diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index f37f63d2ea8..501061e5f2a 100644 --- a/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -446,6 +446,7 @@ protected boolean analyzePOM(Dependency dependency, List c final Properties pomProperties = retrievePomProperties(path, jar); final File pomFile = extractPom(path, jar); final Model pom = PomUtils.readPom(pomFile); + pom.setGAVFromPomDotProperties(pomProperties); pom.processProperties(pomProperties); final String artifactId = new File(path).getParentFile().getName(); diff --git a/core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java b/core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java index 5f611630ccc..43b1aa9fb82 100644 --- a/core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java +++ b/core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java @@ -335,18 +335,6 @@ public void processProperties(Properties properties) { if (properties == null) { return; } - this.groupId = interpolateString(this.groupId, properties); - if (groupId == null && properties.containsKey("groupId")) { - this.groupId = properties.getProperty("groupId"); - } - this.artifactId = interpolateString(this.artifactId, properties); - if (artifactId == null && properties.containsKey("artifactId")) { - this.artifactId = properties.getProperty("artifactId"); - } - this.version = interpolateString(this.version, properties); - if (version == null && properties.containsKey("version")) { - this.version = properties.getProperty("version"); - } this.description = interpolateString(this.description, properties); for (License l : this.getLicenses()) { l.setName(interpolateString(l.getName(), properties)); @@ -398,6 +386,24 @@ public static String interpolateString(String text, Properties properties) { return substitutor.replace(text); } + /** + * Replaces the group/artifact/version obtained from the pom.xml which may contain variable references + * with the interpolated values of the + *