currentRelease = getCurrentReleaseVersion();
- if (currentRelease != null) {
+ final String publishedData = getCurrentReleaseVersion();
+ if (publishedData != null) {
+ final String[] parts = publishedData.split("\n");
+ if (parts.length > 1) {
+ final String message = String.join("\n", Arrays.copyOfRange(parts, 1, parts.length)).trim();
+ LOGGER.warn("\n\n*********************************************************\n"
+ + message
+ + "\n*********************************************************\n");
+ }
+ final String currentRelease = parts[0].trim();
final DependencyVersion v = new DependencyVersion(currentRelease);
if (v.getVersionParts() != null && v.getVersionParts().size() >= 3) {
updateToVersion = v.toString();
@@ -208,30 +216,20 @@ protected boolean shouldUpdate(final long lastChecked, final long now, final Dat
* @return the current released version number
*/
protected String getCurrentReleaseVersion() {
- HttpURLConnection conn = null;
try {
- final String str = settings.getString(Settings.KEYS.ENGINE_VERSION_CHECK_URL, "https://jeremylong.github.io/DependencyCheck/current.txt");
+ final String str = settings.getString(Settings.KEYS.ENGINE_VERSION_CHECK_URL, "https://dependency-check.github.io/DependencyCheck/current.txt");
final URL url = new URL(str);
- final URLConnectionFactory factory = new URLConnectionFactory(settings);
- conn = factory.createHttpURLConnection(url);
- conn.connect();
- if (conn.getResponseCode() != 200) {
- return null;
- }
- try (InputStream is = conn.getInputStream()) {
- final String releaseVersion = new String(IOUtils.toByteArray(is), StandardCharsets.UTF_8);
- return releaseVersion.trim();
- }
+ String releaseVersion = null;
+ releaseVersion = Downloader.getInstance().fetchContent(url, StandardCharsets.UTF_8);
+ return releaseVersion.trim();
+ } catch (TooManyRequestsException ex) {
+ LOGGER.debug("Unable to retrieve current release version of dependency-check - downloader failed on HTTP 429 Too many requests");
+ } catch (ResourceNotFoundException ex) {
+ LOGGER.debug("Unable to retrieve current release version of dependency-check - downloader failed on HTTP 404 ResourceNotFound");
} catch (MalformedURLException ex) {
LOGGER.debug("Unable to retrieve current release version of dependency-check - malformed url?");
- } catch (URLConnectionFailureException ex) {
- LOGGER.debug("Unable to retrieve current release version of dependency-check - connection failed");
} catch (IOException ex) {
LOGGER.debug("Unable to retrieve current release version of dependency-check - i/o exception");
- } finally {
- if (conn != null) {
- conn.disconnect();
- }
}
return null;
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java
index afa0630eb53..09d7627b7b2 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java
@@ -34,7 +34,7 @@
import java.net.URL;
import java.nio.file.Files;
-public class HostedSuppressionsDataSource implements CachedWebDataSource {
+public class HostedSuppressionsDataSource extends LocalDataSource {
/**
* Static logger.
@@ -45,17 +45,17 @@ public class HostedSuppressionsDataSource implements CachedWebDataSource {
* The configured settings.
*/
private Settings settings;
-
/**
* The default URL to the Hosted Suppressions file.
*/
- public static final String DEFAULT_SUPPRESSIONS_URL = "https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml";
+ public static final String DEFAULT_SUPPRESSIONS_URL = "https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml";
/**
* Downloads the current Hosted suppressions file.
*
* @param engine a reference to the ODC Engine
- * @return returns false as no updates are made to the database, just web resources cached locally
+ * @return returns false as no updates are made to the database, just web
+ * resources cached locally
* @throws UpdateException thrown if the update encountered fatal errors
*/
@Override
@@ -76,11 +76,12 @@ public boolean update(Engine engine) throws UpdateException {
if (proceed) {
LOGGER.debug("Begin Hosted Suppressions file update");
fetchHostedSuppressions(settings, url, repoFile);
+ saveLastUpdated(repoFile, System.currentTimeMillis() / 1000);
}
} catch (UpdateException ex) {
// only emit a warning, DependencyCheck will continue without taking the latest hosted suppressions into account.
LOGGER.warn("Failed to update hosted suppressions file, results may contain false positives already resolved by the "
- + "DependencyCheck project", ex);
+ + "DependencyCheck project", ex);
} catch (MalformedURLException ex) {
throw new UpdateException(String.format("Invalid URL for Hosted Suppressions file (%s)", configuredUrl), ex);
} catch (IOException ex) {
@@ -93,8 +94,8 @@ public boolean update(Engine engine) throws UpdateException {
* Determines if the we should update the Hosted Suppressions file.
*
* @param repo the Hosted Suppressions file.
- * @return true if an update to the Hosted Suppressions file should
- * be performed; otherwise false
+ * @return true if an update to the Hosted Suppressions file
+ * should be performed; otherwise false
* @throws NumberFormatException thrown if an invalid value is contained in
* the database properties
*/
@@ -102,7 +103,7 @@ protected boolean shouldUpdate(File repo) throws NumberFormatException {
boolean proceed = true;
if (repo != null && repo.isFile()) {
final int validForHours = settings.getInt(Settings.KEYS.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS, 2);
- final long lastUpdatedOn = repo.lastModified();
+ final long lastUpdatedOn = getLastUpdated(repo);
final long now = System.currentTimeMillis();
LOGGER.debug("Last updated: {}", lastUpdatedOn);
LOGGER.debug("Now: {}", now);
@@ -120,7 +121,8 @@ protected boolean shouldUpdate(File repo) throws NumberFormatException {
*
* @param settings a reference to the dependency-check settings
* @param repoUrl the URL to the hosted suppressions file to use
- * @param repoFile the local file where the hosted suppressions file is to be placed
+ * @param repoFile the local file where the hosted suppressions file is to
+ * be placed
* @throws UpdateException thrown if there is an exception during
* initialization
*/
@@ -130,8 +132,7 @@ private void fetchHostedSuppressions(Settings settings, URL repoUrl, File repoFi
if (LOGGER.isDebugEnabled()) {
LOGGER.debug("Hosted Suppressions URL: {}", repoUrl.toExternalForm());
}
- final Downloader downloader = new Downloader(settings);
- downloader.fetchFile(repoUrl, repoFile);
+ Downloader.getInstance().fetchFile(repoUrl, repoFile);
} catch (IOException | TooManyRequestsException | ResourceNotFoundException | WriteLockException ex) {
throw new UpdateException("Failed to update the hosted suppressions file", ex);
}
@@ -144,7 +145,7 @@ public boolean purge(Engine engine) {
boolean result = true;
try {
final URL repoUrl = new URL(settings.getString(Settings.KEYS.HOSTED_SUPPRESSIONS_URL,
- DEFAULT_SUPPRESSIONS_URL));
+ DEFAULT_SUPPRESSIONS_URL));
final String filename = new File(repoUrl.getPath()).getName();
final File repo = new File(settings.getDataDirectory(), filename);
if (repo.exists()) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java
index 459af715d94..2bae99b04a3 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java
@@ -19,8 +19,13 @@
import java.io.IOException;
import java.io.InputStream;
+import java.net.URISyntaxException;
import java.net.URL;
import java.sql.SQLException;
+
+import org.apache.hc.client5.http.impl.classic.AbstractHttpClientResponseHandler;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.io.HttpClientResponseHandler;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.data.knownexploited.json.KnownExploitedVulnerabilitiesSchema;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
@@ -29,8 +34,7 @@
import org.owasp.dependencycheck.data.update.cisa.KnownExploitedVulnerabilityParser;
import org.owasp.dependencycheck.data.update.exception.CorruptedDatastreamException;
import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.utils.DateUtil;
-import org.owasp.dependencycheck.utils.HttpResourceConnection;
+import org.owasp.dependencycheck.utils.Downloader;
import org.owasp.dependencycheck.utils.ResourceNotFoundException;
import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.utils.TooManyRequestsException;
@@ -38,7 +42,6 @@
import org.slf4j.LoggerFactory;
/**
- *
* @author jeremy
*/
public class KnownExploitedDataSource implements CachedWebDataSource {
@@ -75,21 +78,31 @@ public boolean update(Engine engine) throws UpdateException {
try {
final URL url = new URL(settings.getString(Settings.KEYS.KEV_URL, DEFAULT_URL));
LOGGER.info("Updating CISA Known Exploited Vulnerability list: " + url.toString());
- //TODO - add all the proxy config, likely use the same as configured for NVD
- final HttpResourceConnection conn = new HttpResourceConnection(settings);
- try (InputStream in = conn.fetch(url)) {
- final KnownExploitedVulnerabilityParser parser = new KnownExploitedVulnerabilityParser();
- final KnownExploitedVulnerabilitiesSchema data = parser.parse(in);
- final String currentVersion = dbProperties.getProperty(DatabaseProperties.KEV_VERSION, "");
- if (!currentVersion.equals(data.getCatalogVersion())) {
- cveDB.updateKnownExploitedVulnerabilities(data.getVulnerabilities());
- }
- //all dates in the db are now stored in seconds as opposed to previously milliseconds.
- dbProperties.save(DatabaseProperties.KEV_LAST_CHECKED, Long.toString(System.currentTimeMillis() / 1000));
- return true;
+
+ final HttpClientResponseHandler kevParsingResponseHandler =
+ new AbstractHttpClientResponseHandler<>() {
+ @Override
+ public KnownExploitedVulnerabilitiesSchema handleEntity(HttpEntity entity) throws IOException {
+ try (InputStream in = entity.getContent()) {
+ final KnownExploitedVulnerabilityParser parser = new KnownExploitedVulnerabilityParser();
+ final KnownExploitedVulnerabilitiesSchema data = parser.parse(in);
+ return data;
+ } catch (CorruptedDatastreamException | UpdateException e) {
+ throw new IOException("Error processing response", e);
+ }
+ }
+ };
+
+ final KnownExploitedVulnerabilitiesSchema data = Downloader.getInstance().fetchAndHandle(url, kevParsingResponseHandler);
+ final String currentVersion = dbProperties.getProperty(DatabaseProperties.KEV_VERSION, "");
+ if (!currentVersion.equals(data.getCatalogVersion())) {
+ cveDB.updateKnownExploitedVulnerabilities(data.getVulnerabilities());
}
- } catch (TooManyRequestsException | ResourceNotFoundException | IOException
- | CorruptedDatastreamException | DatabaseException | SQLException ex) {
+ //all dates in the db are now stored in seconds as opposed to previously milliseconds.
+ dbProperties.save(DatabaseProperties.KEV_LAST_CHECKED, Long.toString(System.currentTimeMillis() / 1000));
+ return true;
+ } catch (TooManyRequestsException | ResourceNotFoundException | IOException | DatabaseException
+ | SQLException | URISyntaxException ex) {
throw new UpdateException(ex);
}
}
@@ -98,7 +111,7 @@ public boolean update(Engine engine) throws UpdateException {
@Override
public boolean purge(Engine engine) {
- //do nothing - covered by the NvdCveUpdater data source.
+ //do nothing - covered by the NvdApiDataSource.
return true;
}
@@ -120,7 +133,7 @@ private boolean shouldUpdate() throws UpdateException {
if (cveDB.dataExists() && 0 < validForHours) {
// ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
final long validForSeconds = validForHours * 60L * 60L;
- final long lastChecked = getPropertyInSeconds(DatabaseProperties.KEV_LAST_CHECKED);
+ final long lastChecked = dbProperties.getPropertyInSeconds(DatabaseProperties.KEV_LAST_CHECKED);
final long now = System.currentTimeMillis() / 1000;
proceed = (now - lastChecked) > validForSeconds;
if (!proceed) {
@@ -130,15 +143,4 @@ private boolean shouldUpdate() throws UpdateException {
return proceed;
}
- /**
- * Returns the database property value in seconds.
- *
- * @param key the key to the property
- * @return the property value in seconds
- */
- private long getPropertyInSeconds(String key) {
- final String value = dbProperties.getProperty(key, "0");
- return DateUtil.getEpochValueInSeconds(value);
- }
-
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/LocalDataSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/LocalDataSource.java
new file mode 100644
index 00000000000..88d51840668
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/LocalDataSource.java
@@ -0,0 +1,83 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2024 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.Properties;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ *
+ * @author Jeremy Long
+ */
+public abstract class LocalDataSource implements CachedWebDataSource {
+
+ /**
+ * Static logger.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(LocalDataSource.class);
+
+ /**
+ * Saves the timestamp in a properties file next to the provided repo file
+ *
+ * @param repo the local file data source
+ * @param timestamp the epoch timestamp to store
+ */
+ protected void saveLastUpdated(File repo, long timestamp) {
+ final File timestampFile = new File(repo + ".properties");
+ try (OutputStream out = new FileOutputStream(timestampFile)) {
+ final Properties prop = new Properties();
+ prop.setProperty("LAST_UPDATED", String.valueOf(timestamp));
+ prop.store(out, null);
+ } catch (IOException ex) {
+ throw new RuntimeException(ex);
+ }
+ }
+
+ /**
+ * Retrieves the last updated date from the local file system (in a file
+ * next to the repo file).
+ *
+ * @param repo the local file data source
+ * @return the epoch timestamp of the last updated date/time
+ */
+ protected long getLastUpdated(File repo) {
+ long lastUpdatedOn = 0;
+ final File timestampFile = new File(repo + ".properties");
+ if (timestampFile.isFile()) {
+ try (InputStream is = new FileInputStream(timestampFile)) {
+ final Properties props = new Properties();
+ props.load(is);
+ lastUpdatedOn = Integer.parseInt(props.getProperty("LAST_UPDATED", "0"));
+ } catch (IOException | NumberFormatException ex) {
+ LOGGER.debug("error reading timestamp file", ex);
+ }
+ if (lastUpdatedOn <= 0) {
+ //fall back on conversion from file last modified to storing in the db.
+ lastUpdatedOn = repo.lastModified();
+ }
+ }
+ return lastUpdatedOn;
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java
new file mode 100644
index 00000000000..43f530cc562
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java
@@ -0,0 +1,685 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2023 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
+import io.github.jeremylong.openvulnerability.client.nvd.NvdApiException;
+import io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient;
+import io.github.jeremylong.openvulnerability.client.nvd.NvdCveClientBuilder;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.StringReader;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.text.MessageFormat;
+import java.time.Duration;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.zip.GZIPOutputStream;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+import org.owasp.dependencycheck.data.update.exception.UpdateException;
+import org.owasp.dependencycheck.data.update.nvd.api.DownloadTask;
+import org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor;
+import org.owasp.dependencycheck.utils.DateUtil;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ *
+ * @author Jeremy Long
+ */
+public class NvdApiDataSource implements CachedWebDataSource {
+
+ /**
+ * The logger.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(NvdApiDataSource.class);
+ /**
+ * The thread pool size to use for CPU-intense tasks.
+ */
+ private static final int PROCESSING_THREAD_POOL_SIZE = Runtime.getRuntime().availableProcessors();
+ /**
+ * The configured settings.
+ */
+ private Settings settings;
+ /**
+ * Reference to the DAO.
+ */
+ private CveDB cveDb = null;
+ /**
+ * The properties obtained from the database.
+ */
+ private DatabaseProperties dbProperties = null;
+ /**
+ * The key for the NVD API cache properties file's last modified date.
+ */
+ private static final String NVD_API_CACHE_MODIFIED_DATE = "lastModifiedDate";
+ /**
+ * The number of results per page from the NVD API. The default is 2000; we
+ * are setting the value to be explicit.
