/*
 * This file is part of dependency-check-core.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
 */
package org.owasp.dependencycheck.analyzer;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.Comparator;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import java.util.concurrent.TimeUnit;
import java.util.stream.Collectors;
import javax.annotation.concurrent.ThreadSafe;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.builder.CompareToBuilder;
import org.apache.commons.lang3.builder.EqualsBuilder;
import org.apache.commons.lang3.builder.HashCodeBuilder;
import org.apache.commons.lang3.mutable.MutableInt;
import org.apache.lucene.analysis.CharArraySet;
import org.apache.lucene.document.Document;
import org.apache.lucene.index.CorruptIndexException;
import org.apache.lucene.queryparser.classic.ParseException;
import org.apache.lucene.search.Query;
import org.apache.lucene.search.ScoreDoc;
import org.apache.lucene.search.TopDocs;
import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
import org.owasp.dependencycheck.data.cpe.Fields;
import org.owasp.dependencycheck.data.cpe.IndexEntry;
import org.owasp.dependencycheck.data.cpe.IndexException;
import org.owasp.dependencycheck.data.cpe.MemoryIndex;
import org.owasp.dependencycheck.data.lucene.LuceneUtils;
import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer;
import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.data.update.cpe.CpePlus;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Evidence;
import org.owasp.dependencycheck.dependency.EvidenceType;
import org.owasp.dependencycheck.dependency.naming.CpeIdentifier;
import org.owasp.dependencycheck.dependency.naming.Identifier;
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
import org.owasp.dependencycheck.exception.InitializationException;
import org.owasp.dependencycheck.utils.DependencyVersion;
import org.owasp.dependencycheck.utils.DependencyVersionUtil;
import org.owasp.dependencycheck.utils.Settings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import us.springett.parsers.cpe.Cpe;
import us.springett.parsers.cpe.CpeBuilder;
import us.springett.parsers.cpe.exceptions.CpeValidationException;
import us.springett.parsers.cpe.values.Part;

/**
 * CPEAnalyzer is a utility class that takes a project dependency and attempts
 * to discern if there is an associated CPE. It uses the evidence contained
 * within the dependency to search the Lucene index.
 *
 * @author Jeremy Long
 */
@ThreadSafe
public class CPEAnalyzer extends AbstractAnalyzer {

    /**
     * The Logger.
     */
    private static final Logger LOGGER = LoggerFactory.getLogger(CPEAnalyzer.class);
    /**
     * The weighting boost to give terms when constructing the Lucene query.
     */
    private static final int WEIGHTING_BOOST = 1;
    /**
     * A string representation of a regular expression defining characters
     * utilized within the CPE Names. Note, the :/ are included so URLs are
     * passed into the Lucene query so that the specialized tokenizer can parse
     * them.
     */
    private static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._:/-]";
    /**
     * A string representation of a regular expression used to remove all but
     * alpha characters.
     */
    private static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*";
    /**
     * UTF-8 character set name.
     */
    private static final String UTF8 = StandardCharsets.UTF_8.name();
    /**
     * The URL to search the NVD CVE data at NIST. This is used by calling:
     * <pre>String.format(NVD_SEARCH_URL, vendor, product, version);</pre>
     */
    public static final String NVD_SEARCH_URL = "https://nvd.nist.gov/vuln/search/results?form_type=Advanced&"
            + "results_type=overview&search_type=all&cpe_vendor=cpe%%3A%%2F%%3A%1$s&cpe_product=cpe%%3A%%2F%%3A%1$s%%3A%2$s&"
            + "cpe_version=cpe%%3A%%2F%%3A%1$s%%3A%2$s%%3A%3$s";

    /**
     * The URL to search the NVD CVE data at NIST. This is used by calling:
     * <pre>String.format(NVD_SEARCH_URL, vendor, product);</pre>
     */
    public static final String NVD_SEARCH_BROAD_URL = "https://nvd.nist.gov/vuln/search/results?form_type=Advanced&"
            + "results_type=overview&search_type=all&cpe_vendor=cpe%%3A%%2F%%3A%1$s&cpe_product=cpe%%3A%%2F%%3A%1$s%%3A%2$s";
    /**
     * The CPE in memory index.
     */
    private MemoryIndex cpe;
    /**
     * The CVE Database.
     */
    private CveDB cve;
    /**
     * A reference to the ODC engine.
     */
    private Engine engine;
    /**
     * The list of ecosystems to skip during analysis. These are skipped because
     * there is generally a more accurate vulnerability analyzer in the
     * pipeline.
     */
    private List<String> skipEcosystems;
    /**
     * A reference to the ecosystem object; used to obtain the max query results
     * for each ecosystem.
     */
    private Ecosystem ecosystemTools;
    /**
     * A reference to the suppression analyzer; for timing reasons we need to
     * test for suppressions immediately after identifying the match because a
     * higher confidence match on a FP can mask a lower confidence, yet valid
     * match.
     */
    private CpeSuppressionAnalyzer suppression;

    /**
     * Returns the name of this analyzer.
     *
     * @return the name of this analyzer.
     */
    @Override
    public String getName() {
        return "CPE Analyzer";
    }

    /**
     * Returns the analysis phase that this analyzer should run in.
     *
     * @return the analysis phase that this analyzer should run in.
     */
    @Override
    public AnalysisPhase getAnalysisPhase() {
        return AnalysisPhase.IDENTIFIER_ANALYSIS;
    }

    /**
     * Creates the CPE Lucene Index.
     *
     * @param engine a reference to the dependency-check engine
     * @throws InitializationException is thrown if there is an issue opening
     * the index.
     */
    @Override
    public void prepareAnalyzer(Engine engine) throws InitializationException {
        super.prepareAnalyzer(engine);
        this.engine = engine;
        try {
            this.open(engine.getDatabase());
        } catch (IOException ex) {
            LOGGER.debug("Exception initializing the Lucene Index", ex);
            throw new InitializationException("An exception occurred initializing the Lucene Index", ex);
        } catch (DatabaseException ex) {
            LOGGER.debug("Exception accessing the database", ex);
            throw new InitializationException("An exception occurred accessing the database", ex);
        }
        final String[] tmp = engine.getSettings().getArray(Settings.KEYS.ECOSYSTEM_SKIP_CPEANALYZER);
        if (tmp == null) {
            skipEcosystems = new ArrayList<>();
        } else {
            LOGGER.debug("Skipping CPE Analysis for {}", StringUtils.join(tmp, ","));
            skipEcosystems = Arrays.asList(tmp);
        }
        ecosystemTools = new Ecosystem(engine.getSettings());
        suppression = new CpeSuppressionAnalyzer();
        suppression.initialize(engine.getSettings());
        suppression.prepareAnalyzer(engine);
    }

