/*
 * This file is part of dependency-check-core.
 *
 * Dependency-check-core is free software: you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation, either version 3 of the License, or (at your option) any
 * later version.
 *
 * Dependency-check-core is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 * details.
 *
 * You should have received a copy of the GNU General Public License along with
 * dependency-check-core. If not, see http://www.gnu.org/licenses/.
 *
 * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
 */
package org.owasp.dependencycheck.analyzer;

import java.io.File;
import java.util.Enumeration;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.xml.bind.JAXBException;
import javax.xml.parsers.ParserConfigurationException;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Evidence;
import org.owasp.dependencycheck.dependency.EvidenceCollection;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.Reader;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Properties;
import java.util.Set;
import java.util.StringTokenizer;
import java.util.jar.Attributes;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;
import java.util.jar.Manifest;
import java.util.regex.Pattern;
import java.util.zip.ZipEntry;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBElement;
import javax.xml.bind.Unmarshaller;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import javax.xml.transform.sax.SAXSource;
import org.jsoup.Jsoup;
import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter;
import org.owasp.dependencycheck.jaxb.pom.generated.License;
import org.owasp.dependencycheck.jaxb.pom.generated.Model;
import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
import org.owasp.dependencycheck.utils.NonClosingStream;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.XMLFilter;
import org.xml.sax.XMLReader;

/**
 *
 * Used to load a JAR file and collect information that can be used to determine
 * the associated CPE.
 *
 * @author Jeremy Long (jeremy.long@owasp.org)
 */
public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {

    //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables">
    /**
     * The system independent newline character.
     */
    private static final String NEWLINE = System.getProperty("line.separator");
    /**
     * A list of values in the manifest to ignore as they only result in false
     * positives.
     */
    private static final Set<String> IGNORE_VALUES = newHashSet(
            "Sun Java System Application Server");
    /**
     * A list of elements in the manifest to ignore.
     */
    private static final Set<String> IGNORE_KEYS = newHashSet(
            "built-by",
            "created-by",
            "builtby",
            "createdby",
            "build-jdk",
            "buildjdk",
            "ant-version",
            "antversion",
            "import-package",
            "export-package",
            "importpackage",
            "exportpackage",
            "sealed",
            "manifest-version",
            "archiver-version",
            "manifestversion",
            "archiverversion",
            "classpath",
            "class-path",
            "tool",
            "bundle-manifestversion",
            "bundlemanifestversion",
            "include-resource");
    /**
     * item in some manifest, should be considered medium confidence.
     */
    private static final String BUNDLE_VERSION = "Bundle-Version"; //: 2.1.2
    /**
     * item in some manifest, should be considered medium confidence.
     */
    private static final String BUNDLE_DESCRIPTION = "Bundle-Description"; //: Apache Struts 2
    /**
     * item in some manifest, should be considered medium confidence.
     */
    private static final String BUNDLE_NAME = "Bundle-Name"; //: Struts 2 Core
    /**
     * item in some manifest, should be considered medium confidence.
     */
    private static final String BUNDLE_VENDOR = "Bundle-Vendor"; //: Apache Software Foundation
    /**
     * A pattern to detect HTML within text.
     */
    private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE);
    /**
     * The unmarshaller used to parse the pom.xml from a JAR file.
     */
    private Unmarshaller pomUnmarshaller;
    //</editor-fold>

    /**
     * Constructs a new JarAnalyzer.
     */
    public JarAnalyzer() {
        try {
            final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated");
            pomUnmarshaller = jaxbContext.createUnmarshaller();
        } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details.");
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
        }
    }
    //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    /**
     * The name of the analyzer.
     */
    private static final String ANALYZER_NAME = "Jar Analyzer";
    /**
     * The phase that this analyzer is intended to run in.
     */
    private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    /**
     * The set of file extensions supported by this analyzer.
     */
    private static final Set<String> EXTENSIONS = newHashSet("jar");

    /**
     * Returns a list of file EXTENSIONS supported by this analyzer.
     *
     * @return a list of file EXTENSIONS supported by this analyzer.
     */
    public Set<String> getSupportedExtensions() {
        return EXTENSIONS;
    }

