fad-checker 1.0.0

package/test/cpe.test.js

@@ -0,0 +1,148 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("fs");
+const path = require("path");
+const {
+	parseCpe23,
+	matchVersionRange,
+	cpeMatchesDep,
+	evaluateCveForDep,
+	refineMatchesWithCpe,
+} = require("../lib/cpe");
+
+const FIX = path.join(__dirname, "fixtures", "cve-samples");
+
+test("parseCpe23 splits all 13 fields and handles escaping", () => {
+	const c = parseCpe23("cpe:2.3:a:apache:log4j:2.14.0:*:*:*:*:*:*:*");
+	assert.equal(c.part, "a");
+	assert.equal(c.vendor, "apache");
+	assert.equal(c.product, "log4j");
+	assert.equal(c.version, "2.14.0");
+});
+
+test("parseCpe23 returns null for malformed URI", () => {
+	assert.equal(parseCpe23("not a cpe"), null);
+	assert.equal(parseCpe23("cpe:2.3:a:vendor"), null);
+	assert.equal(parseCpe23(42), null);
+});
+
+test("parseCpe23 handles backslash-escaped colons (e.g. eclipse:vert\\.x)", () => {
+	const c = parseCpe23("cpe:2.3:a:vendor:weird\\:name:1.0:*:*:*:*:*:*:*");
+	assert.equal(c.product, "weird:name");
+});
+
+test("matchVersionRange honours versionStartIncluding + versionEndExcluding", () => {
+	const m = {
+		criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
+		vulnerable: true,
+		versionStartIncluding: "2.0.0",
+		versionEndExcluding: "2.15.0",
+	};
+	assert.equal(matchVersionRange("2.14.1", m), true);
+	assert.equal(matchVersionRange("2.0.0", m), true);    // lower-inclusive
+	assert.equal(matchVersionRange("2.15.0", m), false);  // upper-exclusive
+	assert.equal(matchVersionRange("1.9.0", m), false);
+	assert.equal(matchVersionRange("2.17.0", m), false);
+});
+
+test("matchVersionRange honours hard-pinned criteria version", () => {
+	const m = { criteria: "cpe:2.3:a:apache:log4j:2.14.0:*:*:*:*:*:*:*", vulnerable: true };
+	assert.equal(matchVersionRange("2.14.0", m), true);
+	assert.equal(matchVersionRange("2.14.1", m), false);
+});
+
+test("matchVersionRange returns true for unknown dep version (conservative)", () => {
+	const m = { criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", vulnerable: true, versionEndExcluding: "2.15.0" };
+	assert.equal(matchVersionRange(null, m), true);
+});
+
+test("cpeMatchesDep — curated map exact maven coord", () => {
+	const cpe = parseCpe23("cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*");
+	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", ecosystem: "maven" };
+	assert.equal(cpeMatchesDep(cpe, dep), true);
+});
+
+test("cpeMatchesDep — heuristic vendor token in groupId", () => {
+	const cpe = parseCpe23("cpe:2.3:a:apache:commons-totally-novel:*:*:*:*:*:*:*:*");
+	const dep = { groupId: "org.apache.commons", artifactId: "commons-totally-novel", ecosystem: "maven" };
+	assert.equal(cpeMatchesDep(cpe, dep), true);
+});
+
+test("cpeMatchesDep — npm bare name", () => {
+	const cpe = parseCpe23("cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*");
+	const dep = { groupId: "", artifactId: "lodash", ecosystem: "npm" };
+	assert.equal(cpeMatchesDep(cpe, dep), true);
+});
+
+test("cpeMatchesDep — npm scoped package via vendor split", () => {
+	const cpe = parseCpe23("cpe:2.3:a:scope:pkg:*:*:*:*:*:*:*:*");
+	const dep = { groupId: "", artifactId: "@scope/pkg", ecosystem: "npm" };
+	assert.equal(cpeMatchesDep(cpe, dep), true);
+});
+
+test("cpeMatchesDep — wrong artifact does not match", () => {
+	const cpe = parseCpe23("cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*");
+	const dep = { groupId: "org.apache.commons", artifactId: "commons-io", ecosystem: "maven" };
+	assert.equal(cpeMatchesDep(cpe, dep), false);
+});
+
+test("evaluateCveForDep — Log4Shell NVD record matches vulnerable log4j-core", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
+	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", ecosystem: "maven" };
+	const { affected, confidence } = evaluateCveForDep(cve, dep);
+	assert.equal(affected, true);
+	assert.equal(confidence, "exact");
+});
+
+test("evaluateCveForDep — patched log4j is not affected (version out of range)", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
+	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.17.1", ecosystem: "maven" };
+	const { affected } = evaluateCveForDep(cve, dep);
+	assert.equal(affected, false);
+});
+
+test("evaluateCveForDep — unrelated maven dep is not affected", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
+	const dep = { groupId: "com.google.guava", artifactId: "guava", version: "31.0", ecosystem: "maven" };
+	const { affected } = evaluateCveForDep(cve, dep);
+	assert.equal(affected, false);
+});
+
+test("evaluateCveForDep — npm lodash matches the lodash CVE", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-npm-lodash.json"), "utf8"));
+	const dep = { groupId: "", artifactId: "lodash", version: "4.17.10", ecosystem: "npm" };
+	const { affected, confidence } = evaluateCveForDep(cve, dep);
+	assert.equal(affected, true);
+	assert.equal(confidence, "exact");
+});
+
+test("evaluateCveForDep — patched npm lodash is not affected", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-npm-lodash.json"), "utf8"));
+	const dep = { groupId: "", artifactId: "lodash", version: "4.17.20", ecosystem: "npm" };
+	const { affected } = evaluateCveForDep(cve, dep);
+	assert.equal(affected, false);
+});
+
+test("refineMatchesWithCpe upgrades possible→exact when curated map confirms", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
+	const matches = [{
+		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", ecosystem: "maven" },
+		cve: { id: cve.id, configurations: cve.configurations, severity: "HIGH" },
+		confidence: "possible",
+	}];
+	refineMatchesWithCpe(matches);
+	assert.equal(matches[0].confidence, "exact");
+	assert.equal(matches[0].cpeConfidence, "exact");
+	assert.equal(matches[0].cpeFiltered, undefined);
+});
+
+test("refineMatchesWithCpe flags out-of-range version as likely FP", () => {
+	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
+	const matches = [{
+		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.17.1", ecosystem: "maven" },
+		cve: { id: cve.id, configurations: cve.configurations, severity: "HIGH" },
+		confidence: "probable",
+	}];
+	refineMatchesWithCpe(matches);
+	assert.equal(matches[0].cpeFiltered, true);
+});