    /**
     * Opens the data source.
     *
     * @param cve a reference to the NVD CVE database
     * @throws IOException when the Lucene directory to be queried does not
     * exist or is corrupt.
     * @throws DatabaseException when the database throws an exception. This
     * usually occurs when the database is in use by another process.
     */
    public void open(CveDB cve) throws IOException, DatabaseException {
        this.cve = cve;
        this.cpe = CpeMemoryIndex.getInstance();
        try {
            final long creationStart = System.currentTimeMillis();
            cpe.open(cve.getVendorProductList(), this.getSettings());
            final long creationSeconds = TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis() - creationStart);
            LOGGER.info("Created CPE Index ({} seconds)", creationSeconds);
        } catch (IndexException ex) {
            LOGGER.debug("IndexException", ex);
            throw new DatabaseException(ex);
        }
    }

    /**
     * Closes the data sources.
     */
    @Override
    public void closeAnalyzer() {
        if (cpe != null) {
            cpe.close();
            cpe = null;
        }
    }

    /**
     * Searches the data store of CPE entries, trying to identify the CPE for
     * the given dependency based on the evidence contained within. The
     * dependency passed in is updated with any identified CPE values.
     *
     * @param dependency the dependency to search for CPE entries on
     * @throws CorruptIndexException is thrown when the Lucene index is corrupt
     * @throws IOException is thrown when an IOException occurs
     * @throws ParseException is thrown when the Lucene query cannot be parsed
     * @throws AnalysisException thrown if the suppression rules failed
     */
    protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException, AnalysisException {
        boolean identifierAdded;

        final Set<String> majorVersions = dependency.getSoftwareIdentifiers()
                .stream()
                .filter(i -> i instanceof PurlIdentifier)
                .map(i -> {
                    final PurlIdentifier p = (PurlIdentifier) i;
                    final DependencyVersion depVersion = DependencyVersionUtil.parseVersion(p.getVersion(), false);
                    if (depVersion != null) {
                        return depVersion.getVersionParts().get(0);
                    }
                    return null;
                }).collect(Collectors.toSet());

        final Map<String, MutableInt> vendors = new HashMap<>();
        final Map<String, MutableInt> products = new HashMap<>();
        final Set<Integer> previouslyFound = new HashSet<>();

        for (Confidence confidence : Confidence.values()) {
            collectTerms(vendors, dependency.getIterator(EvidenceType.VENDOR, confidence));
            LOGGER.trace("vendor search: {}", vendors);
            collectTerms(products, dependency.getIterator(EvidenceType.PRODUCT, confidence));
            addMajorVersionToTerms(majorVersions, products);
            LOGGER.trace("product search: {}", products);
            if (!vendors.isEmpty() && !products.isEmpty()) {
                final List<IndexEntry> entries = searchCPE(vendors, products,
                        dependency.getVendorWeightings(), dependency.getProductWeightings(),
                        dependency.getEcosystem());
                if (entries == null) {
                    continue;
                }

                identifierAdded = false;
                for (IndexEntry e : entries) {
                    if (previouslyFound.contains(e.getDocumentId()) /*|| (filter > 0 && e.getSearchScore() < filter)*/) {
                        continue;
                    }
                    previouslyFound.add(e.getDocumentId());
                    if (verifyEntry(e, dependency, majorVersions)) {
                        final String vendor = e.getVendor();
                        final String product = e.getProduct();
                        LOGGER.trace("identified vendor/product: {}/{}", vendor, product);
                        identifierAdded |= determineIdentifiers(dependency, vendor, product, confidence);
                    }
                }
                if (identifierAdded) {
                    break;
                }
            }
        }
    }

    /**
     * <p>
     * Returns the text created by concatenating the text and the values from
     * the EvidenceCollection (filtered for a specific confidence). This
     * attempts to prevent duplicate terms from being added.</p>
     * <p>
     * Note, if the evidence is longer then 1000 characters it will be
     * truncated.</p>
     *
     * @param terms the collection of terms
     * @param evidence an iterable set of evidence to concatenate
     */
    @SuppressWarnings("null")

    protected void collectTerms(Map<String, MutableInt> terms, Iterable<Evidence> evidence) {
        for (Evidence e : evidence) {
            String value = cleanseText(e.getValue());
            if (StringUtils.isBlank(value)) {
                continue;
            }
            if (value.length() > 1000) {
                boolean trimmed = false;
                int pos = value.lastIndexOf(" ", 1000);
                if (pos > 0) {
                    value = value.substring(0, pos);
                    trimmed = true;
                } else {
                    pos = value.lastIndexOf(".", 1000);
                }
                if (!trimmed) {
                    if (pos > 0) {
                        value = value.substring(0, pos);
                        trimmed = true;
                    } else {
                        pos = value.lastIndexOf("-", 1000);
                    }
                }
                if (!trimmed) {
                    if (pos > 0) {
                        value = value.substring(0, pos);
                        trimmed = true;
                    } else {
                        pos = value.lastIndexOf("_", 1000);
                    }
                }
                if (!trimmed) {
                    if (pos > 0) {
                        value = value.substring(0, pos);
                        trimmed = true;
                    } else {
                        pos = value.lastIndexOf("/", 1000);
                    }
                }
                if (!trimmed && pos > 0) {
                    value = value.substring(0, pos);
                    trimmed = true;
                }
                if (!trimmed) {
                    value = value.substring(0, 1000);
                }
            }
            addTerm(terms, value);
        }
    }

