<commit_before>/*
 * This file is part of Dependency-Check.
 *
 * Dependency-Check is free software: you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation, either version 3 of the License, or (at your option) any
 * later version.
 *
 * Dependency-Check is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 * details.
 *
 * You should have received a copy of the GNU General Public License along with
 * Dependency-Check. If not, see http://www.gnu.org/licenses/.
 *
 * Copyright (c) 2012 <NAME>. All Rights Reserved.
 */
package org.owasp.dependencycheck.data.nvdcve;

import java.io.File;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.sql.CallableStatement;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.owasp.dependencycheck.data.cpe.Entry;
import org.owasp.dependencycheck.data.cwe.CweDB;
import org.owasp.dependencycheck.dependency.Reference;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.utils.Settings;

/**
 * The database holding information about the NVD CVE data.
 *
 * @author <NAME> (<EMAIL>)
 */
public class CveDB {

    //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database">
    /**
     * SQL Statement to create an index on the reference table.
     */
    public static final String CREATE_INDEX_IDXREFERENCE = "CREATE INDEX IF NOT EXISTS idxReference ON reference(cveid)";
    /**
     * SQL Statement to create an index on the software for finding CVE entries based on CPE data.
     */
    public static final String CREATE_INDEX_IDXSOFTWARE = "CREATE INDEX IF NOT EXISTS idxSoftware ON software(product, vendor, version)";
    /**
     * SQL Statement to create an index for retrieving software by CVEID.
     */
    public static final String CREATE_INDEX_IDXSOFTWARECVE = "CREATE INDEX IF NOT EXISTS idxSoftwareCve ON software(cveid)";
    /**
     * SQL Statement to create an index on the vulnerability table.
     */
    public static final String CREATE_INDEX_IDXVULNERABILITY = "CREATE INDEX IF NOT EXISTS idxVulnerability ON vulnerability(cveid)";
    /**
     * SQL Statement to create the reference table.
     */
    public static final String CREATE_TABLE_REFERENCE = "CREATE TABLE IF NOT EXISTS reference (cveid CHAR(13), "
            + "name varchar(1000), url varchar(1000), source varchar(255))";
    /**
     * SQL Statement to create the software table.
     */
    public static final String CREATE_TABLE_SOFTWARE = "CREATE TABLE IF NOT EXISTS software (cveid CHAR(13), cpe varchar(500), "
            + "vendor varchar(255), product varchar(255), version varchar(50), previousVersion varchar(50))";
    /**
     * SQL Statement to create the vulnerability table.
     */
    public static final String CREATE_TABLE_VULNERABILITY = "CREATE TABLE IF NOT EXISTS vulnerability (cveid CHAR(13) PRIMARY KEY, "
            + "description varchar(8000), cwe varchar(10), cvssScore DECIMAL(3,1), cvssAccessVector varchar(20), "
            + "cvssAccessComplexity varchar(20), cvssAuthentication varchar(20), cvssConfidentialityImpact varchar(20), "
            + "cvssIntegrityImpact varchar(20), cvssAvailabilityImpact varchar(20))";
    /**
     * SQL Statement to delete references by CVEID.
     */
    public static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?";
    /**
     * SQL Statement to delete software by CVEID.
     */
    public static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?";
    /**
     * SQL Statement to delete a vulnerability by CVEID.
     */
    public static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE cveid = ?";
    /**
     * SQL Statement to insert a new reference.
     */
    public static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)";
    /**
     * SQL Statement to insert a new software.
     */
    public static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpe, vendor, product, version, previousVersion) "
            + "VALUES (?, ?, ?, ?, ?, ?)";
    /**
     * SQL Statement to insert a new vulnerability.
     */
    public static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cveid, description, cwe, cvssScore, cvssAccessVector, "
            + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) "
            + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
    /**
     * SQL Statement to find CVE entries based on CPE data.
     */
    public static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cveid FROM software WHERE Vendor = ? AND Product = ? AND "
            + "(version = '-' OR previousVersion IS NOT NULL OR version=?)";
    /**
     * SQL Statement to select references by CVEID.
     */
    public static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?";
    /**
     * SQL Statement to select software by CVEID.
     */
    public static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion FROM software WHERE cveid = ?";
    /**
     * SQL Statement to select a vulnerability by CVEID.
     */
    public static final String SELECT_VULNERABILITY = "SELECT cveid, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, "
            + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cveid = ?";
    //</editor-fold>
    //<editor-fold defaultstate="collapsed" desc="Collection of CallableStatements to work with the DB">
    /**
     * delete reference - parameters (cveid).
     */
    private CallableStatement deleteReferences;
    /**
     * delete software - parameters (cveid).
     */
    private CallableStatement deleteSoftware;
    /**
     * delete vulnerability - parameters (cveid).
     */
    private CallableStatement deleteVulnerabilities;
    /**
     * insert reference - parameters (cveid, name, url, source).
     */
    private CallableStatement insertReference;
    /**
     * insert software - parameters (cveid, cpe, vendor, product, version, previousVersion).
     */
    private CallableStatement insertSoftware;
    /**
     * insert vulnerability - parameters (cveid, description, cwe, cvssScore, cvssAccessVector,
     * cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact).
     */
    private CallableStatement insertVulnerability;
    /**
     * select cve from software - parameters (vendor, product, version).
     */
    private CallableStatement selectCveFromSoftware;
    /**
     * select vulnerability - parameters (cveid).
     */
    private CallableStatement selectVulnerability;
    /**
     * select reference - parameters (cveid).
     */
    private CallableStatement selectReferences;
    /**
     * select software - parameters (cveid).
     */
    private CallableStatement selectSoftware;
    //</editor-fold>
    /**
     * Database connection
     */
    private Connection conn;

