Skip to content
This repository was archived by the owner on Feb 17, 2025. It is now read-only.

Commit bebb431

Browse files
jeremylongjeremylong
authored
chore: maintenance (#7327)
1 parent 75327b0 commit bebb431

File tree

9 files changed

+66
-61
lines changed

9 files changed

+66
-61
lines changed

‎core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractNpmAnalyzer.java

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
import org.owasp.dependencycheck.data.nodeaudit.NodeAuditSearch;
2929
import org.owasp.dependencycheck.dependency.Confidence;
3030
import org.owasp.dependencycheck.dependency.Dependency;
31-
import org.owasp.dependencycheck.dependency.Reference;
3231
import org.owasp.dependencycheck.dependency.Vulnerability;
3332
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
3433
import org.owasp.dependencycheck.dependency.VulnerableSoftwareBuilder;
@@ -505,13 +504,13 @@ protected void processResults(final List<Advisory> advisories, Engine engine,
505504
* @param vuln the vulnerability to add
506505
*/
507506
protected void replaceOrAddVulnerability(Dependency dependency, Vulnerability vuln) {
508-
boolean found = vuln.getSource() == Vulnerability.Source.NPM &&
509-
dependency.getVulnerabilities().stream().anyMatch(existing -> {
510-
return existing.getReferences().stream().anyMatch(ref ->{
511-
return ref.getName() != null
512-
&& ref.getName().equals("https://nodesecurity.io/advisories/" + vuln.getName());
513-
});
514-
});
507+
final boolean found = vuln.getSource() == Vulnerability.Source.NPM
508+
&& dependency.getVulnerabilities().stream().anyMatch(existing -> {
509+
return existing.getReferences().stream().anyMatch(ref -> {
510+
return ref.getName() != null
511+
&& ref.getName().equals("https://nodesecurity.io/advisories/" + vuln.getName());
512+
});
513+
});
515514
if (!found) {
516515
dependency.addVulnerability(vuln);
517516
}

‎core/src/main/java/org/owasp/dependencycheck/analyzer/LibmanAnalyzer.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ protected FileFilter getFileFilter() {
148148
* Performs the analysis.
149149
*
150150
* @param dependency the dependency to analyze
151-
* @param engine the engine
151+
* @param engine the engine
152152
* @throws AnalysisException when there's an exception during analysis
153153
*/
154154
@Override
@@ -209,7 +209,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
209209
child.setVersion(version);
210210

211211
if (vendor != null) {
212-
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", vendor, Confidence.HIGHEST);
212+
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", vendor, Confidence.HIGHEST);
213213
}
214214
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "name", name, Confidence.HIGH);
215215
child.addEvidence(EvidenceType.PRODUCT, FILE_NAME, "name", name, Confidence.HIGHEST);

‎core/src/main/java/org/owasp/dependencycheck/analyzer/UnusedSuppressionRuleAnalyzer.java

Lines changed: 45 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,12 @@
3333
* @author Jeremy Long
3434
*/
3535
public class UnusedSuppressionRuleAnalyzer extends AbstractAnalyzer {
36-
protected static final String EXCEPTION_MSG = "There are %d unused suppression rule(s): check logs.";
37-
36+
37+
/**
38+
* Exception message.
39+
*/
40+
protected static final String EXCEPTION_MSG = "There are %d unused suppression rule(s): check logs.";
41+
3842
/**
3943
* The Logger for use throughout the class.
4044
*/
@@ -56,21 +60,21 @@ public class UnusedSuppressionRuleAnalyzer extends AbstractAnalyzer {
5660
@Override
5761
public synchronized void initialize(Settings settings) {
5862
super.initialize(settings);
59-
if (settings.getBoolean(Settings.KEYS.FAIL_ON_UNUSED_SUPPRESSION_RULE, false)) {
60-
this.shouldFailForUnusedSuppressionRule = true;
61-
}
62-
}
63+
if (settings.getBoolean(Settings.KEYS.FAIL_ON_UNUSED_SUPPRESSION_RULE, false)) {
64+
this.shouldFailForUnusedSuppressionRule = true;
65+
}
66+
}
6367