    private void addMajorVersionToTerms(Set<String> majorVersions, Map<String, MutableInt> products) {
        final Map<String, MutableInt> temp = new HashMap<>();
        products.entrySet().stream()
                .filter(term -> term.getKey() != null)
                .forEach(term -> majorVersions.stream()
                .filter(version -> version != null
                && (!term.getKey().endsWith(version)
                && !Character.isDigit(term.getKey().charAt(term.getKey().length() - 1))
                && !products.containsKey(term.getKey() + version)))
                .forEach(version -> {
                    addTerm(temp, term.getKey() + version);
                }));
        products.entrySet().stream()
                .filter(term -> term.getKey() != null)
                .forEach(term -> majorVersions.stream()
                .filter(Objects::nonNull)
                .map(version -> "v" + version)
                .filter(version -> (!term.getKey().endsWith(version)
                && !Character.isDigit(term.getKey().charAt(term.getKey().length() - 1))
                && !products.containsKey(term.getKey() + version)))
                .forEach(version -> {
                    addTerm(temp, term.getKey() + version);
                }));
        products.putAll(temp);
    }

    /**
     * Adds a term to the map of terms.
     *
     * @param terms the map of terms
     * @param value the value of the term to add
     */
    private void addTerm(Map<String, MutableInt> terms, String value) {
        final MutableInt count = terms.get(value);
        if (count == null) {
            terms.put(value, new MutableInt(1));
        } else {
            count.add(1);
        }
    }

    /**
     * <p>
     * Searches the Lucene CPE index to identify possible CPE entries associated
     * with the supplied vendor, product, and version.</p>
     *
     * <p>
     * If either the vendorWeightings or productWeightings lists have been
     * populated this data is used to add weighting factors to the search.</p>
     *
     * @param vendor the text used to search the vendor field
     * @param product the text used to search the product field
     * @param vendorWeightings a list of strings to use to add weighting factors
     * to the vendor field
     * @param productWeightings Adds a list of strings that will be used to add
     * weighting factors to the product search
     * @param ecosystem the dependency's ecosystem
     * @return a list of possible CPE values
     */
    protected List<IndexEntry> searchCPE(Map<String, MutableInt> vendor, Map<String, MutableInt> product,
            Set<String> vendorWeightings, Set<String> productWeightings, String ecosystem) {

        final int maxQueryResults = ecosystemTools.getLuceneMaxQueryLimitFor(ecosystem);
        final List<IndexEntry> ret = new ArrayList<>(maxQueryResults);

        final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
        if (searchString == null) {
            return ret;
        }
        try {
            final Query query = cpe.parseQuery(searchString);
            final TopDocs docs = cpe.search(query, maxQueryResults);

            for (ScoreDoc d : docs.scoreDocs) {
                //if (d.score >= minLuceneScore) {
                final Document doc = cpe.getDocument(d.doc);
                final IndexEntry entry = new IndexEntry();
                entry.setDocumentId(d.doc);
                entry.setVendor(doc.get(Fields.VENDOR));
                entry.setProduct(doc.get(Fields.PRODUCT));
                entry.setSearchScore(d.score);

//                LOGGER.error("Explanation: ---------------------");
//                LOGGER.error("Explanation: " + entry.getVendor() + " " + entry.getProduct() + " " + entry.getSearchScore());
//                LOGGER.error("Explanation: " + searchString);
//                LOGGER.error("Explanation: " + cpe.explain(query, d.doc));
                if (!ret.contains(entry)) {
                    ret.add(entry);
                }
                //}
            }
            return ret;
        } catch (ParseException ex) {
            LOGGER.warn("An error occurred querying the CPE data. See the log for more details.");
            LOGGER.info("Unable to parse: {}", searchString, ex);
        } catch (IndexException ex) {
            LOGGER.warn("An error occurred resetting the CPE index searcher. See the log for more details.");
            LOGGER.info("Unable to reset the search analyzer", ex);
        } catch (IOException ex) {
            LOGGER.warn("An error occurred reading CPE data. See the log for more details.");
            LOGGER.info("IO Error with search string: {}", searchString, ex);
        }
        return null;
    }

    /**
     * <p>
     * Builds a Lucene search string by properly escaping data and constructing
     * a valid search query.</p>
     *
     * <p>
     * If either the possibleVendor or possibleProducts lists have been
     * populated this data is used to add weighting factors to the search string
     * generated.</p>
     *
     * @param vendor text to search the vendor field
     * @param product text to search the product field
     * @param vendorWeighting a list of strings to apply to the vendor to boost
     * the terms weight
     * @param productWeightings a list of strings to apply to the product to
     * boost the terms weight
     * @return the Lucene query
     */
    protected String buildSearch(Map<String, MutableInt> vendor, Map<String, MutableInt> product,
            Set<String> vendorWeighting, Set<String> productWeightings) {

        final StringBuilder sb = new StringBuilder();

        if (!appendWeightedSearch(sb, Fields.PRODUCT, product, productWeightings)) {
            return null;
        }
        sb.append(" AND ");
        if (!appendWeightedSearch(sb, Fields.VENDOR, vendor, vendorWeighting)) {
            return null;
        }
        return sb.toString();
    }

    /**
     * This method constructs a Lucene query for a given field. The searchText
     * is split into separate words and if the word is within the list of
     * weighted words then an additional weighting is applied to the term as it
     * is appended into the query.
     *
     * @param sb a StringBuilder that the query text will be appended to.
     * @param field the field within the Lucene index that the query is
     * searching.
     * @param terms text used to construct the query.
     * @param weightedText a list of terms that will be considered higher
     * importance when searching.
     * @return if the append was successful.
     */
    @SuppressWarnings("StringSplitter")
    private boolean appendWeightedSearch(StringBuilder sb, String field, Map<String, MutableInt> terms, Set<String> weightedText) {
        if (terms.isEmpty()) {
            return false;
        }
        sb.append(field).append(":(");
        boolean addSpace = false;
        boolean addedTerm = false;

        for (Map.Entry<String, MutableInt> entry : terms.entrySet()) {
            final StringBuilder boostedTerms = new StringBuilder();
            final int weighting = entry.getValue().intValue();
            final String[] text = entry.getKey().split(" ");
            for (String word : text) {
                if (word.isEmpty()) {
                    continue;
                }
                if (addSpace) {
                    sb.append(" ");
                } else {
                    addSpace = true;
                }
                addedTerm = true;
                if (LuceneUtils.isKeyword(word)) {
                    sb.append("\"");
                    LuceneUtils.appendEscapedLuceneQuery(sb, word);
                    sb.append("\"");
                } else {
                    LuceneUtils.appendEscapedLuceneQuery(sb, word);
                }
                final String boostTerm = findBoostTerm(word, weightedText);

