Modify DFS algorithm to search for vulnerable paths
@@ -46,11 +46,11 @@ import java.sql.SQLException;
import java.sql.Timestamp;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Optional;
import java.util.Set;
+import java.util.Stack;
import java.util.stream.Collectors;
public class VulnerabilityCacheProcessorPlugin extends Plugin {
@@ -134,26 +134,28 @@ public class VulnerabilityCacheProcessorPlugin extends Plugin {
* @param path - helper argument for preliminary path.
* @return the list of paths for each vulnerable dependency.
*/
- private List<Long> getPathsToVulnerableNode(DirectedGraph graph, long source, long target,
- Set<Long> visited, List<Long> path) {
- path.add(source);
- if (source == target) {
- return path;
- }
+ private boolean getPathsToVulnerableNode(DirectedGraph graph, long source, long target,
+ Set<Long> visited, Stack<Long> path) {
visited.add(source);
+ path.add(source);
+
+ if (source == target) return true;
if (!graph.containsVertex(source)) {
- logger.info("Graph doesn't contain vertex: " + source);
- return null;
+ path.pop();
+ return false;
}
for (var node : graph.successors(source)) {
if (!visited.contains(node)) {
- getPathsToVulnerableNode(graph, node, target, visited, path);
+ if (getPathsToVulnerableNode(graph, node, target, visited, path)) {
+ return true;
}
}
- visited.remove(source);
- return null;
+ }
+
+ path.pop();
+ return false;
}
/**
@@ -349,7 +351,14 @@ public class VulnerabilityCacheProcessorPlugin extends Plugin {
var vulnerablePaths = new ArrayList<List<Long>>();
for (var internal : internalCallables) {
for (var vulnerable : vulnerabilities.keySet()) {
- vulnerablePaths.add(getPathsToVulnerableNode(graph, internal, vulnerable, new HashSet<>(), new ArrayList<>()));
+ Stack<Long> path = new Stack<>();
+ var result = getPathsToVulnerableNode(graph, internal, vulnerable, new HashSet<>(), path);
+ if (result) {
+ logger.info("Path found for vulnerable: " + vulnerable.toString());
+ vulnerablePaths.add(path);
+ } else {
+ logger.info("Path not found for vulnerable: " + vulnerable.toString());
+ }
}
}
logger.info("Vulnerable Paths: " + vulnerablePaths.toString());