package/test/cve-download.test.js

@@ -0,0 +1,39 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("fs");
+const path = require("path");
+const { extractMavenRelevantCve, isMavenRelevant } = require("../lib/cve-download");
+
+const SAMPLES = path.join(__dirname, "fixtures", "cve-samples");
+
+test("extractMavenRelevantCve returns null for non-Java CVEs", () => {
+	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-non-java.json"), "utf8"));
+	assert.equal(extractMavenRelevantCve(json), null);
+});
+
+test("extractMavenRelevantCve parses log4j CVE with packageName", () => {
+	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-with-packagename.json"), "utf8"));
+	const cve = extractMavenRelevantCve(json);
+	assert.equal(cve.id, "CVE-2021-44228");
+	assert.equal(cve.severity, "CRITICAL");
+	assert.equal(cve.score, 10);
+	assert.equal(cve.fixVersion, "2.15.0");
+	assert.equal(cve.affected[0].packageName, "org.apache.logging.log4j:log4j-core");
+});
+
+test("extractMavenRelevantCve handles product-only CVEs (no packageName)", () => {
+	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-product-only.json"), "utf8"));
+	const cve = extractMavenRelevantCve(json);
+	assert.equal(cve.id, "CVE-2017-5638");
+	assert.equal(cve.affected[0].product, "struts2-core");
+	assert.equal(cve.affected[0].packageName, null);
+});
+
+test("isMavenRelevant true on known java vendors", () => {
+	assert.equal(isMavenRelevant([{ vendor: "apache", product: "log4j-core" }]), true);
+	assert.equal(isMavenRelevant([{ vendor: "fasterxml", product: "jackson" }]), true);
+});
+
+test("isMavenRelevant false on unrelated ecosystems", () => {
+	assert.equal(isMavenRelevant([{ vendor: "node-vendor", product: "left-pad", collectionURL: "https://registry.npmjs.org" }]), false);
+});

