View Javadoc

    1   /*
    2    * This file is part of dependency-check-core.
    3    *
    4    * Dependency-check-core is free software: you can redistribute it and/or modify it
    5    * under the terms of the GNU General Public License as published by the Free
    6    * Software Foundation, either version 3 of the License, or (at your option) any
    7    * later version.
    8    *
    9    * Dependency-check-core is distributed in the hope that it will be useful, but
    10   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    11   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    12   * details.
    13   *
    14   * You should have received a copy of the GNU General Public License along with
    15   * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    16   *
    17   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    18   */
    19  package org.owasp.dependencycheck.analyzer;
    20
    21  import java.util.Set;
    22  import org.owasp.dependencycheck.Engine;
    23  import org.owasp.dependencycheck.dependency.Dependency;
    24
    25  /**
    26   * An interface that defines an Analyzer that is used to identify Dependencies.
    27   * An analyzer will collect information about the dependency in the form of
    28   * Evidence.
    29   *
    30   * @author Jeremy Long (jeremy.long@owasp.org)
    31   */
    32  public interface Analyzer {
    33
    34      /**
    35       * Analyzes the given dependency. The analysis could be anything from
    36       * identifying an Identifier for the dependency, to finding vulnerabilities,
    37       * etc. Additionally, if the analyzer collects enough information to add a
    38       * description or license information for the dependency it should be added.
    39       *
    40       * @param dependency a dependency to analyze.
    41       * @param engine the engine that is scanning the dependencies - this is
    42       * useful if we need to check other dependencies
    43       * @throws AnalysisException is thrown if there is an error analyzing the
    44       * dependency file
    45       */
    46      void analyze(Dependency dependency, Engine engine) throws AnalysisException;
    47
    48      /**
    49       * <p>Returns a list of supported file extensions. An example would be an
    50       * analyzer that inspected java jar files. The getSupportedExtensions
    51       * function would return a set with a single element "jar".</p>
    52       *
    53       * <p><b>Note:</b> when implementing this the extensions returned MUST be
    54       * lowercase.</p>
    55       *
    56       * @return The file extensions supported by this analyzer.
    57       *
    58       * <p>If the analyzer returns null it will not cause additional files to be
    59       * analyzed but will be executed against every file loaded</p>
    60       */
    61      Set<String> getSupportedExtensions();
    62
    63      /**
    64       * Returns the name of the analyzer.
    65       *
    66       * @return the name of the analyzer.
    67       */
    68      String getName();
    69
    70      /**
    71       * Returns whether or not this analyzer can process the given extension.
    72       *
    73       * @param extension the file extension to test for support.
    74       * @return whether or not the specified file extension is supported by this
    75       * analyzer.
    76       */
    77      boolean supportsExtension(String extension);
    78
    79      /**
    80       * Returns the phase that the analyzer is intended to run in.
    81       *
    82       * @return the phase that the analyzer is intended to run in.
    83       */
    84      AnalysisPhase getAnalysisPhase();
    85
    86      /**
    87       * The initialize method is called (once) prior to the analyze method being
    88       * called on all of the dependencies.
    89       *
    90       * @throws Exception is thrown if an exception occurs initializing the
    91       * analyzer.
    92       */
    93      void initialize() throws Exception;
    94
    95      /**
    96       * The close method is called after all of the dependencies have been
    97       * analyzed.
    98       *
    99       * @throws Exception is thrown if an exception occurs closing the analyzer.
    100      */
    101     void close() throws Exception;
    102 }