1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 package org.owasp.dependencycheck.data.nvd.ecosystem;
19
20 import java.util.Objects;
21 import java.util.Optional;
22 import java.util.TreeMap;
23
24 import javax.annotation.concurrent.NotThreadSafe;
25
26 import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
27 import io.github.jeremylong.openvulnerability.client.nvd.Reference;
28
29 import com.hankcs.algorithm.AhoCorasickDoubleArrayTrie;
30 import com.hankcs.algorithm.AhoCorasickDoubleArrayTrie.Hit;
31 import io.github.jeremylong.openvulnerability.client.nvd.CveItem;
32 import java.util.List;
33
34 @NotThreadSafe
35 public class UrlEcosystemMapper {
36
37
38
39
40 private static final TreeMap<String, String> ECOSYSTEM_MAP;
41
42
43
44
45 private final AhoCorasickDoubleArrayTrie<String> search;
46
47 static {
48 ECOSYSTEM_MAP = new TreeMap<>();
49 for (UrlHostHint urlHostHint : UrlHostHint.values()) {
50 ECOSYSTEM_MAP.put(urlHostHint.getValue(), urlHostHint.getEcosystem());
51 }
52 for (UrlPathHint urlPathHint : UrlPathHint.values()) {
53 ECOSYSTEM_MAP.put(urlPathHint.getValue(), urlPathHint.getEcosystem());
54 }
55 }
56
57
58
59
60 public UrlEcosystemMapper() {
61 search = new AhoCorasickDoubleArrayTrie<>();
62 search.build(ECOSYSTEM_MAP);
63 }
64
65
66
67
68
69
70
71 public String getEcosystem(DefCveItem cve) {
72 final List<Reference> references = Optional.ofNullable(cve)
73 .map(DefCveItem::getCve)
74 .map(CveItem::getReferences)
75 .orElse(null);
76
77 if (Objects.nonNull(references)) {
78 for (Reference r : references) {
79 final Hit<String> ecosystem = search.findFirst(r.getUrl());
80 if (ecosystem != null) {
81 return ecosystem.value;
82 }
83 }
84 }
85 return null;
86 }
87 }