Skip to content
This repository was archived by the owner on Sep 27, 2025. It is now read-only.

Commit b51921f

Browse files
jeremylongjeremylong
authored
fix: add product evidence as vendor to reduce FN (#7295)
1 parent ae8c06a commit b51921f

15 files changed

Lines changed: 32 additions & 2 deletions

‎core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,20 +284,24 @@ private void updateDependency(final AssemblyData data, Dependency dependency) {
284284

285285
if (!StringUtils.isBlank(data.getCompanyName())) {
286286
dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "CompanyName", data.getCompanyName(), Confidence.HIGHEST);
287+
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "CompanyName", data.getCompanyName(), Confidence.LOW);
287288
addMatchingValues(data.getNamespaces(), data.getCompanyName(), dependency, EvidenceType.VENDOR);
288289
}
289290
if (!StringUtils.isBlank(data.getProductName())) {
290291
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "ProductName", data.getProductName(), Confidence.HIGHEST);
292+
dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "ProductName", data.getProductName(), Confidence.MEDIUM);
291293
addMatchingValues(data.getNamespaces(), data.getProductName(), dependency, EvidenceType.PRODUCT);
292294
}
293295
if (!StringUtils.isBlank(data.getFileDescription())) {
294296
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "FileDescription", data.getFileDescription(), Confidence.HIGH);
297+
dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "FileDescription", data.getFileDescription(), Confidence.LOW);
295298
addMatchingValues(data.getNamespaces(), data.getFileDescription(), dependency, EvidenceType.PRODUCT);
296299
}
297300

298301
final String internalName = data.getInternalName();
299302
if (!StringUtils.isBlank(internalName)) {
300303
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "InternalName", internalName, Confidence.MEDIUM);
304+
dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "InternalName", internalName, Confidence.LOW);
301305
addMatchingValues(data.getNamespaces(), internalName, dependency, EvidenceType.PRODUCT);
302306
addMatchingValues(data.getNamespaces(), internalName, dependency, EvidenceType.VENDOR);
303307
if (dependency.getName() == null && StringUtils.containsIgnoreCase(dependency.getActualFile().getName(), internalName)) {
@@ -313,6 +317,7 @@ private void updateDependency(final AssemblyData data, Dependency dependency) {
313317
final String originalFilename = data.getOriginalFilename();
314318
if (!StringUtils.isBlank(originalFilename)) {
315319
dependency.addEvidence(EvidenceType.PRODUCT, "grokassembly", "OriginalFilename", originalFilename, Confidence.MEDIUM);
320+
dependency.addEvidence(EvidenceType.VENDOR, "grokassembly", "OriginalFilename", originalFilename, Confidence.LOW);
316321
addMatchingValues(data.getNamespaces(), originalFilename, dependency, EvidenceType.PRODUCT);
317322
if (dependency.getName() == null && StringUtils.containsIgnoreCase(dependency.getActualFile().getName(), originalFilename)) {
318323
final String ext = FileUtils.getFileExtension(originalFilename);

‎core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,12 +195,15 @@ private void extractConfigureScriptEvidence(Dependency dependency,
195195
if (!value.isEmpty()) {
196196
if (variable.endsWith("NAME")) {
197197
dependency.addEvidence(EvidenceType.PRODUCT, name, variable, value, Confidence.HIGHEST);
198+
dependency.addEvidence(EvidenceType.VENDOR, name, variable, value, Confidence.MEDIUM);
198199
} else if ("VERSION".equals(variable)) {
199200
dependency.addEvidence(EvidenceType.VERSION, name, variable, value, Confidence.HIGHEST);
200201
} else if ("BUGREPORT".equals(variable)) {
201202
dependency.addEvidence(EvidenceType.VENDOR, name, variable, value, Confidence.HIGH);
203+
dependency.addEvidence(EvidenceType.PRODUCT, name, variable, value, Confidence.MEDIUM);
202204
} else if ("URL".equals(variable)) {
203205
dependency.addEvidence(EvidenceType.VENDOR, name, variable, value, Confidence.HIGH);
206+
dependency.addEvidence(EvidenceType.PRODUCT, name, variable, value, Confidence.MEDIUM);
204207
}
205208
}
206209
}

