private Vulnerability createVulnerability ( String parentName , Dependency dependency , String gem , String nextLine ) throws CpeValidationException { Vulnerability vulnerability = null ; if ( null != dependency ) { final String version = nextLine . substring ( VERSION . length ( ) ) ; dependency . addEvidence ( EvidenceType . VERSION , "bundler-audit" , "Version" , version , Confidence . HIGHEST ) ; dependency . setVersion ( version ) ; dependency . setName ( gem ) ; try { final PackageURL purl = PackageURLBuilder . aPackageURL ( ) . withType ( "gem" ) . withName ( dependency . getName ( ) ) . withVersion ( dependency . getVersion ( ) ) . build ( ) ; dependency . addSoftwareIdentifier ( new PurlIdentifier ( purl , Confidence . HIGHEST ) ) ; } catch ( MalformedPackageURLException ex ) { LOGGER . debug ( "Unable to build package url for python" , ex ) ; final GenericIdentifier id = new GenericIdentifier ( "gem:" + dependency . getName ( ) + "@" + dependency . getVersion ( ) , Confidence . HIGHEST ) ; dependency . addSoftwareIdentifier ( id ) ; } vulnerability = new Vulnerability ( ) ; // don't add to dependency until we have name set later final VulnerableSoftwareBuilder builder = new VulnerableSoftwareBuilder ( ) ; final VulnerableSoftware vs = builder . part ( Part . APPLICATION ) . vendor ( gem ) . product ( String . format ( "%s_project" , gem ) ) . version ( version ) . build ( ) ; vulnerability . addVulnerableSoftware ( vs ) ; vulnerability . setMatchedVulnerableSoftware ( vs ) ; vulnerability . setCvssV2 ( new CvssV2 ( - 1 , "-" , "-" , "-" , "-" , "-" , "-" , "unknown" ) ) ; } LOGGER . debug ( "bundle-audit ({}): {}" , parentName , nextLine ) ; return vulnerability ; }
Creates a vulnerability .