dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java
/**
     * Collects information about the file name.
     *
     * @param dependency the dependency to analyze.
     * @param engine the engine that is scanning the dependencies
     * @throws AnalysisException is thrown if there is an error reading the JAR
     * file.
     */
Collects information about the file name.
@param dependency the dependency to analyze.
@param engine the engine that is scanning the dependencies
@throws AnalysisException is thrown if there is an error reading the JAR
file.
Collects information about the file name . @param dependency the dependency to analyze . @param engine the engine that is scanning the dependencies @throws AnalysisException is thrown if there is an error reading the JAR file .
@Override
    protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
        final File f = dependency.getActualFile();
        final String fileName = FilenameUtils.removeExtension(f.getName());
        final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
        final String packageName = DependencyVersionUtil.parsePreVersion(fileName);
        if (version != null) {
            if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
                dependency.getVersionEvidence().addEvidence("file", "version",
                        version.toString(), Confidence.MEDIUM);
            } else {
                dependency.getVersionEvidence().addEvidence("file", "version",
                        version.toString(), Confidence.HIGHEST);
            }
            dependency.getVersionEvidence().addEvidence("file", "name",
                    packageName, Confidence.MEDIUM);
        }
        if (!IGNORED_FILES.accept(f)) {
            dependency.getProductEvidence().addEvidence("file", "name",
                    packageName, Confidence.HIGH);
            dependency.getVendorEvidence().addEvidence("file", "name",
                    packageName, Confidence.HIGH);
        }
    }
@ Override protected void analyzeDependency ( Dependency dependency , Engine engine ) throws AnalysisException { final File f = dependency . getActualFile ( ) ; final String fileName = FilenameUtils . removeExtension ( f . getName ( ) ) ; final DependencyVersion version = DependencyVersionUtil . parseVersion ( fileName ) ; final String packageName = DependencyVersionUtil . parsePreVersion ( fileName ) ; if ( version != null ) { if ( version . getVersionParts ( ) == null || version . getVersionParts ( ) . size ( ) < 2 ) { dependency . getVersionEvidence ( ) . addEvidence ( "file" , "version" , version . toString ( ) , Confidence . MEDIUM ) ; } else { dependency . getVersionEvidence ( ) . addEvidence ( "file" , "version" , version . toString ( ) , Confidence . HIGHEST ) ; } dependency . getVersionEvidence ( ) . addEvidence ( "file" , "name" , packageName , Confidence . MEDIUM ) ; } if ( ! IGNORED_FILES . accept ( f ) ) { dependency . getProductEvidence ( ) . addEvidence ( "file" , "name" , packageName , Confidence . HIGH ) ; dependency . getVendorEvidence ( ) . addEvidence ( "file" , "name" , packageName , Confidence . HIGH ) ; } }
Collects information about the file name.
Collects information about the file name .
//strip any path information that may get added by ArchiveAnalyzer, etc. //add version evidence // If the version number is just a number like 2 or 23, reduce the confidence // a shade. This should hopefully correct for cases like log4j.jar or // struts2-core.jar