Source:
<code>public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { current.setNode(qName); if (current.isEntryNode()) { vendor = null; product = null; hasPreviousVersion = false; final String reject = attributes.getValue("reject"); skip = "1".equals(reject); if (!skip) { vulnerability = attributes.getValue("name"); software = new ArrayList<VulnerableSoftware>(); } else { vulnerability = null; software = null; } } else if (!skip && current.isProdNode()) { vendor = attributes.getValue("vendor"); product = attributes.getValue("name"); } else if (!skip && current.isVersNode()) { final String prev = attributes.getValue("prev"); if (prev != null && "1".equals(prev)) { hasPreviousVersion = true; final String edition = attributes.getValue("edition"); final String num = attributes.getValue("num"); <START> final StringBuilder cpe = new StringBuilder(); <END> cpe.append("cpe:/a:").append(vendor).append(':').append(product); if (num != null) { cpe.append(':').append(num); } if (edition != null) { cpe.append(':').append(edition); } final VulnerableSoftware vs = new VulnerableSoftware(); vs.setCpe(cpe.toString()); vs.setPreviousVersion(prev); software.add(vs); } } else if (current.isNVDNode()) { final String nvdVer = attributes.getValue("nvd_xml_version"); if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); } vulnerabilities = new HashMap<String, List<VulnerableSoftware>>(); } }</code><technical_language>Consider changing this to: new StringBuilder(8+vendor.length()+product.length()+(edition==null?0:1+edition.length()));</technical_language>

Target:
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { current.setNode(qName); if (current.isEntryNode()) { vendor = null; product = null; hasPreviousVersion = false; final String reject = attributes.getValue("reject"); skip = "1".equals(reject); if (!skip) { vulnerability = attributes.getValue("name"); software = new ArrayList<VulnerableSoftware>(); } else { vulnerability = null; software = null; } } else if (!skip && current.isProdNode()) { vendor = attributes.getValue("vendor"); product = attributes.getValue("name"); } else if (!skip && current.isVersNode()) { final String prev = attributes.getValue("prev"); if (prev != null && "1".equals(prev)) { hasPreviousVersion = true; final String edition = attributes.getValue("edition"); final String num = attributes.getValue("num"); final int cpeLen = 8 + vendor.length() + product.length() + (null != num ? (1 + num.length()) : 0) + (null != edition ? (1 + edition.length()) : 0); final StringBuilder cpe = new StringBuilder(cpeLen); cpe.append("cpe:/a:").append(vendor).append(':').append(product); if (num != null) { cpe.append(':').append(num); } if (edition != null) { cpe.append(':').append(edition); } final VulnerableSoftware vs = new VulnerableSoftware(); vs.setCpe(cpe.toString()); vs.setPreviousVersion(prev); software.add(vs); } } else if (current.isNVDNode()) { final String nvdVer = attributes.getValue("nvd_xml_version"); if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); } vulnerabilities = new HashMap<String, List<VulnerableSoftware>>(); } }