    /**
     * Returns the name of the analyzer.
     *
     * @return the name of the analyzer.
     */
    public String getName() {
        return ANALYZER_NAME;
    }

    /**
     * Returns whether or not this analyzer can process the given extension.
     *
     * @param extension the file extension to test for support.
     * @return whether or not the specified file extension is supported by this
     * analyzer.
     */
    public boolean supportsExtension(String extension) {
        return EXTENSIONS.contains(extension);
    }

    /**
     * Returns the phase that the analyzer is intended to run in.
     *
     * @return the phase that the analyzer is intended to run in.
     */
    public AnalysisPhase getAnalysisPhase() {
        return ANALYSIS_PHASE;
    }
    //</editor-fold>

    /**
     * Loads a specified JAR file and collects information from the manifest and
     * checksums to identify the correct CPE information.
     *
     * @param dependency the dependency to analyze.
     * @param engine the engine that is scanning the dependencies
     * @throws AnalysisException is thrown if there is an error reading the JAR
     * file.
     */
    @Override
    public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
        try {
            final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
            final String fileName = dependency.getFileName().toLowerCase();
            if (classNames.isEmpty()
                    && (fileName.endsWith("-sources.jar")
                    || fileName.endsWith("-javadoc.jar")
                    || fileName.endsWith("-src.jar")
                    || fileName.endsWith("-doc.jar"))) {
                engine.getDependencies().remove(dependency);
            }
            final boolean hasManifest = parseManifest(dependency, classNames);
            final boolean hasPOM = analyzePOM(dependency, classNames);
            final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
            analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
        } catch (IOException ex) {
            throw new AnalysisException("Exception occurred reading the JAR file.", ex);
        }
    }

    /**
     * Attempts to find a pom.xml within the JAR file. If found it extracts
     * information and adds it to the evidence. This will attempt to interpolate
     * the strings contained within the pom.properties if one exists.
     *
     * @param dependency the dependency being analyzed
     * @param classes a collection of class name information
     * @throws AnalysisException is thrown if there is an exception parsing the
     * pom
     * @return whether or not evidence was added to the dependency
     */
    protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes) throws AnalysisException {
        boolean foundSomething = false;
        final JarFile jar;
        try {
            jar = new JarFile(dependency.getActualFilePath());
        } catch (IOException ex) {
            final String msg = String.format("Unable to read JarFile '%s'.", dependency.getActualFilePath());
            final AnalysisException ax = new AnalysisException(msg, ex);
            dependency.getAnalysisExceptions().add(ax);
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
            return false;
        }
        List<String> pomEntries;
        try {
            pomEntries = retrievePomListing(jar);
        } catch (IOException ex) {
            final String msg = String.format("Unable to read Jar file entries in '%s'.", dependency.getActualFilePath());
            final AnalysisException ax = new AnalysisException(msg, ex);
            dependency.getAnalysisExceptions().add(ax);
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, msg, ex);
            return false;
        }
        if (pomEntries.isEmpty()) {
            return false;
        }
        if (pomEntries.size() > 1) { //need to sort out which pom we will use
            pomEntries = filterPomEntries(pomEntries, classes);
        }
        for (String path : pomEntries) {
            Properties pomProperties = null;
            try {
                pomProperties = retrievePomProperties(path, jar);
            } catch (IOException ex) {
                Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex);
            }
            Model pom = null;
            try {
                pom = retrievePom(path, jar);
            } catch (JAXBException ex) {
                final String msg = String.format("Unable to parse POM '%s' in '%s'",
                        path, dependency.getFilePath());
                final AnalysisException ax = new AnalysisException(msg, ex);
                dependency.getAnalysisExceptions().add(ax);
                Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, msg, ax);
            } catch (IOException ex) {
                final String msg = String.format("Unable to retrieve POM '%s' in '%s'",
                        path, dependency.getFilePath());
                Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, msg, ex);
            }
            foundSomething = setPomEvidence(dependency, pom, pomProperties, classes) || foundSomething;
        }
        return foundSomething;
    }