‎core/src/main/java/org/owasp/dependencycheck/analyzer/CocoaPodsAnalyzer.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,7 @@ private void analyzePodspecDependency(Dependency dependency)
260260
final String summary = determineEvidence(contents, blockVariable, "summary");
261261
if (!summary.isEmpty()) {
262262
dependency.addEvidence(EvidenceType.PRODUCT, PODSPEC, "summary", summary, Confidence.HIGHEST);
263+
dependency.addEvidence(EvidenceType.VENDOR, PODSPEC, "summary", summary, Confidence.MEDIUM);
263264
}
264265

265266
final String author = determineEvidence(contents, blockVariable, "authors?");
@@ -269,6 +270,7 @@ private void analyzePodspecDependency(Dependency dependency)
269270
final String homepage = determineEvidence(contents, blockVariable, "homepage");
270271
if (!homepage.isEmpty()) {
271272
dependency.addEvidence(EvidenceType.VENDOR, PODSPEC, "homepage", homepage, Confidence.HIGHEST);
273+
dependency.addEvidence(EvidenceType.PRODUCT, PODSPEC, "homepage", homepage, Confidence.LOW);
272274
}
273275
final String license = determineEvidence(contents, blockVariable, "licen[cs]es?");
274276
if (!license.isEmpty()) {

‎core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,9 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
133133
d.setSha256sum(Checksum.getSHA256Checksum(filePath));
134134
d.setMd5sum(Checksum.getMD5Checksum(filePath));
135135
d.addEvidence(EvidenceType.VENDOR, COMPOSER_LOCK, "vendor", dep.getGroup(), Confidence.HIGHEST);
136+
d.addEvidence(EvidenceType.PRODUCT, COMPOSER_LOCK, "vendor", dep.getGroup(), Confidence.MEDIUM);
136137
d.addEvidence(EvidenceType.PRODUCT, COMPOSER_LOCK, "product", dep.getProject(), Confidence.HIGHEST);
138+
d.addEvidence(EvidenceType.VENDOR, COMPOSER_LOCK, "product", dep.getProject(), Confidence.HIGH);
137139
d.addEvidence(EvidenceType.VERSION, COMPOSER_LOCK, "version", dep.getVersion(), Confidence.HIGHEST);
138140
return d;
139141
}).forEach((d) -> {

‎core/src/main/java/org/owasp/dependencycheck/analyzer/LibmanAnalyzer.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,10 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
208208
child.setName(name);
209209
child.setVersion(version);
210210

211-
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", (vendor != null ? vendor : name),
212-
Confidence.HIGHEST);
211+
if (vendor != null) {
212+
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "vendor", vendor, Confidence.HIGHEST);
213+
}
214+
child.addEvidence(EvidenceType.VENDOR, FILE_NAME, "name", name, Confidence.HIGH);
213215
child.addEvidence(EvidenceType.PRODUCT, FILE_NAME, "name", name, Confidence.HIGHEST);
214216
child.addEvidence(EvidenceType.VERSION, FILE_NAME, "version", version, Confidence.HIGHEST);
215217

‎core/src/main/java/org/owasp/dependencycheck/analyzer/MSBuildProjectAnalyzer.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
185185
child.setMd5sum(Checksum.getMD5Checksum(String.format("%s:%s", id, version)));
186186

187187
child.addEvidence(EvidenceType.PRODUCT, "msbuild", "id", id, Confidence.HIGHEST);
188+
child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", id, Confidence.MEDIUM);
188189
child.addEvidence(EvidenceType.VERSION, "msbuild", "version", version, Confidence.HIGHEST);
189190

190191
if (id.indexOf('.') > 0) {
@@ -193,10 +194,12 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
193194
// example: Microsoft.EntityFrameworkCore
194195
child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", parts[0], Confidence.MEDIUM);
195196
child.addEvidence(EvidenceType.PRODUCT, "msbuild", "id", parts[1], Confidence.MEDIUM);
197+
child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", parts[1], Confidence.LOW);
196198

197199
if (parts.length > 2) {
198200
final String rest = id.substring(id.indexOf('.') + 1);
199201
child.addEvidence(EvidenceType.PRODUCT, "msbuild", "id", rest, Confidence.MEDIUM);
202+
child.addEvidence(EvidenceType.VENDOR, "msbuild", "id", rest, Confidence.LOW);
200203
}
201204
} else {
202205
// example: jQuery

