Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: maintenance #7327

Merged
merged 1 commit into from
Jan 20, 2025
Merged

chore: maintenance #7327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 7 additions & 8 deletions core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractNpmAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@
import org.owasp.dependencycheck.data.nodeaudit.NodeAuditSearch;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Reference;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
import org.owasp.dependencycheck.dependency.VulnerableSoftwareBuilder;
Expand Down Expand Up @@ -505,13 +504,13 @@ protected void processResults(final List<Advisory> advisories, Engine engine,
* @param vuln the vulnerability to add
*/
protected void replaceOrAddVulnerability(Dependency dependency, Vulnerability vuln) {
boolean found = vuln.getSource() == Vulnerability.Source.NPM &&
dependency.getVulnerabilities().stream().anyMatch(existing -> {
return existing.getReferences().stream().anyMatch(ref ->{
return ref.getName() != null
&& ref.getName().equals("https://nodesecurity.io/advisories/" + vuln.getName());
});
});
final boolean found = vuln.getSource() == Vulnerability.Source.NPM
&& dependency.getVulnerabilities().stream().anyMatch(existing -> {
return existing.getReferences().stream().anyMatch(ref -> {
return ref.getName() != null
&& ref.getName().equals("https://nodesecurity.io/advisories/" + vuln.getName());
});
});
if (!found) {
dependency.addVulnerability(vuln);
}
Expand Down
4 changes: 2 additions & 2 deletions core/src/main/java/org/owasp/dependencycheck/analyzer/LibmanAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ protected FileFilter getFileFilter() {
* Performs the analysis.
*
* @param dependency the dependency to analyze
* @param engine the engine
* @param engine the engine
* @throws AnalysisException when there's an exception during analysis
*/
@Override
Expand Down Expand Up @@ -209,7 +209,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
child.setVersion(version);

if (vendor != null) {
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", vendor, Confidence.HIGHEST);
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", vendor, Confidence.HIGHEST);
}
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "name", name, Confidence.HIGH);
child.addEvidence(EvidenceType.PRODUCT, FILE_NAME, "name", name, Confidence.HIGHEST);
Expand Down
86 changes: 45 additions & 41 deletions core/src/main/java/org/owasp/dependencycheck/analyzer/UnusedSuppressionRuleAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,12 @@
* @author Jeremy Long
*/
public class UnusedSuppressionRuleAnalyzer extends AbstractAnalyzer {
protected static final String EXCEPTION_MSG = "There are %d unused suppression rule(s): check logs.";


/**
* Exception message.
*/
protected static final String EXCEPTION_MSG = "There are %d unused suppression rule(s): check logs.";

/**
* The Logger for use throughout the class.
*/
Expand All @@ -56,21 +60,21 @@ public class UnusedSuppressionRuleAnalyzer extends AbstractAnalyzer {
@Override
public synchronized void initialize(Settings settings) {
super.initialize(settings);
if (settings.getBoolean(Settings.KEYS.FAIL_ON_UNUSED_SUPPRESSION_RULE, false)) {
this.shouldFailForUnusedSuppressionRule = true;
}
}
if (settings.getBoolean(Settings.KEYS.FAIL_ON_UNUSED_SUPPRESSION_RULE, false)) {
this.shouldFailForUnusedSuppressionRule = true;
}
}

@Override
protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
if (!reported) {
checkUnusedRules(engine);
reported = true;
if(unusedSuppressionRuleCount > 0 && failsForUnusedSuppressionRule()) {
final String message = String.format(EXCEPTION_MSG, unusedSuppressionRuleCount);
LOGGER.error(message);
throw new AnalysisException(message);
}
checkUnusedRules(engine);
reported = true;
if (unusedSuppressionRuleCount > 0 && failsForUnusedSuppressionRule()) {
final String message = String.format(EXCEPTION_MSG, unusedSuppressionRuleCount);
LOGGER.error(message);
throw new AnalysisException(message);
}
}
}

Expand All @@ -85,13 +89,13 @@ protected void checkUnusedRules(Engine engine) {
final List<SuppressionRule> rules = (List<SuppressionRule>) engine.getObject(SUPPRESSION_OBJECT_KEY);
rules.forEach((rule) -> {
if (!rule.isMatched() && !rule.isBase()) {
final String message = String.format("Suppression Rule had zero matches: %s", rule);
if(failsForUnusedSuppressionRule()) {
LOGGER.error(message);
} else {
LOGGER.info(message);
}
increaseUnusedSuppressionRuleCount();
final String message = String.format("Suppression Rule had zero matches: %s", rule);
if (failsForUnusedSuppressionRule()) {
LOGGER.error(message);
} else {
LOGGER.info(message);
}
increaseUnusedSuppressionRuleCount();
}
});
}
Expand All @@ -117,25 +121,25 @@ public AnalysisPhase getAnalysisPhase() {
public boolean supportsParallelProcessing() {
return false;
}
/**
* increases the count of unused suppression rules
*/
public void increaseUnusedSuppressionRuleCount() {
unusedSuppressionRuleCount++;
}
/**
* @return the count of unused suppression rules
*/
public int getUnusedSuppressionRuleCount() {
return unusedSuppressionRuleCount;
}
/**
* @return whether the analyzer will fail for a unused suppression rule
*/
public boolean failsForUnusedSuppressionRule() {
return shouldFailForUnusedSuppressionRule;
}

