i : indexesToRetrieve.entrySet()) {
if (i.getValue() > 5) {
throw new NvdApiRetryExceededException("NVD Update Failed: attempted to retrieve starting index "
+ i.getKey() + " from the NVD unsuccessfully five times.");
}
- i.setValue(i.getValue().intValue() + 1);
+ i.setValue(i.getValue() + 1);
futures.add(callApi(clientIndex, i.getKey()));
+ clientIndex += 1;
if (clientIndex >= clients.size()) {
clientIndex = 0;
}
diff --git a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/NvdCveClientBuilder.java b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/NvdCveClientBuilder.java
index 8c965283..c631e11d 100644
--- a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/NvdCveClientBuilder.java
+++ b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/NvdCveClientBuilder.java
@@ -27,7 +27,7 @@
import java.util.List;
/**
- * Used to build an NVD CVE API client. As the NvdCveClient client is autoclosable the builder should be used in a try
+ * Used to build an NVD CVE API client. As the NvdCveClient client is autocloseable the builder should be used in a try
* with resources:
*
*
@@ -344,7 +344,7 @@ public enum VersionType {
*/
public enum Filter {
/**
- * Returns the vulnerabilties associated with a specific CPE.
+ * Returns the vulnerabilities associated with a specific CPE.
*
*
* cpeName=cpe:2.3:a:apache:log4j:2.0:*:*:*:*:*:*:*
@@ -404,7 +404,7 @@ public enum Filter {
*/
KEYWORD_EXACT_MATCH,
/**
- * Returns vulnerabilities where all of the keywords are in the description.
+ * Returns vulnerabilities where all the keywords are in the description.
*
*
* keywordSearch = words
diff --git a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedCall.java b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedCall.java
index c56c0276..effaee41 100644
--- a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedCall.java
+++ b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedCall.java
@@ -20,9 +20,9 @@
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
public class RateLimitedCall {
- private SimpleHttpResponse response;
- private int clientIndex;
- private int startIndex;
+ private final SimpleHttpResponse response;
+ private final int clientIndex;
+ private final int startIndex;
@SuppressFBWarnings(value = {"EI_EXPOSE_REP",
"EI_EXPOSE_REP2"}, justification = "I prefer to suppress these FindBugs warnings")
diff --git a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedClient.java b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedClient.java
index cbe7b8a9..cfa61630 100644
--- a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedClient.java
+++ b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/RateLimitedClient.java
@@ -20,18 +20,11 @@
import org.apache.hc.client5.http.async.methods.SimpleHttpResponse;
import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
import org.apache.hc.client5.http.impl.async.HttpAsyncClients;
-import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManager;
-import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder;
import org.apache.hc.client5.http.impl.routing.SystemDefaultRoutePlanner;
-import org.apache.hc.client5.http.ssl.ClientTlsStrategyBuilder;
import org.apache.hc.core5.concurrent.FutureCallback;
-import org.apache.hc.core5.function.Factory;
-import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
-import org.apache.hc.core5.reactor.ssl.TlsDetails;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import javax.net.ssl.SSLEngine;
import java.net.ProxySelector;
import java.time.LocalTime;
import java.time.ZonedDateTime;
@@ -51,9 +44,9 @@
* The two mechanisms may appear redundant - but each have its purpose in making the calls as fast as can be done while
* being kind to the endpoint. If one is calling an endpoint, such as the NVD vulnerability API which is limited to 5
* calls in 30 seconds without an API Key, to retrieve 4 page of data as quickly as possible you could set a smaller
- * delay and still keep the Rate Meter to limit to 5 calls per 30 secnods. However, if you are retrieiving a large
- * number of pages you would want the delay to be slightly under the time period divided by the allowed number of calls
- * (e.g., if we allowed 5 calls over 30 seconds we would use 30/5=6 seconds).
+ * delay and still keep the Rate Meter to limit to 5 calls per 30 seconds. However, if you are retrieving a large number
+ * of pages you would want the delay to be slightly under the time period divided by the allowed number of calls (e.g.,
+ * if we allowed 5 calls over 30 seconds we would use 30/5=6 seconds).
*/
class RateLimitedClient implements AutoCloseable {
@@ -66,7 +59,7 @@ class RateLimitedClient implements AutoCloseable {
*/
private final CloseableHttpAsyncClient client;
/**
- * Executor service for asynch implementation.
+ * Executor service for async implementation.
*/
private final ExecutorService executor = Executors.newSingleThreadExecutor();
/**
@@ -76,11 +69,11 @@ class RateLimitedClient implements AutoCloseable {
/**
* The minimum delay in milliseconds between API calls.