+ */
+ private static final int RESULTS_PER_PAGE = 2000;
+
+ @Override
+ public boolean update(Engine engine) throws UpdateException {
+ this.settings = engine.getSettings();
+ this.cveDb = engine.getDatabase();
+ if (isUpdateConfiguredFalse()) {
+ return false;
+ }
+ dbProperties = cveDb.getDatabaseProperties();
+
+ final String nvdDataFeedUrl = settings.getString(Settings.KEYS.NVD_API_DATAFEED_URL);
+ if (nvdDataFeedUrl != null) {
+ return processDatafeed(nvdDataFeedUrl);
+ }
+ return processApi();
+ }
+
+ protected UrlData extractUrlData(String nvdDataFeedUrl) {
+ String url;
+ String pattern = null;
+ if (nvdDataFeedUrl.endsWith(".json.gz")) {
+ final int lio = nvdDataFeedUrl.lastIndexOf("/");
+ pattern = nvdDataFeedUrl.substring(lio + 1);
+ url = nvdDataFeedUrl.substring(0, lio);
+ } else {
+ url = nvdDataFeedUrl;
+ }
+ if (!url.endsWith("/")) {
+ url += "/";
+ }
+ return new UrlData(url, pattern);
+ }
+
+ private boolean processDatafeed(String nvdDataFeedUrl) throws UpdateException {
+ boolean updatesMade = false;
+ try {
+ dbProperties = cveDb.getDatabaseProperties();
+ if (checkUpdate()) {
+ final UrlData data = extractUrlData(nvdDataFeedUrl);
+ final String url = data.getUrl();
+ String pattern = data.getPattern();
+ final Properties cacheProperties = getRemoteCacheProperties(url, pattern);
+ if (pattern == null) {
+ final String prefix = cacheProperties.getProperty("prefix", "nvdcve-");
+ pattern = prefix + "{0}.json.gz";
+ }
+
+ final ZonedDateTime now = ZonedDateTime.now(ZoneId.of("UTC"));
+ final Map updateable = getUpdatesNeeded(url, pattern, cacheProperties, now);
+ if (!updateable.isEmpty()) {
+ final int max = settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 1);
+ final int downloadPoolSize = Math.min(Runtime.getRuntime().availableProcessors(), max);
+ // going over 2 threads does not appear to improve performance
+ final int maxExec = PROCESSING_THREAD_POOL_SIZE;
+ final int execPoolSize = Math.min(maxExec, 2);
+
+ ExecutorService processingExecutorService = null;
+ ExecutorService downloadExecutorService = null;
+ try {
+ downloadExecutorService = Executors.newFixedThreadPool(downloadPoolSize);
+ processingExecutorService = Executors.newFixedThreadPool(execPoolSize);
+
+ DownloadTask runLast = null;
+ final Set>> downloadFutures = new HashSet<>(updateable.size());
+ runLast = startDownloads(updateable, processingExecutorService, runLast, downloadFutures, downloadExecutorService);
+
+ //complete downloads
+ final Set> processFutures = new HashSet<>(updateable.size());
+ for (Future> future : downloadFutures) {
+ processDownload(future, processFutures);
+ }
+ //process the data
+ processFuture(processFutures);
+ processFutures.clear();
+
+ //download and process the modified as the last entry
+ if (runLast != null) {
+ final Future> modified = downloadExecutorService.submit(runLast);
+ processDownload(modified, processFutures);
+ processFuture(processFutures);
+ }
+
+ } finally {
+ if (processingExecutorService != null) {
+ processingExecutorService.shutdownNow();
+ }
+ if (downloadExecutorService != null) {
+ downloadExecutorService.shutdownNow();
+ }
+ }
+ updatesMade = true;
+ }
+ storeLastModifiedDates(now, cacheProperties, updateable);
+ if (updatesMade) {
+ cveDb.persistEcosystemCache();
+ }
+ final int updateCount = cveDb.updateEcosystemCache();
+ LOGGER.debug("Corrected the ecosystem for {} ecoSystemCache entries", updateCount);
+ if (updatesMade || updateCount > 0) {
+ cveDb.cleanupDatabase();
+ }
+ }
+ } catch (UpdateException ex) {
+ if (ex.getCause() != null && ex.getCause() instanceof DownloadFailedException) {
+ final String jre = System.getProperty("java.version");
+ if (jre == null || jre.startsWith("1.4") || jre.startsWith("1.5") || jre.startsWith("1.6") || jre.startsWith("1.7")) {
+ LOGGER.error("An old JRE is being used ({} {}), and likely does not have the correct root certificates or algorithms "
+ + "to connect to the NVD - consider upgrading your JRE.", System.getProperty("java.vendor"), jre);
+ }
+ }
+ throw ex;
+ } catch (DatabaseException ex) {
+ throw new UpdateException("Database Exception, unable to update the data to use the most current data.", ex);
+ }
+ return updatesMade;
+ }
+
+ private void storeLastModifiedDates(final ZonedDateTime now, final Properties cacheProperties,
+ final Map updateable) throws UpdateException {
+
+ final ZonedDateTime lastModifiedRequest = DatabaseProperties.getTimestamp(cacheProperties,
+ NVD_API_CACHE_MODIFIED_DATE + ".modified");
+ dbProperties.save(DatabaseProperties.NVD_CACHE_LAST_CHECKED, now);
+ dbProperties.save(DatabaseProperties.NVD_CACHE_LAST_MODIFIED, lastModifiedRequest);
+ //allow users to initially load from a cache but then use the API - this may happen with the GH Action
+ dbProperties.save(DatabaseProperties.NVD_API_LAST_CHECKED, now);
+ dbProperties.save(DatabaseProperties.NVD_API_LAST_MODIFIED, lastModifiedRequest);
+
+ for (String entry : updateable.keySet()) {
+ final ZonedDateTime date = DatabaseProperties.getTimestamp(cacheProperties, NVD_API_CACHE_MODIFIED_DATE + "." + entry);
+ dbProperties.save(DatabaseProperties.NVD_CACHE_LAST_MODIFIED + "." + entry, date);
+ }
+ }
+
+ private DownloadTask startDownloads(final Map updateable, ExecutorService processingExecutorService, DownloadTask runLast,
+ final Set>> downloadFutures, ExecutorService downloadExecutorService) throws UpdateException {
+ DownloadTask lastCall = runLast;
+ for (Map.Entry cve : updateable.entrySet()) {
+ final DownloadTask call = new DownloadTask(cve.getValue(), processingExecutorService, cveDb, settings);
+ if (call.isModified()) {
+ lastCall = call;
+ } else {
+ final boolean added = downloadFutures.add(downloadExecutorService.submit(call));
+ if (!added) {
+ throw new UpdateException("Unable to add the download task for " + cve);
+ }
+ }
+ }
+ return lastCall;
+ }
+
+ private void processFuture(final Set> processFutures) throws UpdateException {
+ //complete processing
+ for (Future future : processFutures) {
+ try {
+ final NvdApiProcessor task = future.get();
+ } catch (InterruptedException ex) {
+ LOGGER.debug("Thread was interrupted during processing", ex);
+ Thread.currentThread().interrupt();
+ throw new UpdateException(ex);
+ } catch (ExecutionException ex) {
+ LOGGER.debug("Execution Exception during process", ex);
+ throw new UpdateException(ex);
+ }
+ }
+ }
+
+ private void processDownload(Future> future, final Set> processFutures) throws UpdateException {
+ final Future task;
+ try {
+ task = future.get();
+ if (task != null) {
+ processFutures.add(task);
+ }
+ } catch (InterruptedException ex) {
+ LOGGER.debug("Thread was interrupted during download", ex);
+ Thread.currentThread().interrupt();
+ throw new UpdateException("The download was interrupted", ex);
+ } catch (ExecutionException ex) {
+ LOGGER.debug("Thread was interrupted during download execution", ex);
+ throw new UpdateException("The execution of the download was interrupted", ex);
+ }
+ }
+
+ private boolean processApi() throws UpdateException {
+ final ZonedDateTime lastChecked = dbProperties.getTimestamp(DatabaseProperties.NVD_API_LAST_CHECKED);
+ final int validForHours = settings.getInt(Settings.KEYS.NVD_API_VALID_FOR_HOURS, 0);
+ if (cveDb.dataExists() && lastChecked != null && validForHours > 0) {
+ // ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
+ final long validForSeconds = validForHours * 60L * 60L;
+ final ZonedDateTime now = ZonedDateTime.now(ZoneId.of("UTC"));
+ final Duration duration = Duration.between(lastChecked, now);
+ final long difference = duration.getSeconds();
+ if (difference < validForSeconds) {
+ LOGGER.info("Skipping the NVD API Update as it was completed within the last {} minutes", validForSeconds / 60);
+ return false;
+ }
+ }
+
+ ZonedDateTime lastModifiedRequest = dbProperties.getTimestamp(DatabaseProperties.NVD_API_LAST_MODIFIED);
+ final NvdCveClientBuilder builder = NvdCveClientBuilder.aNvdCveApi();
+ final String endpoint = settings.getString(Settings.KEYS.NVD_API_ENDPOINT);
+ if (endpoint != null) {
+ builder.withEndpoint(endpoint);
+ }
+ if (lastModifiedRequest != null) {
+ // make it UTC as required by NvdCveClientBuilder#withLastModifiedFilter
+ lastModifiedRequest = lastModifiedRequest.withZoneSameInstant(ZoneId.of("UTC"));
+ final ZonedDateTime end = lastModifiedRequest.plusDays(120);
+ builder.withLastModifiedFilter(lastModifiedRequest, end);
+ }
+ final String key = settings.getString(Settings.KEYS.NVD_API_KEY);
+ if (key != null) {
+ //using a higher delay as the system may not be able to process these faster.
+ builder.withApiKey(key)
+ .withDelay(5000)
+ .withThreadCount(4);
+ } else {
+ LOGGER.warn("An NVD API Key was not provided - it is highly recommended to use "
+ + "an NVD API key as the update can take a VERY long time without an API Key");
+ builder.withDelay(10000);
+ }
+
+ final int resultsPerPage = Math.min(settings.getInt(Settings.KEYS.NVD_API_RESULTS_PER_PAGE, RESULTS_PER_PAGE), RESULTS_PER_PAGE);
+
+ builder.withResultsPerPage(resultsPerPage);
+ //removed due to the virtualMatch filter causing overhead with the NVD API
+ //final String virtualMatch = settings.getString(Settings.KEYS.CVE_CPE_STARTS_WITH_FILTER);
+ //if (virtualMatch != null) {
+ // builder.withVirtualMatchString(virtualMatch);
+ //}
+
+ final int retryCount = settings.getInt(Settings.KEYS.NVD_API_MAX_RETRY_COUNT, 10);
+ builder.withMaxRetryCount(retryCount);
+ long delay = 0;
+ try {
+ delay = settings.getLong(Settings.KEYS.NVD_API_DELAY);
+ } catch (InvalidSettingException ex) {
+ LOGGER.warn("Invalid setting `NVD_API_DELAY`? ({}), using default delay", settings.getString(Settings.KEYS.NVD_API_DELAY));
+ }
+ if (delay > 0) {
+ builder.withDelay(delay);
+ }
+
+ ExecutorService processingExecutorService = null;
+ try {
+ processingExecutorService = Executors.newFixedThreadPool(PROCESSING_THREAD_POOL_SIZE);
+ final List> submitted = new ArrayList<>();
+ int max = -1;
+ int ctr = 0;
+ try (NvdCveClient api = builder.build()) {
+ while (api.hasNext()) {
+ final Collection items = api.next();
+ max = api.getTotalAvailable();
+ if (ctr == 0) {
+ LOGGER.info(String.format("NVD API has %,d records in this update", max));
+ }
+ if (items != null && !items.isEmpty()) {
+ final ObjectMapper objectMapper = new ObjectMapper();
+ objectMapper.registerModule(new JavaTimeModule());
+ final File outputFile = settings.getTempFile("nvd-data-", ".jsonarray.gz");
+ try (FileOutputStream fos = new FileOutputStream(outputFile); GZIPOutputStream out = new GZIPOutputStream(fos);) {
+ objectMapper.writeValue(out, items);
+ final Future f = processingExecutorService.submit(new NvdApiProcessor(cveDb, outputFile));
+ submitted.add(f);
+ }
+ ctr += 1;
+ if ((ctr % 5) == 0) {
+ //TODO get results per page from the API as it could adjust automatically
+ final double percent = (double) (ctr * resultsPerPage) / max * 100;
+ if (percent < 100) {
+ LOGGER.info(String.format("Downloaded %,d/%,d (%.0f%%)", ctr * resultsPerPage, max, percent));
+ }
+ }
+ }
+ final ZonedDateTime last = api.getLastUpdated();
+ if (last != null && (lastModifiedRequest == null || lastModifiedRequest.compareTo(last) < 0)) {
+ lastModifiedRequest = last;
+ }
+ }
+
+ } catch (Exception e) {
+ if (e instanceof NvdApiException && (e.getMessage().equals("NVD Returned Status Code: 404")
+ || e.getMessage().equals("NVD Returned Status Code: 403"))) {
+ final String msg;
+ if (key != null) {
+ msg = "Error updating the NVD Data; the NVD returned a 403 or 404 error\n\nPlease ensure your API Key is valid; "
+ + "see https://github.com/jeremylong/open-vulnerability-cli/blob/main/README.md#api-key-is-used-and-a-403-or-404-error-occurs\n\n"
+ + "If your NVD API Key is valid try increasing the NVD API Delay.\n\n"
+ + "If this is occurring in a CI environment";
+ } else {
+ msg = "Error updating the NVD Data; the NVD returned a 403 or 404 error\n\nConsider using an NVD API Key; "
+ + "see https://github.com/dependency-check/DependencyCheck?tab=readme-ov-file#nvd-api-key-highly-recommended";
+ }
+ throw new UpdateException(msg);
+ } else {
+ throw new UpdateException("Error updating the NVD Data", e);
+ }
+ }
+ LOGGER.info(String.format("Downloaded %,d/%,d (%.0f%%)", max, max, 100f));
+ max = submitted.size();
+ final boolean updated = max > 0;
+ ctr = 0;
+ for (Future f : submitted) {
+ try {
+ final NvdApiProcessor proc = f.get();
+ ctr += 1;
+ final double percent = (double) ctr / max * 100;
+ LOGGER.info(String.format("Completed processing batch %d/%d (%.0f%%) in %,dms", ctr, max, percent, proc.getDurationMillis()));
+ } catch (InterruptedException ex) {
+ Thread.currentThread().interrupt();
+ throw new RuntimeException(ex);
+ } catch (ExecutionException ex) {
+ LOGGER.error("Exception processing NVD API Results", ex);
+ throw new RuntimeException(ex);
+ }
+ }
+ if (lastModifiedRequest != null) {
+ dbProperties.save(DatabaseProperties.NVD_API_LAST_CHECKED, ZonedDateTime.now());
+ dbProperties.save(DatabaseProperties.NVD_API_LAST_MODIFIED, lastModifiedRequest);
+ }
+ return updated;
+ } finally {
+ if (processingExecutorService != null) {
+ processingExecutorService.shutdownNow();
+ }
+ }
+ }
+
+ /**
+ * Checks if the system is configured NOT to update.
+ *
+ * @return false if the system is configured to perform an update; otherwise
+ * true
+ */
+ private boolean isUpdateConfiguredFalse() {
+ if (!settings.getBoolean(Settings.KEYS.UPDATE_NVDCVE_ENABLED, true)) {
+ return true;
+ }
+ boolean autoUpdate = true;
+ try {
+ autoUpdate = settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+ } catch (InvalidSettingException ex) {
+ LOGGER.debug("Invalid setting for auto-update; using true.");
+ }
+ return !autoUpdate;
+ }
+
+ @Override
+ public boolean purge(Engine engine) {
+ boolean result = true;
+ try {
+ final File dataDir = engine.getSettings().getDataDirectory();
+ final File db = new File(dataDir, engine.getSettings().getString(Settings.KEYS.DB_FILE_NAME, "odc.mv.db"));
+ if (db.exists()) {
+ if (db.delete()) {
+ LOGGER.info("Database file purged; local copy of the NVD has been removed");
+ } else {
+ LOGGER.error("Unable to delete '{}'; please delete the file manually", db.getAbsolutePath());
+ result = false;
+ }
+ } else {
+ LOGGER.info("Unable to purge database; the database file does not exist: {}", db.getAbsolutePath());
+ result = false;
+ }
+ final File traceFile = new File(dataDir, "odc.trace.db");
+ if (traceFile.exists() && !traceFile.delete()) {
+ LOGGER.error("Unable to delete '{}'; please delete the file manually", traceFile.getAbsolutePath());
+ result = false;
+ }
+ final File lockFile = new File(dataDir, "odc.update.lock");
+ if (lockFile.exists() && !lockFile.delete()) {
+ LOGGER.error("Unable to delete '{}'; please delete the file manually", lockFile.getAbsolutePath());
+ result = false;
+ }
+ } catch (IOException ex) {
+ final String msg = "Unable to delete the database";
+ LOGGER.error(msg, ex);
+ result = false;
+ }
+ return result;
+ }
+
+ /**
+ * Checks if the NVD API Cache JSON files were last checked recently. As an
+ * optimization, we can avoid repetitive checks against the NVD cache.
+ *
+ * @return true to proceed with the check, or false to skip
+ * @throws UpdateException thrown when there is an issue checking for
+ * updates
+ */
+ private boolean checkUpdate() throws UpdateException {
+ boolean proceed = true;
+ // If the valid setting has not been specified, then we proceed to check...
+ final int validForHours = settings.getInt(Settings.KEYS.NVD_API_VALID_FOR_HOURS, 0);
+ if (dataExists() && 0 < validForHours) {
+ // ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
+ final long validForSeconds = validForHours * 60L * 60L;
+ final ZonedDateTime lastChecked = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_CHECKED);
+ if (lastChecked != null) {
+ final ZonedDateTime now = ZonedDateTime.now(ZoneId.of("UTC"));
+ final Duration duration = Duration.between(lastChecked, now);
+ final long difference = duration.getSeconds();
+ proceed = difference > validForSeconds;
+ if (!proceed) {
+ LOGGER.info("Skipping NVD API Cache check since last check was within {} hours.", validForHours);
+ LOGGER.debug("Last NVD API was at {}, and now {} is within {} s.", lastChecked, now, validForSeconds);
+ }
+ } else {
+ LOGGER.warn("NVD cache last checked not present; updating the entire database. This could occur if you are "
+ + "switching back and forth from using the API vs a datafeed or if you are using a database created prior to ODC 9.x");
+ }
+ }
+ return proceed;
+ }
+
+ /**
+ * Checks the CVE Index to ensure data exists and analysis can continue.
+ *
+ * @return true if the database contains data
+ */
+ private boolean dataExists() {
+ return cveDb.dataExists();
+ }
+
+ /**
+ * Determines if the index needs to be updated. This is done by fetching the
+ * NVD CVE meta data and checking the last update date. If the data needs to
+ * be refreshed this method will return the NvdCveUrl for the files that
+ * need to be updated.
+ *
+ * @param url the URL of the NVD API cache
+ * @param filePattern the string format pattern for the cached files (e.g.
+ * "nvdcve-{0}.json.gz")
+ * @param cacheProperties the properties from the remote NVD API cache
+ * @param now the start time of the update process
+ * @return the map of key to URLs - where the key is the year or `modified`
+ * @throws UpdateException Is thrown if there is an issue with the last
+ * updated properties file
+ */
+ protected final Map getUpdatesNeeded(String url, String filePattern,
+ Properties cacheProperties, ZonedDateTime now) throws UpdateException {
+ LOGGER.debug("starting getUpdatesNeeded() ...");
+ final Map updates = new HashMap<>();
+ if (dbProperties != null && !dbProperties.isEmpty()) {
+ final int startYear = settings.getInt(Settings.KEYS.NVD_API_DATAFEED_START_YEAR, 2002);
+ // for establishing the current year use the timezone where the new year starts first
+ // as from that moment on CNAs might start assigning CVEs with the new year depending
+ // on the CNA's timezone
+ final int endYear = now.withZoneSameInstant(ZoneId.of("UTC+14:00")).getYear();
+ boolean needsFullUpdate = false;
+ for (int y = startYear; y <= endYear; y++) {
+ final ZonedDateTime val = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_MODIFIED + "." + y);
+ if (val == null) {
+ needsFullUpdate = true;
+ break;
+ }
+ }
+ final ZonedDateTime lastUpdated = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_MODIFIED);
+ final int days = settings.getInt(Settings.KEYS.NVD_API_DATAFEED_VALID_FOR_DAYS, 7);
+
+ if (!needsFullUpdate && lastUpdated.equals(DatabaseProperties.getTimestamp(cacheProperties, NVD_API_CACHE_MODIFIED_DATE))) {
+ return updates;
+ } else {
+ updates.put("modified", url + MessageFormat.format(filePattern, "modified"));
+ if (needsFullUpdate) {
+ for (int i = startYear; i <= endYear; i++) {
+ if (cacheProperties.containsKey(NVD_API_CACHE_MODIFIED_DATE + "." + i)) {
+ updates.put(String.valueOf(i), url + MessageFormat.format(filePattern, String.valueOf(i)));
+ }
+ }
+ } else if (!DateUtil.withinDateRange(lastUpdated, now, days)) {
+ for (int i = startYear; i <= endYear; i++) {
+ if (cacheProperties.containsKey(NVD_API_CACHE_MODIFIED_DATE + "." + i)) {
+ final ZonedDateTime lastModifiedCache = DatabaseProperties.getTimestamp(cacheProperties,
+ NVD_API_CACHE_MODIFIED_DATE + "." + i);
+ final ZonedDateTime lastModifiedDB = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_MODIFIED + "." + i);
+ if (lastModifiedDB == null || lastModifiedCache.compareTo(lastModifiedDB) > 0) {
+ updates.put(String.valueOf(i), url + MessageFormat.format(filePattern, String.valueOf(i)));
+ }
+ }
+ }
+ }
+ }
+ }
+ if (updates.size() > 3) {
+ LOGGER.info("NVD API Cache requires several updates; this could take a couple of minutes.");
+ }
+ return updates;
+ }
+
+ /**
+ * Downloads the metadata properties of the NVD API cache.
+ *
+ * @param url the base URL to the NVD API cache
+ * @param pattern the pattern of the datafile name for the NVD API cache
+ * @return the cache properties
+ * @throws UpdateException thrown if the properties file could not be
+ * downloaded
+ */
+ protected final Properties getRemoteCacheProperties(String url, String pattern) throws UpdateException {
+ final Properties properties = new Properties();
+ try {
+ final URL u = new URI(url + "cache.properties").toURL();
+ final String content = Downloader.getInstance().fetchContent(u, StandardCharsets.UTF_8);
+ properties.load(new StringReader(content));
+
+ } catch (URISyntaxException ex) {
+ throw new UpdateException("Invalid NVD Cache URL", ex);
+ } catch (DownloadFailedException | ResourceNotFoundException ex) {
+ final String metaPattern;
+ if (pattern == null) {
+ metaPattern = "nvdcve-{0}.meta";
+ } else {
+ metaPattern = pattern.replace(".json.gz", ".meta");
+ }
+ try {
+ URL metaUrl = new URI(url + MessageFormat.format(metaPattern, "modified")).toURL();
+ String content = Downloader.getInstance().fetchContent(metaUrl, StandardCharsets.UTF_8);
+ final Properties props = new Properties();
+ props.load(new StringReader(content));
+ ZonedDateTime lmd = DatabaseProperties.getIsoTimestamp(props, "lastModifiedDate");
+ DatabaseProperties.setTimestamp(properties, "lastModifiedDate.modified", lmd);
+ DatabaseProperties.setTimestamp(properties, "lastModifiedDate", lmd);
+ final int startYear = settings.getInt(Settings.KEYS.NVD_API_DATAFEED_START_YEAR, 2002);
+ final ZonedDateTime now = ZonedDateTime.now(ZoneId.of("UTC"));
+ final int endYear = now.withZoneSameInstant(ZoneId.of("UTC+14:00")).getYear();
+ for (int y = startYear; y <= endYear; y++) {
+ metaUrl = new URI(url + MessageFormat.format(metaPattern, String.valueOf(y))).toURL();
+ content = Downloader.getInstance().fetchContent(metaUrl, StandardCharsets.UTF_8);
+ props.clear();
+ props.load(new StringReader(content));
+ lmd = DatabaseProperties.getIsoTimestamp(props, "lastModifiedDate");
+ DatabaseProperties.setTimestamp(properties, "lastModifiedDate." + String.valueOf(y), lmd);
+ }
+ } catch (URISyntaxException | TooManyRequestsException | ResourceNotFoundException | IOException ex1) {
+ throw new UpdateException("Unable to download the data feed META files", ex);
+ }
+ } catch (TooManyRequestsException ex) {
+ throw new UpdateException("Unable to download the NVD API cache.properties", ex);
+ } catch (IOException ex) {
+ throw new UpdateException("Invalid NVD Cache Properties file contents", ex);
+ }
+ return properties;
+ }
+
+ protected static class UrlData {
+
+ /**
+ * The URL to download resources from.