    /**
     * Given a path to a pom.xml within a JarFile, this method attempts to load
     * a sibling pom.properties if one exists.
     *
     * @param path the path to the pom.xml within the JarFile
     * @param jar the JarFile to load the pom.properties from
     * @return a Properties object or null if no pom.properties was found
     * @throws IOException thrown if there is an exception reading the
     * pom.properties
     */
    @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM",
            justification = "The reader is closed by closing the zipEntry")
    private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
        Properties pomProperties = null;
        final String propPath = path.substring(0, path.length() - 7) + "pom.properies";
        final ZipEntry propEntry = jar.getEntry(propPath);
        if (propEntry != null) {
            final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8");
            pomProperties = new Properties();
            pomProperties.load(reader);
        }
        return pomProperties;
    }

    /**
     * Searches a JarFile for pom.xml entries and returns a listing of these
     * entries.
     *
     * @param jar the JarFile to search
     * @return a list of pom.xml entries
     * @throws IOException thrown if there is an exception reading a JarEntryf
     */
    private List<String> retrievePomListing(final JarFile jar) throws IOException {
        final List<String> pomEntries = new ArrayList<String>();
        final Enumeration<JarEntry> entries = jar.entries();
        while (entries.hasMoreElements()) {
            final JarEntry entry = entries.nextElement();
            final String entryName = (new File(entry.getName())).getName().toLowerCase();
            if (!entry.isDirectory() && "pom.xml".equals(entryName)) {
                pomEntries.add(entry.getName());
            }
        }
        return pomEntries;
    }

    /**
     * Retrieves the specified POM from a jar file and converts it to a Model.
     *
     * @param path the path to the pom.xml file within the jar file
     * @param jar the jar file to extract the pom from
     * @return returns a
     * {@link org.owasp.dependencycheck.analyzer.pom.generated.Model} object
     * @throws JAXBException is thrown if there is an exception parsing the pom
     * @throws IOException is thrown if there is an exception reading the jar
     */
    private Model retrievePom(String path, JarFile jar) throws JAXBException, IOException {
        final ZipEntry entry = jar.getEntry(path);
        if (entry != null) { //should never be null
            Model m = null;
            try {
                final XMLFilter filter = new MavenNamespaceFilter();
                final SAXParserFactory spf = SAXParserFactory.newInstance();
                final SAXParser sp = spf.newSAXParser();
                final XMLReader xr = sp.getXMLReader();
                filter.setParent(xr);
                final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
                final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
                final InputSource xml = new InputSource(reader);
                final SAXSource source = new SAXSource(filter, xml);
                final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class);
                m = el.getValue();
            } catch (ParserConfigurationException ex) {
                final String msg = String.format("Unable to parse pom '%s' in jar '%s'", path, jar.getName());
                Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, msg, ex);
            } catch (SAXException ex) {
                final String msg = String.format("Unable to parse pom '%s' in jar '%s'", path, jar.getName());
                Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, msg, ex);
            }
            return m;
        }
        return null;
    }

    /**
     * Sets evidence from the pom on the supplied dependency.
     *
     * @param dependency the dependency to set data on
     * @param pom the information from the pom
     * @param pomProperties the pom properties file (null if none exists)
     * @param classes a collection of ClassNameInformation - containing data
     * about the fully qualified class names within the JAR file being analyzed
     * @return true if there was evidence within the pom that we could use;
     * otherwise false
     */
    private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
        boolean foundSomething = false;
        if (pom == null) {
            return foundSomething;
        }
        String groupid = interpolateString(pom.getGroupId(), pomProperties);
        if (groupid != null && !groupid.isEmpty()) {
            if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
                groupid = groupid.substring(4);
            }
            foundSomething = true;
            dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.HIGH);
            dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.LOW);
            addMatchingValues(classes, groupid, dependency.getVendorEvidence());
            addMatchingValues(classes, groupid, dependency.getProductEvidence());
        }
        String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
        if (artifactid != null && !artifactid.isEmpty()) {
            if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
                artifactid = artifactid.substring(4);
            }
            foundSomething = true;
            dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.HIGH);
            dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.LOW);
            addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
            addMatchingValues(classes, artifactid, dependency.getProductEvidence());
        }
        //version
        final String version = interpolateString(pom.getVersion(), pomProperties);
        if (version != null && !version.isEmpty()) {
            foundSomething = true;
            dependency.getVersionEvidence().addEvidence("pom", "version", version, Evidence.Confidence.HIGHEST);
        }
        // org name
        final Organization org = pom.getOrganization();
        if (org != null && org.getName() != null) {
            foundSomething = true;
            final String orgName = interpolateString(org.getName(), pomProperties);
            if (orgName != null && !orgName.isEmpty()) {
                dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Evidence.Confidence.HIGH);
                addMatchingValues(classes, orgName, dependency.getVendorEvidence());
            }
        }
        //pom name
        final String pomName = interpolateString(pom.getName(), pomProperties);
        if (pomName != null && !pomName.isEmpty()) {
            foundSomething = true;
            dependency.getProductEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH);
            dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH);
            addMatchingValues(classes, pomName, dependency.getVendorEvidence());
            addMatchingValues(classes, pomName, dependency.getProductEvidence());
        }