6468
@Override
6569
protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
6670
if (!reported) {
67-
checkUnusedRules(engine);
68-
reported = true;
69-
if(unusedSuppressionRuleCount > 0 && failsForUnusedSuppressionRule()) {
70-
final String message = String.format(EXCEPTION_MSG, unusedSuppressionRuleCount);
71-
LOGGER.error(message);
72-
throw new AnalysisException(message);
73-
}
71+
checkUnusedRules(engine);
72+
reported = true;
73+
if (unusedSuppressionRuleCount > 0 && failsForUnusedSuppressionRule()) {
74+
final String message = String.format(EXCEPTION_MSG, unusedSuppressionRuleCount);
75+
LOGGER.error(message);
76+
throw new AnalysisException(message);
77+
}
7478
}
7579
}
7680

@@ -85,13 +89,13 @@ protected void checkUnusedRules(Engine engine) {
8589
final List<SuppressionRule> rules = (List<SuppressionRule>) engine.getObject(SUPPRESSION_OBJECT_KEY);
8690
rules.forEach((rule) -> {
8791
if (!rule.isMatched() && !rule.isBase()) {
88-
final String message = String.format("Suppression Rule had zero matches: %s", rule);
89-
if(failsForUnusedSuppressionRule()) {
90-
LOGGER.error(message);
91-
} else {
92-
LOGGER.info(message);
93-
}
94-
increaseUnusedSuppressionRuleCount();
92+
final String message = String.format("Suppression Rule had zero matches: %s", rule);
93+
if (failsForUnusedSuppressionRule()) {
94+
LOGGER.error(message);
95+
} else {
96+
LOGGER.info(message);
97+
}
98+
increaseUnusedSuppressionRuleCount();
9599
}
96100
});
97101
}
@@ -117,25 +121,25 @@ public AnalysisPhase getAnalysisPhase() {
117121
public boolean supportsParallelProcessing() {
118122
return false;
119123
}
120-
121-
/**
122-
* increases the count of unused suppression rules
123-
*/
124-
public void increaseUnusedSuppressionRuleCount() {
125-
unusedSuppressionRuleCount++;
126-
}
127-
128-
/**
129-
* @return the count of unused suppression rules
130-
*/
131-
public int getUnusedSuppressionRuleCount() {
132-
return unusedSuppressionRuleCount;
133-
}
134-
135-
/**
136-
* @return whether the analyzer will fail for a unused suppression rule
137-
*/
138-
public boolean failsForUnusedSuppressionRule() {
139-
return shouldFailForUnusedSuppressionRule;
140-
}
124+
125+
/**
126+
* increases the count of unused suppression rules.
127+
*/
128+
public void increaseUnusedSuppressionRuleCount() {
129+
unusedSuppressionRuleCount++;
130+
}
131+
132+
/**
133+
* @return the count of unused suppression rules.
134+
*/
135+
public int getUnusedSuppressionRuleCount() {
136+
return unusedSuppressionRuleCount;
137+
}
138+
139+
/**
140+
* @return whether the analyzer will fail for a unused suppression rule.
141+
*/
142+
public boolean failsForUnusedSuppressionRule() {
143+
return shouldFailForUnusedSuppressionRule;
144+
}
141145
}

‎core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ public class ComposerLockParser {
6161
* Creates a ComposerLockParser from a JsonReader and an InputStream.
6262
*
6363
* @param inputStream the InputStream to parse
64+
* @param skipDev whether to skip dev dependencies
6465
*/
6566
public ComposerLockParser(InputStream inputStream, boolean skipDev) {
6667
LOGGER.debug("Creating a ComposerLockParser");

