protected Dependency createDependency ( Dependency dependency , String name , String version , String scope ) { final Dependency nodeModule = new Dependency ( new File ( dependency . getActualFile ( ) + "?" + name ) , true ) ; nodeModule . setEcosystem ( NPM_DEPENDENCY_ECOSYSTEM ) ; //this is virtual - the sha1 is purely for the hyperlink in the final html report nodeModule . setSha1sum ( Checksum . getSHA1Checksum ( String . format ( "%s:%s" , name , version ) ) ) ; nodeModule . setSha256sum ( Checksum . getSHA256Checksum ( String . format ( "%s:%s" , name , version ) ) ) ; nodeModule . setMd5sum ( Checksum . getMD5Checksum ( String . format ( "%s:%s" , name , version ) ) ) ; nodeModule . addEvidence ( EvidenceType . PRODUCT , "package.json" , "name" , name , Confidence . HIGHEST ) ; nodeModule . addEvidence ( EvidenceType . VENDOR , "package.json" , "name" , name , Confidence . HIGH ) ; if ( ! StringUtils . isBlank ( version ) ) { nodeModule . addEvidence ( EvidenceType . VERSION , "package.json" , "version" , version , Confidence . HIGHEST ) ; nodeModule . setVersion ( version ) ; } if ( dependency . getName ( ) != null ) { nodeModule . addProjectReference ( dependency . getName ( ) + ": " + scope ) ; } else { nodeModule . addProjectReference ( dependency . getDisplayFileName ( ) + ": " + scope ) ; } nodeModule . setName ( name ) ; //TODO - we can likely create a valid CPE as a low confidence guess using cpe:2.3:a:[name]_project:[name]:[version] //(and add a targetSw of npm/node) Identifier id ; try { final PackageURL purl = PackageURLBuilder . aPackageURL ( ) . withType ( StandardTypes . NPM ) . withName ( name ) . withVersion ( version ) . build ( ) ; id = new PurlIdentifier ( purl , Confidence . HIGHEST ) ; } catch ( MalformedPackageURLException ex ) { LOGGER . debug ( "Unable to generate Purl - using a generic identifier instead " + ex . getMessage ( ) ) ; id = new GenericIdentifier ( String . format ( "npm:%s@%s" , dependency . getName ( ) , version ) , Confidence . HIGHEST ) ; } nodeModule . addSoftwareIdentifier ( id ) ; return nodeModule ; }
Construct a dependency object .