+ */
+ private final String url;
+
+ /**
+ * The pattern to construct the file names for resources from.
+ */
+ private final String pattern;
+
+ public UrlData(String url, String pattern) {
+ this.url = url;
+ this.pattern = pattern;
+ }
+
+ /**
+ * Get the value of pattern
+ *
+ * @return the value of pattern
+ */
+ public String getPattern() {
+ return pattern;
+ }
+
+ /**
+ * Get the value of url
+ *
+ * @return the value of url
+ */
+ public String getUrl() {
+ return url;
+ }
+
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
deleted file mode 100644
index cbd2939b423..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
+++ /dev/null
@@ -1,585 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update;
-
-import java.io.BufferedReader;
-import java.io.BufferedWriter;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.OutputStreamWriter;
-import java.net.MalformedURLException;
-import java.time.ZoneOffset;
-import java.time.ZonedDateTime;
-import java.util.HashSet;
-import java.util.Set;
-import java.net.URL;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.stream.Collectors;
-import javax.annotation.concurrent.ThreadSafe;
-import org.apache.commons.io.FileUtils;
-
-import org.owasp.dependencycheck.Engine;
-import org.owasp.dependencycheck.data.nvd.json.MetaProperties;
-import org.owasp.dependencycheck.data.nvdcve.CveDB;
-import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
-import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
-
-import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.MODIFIED;
-
-import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
-import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.data.update.nvd.DownloadTask;
-import org.owasp.dependencycheck.data.update.nvd.NvdCache;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
-import org.owasp.dependencycheck.data.update.nvd.ProcessTask;
-import org.owasp.dependencycheck.utils.DateUtil;
-import org.owasp.dependencycheck.utils.DownloadFailedException;
-import org.owasp.dependencycheck.utils.Downloader;
-import org.owasp.dependencycheck.utils.InvalidSettingException;
-import org.owasp.dependencycheck.utils.ResourceNotFoundException;
-import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.TooManyRequestsException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Class responsible for updating the NVD CVE data.
- *
- * @author Jeremy Long
- */
-@ThreadSafe
-public class NvdCveUpdater implements CachedWebDataSource {
-
- /**
- * The logger.
- */
- private static final Logger LOGGER = LoggerFactory.getLogger(NvdCveUpdater.class);
- /**
- * The thread pool size to use for CPU-intense tasks.
- */
- private static final int PROCESSING_THREAD_POOL_SIZE = Runtime.getRuntime().availableProcessors();
- /**
- * The thread pool size to use when downloading files.
- */
- private static final int DOWNLOAD_THREAD_POOL_SIZE = Math.round(1.5f * Runtime.getRuntime().availableProcessors());
- /**
- * ExecutorService for CPU-intense processing tasks.
- */
- private ExecutorService processingExecutorService = null;
- /**
- * ExecutorService for tasks that involve blocking activities and are not
- * very CPU-intense, e.g. downloading files.
- */
- private ExecutorService downloadExecutorService = null;
- /**
- * The configured settings.
- */
- private Settings settings;
- /**
- * Reference to the DAO.
- */
- private CveDB cveDb = null;
- /**
- * The properties obtained from the database.
- */
- private DatabaseProperties dbProperties = null;
-
- /**
- * Downloads the latest NVD CVE XML file from the web and imports it into
- * the current CVE Database. A lock on a file is obtained in an attempt to
- * prevent more then one thread/JVM from updating the database at the same
- * time. This method may sleep upto 5 minutes.
- *
- * @param engine a reference to the dependency-check engine
- * @return whether or not an update was made to the CveDB
- * @throws UpdateException is thrown if there is an error updating the
- * database
- */
- @Override
- public synchronized boolean update(Engine engine) throws UpdateException {
- this.settings = engine.getSettings();
- this.cveDb = engine.getDatabase();
- if (isUpdateConfiguredFalse()) {
- return false;
- }
- boolean updatesMade = false;
- try {
- dbProperties = cveDb.getDatabaseProperties();
- if (checkUpdate()) {
- final List updateable = getUpdatesNeeded();
- if (!updateable.isEmpty()) {
- initializeExecutorServices();
- performUpdate(updateable);
- updatesMade = true;
- }
- //all dates in the db are now stored in seconds as opposed to previously milliseconds.
- dbProperties.save(DatabaseProperties.LAST_CHECKED, Long.toString(System.currentTimeMillis() / 1000));
- if (updatesMade) {
- cveDb.persistEcosystemCache();
- }
- final int updateCount = cveDb.updateEcosystemCache();
- LOGGER.debug("Corrected the ecosystem for {} ecoSystemCache entries", updateCount);
- if (updatesMade || updateCount > 0) {
- cveDb.cleanupDatabase();
- }
- }
- } catch (UpdateException ex) {
- if (ex.getCause() != null && ex.getCause() instanceof DownloadFailedException) {
- final String jre = System.getProperty("java.version");
- if (jre == null || jre.startsWith("1.4") || jre.startsWith("1.5") || jre.startsWith("1.6") || jre.startsWith("1.7")) {
- LOGGER.error("An old JRE is being used ({} {}), and likely does not have the correct root certificates or algorithms "
- + "to connect to the NVD - consider upgrading your JRE.", System.getProperty("java.vendor"), jre);
- }
- }
- throw ex;
- } catch (DatabaseException ex) {
- throw new UpdateException("Database Exception, unable to update the data to use the most current data.", ex);
- } finally {
- shutdownExecutorServices();
- }
- return updatesMade;
- }
-
- /**
- * Checks if the system is configured NOT to update.
- *
- * @return false if the system is configured to perform an update; otherwise
- * true
- */
- private boolean isUpdateConfiguredFalse() {
- if (!settings.getBoolean(Settings.KEYS.UPDATE_NVDCVE_ENABLED, true)) {
- return true;
- }
- boolean autoUpdate = true;
- try {
- autoUpdate = settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
- } catch (InvalidSettingException ex) {
- LOGGER.debug("Invalid setting for auto-update; using true.");
- }
- return !autoUpdate;
- }
-
- /**
- * Initialize the executor services for download and processing of the NVD
- * CVE XML data.
- */
- protected void initializeExecutorServices() {
- final int downloadPoolSize;
- final int max = settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 1);
- downloadPoolSize = Math.min(DOWNLOAD_THREAD_POOL_SIZE, max);
- downloadExecutorService = Executors.newFixedThreadPool(downloadPoolSize);
- processingExecutorService = Executors.newFixedThreadPool(PROCESSING_THREAD_POOL_SIZE);
- LOGGER.debug("#download threads: {}", downloadPoolSize);
- LOGGER.debug("#processing threads: {}", PROCESSING_THREAD_POOL_SIZE);
- }
-
- /**
- * Shutdown and cleanup of resources used by the executor services.
- */
- private void shutdownExecutorServices() {
- if (processingExecutorService != null) {
- processingExecutorService.shutdownNow();
- }
- if (downloadExecutorService != null) {
- downloadExecutorService.shutdownNow();
- }
- }
-
- /**
- * Checks if the NVD CVE XML files were last checked recently. As an
- * optimization, we can avoid repetitive checks against the NVD. Setting
- * CVE_CHECK_VALID_FOR_HOURS determines the duration since last check before
- * checking again. A database property stores the timestamp of the last
- * check.
- *
- * @return true to proceed with the check, or false to skip
- * @throws UpdateException thrown when there is an issue checking for
- * updates
- */
- private boolean checkUpdate() throws UpdateException {
- boolean proceed = true;
- // If the valid setting has not been specified, then we proceed to check...
- final int validForHours = settings.getInt(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, 0);
- if (dataExists() && 0 < validForHours) {
- // ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
- final long validForSeconds = validForHours * 60L * 60L;
- final long lastChecked = getPropertyInSeconds(DatabaseProperties.LAST_CHECKED);
- final long now = System.currentTimeMillis() / 1000;
- proceed = (now - lastChecked) > validForSeconds;
- if (!proceed) {
- LOGGER.info("Skipping NVD check since last check was within {} hours.", validForHours);
- LOGGER.debug("Last NVD was at {}, and now {} is within {} s.", lastChecked, now, validForSeconds);
- }
- }
- return proceed;
- }
-
- /**
- * Checks the CVE Index to ensure data exists and analysis can continue.
- *
- * @return true if the database contains data
- */
- private boolean dataExists() {
- return cveDb.dataExists();
- }
-
- /**
- * Downloads the latest NVD CVE XML file from the web and imports it into
- * the current CVE Database.
- *
- * @param updateable a collection of NVD CVE data file references that need
- * to be downloaded and processed to update the database
- * @throws UpdateException is thrown if there is an error updating the
- * database
- */
- @SuppressWarnings("FutureReturnValueIgnored")
- private void performUpdate(List updateable) throws UpdateException {
- if (updateable.isEmpty()) {
- return;
- }
- if (updateable.size() > 3) {
- LOGGER.info("NVD CVE requires several updates; this could take a couple of minutes.");
- }
-
- DownloadTask runLast = null;
- final Set>> downloadFutures = new HashSet<>(updateable.size());
- for (NvdCveInfo cve : updateable) {
- final DownloadTask call = new DownloadTask(cve, processingExecutorService, cveDb, settings);
- if (call.isModified()) {
- runLast = call;
- } else {
- final boolean added = downloadFutures.add(downloadExecutorService.submit(call));
- if (!added) {
- throw new UpdateException("Unable to add the download task for " + cve.getId());
- }
- }
- }
-
- //next, move the future future processTasks to just future processTasks and check for errors.
- final Set> processFutures = new HashSet<>(updateable.size());
- for (Future> future : downloadFutures) {
- final Future task;
- try {
- task = future.get();
- if (task != null) {
- processFutures.add(task);
- }
- } catch (InterruptedException ex) {
- LOGGER.debug("Thread was interrupted during download", ex);
- Thread.currentThread().interrupt();
- throw new UpdateException("The download was interrupted", ex);
- } catch (ExecutionException ex) {
- LOGGER.debug("Thread was interrupted during download execution", ex);
- throw new UpdateException("The execution of the download was interrupted", ex);
- }
- }
-
- for (Future future : processFutures) {
- try {
- final ProcessTask task = future.get();
- if (task.getException() != null) {
- throw task.getException();
- }
- } catch (InterruptedException ex) {
- LOGGER.debug("Thread was interrupted during processing", ex);
- Thread.currentThread().interrupt();
- throw new UpdateException(ex);
- } catch (ExecutionException ex) {
- LOGGER.debug("Execution Exception during process", ex);
- throw new UpdateException(ex);
- }
- }
-
- if (runLast != null) {
- final Future> modified = downloadExecutorService.submit(runLast);
- final Future task;
- try {
- task = modified.get();
- if (task != null) {
- final ProcessTask last = task.get();
- if (last.getException() != null) {
- throw last.getException();
- }
- }
- } catch (InterruptedException ex) {
- LOGGER.debug("Thread was interrupted during download", ex);
- Thread.currentThread().interrupt();
- throw new UpdateException("The download was interrupted", ex);
- } catch (ExecutionException ex) {
- LOGGER.debug("Thread was interrupted during download execution", ex);
- throw new UpdateException("The execution of the download was interrupted", ex);
- }
- }
-
- }
-
- /**
- * Downloads the NVD CVE Meta file properties.
- *
- * @param url the URL to the NVD CVE JSON file
- * @return the meta file properties
- * @throws UpdateException thrown if the meta file could not be downloaded
- */
- protected final MetaProperties getMetaFile(String url) throws UpdateException {
- try {
- final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
- MetaProperties retVal = doMetaDownload(url, false);
-
- final int downloadAttempts = 4;
- for (int x = 2; retVal == null && x <= downloadAttempts; x++) {
- Thread.sleep(waitTime * (x / 2));
- retVal = doMetaDownload(url, x == downloadAttempts);
- }
- return retVal;
- } catch (InterruptedException ex) {
- Thread.interrupted();
- throw new UpdateException("Download interupted", ex);
- }
- }
-
- /**
- * Downloads the NVD CVE Meta file properties.
- *
- * @param url the URL to the NVD CVE JSON file
- * @param throwErrors if true and an error occurs, the error
- * will be thrown; otherwise the error will be suppressed
- * @return the meta file properties
- * @throws UpdateException thrown if the meta file could not be downloaded
- */
- private MetaProperties doMetaDownload(String url, boolean throwErrors) throws UpdateException {
- final String metaUrl = url.substring(0, url.length() - 7) + "meta";
- final NvdCache cache = new NvdCache(settings);
- try {
- final URL u = new URL(metaUrl);
- final File tmp = settings.getTempFile("nvd", "meta");
- if (cache.notInCache(u, tmp)) {
- final Downloader d = new Downloader(settings);
- final String content = d.fetchContent(u, true, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);
- try (FileOutputStream fos = new FileOutputStream(tmp);
- OutputStreamWriter osw = new OutputStreamWriter(fos, StandardCharsets.UTF_8);
- BufferedWriter writer = new BufferedWriter(osw)) {
- writer.write(content);
- }
- cache.storeInCache(u, tmp);
- FileUtils.deleteQuietly(tmp);
- return new MetaProperties(content);
- } else {
- final String content;
- try (FileInputStream fis = new FileInputStream(tmp);
- InputStreamReader isr = new InputStreamReader(fis, StandardCharsets.UTF_8);
- BufferedReader reader = new BufferedReader(isr)) {
- content = reader.lines().collect(Collectors.joining("\n"));
- }
- FileUtils.deleteQuietly(tmp);
- return new MetaProperties(content);
- }
- } catch (MalformedURLException ex) {
- if (throwErrors) {
- throw new UpdateException("Meta file url is invalid: " + metaUrl, ex);
- }
- } catch (InvalidDataException ex) {
- if (throwErrors) {
- throw new UpdateException("Meta file content is invalid: " + metaUrl, ex);
- }
- } catch (DownloadFailedException ex) {
- if (throwErrors) {
- throw new UpdateException("Unable to download meta file: " + metaUrl, ex);
- }
- } catch (TooManyRequestsException ex) {
- if (throwErrors) {
- throw new UpdateException("Unable to download meta file: " + metaUrl + "; received 429 -- too many requests", ex);
- }
- } catch (ResourceNotFoundException ex) {
- if (throwErrors) {
- throw new UpdateException("Unable to download meta file: " + metaUrl + "; received 404 -- resource not found", ex);
- }
- } catch (IOException ex) {
- if (throwErrors) {
- throw new RuntimeException(ex);
- }
- }
- return null;
- }
-
- /**
- * Determines if the index needs to be updated. This is done by fetching the
- * NVD CVE meta data and checking the last update date. If the data needs to
- * be refreshed this method will return the NvdCveUrl for the files that
- * need to be updated.
- *
- * @return the collection of files that need to be updated
- * @throws UpdateException Is thrown if there is an issue with the last
- * updated properties file
- */
- protected final List getUpdatesNeeded() throws UpdateException {
- LOGGER.debug("starting getUpdatesNeeded() ...");
- final List updates = new ArrayList<>();
- if (dbProperties != null && !dbProperties.isEmpty()) {
- try {
- final int startYear = settings.getInt(Settings.KEYS.CVE_START_YEAR, 2002);
- // for establishing the current year use the timezone where the new year starts first
- // as from that moment on CNAs might start assigning CVEs with the new year depending
- // on the CNA's timezone
- final ZonedDateTime today = ZonedDateTime.now().withZoneSameInstant(ZoneOffset.ofHours(14));
- final int endYear = today.getYear();
- final int dayOfEndYear = today.getDayOfYear();
- boolean needsFullUpdate = false;
- for (int y = startYear; y <= endYear; y++) {
- final long val = Long.parseLong(dbProperties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + y, "0"));
- if (val == 0) {
- needsFullUpdate = true;
- break;
- }
- }
- final long lastUpdated = getPropertyInSeconds(DatabaseProperties.LAST_UPDATED);
- final long now = System.currentTimeMillis() / 1000;
- final int days = settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
-
- String url = settings.getString(Settings.KEYS.CVE_MODIFIED_JSON);
- final MetaProperties modified = getMetaFile(url);
-
- if (!needsFullUpdate && lastUpdated == modified.getLastModifiedDate()) {
- return updates;
- } else {
- final String baseUrl = settings.getString(Settings.KEYS.CVE_BASE_JSON);
- final NvdCveInfo item = new NvdCveInfo(MODIFIED, url, modified.getLastModifiedDate());
- updates.add(item);
- if (needsFullUpdate) {
- // no need to download each one, just use the modified timestamp
- for (int i = startYear; i < endYear; i++) {
- url = String.format(baseUrl, i);
- final NvdCveInfo entry = new NvdCveInfo(Integer.toString(i), url, modified.getLastModifiedDate());
- updates.add(entry);
- }
- // for endyear check metadata availability to determine inclusion when still in grace period
- if (dayOfEndYear < settings.getInt(Settings.KEYS.NVD_NEW_YEAR_GRACE_PERIOD, 10)) {
- try {
- url = String.format(baseUrl, endYear);
- final MetaProperties meta = getMetaFile(url);
- } catch (UpdateException ue) {
- if (ue.getCause() instanceof ResourceNotFoundException) {
- LOGGER.warn("NVD Data for {} has not been published yet.", endYear);
- } else {
- throw ue;
- }
- }
- } else {
- url = String.format(baseUrl, endYear);
- final NvdCveInfo entry = new NvdCveInfo(Integer.toString(endYear), url, modified.getLastModifiedDate());
- updates.add(entry);
- }
- } else if (!DateUtil.withinDateRange(lastUpdated, now, days)) {
- final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
- for (int i = startYear; i <= endYear; i++) {
- try {
- url = String.format(baseUrl, i);
- Thread.sleep(waitTime);
- final MetaProperties meta = getMetaFile(url);
- final long currentTimestamp = getPropertyInSeconds(DatabaseProperties.LAST_UPDATED_BASE + i);
-
- if (currentTimestamp < meta.getLastModifiedDate()) {
- final NvdCveInfo entry = new NvdCveInfo(Integer.toString(i), url, meta.getLastModifiedDate());
- updates.add(entry);
- }
- } catch (UpdateException ex) {
- final int grace = settings.getInt(Settings.KEYS.NVD_NEW_YEAR_GRACE_PERIOD, 10);
- if (ex.getCause() instanceof ResourceNotFoundException
- && i == endYear && dayOfEndYear < grace) {
- LOGGER.warn("NVD Data for {} has not been published yet.", endYear);
- } else {
- throw ex;
- }
- } catch (InterruptedException ex) {
- Thread.interrupted();
- throw new UpdateException("The download of the meta file was interupted: " + url, ex);
- }
- }
- }
- }
- } catch (NumberFormatException ex) {
- LOGGER.warn("An invalid schema version or timestamp exists in the data.properties file.");
- LOGGER.debug("", ex);
- }
- }
- return updates;
- }
-
- /**
- * Returns the database property value in seconds.