                //The weighting is on a full phrase rather then at a term level for vendor or products
                //TODO - should the weighting be at a "word" level as opposed to phrase level? Or combined word and phrase?
                //remember the reason we are counting the frequency of "phrases" as opposed to terms is that
                //we need to keep the correct sequence of terms from the evidence so the term concatenating analyzer
                //works correctly and will causes searches to take spring framework and produce: spring springframework framework
                if (boostTerm != null) {
                    sb.append("^").append(weighting + WEIGHTING_BOOST);
                    if (!boostTerm.equals(word)) {
                        boostedTerms.append(" ");
                        LuceneUtils.appendEscapedLuceneQuery(boostedTerms, boostTerm);
                        boostedTerms.append("^").append(weighting + WEIGHTING_BOOST);
                    }
                } else if (weighting > 1) {
                    sb.append("^").append(weighting);
                }
            }
            if (boostedTerms.length() > 0) {
                sb.append(boostedTerms);
            }
        }
        sb.append(")");
        return addedTerm;
    }

    /**
     * Removes characters from the input text that are not used within the CPE
     * index.
     *
     * @param text is the text to remove the characters from.
     * @return the text having removed some characters.
     */
    private String cleanseText(String text) {
        return text.replaceAll(CLEANSE_CHARACTER_RX, " ");
    }

    /**
     * Searches the collection of boost terms for the given term. The elements
     * are case insensitive matched using only the alpha-numeric contents of the
     * terms; all other characters are removed.
     *
     * @param term the term to search for
     * @param boost the collection of boost terms
     * @return the value identified
     */
    private String findBoostTerm(String term, Set<String> boost) {
        for (String entry : boost) {
            if (equalsIgnoreCaseAndNonAlpha(term, entry)) {
                return entry;
            }
        }
        return null;
    }

    /**
     * Compares two strings after lower casing them and removing the non-alpha
     * characters.
     *
     * @param l string one to compare.
     * @param r string two to compare.
     * @return whether or not the two strings are similar.
     */
    private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
        if (l == null || r == null) {
            return false;
        }

        final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "");
        final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "");
        return left.equalsIgnoreCase(right);
    }

    /**
     * Ensures that the CPE Identified matches the dependency. This validates
     * that the product, vendor, and version information for the CPE are
     * contained within the dependencies evidence.
     *
     * @param entry a CPE entry
     * @param dependency the dependency that the CPE entries could be for
     * @param majorVersions the major versions detected for the dependency
     * @return whether or not the entry is valid.
     */
    private boolean verifyEntry(final IndexEntry entry, final Dependency dependency,
            final Set<String> majorVersions) {
        boolean isValid = false;
        //TODO - does this nullify some of the fuzzy matching that happens in the lucene search?
        // for instance CPE some-component and in the evidence we have SomeComponent.

        //TODO - should this have a package manager only flag instead of just looking for NPM
        if (Ecosystem.NODEJS.equals(dependency.getEcosystem())) {
            for (Identifier i : dependency.getSoftwareIdentifiers()) {
                if (i instanceof PurlIdentifier) {
                    final PurlIdentifier p = (PurlIdentifier) i;
                    if (cleanPackageName(p.getName()).equals(cleanPackageName(entry.getProduct()))) {
                        isValid = true;
                    }
                }
            }
        } else if (collectionContainsString(dependency.getEvidence(EvidenceType.VENDOR), entry.getVendor())) {
            if (collectionContainsString(dependency.getEvidence(EvidenceType.PRODUCT), entry.getProduct())) {
                isValid = true;
            } else {
                isValid = majorVersions.stream().filter(version
                        -> version != null && entry.getProduct().endsWith("v" + version) && entry.getProduct().length() > version.length() + 1)
                        .anyMatch(version
                                -> collectionContainsString(dependency.getEvidence(EvidenceType.PRODUCT),
                                entry.getProduct().substring(0, entry.getProduct().length() - version.length() - 1))
                        );
                isValid |= majorVersions.stream().filter(version
                        -> version != null && entry.getProduct().endsWith(version) && entry.getProduct().length() > version.length())
                        .anyMatch(version
                                -> collectionContainsString(dependency.getEvidence(EvidenceType.PRODUCT),
                                entry.getProduct().substring(0, entry.getProduct().length() - version.length()))
                        );
            }
        }
        return isValid;
    }

    /**
     * Only returns alpha numeric characters contained in a given package name.
     *
     * @param name the package name to cleanse
     * @return the cleansed packaage name
     */
    private String cleanPackageName(String name) {
        if (name == null) {
            return "";
        }
        return name.replaceAll("[^a-zA-Z0-9]+", "");
    }

    /**
     * Used to determine if the EvidenceCollection contains a specific string.
     *
     * @param evidence an of evidence object to check
     * @param text the text to search for
     * @return whether or not the EvidenceCollection contains the string
     */
    @SuppressWarnings("StringSplitter")
    private boolean collectionContainsString(Set<Evidence> evidence, String text) {
        //TODO - likely need to change the split... not sure if this will work for CPE with special chars
        if (text == null) {
            return false;
        }
        // Check if we have an exact match
        final String textLC = text.toLowerCase();
        for (Evidence e : evidence) {
            if (e.getValue().toLowerCase().equals(textLC)) {
                return true;
            }
        }

        final String[] words = text.split("[\\s_-]+");
        final List<String> list = new ArrayList<>();
        String tempWord = null;
        final CharArraySet stopWords = SearchFieldAnalyzer.getStopWords();
        for (String word : words) {
            /*
             single letter words should be concatenated with the next word.
             so { "m", "core", "sample" } -> { "mcore", "sample" }
             */
            if (tempWord != null) {
                list.add(tempWord + word);
                tempWord = null;
            } else if (word.length() <= 2) {
                tempWord = word;
            } else {
                if (stopWords.contains(word)) {
                    continue;
                }
                list.add(word);
            }
        }
        if (tempWord != null) {
            if (!list.isEmpty()) {
                final String tmp = list.get(list.size() - 1) + tempWord;
                list.add(tmp);
            } else {
                list.add(tempWord);
            }
        }
        if (list.isEmpty()) {
            return false;
        }
        boolean isValid = true;