*/
- private long delay = 0;
+ private long delay;
/**
* Rate limiting meter.
*/
- private RateMeter meter;
+ private final RateMeter meter;
/**
* Construct a rate limited client without a delay or limiters.
@@ -156,9 +149,7 @@ void setDelay(long milliseconds) {
* @return the future response
*/
Future execute(SimpleHttpRequest request, int clientIndex, int startIndex) {
- return executor.submit(() -> {
- return delayedExecute(request, clientIndex, startIndex);
- });
+ return executor.submit(() -> delayedExecute(request, clientIndex, startIndex));
}
/**
@@ -201,7 +192,7 @@ private RateLimitedCall delayedExecute(SimpleHttpRequest request, int clientInde
/**
* Future response.
*/
- class SimpleFutureResponse implements FutureCallback {
+ static class SimpleFutureResponse implements FutureCallback {
/**
* Reference to the logger.
*/
@@ -209,8 +200,6 @@ class SimpleFutureResponse implements FutureCallback {
@Override
public void completed(SimpleHttpResponse result) {
- // String response = result.getBodyText();
- // log.debug("response::{}", response);
}
@Override
diff --git a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Reference.java b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Reference.java
index bc47112e..136ff9e8 100644
--- a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Reference.java
+++ b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Reference.java
@@ -21,13 +21,18 @@
import com.fasterxml.jackson.annotation.JsonPropertyOrder;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.Serializable;
import java.util.List;
import java.util.Objects;
@JsonInclude(JsonInclude.Include.NON_NULL)
@JsonPropertyOrder({"url", "source", "tags"})
-public class Reference {
+public class Reference implements Serializable {
+ /**
+ * Serialization version UID.
+ */
+ private static final long serialVersionUID = -224192309845772254L;
/**
* (Required)
*/
diff --git a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/VendorComment.java b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/VendorComment.java
index dcd0db85..0d041c48 100644
--- a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/VendorComment.java
+++ b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/VendorComment.java
@@ -21,13 +21,18 @@
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import java.io.Serializable;
import java.time.ZonedDateTime;
import java.util.Objects;
@JsonInclude(JsonInclude.Include.NON_NULL)
@JsonPropertyOrder({"organization", "comment", "lastModified"})
-public class VendorComment {
+public class VendorComment implements Serializable {
+ /**
+ * Serialization version UID.
+ */
+ private static final long serialVersionUID = -5866678952379674377L;
/**
* (Required)
*/
@@ -42,8 +47,8 @@ public class VendorComment {
* (Required)
*/
@JsonProperty("lastModified")
- // the below format is a hack work around due to some poorly formated dates in the NVD data, the getter corrects the
- // serizlized format
+ // the below format is a hack/workaround due to some poorly formatted dates in the NVD data, the getter corrects the
+ // serialized format
@JsonFormat(pattern = "uuuu-MM-dd'T'HH:mm:ss[.[SSSSSSSSS][SSSSSSSS][SSSSSSS][SSSSSS][SSSSS][SSSS][SSS][SS][S]]", timezone = "UTC")
private ZonedDateTime lastModified;
diff --git a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Weakness.java b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Weakness.java
index 220fcb06..532950f9 100644
--- a/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Weakness.java
+++ b/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/Weakness.java
@@ -21,13 +21,18 @@
import com.fasterxml.jackson.annotation.JsonPropertyOrder;
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+import java.io.Serializable;
import java.util.List;
import java.util.Objects;
@JsonInclude(JsonInclude.Include.NON_NULL)
@JsonPropertyOrder({"source", "type", "description"})
-public class Weakness {
+public class Weakness implements Serializable {
+ /**
+ * Serialization version UID.
+ */
+ private static final long serialVersionUID = -6330752220797574809L;
/**
* (Required)
*/
diff --git a/vulnz/README.md b/vulnz/README.md
index 5d33d61b..f5b3d4fa 100644
--- a/vulnz/README.md
+++ b/vulnz/README.md
@@ -54,7 +54,7 @@ export JAVA_OPTS="-Xmx2g"
Alternatively, run the CLI using the `-Xmx2g` argument:
```bash
-java -Xmx2g -jar ./vulnz-5.0.0.jar
+java -Xmx2g -jar ./vulnz-5.0.1.jar
```
### Creating the Cache
@@ -71,7 +71,7 @@ for file in *.json; do gzip -k "${file}"; done
Alternatively, without using the above install command:
```bash
-./vulnz-5.0.0.jar cve --cache --directory ./cache
+./vulnz-5.0.1.jar cve --cache --directory ./cache
cd cache
for file in *.json; do gzip -k "${file}"; done
```