jeremylong/DependencyCheck — pull request #47 by colezlaw (2014-01-22 17:14:02+00:00)
Title: Change confidence on filename version when it's just a simple integer

The `FileNameAnalyzer` sets its confidence to `HIGHEST` for the version number, but there are times when this has negative consequences. If a filename includes the product name, but no version information, but the product name itself has digits, those digits become the version number. For instance, a jar called `struts2-core.jar` will have a matched CPE of `cpe:/a:apache:struts:2.0.0` even if there are other analyzers which can also determine a version number. `log4j.jar` also produces problematic results.

This patch reduces the confidence to `MEDIUM` on filename version numbers matched where the version number matched is just a single integer. I had originally considered changing the `DependencyVersionUtil` to either have multiple methods for when it needs to drop down to the `RX_SINGLE_VERSION`, but decided against it as this would un-necessarily couple the `DependencyVersionUtil` to the concept of confidence.