Skip to content

Commit 0901493

Browse files
chadlwilsonchadlwilson
authored
fix(fp): allow stricter matching of suppression CPE 2.2 URI prefixes to only whole parts (#8548)
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
1 parent 8ed81d0 commit 0901493

7 files changed

Lines changed: 243 additions & 562 deletions

File tree

‎core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,17 @@
1717
*/
1818
package org.owasp.dependencycheck.xml.hints;
1919

20-
import java.util.ArrayList;
21-
import java.util.List;
22-
import javax.annotation.concurrent.NotThreadSafe;
2320
import org.owasp.dependencycheck.dependency.Confidence;
2421
import org.owasp.dependencycheck.utils.XmlUtils;
2522
import org.owasp.dependencycheck.xml.suppression.PropertyType;
2623
import org.xml.sax.Attributes;
2724
import org.xml.sax.SAXException;
2825
import org.xml.sax.helpers.DefaultHandler;
2926

27+
import javax.annotation.concurrent.NotThreadSafe;
28+
import java.util.ArrayList;
29+
import java.util.List;
30+
3031
/**
3132
* A handler to load hint rules.
3233
*
@@ -268,19 +269,19 @@ public void startElement(String uri, String localName, String qName, Attributes
268269
}
269270
break;
270271
case FILE_NAME:
271-
final PropertyType pt = new PropertyType();
272-
pt.setValue(attr.getValue(CONTAINS));
272+
boolean isRegex = false;
273+
boolean isCaseSensitive = false;
273274
if (attr.getLength() > 0) {
274275
final String regex = attr.getValue(REGEX);
275276
if (regex != null) {
276-
pt.setRegex(Boolean.parseBoolean(regex));
277+
isRegex = Boolean.parseBoolean(regex);
277278
}
278279
final String caseSensitive = attr.getValue(CASE_SENSITIVE);
279280
if (caseSensitive != null) {
280-
pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
281+
isCaseSensitive = Boolean.parseBoolean(caseSensitive);
281282
}
282283
}
283-
rule.addFilename(pt);
284+
rule.addFilename(new PropertyType(attr.getValue(CONTAINS), isRegex, isCaseSensitive));
284285
break;
285286
case VENDOR_DUPLICATING_RULE:
286287
vendorDuplicatingHintRules.add(new VendorDuplicatingHintRule(attr.getValue(VALUE), attr.getValue(DUPLICATE)));

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/PropertyType.java‎

Lines changed: 38 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,13 @@
1717
*/
1818
package org.owasp.dependencycheck.xml.suppression;
1919

20+
import com.google.common.base.Suppliers;
2021
import org.apache.commons.lang3.builder.EqualsBuilder;
2122
import org.apache.commons.lang3.builder.HashCodeBuilder;
2223

23-
import java.util.regex.Pattern;
2424
import javax.annotation.concurrent.ThreadSafe;
25+
import java.util.function.Supplier;
26+
import java.util.regex.Pattern;
2527

2628
/**
2729
* A simple PropertyType used to represent a string value that could be used as
@@ -37,32 +39,53 @@ public class PropertyType {
3739
/**
3840
* The value.
3941
*/
40-
private String value;
42+
private final String value;
4143
/**
4244
* Whether or not the expression is a regex.
4345
*/
44-
private boolean regex = false;
46+
private final boolean regex;
4547
/**
4648
* Indicates case sensitivity.
4749
*/
48-
private boolean caseSensitive = false;
50+
private final boolean caseSensitive;
51+
52+
private final Supplier<Pattern> compiledRegex = Suppliers
53+
.memoize(() -> isRegex() ? Pattern.compile(getValue(), isCaseSensitive() ? 0 : Pattern.CASE_INSENSITIVE) : null);
4954

5055
/**
51-
* Gets the value of the value property.
52-
*
53-
* @return the value of the value property
56+
* @param value the value of the value property
57+
* @param regex whether the value is a regex
58+
* @param caseSensitive whether the value is case-sensitive
5459
*/
55-
public String getValue() {
56-
return value;
60+
public PropertyType(String value, boolean regex, boolean caseSensitive) {
61+
this.value = value;
62+
this.regex = regex;
63+
this.caseSensitive = caseSensitive;
64+
}
65+
66+
public static PropertyType of(String value) {
67+
return new PropertyType(value, false, false);
68+
}
69+
70+
public static PropertyType regex(String value) {
71+
return new PropertyType(value, true, false);
72+
}
73+
74+
public static PropertyType caseSensitive(String value) {
75+
return new PropertyType(value, false, true);
76+
}
77+
78+
public static PropertyType regexCaseSensitive(String value) {
79+
return new PropertyType(value, true, true);
5780
}
5881