        // Prepare the evidence values, e.g. remove the characters we used for splitting
        final List<String> evidenceValues = new ArrayList<>(evidence.size());
        evidence.forEach((e) -> evidenceValues.add(e.getValue().toLowerCase().replaceAll("[\\s_-]+", "")));

        for (String word : list) {
            word = word.toLowerCase();
            boolean found = false;
            for (String e : evidenceValues) {
                if (e.contains(word)) {
                    if ("http".equals(word) && e.contains("http:")) {
                        continue;
                    }
                    found = true;
                    break;
                }
            }
            isValid &= found;
        }
        return isValid;
    }

    /**
     * Analyzes a dependency and attempts to determine if there are any CPE
     * identifiers for this dependency.
     *
     * @param dependency The Dependency to analyze.
     * @param engine The analysis engine
     * @throws AnalysisException is thrown if there is an issue analyzing the
     * dependency.
     */
    @Override
    protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
        if (skipEcosystems.contains(dependency.getEcosystem())) {
            return;
        }
        try {
            determineCPE(dependency);
        } catch (CorruptIndexException ex) {
            throw new AnalysisException("CPE Index is corrupt.", ex);
        } catch (IOException ex) {
            throw new AnalysisException("Failure opening the CPE Index.", ex);
        } catch (ParseException ex) {
            throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex);
        }
    }

    /**
     * Retrieves a list of CPE values from the CveDB based on the vendor and
     * product passed in. The list is then validated to find only CPEs that are
     * valid for the given dependency. It is possible that the CPE identified is
     * a best effort "guess" based on the vendor, product, and version
     * information.
     *
     * @param dependency the Dependency being analyzed
     * @param vendor the vendor for the CPE being analyzed
     * @param product the product for the CPE being analyzed
     * @param currentConfidence the current confidence being used during
     * analysis
     * @return <code>true</code> if an identifier was added to the dependency;
     * otherwise <code>false</code>
     * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported
     * @throws AnalysisException thrown if the suppression rules failed
     */
    @SuppressWarnings("StringSplitter")
    protected boolean determineIdentifiers(Dependency dependency, String vendor, String product,
            Confidence currentConfidence) throws UnsupportedEncodingException, AnalysisException {

        final CpeBuilder cpeBuilder = new CpeBuilder();

        final Set<CpePlus> cpePlusEntries = cve.getCPEs(vendor, product);
        final Set<Cpe> cpes = filterEcosystem(dependency.getEcosystem(), cpePlusEntries);
        if (cpes == null || cpes.isEmpty()) {
            return false;
        }

        DependencyVersion bestGuess;
        if ("Golang".equals(dependency.getEcosystem()) && dependency.getVersion() == null) {
            bestGuess = new DependencyVersion("*");
        } else {
            bestGuess = new DependencyVersion("-");
        }
        String bestGuessUpdate = null;
        Confidence bestGuessConf = null;
        String bestGuessURL = null;
        final Set<IdentifierMatch> collected = new HashSet<>();

        considerDependencyVersion(dependency, vendor, product, currentConfidence, collected);

        //TODO the following algorithm incorrectly identifies things as a lower version
        // if there lower confidence evidence when the current (highest) version number
        // is newer then anything in the NVD.
        for (Confidence conf : Confidence.values()) {
            for (Evidence evidence : dependency.getIterator(EvidenceType.VERSION, conf)) {
                final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue(), true);
                if (evVer == null) {
                    continue;
                }
                DependencyVersion evBaseVer = null;
                String evBaseVerUpdate = null;
                final int idx = evVer.getVersionParts().size() - 1;
                if (evVer.getVersionParts().get(idx)
                        .matches("^(v|release|final|snapshot|beta|alpha|u|rc|m|20\\d\\d).*$")) {
                    //store the update version
                    final String checkUpdate = evVer.getVersionParts().get(idx);
                    if (checkUpdate.matches("^(v|release|final|snapshot|beta|alpha|u|rc|m|20\\d\\d).*$")) {
                        evBaseVerUpdate = checkUpdate;
                        evBaseVer = new DependencyVersion();
                        evBaseVer.setVersionParts(evVer.getVersionParts().subList(0, idx));
                    }
                }
                //TODO - review and update for new JSON data
                for (Cpe vs : cpes) {
                    final DependencyVersion dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
                    DependencyVersion dbVerUpdate = dbVer;
                    if (vs.getUpdate() != null && !vs.getUpdate().isEmpty() && !vs.getUpdate().startsWith("*") && !vs.getUpdate().startsWith("-")) {
                        dbVerUpdate = DependencyVersionUtil.parseVersion(vs.getVersion() + '.' + vs.getUpdate(), true);
                    }
                    if (dbVer == null) { //special case, no version specified - everything is vulnerable
                        final String url = String.format(NVD_SEARCH_BROAD_URL, URLEncoder.encode(vs.getVendor(), UTF8),
                                URLEncoder.encode(vs.getProduct(), UTF8));
                        final IdentifierMatch match = new IdentifierMatch(vs, url, IdentifierConfidence.BROAD_MATCH, conf);
                        collected.add(match);
                    } else if (evVer.equals(dbVer)) {
                        addExactMatch(vs, evBaseVerUpdate, conf, collected);
                    } else if (evBaseVer != null && evBaseVer.equals(dbVer)
                            && (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0)) {
                        bestGuessConf = conf;
                        bestGuess = dbVer;
                        bestGuessUpdate = evBaseVerUpdate;
                        bestGuessURL = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getVendor(), UTF8),
                                URLEncoder.encode(vs.getProduct(), UTF8), URLEncoder.encode(vs.getVersion(), UTF8));
                    } else if (dbVerUpdate != null && evVer.getVersionParts().size() <= dbVerUpdate.getVersionParts().size()
                            && evVer.matchesAtLeastThreeLevels(dbVerUpdate)) {
                        if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
                            if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
                                bestGuess = dbVer;
                                bestGuessUpdate = evBaseVerUpdate;
                                bestGuessConf = conf;
                            }
                        }
                    }
                }
                if ((bestGuessConf == null || bestGuessConf.compareTo(conf) > 0)
                        && bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
                    bestGuess = evVer;
                    bestGuessUpdate = evBaseVerUpdate;
                    bestGuessConf = conf;
                }
            }
        }