- *
- * @param key the key to the property
- * @return the property value in seconds
- */
- private long getPropertyInSeconds(String key) {
- final String value = dbProperties.getProperty(key, "0");
- return DateUtil.getEpochValueInSeconds(value);
- }
-
- /**
- * Sets the settings object; this is used during testing.
- *
- * @param settings the configured settings
- */
- protected synchronized void setSettings(Settings settings) {
- this.settings = settings;
- }
-
- @Override
- public boolean purge(Engine engine) {
- boolean result = true;
- try {
- final File dataDir = engine.getSettings().getDataDirectory();
- final File db = new File(dataDir, engine.getSettings().getString(Settings.KEYS.DB_FILE_NAME, "odc.mv.db"));
- if (db.exists()) {
- if (db.delete()) {
- LOGGER.info("Database file purged; local copy of the NVD has been removed");
- } else {
- LOGGER.error("Unable to delete '{}'; please delete the file manually", db.getAbsolutePath());
- result = false;
- }
- } else {
- LOGGER.info("Unable to purge database; the database file does not exist: {}", db.getAbsolutePath());
- result = false;
- }
- final File traceFile = new File(dataDir, "odc.trace.db");
- if (traceFile.exists() && !traceFile.delete()) {
- LOGGER.error("Unable to delete '{}'; please delete the file manually", traceFile.getAbsolutePath());
- result = false;
- }
- final File lockFile = new File(dataDir, "odc.update.lock");
- if (lockFile.exists() && !lockFile.delete()) {
- LOGGER.error("Unable to delete '{}'; please delete the file manually", lockFile.getAbsolutePath());
- result = false;
- }
- } catch (IOException ex) {
- final String msg = "Unable to delete the database";
- LOGGER.error(msg, ex);
- result = false;
- }
- return result;
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/RetireJSDataSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/RetireJSDataSource.java
index 59f4b7a39fa..7dcbf994b0d 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/RetireJSDataSource.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/RetireJSDataSource.java
@@ -40,7 +40,7 @@
* @author Jeremy Long
*/
@ThreadSafe
-public class RetireJSDataSource implements CachedWebDataSource {
+public class RetireJSDataSource extends LocalDataSource {
/**
* Static logger.
@@ -87,6 +87,7 @@ public boolean update(Engine engine) throws UpdateException {
if (proceed) {
LOGGER.debug("Begin RetireJS Update");
initializeRetireJsRepo(settings, url, repoFile);
+ saveLastUpdated(repoFile, System.currentTimeMillis() / 1000);
}
} catch (MalformedURLException ex) {
throw new UpdateException(String.format("Invalid URL for RetireJS repository (%s)", configuredUrl), ex);
@@ -109,7 +110,7 @@ protected boolean shouldUpdate(File repo) throws NumberFormatException {
boolean proceed = true;
if (repo != null && repo.isFile()) {
final int validForHours = settings.getInt(Settings.KEYS.ANALYZER_RETIREJS_REPO_VALID_FOR_HOURS, 0);
- final long lastUpdatedOn = repo.lastModified();
+ final long lastUpdatedOn = getLastUpdated(repo);
final long now = System.currentTimeMillis();
LOGGER.debug("Last updated: {}", lastUpdatedOn);
LOGGER.debug("Now: {}", now);
@@ -122,6 +123,7 @@ protected boolean shouldUpdate(File repo) throws NumberFormatException {
return proceed;
}
+
/**
* Initializes the local RetireJS repository
*
@@ -135,8 +137,7 @@ protected boolean shouldUpdate(File repo) throws NumberFormatException {
private void initializeRetireJsRepo(Settings settings, URL repoUrl, File repoFile) throws UpdateException {
try (WriteLock lock = new WriteLock(settings, true, repoFile.getName() + ".lock")) {
LOGGER.debug("RetireJS Repo URL: {}", repoUrl.toExternalForm());
- final Downloader downloader = new Downloader(settings);
- downloader.fetchFile(repoUrl, repoFile, Settings.KEYS.ANALYZER_RETIREJS_REPO_JS_USER, Settings.KEYS.ANALYZER_RETIREJS_REPO_JS_PASSWORD);
+ Downloader.getInstance().fetchFile(repoUrl, repoFile);
} catch (IOException | TooManyRequestsException | ResourceNotFoundException | WriteLockException ex) {
throw new UpdateException("Failed to initialize the RetireJS repo", ex);
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/cisa/KnownExploitedVulnerabilityParser.java b/core/src/main/java/org/owasp/dependencycheck/data/update/cisa/KnownExploitedVulnerabilityParser.java
index c4c28f5a0bb..1d7ee983f16 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/cisa/KnownExploitedVulnerabilityParser.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/cisa/KnownExploitedVulnerabilityParser.java
@@ -19,10 +19,8 @@
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.Module;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.ObjectReader;
-import com.fasterxml.jackson.module.afterburner.AfterburnerModule;
import com.fasterxml.jackson.module.blackbird.BlackbirdModule;
import java.io.EOFException;
import java.io.IOException;
@@ -33,7 +31,6 @@
import org.owasp.dependencycheck.data.knownexploited.json.KnownExploitedVulnerabilitiesSchema;
import org.owasp.dependencycheck.data.update.exception.CorruptedDatastreamException;
import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.utils.Utils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -61,13 +58,7 @@ public class KnownExploitedVulnerabilityParser {
public KnownExploitedVulnerabilitiesSchema parse(InputStream in) throws UpdateException, CorruptedDatastreamException {
final ObjectMapper objectMapper = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
- final Module module;
- if (Utils.getJavaVersion() <= 8) {
- module = new AfterburnerModule();
- } else {
- module = new BlackbirdModule();
- }
- objectMapper.registerModule(module);
+ objectMapper.registerModule(new BlackbirdModule());
final ObjectReader objectReader = objectMapper.readerFor(KnownExploitedVulnerabilitiesSchema.class);
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CpeEcosystemCache.java b/core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CpeEcosystemCache.java
index 671b7bd009b..71d61cf2185 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CpeEcosystemCache.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CpeEcosystemCache.java
@@ -20,7 +20,7 @@
import java.util.HashMap;
import java.util.Map;
import org.apache.commons.lang3.StringUtils;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveParser;
+
import org.owasp.dependencycheck.utils.Pair;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -50,7 +50,7 @@ private CpeEcosystemCache() {
/**
* The logger.
*/
- private static final Logger LOGGER = LoggerFactory.getLogger(NvdCveParser.class);
+ private static final Logger LOGGER = LoggerFactory.getLogger(CpeEcosystemCache.class);
//CSOFF: EmptyBlock
/**
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/exception/CorruptedDatastreamException.java b/core/src/main/java/org/owasp/dependencycheck/data/update/exception/CorruptedDatastreamException.java
index 2794adb98bf..3ce88bf2f26 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/exception/CorruptedDatastreamException.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/exception/CorruptedDatastreamException.java
@@ -27,6 +27,8 @@
@ThreadSafe
public class CorruptedDatastreamException extends Exception {
+ private static final long serialVersionUID = 1L;
+
/**
* Create a new CorruptedDatastreamException.
*/
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
deleted file mode 100644
index a0d8f0bf9ce..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import java.io.File;
-import java.io.IOException;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.concurrent.Callable;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Future;
-import javax.annotation.concurrent.ThreadSafe;
-import org.apache.commons.lang3.StringUtils;
-import org.owasp.dependencycheck.data.nvdcve.CveDB;
-import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.utils.DownloadFailedException;
-import org.owasp.dependencycheck.utils.Downloader;
-import org.owasp.dependencycheck.utils.ResourceNotFoundException;
-import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.TooManyRequestsException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * A callable object to download two files.
- *
- * @author Jeremy Long
- */
-@ThreadSafe
-public class DownloadTask implements Callable> {
-
- /**
- * The Logger.
- */
- private static final Logger LOGGER = LoggerFactory.getLogger(DownloadTask.class);
- /**
- * The CVE DB to use when processing the files.
- */
- private final CveDB cveDB;
- /**
- * The processor service to pass the results of the download to.
- */
- private final ExecutorService processorService;
- /**
- * The NVD CVE Meta Data.
- */
- private NvdCveInfo nvdCveInfo;
- /**
- * A reference to the global settings object.
- */
- private final Settings settings;
- /**
- * a file.
- */
- private final File file;
-
- /**
- * Simple constructor for the callable download task.
- *
- * @param nvdCveInfo the NVD CVE info
- * @param processor the processor service to submit the downloaded files to
- * @param cveDB the CVE DB to use to store the vulnerability data
- * @param settings a reference to the global settings object; this is
- * necessary so that when the thread is started the dependencies have a
- * correct reference to the global settings.
- * @throws UpdateException thrown if temporary files could not be created
- */
- public DownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB, Settings settings) throws UpdateException {
- this.nvdCveInfo = nvdCveInfo;
- this.processorService = processor;
- this.cveDB = cveDB;
- this.settings = settings;
-
- try {
- this.file = File.createTempFile("cve" + nvdCveInfo.getId() + '_', ".json.gz", settings.getTempDirectory());
- } catch (IOException ex) {
- throw new UpdateException("Unable to create temporary files", ex);
- }
- }
-
- /**
- * Get the value of nvdCveInfo.
- *
- * @return the value of nvdCveInfo
- */
- public NvdCveInfo getNvdCveInfo() {
- return nvdCveInfo;
- }
-
- /**
- * Set the value of nvdCveInfo.
- *
- * @param nvdCveInfo new value of nvdCveInfo
- */
- public void setNvdCveInfo(NvdCveInfo nvdCveInfo) {
- this.nvdCveInfo = nvdCveInfo;
- }
-
- /**
- * Get the value of file.
- *
- * @return the value of file
- */
- public File getFile() {
- return file;
- }
-
- @SuppressWarnings("BusyWait")
- @Override
- public Future call() throws Exception {
- final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
- long startDownload = 0;
- final NvdCache cache = new NvdCache(settings);
- try {
- final URL url1 = new URL(nvdCveInfo.getUrl());
- if (cache.notInCache(url1, file)) {
- Thread.sleep(waitTime);
- LOGGER.info("Download Started for NVD CVE - {}", nvdCveInfo.getId());
- startDownload = System.currentTimeMillis();
- final int downloadAttempts = 5;
- for (int x = 2; x <= downloadAttempts && !attemptDownload(url1, x == downloadAttempts); x++) {
- LOGGER.info("Download Attempt {} for NVD CVE - {}", x, nvdCveInfo.getId());
- Thread.sleep(waitTime * (x / 2));
- }
- if (file.isFile() && file.length() > 0) {
- LOGGER.info("Download Complete for NVD CVE - {} ({} ms)", nvdCveInfo.getId(),
- System.currentTimeMillis() - startDownload);
- cache.storeInCache(url1, file);
- } else {
- throw new DownloadFailedException("Unable to download NVD CVE " + nvdCveInfo.getId());
- }
- }
- if (this.processorService == null) {
- return null;
- }
- final ProcessTask task = new ProcessTask(cveDB, this, settings);
- final Future val = this.processorService.submit(task);
- return val;
-
- } catch (Throwable ex) {
- LOGGER.error("Error downloading NVD CVE - {} Reason: {}", nvdCveInfo.getId(), ex.getMessage());
- throw ex;
- } finally {
- settings.cleanup(false);
- }
- }
-
- private boolean attemptDownload(final URL url1, boolean showLog) throws TooManyRequestsException, ResourceNotFoundException {
- try {
- final Downloader downloader = new Downloader(settings);
- downloader.fetchFile(url1, file, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);
- } catch (DownloadFailedException ex) {
- if (showLog) {
- LOGGER.error("Download Failed for NVD CVE - {}\nSome CVEs may not be reported. Reason: {}",
- nvdCveInfo.getId(), ex.getMessage());
- if (settings.getString(Settings.KEYS.PROXY_SERVER) == null) {
- LOGGER.error("If you are behind a proxy you may need to configure dependency-check to use the proxy.");
- }
- LOGGER.debug("", ex);
- }
- return false;
- }
- return true;
- }
-
- /**
- * Attempts to delete the files that were downloaded.
- */
- public void cleanup() {
- if (file != null && file.exists() && !file.delete()) {
- LOGGER.debug("Failed to delete first temporary file {}", file);
- file.deleteOnExit();
- }
- }
-
- /**
- * Attempts to delete the files that were downloaded.
- */
- public void evictCorruptFileFromCache() {
- final NvdCache cache = new NvdCache(settings);
- try {
- final URL url1 = new URL(nvdCveInfo.getUrl());
- cache.evictFromCache(url1);
- } catch (MalformedURLException e) {
- LOGGER.debug("Ignoring Cache-eviction request for an invalid URL");
- }
- }
-
- /**
- * Returns true if the process task is for the modified json file from the
- * NVD.
- *
- * @return true if the process task is for the modified data;
- * otherwise false
- */
- public boolean isModified() {
- return StringUtils.containsIgnoreCase(file.toString(), "modified");
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCache.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCache.java
deleted file mode 100644
index 2471e7ce0f3..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCache.java
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2021 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import java.io.File;
-import java.io.IOException;
-import java.net.URL;
-import java.nio.file.Files;
-import java.time.Instant;
-import org.apache.commons.io.FileUtils;
-import org.owasp.dependencycheck.utils.Settings;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Simple four hour cache for files.
- *
- * @author Jeremy Long
- */
-public class NvdCache {
-
- /**
- * The Logger.
- */
- private static final Logger LOGGER = LoggerFactory.getLogger(DownloadTask.class);
- /**
- * The settings.
- */
- private final Settings settings;
-
- /**
- * Creates a new cache for the NVD files.
- *
- * @param settings ODC settings
- */
- public NvdCache(Settings settings) {
- this.settings = settings;
- }
-
- /**
- * Checks if the file is in the cache and within four hours. If found and
- * viable, the cached data will be copied to the given file.
- *
- * @param url the URL of the file cached
- * @param file the path of the file to restore from the cache
- * @return true if the URL file is not in the cache; otherwise
- * false
- */
- public boolean notInCache(URL url, File file) {
- try {
- //valid for up to four hours.
- final long validEpoch = Instant.now().toEpochMilli() - 14400000;
- final File tmp = new File(url.getPath());
- final String filename = tmp.getName();
- final File cache = new File(settings.getDataDirectory(), "nvdcache");
- if (!cache.isDirectory()) {
- return true;
- }
- final File nvdFile = new File(cache, filename);
- if (nvdFile.isFile() && nvdFile.lastModified() > validEpoch) {
- LOGGER.debug("Copying {} from cache", url);
- FileUtils.copyFile(nvdFile, file);
- return false;
- }
- return true;
- } catch (IOException ex) {
- LOGGER.debug("Error checking for nvd file in cache", ex);
- return true;
- }
- }
-
- /**
- * Stores a file in the cache.
- *
- * @param url the URL of the file to cache
- * @param file the file to cache
- */
- public void storeInCache(URL url, File file) {
- if (file.isFile()) {
- try {
- final File tmp = new File(url.getPath());
- final String filename = tmp.getName();
- final File cache = new File(settings.getDataDirectory(), "nvdcache");
- if (!cache.isDirectory() && !cache.mkdir()) {
- return;
- }
- final File nvdFile = new File(cache, filename);
- FileUtils.copyFile(file, nvdFile);
- if (!nvdFile.setLastModified(Instant.now().toEpochMilli())) {
- LOGGER.debug("Unable to set last modified date on {}", nvdFile);
- }
- } catch (IOException ex) {
- LOGGER.debug("Error storing nvd file in cache", ex);
- }
- }
- }
-
- /**
- * Evict a file corresponding to a URL from the cache.
- *
- * Used to clear files from the cache that are found to be a corrupted download.
- *
- * @param url
- * the origin URL of the file that is to be evicted from the cache
- */
- public void evictFromCache(URL url) {
- try {
- final File tmp = new File(url.getPath());
- final String filename = tmp.getName();
- final File cache = new File(settings.getDataDirectory(), "nvdcache");
- if (!cache.isDirectory()) {
- return;
- }
- LOGGER.error("Removing file from cache for {} as a corrupted download is detected", url);
- final File nvdFile = new File(cache, filename);
- Files.delete(nvdFile.toPath());
- } catch (IOException ex) {
- LOGGER.warn("Error evicting corrupt nvd file from cache", ex);
- }
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java
deleted file mode 100644
index 57009240d7a..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-/**
- * A pojo that contains the Url and timestamp of the current NvdCve JSON files.
- *
- * @author Jeremy Long
- */
-@ThreadSafe
-public class NvdCveInfo {
-
- /**
- * The identifier for the CVE data file.
- */
- private final String id;
- /**
- * The URL to download the file.
- */
- private final String url;
- /**
- * The timestamp of the file - epoch time.
- */
- private final long timestamp;
-
- /**
- * Construct a new NVD CVE Info object.
- *
- * @param id the id
- * @param url the url
- * @param timestamp the timestamp
- */
- public NvdCveInfo(String id, String url, long timestamp) {
- this.id = id;
- this.url = url;
- this.timestamp = timestamp;
- }
-
- /**
- * Get the value of id.
- *
- * @return the value of id
- */
- public String getId() {
- return id;
- }
-
- /**
- * Get the value of URL.
- *
- * @return the value of URL
- */
- public String getUrl() {
- return url;
- }
-
- /**
- * Get the value of timestamp - epoch time.
- *
- * @return the value of timestamp - epoch time
- */
- public long getTimestamp() {
- return timestamp;
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveParser.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveParser.java
deleted file mode 100644
index a1451eaf919..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveParser.java
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2018 Steve Springett. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.core.JsonToken;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.Module;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.ObjectReader;
-import com.fasterxml.jackson.databind.json.JsonMapper;
-import com.fasterxml.jackson.module.blackbird.BlackbirdModule;
-import com.fasterxml.jackson.module.afterburner.AfterburnerModule;
-
-import java.io.EOFException;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import static java.nio.charset.StandardCharsets.UTF_8;
-import java.util.zip.GZIPInputStream;
-import java.util.zip.ZipException;
-
-import org.owasp.dependencycheck.data.nvdcve.CveDB;
-import org.owasp.dependencycheck.data.update.exception.CorruptedDatastreamException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.owasp.dependencycheck.data.nvd.json.DefCveItem;
-import org.owasp.dependencycheck.data.nvd.ecosystem.CveEcosystemMapper;
-import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.Utils;
-
-/**
- * Parser and processor of NVD CVE JSON data feeds.
- *
- * @author Jeremy Long
- */
-public final class NvdCveParser {
-
- /**
- * The logger.
- */
- private static final Logger LOGGER = LoggerFactory.getLogger(NvdCveParser.class);
- /**
- * A reference to the CVE DB.
- */
- private final CveDB cveDB;
- /**
- * A reference to the ODC settings.
- */
- private final Settings settings;
-
- /**
- * Creates a new NVD CVE JSON Parser.
- *
- * @param settings the dependency-check settings
- * @param db a reference to the database
- */
- public NvdCveParser(Settings settings, CveDB db) {
- this.settings = settings;
- this.cveDB = db;
- }
-
- /**
- * Parses the NVD JSON file and inserts/updates data into the database.
