Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.owasp.dependencycheck.analyzer
Class JarAnalyzer

    java.lang.Object
      org.owasp.dependencycheck.analyzer.AbstractAnalyzer
          org.owasp.dependencycheck.analyzer.JarAnalyzer

All Implemented Interfaces:
  Analyzer

    public class JarAnalyzer

extends AbstractAnalyzer
implements Analyzer

Used to load a JAR file and collect information that can be used to determine the associated CPE.

Author:
  Jeremy Long (jeremy.long@owasp.org)

Nested Class Summary
`protected static class` | `JarAnalyzer.ClassNameInformation` Stores information about a class name.

Constructor Summary
`JarAnalyzer()` Constructs a new JarAnalyzer.

Method Summary
`void` | `analyze(Dependency dependency, Engine engine)` Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE information.
`protected void` | `analyzePackageNames(ArrayList<JarAnalyzer.ClassNameInformation> classNames, Dependency dependency, boolean addPackagesAsEvidence)` Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible vendor or product names.
`protected boolean` | `analyzePOM(Dependency dependency, ArrayList<JarAnalyzer.ClassNameInformation> classes)` Attempts to find a pom.xml within the JAR file.
`void` | `close()` The close method does nothing for this Analyzer.
`AnalysisPhase` | `getAnalysisPhase()` Returns the phase that the analyzer is intended to run in.
`String` | `getName()` Returns the name of the analyzer.
`Set<String>` | `getSupportedExtensions()` Returns a list of file EXTENSIONS supported by this analyzer.
`void` | `initialize()` The initialize method does nothing for this Analyzer.
`protected String` | `interpolateString(String text, Properties properties)` A utility function that will interpolate strings based on values given in the properties file.
`protected boolean` | `parseManifest(Dependency dependency, ArrayList<JarAnalyzer.ClassNameInformation> classInformation)` Reads the manifest from the JAR file and collects the entries.
`boolean` | `supportsExtension(String extension)` Returns whether or not this analyzer can process the given extension.

Methods inherited from class org.owasp.dependencycheck.analyzer.AbstractAnalyzer
`newHashSet`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

### JarAnalyzer

    public JarAnalyzer()

  Constructs a new JarAnalyzer.

Method Detail

### getSupportedExtensions

    public Set<String> getSupportedExtensions()

  Returns a list of file EXTENSIONS supported by this analyzer.

  Specified by:
    `getSupportedExtensions` in interface `Analyzer`
  Returns:
    a list of file EXTENSIONS supported by this analyzer.

### getName

    public String getName()

  Returns the name of the analyzer.

  Specified by:
    `getName` in interface `Analyzer`
  Returns:
    the name of the analyzer.

### supportsExtension

    public boolean supportsExtension(String extension)

  Returns whether or not this analyzer can process the given extension.

  Specified by:
    `supportsExtension` in interface `Analyzer`
  Parameters:
    `extension` - the file extension to test for support.
  Returns:
    whether or not the specified file extension is supported by this analyzer.

### getAnalysisPhase

    public AnalysisPhase getAnalysisPhase()

  Returns the phase that the analyzer is intended to run in.

  Specified by:
    `getAnalysisPhase` in interface `Analyzer`
  Returns:
    the phase that the analyzer is intended to run in.

### analyze

    public void analyze(Dependency dependency,
                        Engine engine)
                 throws AnalysisException

  Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE information.

  Specified by:
    `analyze` in interface `Analyzer`
  Parameters:
    `dependency` - the dependency to analyze.
    `engine` - the engine that is scanning the dependencies
  Throws:
    `AnalysisException` - is thrown if there is an error reading the JAR file.

### analyzePOM

    protected boolean analyzePOM(Dependency dependency,
                                 ArrayList<JarAnalyzer.ClassNameInformation> classes)
                          throws AnalysisException

  Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence. This will attempt to interpolate the strings contained within the pom.properties if one exists.

  Parameters:
    `dependency` - the dependency being analyzed
    `classes` - a collection of class name information
  Returns:
    whether or not evidence was added to the dependency
  Throws:
    `AnalysisException` - is thrown if there is an exception parsing the pom

### analyzePackageNames

    protected void analyzePackageNames(ArrayList<JarAnalyzer.ClassNameInformation> classNames,
                                       Dependency dependency,
                                       boolean addPackagesAsEvidence)

  Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets.

  Parameters:
    `classNames` - a list of class names
    `dependency` - a dependency to analyze
    `addPackagesAsEvidence` - a flag indicating whether or not package names should be added as evidence.

### parseManifest

    protected boolean parseManifest(Dependency dependency,
                                    ArrayList<JarAnalyzer.ClassNameInformation> classInformation)
                             throws IOException

  Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:

  - Implementation Title
  - Implementation Version
  - Implementation Vendor
  - Implementation VendorId
  - Bundle Name
  - Bundle Version
  - Bundle Vendor
  - Bundle Description
  - Main Class
  However, all but a handful of specific entries are read in.

  Parameters:
    `dependency` - A reference to the dependency
    `classInformation` - a collection of class information
  Returns:
    whether evidence was identified parsing the manifest
  Throws:
    `IOException` - if there is an issue reading the JAR file

### initialize

    public void initialize()

  The initialize method does nothing for this Analyzer.

  Specified by:
    `initialize` in interface `Analyzer`
  Overrides:
    `initialize` in class `AbstractAnalyzer`

### close

    public void close()

  The close method does nothing for this Analyzer.

  Specified by:
    `close` in interface `Analyzer`
  Overrides:
    `close` in class `AbstractAnalyzer`

### interpolateString

    protected String interpolateString(String text,
                                       Properties properties)

  A utility function that will interpolate strings based on values given in the properties file. It will also interpolate the strings contained within the properties file so that properties can reference other properties.

  Note: if there is no property found the reference will be removed. In other words, if the interpolated string will be replaced with an empty string.

  Example:

  `Properties p = new Properties(); p.setProperty("key", "value"); String s = interpolateString("'${key}' and '${nothing}'", p); System.out.println(s);`

  Will result in:

  `'value' and ''`

  Parameters:
    `text` - the string that contains references to properties.
    `properties` - a collection of properties that may be referenced within the text.
  Returns:
    the interpolated text.

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2012-2013 OWASP. All Rights Reserved.