        cpeBuilder.part(Part.APPLICATION).vendor(vendor).product(product);
        final int idx = bestGuess.getVersionParts().size() - 1;
        if (bestGuess.getVersionParts().get(idx)
                .matches("^(v|release|final|snapshot|beta|alpha|u|rc|m|20\\d\\d).*$")) {
            cpeBuilder.version(StringUtils.join(bestGuess.getVersionParts().subList(0, idx), "."));
            //when written - no update versions in the NVD start with v### - they all strip the v off
            if (bestGuess.getVersionParts().get(idx).matches("^v\\d.*$")) {
                cpeBuilder.update(bestGuess.getVersionParts().get(idx).substring(1));
            } else {
                cpeBuilder.update(bestGuess.getVersionParts().get(idx));
            }
        } else {
            cpeBuilder.version(bestGuess.toString());
            if (bestGuessUpdate != null) {
                cpeBuilder.update(bestGuessUpdate);
            }
        }
        final Cpe guessCpe;

        try {
            guessCpe = cpeBuilder.build();
        } catch (CpeValidationException ex) {
            throw new AnalysisException(String.format("Unable to create a CPE for %s:%s:%s", vendor, product, bestGuess));
        }
        if (!"-".equals(guessCpe.getVersion())) {
            String url = null;
            if (bestGuessURL != null) {
                url = bestGuessURL;
            }
            if (bestGuessConf == null) {
                bestGuessConf = Confidence.LOW;
            }
            final IdentifierMatch match = new IdentifierMatch(guessCpe, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);

            collected.add(match);
        }
        boolean identifierAdded = false;
        if (!collected.isEmpty()) {
            final List<IdentifierMatch> items = new ArrayList<>(collected);

            Collections.sort(items);
            final IdentifierConfidence bestIdentifierQuality = items.get(0).getIdentifierConfidence();
            final Confidence bestEvidenceQuality = items.get(0).getEvidenceConfidence();
            boolean addedNonGuess = false;
            final Confidence prevAddedConfidence = dependency.getVulnerableSoftwareIdentifiers().stream().map(Identifier::getConfidence)
                    .min(Comparator.comparing(Confidence::ordinal))
                    .orElse(Confidence.LOW);

            for (IdentifierMatch m : items) {
                if (bestIdentifierQuality.equals(m.getIdentifierConfidence())
                        && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
                    final CpeIdentifier i = m.getIdentifier();
                    if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
                        if (addedNonGuess) {
                            continue;
                        }
                        i.setConfidence(Confidence.LOW);
                    } else {
                        i.setConfidence(bestEvidenceQuality);
                    }
                    if (prevAddedConfidence.compareTo(i.getConfidence()) < 0) {
                        continue;
                    }

                    //TODO - while this gets the job down it is slow; consider refactoring
                    dependency.addVulnerableSoftwareIdentifier(i);
                    suppression.analyze(dependency, engine);
                    if (dependency.getVulnerableSoftwareIdentifiers().contains(i)) {
                        identifierAdded = true;
                        if (!addedNonGuess && bestIdentifierQuality != IdentifierConfidence.BEST_GUESS) {
                            addedNonGuess = true;
                        }
                    }
                }
            }
        }
        return identifierAdded;
    }

    /**
     * Adds a new CPE to the identifier match collection.
     *
     * @param vs a reference to the vulnerable software
     * @param updateVersion the update version
     * @param conf the current confidence
     * @param collected a reference to the collected identifiers
     * @throws UnsupportedEncodingException thrown if UTF-8 is not supported
     */
    private void addExactMatch(Cpe vs, String updateVersion, Confidence conf,
            final Set<IdentifierMatch> collected) throws UnsupportedEncodingException {

        final CpeBuilder cpeBuilder = new CpeBuilder();
        final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vs.getVendor(), UTF8),
                URLEncoder.encode(vs.getProduct(), UTF8), URLEncoder.encode(vs.getVersion(), UTF8));
        Cpe useCpe;
        if (updateVersion != null && "*".equals(vs.getUpdate())) {
            try {
                useCpe = cpeBuilder.part(vs.getPart()).wfVendor(vs.getWellFormedVendor())
                        .wfProduct(vs.getWellFormedProduct()).wfVersion(vs.getWellFormedVersion())
                        .wfEdition(vs.getWellFormedEdition()).wfLanguage(vs.getWellFormedLanguage())
                        .wfOther(vs.getWellFormedOther()).wfSwEdition(vs.getWellFormedSwEdition())
                        .update(updateVersion).build();
            } catch (CpeValidationException ex) {
                LOGGER.debug("Error building cpe with update:" + updateVersion, ex);
                useCpe = vs;
            }
        } else {
            useCpe = vs;
        }
        final IdentifierMatch match = new IdentifierMatch(useCpe, url, IdentifierConfidence.EXACT_MATCH, conf);
        collected.add(match);
    }