- *
- * @param file the NVD JSON file to parse
- * @throws UpdateException thrown if the file could not be read
- * @throws CorruptedDatastreamException thrown if the file was found to be a
- * corrupted download (ZipException or premature EOF)
- */
- public void parse(File file) throws UpdateException, CorruptedDatastreamException {
- LOGGER.debug("Parsing " + file.getName());
-
- final Module module;
- if (Utils.getJavaVersion() <= 8) {
- module = new AfterburnerModule();
- } else {
- module = new BlackbirdModule();
- }
- final ObjectMapper objectMapper = JsonMapper.builder()
- .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
- .addModule(module)
- .build();
-
- final ObjectReader objectReader = objectMapper.readerFor(DefCveItem.class);
-
- try (InputStream fin = new FileInputStream(file);
- InputStream in = new GZIPInputStream(fin);
- InputStreamReader isr = new InputStreamReader(in, UTF_8);
- JsonParser parser = objectReader.getFactory().createParser(isr)) {
-
- final CveEcosystemMapper mapper = new CveEcosystemMapper();
- init(parser);
- while (parser.nextToken() == JsonToken.START_OBJECT) {
- final DefCveItem cve = objectReader.readValue(parser);
- cveDB.updateVulnerability(cve, mapper.getEcosystem(cve));
- }
- } catch (FileNotFoundException ex) {
- LOGGER.error(ex.getMessage());
- throw new UpdateException("Unable to find the NVD CVE file, `" + file + "`, to parse", ex);
- } catch (ZipException | EOFException ex) {
- throw new CorruptedDatastreamException("Error parsing NVD CVE file", ex);
- } catch (IOException ex) {
- LOGGER.error("Error reading NVD JSON data: {}", file);
- LOGGER.debug("Error extracting the NVD JSON data from: " + file, ex);
- throw new UpdateException("Unable to find the NVD CVE file to parse", ex);
- }
- }
-
- void init(JsonParser parser) throws IOException {
- JsonToken nextToken = parser.nextToken();
- if (nextToken != JsonToken.START_OBJECT) {
- throw new IOException("Expected " + JsonToken.START_OBJECT + ", got " + nextToken);
- }
-
- do {
- nextToken = parser.nextToken();
- if (nextToken == null) {
- break;
- }
-
- if (nextToken.isStructStart()) {
- if (nextToken == JsonToken.START_ARRAY) {
- break;
- } else {
- parser.skipChildren();
- }
- }
- } while (true);
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
deleted file mode 100644
index a3f2e70f1d4..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import java.io.File;
-import java.io.IOException;
-import java.sql.SQLException;
-import java.util.concurrent.Callable;
-import javax.annotation.concurrent.ThreadSafe;
-import javax.xml.parsers.ParserConfigurationException;
-import org.owasp.dependencycheck.data.nvdcve.CveDB;
-import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
-import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
-import org.owasp.dependencycheck.data.update.exception.CorruptedDatastreamException;
-import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.utils.Settings;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * A callable task that will process a given set of NVD CVE xml files and update
- * the Cve Database accordingly.
- *
- * @author Jeremy Long
- */
-@ThreadSafe
-public class ProcessTask implements Callable {
-
- /**
- * The logger.
- */
- private static final Logger LOGGER = LoggerFactory.getLogger(ProcessTask.class);
- /**
- * A field to store any update exceptions that occur during the "call".
- */
- private UpdateException exception = null;
- /**
- * A reference to the CveDB.
- */
- private final CveDB cveDB;
- /**
- * A reference to the callable download task.
- */
- private final DownloadTask downloadTask;
- /**
- * A reference to the properties.
- */
- private final DatabaseProperties properties;
- /**
- * A reference to the global settings object.
- */
- private final Settings settings;
-
- /**
- * Get the value of exception.
- *
- * @return the value of exception
- */
- public UpdateException getException() {
- return exception;
- }
-
- /**
- * Set the value of exception.
- *
- * @param exception new value of exception
- */
- public void setException(UpdateException exception) {
- this.exception = exception;
- }
-
- /**
- * Constructs a new ProcessTask used to process an NVD CVE update.
- *
- * @param cveDB the data store object
- * @param downloadTask the download task that contains the URL references to
- * download
- * @param settings a reference to the global settings object; this is
- * necessary so that when the thread is started the dependencies have a
- * correct reference to the global settings.
- */
- public ProcessTask(final CveDB cveDB, final DownloadTask downloadTask, Settings settings) {
- this.cveDB = cveDB;
- this.downloadTask = downloadTask;
- this.properties = cveDB.getDatabaseProperties();
- this.settings = settings;
- }
-
- /**
- * Implements the callable interface.
- *
- * @return this object
- * @throws Exception thrown if there is an exception; note that any
- * UpdateExceptions are simply added to the tasks exception collection
- */
- @Override
- public ProcessTask call() throws Exception {
- try {
- processFiles();
- } catch (UpdateException ex) {
- this.exception = ex;
- } finally {
- settings.cleanup(false);
- }
- return this;
- }
-
- /**
- * Imports the NVD CVE JSON File into the database.
- *
- * @param file the file containing the NVD CVE JSON
- * @throws ParserConfigurationException is thrown if there is a parser
- * configuration exception
- * @throws IOException is thrown if there is a IO Exception
- * @throws SQLException is thrown if there is a SQL exception
- * @throws DatabaseException is thrown if there is a database exception
- * @throws ClassNotFoundException thrown if the h2 database driver cannot be
- * loaded
- * @throws UpdateException thrown if the file could not be found
- * @throws CorruptedDatastreamException thrown if the file was found to be a corrupted download
- */
- protected void importJSON(File file) throws ParserConfigurationException, IOException, SQLException, DatabaseException,
- ClassNotFoundException, UpdateException, CorruptedDatastreamException {
-
- final NvdCveParser parser = new NvdCveParser(settings, cveDB);
- parser.parse(file);
- }
-
- /**
- * Processes the NVD CVE XML file and imports the data into the DB.
- *
- * @throws UpdateException thrown if there is an error loading the data into
- * the database
- */
- private void processFiles() throws UpdateException {
- LOGGER.info("Processing Started for NVD CVE - {}", downloadTask.getNvdCveInfo().getId());
- final long startProcessing = System.currentTimeMillis();
- try {
- importJSON(downloadTask.getFile());
- properties.save(downloadTask.getNvdCveInfo());
- } catch (ParserConfigurationException | SQLException | DatabaseException | ClassNotFoundException | IOException ex) {
- throw new UpdateException(ex);
- } catch (CorruptedDatastreamException ex) {
- downloadTask.evictCorruptFileFromCache();
- throw new UpdateException(ex);
- } finally {
- downloadTask.cleanup();
- }
- LOGGER.info("Processing Complete for NVD CVE - {} ({} ms)", downloadTask.getNvdCveInfo().getId(),
- System.currentTimeMillis() - startProcessing);
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveApiJson20CveItemSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveApiJson20CveItemSource.java
new file mode 100644
index 00000000000..cfe7d5d5b60
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveApiJson20CveItemSource.java
@@ -0,0 +1,101 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update.nvd.api;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
+import org.apache.commons.io.IOUtils;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+public class CveApiJson20CveItemSource implements CveItemSource {
+
+ /**
+ * The object mapper.
+ */
+ private final ObjectMapper mapper;
+ /**
+ * The input stream.
+ */
+ private final InputStream inputStream;
+ /**
+ * The JSON Parser
+ */
+ private final JsonParser jsonParser;
+ /**
+ * The current item.
+ */
+ private DefCveItem currentItem;
+ /**
+ * The next item.
+ */
+ private DefCveItem nextItem;
+
+ /**
+ * Constructs a CVE Item Source record.
+ *
+ * @param inputStream the input source to read from
+ * @throws IOException thrown if there is an issue reading from the input
+ * stream
+ */
+ public CveApiJson20CveItemSource(InputStream inputStream) throws IOException {
+ mapper = new ObjectMapper();
+ mapper.registerModule(new JavaTimeModule());
+ this.inputStream = inputStream;
+ jsonParser = mapper.getFactory().createParser(inputStream);
+
+ JsonToken token = null;
+ do {
+ token = jsonParser.nextToken();
+ if (token == JsonToken.FIELD_NAME) {
+ final String fieldName = jsonParser.currentName();
+ if ("vulnerabilities".equals(fieldName) && (jsonParser.nextToken() == JsonToken.START_ARRAY)) {
+ nextItem = readItem(jsonParser);
+ }
+ }
+ } while (token != null && nextItem == null);
+ }
+
+ @Override
+ public void close() throws Exception {
+ IOUtils.closeQuietly(jsonParser, inputStream);
+ }
+
+ @Override
+ public boolean hasNext() {
+ return nextItem != null;
+ }
+
+ @Override
+ public DefCveItem next() throws IOException {
+ currentItem = nextItem;
+ nextItem = readItem(jsonParser);
+ return currentItem;
+ }
+
+ private DefCveItem readItem(JsonParser jsonParser) throws IOException {
+ if (jsonParser.nextToken() == JsonToken.START_OBJECT) {
+ return mapper.readValue(jsonParser, DefCveItem.class);
+ }
+ return null;
+ }
+}
diff --git a/core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveItemSource.java
similarity index 50%
rename from core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java
rename to core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveItemSource.java
index 90b41674369..674178b2819 100644
--- a/core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveItemSource.java
@@ -15,29 +15,27 @@
*
* Copyright (c) 2013 Jeremy Long. All Rights Reserved.
*/
-package org.owasp.dependencycheck.data.update;
+package org.owasp.dependencycheck.data.update.nvd.api;
-import java.util.List;
-import org.junit.Test;
-import org.owasp.dependencycheck.BaseDBTestCase;
-import static org.junit.Assert.assertNotNull;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
-/**
- *
- * @author Jeremy Long
- */
-public class NvdCveUpdaterIT extends BaseDBTestCase {
+import java.io.IOException;
+
+public interface CveItemSource extends AutoCloseable {
+
+ /**
+ * Returns whether there is another item.
+ *
+ * @return true if there is another item; otherwise
+ * false.
+ */
+ boolean hasNext();
/**
- * Test of updatesNeeded method.
+ * Returns the next item.
+ *
+ * @return the next item
+ * @throws IOException thrown if there is an error reading from the source
*/
- @Test
- public void testUpdatesNeeded() throws Exception {
- NvdCveUpdater instance = new NvdCveUpdater();
- instance.setSettings(getSettings());
- instance.initializeExecutorServices();
- List result = instance.getUpdatesNeeded();
- assertNotNull(result);
- }
+ T next() throws IOException;
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/DownloadTask.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/DownloadTask.java
new file mode 100644
index 00000000000..25f791b1304
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/DownloadTask.java
@@ -0,0 +1,114 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update.nvd.api;
+
+import java.io.File;
+import java.net.URL;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Future;
+import javax.annotation.concurrent.ThreadSafe;
+import org.apache.commons.lang3.StringUtils;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.utils.Downloader;
+import org.owasp.dependencycheck.utils.Settings;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A callable object to download the NVD API cache files and start the
+ * NvdApiProcessor.
+ *
+ * @author Jeremy Long
+ */
+@ThreadSafe
+public class DownloadTask implements Callable> {
+
+ /**
+ * The Logger.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(DownloadTask.class);
+ /**
+ * The CVE DB to use when processing the files.
+ */
+ private final CveDB cveDB;
+ /**
+ * The processor service to pass the results of the download to.
+ */
+ private final ExecutorService processorService;
+ /**
+ * The NVD API Cache file URL.
+ */
+ private final String url;
+ /**
+ * A reference to the global settings object.
+ */
+ private final Settings settings;
+
+ /**
+ * Simple constructor for the callable download task.
+ *
+ * @param url the file to download
+ * @param processor the processor service to submit the downloaded files to
+ * @param cveDB the CVE DB to use to store the vulnerability data
+ * @param settings a reference to the global settings object; this is
+ * necessary so that when the thread is started the dependencies have a
+ * correct reference to the global settings.
+ */
+ public DownloadTask(String url, ExecutorService processor, CveDB cveDB, Settings settings) {
+ this.url = url;
+ this.processorService = processor;
+ this.cveDB = cveDB;
+ this.settings = settings;
+ }
+
+ @SuppressWarnings("BusyWait")
+ @Override
+ public Future call() throws Exception {
+ try {
+ final URL u = new URL(url);
+ LOGGER.info("Download Started for NVD Cache - {}", url);
+ final long startDownload = System.currentTimeMillis();
+ final File outputFile = settings.getTempFile("nvd-datafeed-", "json.gz");
+ Downloader.getInstance().fetchFile(u, outputFile, true, Settings.KEYS.NVD_API_DATAFEED_USER, Settings.KEYS.NVD_API_DATAFEED_PASSWORD,
+ Settings.KEYS.NVD_API_DATAFEED_BEARER_TOKEN);
+ if (this.processorService == null) {
+ return null;
+ }
+ final NvdApiProcessor task = new NvdApiProcessor(cveDB, outputFile, startDownload);
+ final Future val = this.processorService.submit(task);
+ return val;
+ } catch (Throwable ex) {
+ LOGGER.error("Error downloading NVD CVE - {} Reason: {}", url, ex.getMessage());
+ throw ex;
+ } finally {
+ settings.cleanup(false);
+ }
+ }
+
+ /**
+ * Returns true if the process task is for the modified json file from the
+ * NVD API Cache.
+ *
+ * @return true if the process task is for the modified data;
+ * otherwise false
+ */
+ public boolean isModified() {
+ return StringUtils.containsIgnoreCase(url, "modified");
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/JsonArrayCveItemSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/JsonArrayCveItemSource.java
new file mode 100644
index 00000000000..caf2c99fca6
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/JsonArrayCveItemSource.java
@@ -0,0 +1,106 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update.nvd.api;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+public class JsonArrayCveItemSource implements CveItemSource {
+
+ /**
+ * The object mapper.
+ */
+ private final ObjectMapper mapper;
+ /**
+ * The input stream.
+ */
+ private final InputStream inputStream;
+ /**
+ * The JSON parser.
+ */
+ private final JsonParser jsonParser;
+ /**
+ * The current item.
+ */
+ private DefCveItem currentItem;
+ /**
+ * The next item.
+ */
+ private DefCveItem nextItem;
+
+ /**
+ * Constructs a new Item Source.
+ *
+ * @param inputStream the input stream to read from
+ * @throws IOException thrown if there is a problem reading from the input
+ * stream
+ */
+ public JsonArrayCveItemSource(InputStream inputStream) throws IOException {
+ mapper = new ObjectMapper();
+ mapper.registerModule(new JavaTimeModule());
+ this.inputStream = inputStream;
+ jsonParser = mapper.getFactory().createParser(inputStream);
+
+ if (jsonParser.nextToken() == JsonToken.START_ARRAY) {
+ nextItem = readItem(jsonParser);
+ }
+ }
+
+ @Override
+ public void close() throws Exception {
+ if (jsonParser != null) {
+ try {
+ jsonParser.close();
+ } catch (IOException ex) {
+ //ignore
+ }
+ }
+ if (inputStream != null) {
+ try {
+ inputStream.close();
+ } catch (IOException ex) {
+ //ignore
+ }
+ }
+ }
+
+ @Override
+ public boolean hasNext() {
+ return nextItem != null;
+ }
+
+ @Override
+ public DefCveItem next() throws IOException {
+ currentItem = nextItem;
+ nextItem = readItem(jsonParser);
+ return currentItem;
+ }
+
+ private DefCveItem readItem(JsonParser jsonParser) throws IOException {
+ if (jsonParser.nextToken() == JsonToken.START_OBJECT) {
+ return mapper.readValue(jsonParser, DefCveItem.class);
+ }
+ return null;
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java
new file mode 100644
index 00000000000..6dde51bbd87
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java
@@ -0,0 +1,134 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2023 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update.nvd.api;
+
+import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
+
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.util.concurrent.Callable;
+import java.util.zip.GZIPInputStream;
+
+import org.owasp.dependencycheck.data.nvd.ecosystem.CveEcosystemMapper;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Stores a collection of NVD CVE Data from the NVD API into the database.
+ *
+ * @author Jeremy Long
+ */
+public class NvdApiProcessor implements Callable {
+
+ /**
+ * The Logger for use throughout the class.
+ */
+ private static final Logger LOGGER = LoggerFactory.getLogger(NvdApiProcessor.class);
+ /**
+ * A reference to the database.
+ */
+ private final CveDB cveDB;
+ /**
+ * The file containing the data to inject.
+ */
+ private File jsonFile;
+ /**
+ * Reference to the CVE Ecosystem Mapper object.
+ */
+ private final CveEcosystemMapper mapper = new CveEcosystemMapper();
+ /**
+ * The start time.
+ */
+ private final long startTime;
+ /**
+ * The end time.
+ */
+ private long endTime = 0;
+
+ /**
+ * Create a new processor to put the NVD data into the database.
+ *
+ * @param cveDB a reference to the database.
+ * @param jsonFile the JSON data file to inject.
+ * @param startTime the start time of the update process.
+ */
+ public NvdApiProcessor(final CveDB cveDB, File jsonFile, long startTime) {
+ this.cveDB = cveDB;
+ this.jsonFile = jsonFile;
+ this.startTime = startTime;
+ }
+
+ /**
+ * Create a new processor to put the NVD data into the database.
+ *
+ * @param cveDB a reference to the database
+ * @param jsonFile the JSON data file to inject.
+ */
+ public NvdApiProcessor(final CveDB cveDB, File jsonFile) {
+ this(cveDB, jsonFile, System.currentTimeMillis());
+ }
+
+ @Override
+ public NvdApiProcessor call() throws Exception {
+ if (jsonFile.getName().endsWith(".jsonarray.gz")) {
+ try (InputStream fis = Files.newInputStream(jsonFile.toPath());
+ InputStream is = new BufferedInputStream(new GZIPInputStream(fis));
+ CveItemSource itemSource = new JsonArrayCveItemSource(is)) {
+ updateCveDb(itemSource);
+ }
+ } else if (jsonFile.getName().endsWith(".gz")) {
+ try (InputStream fis = Files.newInputStream(jsonFile.toPath());
+ InputStream is = new BufferedInputStream(new GZIPInputStream(fis));
+ CveItemSource itemSource = new CveApiJson20CveItemSource(is)) {
+ updateCveDb(itemSource);
+ }
+ } else {
+ try (InputStream fis = Files.newInputStream(jsonFile.toPath());
+ InputStream is = new BufferedInputStream(fis);
+ CveItemSource itemSource = new JsonArrayCveItemSource(is)) {
+ updateCveDb(itemSource);
+ }
+ }
+ endTime = System.currentTimeMillis();
+ return this;
+ }
+
+ private void updateCveDb(CveItemSource itemSource) throws IOException {
+ while (itemSource.hasNext()) {
+ final DefCveItem entry = itemSource.next();
+ try {
+ cveDB.updateVulnerability(entry, mapper.getEcosystem(entry));
+ } catch (Exception ex) {
+ LOGGER.error("Failed to process " + entry.getCve().getId(), ex);
+ }
+ }
+ }
+
+ /**
+ * Calculates how long the update process took.
+ *
+ * @return the number of milliseconds that the update process took
+ */
+ public long getDurationMillis() {
+ return endTime - startTime;
+ }
+}
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/package-info.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/package-info.java
new file mode 100644
index 00000000000..b2d1baeaac8
--- /dev/null
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Contains classes used to download, parse, and load the NVD API CVE data from NIST into the local database.
+ */
+package org.owasp.dependencycheck.data.update.nvd.api;
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/package-info.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/package-info.java
deleted file mode 100644
index 6b29278aca0..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/package-info.java
+++ /dev/null
@@ -1,4 +0,0 @@
-/**
- * Contains classes used to download, parse, and load the NVD CVE data from NIST into the local database.
- */
-package org.owasp.dependencycheck.data.update.nvd;
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/CvssV2.java b/core/src/main/java/org/owasp/dependencycheck/dependency/CvssV2.java
deleted file mode 100644
index e82bcaf864a..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/CvssV2.java
+++ /dev/null
@@ -1,318 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2018 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.dependency;
-
-import java.io.Serializable;
-
-/**
- * CVSS V2 scoring information.
- *
- * @author Jeremy Long
- */
-public class CvssV2 implements Serializable {
-
- /**
- * Serial version UID.
- */
- private static final long serialVersionUID = -2203955879356702367L;
-
- /**
- * CVSS Score.
- */
- private final float score;
- /**
- * CVSS Access Vector.