5982
/**
60-
* Sets the value of the value property.
83+
* Gets the value of the value property.
6184
*
62-
* @param value the value of the value property
85+
* @return the value of the value property
6386
*/
64-
public void setValue(String value) {
65-
this.value = value;
87+
public String getValue() {
88+
return value;
6689
}
6790

6891
/**
@@ -74,32 +97,14 @@ public boolean isRegex() {
7497
return regex;
7598
}
7699

77-
/**
78-
* Sets whether the value property is a regex.
79-
*
80-
* @param value true if the value is a regex, otherwise false
81-
*/
82-
public void setRegex(boolean value) {
83-
this.regex = value;
84-
}
85-
86100
/**
87101
* Gets the value of the caseSensitive property.
88102
*
89-
* @return true if the value is case sensitive
103+
* @return true if the value is case-sensitive
90104
*/
91105
public boolean isCaseSensitive() {
92106
return caseSensitive;
93107
}
94-
95-
/**
96-
* Sets the value of the caseSensitive property.
97-
*
98-
* @param value whether the value is case sensitive
99-
*/
100-
public void setCaseSensitive(boolean value) {
101-
this.caseSensitive = value;
102-
}
103108
//</editor-fold>
104109

105110
/**
@@ -114,13 +119,7 @@ public boolean matches(String text) {
114119
return false;
115120
}
116121
if (this.regex) {
117-
final Pattern rx;
118-
if (this.caseSensitive) {
119-
rx = Pattern.compile(this.value);
120-
} else {
121-
rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE);
122-
}
123-
return rx.matcher(text).matches();
122+
return compiledRegex.get().matcher(text).matches();
124123
} else {
125124
if (this.caseSensitive) {
126125
return value.equals(text);

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,6 @@
1717
*/
1818
package org.owasp.dependencycheck.xml.suppression;
1919

20-
import java.util.ArrayList;
21-
import java.util.Calendar;
22-
import java.util.List;
23-
import java.util.Optional;
24-
import javax.annotation.concurrent.NotThreadSafe;
2520
import org.owasp.dependencycheck.exception.ParseException;
2621
import org.owasp.dependencycheck.utils.DateUtil;
2722
import org.slf4j.Logger;
@@ -30,6 +25,12 @@
3025
import org.xml.sax.SAXException;
3126
import org.xml.sax.helpers.DefaultHandler;
3227

28+
import javax.annotation.concurrent.NotThreadSafe;
29+
import java.util.ArrayList;
30+
import java.util.Calendar;
31+
import java.util.List;
32+
import java.util.Optional;
33+
3334
/**
3435
* A handler to load suppression rules. In the input xml a suppression rule can be part of a {@code suppressionGroup}. In that
3536
* case the attributes set on group element will act as default values for child suppressions.
@@ -282,18 +283,18 @@ public void characters(char[] ch, int start, int length) throws SAXException {
282283
* @return a PropertyType object
283284
*/
284285
private PropertyType processPropertyType() {
285-
final PropertyType pt = new PropertyType();
286-
pt.setValue(currentText.toString().trim());
286+
boolean isRegex = false;
287+
boolean isCaseSensitive = false;
287288
if (currentAttributes != null && currentAttributes.getLength() > 0) {
288289
final String regex = currentAttributes.getValue("regex");
289290
if (regex != null) {
290-
pt.setRegex(Boolean.parseBoolean(regex));
291+
isRegex = Boolean.parseBoolean(regex);
291292
}
292293
final String caseSensitive = currentAttributes.getValue("caseSensitive");
293294
if (caseSensitive != null) {
294-
pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
295+
isCaseSensitive = Boolean.parseBoolean(caseSensitive);
295296
}
296297
}
297-
return pt;
298+
return new PropertyType(currentText.toString().trim(), isRegex, isCaseSensitive);
298299
}
299300
}

0 commit comments

Comments
 (0)