    /**
     * Evaluates whether or not to use the `version` of the dependency instead
     * of the version evidence. The dependency should not always be used as it
     * can cause FP.
     *
     * @param dependency the dependency being analyzed
     * @param product the product name
     * @param vendor the vendor name
     * @param confidence the current confidence level
     * @param collected a reference to the identifiers matched
     * @throws AnalysisException thrown if aliens attacked and valid input could
     * not be used to construct a CPE
     * @throws UnsupportedEncodingException thrown if run on a system that
     * doesn't support UTF-8
     */
    private void considerDependencyVersion(Dependency dependency,
            String vendor, String product, Confidence confidence,
            final Set<IdentifierMatch> collected)
            throws AnalysisException, UnsupportedEncodingException {

        if (dependency.getVersion() != null && !dependency.getVersion().isEmpty()) {
            final CpeBuilder cpeBuilder = new CpeBuilder();
            boolean useDependencyVersion = true;
            final CharArraySet stopWords = SearchFieldAnalyzer.getStopWords();
            if (dependency.getName() != null && !dependency.getName().isEmpty()) {
                final String name = dependency.getName();
                for (String word : product.split("[^a-zA-Z0-9]")) {
                    useDependencyVersion &= name.contains(word) || stopWords.contains(word)
                            || wordMatchesEcosystem(dependency.getEcosystem(), word);
                }
            }

            if (useDependencyVersion) {
                //TODO - we need to filter this so that we only use this if something in the
                //dependency.getName() matches the vendor/product in some way
                final DependencyVersion depVersion = new DependencyVersion(dependency.getVersion());
                if (depVersion.getVersionParts().size() > 0) {
                    cpeBuilder.part(Part.APPLICATION).vendor(vendor).product(product);
                    addVersionAndUpdate(depVersion, cpeBuilder);
                    try {
                        final Cpe depCpe = cpeBuilder.build();
                        final String url = String.format(NVD_SEARCH_URL, URLEncoder.encode(vendor, UTF8),
                                URLEncoder.encode(product, UTF8), URLEncoder.encode(depCpe.getVersion(), UTF8));
                        final IdentifierMatch match = new IdentifierMatch(depCpe, url, IdentifierConfidence.EXACT_MATCH, confidence);
                        collected.add(match);
                    } catch (CpeValidationException ex) {
                        throw new AnalysisException(String.format("Unable to create a CPE for %s:%s:%s", vendor, product, depVersion));
                    }
                }
            }
        }
    }

    /**
     * If a CPE product word represents the ecosystem of a dependency it is not required
     * to appear in the dependencyName to still consider the CPE product a match.
     *
     * @param ecosystem The ecosystem of the dependency
     * @param word       The word from the CPE product to check
     * @return {@code true} when the CPE product word is known to match the ecosystem of the dependency
     * @implNote This method is not intended to cover every possible case where the ecosystem is represented by the word. It is a
     * best-effort attempt to prevent {@link #considerDependencyVersion(Dependency, String, String, Confidence, Set)}
     * from not taking an exact-match versioned CPE into account because the ecosystem-related word does not appear in
     * the dependencyName. It helps prevent false-positive cases like https://github.com/jeremylong/DependencyCheck/issues/5545
     * @see #considerDependencyVersion(Dependency, String, String, Confidence, Set)
     */
    private boolean wordMatchesEcosystem(@Nullable String ecosystem, String word) {
        if (Ecosystem.JAVA.equalsIgnoreCase(word)) {
            return Ecosystem.JAVA.equals(ecosystem);
        }
        return false;
    }

    /**
     * <p>
     * Returns the setting key to determine if the analyzer is enabled.</p>
     *
     * @return the key for the analyzer's enabled property
     */
    @Override
    protected String getAnalyzerEnabledSettingKey() {
        return Settings.KEYS.ANALYZER_CPE_ENABLED;
    }

    /**
     * Filters the given list of CPE Entries (plus ecosystem) for the given
     * dependencies ecosystem.
     *
     * @param ecosystem the dependencies ecosystem
     * @param entries the CPE Entries (plus ecosystem)
     * @return the filtered list of CPE entries
     */
    private Set<Cpe> filterEcosystem(String ecosystem, Set<CpePlus> entries) {
        if (entries == null || entries.isEmpty()) {
            return null;
        }
        if (ecosystem != null) {
            return entries.stream().filter(c
                    -> c.getEcosystem() == null
                    || c.getEcosystem().equals(ecosystem)
                    //some ios CVE/CPEs are listed under native
                    || (Ecosystem.IOS.equals(ecosystem) && Ecosystem.NATIVE.equals(c.getEcosystem())))
                    .map(CpePlus::getCpe)
                    .collect(Collectors.toSet());
        }
        return entries.stream()
                .map(CpePlus::getCpe)
                .collect(Collectors.toSet());
    }

    /**
     * Add the given version to the CpeBuilder - this method attempts to parse
     * out the update from the version and correctly set the value in the CPE.
     *
     * @param depVersion the version to add
     * @param cpeBuilder a reference to the CPE Builder
     */
    private void addVersionAndUpdate(DependencyVersion depVersion, final CpeBuilder cpeBuilder) {
        final int idx = depVersion.getVersionParts().size() - 1;
        if (idx > 0 && depVersion.getVersionParts().get(idx)
                .matches("^(v|final|release|snapshot|r|b|beta|a|alpha|u|rc|sp|dev|revision|service|build|pre|p|patch|update|m|20\\d\\d).*$")) {
            cpeBuilder.version(StringUtils.join(depVersion.getVersionParts().subList(0, idx), "."));
            //when written - no update versions in the NVD start with v### - they all strip the v off
            if (depVersion.getVersionParts().get(idx).matches("^v\\d.*$")) {
                cpeBuilder.update(depVersion.getVersionParts().get(idx).substring(1));
            } else {
                cpeBuilder.update(depVersion.getVersionParts().get(idx));
            }
        } else {
            cpeBuilder.version(depVersion.toString());
        }
    }

    /**
     * The confidence whether the identifier is an exact match, or a best guess.
     */
    private enum IdentifierConfidence {

        /**
         * An exact match for the CPE.
         */
        EXACT_MATCH,
        /**
         * A best guess for the CPE.
         */
        BEST_GUESS,
        /**
         * The entire vendor/product group must be added (without a guess at
         * version) because there is a CVE with a VS that only specifies
         * vendor/product.
         */
        BROAD_MATCH
    }

    /**
     * A simple object to hold an identifier and carry information about the
     * confidence in the identifier.
     */
    private static class IdentifierMatch implements Comparable<IdentifierMatch> {

        /**
         * The confidence whether this is an exact match, or a best guess.
         */
        private IdentifierConfidence identifierConfidence;
        /**
         * The CPE identifier.
         */
        private CpeIdentifier identifier;