    /**
     * Opens the database connection. If the database does not exist, it will
     * create a new one.
     *
     * @throws IOException thrown if there is an IO Exception
     * @throws SQLException thrown if there is a SQL Exception
     * @throws DatabaseException thrown if there is an error initializing a new database
     * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded
     */
    @edu.umd.cs.findbugs.annotations.SuppressWarnings(
    value = "DMI_EMPTY_DB_PASSWORD",
    justification = "Yes, I know... Blank password. With the embedded DB the password doesn't have any affect.")
    public void open() throws IOException, SQLException, DatabaseException, ClassNotFoundException {
        final String fileName = CveDB.getDataDirectory().getCanonicalPath()
                + File.separator
                + "cve";
        final File f = new File(fileName);
        final boolean createTables = !f.exists();
        final String connStr = "jdbc:h2:file:" + fileName;
        Class.forName("org.h2.Driver");
        conn = DriverManager.getConnection(connStr, "local", "");
        if (createTables) {
            createTables();
        }
        buildStatements();
    }

    /**
     * Cleans up the object and ensures that "close" has been called.
     * @throws Throwable thrown if there is a problem<commit_msg>reset username and blank password<commit_after>/*
 * This file is part of Dependency-Check.
 *
 * Dependency-Check is free software: you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation, either version 3 of the License, or (at your option) any
 * later version.
 *
 * Dependency-Check is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 * details.
 *
 * You should have received a copy of the GNU General Public License along with
 * Dependency-Check. If not, see http://www.gnu.org/licenses/.
 *
 * Copyright (c) 2012 <NAME>. All Rights Reserved.
 */
package org.owasp.dependencycheck.data.nvdcve;

import java.io.File;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.sql.CallableStatement;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.owasp.dependencycheck.data.cpe.Entry;
import org.owasp.dependencycheck.data.cwe.CweDB;
import org.owasp.dependencycheck.dependency.Reference;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.utils.Settings;

/**
 * The database holding information about the NVD CVE data.
 *
 * @author <NAME> (<EMAIL>)
 */
public class CveDB {