package/test/cve-match.test.js

@@ -0,0 +1,108 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const fs = require("fs");
+const core = require("../lib/core");
+const { collectResolvedDeps, matchDepsAgainstCves, vendorMatchesGroup } = require("../lib/cve-match");
+const { extractMavenRelevantCve, isMavenRelevant } = require("../lib/cve-download");
+
+const FIXTURES = path.join(__dirname, "fixtures");
+const COMPLEX = path.join(FIXTURES, "complex-enterprise");
+const CVE_SAMPLES = path.join(FIXTURES, "cve-samples");
+
+async function pipeline(src) {
+	const store = core.newMetadataStore();
+	const props = {};
+	const pomFiles = core.findPomFiles(src);
+	for (const f of pomFiles) await core.parsePom(f, store);
+	for (const f of pomFiles) await core.getAllInheritedProps(f, store, props);
+	return { store, props };
+}
+
+function buildIndexFromSamples() {
+	const index = { meta: {}, byPackageName: {}, byProduct: {} };
+	for (const f of fs.readdirSync(CVE_SAMPLES)) {
+		const json = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, f), "utf8"));
+		const cve = extractMavenRelevantCve(json);
+		if (!cve) continue;
+		for (const a of cve.affected) {
+			const e = { id: cve.id, severity: cve.severity, score: cve.score, description: cve.description, ranges: a.ranges, vendor: a.vendor, product: a.product, fixVersion: cve.fixVersion };
+			if (a.packageName) (index.byPackageName[a.packageName.toLowerCase()] ||= []).push(e);
+			if (a.product) (index.byProduct[a.product] ||= []).push(e);
+		}
+	}
+	return index;
+}
+
+test("isMavenRelevant filters out non-Java CVEs", () => {
+	const npmCve = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, "cve-non-java.json"), "utf8"));
+	assert.equal(isMavenRelevant(npmCve.containers.cna.affected), false);
+
+	const log4jCve = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, "cve-with-packagename.json"), "utf8"));
+	assert.equal(isMavenRelevant(log4jCve.containers.cna.affected), true);
+});
+
+test("vendorMatchesGroup heuristic", () => {
+	assert.equal(vendorMatchesGroup("apache", "org.apache.commons"), true);
+	assert.equal(vendorMatchesGroup("apache", "org.eclipse.jetty"), false);
+	assert.equal(vendorMatchesGroup("springframework", "org.springframework"), true);
+});
+
+test("collectResolvedDeps dedupes by g:a and includes external parent POMs", async () => {
+	const { store, props } = await pipeline(COMPLEX);
+	const deps = collectResolvedDeps(store, props, {});
+	// External Spring Boot parent should be present as scope='parent'
+	const sbParent = deps.get("org.springframework.boot:spring-boot-starter-parent");
+	assert.ok(sbParent, "external parent should be collected");
+	assert.equal(sbParent.scope, "parent");
+});
+
+test("collectResolvedDeps keeps highest version on conflict", async () => {
+	const { store, props } = await pipeline(COMPLEX);
+	const deps = collectResolvedDeps(store, props, {});
+	const lang = deps.get("org.apache.commons:commons-lang3");
+	if (lang) assert.equal(lang.version, "3.12.0");
+});
+
+test("collectResolvedDeps --ignore-test drops test-scope deps", async () => {
+	const { store, props } = await pipeline(COMPLEX);
+	const withTest = collectResolvedDeps(store, props, {});
+	const withoutTest = collectResolvedDeps(store, props, { ignoreTest: true });
+	assert.ok(withTest.has("junit:junit"));
+	assert.ok(!withoutTest.has("junit:junit"));
+});
+
+test("matchDepsAgainstCves: log4j 2.14 is matched as CRITICAL via packageName", async () => {
+	const { store, props } = await pipeline(COMPLEX);
+	const deps = collectResolvedDeps(store, props, {});
+	const idx = buildIndexFromSamples();
+	const matches = matchDepsAgainstCves(deps, idx);
+	const log4j = matches.find(m => m.cve.id === "CVE-2021-44228");
+	assert.ok(log4j, "log4j CVE not matched");
+	assert.equal(log4j.dep.artifactId, "log4j-core");
+	assert.equal(log4j.cve.severity, "CRITICAL");
+	assert.equal(log4j.confidence, "exact");
+});
+
+test("matchDepsAgainstCves dedupes by (dep, cveId)", () => {
+	// Synthesize an index where the same dep+cveId appears twice
+	const idx = {
+		byPackageName: {
+			"org.apache.logging.log4j:log4j-core": [
+				{ id: "CVE-2021-44228", severity: "CRITICAL", ranges: [{ version: "2.0", lessThan: "2.15.0" }], vendor: "apache", product: "log4j-core" },
+			],
+		},
+		byProduct: {
+			"log4j-core": [
+				{ id: "CVE-2021-44228", severity: "CRITICAL", ranges: [{ version: "2.0", lessThan: "2.15.0" }], vendor: "apache", product: "log4j-core" },
+			],
+		},
+	};
+	const deps = new Map([
+		["org.apache.logging.log4j:log4j-core", {
+			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile", pomPaths: [],
+		}],
+	]);
+	const matches = matchDepsAgainstCves(deps, idx);
+	assert.equal(matches.length, 1, "duplicate (dep, cveId) match should be dedup'd");
+});