        /**
         * Constructs an IdentifierMatch.
         *
         * @param cpe the CPE value for the match
         * @param url the URL of the identifier
         * @param identifierConfidence the confidence in the identifier: best
         * guess or exact match
         * @param evidenceConfidence the confidence of the evidence used to find
         * the identifier
         */
        IdentifierMatch(Cpe cpe, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
            this.identifier = new CpeIdentifier(cpe, url, evidenceConfidence);
            this.identifierConfidence = identifierConfidence;
        }

        //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier">
        /**
         * Get the value of evidenceConfidence
         *
         * @return the value of evidenceConfidence
         */
        public Confidence getEvidenceConfidence() {
            return this.identifier.getConfidence();
        }

        /**
         * Set the value of evidenceConfidence
         *
         * @param evidenceConfidence new value of evidenceConfidence
         */
        public void setEvidenceConfidence(Confidence evidenceConfidence) {
            this.identifier.setConfidence(evidenceConfidence);
        }

        /**
         * Get the value of confidence.
         *
         * @return the value of confidence
         */
        public IdentifierConfidence getIdentifierConfidence() {
            return identifierConfidence;
        }

        /**
         * Set the value of confidence.
         *
         * @param confidence new value of confidence
         */
        public void setIdentifierConfidence(IdentifierConfidence confidence) {
            this.identifierConfidence = confidence;
        }

        /**
         * Get the value of identifier.
         *
         * @return the value of identifier
         */
        public CpeIdentifier getIdentifier() {
            return identifier;
        }

        /**
         * Set the value of identifier.
         *
         * @param identifier new value of identifier
         */
        public void setIdentifier(CpeIdentifier identifier) {
            this.identifier = identifier;
        }
        //</editor-fold>
        //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals">

        /**
         * Standard toString() implementation.
         *
         * @return the string representation of the object
         */
        @Override
        public String toString() {
            return "IdentifierMatch{ IdentifierConfidence=" + identifierConfidence + ", identifier=" + identifier + '}';
        }

        /**
         * Standard hashCode() implementation.
         *
         * @return the hashCode
         */
        @Override
        public int hashCode() {
            return new HashCodeBuilder(115, 303)
                    .append(identifierConfidence)
                    .append(identifier)
                    .toHashCode();
        }

        /**
         * Standard equals implementation.
         *
         * @param obj the object to compare
         * @return true if the objects are equal, otherwise false
         */
        @Override
        public boolean equals(Object obj) {
            if (obj == null || !(obj instanceof IdentifierMatch)) {
                return false;
            }
            if (this == obj) {
                return true;
            }
            final IdentifierMatch other = (IdentifierMatch) obj;
            return new EqualsBuilder()
                    .append(identifierConfidence, other.identifierConfidence)
                    .append(identifier, other.identifier)
                    .build();
        }
        //</editor-fold>

        /**
         * Standard implementation of compareTo that compares identifier
         * confidence, evidence confidence, and then the identifier.
         *
         * @param o the IdentifierMatch to compare to
         * @return the natural ordering of IdentifierMatch
         */
        @Override
        public int compareTo(@NotNull IdentifierMatch o) {
            return new CompareToBuilder()
                    .append(identifierConfidence, o.identifierConfidence)
                    .append(identifier, o.identifier)
                    .toComparison();
        }
    }

    /**
     * Command line tool for querying the Lucene CPE Index.
     *
     * @param args not used
     */
    @SuppressWarnings("InfiniteLoopStatement")
    public static void main(String[] args) {
        final Settings props = new Settings();
        try (Engine en = new Engine(Engine.Mode.EVIDENCE_PROCESSING, props)) {
            en.openDatabase(false, false);
            final CPEAnalyzer analyzer = new CPEAnalyzer();
            analyzer.initialize(props);
            analyzer.prepareAnalyzer(en);
            LOGGER.error("test");
            System.out.println("Memory index query for ODC");
            try (BufferedReader br = new BufferedReader(new InputStreamReader(System.in, StandardCharsets.UTF_8))) {
                while (true) {

                    final Map<String, MutableInt> vendor = new HashMap<>();
                    final Map<String, MutableInt> product = new HashMap<>();
                    System.out.print("Vendor: ");
                    String[] parts = br.readLine().split(" ");
                    for (String term : parts) {
                        final MutableInt count = vendor.get(term);
                        if (count == null) {
                            vendor.put(term, new MutableInt(0));
                        } else {
                            count.add(1);
                        }
                    }
                    System.out.print("Product: ");
                    parts = br.readLine().split(" ");
                    for (String term : parts) {
                        final MutableInt count = product.get(term);
                        if (count == null) {
                            product.put(term, new MutableInt(0));
                        } else {
                            count.add(1);
                        }
                    }
                    final List<IndexEntry> list = analyzer.searchCPE(vendor, product, new HashSet<>(), new HashSet<>(), "default");
                    if (list == null || list.isEmpty()) {
                        System.out.println("No results found");
                    } else {
                        list.forEach((e) -> System.out.printf("%s:%s (%f)%n", e.getVendor(), e.getProduct(),
                                e.getSearchScore()));
                    }
                    System.out.println();
                    System.out.println();
                }
            }
        } catch (InitializationException | IOException ex) {
            System.err.println("Lucene ODC search tool failed:");
            System.err.println(ex.getMessage());
        }
    }

    /**
     * Sets the reference to the CveDB.
     *
     * @param cveDb the CveDB
     */
    protected void setCveDB(CveDB cveDb) {
        this.cve = cveDb;
    }

    /**
     * returns a reference to the CveDB.
     *
     * @return a reference to the CveDB
     */
    protected CveDB getCveDB() {
        return this.cve;
    }

    /**
     * Sets the MemoryIndex.
     *
     * @param idx the memory index
     */
    protected void setMemoryIndex(MemoryIndex idx) {
        cpe = idx;
    }

    /**
     * Returns the memory index.
     *
     * @return the memory index
     */
    protected MemoryIndex getMemoryIndex() {
        return cpe;
    }

    /**
     * Sets the CPE Suppression Analyzer.
     *
     * @param suppression the CPE Suppression Analyzer
     */
    protected void setCpeSuppressionAnalyzer(CpeSuppressionAnalyzer suppression) {
        this.suppression = suppression;
    }
}