- */
- private final String accessVector;
- /**
- * CVSS Access Complexity.
- */
- private final String accessComplexity;
- /**
- * CVSS Authentication.
- */
- private final String authentication;
- /**
- * CVSS Confidentiality Impact.
- */
- private final String confidentialityImpact;
- /**
- * CVSS Integrity Impact.
- */
- private final String integrityImpact;
- /**
- * CVSS Availability Impact.
- */
- private final String availabilityImpact;
- /**
- * CVSS version.
- */
- private final String version;
-
- /**
- * CVSSv2 Base Metric severity.
- */
- private final String severity;
- /**
- * CVSSv2 Base Metric exploitability score.
- */
- private final Float exploitabilityScore;
- /**
- * CVSSv2 Base Metric impact score.
- */
- private final Float impactScore;
- /**
- * CVSSv2 Base Metric acInsufInfo.
- */
- private final Boolean acInsufInfo;
- /**
- * CVSSv2 Base Metric obtain all privilege.
- */
- private final Boolean obtainAllPrivilege;
- /**
- * CVSSv2 Base Metric obtain user privilege.
- */
- private final Boolean obtainUserPrivilege;
- /**
- * CVSSv2 Base Metric obtain other privilege.
- */
- private final Boolean obtainOtherPrivilege;
- /**
- * CVSSv2 Base Metric user interaction required.
- */
- private final Boolean userInteractionRequired;
-
- /**
- * Constructs a new CVSS V2 object.
- *
- * @param score the score
- * @param accessVector the access vector
- * @param accessComplexity the access complexity
- * @param authentication the authentication
- * @param confidentialityImpact the confidentiality impact
- * @param integrityImpact the integrity impact
- * @param availabilityImpact the availability impact
- * @param severity the severity
- */
- //CSOFF: ParameterNumber
- public CvssV2(float score, String accessVector, String accessComplexity, String authentication,
- String confidentialityImpact, String integrityImpact, String availabilityImpact, String severity) {
- this(score, accessVector, accessComplexity, authentication, confidentialityImpact,
- integrityImpact, availabilityImpact, severity, null, null, null, null, null, null, null, null);
- }
-
- /**
- * Constructs a new CVSS V2 object.
- *
- * @param score the score
- * @param accessVector the access vector
- * @param accessComplexity the access complexity
- * @param authentication the authentication
- * @param confidentialityImpact the confidentiality impact
- * @param integrityImpact the integrity impact
- * @param availabilityImpact the availability impact
- * @param severity the severity
- * @param exploitabilityScore the exploitability score
- * @param impactScore the impact score
- * @param acInsufInfo the acInsufInfo
- * @param obtainAllPrivilege whether or not the vulnerability allows one to obtain all privileges
- * @param obtainUserPrivilege whether or not the vulnerability allows one to obtain user privileges
- * @param obtainOtherPrivilege whether or not the vulnerability allows one to obtain other privileges
- * @param userInteractionRequired whether or not user interaction is required
- * @param version the CVSS version
- */
- //CSOFF: ParameterNumber
- public CvssV2(float score, String accessVector, String accessComplexity, String authentication,
- String confidentialityImpact, String integrityImpact, String availabilityImpact, String severity,
- Float exploitabilityScore, Float impactScore, Boolean acInsufInfo, Boolean obtainAllPrivilege,
- Boolean obtainUserPrivilege, Boolean obtainOtherPrivilege, Boolean userInteractionRequired, String version) {
- this.score = score;
- this.accessVector = accessVector;
- this.accessComplexity = accessComplexity;
- this.authentication = authentication;
- this.confidentialityImpact = confidentialityImpact;
- this.integrityImpact = integrityImpact;
- this.availabilityImpact = availabilityImpact;
-
- this.severity = severity;
- this.exploitabilityScore = exploitabilityScore;
- this.impactScore = impactScore;
- this.acInsufInfo = acInsufInfo;
- this.obtainAllPrivilege = obtainAllPrivilege;
- this.obtainUserPrivilege = obtainUserPrivilege;
- this.obtainOtherPrivilege = obtainOtherPrivilege;
- this.userInteractionRequired = userInteractionRequired;
- this.version = version;
- }
- //CSON: ParameterNumber
-
- /**
- * Get the value of score.
- *
- * @return the value of score
- */
- public float getScore() {
- return score;
- }
-
- /**
- * Get the value of accessVector.
- *
- * @return the value of accessVector
- */
- public String getAccessVector() {
- return accessVector;
- }
-
- /**
- * Get the value of accessComplexity.
- *
- * @return the value of accessComplexity
- */
- public String getAccessComplexity() {
- return accessComplexity;
- }
-
- /**
- * Get the value of authentication.
- *
- * @return the value of authentication
- */
- public String getAuthentication() {
- return authentication;
- }
-
- /**
- * Get the value of confidentialityImpact.
- *
- * @return the value of confidentialityImpact
- */
- public String getConfidentialityImpact() {
- return confidentialityImpact;
- }
-
- /**
- * Get the value of integrityImpact.
- *
- * @return the value of integrityImpact
- */
- public String getIntegrityImpact() {
- return integrityImpact;
- }
-
- /**
- * Get the value of availabilityImpact.
- *
- * @return the value of availabilityImpact
- */
- public String getAvailabilityImpact() {
- return availabilityImpact;
- }
-
- /**
- * Get the value of version.
- *
- * @return the value of version
- */
- public String getVersion() {
- return version;
- }
-
- /**
- * Returns the severity for the vulnerability.
- *
- * @return the severity
- */
- public String getSeverity() {
- return severity;
- }
-
- /**
- * Returns the exploitabilityScore for the vulnerability.
- *
- * @return the exploitabilityScore
- */
- public Float getExploitabilityScore() {
- return exploitabilityScore;
- }
-
- /**
- * Returns the impactScore for the vulnerability.
- *
- * @return the impactScore
- */
- public Float getImpactScore() {
- return impactScore;
- }
-
- /**
- * Returns the acInsufInfo for the vulnerability.
- *
- * @return the acInsufInfo
- */
- public Boolean isAcInsufInfo() {
- return acInsufInfo;
- }
-
- /**
- * Returns the obtainAllPrivilege for the vulnerability.
- *
- * @return the obtainAllPrivilege
- */
- public Boolean isObtainAllPrivilege() {
- return obtainAllPrivilege;
- }
-
- /**
- * Returns the obtainUserPrivilege for the vulnerability.
- *
- * @return the obtainUserPrivilege
- */
- public Boolean isObtainUserPrivilege() {
- return obtainUserPrivilege;
- }
-
- /**
- * Returns the obtainOtherPrivilege for the vulnerability.
- *
- * @return the obtainOtherPrivilege
- */
- public Boolean isObtainOtherPrivilege() {
- return obtainOtherPrivilege;
- }
-
- /**
- * Returns the userInteractionRequired for the vulnerability.
- *
- * @return the userInteractionRequired
- */
- public Boolean isUserInteractionRequired() {
- return userInteractionRequired;
- }
-
- @Override
- public String toString() {
- return String.format("/AV:%s/AC:%s/Au:%s/C:%s/I:%s/A:%s",
- accessVector == null ? "" : accessVector.substring(0, 1),
- accessComplexity == null ? "" : accessComplexity.substring(0, 1),
- authentication == null ? "" : authentication.substring(0, 1),
- confidentialityImpact == null ? "" : confidentialityImpact.substring(0, 1),
- integrityImpact == null ? "" : integrityImpact.substring(0, 1),
- availabilityImpact == null ? "" : availabilityImpact.substring(0, 1));
- }
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/CvssV3.java b/core/src/main/java/org/owasp/dependencycheck/dependency/CvssV3.java
deleted file mode 100644
index bf6c0814c2e..00000000000
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/CvssV3.java
+++ /dev/null
@@ -1,330 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2018 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.dependency;
-
-import org.sonatype.ossindex.service.api.cvss.Cvss3Severity;
-
-import java.io.Serializable;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-
-/**
- * CVSS V3 scoring information.
- *
- * @author Jeremy Long
- */
-public class CvssV3 implements Serializable {
-
- /**
- * Serial version UID.
- */
- private static final long serialVersionUID = -315810090425928920L;
-
- /**
- * The CVSS v3 Base Metrics (that are required by the spec for any CVSS v3 Vector String)
- */
- private static final List BASE_METRICS = Arrays.asList("AV", "AC", "PR", "UI", "S", "C", "I", "A");
-
- /**
- * CVSS Availability Impact.
- */
- private final String attackVector;
- /**
- * CVSS Availability Impact.
- */
- private final String attackComplexity;
- /**
- * CVSS Availability Impact.
- */
- private final String privilegesRequired;
- /**
- * CVSS Availability Impact.
- */
- private final String userInteraction;
- /**
- * CVSS Availability Impact.
- */
- private final String scope;
- /**
- * CVSS Availability Impact.
- */
- private final String confidentialityImpact;
- /**
- * CVSS Availability Impact.
- */
- private final String integrityImpact;
- /**
- * CVSS Availability Impact.
- */
- private final String availabilityImpact;
- /**
- * CVSS Base Score.
- */
- private final float baseScore;
- /**
- * CVSS Base Severity.
- */
- private final String baseSeverity;
- /**
- * CVSSv3 Base Metric exploitability score.
- */
- private final Float exploitabilityScore;
- /**
- * CVSSv3 Base Metric impact score.
- */
- private final Float impactScore;
- /**
- * CVSS version.
- */
- private final String version;
-
- /**
- * Constructs a new CVSS V3 object.
- *
- * @param attackVector the attack vector value
- * @param attackComplexity the attack complexity value
- * @param privilegesRequired the privileges required value
- * @param userInteraction the user interaction value
- * @param scope the scope value
- * @param confidentialityImpact the confidentiality impact value
- * @param integrityImpact the integrity impact value
- * @param availabilityImpact the availability impact value
- * @param baseScore the base score
- * @param baseSeverity the base severity
- */
- //CSOFF: ParameterNumber
- public CvssV3(String attackVector, String attackComplexity, String privilegesRequired,
- String userInteraction, String scope, String confidentialityImpact, String integrityImpact,
- String availabilityImpact, float baseScore, String baseSeverity) {
- this(attackVector, attackComplexity, privilegesRequired, userInteraction, scope, confidentialityImpact,
- integrityImpact, availabilityImpact, baseScore, baseSeverity, null, null, null);
- }
-
- /**
- * Constructs a new CVSS V3 object.
- *
- * @param attackVector the attack vector value
- * @param attackComplexity the attack complexity value
- * @param privilegesRequired the privileges required value
- * @param userInteraction the user interaction value
- * @param scope the scope value
- * @param confidentialityImpact the confidentiality impact value
- * @param integrityImpact the integrity impact value
- * @param availabilityImpact the availability impact value
- * @param baseScore the base score
- * @param baseSeverity the base severity
- * @param exploitabilityScore the exploitability score
- * @param impactScore the impact score
- * @param version the CVSS version
- */
- public CvssV3(String attackVector, String attackComplexity, String privilegesRequired,
- String userInteraction, String scope, String confidentialityImpact, String integrityImpact,
- String availabilityImpact, float baseScore, String baseSeverity, Float exploitabilityScore, Float impactScore, String version) {
- this.attackVector = attackVector;
- this.attackComplexity = attackComplexity;
- this.privilegesRequired = privilegesRequired;
- this.userInteraction = userInteraction;
- this.scope = scope;
- this.confidentialityImpact = confidentialityImpact;
- this.integrityImpact = integrityImpact;
- this.availabilityImpact = availabilityImpact;
- this.baseScore = baseScore;
- this.baseSeverity = baseSeverity;
- this.exploitabilityScore = exploitabilityScore;
- this.impactScore = impactScore;
- this.version = version;
- }
- //CSON: ParameterNumber
-
- /**
- * Constructs a new CVSS V3 object from a CVSS v3.x Vector String representation and
- * a CVSS V3 Base score.
- *
- * @param vectorString a CVSS v3 Vector String
- * @param baseScore the CVSS v3 base score
- * @throws IllegalArgumentException when the provided vectorString is not a valid
- * CVSS v3.x vector string.
- */
- public CvssV3(String vectorString, float baseScore) {
- if (!vectorString.startsWith("CVSS:3")) {
- throw new IllegalArgumentException("Not a valid CVSSv3 vector string: " + vectorString);
- }
- this.version = vectorString.substring(5, vectorString.indexOf('/'));
- final String[] metricStrings = vectorString.substring(vectorString.indexOf('/') + 1).split("/");
- final HashMap metrics = new HashMap<>();
- for (int i = 0; i < metricStrings.length; i++) {
- final String[] metricKeyVal = metricStrings[i].split(":");
- if (metricKeyVal.length != 2) {
- throw new IllegalArgumentException(
- String.format("Not a valid CVSSv3 vector string '%s', invalid metric component '%s'",
- vectorString, metricStrings[i]));
- }
- metrics.put(metricKeyVal[0], metricKeyVal[1]);
- }
- if (!metrics.keySet().containsAll(BASE_METRICS)) {
- throw new IllegalArgumentException(
- String.format("Not a valid CVSSv3 vector string '%s'; missing one or more required Base Metrics;",
- vectorString));
- }
- this.attackVector = metrics.get("AV");
- this.attackComplexity = metrics.get("AC");
- this.privilegesRequired = metrics.get("PR");
- this.userInteraction = metrics.get("UI");
- this.scope = metrics.get("S");
- this.confidentialityImpact = metrics.get("C");
- this.integrityImpact = metrics.get("I");
- this.availabilityImpact = metrics.get("A");
- this.baseScore = baseScore;
- this.baseSeverity = Cvss3Severity.of(baseScore).name();
- this.exploitabilityScore = null;
- this.impactScore = null;
- }
-
- /**
- * Get the value of attackVector.
- *
- * @return the value of attackVector
- */
- public String getAttackVector() {
- return attackVector;
- }
-
- /**
- * Get the value of attackComplexity.
- *
- * @return the value of attackComplexity
- */
- public String getAttackComplexity() {
- return attackComplexity;
- }
-
- /**
- * Get the value of privilegesRequired.
- *
- * @return the value of privilegesRequired
- */
- public String getPrivilegesRequired() {
- return privilegesRequired;
- }
-
- /**
- * Get the value of userInteraction.
- *
- * @return the value of userInteraction
- */
- public String getUserInteraction() {
- return userInteraction;
- }
-
- /**
- * Get the value of scope.
- *
- * @return the value of scope
- */
- public String getScope() {
- return scope;
- }
-
- /**
- * Get the value of confidentialityImpact.
- *
- * @return the value of confidentialityImpact
- */
- public String getConfidentialityImpact() {
- return confidentialityImpact;
- }
-
- /**
- * Get the value of integrityImpact.
- *
- * @return the value of integrityImpact
- */
- public String getIntegrityImpact() {
- return integrityImpact;
- }
-
- /**
- * Get the value of availabilityImpact.
- *
- * @return the value of availabilityImpact
- */
- public String getAvailabilityImpact() {
- return availabilityImpact;
- }
-
- /**
- * Get the value of baseScore.
- *
- * @return the value of baseScore
- */
- public float getBaseScore() {
- return baseScore;
- }
-
- /**
- * Get the value of baseSeverity.
- *
- * @return the value of baseSeverity
- */
- public String getBaseSeverity() {
- return baseSeverity;
- }
-
- /**
- * Get the value of version.
- *
- * @return the value of version
- */
- public String getVersion() {
- return version;
- }
-
- /**
- * Returns the exploitabilityScore for the vulnerability.
- *
- * @return the exploitabilityScore
- */
- public Float getexploitabilityScore() {
- return exploitabilityScore;
- }
-
- /**
- * Returns the impactScore for the vulnerability.
- *
- * @return the impactScore
- */
- public Float getimpactScore() {
- return impactScore;
- }
-
- @Override
- public String toString() {
- return String.format("CVSS:%s/AV:%s/AC:%s/PR:%s/UI:%s/S:%s/C:%s/I:%s/A:%s",
- version == null ? "" : version,
- attackVector == null ? "" : attackVector.substring(0, 1),
- attackComplexity == null ? "" : attackComplexity.substring(0, 1),
- privilegesRequired == null ? "" : privilegesRequired.substring(0, 1),
- userInteraction == null ? "" : userInteraction.substring(0, 1),
- scope == null ? "" : scope.substring(0, 1),
- confidentialityImpact == null ? "" : confidentialityImpact.substring(0, 1),
- integrityImpact == null ? "" : integrityImpact.substring(0, 1),
- availabilityImpact == null ? "" : availabilityImpact.substring(0, 1));
- }
-
-}
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
index 92a1402ebd2..ad33bd8a585 100644
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
+++ b/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
@@ -625,7 +625,7 @@ public synchronized Set getVulnerabilities(boolean sorted) {
if (sorted) {
vulnerabilitySet = new TreeSet<>(vulnerabilities);
} else {
- vulnerabilitySet = vulnerabilities;
+ vulnerabilitySet = new HashSet<>(vulnerabilities);
}
return Collections.unmodifiableSet(vulnerabilitySet);
}
@@ -867,7 +867,7 @@ public synchronized void addAllProjectReferences(Set projectReferences)
public synchronized void addRelatedDependency(Dependency dependency) {
if (this == dependency) {
LOGGER.warn("Attempted to add a circular reference - please post the log file to issue #172 here "
- + "https://github.com/jeremylong/DependencyCheck/issues/172");
+ + "https://github.com/dependency-check/DependencyCheck/issues/172");
LOGGER.debug("this: {}", this);
LOGGER.debug("dependency: {}", dependency);
} else if (NAME_COMPARATOR.compare(this, dependency) == 0) {
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java b/core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java
index 82eb1ae1fbc..a726d613850 100644
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java
+++ b/core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java
@@ -59,6 +59,11 @@ public class Evidence implements Serializable, Comparable {
*/
private Confidence confidence;
+ /**
+ * Whether the evidence originates from a hint.
+ */
+ private boolean fromHint;
+
/**
* Creates a new Evidence object.
*/
@@ -74,10 +79,24 @@ public Evidence() {
* @param confidence the confidence of the evidence.
*/
public Evidence(String source, String name, String value, Confidence confidence) {
+ this(source, name, value, confidence, false);
+ }
+
+ /**
+ * Creates a new Evidence objects.
+ *
+ * @param source the source of the evidence.
+ * @param name the name of the evidence.
+ * @param value the value of the evidence.
+ * @param confidence the confidence of the evidence.
+ * @param fromHint whether the evidence was introduced by a hint.
+ */
+ public Evidence(String source, String name, String value, Confidence confidence, boolean fromHint) {
this.source = source;
this.name = name;
this.value = value;
this.confidence = confidence;
+ this.fromHint = fromHint;
}
/**
@@ -152,6 +171,24 @@ public void setConfidence(Confidence confidence) {
this.confidence = confidence;
}
+ /**
+ * Get the value of fromHint.
+ *
+ * @return the value of fromHint
+ */
+ public boolean isFromHint() {
+ return fromHint;
+ }
+
+ /**
+ * Set the value of fromHint.
+ *
+ * @param fromHint new value of fromHint
+ */
+ public void setFromHint(boolean fromHint) {
+ this.fromHint = fromHint;
+ }
+
/**
* Implements the hashCode for Evidence.