package/test/cve-report.test.js

@@ -0,0 +1,79 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { generateHtmlReport, generateWordReport, computeStats, writeReports, esc } = require("../lib/cve-report");
+
+const sampleMatches = [
+	{
+		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
+		cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0" },
+		confidence: "exact",
+	},
+	{
+		dep: { groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind", version: "2.13.0", scope: "compile" },
+		cve: { id: "CVE-2022-42003", severity: "HIGH", score: 7.5, description: "DoS via deep nesting", fixVersion: "2.13.5" },
+		confidence: "exact",
+	},
+];
+
+const projectInfo = { name: "demo", src: "/tmp/demo", generatedAt: "2026-05-21", cveDataDate: null };
+
+test("computeStats counts by severity", () => {
+	const s = computeStats(sampleMatches);
+	assert.equal(s.total, 2);
+	assert.equal(s.critical, 1);
+	assert.equal(s.high, 1);
+	assert.equal(s.medium, 0);
+});
+
+test("computeStats handles undefined/null severity", () => {
+	const s = computeStats([{ cve: { severity: null } }, { cve: {} }]);
+	assert.equal(s.unknown, 2);
+});
+
+test("esc escapes HTML entities", () => {
+	assert.equal(esc(`<script>alert("x")</script>&`), "&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;&amp;");
+});
+
+test("generateHtmlReport produces well-formed self-contained HTML", () => {
+	const html = generateHtmlReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(html.startsWith("<!doctype html>"));
+	assert.ok(html.includes("CVE-2021-44228"));
+	assert.ok(html.includes("Log4Shell"));
+	assert.ok(html.includes("<style>"), "should have inline CSS");
+	assert.ok(!html.includes("</body>\n<body>"), "no double body");
+});
+
+test("generateWordReport contains Word XML namespaces", () => {
+	const doc = generateWordReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(doc.includes("xmlns:o=\"urn:schemas-microsoft-com:office:office\""));
+	assert.ok(doc.includes("Word.Document"));
+});
+
+test("writeReports writes both files to disk", async () => {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-rep-"));
+	const r = await writeReports({
+		cveMatches: sampleMatches,
+		eolResults: [{ dep: { groupId: "org.hibernate", artifactId: "hibernate-core", version: "5.6" }, product: "Hibernate ORM", eol: "2025-08-08" }],
+		obsoleteResults: [{ dep: { groupId: "log4j", artifactId: "log4j", version: "1.2" }, severity: "CRITICAL", replacement: "log4j-core 2.x" }],
+		outdatedResults: [],
+		projectInfo,
+		outputDir: tmp,
+	});
+	assert.ok(fs.existsSync(r.htmlPath));
+	assert.ok(fs.existsSync(r.docPath));
+	const html = fs.readFileSync(r.htmlPath, "utf8");
+	assert.ok(html.includes("Hibernate ORM"));
+	assert.ok(html.includes("log4j:log4j"));
+	fs.rmSync(tmp, { recursive: true, force: true });
+});

