View Javadoc

    1   /*
    2    * This file is part of dependency-check-core.
    3    *
    4    * Dependency-check-core is free software: you can redistribute it and/or modify it
    5    * under the terms of the GNU General Public License as published by the Free
    6    * Software Foundation, either version 3 of the License, or (at your option) any
    7    * later version.
    8    *
    9    * Dependency-check-core is distributed in the hope that it will be useful, but
    10   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    11   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    12   * details.
    13   *
    14   * You should have received a copy of the GNU General Public License along with
    15   * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    16   *
    17   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    18   */
    19  package org.owasp.dependencycheck.analyzer;
    20
    21  import java.io.File;
    22  import org.owasp.dependencycheck.dependency.Dependency;
    23  import org.owasp.dependencycheck.dependency.Evidence;
    24  import java.util.Set;
    25  import org.owasp.dependencycheck.Engine;
    26  import org.owasp.dependencycheck.utils.DependencyVersion;
    27  import org.owasp.dependencycheck.utils.DependencyVersionUtil;
    28
    29  /**
    30   *
    31   * Takes a dependency and analyzes the filename and determines the hashes.
    32   *
    33   * @author Jeremy Long (jeremy.long@owasp.org)
    34   */
    35  public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
    36
    37      //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    38      /**
    39       * The name of the analyzer.
    40       */
    41      private static final String ANALYZER_NAME = "File Name Analyzer";
    42      /**
    43       * The phase that this analyzer is intended to run in.
    44       */
    45      private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    46      /**
    47       * The set of file extensions supported by this analyzer.
    48       */
    49      private static final Set<String> EXTENSIONS = null;
    50
    51      /**
    52       * Returns a list of file EXTENSIONS supported by this analyzer.
    53       *
    54       * @return a list of file EXTENSIONS supported by this analyzer.
    55       */
    56      public Set<String> getSupportedExtensions() {
    57          return EXTENSIONS;
    58      }
    59
    60      /**
    61       * Returns the name of the analyzer.
    62       *
    63       * @return the name of the analyzer.
    64       */
    65      public String getName() {
    66          return ANALYZER_NAME;
    67      }
    68
    69      /**
    70       * Returns whether or not this analyzer can process the given extension.
    71       *
    72       * @param extension the file extension to test for support.
    73       * @return whether or not the specified file extension is supported by this
    74       * analyzer.
    75       */
    76      public boolean supportsExtension(String extension) {
    77          return true;
    78      }
    79
    80      /**
    81       * Returns the phase that the analyzer is intended to run in.
    82       *
    83       * @return the phase that the analyzer is intended to run in.
    84       */
    85      public AnalysisPhase getAnalysisPhase() {
    86          return ANALYSIS_PHASE;
    87      }
    88      //</editor-fold>
    89
    90      /**
    91       * Collects information about the file name.
    92       *
    93       * @param dependency the dependency to analyze.
    94       * @param engine the engine that is scanning the dependencies
    95       * @throws AnalysisException is thrown if there is an error reading the JAR
    96       * file.
    97       */
    98      @Override
    99      public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    100
    101         //strip any path information that may get added by ArchiveAnalyzer, etc.
    102         final File f = new File(dependency.getFileName());
    103         String fileName = f.getName();
    104
    105         //remove file extension
    106         final int pos = fileName.lastIndexOf(".");
    107         if (pos > 0) {
    108             fileName = fileName.substring(0, pos);
    109         }
    110
    111         //add version evidence
    112         final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
    113         if (version != null) {
    114             dependency.getVersionEvidence().addEvidence("file", "name",
    115                     version.toString(), Evidence.Confidence.HIGHEST);
    116             dependency.getVersionEvidence().addEvidence("file", "name",
    117                     fileName, Evidence.Confidence.MEDIUM);
    118         }
    119
    120         //add as vendor and product evidence
    121         if (fileName.contains("-")) {
    122             dependency.getProductEvidence().addEvidence("file", "name",
    123                     fileName, Evidence.Confidence.HIGHEST);
    124             dependency.getVendorEvidence().addEvidence("file", "name",
    125                     fileName, Evidence.Confidence.HIGHEST);
    126         } else {
    127             dependency.getProductEvidence().addEvidence("file", "name",
    128                     fileName, Evidence.Confidence.HIGH);
    129             dependency.getVendorEvidence().addEvidence("file", "name",
    130                     fileName, Evidence.Confidence.HIGH);
    131         }
    132     }
    133 }