Improve Spring Support

[jeremylong]

The Spring Framework is bad about including vendor information in their manifest. There are a few "a priori" items of evidence added to aid in the detection of the Spring Framework. This is currently in the JAR Analyzer and should be moved to a PRE_IDENTIFIER_ANALYSIS Analyzer.

Additionally, the SpringCleaner Analyzer should be cleaned up to use regular expressions rather then the two hard-coded partial CPE Strings.

[jeremylong]

The hints regarding the spring framework have been removed from the JarAnalyzer and have been placed into the HintAnalyzer.

The SpringCleanerAnalyzer has been cleaned up, made generic, and is now the DependencyBundlingAnalyzer and FalsePositiveAnalyzer.

[CorduroyCordova]

I seem to have an issue where Spring Security Core is being mis-identified as Spring Core and generating false positives, for Jenkins plugin v1.2.1:

Example:
...
spring-aop-3.2.8.RELEASE.jar
spring-beans-3.2.8.RELEASE.jar
spring-context-3.2.8.RELEASE.jar
spring-context-support-3.2.8.RELEASE.jar
spring-core-3.2.8.RELEASE.jar
spring-expression-3.2.8.RELEASE.jar
spring-jdbc-3.2.8.RELEASE.jar
spring-jms-3.2.8.RELEASE.jar
spring-security-core-3.2.3.RELEASE.jar

spring-security-acl-3.2.3.RELEASE.jar
spring-security-config-3.2.3.RELEASE.jar
spring-security-taglibs-3.2.3.RELEASE.jar

spring-security-web-3.2.3.RELEASE.jar
spring-tx-3.2.8.RELEASE.jar
spring-web-3.2.8.RELEASE.jar
spring-webmvc-3.2.8.RELEASE.jar
...
jenkins/workspace/xxxxxx_test/runtime-libraries/spring-security-core-3.2.3.RELEASE.jar
cpe: cpe:/a:springsource:spring_framework:3.2.3 Confidence:HIGHEST

Is this an artifact of the way this issue was closed? Should I create a new issue?

New to GitHub and DependencyCheck, please advise.

[jeremylong]

Thanks for pointing this out. A new issue should be opened for this so that
it doesn't get lost (and it is different from the original Spring issue.
The best fix for this will need to happen after issue #124 has been fixed.
I just opened issue #130 to track this.

--Jeremy

On Mon, Jun 9, 2014 at 1:05 PM, CorduroyCordova notifications@github.com
wrote:

I seem to have an issue where Spring Security Core is being mis-identified
as Spring Core and generating false positives, for Jenkins plugin v1.2.1:

Example:
...
spring-aop-3.2.8.RELEASE.jar
spring-beans-3.2.8.RELEASE.jar
spring-context-3.2.8.RELEASE.jar
spring-context-support-3.2.8.RELEASE.jar
spring-core-3.2.8.RELEASE.jar
spring-expression-3.2.8.RELEASE.jar
spring-jdbc-3.2.8.RELEASE.jar
spring-jms-3.2.8.RELEASE.jar
spring-security-core-3.2.3.RELEASE.jar

spring-security-acl-3.2.3.RELEASE.jar
spring-security-config-3.2.3.RELEASE.jar
spring-security-taglibs-3.2.3.RELEASE.jar

spring-security-web-3.2.3.RELEASE.jar
spring-tx-3.2.8.RELEASE.jar
spring-web-3.2.8.RELEASE.jar
spring-webmvc-3.2.8.RELEASE.jar
...

jenkins/workspace/xxxxxx_test/runtime-libraries/spring-security-core-3.2.3.RELEASE.jar
cpe: cpe:/a:springsource:spring_framework:3.2.3 Confidence:HIGHEST

Is this an artifact of the way this issue was closed? Should I create a
new issue?

New to GitHub and DependencyCheck, please advise.

—
Reply to this email directly or view it on GitHub
#5 (comment)
.

[CorduroyCordova]

Jeremy,

Thank you. I will open a new issue today. I appreciate the quick response.

Be well,

EK

From: Jeremy Long [mailto:notifications@github.com]
Sent: Tuesday, June 10, 2014 6:16 AM
To: jeremylong/DependencyCheck
Cc: Emmanuel Koutsourais
Subject: Re: [DependencyCheck] Improve Spring Support (#5)

Thanks for pointing this out. A new issue should be opened for this so that
it doesn't get lost (and it is different from the original Spring issue.
The best fix for this will need to happen after issue #124 has been fixed.
I just opened issue #130 to track this.

