dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java
/**
     * Analyzes a set of dependencies. If they have been found to be the same
     * dependency created by more multiple FileTypeAnalyzers (i.e. a gemspec
     * dependency and a dependency from the Bundle Audit Analyzer. The
     * dependencies are then merged into a single reportable item.
     *
     * @param ignore this analyzer ignores the dependency being analyzed
     * @param engine the engine that is scanning the dependencies
     * @throws AnalysisException is thrown if there is an error reading the JAR
     * file.
     */
Analyzes a set of dependencies. If they have been found to be the same
dependency created by more multiple FileTypeAnalyzers (i.e. a gemspec
dependency and a dependency from the Bundle Audit Analyzer. The
dependencies are then merged into a single reportable item.

@param ignore this analyzer ignores the dependency being analyzed
@param engine the engine that is scanning the dependencies
@throws AnalysisException is thrown if there is an error reading the JAR
file.
Analyzes a set of dependencies . If they have been found to be the same dependency created by more multiple FileTypeAnalyzers ( i . e . a gemspec dependency and a dependency from the Bundle Audit Analyzer . The dependencies are then merged into a single reportable item . @param ignore this analyzer ignores the dependency being analyzed @param engine the engine that is scanning the dependencies @throws AnalysisException is thrown if there is an error reading the JAR file .
@Override
    protected synchronized void analyzeDependency(Dependency ignore, Engine engine) throws AnalysisException {
        if (!analyzed) {
            analyzed = true;
            final Set<Dependency> dependenciesToRemove = new HashSet<>();
            final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
            while (mainIterator.hasNext()) {
                final Dependency dependency = mainIterator.next();
                if (mainIterator.hasNext() && !dependenciesToRemove.contains(dependency)) {
                    final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
                    while (subIterator.hasNext()) {
                        final Dependency nextDependency = subIterator.next();
                        Dependency main;
                        if ((main = getMainGemspecDependency(dependency, nextDependency)) != null) {
                            if (main == dependency) {
                                mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                            } else {
                                mergeDependencies(nextDependency, dependency, dependenciesToRemove);
                                break; 
                            }
                        } else if ((main = getMainSwiftDependency(dependency, nextDependency)) != null) {
                            if (main == dependency) {
                                mergeDependencies(dependency, nextDependency, dependenciesToRemove);
                            } else {
                                mergeDependencies(nextDependency, dependency, dependenciesToRemove);
                                break; 
                            }
                        }
                    }
                }
            }
            engine.getDependencies().removeAll(dependenciesToRemove);
        }
    }
@ Override protected synchronized void analyzeDependency ( Dependency ignore , Engine engine ) throws AnalysisException { if ( ! analyzed ) { analyzed = true ; final Set < Dependency > dependenciesToRemove = new HashSet < > ( ) ; final ListIterator < Dependency > mainIterator = engine . getDependencies ( ) . listIterator ( ) ; while ( mainIterator . hasNext ( ) ) { final Dependency dependency = mainIterator . next ( ) ; if ( mainIterator . hasNext ( ) && ! dependenciesToRemove . contains ( dependency ) ) { final ListIterator < Dependency > subIterator = engine . getDependencies ( ) . listIterator ( mainIterator . nextIndex ( ) ) ; while ( subIterator . hasNext ( ) ) { final Dependency nextDependency = subIterator . next ( ) ; Dependency main ; if ( ( main = getMainGemspecDependency ( dependency , nextDependency ) ) != null ) { if ( main == dependency ) { mergeDependencies ( dependency , nextDependency , dependenciesToRemove ) ; } else { mergeDependencies ( nextDependency , dependency , dependenciesToRemove ) ; break ; } } else if ( ( main = getMainSwiftDependency ( dependency , nextDependency ) ) != null ) { if ( main == dependency ) { mergeDependencies ( dependency , nextDependency , dependenciesToRemove ) ; } else { mergeDependencies ( nextDependency , dependency , dependenciesToRemove ) ; break ; } } } } } engine . getDependencies ( ) . removeAll ( dependenciesToRemove ) ; } }
Analyzes a set of dependencies.
Analyzes a set of dependencies .
//for (Dependency nextDependency : engine.getDependencies()) { //since we merged into the next dependency - skip forward to the next in mainIterator //since we merged into the next dependency - skip forward to the next in mainIterator //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions // was difficult because of the inner iterator.