dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java
/**
     * If a zip file was identified as a possible JAR, this method will add the
     * zip to the list of dependencies.
     *
     * @param dependency the zip file
     * @param engine the engine
     * @throws AnalysisException thrown if there is an issue
     */
If a zip file was identified as a possible JAR, this method will add the
zip to the list of dependencies.

@param dependency the zip file
@param engine the engine
@throws AnalysisException thrown if there is an issue
If a zip file was identified as a possible JAR this method will add the zip to the list of dependencies . @param dependency the zip file @param engine the engine @throws AnalysisException thrown if there is an issue
private void addDisguisedJarsToDependencies(Dependency dependency, Engine engine) throws AnalysisException {
        if (ZIP_FILTER.accept(dependency.getActualFile()) && isZipFileActuallyJarFile(dependency)) {
            final File tempDir = getNextTempDirectory();
            final String fileName = dependency.getFileName();
            LOGGER.info("The zip file '{}' appears to be a JAR file, making a copy and analyzing it as a JAR.", fileName);
            final File tmpLoc = new File(tempDir, fileName.substring(0, fileName.length() - 3) + "jar");
            final String archiveSha1 = dependency.getSha1sum();
            try {
                dependency.setSha1sum("");
                org.apache.commons.io.FileUtils.copyFile(dependency.getActualFile(), tmpLoc);
                final List<Dependency> dependencySet = findMoreDependencies(engine, tmpLoc);
                if (dependencySet != null && !dependencySet.isEmpty()) {
                    for (Dependency d : dependencySet) {
                        if (d.getActualFile().equals(tmpLoc)) {
                            d.setFilePath(dependency.getFilePath());
                            d.setDisplayFileName(dependency.getFileName());
                        } else {
                            for (Dependency sub : d.getRelatedDependencies()) {
                                if (sub.getActualFile().equals(tmpLoc)) {
                                    sub.setFilePath(dependency.getFilePath());
                                    sub.setDisplayFileName(dependency.getFileName());
                                }
                            }
                        }
                    }
                }
            } catch (IOException ex) {
                LOGGER.debug("Unable to perform deep copy on '{}'", dependency.getActualFile().getPath(), ex);
            } finally {
                dependency.setSha1sum(archiveSha1);
            }
        }
    }
private void addDisguisedJarsToDependencies ( Dependency dependency , Engine engine ) throws AnalysisException { if ( ZIP_FILTER . accept ( dependency . getActualFile ( ) ) && isZipFileActuallyJarFile ( dependency ) ) { final File tempDir = getNextTempDirectory ( ) ; final String fileName = dependency . getFileName ( ) ; LOGGER . info ( "The zip file '{}' appears to be a JAR file, making a copy and analyzing it as a JAR." , fileName ) ; final File tmpLoc = new File ( tempDir , fileName . substring ( 0 , fileName . length ( ) - 3 ) + "jar" ) ; final String archiveSha1 = dependency . getSha1sum ( ) ; try { dependency . setSha1sum ( "" ) ; org . apache . commons . io . FileUtils . copyFile ( dependency . getActualFile ( ) , tmpLoc ) ; final List < Dependency > dependencySet = findMoreDependencies ( engine , tmpLoc ) ; if ( dependencySet != null && ! dependencySet . isEmpty ( ) ) { for ( Dependency d : dependencySet ) { if ( d . getActualFile ( ) . equals ( tmpLoc ) ) { d . setFilePath ( dependency . getFilePath ( ) ) ; d . setDisplayFileName ( dependency . getFileName ( ) ) ; } else { for ( Dependency sub : d . getRelatedDependencies ( ) ) { if ( sub . getActualFile ( ) . equals ( tmpLoc ) ) { sub . setFilePath ( dependency . getFilePath ( ) ) ; sub . setDisplayFileName ( dependency . getFileName ( ) ) ; } } } } } } catch ( IOException ex ) { LOGGER . debug ( "Unable to perform deep copy on '{}'" , dependency . getActualFile ( ) . getPath ( ) , ex ) ; } finally { dependency . setSha1sum ( archiveSha1 ) ; } } }
If a zip file was identified as a possible JAR, this method will add the
 zip to the list of dependencies.
If a zip file was identified as a possible JAR this method will add the zip to the list of dependencies .
//store the archives sha1 and change it so that the engine doesn't think the zip and jar file are the same // and add it is a related dependency. //fix the dependency's display name and path