*
@@ -187,6 +224,7 @@ public boolean equals(Object obj) {
.append(this.name == null ? null : this.name.toLowerCase(), o.name == null ? null : o.name.toLowerCase())
.append(this.value == null ? null : this.value.toLowerCase(), o.value == null ? null : o.value.toLowerCase())
.append(this.confidence, o.getConfidence())
+ .append(this.fromHint, o.isFromHint())
.build();
}
@@ -196,7 +234,6 @@ public boolean equals(Object obj) {
* @param o the evidence being compared
* @return an integer indicating the ordering of the two objects
*/
- @SuppressWarnings("deprecation")
@Override
public int compareTo(@NotNull Evidence o) {
return new CompareToBuilder()
@@ -204,6 +241,7 @@ public int compareTo(@NotNull Evidence o) {
.append(this.name == null ? null : this.name.toLowerCase(), o.name == null ? null : o.name.toLowerCase())
.append(this.value == null ? null : this.value.toLowerCase(), o.value == null ? null : o.value.toLowerCase())
.append(this.confidence, o.getConfidence())
+ .append(this.fromHint, o.isFromHint())
.toComparison();
}
@@ -214,6 +252,7 @@ public int compareTo(@NotNull Evidence o) {
*/
@Override
public String toString() {
- return "Evidence{" + "name=" + name + ", source=" + source + ", value=" + value + ", confidence=" + confidence + '}';
+ return "Evidence{" + "name=" + name + ", source=" + source + ", value=" + value + ", confidence=" + confidence
+ + ", fromHint=" + fromHint + '}';
}
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java b/core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
index c9e1c8a71fc..395dd3d38bd 100644
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
+++ b/core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
@@ -17,12 +17,15 @@
*/
package org.owasp.dependencycheck.dependency;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV4;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.HashSet;
import java.util.List;
import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
import javax.annotation.concurrent.NotThreadSafe;
import org.apache.commons.lang3.builder.CompareToBuilder;
@@ -89,11 +92,20 @@ public enum Source {
/**
* References for this vulnerability.
*/
- private final Set references = Collections.synchronizedSet(new HashSet<>());
+ private final Set references = ConcurrentHashMap.newKeySet();
/**
* A set of vulnerable software.
*/
- private final Set vulnerableSoftware = new HashSet<>();
+ private final Set vulnerableSoftware = ConcurrentHashMap.newKeySet();
+ /**
+ * Immutable views for getters.
+ */
+ private final Set referencesView = Collections.unmodifiableSet(references);
+ /**
+ * Immutable views for getters.
+ */
+ private final Set vulnerableSoftwareView = Collections.unmodifiableSet(vulnerableSoftware);
+
/**
* The CWE(s) for the vulnerability.
*/
@@ -115,6 +127,11 @@ public enum Source {
*/
private CvssV3 cvssV3;
+ /**
+ * The CVSS V4 scoring information.
+ */
+ private CvssV4 cvssV4;
+
/**
* The Vulnerable Software that caused this vulnerability to be flagged.
*/
@@ -188,7 +205,7 @@ public void setDescription(String description) {
* @return the value of references
*/
public Set getReferences() {
- return references;
+ return referencesView;
}
/**
@@ -247,6 +264,7 @@ public void addReference(String referenceSource, String referenceName, String re
public void setKnownExploitedVulnerability(org.owasp.dependencycheck.data.knownexploited.json.Vulnerability kev) {
this.knownExploitedVulnerability = kev;
}
+
/**
* Get the value of knownExploitedVulnerability.
*
@@ -255,13 +273,14 @@ public void setKnownExploitedVulnerability(org.owasp.dependencycheck.data.knowne
public org.owasp.dependencycheck.data.knownexploited.json.Vulnerability getKnownExploitedVulnerability() {
return knownExploitedVulnerability;
}
+
/**
* Get the value of vulnerableSoftware.
*
* @return the value of vulnerableSoftware
*/
public Set getVulnerableSoftware() {
- return vulnerableSoftware;
+ return vulnerableSoftwareView;
}
/**
@@ -273,13 +292,20 @@ public Set getVulnerableSoftware() {
*/
@SuppressWarnings("unchecked")
public List getVulnerableSoftware(boolean sorted) {
- synchronized (vulnerableSoftware) {
- final List sortedVulnerableSoftware = new ArrayList<>(this.vulnerableSoftware);
- if (sorted) {
- Collections.sort(sortedVulnerableSoftware);
- }
- return sortedVulnerableSoftware;
+ final List sortedVulnerableSoftware = new ArrayList<>(this.vulnerableSoftware);
+ if (sorted) {
+ Collections.sort(sortedVulnerableSoftware);
}
+ return sortedVulnerableSoftware;
+ }
+
+ /**
+ * Removes the specified vulnerableSoftware from the collection.
+ *
+ * @param vulnerableSoftware a collection of vulnerable software to be removed
+ */
+ public void removeVulnerableSoftware(Set vulnerableSoftware) {
+ this.vulnerableSoftware.removeAll(vulnerableSoftware);
}
/**
@@ -336,6 +362,24 @@ public void setCvssV3(CvssV3 cvssV3) {
this.cvssV3 = cvssV3;
}
+ /**
+ * Get the CVSS V3 scoring information.
+ *
+ * @return the CVSS V3 scoring information
+ */
+ public CvssV4 getCvssV4() {
+ return cvssV4;
+ }
+
+ /**
+ * Sets the CVSS V4 scoring information.
+ *
+ * @param cvssV4 the CVSS V4 scoring information
+ */
+ public void setCvssV4(CvssV4 cvssV4) {
+ this.cvssV4 = cvssV4;
+ }
+
/**
* Get the set of CWEs.
*
@@ -451,8 +495,7 @@ public String toString() {
* on both sides. If any of the vulnerabilities does not have a CVSSv3 score
* the sort order may be off, but it will be consistent.
*
- * The ranking (high to low) of severity can be informally represented as
- * {@code <CVSSv3 critical> >> <Unscored recognized critical> >>
+ * The ranking (high to low) of severity can be informally represented as {@code <CVSSv3 critical> >> <Unscored recognized critical> >>
* <Unscored unrecognized (assumed Critical)> >> <Score-based comparison for high-or-lower scoring severities with
* recognized unscored severities taking the lower bound of the comparable CVSSv3 range>
* }
@@ -481,7 +524,7 @@ public int compareTo(@NotNull Vulnerability o) {
* be reported as the highest severity after sorting on descending severity.
*
* For vulnerabilities not scored with a CVSS score we estimate a score from
- * the severity text. For textual severities assumed or sementically
+ * the severity text. For textual severities assumed or semantically
* confirmed to be of a critical nature we assign a value in between the
* highest CVSSv2 HIGH and the lowest CVSSv3 CRITICAL severity level.
*
@@ -490,12 +533,15 @@ public int compareTo(@NotNull Vulnerability o) {
* @return A float value that allows for best-effort sorting on
* vulnerability severity
*/
- private float bestEffortSeverityLevelForSorting() {
+ private Double bestEffortSeverityLevelForSorting() {
+ if (this.cvssV4 != null) {
+ return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV4.getCvssData().getBaseScore());
+ }
if (this.cvssV3 != null) {
- return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV3.getBaseScore());
+ return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV3.getCvssData().getBaseScore());
}
if (this.cvssV2 != null) {
- return this.cvssV2.getScore();
+ return this.cvssV2.getCvssData().getBaseScore();
}
return SeverityUtil.estimatedSortAdjustedCVSSv3(this.unscoredSeverity);
}
@@ -508,11 +554,14 @@ private float bestEffortSeverityLevelForSorting() {
* unscored severities that critical is assumed.
*/
public String getHighestSeverityText() {
+ if (this.cvssV4 != null) {
+ return this.cvssV4.getCvssData().getBaseSeverity().value().toUpperCase();
+ }
if (this.cvssV3 != null) {
- return this.cvssV3.getBaseSeverity().toUpperCase();
+ return this.cvssV3.getCvssData().getBaseSeverity().value().toUpperCase();
}
if (this.cvssV2 != null) {
- return this.cvssV2.getSeverity().toUpperCase();
+ return this.cvssV2.getCvssData().getBaseSeverity().toUpperCase();
}
return SeverityUtil.unscoredToSeveritytext(this.unscoredSeverity).toUpperCase();
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java b/core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java
index 5982c80450d..31763bf21e9 100644
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java
+++ b/core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java
@@ -28,6 +28,7 @@
import org.apache.commons.lang3.builder.HashCodeBuilder;
import org.jetbrains.annotations.NotNull;
import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
+import org.owasp.dependencycheck.dependency.naming.CpeIdentifier;
import org.owasp.dependencycheck.utils.DependencyVersion;
import us.springett.parsers.cpe.Cpe;
import us.springett.parsers.cpe.ICpe;
@@ -123,16 +124,25 @@ public VulnerableSoftware(Part part, String vendor, String product, String versi
}
//CSON: ParameterNumber
+ /**
+ * Normalizes null and empty strings to null for consistent comparison.
+ * @param s the string to normalize
+ * @return null if s is null or empty, otherwise s
+ */
+ private static String normalizeForComparison(String s) {
+ return (s == null || s.isEmpty()) ? null : s;
+ }
+
@Override
- public int compareTo(@NotNull Object o) {
+ public int compareTo(@NotNull ICpe o) {
if (o instanceof VulnerableSoftware) {
final VulnerableSoftware other = (VulnerableSoftware) o;
return new CompareToBuilder()
.appendSuper(super.compareTo(other))
- .append(versionStartIncluding, other.versionStartIncluding)
- .append(versionStartExcluding, other.versionStartExcluding)
- .append(versionEndIncluding, other.versionEndIncluding)
- .append(versionEndExcluding, other.versionEndExcluding)
+ .append(normalizeForComparison(versionStartIncluding), normalizeForComparison(other.versionStartIncluding))
+ .append(normalizeForComparison(versionStartExcluding), normalizeForComparison(other.versionStartExcluding))
+ .append(normalizeForComparison(versionEndIncluding), normalizeForComparison(other.versionEndIncluding))
+ .append(normalizeForComparison(versionEndExcluding), normalizeForComparison(other.versionEndExcluding))
.append(this.vulnerable, other.vulnerable)
.build();
} else if (o instanceof Cpe) {
@@ -517,4 +527,8 @@ public String toString() {
}
return sb.toString();
}
+
+ public String toNvdSearchUrl() {
+ return CpeIdentifier.nvdSearchUrlFor(this);
+ }
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/naming/CpeIdentifier.java b/core/src/main/java/org/owasp/dependencycheck/dependency/naming/CpeIdentifier.java
index 7ed914d87a5..0f6dc48006b 100644
--- a/core/src/main/java/org/owasp/dependencycheck/dependency/naming/CpeIdentifier.java
+++ b/core/src/main/java/org/owasp/dependencycheck/dependency/naming/CpeIdentifier.java
@@ -20,6 +20,7 @@
import org.apache.commons.lang3.builder.CompareToBuilder;
import org.apache.commons.lang3.builder.EqualsBuilder;
import org.apache.commons.lang3.builder.HashCodeBuilder;
+import org.apache.hc.core5.net.PercentCodec;
import org.jetbrains.annotations.NotNull;
import org.owasp.dependencycheck.dependency.Confidence;
import us.springett.parsers.cpe.Cpe;
@@ -27,6 +28,8 @@
import us.springett.parsers.cpe.exceptions.CpeValidationException;
import us.springett.parsers.cpe.values.Part;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
/**
* A CPE Identifier for a dependency object.
*
@@ -203,4 +206,41 @@ public int compareTo(@NotNull Identifier o) {
.append(this.confidence, o.getConfidence())
.toComparison();
}
+
+ /**
+ * Produces an NVD search URL for a given CPE to find all applicable vulnerabilities, including all populated parts
+ * of the given CPE.
+ *
+ * The opened link should be sorted in descending order (sortDirection=2) by publish date (sortOrder=3).
+ */
+ public static String nvdSearchUrlFor(Cpe cpe) {
+ // Use PercentCodec to force `*` to be encoded for CPE strings inside the URL. Technically '*' is not a reserved
+ // character in the fragment of URLs, but not all browsers handle this consistently, so better to encode aggressively.
+ // URlEncoder does not distinguish between parts of URLs appropriately, as well as not forcing encoding of these.
+ return String.format("https://nvd.nist.gov/vuln/search#/nvd/home?sortOrder=3&sortDirection=2&cpeFilterMode=applicability&resultType=records&cpeName=%s",
+ PercentCodec.encode(cpe.toCpe23FS(), UTF_8));
+ }
+
+ /**
+ * Produces an NVD search URL for a given application vendor/product/version combination to find all applicable vulnerabilities.
+ *
+ * The opened link should be sorted in descending order (sortDirection=2) by publish date (sortOrder=3).
+ */
+ public static String nvdSearchUrlFor(String vendor, String product, String version) throws CpeValidationException {
+ return nvdSearchUrlFor(new CpeBuilder().part(Part.APPLICATION).vendor(vendor).product(product).version(version).build());
+ }
+
+ /**
+ * Produces an NVD search URL for a given CPE to find all applicable vulnerabilities, including only the part, vendor,
+ * and product of the given CPE (if populated). Discards all other parts/discriminators of the CPE in the generated search.
+ *
+ * The opened link should be sorted in descending order (sortDirection=2) by publish date (sortOrder=3).
+ */
+ public static String nvdProductSearchUrlFor(Cpe cpe) {
+ try {
+ return nvdSearchUrlFor(new CpeBuilder().part(cpe.getPart()).vendor(cpe.getVendor()).product(cpe.getProduct()).build());
+ } catch (CpeValidationException e) {
+ throw new RuntimeException(e);
+ }
+ }
}
diff --git a/core/src/main/java/org/owasp/dependencycheck/processing/BundlerAuditProcessor.java b/core/src/main/java/org/owasp/dependencycheck/processing/BundlerAuditProcessor.java
index 973a5711df4..eef7b5f62d1 100644
--- a/core/src/main/java/org/owasp/dependencycheck/processing/BundlerAuditProcessor.java
+++ b/core/src/main/java/org/owasp/dependencycheck/processing/BundlerAuditProcessor.java
@@ -20,27 +20,12 @@
import com.github.packageurl.MalformedPackageURLException;
import com.github.packageurl.PackageURL;
import com.github.packageurl.PackageURLBuilder;
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.nio.charset.Charset;
-import java.nio.charset.StandardCharsets;
-import java.util.HashMap;
-import java.util.Map;
-import org.apache.commons.io.FileUtils;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
+import io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data;
import org.owasp.dependencycheck.Engine;
-import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.ADVISORY;
-import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.CRITICALITY;
-import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.CVE;
-import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.DEPENDENCY_ECOSYSTEM;
-import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.NAME;
-import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.VERSION;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.dependency.Confidence;
-import org.owasp.dependencycheck.dependency.CvssV2;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.dependency.Reference;
@@ -56,6 +41,22 @@
import us.springett.parsers.cpe.exceptions.CpeValidationException;
import us.springett.parsers.cpe.values.Part;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.ADVISORY;
+import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.CRITICALITY;
+import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.CVE;
+import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.DEPENDENCY_ECOSYSTEM;
+import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.NAME;
+import static org.owasp.dependencycheck.analyzer.RubyBundleAuditAnalyzer.VERSION;
+
/**
* Processor for the output of bundler-audit.
*
@@ -124,8 +125,7 @@ public void run() {
final Map map = new HashMap<>();
boolean appendToDescription = false;
- try (InputStreamReader ir = new InputStreamReader(getInput(), StandardCharsets.UTF_8);
- BufferedReader br = new BufferedReader(ir)) {
+ try (InputStreamReader ir = new InputStreamReader(getInput(), StandardCharsets.UTF_8); BufferedReader br = new BufferedReader(ir)) {
String nextLine;
while ((nextLine = br.readLine()) != null) {
@@ -133,7 +133,7 @@ public void run() {
appendToDescription = false;
gem = nextLine.substring(NAME.length());
if (!map.containsKey(gem)) {
- map.put(gem, createDependencyForGem(engine, parentName, fileName, filePath, gem));
+ map.put(gem, createDependencyForGem(engine, gemDependency.getActualFile(), parentName, fileName, filePath, gem));
}
dependency = map.get(gem);
LOGGER.debug("bundle-audit ({}): {}", parentName, nextLine);
@@ -201,7 +201,7 @@ private void addReferenceToVulnerability(String parentName, Vulnerability vulner
ref.setName(vulnerability.getName());
ref.setSource("bundle-audit");
ref.setUrl(url);
- vulnerability.getReferences().add(ref);
+ vulnerability.addReference(ref);
}
LOGGER.debug("bundle-audit ({}): {}", parentName, nextLine);
}
@@ -216,7 +216,7 @@ private void addReferenceToVulnerability(String parentName, Vulnerability vulner
private void addCriticalityToVulnerability(String parentName, Vulnerability vulnerability, String nextLine) {
if (null != vulnerability) {
final String criticality = nextLine.substring(CRITICALITY.length()).trim();
- float score = -1.0f;
+ Double score = -1.0;
Vulnerability v = null;
final CveDB cvedb = engine.getDatabase();
if (cvedb != null) {
@@ -235,13 +235,18 @@ private void addCriticalityToVulnerability(String parentName, Vulnerability vuln
}
} else {
if ("High".equalsIgnoreCase(criticality)) {
- score = 8.5f;
+ score = 8.5;
} else if ("Medium".equalsIgnoreCase(criticality)) {
- score = 5.5f;
+ score = 5.5;
} else if ("Low".equalsIgnoreCase(criticality)) {
- score = 2.0f;
+ score = 2.0;
}
- vulnerability.setCvssV2(new CvssV2(score, "-", "-", "-", "-", "-", "-", criticality));
+ LOGGER.debug("bundle-audit vulnerability missing CVSS data: {}", vulnerability.getName());
+ final CvssV2Data cvssData = new CvssV2Data(CvssV2Data.Version._2_0, null, null, null, null, null, null, null, score, criticality.toUpperCase(),
+ null, null, null, null, null, null, null, null, null, null);
+ final CvssV2 cvssV2 = new CvssV2(null, null, cvssData, criticality.toUpperCase(), null, null, null, null, null, null, null);
+ vulnerability.setCvssV2(cvssV2);
+ vulnerability.setUnscoredSeverity(null);
}
}
LOGGER.debug("bundle-audit ({}): {}", parentName, nextLine);
@@ -289,7 +294,7 @@ private Vulnerability createVulnerability(String parentName, Dependency dependen
.version(version).build();
vulnerability.addVulnerableSoftware(vs);
vulnerability.setMatchedVulnerableSoftware(vs);
- vulnerability.setCvssV2(new CvssV2(-1, "-", "-", "-", "-", "-", "-", "unknown"));
+ vulnerability.setUnscoredSeverity("UNKNOWN");
}
LOGGER.debug("bundle-audit ({}): {}", parentName, nextLine);
return vulnerability;
@@ -299,6 +304,7 @@ private Vulnerability createVulnerability(String parentName, Dependency dependen
* Creates the dependency based off of the gem.