        //Description
        if (pom.getDescription() != null) {
            foundSomething = true;
            final String description = interpolateString(pom.getDescription(), pomProperties);
            if (description != null && !description.isEmpty()) {
                addDescription(dependency, description, "pom", "description");
                addMatchingValues(classes, description, dependency.getVendorEvidence());
                addMatchingValues(classes, description, dependency.getProductEvidence());
            }
        }

        //license
        if (pom.getLicenses() != null) {
            String license = null;
            for (License lic : pom.getLicenses().getLicense()) {
                String tmp = null;
                if (lic.getName() != null) {
                    tmp = interpolateString(lic.getName(), pomProperties);
                }
                if (lic.getUrl() != null) {
                    if (tmp == null) {
                        tmp = interpolateString(lic.getUrl(), pomProperties);
                    } else {
                        tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
                    }
                }
                if (tmp == null) {
                    continue;
                }
                if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
                    tmp = Jsoup.parse(tmp).text();
                }
                if (license == null) {
                    license = tmp;
                } else {
                    license += "\n" + tmp;
                }
            }
            if (license != null) {
                dependency.setLicense(license);
            }
        }
        return foundSomething;
    }

    /**
     * Analyzes the path information of the classes contained within the
     * JarAnalyzer to try and determine possible vendor or product names. If any
     * are found they are stored in the packageVendor and packageProduct
     * hashSets.
     *
     * @param classNames a list of class names
     * @param dependency a dependency to analyze
     * @param addPackagesAsEvidence a flag indicating whether or not package
     * names should be added as evidence.
     */
    protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
            Dependency dependency, boolean addPackagesAsEvidence) {
        final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
        final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
        analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);

        final int classCount = classNames.size();
        final EvidenceCollection vendor = dependency.getVendorEvidence();
        final EvidenceCollection product = dependency.getProductEvidence();

        for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
            final float ratio = entry.getValue() / (float) classCount;
            if (ratio > 0.5) {
                //TODO remove weighting
                vendor.addWeighting(entry.getKey());
                if (addPackagesAsEvidence) {
                    vendor.addEvidence("jar", "package", entry.getKey(), Evidence.Confidence.LOW);
                }
            }
        }
        for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
            final float ratio = entry.getValue() / (float) classCount;
            if (ratio > 0.5) {
                product.addWeighting(entry.getKey());
                if (addPackagesAsEvidence) {
                    product.addEvidence("jar", "package", entry.getKey(), Evidence.Confidence.LOW);
                }
            }
        }
    }

    /**
     * <p>Reads the manifest from the JAR file and collects the entries. Some
     * vendorKey entries are:</p> <ul><li>Implementation Title</li>
     * <li>Implementation Version</li> <li>Implementation Vendor</li>
     * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle
     * Version</li> <li>Bundle Vendor</li> <li>Bundle Description</li> <li>Main
     * Class</li> </ul>
     * However, all but a handful of specific entries are read in.
     *
     * @param dependency A reference to the dependency
     * @param classInformation a collection of class information
     * @return whether evidence was identified parsing the manifest
     * @throws IOException if there is an issue reading the JAR file
     */
    protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
        boolean foundSomething = false;
        JarFile jar = null;
        try {
            jar = new JarFile(dependency.getActualFilePath());

