private void removeBadSpringMatches ( Dependency dependency ) { String mustContain = null ; for ( Identifier i : dependency . getSoftwareIdentifiers ( ) ) { if ( i . getValue ( ) != null && i . getValue ( ) . startsWith ( "org.springframework." ) ) { final int endPoint = i . getValue ( ) . indexOf ( ' ' , 19 ) ; if ( endPoint >= 0 ) { mustContain = i . getValue ( ) . substring ( 19 , endPoint ) . toLowerCase ( ) ; break ; } } } if ( mustContain != null ) { final Set < Identifier > removalSet = new HashSet <> ( ) ; for ( Identifier i : dependency . getVulnerableSoftwareIdentifiers ( ) ) { if ( i . getValue ( ) != null && i . getValue ( ) . startsWith ( "cpe:/a:springsource:" ) && ! i . getValue ( ) . toLowerCase ( ) . contains ( mustContain ) ) { removalSet . add ( i ) ; } } removalSet . forEach ( ( i ) - > { dependency . removeVulnerableSoftwareIdentifier ( i ) ; } ) ; }
Removes inaccurate matches on springframework CPEs .