‎core/src/main/java/org/owasp/dependencycheck/analyzer/NugetconfAnalyzer.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
182182
child.setMd5sum(Checksum.getMD5Checksum(String.format("%s:%s", id, version)));
183183
child.addEvidence(EvidenceType.VERSION, "packages.config", "version", np.getVersion(), Confidence.HIGHEST);
184184
child.addEvidence(EvidenceType.PRODUCT, "packages.config", "id", np.getId(), Confidence.HIGHEST);
185+
child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", np.getId(), Confidence.MEDIUM);
185186

186187
// handle package names the same way as the MSBuild analyzer
187188
if (id.indexOf('.') > 0) {
@@ -190,10 +191,12 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
190191
// example: Microsoft.EntityFrameworkCore
191192
child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", parts[0], Confidence.MEDIUM);
192193
child.addEvidence(EvidenceType.PRODUCT, "packages.config", "id", parts[1], Confidence.MEDIUM);
194+
child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", parts[1], Confidence.LOW);
193195

194196
if (parts.length > 2) {
195197
final String rest = id.substring(id.indexOf('.') + 1);
196198
child.addEvidence(EvidenceType.PRODUCT, "packages.config", "id", rest, Confidence.MEDIUM);
199+
child.addEvidence(EvidenceType.VENDOR, "packages.config", "id", rest, Confidence.LOW);
197200
}
198201
} else {
199202
// example: jQuery

‎core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
158158
dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "authors", np.getAuthors(), Confidence.HIGH);
159159
dependency.addEvidence(EvidenceType.VERSION, "nuspec", "version", np.getVersion(), Confidence.HIGHEST);
160160
dependency.addEvidence(EvidenceType.PRODUCT, "nuspec", "id", np.getId(), Confidence.HIGHEST);
161+
dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "id", np.getId(), Confidence.HIGH);
161162
dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "description", np.getDescription(), Confidence.LOW);
162163
dependency.addEvidence(EvidenceType.PRODUCT, "nuspec", "description", np.getDescription(), Confidence.LOW);
163164
dependency.setName(np.getId());
@@ -178,6 +179,7 @@ public void analyzeDependency(Dependency dependency, Engine engine) throws Analy
178179
}
179180
if (np.getTitle() != null) {
180181
dependency.addEvidence(EvidenceType.PRODUCT, "nuspec", "title", np.getTitle(), Confidence.MEDIUM);
182+
dependency.addEvidence(EvidenceType.VENDOR, "nuspec", "title", np.getTitle(), Confidence.LOW);
181183
}
182184
} catch (Throwable e) {
183185
throw new AnalysisException(e);

‎core/src/main/java/org/owasp/dependencycheck/analyzer/PEAnalyzer.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ protected void analyzeDependency(final Dependency dependency, final Engine engin
185185
break;
186186
case "InternalName":
187187
dependency.addEvidence(EvidenceType.PRODUCT, "PE Header", "InternalName", value, Confidence.MEDIUM);
188+
dependency.addEvidence(EvidenceType.VENDOR, "PE Header", "InternalName", value, Confidence.LOW);
188189
determineDependencyName(dependency, value);
189190
break;
190191
case "LegalCopyright":
@@ -201,6 +202,7 @@ protected void analyzeDependency(final Dependency dependency, final Engine engin
201202
break;
202203
case "ProductName":
203204
dependency.addEvidence(EvidenceType.PRODUCT, "PE Header", "ProductName", value, Confidence.HIGHEST);
205+
dependency.addEvidence(EvidenceType.VENDOR, "PE Header", "ProductName", value, Confidence.MEDIUM);
204206
determineDependencyName(dependency, value);
205207
break;
206208
default:

‎core/src/main/java/org/owasp/dependencycheck/analyzer/PinnedMavenInstallAnalyzer.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@ protected void analyzeDependency(Dependency dependency, Engine engine) throws An
207207
d.setEcosystem(Ecosystem.JAVA);
208208
d.addEvidence(EvidenceType.VENDOR, "project", "groupid", group, Confidence.HIGHEST);
209209
d.addEvidence(EvidenceType.PRODUCT, "project", "artifactid", artifact, Confidence.HIGHEST);
210+
d.addEvidence(EvidenceType.VENDOR, "project", "artifactid", artifact, Confidence.HIGH);
210211
d.addEvidence(EvidenceType.VERSION, "project", "version", version, Confidence.HIGHEST);
211212
d.setName(String.format("%s:%s", group, artifact));
212213
d.setFilePath(String.format("%s>>%s", dependency.getActualFile(), dep.getCoord()));

0 commit comments

Comments
 (0)