            final Manifest manifest = jar.getManifest();
            if (manifest == null) {
                //don't log this for javadoc or sources jar files
                if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar")
                        && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar")
                        && !dependency.getFileName().toLowerCase().endsWith("-src.jar")
                        && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) {
                    Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO,
                            String.format("Jar file '%s' does not contain a manifest.",
                            dependency.getFileName()));
                }
                return false;
            }
            final Attributes atts = manifest.getMainAttributes();

            final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
            final EvidenceCollection productEvidence = dependency.getProductEvidence();
            final EvidenceCollection versionEvidence = dependency.getVersionEvidence();

            final String source = "Manifest";

            for (Entry<Object, Object> entry : atts.entrySet()) {
                String key = entry.getKey().toString();
                String value = atts.getValue(key);
                if (HTML_DETECTION_PATTERN.matcher(value).find()) {
                    value = Jsoup.parse(value).text();
                }
                if (IGNORE_VALUES.contains(value)) {
                    continue;
                } else if (key.equals(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
                    foundSomething = true;
                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
                    addMatchingValues(classInformation, value, productEvidence);
                } else if (key.equals(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
                    foundSomething = true;
                    versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
                } else if (key.equals(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
                    foundSomething = true;
                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
                    addMatchingValues(classInformation, value, vendorEvidence);
                } else if (key.equals(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
                    foundSomething = true;
                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                    addMatchingValues(classInformation, value, vendorEvidence);
                } else if (key.equals(BUNDLE_DESCRIPTION)) {
                    foundSomething = true;
                    addDescription(dependency, value, "manifest", key);
                    //productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                    addMatchingValues(classInformation, value, productEvidence);
                } else if (key.equals(BUNDLE_NAME)) {
                    foundSomething = true;
                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                    addMatchingValues(classInformation, value, productEvidence);
                } else if (key.equals(BUNDLE_VENDOR)) {
                    foundSomething = true;
                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
                    addMatchingValues(classInformation, value, vendorEvidence);
                } else if (key.equals(BUNDLE_VERSION)) {
                    foundSomething = true;
                    versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
                } else if (key.equals(Attributes.Name.MAIN_CLASS.toString())) {
                    continue;
                    //skipping main class as if this has important information to add
                    // it will be added during class name analysis...  if other fields
                    // have the information from the class name then they will get added...
//                    foundSomething = true;
//                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
//                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
//                    addMatchingValues(classInformation, value, vendorEvidence);
//                    addMatchingValues(classInformation, value, productEvidence);
                } else {
                    key = key.toLowerCase();

                    if (!IGNORE_KEYS.contains(key)
                            && !key.endsWith("jdk")
                            && !key.contains("lastmodified")
                            && !key.endsWith("package")
                            && !key.endsWith("classpath")
                            && !key.endsWith("class-path")
                            && !key.endsWith("-scm") //todo change this to a regex?
                            && !key.startsWith("scm-")
                            && !isImportPackage(key, value)
                            && !isPackage(key, value)) {

                        foundSomething = true;
                        if (key.contains("version")) {
                            versionEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                        } else if (key.contains("title")) {
                            productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                            addMatchingValues(classInformation, value, productEvidence);
                        } else if (key.contains("vendor")) {
                            vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                            addMatchingValues(classInformation, value, vendorEvidence);
                        } else if (key.contains("name")) {
                            productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                            vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
                            addMatchingValues(classInformation, value, vendorEvidence);
                            addMatchingValues(classInformation, value, productEvidence);
                        } else if (key.contains("license")) {
                            addLicense(dependency, value);
                        } else {
                            if (key.contains("description")) {
                                addDescription(dependency, value, "manifest", key);
                            } else {
                                productEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
                                vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
                                addMatchingValues(classInformation, value, vendorEvidence);
                                addMatchingValues(classInformation, value, productEvidence);
                                if (value.matches(".*\\d.*")) {
                                    final StringTokenizer tokenizer = new StringTokenizer(value, " ");
                                    while (tokenizer.hasMoreElements()) {
                                        final String s = tokenizer.nextToken();
                                        if (s.matches("^[0-9.]+$")) {
                                            versionEvidence.addEvidence(source, key, s, Evidence.Confidence.LOW);
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        } finally {
            if (jar != null) {
                jar.close();
            }
        }
        return foundSomething;
    }

