An OWASP dependency-check plug-in example. If you are not implementing a FileTypeAnalyzer, simple remove the annotation and the accept() method.

Test cases for ${analyzerName}

A collection of static final strings that represent the possible command line arguments.

Base class for analyzers to avoid code duplication of prepare and close as most analyzers do not need these methods. @author Jeremy Long

<p> This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are grouped. An example would be Sprin

The base FileTypeAnalyzer that all analyzers that have specific file types they analyze should extend. @author Jeremy Long

@author Jeremy Long

<p> An in memory Lucene index that contains the vendor/product combinations from the CPE (application) identifiers within the NVD CVE data.</p> This

An abstract NPM analyzer that contains common methods for concrete implementations. @author Steve Springett

@author jeremy long

Abstract base suppression analyzer that contains methods for parsing the suppression XML file. @author Jeremy Long

@author Jeremy Long

An abstract tokenizing filter that can be used as the base for a tokenizing filter. @author Jeremy Long

The response from NPM Audit API will respond with 0 or more advisories. This class defines the Advisory objects returned. @author Steve Springett

Maven Plugin that checks project dependencies and the dependencies of all child modules to see if they have any known published vulnerabilities. @aut

A simple alphanumeric filter that removes non-alphanumeric characters from the terms. If a term contains a non-alphanumeric character it may be split

@author Jeremy Long

An exception thrown when the analysis of a dependency fails. @author Jeremy Long

An enumeration defining the phases of analysis. @author Jeremy Long

Task to support parallelism of dependency-check analysis. Analysis a single {@link Dependency} by a specific {@link Analyzer}. @author Stefan Neuhaus

<p> An interface that defines an Analyzer that is used to identify Dependencies. An analyzer will collect information about the dependency in the form

The Analyzer Service Loader. This class loads all services that implement {@link org.owasp.dependencycheck.analyzer.Analyzer}. @author Jeremy Long

@author Jeremy Long

An instance of {@link org.slf4j.Logger} which simply calls the log method on the current Ant task obtained from {@link AntTaskHolder}. @author colezl

An implementation of {@link org.slf4j.ILoggerFactory} which always returns {@link AntLoggerAdapter} instances. @author colezlaw

SLF4J 2.0 service provider for the dependency-check Ant integration. Replaces the old StaticLoggerBinder mechanism used in SLF4J 1.x.

Tests that the {@link AntSlf4jServiceProvider} is discoverable via the {@link ServiceLoader} mechanism and that log output is routed through the Ant t

Holds a reference to the current Ant Task for logging. Replaces the old StaticLoggerBinder singleton pattern used with SLF4J 1.x. <p> Uses ThreadLocal

Utility application to process and serialize the CWE data. This class should be used with the 'research concepts' view from https://cwe.mitre.org/data

The command line interface for the DependencyCheck application. @author Jeremy Long

Tests for the {@link AppTest} class.

<p> An analyzer that extracts files from archives and ensures any supported files contained within the archive are added to the dependency list.</p>

@author Jeremy Long

@author jeremy long

An exception thrown when files in an archive cannot be extracted. @author Jeremy Long

Utility class to determine if an artifact should be excluded. @author Josh Cain

{@link Filter} implementation to exclude artifacts whose type matches a regular expression. @author ercpe

@author Jeremy Long

Analyzer which will attempt to locate a dependency, and the GAV information, by querying Artifactory for the dependency's hashes digest. @author nhen

Class of methods to search Artifactory for hashes and determine Maven GAV from there. <p>Data classes copied from JFrog's artifactory-client-java pro

Analyzer for getting company, product, and version information from a .NET assembly. @author colezlaw

Tests for the AssemblyAnalyzer. @author colezlaw

A simple collection of .NET assembly data as collected from GrokAssembly. @author Jeremy Long

Used to analyze Autoconf input files named configure.ac or configure.in. Files simply named "configure" are also analyzed, assuming they are generated

Unit tests for AutoconfAnalyzer. The test resources under autoconf/ were obtained from outside open source software projects. Links to those projects

An abstract database test case that is used to ensure the H2 DB exists prior to performing tests that utilize the data contained within. @author Jere

@author Jeremy Long

Implementation of ODC Mojo for testing.

@author Jeremy Long

@author Jeremy Long

@author Jeremy Long

@author Jeremy Long

@author Jeremy Long

Processor for the output of bundler-audit. @author Jeremy Long

<p> Used to analyze CMake build files, and collect information that can be used to determine the associated CPE.</p> <p> Note: This analyzer catches s

Unit tests for CmakeAnalyzer. @author Dale Visser

CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE. It uses the evidence contained w

@author Jeremy Long

@author jeremy long

The types of caches that can be instantiated.

Defines a data source who's data is retrieved from the Internet. This data can be downloaded and the local cache updated. @author Jeremy Long

This analyzer is used to analyze SWIFT and Objective-C packages by collecting information from Cartfile files. Carthage dependency manager see https:/

Analyzer which will attempt to locate a dependency, and the GAV information, by querying Central for the dependency's SHA-1 digest. @author colezlaw

Tests for the CentralAnalyzer.

Class of methods to search Maven Central via Central. @author colezlaw

Created by colezlaw on 10/13/14.

An Ant task definition to execute dependency-check during an Ant build. @author Jeremy Long

Maven Plugin that checks the project dependencies to see if they have any known published vulnerabilities. @author Jeremy Long

Includes methods to generate the MD5 and SHA1 checksum. @author Jeremy Long @version $Id: $Id

@author Jeremy Long

Copied from JFrog's artifactory client. @see <a href="https://github.com/jfrog/artifactory-client-java">artifactory-client-java</a> @author jbaruch

Stores information about a class name.

@author Jeremy Long

This analyzer is used to analyze SWIFT and Objective-C packages by collecting information from .podspec files. CocoaPods dependency manager see https:

@author Jeremy Long

Represents a dependency (GAV, right now) from a Composer dependency. @author colezlaw

Represents an exception when handling a composer.json or composer.lock file. Generally used to wrap a downstream exception. @author colezlaw

Used to analyze a composer.lock file for a composer PHP app. @author colezlaw

Unit tests for NodePackageAnalyzer. @author Dale Visser

Parses a Composer.lock file from an input stream. In a separate class so it can hopefully be injected. @author colezlaw

Created by colezlaw on 9/5/15.