Skip to content
This repository was archived by the owner on Feb 17, 2025. It is now read-only.

Commit 19dd71b

Browse files
aikebahaikebah
authored
fix: Do not filter out evidences added by hints (#5900)
1 parent 0112100 commit 19dd71b

File tree

6 files changed

+53
-55
lines changed

6 files changed

+53
-55
lines changed

‎core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
198198
for (VendorDuplicatingHintRule dhr : vendorHints) {
199199
if (dhr.getValue().equalsIgnoreCase(e.getValue())) {
200200
dependency.addEvidence(EvidenceType.VENDOR, new Evidence(e.getSource() + " (hint)",
201-
e.getName(), dhr.getDuplicate(), e.getConfidence()));
201+
e.getName(), dhr.getDuplicate(), e.getConfidence(), true));
202202
}
203203
}
204204
}

‎core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
136136
final Set<Evidence> remove;
137137
if (dependency.getVersion() != null) {
138138
remove = dependency.getEvidence(EvidenceType.VERSION).stream()
139-
.filter(e -> !dependency.getVersion().equals(e.getValue()))
139+
.filter(e -> !e.isFromHint() && !dependency.getVersion().equals(e.getValue()))
140140
.collect(Collectors.toSet());
141141
} else {
142142
remove = new HashSet<>();
@@ -165,7 +165,8 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
165165
LOGGER.debug("filtering evidence from {}", dependency.getFileName());
166166

167167
for (Evidence e : dependency.getEvidence(EvidenceType.VERSION)) {
168-
if (!(pomMatch && VERSION.equals(e.getName())
168+
if (!e.isFromHint()
169+
&& !(pomMatch && VERSION.equals(e.getName())
169170
&& (NEXUS.equals(e.getSource()) || CENTRAL.equals(e.getSource()) || POM.equals(e.getSource())))
170171
&& !(fileMatch && VERSION.equals(e.getName()) && FILE.equals(e.getSource()))
171172
&& !(manifestMatch && MANIFEST.equals(e.getSource()) && IMPLEMENTATION_VERSION.equals(e.getName()))) {

‎core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ public class Evidence implements Serializable, Comparable<Evidence> {
5959
*/
6060
private Confidence confidence;
6161

62+
/**
63+
* Whether the evidence originates from a hint.
64+
*/
65+
private boolean fromHint;
66+
6267
/**
6368
* Creates a new Evidence object.
6469
*/
@@ -74,10 +79,24 @@ public Evidence() {
7479
* @param confidence the confidence of the evidence.
7580
*/
7681
public Evidence(String source, String name, String value, Confidence confidence) {
82+
this(source, name, value, confidence, false);
83+
}
84+
85+
/**
86+
* Creates a new Evidence objects.
87+
*
88+
* @param source the source of the evidence.
89+
* @param name the name of the evidence.
90+
* @param value the value of the evidence.
91+
* @param confidence the confidence of the evidence.
92+
* @param fromHint whether the evidence was introduced by a hint.
93+
*/
94+
public Evidence(String source, String name, String value, Confidence confidence, boolean fromHint) {
7795
this.source = source;
7896
this.name = name;
7997
this.value = value;
8098
this.confidence = confidence;
99+
this.fromHint = fromHint;
81100
}
82101

83102
/**
@@ -152,6 +171,24 @@ public void setConfidence(Confidence confidence) {
152171
this.confidence = confidence;
153172
}
154173

174+
/**
175+
* Get the value of fromHint.
176+
*
177+
* @return the value of fromHint
178+
*/
179+
public boolean isFromHint() {
180+
return fromHint;
181+
}
182+
183+
/**
184+
* Set the value of fromHint.
185+
*
186+
* @param fromHint new value of fromHint
187+
*/
188+
public void setFromHint(boolean fromHint) {
189+
this.fromHint = fromHint;
190+
}
191+
155192
/**
156193
* Implements the hashCode for Evidence.
157194
*
@@ -187,6 +224,7 @@ public boolean equals(Object obj) {
187224
.append(this.name == null ? null : this.name.toLowerCase(), o.name == null ? null : o.name.toLowerCase())
188225
.append(this.value == null ? null : this.value.toLowerCase(), o.value == null ? null : o.value.toLowerCase())
189226
.append(this.confidence, o.getConfidence())
227+
.append(this.fromHint, o.isFromHint())
190228
.build();
191229
}
192230

@@ -196,14 +234,14 @@ public boolean equals(Object obj) {
196234
* @param o the evidence being compared
197235
* @return an integer indicating the ordering of the two objects
198236
*/
199-
@SuppressWarnings("deprecation")
200237
@Override
201238
public int compareTo(@NotNull Evidence o) {
202239
return new CompareToBuilder()
203240
.append(this.source == null ? null : this.source.toLowerCase(), o.source == null ? null : o.source.toLowerCase())
204241
.append(this.name == null ? null : this.name.toLowerCase(), o.name == null ? null : o.name.toLowerCase())
205242
.append(this.value == null ? null : this.value.toLowerCase(), o.value == null ? null : o.value.toLowerCase())
206243
.append(this.confidence, o.getConfidence())
244+
.append(this.fromHint, o.isFromHint())
207245
.toComparison();
208246
}
209247

