jeremylong/DependencyCheck — pull request #163 by ctrl-alt-dev (2014-10-22 18:17:14+00:00)
Title: Inclusion of evidence from the project-pom, configration to exclude internal groupIds

Hi Jeremy,

First of all: thank you for Dependency Check!

I've made two new features of which I hope you'll consider to include in the project. Both are for the maven plugin.
- I noticed that only the (jar) files of the maven dependencies are are used but not the group, artifact and version fields which are present as well. This is mostly the same data retrieved when querying nexus. Using this data instead of nexus speeds up the analysis process considerably. So I added an additional scan method in the Engine that also takes a MavenArtifact and evaluates it like the nexus evidence. I moved the evaluation code from the NexusAnalyzer to Dependency to share it between Engine and NexusAnalyzer.
- The (internal) project I am working on uses a lot of poorly named artifacts which trigger false positives because of name clashes. Since they all start with a common groupId I've added the feature to exclude those from analysis using the excludeInternalGroupIds configuration parameter, like this:

```xml

some.internal.group.id

```
I apologize for the code reformatting in my commits. I found out when it was too late :-)

Best regards,

Erik Hooijmeijer