Validates the path to point at an existing file. @param path the path to validate if it exists @param argumentName the argument being validated (e.g.

Validates the format to be one of the known Formats. @param format the format to validate @return true, if format is known in Format; false otherwise

Returns the value of vulnerable. @return the value of vulnerable

Determines if the character is whitespace. @param ch the character to check @return true if the character is whitespace; otherwise false

Returns true if the disableYarnAudit command line argument was specified. @return true if the disableYarnAudit command line argument was specified; o

Attempts to read the first bytes of the given dependency (using its actual file path) and returns true if they match the expected first bytes of a zip

Attempts to determine if a zip file is actually a JAR file. @param dependency the dependency to check @return true if the dependency appears to be a

Launches `go list -json -m -mod=readonly all` in the given folder. @param folder the working folder @return a reference to the launched process @thro

Analyzes the package and package-lock files by extracting dependency information, creating a payload to submit to the npm audit API, submitting the pa

Loads the analyzers specified in the configuration file (or system properties).

Load the hosted suppression file from the web resource @param parser The suppressionParser to use for loading @param repoFile The cached web resource

Loads a HashMap containing the CWE data from a resource found in the jar. @return a HashMap of CWE data

Attempts to load the `Directory.Build.props` file. @param directory the project directory. @return the properties from the Directory.Build.props. @th

Loads the hint rules file. @throws HintParseException thrown if the XML cannot be parsed.

Loads all the base suppression rules from the hosted suppression file generated/updated automatically by the FP Suppression GitHub Action for approved

Loads the suppression rules packaged with the application. @param parser The suppression parser to use @param engine a reference the dependency-check

Loads all the base suppression rules files. @param engine a reference the dependency-check engine @throws SuppressionParseException thrown if the XML

Loads all the suppression rules files configured in the {@link Settings}. @param engine a reference to the ODC engine. @throws SuppressionParseExcept

Load a single suppression rules file from the path provided using the parser provided. @param parser the parser to use for loading the file @param su

Obtains a lock on the resource. @throws WriteLockException thrown if a lock could not be obtained

Hacky method of muting the noisy logging from certain libraries.

Determine if the dependency name is equal in the given dependencies. @param dependency a dependency to compare @param nextDependency a dependency to

Checks if a package lock file or equivalent exists for the NPM project. @param dependencyFile a reference to the `package.json` file @return <code>tr

Returns the number of CPE entries stored in the index. @return the number of CPE entries stored in the index

Opens the data source. @param cve a reference to the NVD CVE database @throws IOException when the Lucene directory to be queried does not exist or i

Opens the database connection pool.

Parses the given stream for MSBuild PackageReference elements. @param stream the input stream to parse @param props the Directory.Build.props propert

Parse an input stream and return the resulting {@link NugetPackage}. @param stream the input stream to parse @return the populated bean @throws Nuget

Parses the given stream for Directory.Packages.props elements. @param stream the input stream to parse @param props the Directory.Build.props propert

Parse the properties from the `Directory.Build.props` file InputStream.If any import nodes are found while parsing, the values will be available via `

Parses the advisory from Node Audit. @param object the JSON object containing the advisory @return the Advisory object @throws org.json.JSONException

Parses the command line arguments. @param args the command line arguments @return the results of parsing the command line arguments @throws ParseExce

Helper method to convert a CpeMatch (generated code used in parsing the NVD JSON) into a CPE object. @param cpe the CPE Match @param cveId the CVE as

Parses the configuration entries from the CVE entry into a list of VulnerableSoftware objects. @param cve the CVE to parse the vulnerable software en

<p> Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.</p> <p> Example:</p> <code>nbsp;nbsp;nbsp;cpe:/a:a

Parses the given string into a Lucene Query. @param searchString the search text @return the Query object @throws ParseException thrown if the search

Parse text. @param text The text @param processor A processor which handles the output

Determines whether the object passes the filter. @param object the object to test @return whether or not the object passes the filter

Tests is the artifact should be included in the scan (i.e. is the dependency in a scope that is being scanned). @param scope the scope of the artifac

Persist the EcosystemCache into the database.

Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system properties required to change the proxy se

Creates the CPE Lucene Index. @param engine a reference to the dependency-check engine @throws InitializationException is thrown if there is an issue

Prepares a given Analyzer. This will be skipped if the analyzer is disabled. @param engine a reference to the dependency-check engine @throws Initial

Prepares the file type analyzer for dependency analysis. @param engine a reference to the dependency-check engine @throws InitializationException thr

Performs validation on the configuration to ensure that the correct analyzers are in place. @param engine the dependency-check engine @throws Initial

Creates a file appender and adds it to logback. @param verboseLog the path to the verbose log file

Reformats the given JSON file. @param pathToJson the path to the JSON file to be reformatted @throws ReportException thrown if the given JSON file is

Reformats the given XML file. @param path the path to the XML file to be reformatted

Prints the stack trace. @param s the writer to print to

Process the dependencies in the lock file by first parsing its dependencies and then finding the package.json for the module and adding it as a depend

Processes the mix audit output. @param rdr the reader of the report @throws AnalysisException thrown if an analysis error occurred @throws CpeValidat

If necessary, downloads the pom.xml from Central and adds the evidence to the dependency. @param dependency the dependency to download and process th

Determines if the cpeEntry specified as a PropertyType matches the given Identifier. @param suppressionEntry a suppression rule entry @param identifi

Duplicates {@link PE#read(IDataReader)} with added error handling to swallow EOFExceptions to be more lenient for certain file sections. @see PE#read(

Deal with an ampersand in the stream. @throws IOException thrown if an unknown entity is encountered

Reads the CWE data from the array of files. @param files the array of files to parse @return a map of the CWE data

Duplicates {@link PE#readDebugRawData(PE, DataEntry, IDataReader)} since it is private. @see PE#readDebugRawData(PE, DataEntry, IDataReader)

Might not actually push back anything but usually will. @return true if at end-of-file @throws IOException thrown if there is an IO exception in the

Reads the first line from the lock file and returns the results as a string. @return the first line from the lock file; or null if the contents could

Releases the resources used by CveDB.

Used within the unit tests to reload the database properties. @return the database properties

Removes duplicate entries identified that are contained within JAR files. These occasionally crop up due to POM entries or other types of files (such

Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar @param dependency the dependency to remove JRE CPEs from

Removes the given vulnerability from the list. @param v the vulnerability to remove

Removes the specified vulnerableSoftware from the collection. @param vulnerableSoftware a collection of vulnerable software to be removed

Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. @param dependency the dependency to analyze

Evaluates if the vulnerability is already present; if it is the vulnerability is not added. @param dependency a reference to the dependency being ana

Evaluates if the vulnerability is already present; if it is the vulnerability is not added. @param dependency a reference to the dependency being ana

Delays each request (thread) by the configured amount of seconds, if the configuration is present.

Batch request component-reports for all dependencies. @param dependencies the collection of dependencies @return the map of dependency to OSS Index's

Resets the Vulnerable Software Builder to a clean state.