--Jeremy

On Mon, Jun 9, 2014 at 1:05 PM, CorduroyCordova <notifications@github.commailto:notifications@github.com>
wrote:

I seem to have an issue where Spring Security Core is being mis-identified
as Spring Core and generating false positives, for Jenkins plugin v1.2.1:

Example:
...
spring-aop-3.2.8.RELEASE.jar
spring-beans-3.2.8.RELEASE.jar
spring-context-3.2.8.RELEASE.jar
spring-context-support-3.2.8.RELEASE.jar
spring-core-3.2.8.RELEASE.jar
spring-expression-3.2.8.RELEASE.jar
spring-jdbc-3.2.8.RELEASE.jar
spring-jms-3.2.8.RELEASE.jar
spring-security-core-3.2.3.RELEASE.jar

spring-security-acl-3.2.3.RELEASE.jar
spring-security-config-3.2.3.RELEASE.jar
spring-security-taglibs-3.2.3.RELEASE.jar

spring-security-web-3.2.3.RELEASE.jar
spring-tx-3.2.8.RELEASE.jar
spring-web-3.2.8.RELEASE.jar
spring-webmvc-3.2.8.RELEASE.jar
...

jenkins/workspace/xxxxxx_test/runtime-libraries/spring-security-core-3.2.3.RELEASE.jar
cpe: cpe:/a:springsource:spring_framework:3.2.3 Confidence:HIGHEST

Is this an artifact of the way this issue was closed? Should I create a
new issue?

New to GitHub and DependencyCheck, please advise.

—
Reply to this email directly or view it on GitHub
#5 (comment)
.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/5#issuecomment-45596329.

[jeremylong]

I already opened issue #130 to track this.

Thanks,

Jeremy

On Tue, Jun 10, 2014 at 10:04 AM, CorduroyCordova notifications@github.com
wrote:

Jeremy,

Thank you. I will open a new issue today. I appreciate the quick response.

Be well,

EK

From: Jeremy Long [mailto:notifications@github.com]
Sent: Tuesday, June 10, 2014 6:16 AM
To: jeremylong/DependencyCheck
Cc: Emmanuel Koutsourais
Subject: Re: [DependencyCheck] Improve Spring Support (#5)

Thanks for pointing this out. A new issue should be opened for this so
that
it doesn't get lost (and it is different from the original Spring issue.
The best fix for this will need to happen after issue #124 has been fixed.
I just opened issue #130 to track this.

--Jeremy

On Mon, Jun 9, 2014 at 1:05 PM, CorduroyCordova <notifications@github.com
mailto:notifications@github.com>
wrote:

I seem to have an issue where Spring Security Core is being
mis-identified
as Spring Core and generating false positives, for Jenkins plugin
v1.2.1:

Example:
...
spring-aop-3.2.8.RELEASE.jar
spring-beans-3.2.8.RELEASE.jar
spring-context-3.2.8.RELEASE.jar
spring-context-support-3.2.8.RELEASE.jar
spring-core-3.2.8.RELEASE.jar
spring-expression-3.2.8.RELEASE.jar
spring-jdbc-3.2.8.RELEASE.jar
spring-jms-3.2.8.RELEASE.jar
spring-security-core-3.2.3.RELEASE.jar

spring-security-acl-3.2.3.RELEASE.jar
spring-security-config-3.2.3.RELEASE.jar
spring-security-taglibs-3.2.3.RELEASE.jar

spring-security-web-3.2.3.RELEASE.jar
spring-tx-3.2.8.RELEASE.jar
spring-web-3.2.8.RELEASE.jar
spring-webmvc-3.2.8.RELEASE.jar
...

jenkins/workspace/xxxxxx_test/runtime-libraries/spring-security-core-3.2.3.RELEASE.jar

cpe: cpe:/a:springsource:spring_framework:3.2.3 Confidence:HIGHEST

Is this an artifact of the way this issue was closed? Should I create a
new issue?

New to GitHub and DependencyCheck, please advise.

—
Reply to this email directly or view it on GitHub
<
https://github.com/jeremylong/DependencyCheck/issues/5#issuecomment-45515882>

.

—
Reply to this email directly or view it on GitHub<
https://github.com/jeremylong/DependencyCheck/issues/5#issuecomment-45596329>.

—
Reply to this email directly or view it on GitHub
#5 (comment)
.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.