dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
/**
     * The HintAnalyzer uses knowledge about a dependency to add additional
     * information to help in identification of identifiers or vulnerabilities.
     *
     * @param dependency The dependency being analyzed
     * @param engine The scanning engine
     * @throws AnalysisException is thrown if there is an exception analyzing
     * the dependency.
     */
The HintAnalyzer uses knowledge about a dependency to add additional
information to help in identification of identifiers or vulnerabilities.

@param dependency The dependency being analyzed
@param engine The scanning engine
@throws AnalysisException is thrown if there is an exception analyzing
the dependency.
The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of identifiers or vulnerabilities . @param dependency The dependency being analyzed @param engine The scanning engine @throws AnalysisException is thrown if there is an exception analyzing the dependency .
@Override
    protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
        for (HintRule hint : hints.getHintRules()) {
            boolean matchFound = false;
            for (Evidence given : hint.getGivenVendor()) {
                if (dependency.getVendorEvidence().getEvidence().contains(given)) {
                    matchFound = true;
                    break;
                }
            }
            if (!matchFound) {
                for (Evidence given : hint.getGivenProduct()) {
                    if (dependency.getProductEvidence().getEvidence().contains(given)) {
                        matchFound = true;
                        break;
                    }
                }
            }
            if (!matchFound) {
                for (Evidence given : hint.getGivenVersion()) {
                    if (dependency.getVersionEvidence().getEvidence().contains(given)) {
                        matchFound = true;
                        break;
                    }
                }
            }
            if (!matchFound) {
                for (PropertyType pt : hint.getFilenames()) {
                    if (pt.matches(dependency.getFileName())) {
                        matchFound = true;
                        break;
                    }
                }
            }
            if (matchFound) {
                for (Evidence e : hint.getAddVendor()) {
                    dependency.getVendorEvidence().addEvidence(e);
                }
                for (Evidence e : hint.getAddProduct()) {
                    dependency.getProductEvidence().addEvidence(e);
                }
                for (Evidence e : hint.getAddVersion()) {
                    dependency.getVersionEvidence().addEvidence(e);
                }
                for (Evidence e : hint.getRemoveVendor()) {
                    if (dependency.getVendorEvidence().getEvidence().contains(e)) {
                        dependency.getVendorEvidence().getEvidence().remove(e);
                    }
                }
                for (Evidence e : hint.getRemoveProduct()) {
                    if (dependency.getProductEvidence().getEvidence().contains(e)) {
                        dependency.getProductEvidence().getEvidence().remove(e);
                    }
                }
                for (Evidence e : hint.getRemoveVersion()) {
                    if (dependency.getVersionEvidence().getEvidence().contains(e)) {
                        dependency.getVersionEvidence().getEvidence().remove(e);
                    }
                }
            }
        }
        final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
        final List<Evidence> newEntries = new ArrayList<>();
        while (itr.hasNext()) {
            final Evidence e = itr.next();
            for (VendorDuplicatingHintRule dhr : hints.getVendorDuplicatingHintRules()) {
                if (dhr.getValue().equalsIgnoreCase(e.getValue(false))) {
                    newEntries.add(new Evidence(e.getSource() + " (hint)",
                            e.getName(), dhr.getDuplicate(), e.getConfidence()));
                }
            }
        }
        for (Evidence e : newEntries) {
            dependency.getVendorEvidence().addEvidence(e);
        }
    }
@ Override protected void analyzeDependency ( Dependency dependency , Engine engine ) throws AnalysisException { for ( HintRule hint : hints . getHintRules ( ) ) { boolean matchFound = false ; for ( Evidence given : hint . getGivenVendor ( ) ) { if ( dependency . getVendorEvidence ( ) . getEvidence ( ) . contains ( given ) ) { matchFound = true ; break ; } } if ( ! matchFound ) { for ( Evidence given : hint . getGivenProduct ( ) ) { if ( dependency . getProductEvidence ( ) . getEvidence ( ) . contains ( given ) ) { matchFound = true ; break ; } } } if ( ! matchFound ) { for ( Evidence given : hint . getGivenVersion ( ) ) { if ( dependency . getVersionEvidence ( ) . getEvidence ( ) . contains ( given ) ) { matchFound = true ; break ; } } } if ( ! matchFound ) { for ( PropertyType pt : hint . getFilenames ( ) ) { if ( pt . matches ( dependency . getFileName ( ) ) ) { matchFound = true ; break ; } } } if ( matchFound ) { for ( Evidence e : hint . getAddVendor ( ) ) { dependency . getVendorEvidence ( ) . addEvidence ( e ) ; } for ( Evidence e : hint . getAddProduct ( ) ) { dependency . getProductEvidence ( ) . addEvidence ( e ) ; } for ( Evidence e : hint . getAddVersion ( ) ) { dependency . getVersionEvidence ( ) . addEvidence ( e ) ; } for ( Evidence e : hint . getRemoveVendor ( ) ) { if ( dependency . getVendorEvidence ( ) . getEvidence ( ) . contains ( e ) ) { dependency . getVendorEvidence ( ) . getEvidence ( ) . remove ( e ) ; } } for ( Evidence e : hint . getRemoveProduct ( ) ) { if ( dependency . getProductEvidence ( ) . getEvidence ( ) . contains ( e ) ) { dependency . getProductEvidence ( ) . getEvidence ( ) . remove ( e ) ; } } for ( Evidence e : hint . getRemoveVersion ( ) ) { if ( dependency . getVersionEvidence ( ) . getEvidence ( ) . contains ( e ) ) { dependency . getVersionEvidence ( ) . getEvidence ( ) . remove ( e ) ; } } } } final Iterator < Evidence > itr = dependency . getVendorEvidence ( ) . iterator ( ) ; final List < Evidence > newEntries = new ArrayList < > ( ) ; while ( itr . hasNext ( ) ) { final Evidence e = itr . next ( ) ; for ( VendorDuplicatingHintRule dhr : hints . getVendorDuplicatingHintRules ( ) ) { if ( dhr . getValue ( ) . equalsIgnoreCase ( e . getValue ( false ) ) ) { newEntries . add ( new Evidence ( e . getSource ( ) + " (hint)" , e . getName ( ) , dhr . getDuplicate ( ) , e . getConfidence ( ) ) ) ; } } } for ( Evidence e : newEntries ) { dependency . getVendorEvidence ( ) . addEvidence ( e ) ; } }
The HintAnalyzer uses knowledge about a dependency to add additional
 information to help in identification of identifiers or vulnerabilities.
The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of identifiers or vulnerabilities .