    //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database">
    /**
     * SQL Statement to create an index on the reference table.
     */
    public static final String CREATE_INDEX_IDXREFERENCE = "CREATE INDEX IF NOT EXISTS idxReference ON reference(cveid)";
    /**
     * SQL Statement to create an index on the software for finding CVE entries based on CPE data.
     */
    public static final String CREATE_INDEX_IDXSOFTWARE = "CREATE INDEX IF NOT EXISTS idxSoftware ON software(product, vendor, version)";
    /**
     * SQL Statement to create an index for retrieving software by CVEID.
     */
    public static final String CREATE_INDEX_IDXSOFTWARECVE = "CREATE INDEX IF NOT EXISTS idxSoftwareCve ON software(cveid)";
    /**
     * SQL Statement to create an index on the vulnerability table.
     */
    public static final String CREATE_INDEX_IDXVULNERABILITY = "CREATE INDEX IF NOT EXISTS idxVulnerability ON vulnerability(cveid)";
    /**
     * SQL Statement to create the reference table.
     */
    public static final String CREATE_TABLE_REFERENCE = "CREATE TABLE IF NOT EXISTS reference (cveid CHAR(13), "
            + "name varchar(1000), url varchar(1000), source varchar(255))";
    /**
     * SQL Statement to create the software table.
     */
    public static final String CREATE_TABLE_SOFTWARE = "CREATE TABLE IF NOT EXISTS software (cveid CHAR(13), cpe varchar(500), "
            + "vendor varchar(255), product varchar(255), version varchar(50), previousVersion varchar(50))";
    /**
     * SQL Statement to create the vulnerability table.
     */
    public static final String CREATE_TABLE_VULNERABILITY = "CREATE TABLE IF NOT EXISTS vulnerability (cveid CHAR(13) PRIMARY KEY, "
            + "description varchar(8000), cwe varchar(10), cvssScore DECIMAL(3,1), cvssAccessVector varchar(20), "
            + "cvssAccessComplexity varchar(20), cvssAuthentication varchar(20), cvssConfidentialityImpact varchar(20), "
            + "cvssIntegrityImpact varchar(20), cvssAvailabilityImpact varchar(20))";
    /**
     * SQL Statement to delete references by CVEID.
     */
    public static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?";
    /**
     * SQL Statement to delete software by CVEID.
     */
    public static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?";
    /**
     * SQL Statement to delete a vulnerability by CVEID.
     */
    public static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE cveid = ?";
    /**
     * SQL Statement to insert a new reference.
     */
    public static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)";
    /**
     * SQL Statement to insert a new software.
     */
    public static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpe, vendor, product, version, previousVersion) "
            + "VALUES (?, ?, ?, ?, ?, ?)";
    /**
     * SQL Statement to insert a new vulnerability.
     */
    public static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cveid, description, cwe, cvssScore, cvssAccessVector, "
            + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) "
            + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
    /**
     * SQL Statement to find CVE entries based on CPE data.
     */
    public static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cveid FROM software WHERE Vendor = ? AND Product = ? AND "
            + "(version = '-' OR previousVersion IS NOT NULL OR version=?)";
    /**
     * SQL Statement to select references by CVEID.
     */
    public static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?";
    /**
     * SQL Statement to select software by CVEID.
     */
    public static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion FROM software WHERE cveid = ?";
    /**
     * SQL Statement to select a vulnerability by CVEID.
     */
    public static final String SELECT_VULNERABILITY = "SELECT cveid, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, "
            + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cveid = ?";
    //</editor-fold>
    //<editor-fold defaultstate="collapsed" desc="Collection of CallableStatements to work with the DB">
    /**
     * delete reference - parameters (cveid).
     */
    private CallableStatement deleteReferences;
    /**
     * delete software - parameters (cveid).
     */
    private CallableStatement deleteSoftware;
    /**
     * delete vulnerability - parameters (cveid).
     */
    private CallableStatement deleteVulnerabilities;
    /**
     * insert reference - parameters (cveid, name, url, source).
     */
    private CallableStatement insertReference;
    /**
     * insert software - parameters (cveid, cpe, vendor, product, version, previousVersion).
     */
    private CallableStatement insertSoftware;
    /**
     * insert vulnerability - parameters (cveid, description, cwe, cvssScore, cvssAccessVector,
     * cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact).
     */
    private CallableStatement insertVulnerability;
    /**
     * select cve from software - parameters (vendor, product, version).
     */
    private CallableStatement selectCveFromSoftware;
    /**
     * select vulnerability - parameters (cveid).
     */
    private CallableStatement selectVulnerability;
    /**
     * select reference - parameters (cveid).
     */
    private CallableStatement selectReferences;
    /**
     * select software - parameters (cveid).
     */
    private CallableStatement selectSoftware;
    //</editor-fold>
    /**
     * Database connection
     */
    private Connection conn;

    /**
     * Opens the database connection. If the database does not exist, it will
     * create a new one.
     *
     * @throws IOException thrown if there is an IO Exception
     * @throws SQLException thrown if there is a SQL Exception
     * @throws DatabaseException thrown if there is an error initializing a new database
     * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded
     */
    @edu.umd.cs.findbugs.annotations.SuppressWarnings(
    value = "DMI_EMPTY_DB_PASSWORD",
    justification = "Yes, I know... Blank password.")
    public void open() throws IOException, SQLException, DatabaseException, ClassNotFoundException {
        final String fileName = CveDB.getDataDirectory().getCanonicalPath()
                + File.separator
                + "cve";
        final File f = new File(fileName);
        final boolean createTables = !f.exists();
        final String connStr = "jdbc:h2:file:" + fileName;
        Class.forName("org.h2.Driver");
        conn = DriverManager.getConnection(connStr, "sa", "");
        if (createTables) {
            createTables();
        }
        buildStatements();
    }

    /**
     * Cleans up the object and ensures that "close" has been called.
     * @throws Throwable thrown if there is a problem
{'fraction_non_alphanumeric': 0.09253731343283582, 'fraction_numerical': 0.006412382531785517, 'mean_word_length': 3.236768149882904, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6078400', 'n_tokens_mistral': 5134, 'n_tokens_neox': 4870, 'n_words': 1667}