public synchronized void addSoftwareIdentifier ( Identifier identifier ) { //todo the following assertion should be removed after initial testing and implementation assert ! ( identifier instanceof CpeIdentifier ) : "vulnerability identifier cannot be added to software identifiers" ; final Optional < Identifier > found = softwareIdentifiers . stream ( ) . filter ( id -> id . getValue ( ) . equals ( identifier . getValue ( ) ) ) . findFirst ( ) ; if ( found . isPresent ( ) ) { //TODO - should we check for type of identifier? I.e. could we see a Purl and GenericIdentifier with the same value final Identifier existing = found . get ( ) ; if ( existing . getConfidence ( ) . compareTo ( identifier . getConfidence ( ) ) < 0 ) { existing . setConfidence ( identifier . getConfidence ( ) ) ; } if ( existing . getNotes ( ) != null && identifier . getNotes ( ) != null ) { existing . setNotes ( existing . getNotes ( ) + " " + identifier . getNotes ( ) ) ; } else if ( identifier . getNotes ( ) != null ) { existing . setNotes ( identifier . getNotes ( ) ) ; } if ( existing . getUrl ( ) == null && identifier . getUrl ( ) != null ) { existing . setUrl ( identifier . getUrl ( ) ) ; } } else { this . softwareIdentifiers . add ( identifier ) ; } }
Adds an entry to the list of detected Identifiers for the dependency file .