    /**
     * Adds a description to the given dependency.
     *
     * @param dependency a dependency
     * @param description the description
     * @param source the source of the evidence
     * @param key the "name" of the evidence
     */
    private void addDescription(Dependency dependency, String description, String source, String key) {
        if (dependency.getDescription() == null) {
            dependency.setDescription(description);
        }
        String desc;
        if (HTML_DETECTION_PATTERN.matcher(description).find()) {
            desc = Jsoup.parse(description).text();
        } else {
            desc = description;
        }
        dependency.setDescription(desc);
        if (desc.length() > 100) {
            final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100);
            final int posLike = desc.toLowerCase().indexOf("like ", 100);
            int pos = -1;
            if (posLike > 0 && posSuchAs > 0) {
                pos = posLike > posSuchAs ? posLike : posSuchAs;
            } else if (posLike > 0) {
                pos = posLike;
            } else if (posSuchAs > 0) {
                pos = posSuchAs;
            }
            String descToUse = desc;
            if (pos > 0) {
                final StringBuilder sb = new StringBuilder(pos + 3);
                sb.append(desc.substring(0, pos));
                sb.append("...");
                descToUse = sb.toString();
            }
            dependency.getProductEvidence().addEvidence(source, key, descToUse, Evidence.Confidence.LOW);
            dependency.getVendorEvidence().addEvidence(source, key, descToUse, Evidence.Confidence.LOW);
        } else {
            dependency.getProductEvidence().addEvidence(source, key, desc, Evidence.Confidence.MEDIUM);
            dependency.getVendorEvidence().addEvidence(source, key, desc, Evidence.Confidence.MEDIUM);
        }
    }

    /**
     * Adds a license to the given dependency.
     *
     * @param d a dependency
     * @param license the license
     */
    private void addLicense(Dependency d, String license) {
        if (d.getLicense() == null) {
            d.setLicense(license);
        } else if (!d.getLicense().contains(license)) {
            d.setLicense(d.getLicense() + NEWLINE + license);
        }
    }

    /**
     * The initialize method does nothing for this Analyzer.
     */
    public void initialize() {
        //do nothing
    }

    /**
     * The close method does nothing for this Analyzer.
     */
    public void close() {
        //do nothing
    }

    /**
     * <p>A utility function that will interpolate strings based on values given
     * in the properties file. It will also interpolate the strings contained
     * within the properties file so that properties can reference other
     * properties.</p>
     * <p><b>Note:</b> if there is no property found the reference will be
     * removed. In other words, if the interpolated string will be replaced with
     * an empty string.
     * </p>
     * <p>Example:</p>
     * <code>
     * Properties p = new Properties();
     * p.setProperty("key", "value");
     * String s = interpolateString("'${key}' and '${nothing}'", p);
     * System.out.println(s);
     * </code>
     * <p>Will result in:</p>
     * <code>
     * 'value' and ''
     * </code>
     *
     * @param text the string that contains references to properties.
     * @param properties a collection of properties that may be referenced
     * within the text.
     * @return the interpolated text.
     */
    protected String interpolateString(String text, Properties properties) {
        Properties props = properties;
        if (text == null) {
            return text;
        }
        if (props == null) {
            props = new Properties();
        }

        final int pos = text.indexOf("${");
        if (pos < 0) {
            return text;
        }
        final int end = text.indexOf("}");
        if (end < pos) {
            return text;
        }

        final String propName = text.substring(pos + 2, end);
        String propValue = interpolateString(props.getProperty(propName), props);
        if (propValue == null) {
            propValue = "";
        }
        final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
        sb.append(text.subSequence(0, pos));
        sb.append(propValue);
        sb.append(text.substring(end + 1));
        return interpolateString(sb.toString(), props); //yes yes, this should be a loop...
    }

    /**
     * Determines if the key value pair from the manifest is for an "import"
     * type entry for package names.
     *
     * @param key the key from the manifest
     * @param value the value from the manifest
     * @return true or false depending on if it is believed the entry is an
     * "import" entry
     */
    private boolean isImportPackage(String key, String value) {
        final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$");
        if (packageRx.matcher(value).matches()) {
            return (key.contains("import") || key.contains("include"));
        }
        return false;
    }