/**
* increases the count of unused suppression rules.
*/
public void increaseUnusedSuppressionRuleCount() {
unusedSuppressionRuleCount++;
}

/**
* @return the count of unused suppression rules.
*/
public int getUnusedSuppressionRuleCount() {
return unusedSuppressionRuleCount;
}

/**
* @return whether the analyzer will fail for a unused suppression rule.
*/
public boolean failsForUnusedSuppressionRule() {
return shouldFailForUnusedSuppressionRule;
}
}
1 change: 1 addition & 0 deletions core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ public class ComposerLockParser {
* Creates a ComposerLockParser from a JsonReader and an InputStream.
*
* @param inputStream the InputStream to parse
* @param skipDev whether to skip dev dependencies
*/
public ComposerLockParser(InputStream inputStream, boolean skipDev) {
LOGGER.debug("Creating a ComposerLockParser");
Expand Down
4 changes: 2 additions & 2 deletions core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,8 @@ public boolean update(Engine engine) throws UpdateException {
final URL url = new URL(settings.getString(Settings.KEYS.KEV_URL, DEFAULT_URL));
LOGGER.info("Updating CISA Known Exploited Vulnerability list: " + url.toString());

final HttpClientResponseHandler<KnownExploitedVulnerabilitiesSchema> kevParsingResponseHandler
= new AbstractHttpClientResponseHandler<>() {
final HttpClientResponseHandler<KnownExploitedVulnerabilitiesSchema> kevParsingResponseHandler =
new AbstractHttpClientResponseHandler<>() {
@Override
public KnownExploitedVulnerabilitiesSchema handleEntity(HttpEntity entity) throws IOException {
try (InputStream in = entity.getContent()) {
Expand Down
2 changes: 1 addition & 1 deletion core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveItemSource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ public interface CveItemSource<T extends DefCveItem> extends AutoCloseable {
/**
* Returns whether there is another item.
*
* @return <code>true</code if there is another item; otherwise
* @return <code>true</code> if there is another item; otherwise
* <code>false</code>.
*/
boolean hasNext();
Expand Down
1 change: 1 addition & 0 deletions core/src/main/java/org/owasp/dependencycheck/reporting/SarifRule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ public class SarifRule {
* @param source the source
* @param cvssV2 the CVSS v2 score
* @param cvssV3 the CVSS v3 score
* @param cvssV4 the CVSS v4 score
*/
public SarifRule(String name, String shortDescription, String fullDescription,
String source, CvssV2 cvssV2, CvssV3 cvssV3, CvssV4 cvssV4) {
Expand Down
12 changes: 6 additions & 6 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ Copyright (c) 2012 - Jeremy Long
<taglist-maven-plugin.version>3.2.1</taglist-maven-plugin.version>
<versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
<jetbrains.annotations.version>26.0.1</jetbrains.annotations.version>
<findbugs-jsr305.version>3.0.2</findbugs-jsr305.version>
<findbugs.spotbugs.version>4.9.0</findbugs.spotbugs.version>
<com.h2database.version>2.3.232</com.h2database.version>
<commons-cli.version>1.9.0</commons-cli.version>
<commons-io.version>2.18.0</commons-io.version>
Expand Down Expand Up @@ -1273,9 +1273,9 @@ Copyright (c) 2012 - Jeremy Long
<version>${doxia-base.version}</version>
</dependency>
<dependency>
<groupId>com.google.code.findbugs</groupId>
<artifactId>jsr305</artifactId>
<version>${findbugs-jsr305.version}</version>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-annotations</artifactId>
<version>${findbugs.spotbugs.version}</version>
</dependency>
<dependency>
<groupId>org.sonatype.ossindex</groupId>
Expand Down Expand Up @@ -1348,8 +1348,8 @@ Copyright (c) 2012 - Jeremy Long
<optional>true</optional>
</dependency>
<dependency>
<groupId>com.google.code.findbugs</groupId>
<artifactId>jsr305</artifactId>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-annotations</artifactId>
<scope>compile</scope>
<optional>true</optional>
</dependency>
Expand Down
2 changes: 1 addition & 1 deletion utils/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved.
<tag>v6.4.1</tag>
</scm>
<properties>
<findbugs.onlyAnalyze>org.owasp.dependencycheck.utils.*</findbugs.onlyAnalyze>
<spotbugs.onlyAnalyze>org.owasp.dependencycheck.utils.*</spotbugs.onlyAnalyze>
</properties>
<dependencies>
<dependency>
Expand Down
Loading