package/test/fixtures/complex-enterprise/api/pom.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme.enterprise</groupId>
+		<artifactId>enterprise-root</artifactId>
+		<version>4.2.1</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>api</artifactId>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.acme.enterprise</groupId>
+				<artifactId>build-bom</artifactId>
+				<version>4.2.1</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+	<dependencies>
+		<dependency>
+			<groupId>com.fasterxml.jackson.core</groupId>
+			<artifactId>jackson-databind</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>com.acme.private</groupId>
+			<artifactId>acme-commons</artifactId>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/complex-enterprise/build/pom.xml

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme.enterprise</groupId>
+		<artifactId>enterprise-root</artifactId>
+		<version>4.2.1</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>build-bom</artifactId>
+	<packaging>pom</packaging>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>org.hibernate</groupId>
+				<artifactId>hibernate-core</artifactId>
+				<version>${hibernate.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>${jackson.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.logging.log4j</groupId>
+				<artifactId>log4j-core</artifactId>
+				<version>2.14.0</version>
+			</dependency>
+			<dependency>
+				<groupId>com.acme.private</groupId>
+				<artifactId>acme-commons</artifactId>
+				<version>${acme-commons.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>commons-io</groupId>
+				<artifactId>commons-io</artifactId>
+				<version>2.7</version>
+			</dependency>
+			<dependency>
+				<groupId>org.codehaus.jackson</groupId>
+				<artifactId>jackson-mapper-asl</artifactId>
+				<version>1.9.13</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+</project>

package/test/fixtures/complex-enterprise/dao/pom.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme.enterprise</groupId>
+		<artifactId>enterprise-root</artifactId>
+		<version>4.2.1</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>dao</artifactId>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.acme.enterprise</groupId>
+				<artifactId>build-bom</artifactId>
+				<version>4.2.1</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+	<dependencies>
+		<dependency>
+			<groupId>org.hibernate</groupId>
+			<artifactId>hibernate-core</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-lang3</artifactId>
+			<version>3.12.0</version>
+		</dependency>
+		<dependency>
+			<groupId>commons-io</groupId>
+			<artifactId>commons-io</artifactId>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/complex-enterprise/pom.xml