@@ -214,6 +252,7 @@ public int compareTo(@NotNull Evidence o) {
214252
*/
215253
@Override
216254
public String toString() {
217-
return "Evidence{" + "name=" + name + ", source=" + source + ", value=" + value + ", confidence=" + confidence + '}';
255+
return "Evidence{" + "name=" + name + ", source=" + source + ", value=" + value + ", confidence=" + confidence
256+
+ ", fromHint=" + fromHint + '}';
218257
}
219258
}

‎core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ public List<EvidenceMatcher> getGivenVendor() {
147147
* @param confidence the confidence of the evidence
148148
*/
149149
public void addAddProduct(String source, String name, String value, Confidence confidence) {
150-
addProduct.add(new Evidence(source, name, value, confidence));
150+
addProduct.add(new Evidence(source, name, value, confidence, true));
151151
}
152152

153153
/**
@@ -168,7 +168,7 @@ public List<Evidence> getAddProduct() {
168168
* @param confidence the confidence of the evidence
169169
*/
170170
public void addAddVersion(String source, String name, String value, Confidence confidence) {
171-
addVersion.add(new Evidence(source, name, value, confidence));
171+
addVersion.add(new Evidence(source, name, value, confidence, true));
172172
}
173173

174174
/**
@@ -189,7 +189,7 @@ public List<Evidence> getAddVersion() {
189189
* @param confidence the confidence of the evidence
190190
*/
191191
public void addAddVendor(String source, String name, String value, Confidence confidence) {
192-
addVendor.add(new Evidence(source, name, value, confidence));
192+
addVendor.add(new Evidence(source, name, value, confidence, true));
193193
}
194194

195195
/**

‎core/src/main/resources/dependencycheck-base-hint.xml‎

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -148,48 +148,6 @@
148148
</add>
149149
</hint>
150150

151-
<!-- begin hack for temporary patch of issue #534-->
152-
<hint>
153-
<given>
154-
<fileName regex="true" contains=".*hibernate-validator-5\.0\..*"/>
155-
</given>
156-
<add>
157-
<evidence type="version" source="hint" name="version" value="5.0" confidence="HIGHEST"/>
158-
</add>
159-
</hint>
160-
<hint>
161-
<given>
162-
<fileName regex="true" contains=".*hibernate-validator-5\.1\.[01].*"/>
163-
</given>
164-
<add>
165-
<evidence type="version" source="hint" name="version" value="5.1" confidence="HIGHEST"/>
166-
</add>
167-
</hint>
168-
<hint>
169-
<given>
170-
<fileName regex="true" contains=".*hibernate-validator-4\.1\..*"/>
171-
</given>
172-
<add>
173-
<evidence type="version" source="hint" name="version" value="4.1.0" confidence="HIGHEST"/>
174-
</add>
175-
</hint>
176-
<hint>
177-
<given>
178-
<fileName regex="true" contains=".*hibernate-validator-4\.2\.0.*"/>
179-
</given>
180-
<add>
181-
<evidence type="version" source="hint" name="version" value="4.2.0" confidence="HIGHEST"/>
182-
</add>
183-
</hint>
184-
<hint>
185-
<given>
186-
<fileName regex="true" contains=".*hibernate-validator-4\.3\.[01]\..*"/>
187-
</given>
188-
<add>
189-
<evidence type="version" source="hint" name="version" value="4.3.0" confidence="HIGHEST"/>
190-
</add>
191-
</hint>
192-
<!-- end hack for temporary patch of issue #534-->
193151
<!-- creating a spring boot starter project can cause your app to incorrectly be flagged as spring-->
194152
<hint>
195153
<given>

‎core/src/test/java/org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,11 +86,11 @@ public void testAnalyze() throws Exception {
8686
sdep = d;
8787
}
8888
}
89-
final Evidence springTest1 = new Evidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGHEST);
90-
final Evidence springTest2 = new Evidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGHEST);
91-
final Evidence springTest3 = new Evidence("hint analyzer", "vendor", "vmware", Confidence.HIGHEST);
92-
final Evidence springTest4 = new Evidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGHEST);
93-
final Evidence springTest5 = new Evidence("hint analyzer", "vendor", "vmware", Confidence.HIGHEST);
89+
final Evidence springTest1 = new Evidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGHEST, true);
90+
final Evidence springTest2 = new Evidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGHEST, true);
91+
final Evidence springTest3 = new Evidence("hint analyzer", "vendor", "vmware", Confidence.HIGHEST, true);
92+
final Evidence springTest4 = new Evidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGHEST, true);
93+
final Evidence springTest5 = new Evidence("hint analyzer", "vendor", "vmware", Confidence.HIGHEST, true);
9494

9595
assertFalse(gdep.contains(EvidenceType.PRODUCT, springTest1));
9696
assertFalse(gdep.contains(EvidenceType.VENDOR, springTest2));

0 commit comments

Comments
 (0)