‎core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,8 +80,8 @@ public boolean update(Engine engine) throws UpdateException {
8080
final URL url = new URL(settings.getString(Settings.KEYS.KEV_URL, DEFAULT_URL));
8181
LOGGER.info("Updating CISA Known Exploited Vulnerability list: " + url.toString());
8282

83-
final HttpClientResponseHandler<KnownExploitedVulnerabilitiesSchema> kevParsingResponseHandler
84-
= new AbstractHttpClientResponseHandler<>() {
83+
final HttpClientResponseHandler<KnownExploitedVulnerabilitiesSchema> kevParsingResponseHandler =
84+
new AbstractHttpClientResponseHandler<>() {
8585
@Override
8686
public KnownExploitedVulnerabilitiesSchema handleEntity(HttpEntity entity) throws IOException {
8787
try (InputStream in = entity.getContent()) {

‎core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/CveItemSource.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public interface CveItemSource<T extends DefCveItem> extends AutoCloseable {
2626
/**
2727
* Returns whether there is another item.
2828
*
29-
* @return <code>true</code if there is another item; otherwise
29+
* @return <code>true</code> if there is another item; otherwise
3030
* <code>false</code>.
3131
*/
3232
boolean hasNext();

‎core/src/main/java/org/owasp/dependencycheck/reporting/SarifRule.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ public class SarifRule {
161161
* @param source the source
162162
* @param cvssV2 the CVSS v2 score
163163
* @param cvssV3 the CVSS v3 score
164+
* @param cvssV4 the CVSS v4 score
164165
*/
165166
public SarifRule(String name, String shortDescription, String fullDescription,
166167
String source, CvssV2 cvssV2, CvssV3 cvssV3, CvssV4 cvssV4) {

‎pom.xml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ Copyright (c) 2012 - Jeremy Long
142142
<taglist-maven-plugin.version>3.2.1</taglist-maven-plugin.version>
143143
<versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
144144
<jetbrains.annotations.version>26.0.1</jetbrains.annotations.version>
145-
<findbugs-jsr305.version>3.0.2</findbugs-jsr305.version>
145+
<findbugs.spotbugs.version>4.9.0</findbugs.spotbugs.version>
146146
<com.h2database.version>2.3.232</com.h2database.version>
147147
<commons-cli.version>1.9.0</commons-cli.version>
148148
<commons-io.version>2.18.0</commons-io.version>
@@ -1273,9 +1273,9 @@ Copyright (c) 2012 - Jeremy Long
12731273
<version>${doxia-base.version}</version>
12741274
</dependency>
12751275
<dependency>
1276-
<groupId>com.google.code.findbugs</groupId>
1277-
<artifactId>jsr305</artifactId>
1278-
<version>${findbugs-jsr305.version}</version>
1276+
<groupId>com.github.spotbugs</groupId>
1277+
<artifactId>spotbugs-annotations</artifactId>
1278+
<version>${findbugs.spotbugs.version}</version>
12791279
</dependency>
12801280
<dependency>
12811281
<groupId>org.sonatype.ossindex</groupId>
@@ -1348,8 +1348,8 @@ Copyright (c) 2012 - Jeremy Long
13481348
<optional>true</optional>
13491349
</dependency>
13501350
<dependency>
1351-
<groupId>com.google.code.findbugs</groupId>
1352-
<artifactId>jsr305</artifactId>
1351+
<groupId>com.github.spotbugs</groupId>
1352+
<artifactId>spotbugs-annotations</artifactId>
13531353
<scope>compile</scope>
13541354
<optional>true</optional>
13551355
</dependency>

‎utils/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved.
3333
<tag>v6.4.1</tag>
3434
</scm>
3535
<properties>
36-
<findbugs.onlyAnalyze>org.owasp.dependencycheck.utils.*</findbugs.onlyAnalyze>
36+
<spotbugs.onlyAnalyze>org.owasp.dependencycheck.utils.*</spotbugs.onlyAnalyze>
3737
</properties>
3838
<dependencies>
3939
<dependency>

0 commit comments

Comments
 (0)