Skip to content

Commit 4c71e20

Browse files
chadlwilsonchadlwilson
committed
fix: Fix bad links in HTML reports for "Vulnerable Software & Versions"
Since the search function accepts a full CPE 2.3 name, we should be able to use whatever CPE we have, with whatever specificity the CPE has. If it happens to have a version number in it, that will be in the URL. If it does not (due to match being against version ranges, then it will do a broad search). Signed-off-by: Chad Wilson <[email protected]>
1 parent c10f09c commit 4c71e20

File tree

3 files changed

+13
-12
lines changed

3 files changed

+13
-12
lines changed

‎core/src/main/java/org/owasp/dependencycheck/reporting/ReportTool.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,4 +213,8 @@ private String buildDescription(String description,
213213
sb.append(description);
214214
return sb.toString();
215215
}
216+
217+
public String nvdSearchUrlFor(Cpe cpe) {
218+
return CpeIdentifier.nvdSearchUrlFor(cpe);
219+
}
216220
}

‎core/src/main/resources/templates/htmlReport.vsl‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -945,7 +945,6 @@ Getting Help: <a href="https://github.com/dependency-check/DependencyCheck/issue
945945
#end
946946
#set($cnt=$cnt+1)
947947
<h4 id="header$cnt" class="subsectionheader white">Identifiers</h4>
948-
##:&nbsp;<a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($cpevalue)" target="_blank">$enc.html($cpevalue)</a></h4>
949948
<div id="content$cnt" class="subsectioncontent standardsubsection">
950949
#set($supressPkgUrl='')
951950
#if ($dependency.getSoftwareIdentifiers().size()==0 && $dependency.getVulnerableSoftwareIdentifiers().size()==0)
@@ -1060,14 +1059,14 @@ Getting Help: <a href="https://github.com/dependency-check/DependencyCheck/issue
10601059
#if ($vuln.getSource().name().equals("NVD") && $vuln.matchedVulnerableSoftware)
10611060
#if ($vuln.getVulnerableSoftware().size()<2)
10621061
<p>Vulnerable Software &amp; Versions:<ul>
1063-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
1062+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
10641063
</ul></p>
10651064
#else
10661065
<p>Vulnerable Software &amp; Versions:&nbsp;(<a href="#" class="versionToggle" data-toggle=".vs$vsctr">show all</a>)<ul>
1067-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
1066+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
10681067
<li class="vs$vsctr">...</li>
10691068
#foreach($vs in $vuln.getVulnerableSoftware(true))
1070-
<li class="vs$vsctr hidden"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vs.toCpe22Uri())">$enc.html($vs.toString())</a></li>
1069+
<li class="vs$vsctr hidden"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vs))">$enc.html($vs.toString())</a></li>
10711070
#end
10721071
</ul></p>
10731072
#end
@@ -1174,7 +1173,6 @@ Getting Help: <a href="https://github.com/dependency-check/DependencyCheck/issue
11741173
#end
11751174
#set($cnt=$cnt+1)
11761175
<h4 id="header$cnt" class="subsectionheader white">Suppressed Identifiers</h4>
1177-
##:&nbsp;<a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($cpevalue)" target="_blank">$enc.html($cpevalue)</a></h4>
11781176
<div id="content$cnt" class="subsectioncontent standardsubsection">
11791177
#if ($dependency.getSuppressedIdentifiers().size()==0)
11801178
<ul><li><b>None</b></li></ul>
@@ -1267,14 +1265,14 @@ Getting Help: <a href="https://github.com/dependency-check/DependencyCheck/issue
12671265
#if ($vuln.getSource().name().equals("NVD") && $vuln.matchedVulnerableSoftware)
12681266
#if ($vuln.getVulnerableSoftware().size()<2)
12691267
<p>Vulnerable Software &amp; Versions:<ul>
1270-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
1268+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
12711269
</ul></p>
12721270
#else
12731271
<p>Vulnerable Software &amp; Versions:&nbsp;(<a href="#" class="versionToggle" data-toggle=".vs$vsctr">show all</a>)<ul>
1274-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
1272+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
12751273
<li class="vs$vsctr">...</li>
12761274
#foreach($vs in $vuln.getVulnerableSoftware(true))
1277-
<li class="vs$vsctr hidden"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vs.toCpe22Uri())">$enc.html($vs.toString())</a></li>
1275+
<li class="vs$vsctr hidden"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vs))">$enc.html($vs.toString())</a></li>
12781276
#end
12791277
</ul></p>
12801278
#end

‎core/src/main/resources/templates/jenkinsReport.vsl‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -670,7 +670,6 @@ Getting Help: <a href="https://github.com/dependency-check/DependencyCheck/issue
670670
#end
671671
#set($cnt=$cnt+1)
672672
<h4 id="header$cnt" class="subsectionheader white">Identifiers</h4>
673-
##:&nbsp;<a href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($cpevalue)" target="_blank">$enc.html($cpevalue)</a></h4>
674673
<div id="content$cnt" class="subsectioncontent standardsubsection">
675674
#if ($dependency.getSoftwareIdentifiers().size()==0 && $dependency.getVulnerableSoftwareIdentifiers().size()==0)
676675
<ul><li><b>None</b></li></ul>
@@ -764,13 +763,13 @@ Getting Help: <a href="https://github.com/dependency-check/DependencyCheck/issue
764763
#if ($vuln.getSource().name().equals("NVD") && $vuln.matchedVulnerableSoftware)
765764
#if ($vuln.getVulnerableSoftware().size()<2)
766765
<p>Vulnerable Software &amp; Versions:<ul>
767-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
766+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
768767
</ul></p>
769768
#else
770769
<p>Vulnerable Software &amp; Versions:<ul>
771-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
770+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
772771
#foreach($vs in $vuln.getVulnerableSoftware(true))
773-
<li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vs.toCpe22Uri())">$enc.html($vs.toString())</a></li>
772+
<li class="vs$vsctr"><a target="_blank" href="$enc.html($rpt.nvdSearchUrlFor($vuln.matchedVulnerableSoftware))">$enc.html($vs.toString())</a></li>
774773
#end
775774
</ul></p>
776775
#end

0 commit comments

Comments
 (0)