*
* @param engine the engine used for scanning
+ * @param gemFile the gem file
* @param parentName the gem parent
* @param fileName the file name
* @param filePath the file path
@@ -306,19 +312,14 @@ private Vulnerability createVulnerability(String parentName, Dependency dependen
* @return the dependency to add
* @throws IOException thrown if a temporary gem file could not be written
*/
- private Dependency createDependencyForGem(Engine engine, String parentName, String fileName, String filePath, String gem) throws IOException {
- final File gemFile;
- try {
- gemFile = File.createTempFile(gem, "_Gemfile.lock", engine.getSettings().getTempDirectory());
- } catch (IOException ioe) {
- throw new IOException("Unable to create temporary gem file");
- }
+ private Dependency createDependencyForGem(Engine engine, File gemFile, String parentName, String fileName,
+ String filePath, String gem) throws IOException {
final String displayFileName = String.format("%s%c%s:%s", parentName, File.separatorChar, fileName, gem);
-
- FileUtils.write(gemFile, displayFileName, Charset.defaultCharset()); // unique contents to avoid dependency bundling
- final Dependency dependency = new Dependency(gemFile);
+ final Dependency dependency = new Dependency(gemFile, true);
+ dependency.setSha1sum(Checksum.getSHA1Checksum(displayFileName));
dependency.setEcosystem(DEPENDENCY_ECOSYSTEM);
dependency.addEvidence(EvidenceType.PRODUCT, "bundler-audit", "Name", gem, Confidence.HIGHEST);
+ dependency.addEvidence(EvidenceType.VENDOR, "bundler-audit", "Name", gem, Confidence.HIGH);
//TODO add package URL - note, this may require parsing the gemfile.lock and getting the version for each entry
dependency.setDisplayFileName(displayFileName);
diff --git a/core/src/main/java/org/owasp/dependencycheck/processing/MixAuditProcessor.java b/core/src/main/java/org/owasp/dependencycheck/processing/MixAuditProcessor.java
index c4661c36894..342a529d7d0 100644
--- a/core/src/main/java/org/owasp/dependencycheck/processing/MixAuditProcessor.java
+++ b/core/src/main/java/org/owasp/dependencycheck/processing/MixAuditProcessor.java
@@ -31,7 +31,7 @@
import org.owasp.dependencycheck.data.elixir.MixAuditJsonParser;
import org.owasp.dependencycheck.data.elixir.MixAuditResult;
import org.owasp.dependencycheck.dependency.Confidence;
-import org.owasp.dependencycheck.dependency.CvssV2;
+
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.dependency.Vulnerability;
@@ -166,6 +166,7 @@ private Dependency createDependency(Dependency parentDependency, String packageN
dep.addEvidence(EvidenceType.VERSION, "mix_audit", "Version", version, Confidence.HIGHEST);
dep.addEvidence(EvidenceType.PRODUCT, "mix_audit", "Package", packageName, Confidence.HIGHEST);
+ dep.addEvidence(EvidenceType.VENDOR, "mix_audit", "Package", packageName, Confidence.HIGH);
try {
final PackageURL purl = PackageURLBuilder.aPackageURL().withType("hex").withName(packageName)
@@ -197,7 +198,7 @@ private Vulnerability createVulnerability(MixAuditResult result) throws CpeValid
vulnerability.addVulnerableSoftware(vs);
vulnerability.setMatchedVulnerableSoftware(vs);
- vulnerability.setCvssV2(new CvssV2(-1, "-", "-", "-", "-", "-", "-", "unknown"));
+ vulnerability.setUnscoredSeverity("UNKOWN");
vulnerability.setDescription(result.getDescription());
vulnerability.setName(result.getCve());
diff --git a/core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
index 041c3c07367..1292954a2b8 100644
--- a/core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
+++ b/core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
@@ -17,41 +17,16 @@
*/
package org.owasp.dependencycheck.reporting;
-import java.time.ZonedDateTime;
-import java.util.List;
-
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStream;
-import java.io.OutputStreamWriter;
-import java.io.UnsupportedEncodingException;
-import java.nio.charset.StandardCharsets;
-import java.time.format.DateTimeFormatter;
-import javax.annotation.concurrent.NotThreadSafe;
-import javax.xml.XMLConstants;
-import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.transform.OutputKeys;
-import javax.xml.transform.Transformer;
-import javax.xml.transform.TransformerConfigurationException;
-import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
-import javax.xml.transform.sax.SAXSource;
-import javax.xml.transform.sax.SAXTransformerFactory;
-import javax.xml.transform.stream.StreamResult;
-
import org.apache.commons.io.FilenameUtils;
import org.apache.commons.text.WordUtils;
+import org.apache.commons.lang3.StringUtils;
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.VelocityEngine;
import org.apache.velocity.context.Context;
-
import org.owasp.dependencycheck.analyzer.Analyzer;
import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
import org.owasp.dependencycheck.dependency.Dependency;
@@ -68,9 +43,32 @@
import org.xml.sax.SAXException;
import org.xml.sax.XMLReader;
-import com.fasterxml.jackson.core.JsonFactory;
-import com.fasterxml.jackson.core.JsonGenerator;
-import com.fasterxml.jackson.core.JsonParser;
+import javax.annotation.concurrent.NotThreadSafe;
+import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.OutputKeys;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.sax.SAXSource;
+import javax.xml.transform.sax.SAXTransformerFactory;
+import javax.xml.transform.stream.StreamResult;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.List;
/**
* The ReportGenerator is used to, as the name implies, generate reports.
@@ -118,13 +116,21 @@ public enum Format {
*/
SARIF,
/**
- * Generate HTML report without script or non-vulnerable libraries for Jenkins.
+ * Generate HTML report without script or non-vulnerable libraries for
+ * Jenkins.
*/
JENKINS,
/**
* Generate JUNIT report.
*/
- JUNIT
+ JUNIT,
+ /**
+ * Generate Report in GitLab dependency check format.
+ *
+ * @see format definition
+ * @see additional explanations on the format
+ */
+ GITLAB
}
/**
@@ -142,6 +148,7 @@ public enum Format {
//CSOFF: ParameterNumber
//CSOFF: LineLength
+
/**
* Constructs a new ReportGenerator.
*
@@ -156,7 +163,7 @@ public enum Format {
*/
@Deprecated
public ReportGenerator(String applicationName, List dependencies, List analyzers,
- DatabaseProperties properties, Settings settings) {
+ DatabaseProperties properties, Settings settings) {
this(applicationName, dependencies, analyzers, properties, settings, null);
}
@@ -174,7 +181,7 @@ public ReportGenerator(String applicationName, List dependencies, Li
* @since 5.1.0
*/
public ReportGenerator(String applicationName, List dependencies, List analyzers,
- DatabaseProperties properties, Settings settings, ExceptionCollection exceptions) {
+ DatabaseProperties properties, Settings settings, ExceptionCollection exceptions) {
this(applicationName, null, null, null, dependencies, analyzers, properties, settings, exceptions);
}
@@ -195,8 +202,8 @@ public ReportGenerator(String applicationName, List dependencies, Li
*/
@Deprecated
public ReportGenerator(String applicationName, String groupID, String artifactID, String version,
- List dependencies, List analyzers, DatabaseProperties properties,
- Settings settings) {
+ List dependencies, List analyzers, DatabaseProperties properties,
+ Settings settings) {
this(applicationName, groupID, artifactID, version, dependencies, analyzers, properties, settings, null);
}
@@ -217,8 +224,8 @@ public ReportGenerator(String applicationName, String groupID, String artifactID
* @since 5.1.0
*/
public ReportGenerator(String applicationName, String groupID, String artifactID, String version,
- List dependencies, List analyzers, DatabaseProperties properties,
- Settings settings, ExceptionCollection exceptions) {
+ List
diff --git a/SECURITY.md b/SECURITY.md
index ffc5f225656..08e36f7633f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,15 +2,15 @@
## Supported Versions
-| Version | Supported |
-| ---------|--------------------|
-| 8.0.0+ | :white_check_mark: |
-| <= 7.4.4 | :x: |
+| Version | Supported |
+|-----------|--------------------|
+| 12.1.3+ | :white_check_mark: |
+| <= 12.1.2 | :x: |
## Reporting a Vulnerability
If a security vulnerability is identified in dependency-check please
-open an [issue](https://github.com/jeremylong/DependencyCheck/issues/new/choose)
+open an [issue](https://github.com/dependency-check/DependencyCheck/issues/new/choose)
and/or submit a PR to resolve the identified vulnerability.
The team is very responsive to reported vulnerabilities - historically having reported issues resolved in 30 days or less.
diff --git a/ant/README.md b/ant/README.md
index fc971dd1c69..3338cd1f12d 100644
--- a/ant/README.md
+++ b/ant/README.md
@@ -6,7 +6,7 @@ performed are a "best effort" and as such, there could be false positives as wel
vulnerabilities in 3rd party components is a well-known problem and is currently documented in the 2021 OWASP
Top 10 as [A06:2021 – Vulnerable and Outdated Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/).
-Documentation and links to production binary releases can be found on the [github pages](http://jeremylong.github.io/DependencyCheck/dependency-check-ant/index.html).
+Documentation and links to production binary releases can be found on the [github pages](https://dependency-check.github.io/DependencyCheck/dependency-check-ant/index.html).
Copyright & License
@@ -14,6 +14,8 @@ Copyright & License
Dependency-Check is Copyright (c) 2012-2014 Jeremy Long. All Rights Reserved.
-Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE.txt](https://github.com/jeremylong/DependencyCheck/blob/main/LICENSE.txt) file for the full license.
+Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE.txt](https://github.com/dependency-check/DependencyCheck/blob/main/LICENSE.txt) file for the full license.
-Dependency-Check-Ant makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/jeremylong/DependencyCheck/blob/main/ant/NOTICE.txt) file for more information.
+Dependency-Check-Ant makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/dependency-check/DependencyCheck/blob/main/ant/NOTICE.txt) file for more information.
+
+
]]>
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java b/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java
index a020d72092e..67b23f4819f 100644
--- a/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java
+++ b/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java
@@ -17,29 +17,28 @@
*/
package org.owasp.dependencycheck.taskdefs;
-import java.io.File;
-
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.BuildFileRule;
import org.apache.tools.ant.types.LogLevel;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
import org.owasp.dependencycheck.BaseDBTestCase;
-import static org.junit.Assert.assertTrue;
+import java.io.File;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
/**
*
* @author Jeremy Long
*/
-public class DependencyCheckTaskIT extends BaseDBTestCase {
+class DependencyCheckTaskIT extends BaseDBTestCase {
- @Rule
- public final BuildFileRule buildFileRule = new BuildFileRule();
+ private final BuildFileRule buildFileRule = new BuildFileRule();
- @Before
+ @BeforeEach
@Override
public void setUp() throws Exception {
super.setUp();
@@ -47,17 +46,28 @@ public void setUp() throws Exception {
buildFileRule.configureProject(buildFile, LogLevel.VERBOSE.getLevel());
}
+ @AfterEach
+ @Override
+ public void tearDown() throws Exception {
+ if (buildFileRule.getProject() != null) {
+ if (this.buildFileRule.getProject().getTargets().containsKey("tearDown")) {
+ this.buildFileRule.getProject().executeTarget("tearDown");
+ }
+ }
+ super.tearDown();
+ }
+
/**
* Test of addFileSet method, of class DependencyCheckTask.
*/
@Test
- public void testAddFileSet() throws Exception {
+ void testAddFileSet() throws Exception {
File report = new File("target/dependency-check-report.html");
if (report.exists() && !report.delete()) {
throw new Exception("Unable to delete 'target/dependency-check-report.html' prior to test.");
}
buildFileRule.executeTarget("test.fileset");
- assertTrue("DependencyCheck report was not generated", report.exists());
+ assertTrue(report.exists(), "DependencyCheck report was not generated");
}
/**
@@ -66,7 +76,7 @@ public void testAddFileSet() throws Exception {
* @throws Exception
*/
@Test
- public void testAddFileList() throws Exception {
+ void testAddFileList() throws Exception {
File report = new File("target/dependency-check-report.xml");
if (report.exists()) {
if (!report.delete()) {
@@ -75,7 +85,7 @@ public void testAddFileList() throws Exception {
}
buildFileRule.executeTarget("test.filelist");
- assertTrue("DependencyCheck report was not generated", report.exists());
+ assertTrue(report.exists(), "DependencyCheck report was not generated");
}
/**
@@ -84,7 +94,7 @@ public void testAddFileList() throws Exception {
* @throws Exception
*/
@Test
- public void testAddDirSet() throws Exception {
+ void testAddDirSet() throws Exception {
File report = new File("target/dependency-check-report.csv");
if (report.exists()) {
if (!report.delete()) {
@@ -92,11 +102,11 @@ public void testAddDirSet() throws Exception {
}
}
buildFileRule.executeTarget("test.dirset");
- assertTrue("DependencyCheck report was not generated", report.exists());
+ assertTrue(report.exists(), "DependencyCheck report was not generated");
}
@Test
- public void testNestedReportFormat() throws Exception {
+ void testNestedReportFormat() throws Exception {
File reportHTML = new File("target/dependency-check-report.html");
File reportCSV = new File("target/dependency-check-report.csv");
if (reportCSV.exists()) {
@@ -110,38 +120,37 @@ public void testNestedReportFormat() throws Exception {
}
}
buildFileRule.executeTarget("test.formatNested");
- assertTrue("DependencyCheck CSV report was not generated", reportCSV.exists());
- assertTrue("DependencyCheck HTML report was not generated", reportHTML.exists());
+ assertTrue(reportCSV.exists(), "DependencyCheck CSV report was not generated");
+ assertTrue(reportHTML.exists(), "DependencyCheck HTML report was not generated");
}
@Test
- public void testNestedBADReportFormat() throws Exception {
- try {
- buildFileRule.executeTarget("test.formatBADNested");
- Assert.fail("Should have had a buildExceotion for a bad format attribute");
- } catch (BuildException e) {
- assertTrue("Message did not have BAD, unexpected exception: " + e.getMessage(), e.getMessage().contains("BAD is not a legal value for this attribute"));
- }
+ void testNestedBADReportFormat() {
+ BuildException e = assertThrows(BuildException.class,
+ () -> buildFileRule.executeTarget("test.formatBADNested"),
+ "Should have had a buildException for a bad format attribute");
+ assertTrue(e.getMessage().contains("BAD is not a legal value for this attribute"),
+ "Message did not have BAD, unexpected exception: " + e.getMessage());
}
/**
* Test of getFailBuildOnCVSS method, of class DependencyCheckTask.
*/
@Test
- public void testGetFailBuildOnCVSS() {
- Exception exception = Assert.assertThrows(BuildException.class, () -> buildFileRule.executeTarget("failCVSS"));
+ void testGetFailBuildOnCVSS() {
+ Exception exception = assertThrows(BuildException.class, () -> buildFileRule.executeTarget("failCVSS"));
String expectedMessage = String.format("One or more dependencies were identified with vulnerabilities that "
+ "have a CVSS score greater than or equal to '%.1f':", 3.0f);
- Assert.assertTrue(exception.getMessage().contains(expectedMessage));
+ assertTrue(exception.getMessage().contains(expectedMessage));
}
/**
* Test the DependencyCheckTask where a CVE is suppressed.
*/
@Test
- public void testSuppressingCVE() {
+ void testSuppressingCVE() {
// GIVEN an ant task with a vulnerability
final String antTaskName = "suppression";
@@ -157,7 +166,7 @@ public void testSuppressingCVE() {
// THEN the ant task executed without error
final File report = new File("target/suppression-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
/**
@@ -165,7 +174,7 @@ public void testSuppressingCVE() {
* exception with a warning.
*/
@Test
- public void testSuppressingSingle() {
+ void testSuppressingSingle() {
// GIVEN an ant task with a vulnerability using the legacy property
final String antTaskName = "suppression-single";
// WHEN executing the ant task
@@ -173,7 +182,7 @@ public void testSuppressingSingle() {
// THEN the ant task executed without error
final File report = new File("target/suppression-single-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
/**
@@ -181,7 +190,7 @@ public void testSuppressingSingle() {
* exception with a warning.
*/
@Test
- public void testSuppressingMultiple() {
+ void testSuppressingMultiple() {
// GIVEN an ant task with a vulnerability using multiple was to configure the suppression file
final String antTaskName = "suppression-multiple";
// WHEN executing the ant task
@@ -189,14 +198,14 @@ public void testSuppressingMultiple() {
// THEN the ant task executed without error
final File report = new File("target/suppression-multiple-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
/**
* Test the DependencyCheckTask retireJS configuration.
*/
@Test
- public void testRetireJsConfiguration() {
+ void testRetireJsConfiguration() {
// GIVEN an ant task with a vulnerability using multiple was to configure the suppression file
final String antTaskName = "retireJS";
@@ -205,6 +214,6 @@ public void testRetireJsConfiguration() {
// THEN the ant task executed without error
final File report = new File("target/retirejs-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
}
diff --git a/ant/src/test/java/org/owasp/dependencycheck/taskdefs/UpdateTest.java b/ant/src/test/java/org/owasp/dependencycheck/taskdefs/UpdateTest.java
deleted file mode 100644
index 27b77fc031c..00000000000
--- a/ant/src/test/java/org/owasp/dependencycheck/taskdefs/UpdateTest.java
+++ /dev/null
@@ -1,90 +0,0 @@
-package org.owasp.dependencycheck.taskdefs;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.core.Is.is;
-
-import org.junit.Test;
-import org.owasp.dependencycheck.BaseTest;
-import org.owasp.dependencycheck.utils.Settings;
-
-public class UpdateTest extends BaseTest {
-
- @Test
- public void testPopulateSettingsShouldSetDefaultValueToCveUrlModified() throws Exception {
- // Given
- System.clearProperty(Settings.KEYS.CVE_MODIFIED_JSON);
- System.clearProperty(Settings.KEYS.CVE_BASE_JSON);
-
- final Update update = new Update();
- update.setCveUrlModified(null);
- update.setCveUrlBase("https://my-custom-mirror-of-nvd/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz");
-
- // When
- update.populateSettings();
-
- // Then
- String output = update.getSettings().getString(Settings.KEYS.CVE_MODIFIED_JSON);
- String expectedOutput = "https://my-custom-mirror-of-nvd/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz";
- assertThat("cveUrlModified must be set to a default of the same model", output, is(expectedOutput));
- }
-
- @Test
- public void testPopulateSettingsShouldSetDefaultValueToCveUrlModifiedWhenCveUrlModifiedIsEmpty() throws Exception {
- // Given
- System.clearProperty(Settings.KEYS.CVE_MODIFIED_JSON);
- System.clearProperty(Settings.KEYS.CVE_BASE_JSON);
-
- final Update update = new Update();
- update.setCveUrlModified("");
- update.setCveUrlBase("https://my-custom-mirror-of-nvd/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz");
-
- // When
- update.populateSettings();
-
- // Then
- String output = update.getSettings().getString(Settings.KEYS.CVE_MODIFIED_JSON);
- String expectedOutput = "https://my-custom-mirror-of-nvd/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz";
- assertThat("cveUrlModified must be set to a default of the same model when arg is empty", output,
- is(expectedOutput));
- }
-
- @Test
- public void testPopulateSettingsShouldNotSetDefaultValueToCveUrlModifiedWhenValueIsExplicitelySet() throws Exception {
- // Given
- System.clearProperty(Settings.KEYS.CVE_MODIFIED_JSON);
- System.clearProperty(Settings.KEYS.CVE_BASE_JSON);
-
- final Update update = new Update();
- update.setCveUrlModified("https://another-custom-mirror-of-nvd/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz");
- update.setCveUrlBase("https://my-custom-mirror-of-nvd/feeds/json/cve/1.1/some-unusual-file-name-%d.json.gz");
-
- // When
- update.populateSettings();
-
- // Then
- String output = update.getSettings().getString(Settings.KEYS.CVE_MODIFIED_JSON);
- String expectedOutput = "https://another-custom-mirror-of-nvd/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz";
- assertThat("cveUrlModified must be set to the specified value", output, is(expectedOutput));
- }
-
- @Test
- public void testPopulateSettingsShouldNotSetDefaultValueToCveUrlModifiedWhenUnknownValueIsSet() throws Exception {
- // Given
- System.clearProperty(Settings.KEYS.CVE_MODIFIED_JSON);
- System.clearProperty(Settings.KEYS.CVE_BASE_JSON);
-
- final Update update = new Update();
- update.setCveUrlModified(null);
- update.setCveUrlBase("https://my-custom-mirror-of-nvd/feeds/json/cve/1.1/some-unusual-file-name-%d.json.gz");
-
- // When
- update.populateSettings();
-
- // Then
- String output = update.getSettings().getString(Settings.KEYS.CVE_MODIFIED_JSON);
- String expectedOutput = "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz";
- assertThat("cveUrlModified must not be set when name is not the same as from the nvd datasource", output,
- is(expectedOutput));
- }
-
-}
diff --git a/archetype/pom.xml b/archetype/pom.xml
index 6d2a53031bc..75c34eea3f7 100644
--- a/archetype/pom.xml
+++ b/archetype/pom.xml
@@ -20,30 +20,23 @@ Copyright (c) 2017 Jeremy Long. All Rights Reserved.