    /**
     * Cycles through an enumeration of JarEntries, contained within the
     * dependency, and returns a list of the class names. This does not include
     * core Java package names (i.e. java.* or javax.*).
     *
     * @param dependency the dependency being analyzed
     * @return an list of fully qualified class names
     */
    private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
        final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
        JarFile jar = null;
        try {
            jar = new JarFile(dependency.getActualFilePath());
            final Enumeration entries = jar.entries();
            while (entries.hasMoreElements()) {
                final JarEntry entry = (JarEntry) entries.nextElement();
                final String name = entry.getName().toLowerCase();
                //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs.
                if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) {
                    final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
                    classNames.add(className);
                }
            }
        } catch (IOException ex) {
            final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName());
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
            Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
        } finally {
            if (jar != null) {
                try {
                    jar.close();
                } catch (IOException ex) {
                    Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex);
                }
            }
        }
        return classNames;
    }

    /**
     * Cycles through the list of class names and places the package levels 0-3
     * into the provided maps for vendor and product. This is helpful when
     * analyzing vendor/product as many times this is included in the package
     * name.
     *
     * @param classNames a list of class names
     * @param vendor HashMap of possible vendor names from package names (e.g.
     * owasp)
     * @param product HashMap of possible product names from package names (e.g.
     * dependencycheck)
     */
    private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
            HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
        for (ClassNameInformation entry : classNames) {
            final ArrayList<String> list = entry.getPackageStructure();
            addEntry(vendor, list.get(0));

            if (list.size() == 2) {
                addEntry(product, list.get(1));
            }
            if (list.size() == 3) {
                addEntry(vendor, list.get(1));
                addEntry(product, list.get(1));
                addEntry(product, list.get(2));
            }
            if (list.size() >= 4) {
                addEntry(vendor, list.get(1));
                addEntry(vendor, list.get(2));
                addEntry(product, list.get(1));
                addEntry(product, list.get(2));
                addEntry(product, list.get(3));
            }
        }
    }

    /**
     * Adds an entry to the specified collection and sets the Integer (e.g. the
     * count) to 1. If the entry already exists in the collection then the
     * Integer is incremented by 1.
     *
     * @param collection a collection of strings and their occurrence count
     * @param key the key to add to the collection
     */
    private void addEntry(HashMap<String, Integer> collection, String key) {
        if (collection.containsKey(key)) {
            collection.put(key, collection.get(key) + 1);
        } else {
            collection.put(key, 1);
        }
    }

    /**
     * Cycles through the collection of class name information to see if parts
     * of the package names are contained in the provided value. If found, it
     * will be added as the HIGHEST confidence evidence because we have more
     * then one source corroborating the value.
     *
     * @param classes a collection of class name information
     * @param value the value to check to see if it contains a package name
     * @param evidence the evidence collection to add new entries too
     */
    private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
        if (value == null || value.isEmpty()) {
            return;
        }
        final String text = value.toLowerCase();
        for (ClassNameInformation cni : classes) {
            for (String key : cni.getPackageStructure()) {
                if (text.contains(key)) { //note, package structure elements are already lowercase.
                    evidence.addEvidence("jar", "package name", key, Evidence.Confidence.HIGHEST);
                }
            }
        }
    }