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>2.7.18</version>
+	</parent>
+	<groupId>com.acme.enterprise</groupId>
+	<artifactId>enterprise-root</artifactId>
+	<version>4.2.1</version>
+	<packaging>pom</packaging>
+	<modules>
+		<module>build</module>
+		<module>api</module>
+		<module>dao</module>
+		<module>web</module>
+	</modules>
+	<properties>
+		<java.version>17</java.version>
+		<hibernate.version>5.6.15.Final</hibernate.version>
+		<jackson.version>2.13.5</jackson.version>
+		<acme-commons.version>3.0.0</acme-commons.version>
+	</properties>
+	<profiles>
+		<profile>
+			<id>dev</id>
+			<activation>
+				<activeByDefault>true</activeByDefault>
+			</activation>
+			<properties>
+				<env.profile>dev</env.profile>
+			</properties>
+			<dependencies>
+				<dependency>
+					<groupId>com.h2database</groupId>
+					<artifactId>h2</artifactId>
+					<version>2.2.224</version>
+				</dependency>
+			</dependencies>
+		</profile>
+		<profile>
+			<id>prod</id>
+			<properties>
+				<env.profile>prod</env.profile>
+			</properties>
+			<dependencies>
+				<dependency>
+					<groupId>org.postgresql</groupId>
+					<artifactId>postgresql</artifactId>
+					<version>42.6.0</version>
+				</dependency>
+			</dependencies>
+		</profile>
+		<profile>
+			<id>oracle</id>
+			<dependencies>
+				<dependency>
+					<groupId>com.acme.private</groupId>
+					<artifactId>acme-oracle-driver</artifactId>
+					<version>1.2.3</version>
+				</dependency>
+			</dependencies>
+		</profile>
+	</profiles>
+</project>

package/test/fixtures/complex-enterprise/web/pom.xml

@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme.enterprise</groupId>
+		<artifactId>enterprise-root</artifactId>
+		<version>4.2.1</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>web</artifactId>
+	<packaging>war</packaging>
+	<profiles>
+		<profile>
+			<id>tomcat</id>
+			<activation>
+				<activeByDefault>true</activeByDefault>
+			</activation>
+			<properties>
+				<servlet.container>tomcat</servlet.container>
+			</properties>
+			<dependencies>
+				<dependency>
+					<groupId>org.apache.tomcat.embed</groupId>
+					<artifactId>tomcat-embed-core</artifactId>
+					<version>9.0.83</version>
+				</dependency>
+			</dependencies>
+		</profile>
+		<profile>
+			<id>jetty</id>
+			<dependencies>
+				<dependency>
+					<groupId>org.eclipse.jetty</groupId>
+					<artifactId>jetty-server</artifactId>
+					<version>9.4.51.v20230217</version>
+				</dependency>
+			</dependencies>
+		</profile>
+	</profiles>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.acme.enterprise</groupId>
+				<artifactId>build-bom</artifactId>
+				<version>4.2.1</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+	<dependencies>
+		<dependency>
+			<groupId>com.acme.enterprise</groupId>
+			<artifactId>api</artifactId>
+			<version>4.2.1</version>
+		</dependency>
+		<dependency>
+			<groupId>com.acme.enterprise</groupId>
+			<artifactId>dao</artifactId>
+			<version>4.2.1</version>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-core</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.codehaus.jackson</groupId>
+			<artifactId>jackson-mapper-asl</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<version>4.13.2</version>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/cve-samples/cve-non-java.json

@@ -0,0 +1,19 @@
+{
+  "cveMetadata": {
+    "cveId": "CVE-2024-00001"
+  },
+  "containers": {
+    "cna": {
+      "descriptions": [{ "lang": "en", "value": "Some npm package vulnerability — should be excluded from Maven index." }],
+      "metrics": [{ "cvssV3_1": { "baseScore": 5.0, "baseSeverity": "MEDIUM" } }],
+      "affected": [
+        {
+          "vendor": "npm-vendor",
+          "product": "left-pad",
+          "collectionURL": "https://registry.npmjs.org",
+          "versions": [{ "version": "1.0.0", "status": "affected", "lessThan": "1.3.0" }]
+        }
+      ]
+    }
+  }
+}