    /**
     * <p><b>This is currently a failed implementation.</b> Part of the issue is
     * I was trying to solve the wrong problem. Instead of multiple POMs being
     * in the JAR to just add information about dependencies - I didn't realize
     * until later that I was looking at an uber-jar (aka fat-jar) that included
     * all of its dependencies.</p>
     * <p>I'm leaving this method in the source tree, entirely commented out
     * until a solution https://github.com/jeremylong/DependencyCheck/issues/11
     * has been implemented.</p>
     * <p>Takes a list of pom entries from a JAR file and attempts to filter it
     * down to the pom related to the jar (rather then the pom entry for a
     * dependency).</p>
     *
     * @param pomEntries a list of pom entries
     * @param classes a list of fully qualified classes from the JAR file
     * @return the list of pom entries that are associated with the jar being
     * analyzed rather then the dependent poms
     */
    private List<String> filterPomEntries(List<String> pomEntries, ArrayList<ClassNameInformation> classes) {
        return pomEntries;
//        final HashMap<String, Integer> usePoms = new HashMap<String, Integer>();
//        final ArrayList<String> possiblePoms = new ArrayList<String>();
//        for (String entry : pomEntries) {
//            //todo validate that the starts with is correct... or does it start with a ./ or /?
//            // is it different on different platforms?
//            if (entry.startsWith("META-INF/maven/")) {
//                //trim the meta-inf/maven and pom.xml...
//                final String pomPath = entry.substring(15, entry.length() - 8).toLowerCase();
//                final String[] parts = pomPath.split("/");
//                if (parts == null || parts.length != 2) { //misplaced pom?
//                    //TODO add logging to FINE
//                    possiblePoms.add(entry);
//                }
//                parts[0] = parts[0].replace('.', '/');
//                parts[1] = parts[1].replace('.', '/');
//                for (ClassNameInformation cni : classes) {
//                    final String name = cni.getName();
//                    if (StringUtils.containsIgnoreCase(name, parts[0])) {
//                        addEntry(usePoms, entry);
//                    }
//                    if (StringUtils.containsIgnoreCase(name, parts[1])) {
//                        addEntry(usePoms, entry);
//                    }
//                }
//            } else { // we have a JAR file with an incorrect POM layout...
//                //TODO add logging to FINE
//                possiblePoms.add(entry);
//            }
//        }
//        List<String> retValue;
//        if (usePoms.isEmpty()) {
//            if (possiblePoms.isEmpty()) {
//                retValue = pomEntries;
//            } else {
//                retValue = possiblePoms;
//            }
//        } else {
//            retValue = new ArrayList<String>();
//            int maxCount = 0;
//            for (Map.Entry<String, Integer> entry : usePoms.entrySet()) {
//                final int current = entry.getValue().intValue();
//                if (current > maxCount) {
//                    maxCount = current;
//                    retValue.clear();
//                    retValue.add(entry.getKey());
//                } else if (current == maxCount) {
//                    retValue.add(entry.getKey());
//                }
//            }
//        }
//        return retValue;
    }

    /**
     * Simple check to see if the attribute from a manifest is just a package
     * name.
     *
     * @param key the key of the value to check
     * @param value the value to check
     * @return true if the value looks like a java package name, otherwise false
     */
    private boolean isPackage(String key, String value) {

        return !key.matches(".*(version|title|vendor|name|license|description).*")
                && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$");
    }

    /**
     * Stores information about a class name.
     */
    protected static class ClassNameInformation {

        /**
         * Stores information about a given class name. This class will keep the
         * fully qualified class name and a list of the important parts of the
         * package structure. Up to the first four levels of the package
         * structure are stored, excluding a leading "org" or "com". Example:
         * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer");
         * System.out.println(obj.getName());
         * for (String p : obj.getPackageStructure())
         *     System.out.println(p);
         * </code> Would result in:
         * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer
         * owasp
         * dependencycheck
         * analyzer
         * jaranalyzer</code>
         *
         * @param className a fully qualified class name
         */
        ClassNameInformation(String className) {
            name = className;
            if (name.contains("/")) {
                final String[] tmp = className.toLowerCase().split("/");
                int start = 0;
                int end = 3;
                if ("com".equals(tmp[0]) || "org".equals(tmp[0])) {
                    start = 1;
                    end = 4;
                }
                if (tmp.length <= end) {
                    end = tmp.length - 1;
                }
                for (int i = start; i <= end; i++) {
                    packageStructure.add(tmp[i]);
                }
            } else {
                packageStructure.add(name);
            }
        }
        /**
         * The fully qualified class name.
         */
        private String name;

        /**
         * Get the value of name
         *
         * @return the value of name
         */
        public String getName() {
            return name;
        }

        /**
         * Set the value of name
         *
         * @param name new value of name
         */
        public void setName(String name) {
            this.name = name;
        }
        /**
         * Up to the first four levels of the package structure, excluding a
         * leading "org" or "com".
         */
        private ArrayList<String> packageStructure = new ArrayList<String>();

        /**
         * Get the value of packageStructure
         *
         * @return the value of packageStructure
         */
        public ArrayList<String> getPackageStructure() {
            return packageStructure;
        }
    }
}
