##### Coverage Report - org.owasp.dependencycheck.analyzer.HintAnalyzer

Classes in this File | Line Coverage | Branch Coverage | Complexity
HintAnalyzer |
93% | 31/33
92% | 13/14
| 2.4;2.4

1 |  |
     /*
2 |  |
      * This file is part of dependency-check-core.
3 |  |
      *
4 |  |
      * Dependency-check-core is free software: you can redistribute it and/or modify it
5 |  |
      * under the terms of the GNU General Public License as published by the Free
6 |  |
      * Software Foundation, either version 3 of the License, or (at your option) any
7 |  |
      * later version.
8 |  |
      *
9 |  |
      * Dependency-check-core is distributed in the hope that it will be useful, but
10 |  |
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 |  |
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
12 |  |
      * details.
13 |  |
      *
14 |  |
      * You should have received a copy of the GNU General Public License along with
15 |  |
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
16 |  |
      *
17 |  |
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
18 |  |
      */
19 |  |
     package org.owasp.dependencycheck.analyzer;
20 |  |
21 |  |
     import java.util.ArrayList;
22 |  |
     import java.util.Iterator;
23 |  |
     import java.util.Set;
24 |  |
     import org.owasp.dependencycheck.Engine;
25 |  |
     import org.owasp.dependencycheck.dependency.Dependency;
26 |  |
     import org.owasp.dependencycheck.dependency.Evidence;
27 |  |
28 |  |
     /**
29 |  |
      *
30 |  |
      * @author Jeremy Long (jeremy.long@owasp.org)
31 |  |
      */
32 | 7 |
     public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
33 |  |
34 |  |
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
35 |  |
         /**
36 |  |
          * The name of the analyzer.
37 |  |
          */
38 |  |
         private static final String ANALYZER_NAME = "Hint Analyzer";
39 |  |
         /**
40 |  |
          * The phase that this analyzer is intended to run in.
41 |  |
          */
42 | 1 |
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
43 |  |
         /**
44 |  |
          * The set of file extensions supported by this analyzer.
45 |  |
          */
46 | 1 |
         private static final Set<String> EXTENSIONS = null;
47 |  |
48 |  |
         /**
49 |  |
          * Returns a list of file EXTENSIONS supported by this analyzer.
50 |  |
          *
51 |  |
          * @return a list of file EXTENSIONS supported by this analyzer.
52 |  |
          */
53 |  |
         public Set<String> getSupportedExtensions() {
54 | 132 |
             return EXTENSIONS;
55 |  |
         }
56 |  |
57 |  |
         /**
58 |  |
          * Returns the name of the analyzer.
59 |  |
          *
60 |  |
          * @return the name of the analyzer.
61 |  |
          */
62 |  |
         public String getName() {
63 | 9 |
             return ANALYZER_NAME;
64 |  |
         }
65 |  |
66 |  |
         /**
67 |  |
          * Returns whether or not this analyzer can process the given extension.
68 |  |
          *
69 |  |
          * @param extension the file extension to test for support.
70 |  |
          * @return whether or not the specified file extension is supported by this
71 |  |
          * analyzer.
72 |  |
          */
73 |  |
         public boolean supportsExtension(String extension) {
74 | 9 |
             return true;
75 |  |
         }
76 |  |
77 |  |
         /**
78 |  |
          * Returns the phase that the analyzer is intended to run in.
79 |  |
          *
80 |  |
          * @return the phase that the analyzer is intended to run in.
81 |  |
          */
82 |  |
         public AnalysisPhase getAnalysisPhase() {
83 | 6 |
             return ANALYSIS_PHASE;
84 |  |
         }
85 |  |
         //</editor-fold>
86 |  |
87 |  |
         /**
88 |  |
          * The HintAnalyzer uses knowledge about a dependency to add additional
89 |  |
          * information to help in identification of identifiers or vulnerabilities.
90 |  |
          *
91 |  |
          * @param dependency The dependency being analyzed
92 |  |
          * @param engine The scanning engine
93 |  |
          * @throws AnalysisException is thrown if there is an exception analyzing
94 |  |
          * the dependency.
95 |  |
          */
96 |  |
         @Override
97 |  |
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
98 | 15 |
             final Evidence springTest1 = new Evidence("Manifest",
99 |  |
                     "Implementation-Title",
100 |  |
                     "Spring Framework",
101 |  |
                     Evidence.Confidence.HIGH);
102 |  |
103 | 15 |
             final Evidence springTest2 = new Evidence("Manifest",
104 |  |
                     "Implementation-Title",
105 |  |
                     "org.springframework.core",
106 |  |
                     Evidence.Confidence.HIGH);
107 |  |
108 | 15 |
             final Evidence springTest3 = new Evidence("Manifest",
109 |  |
                     "Bundle-Vendor",
110 |  |
                     "SpringSource",
111 |  |
                     Evidence.Confidence.HIGH);
112 |  |
113 |  |
114 | 15 |
             Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
115 | 15 |
             if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
116 | 2 |
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
117 | 2 |
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Evidence.Confidence.HIGH);
118 | 2 |
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH);
119 |  |
             }
120 |  |
121 | 15 |
             evidence = dependency.getVendorEvidence().getEvidence();
122 | 15 |
             if (evidence.contains(springTest3)) {
123 | 2 |
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
124 | 2 |
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH);
125 |  |
             }
126 | 15 |
             final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
127 | 15 |
             final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
128 | 121 |
             while (itr.hasNext()) {
129 | 106 |
                 final Evidence e = itr.next();
130 | 106 |
                 if ("sun".equalsIgnoreCase(e.getValue(false))) {
131 | 2 |
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence());
132 | 2 |
                     newEntries.add(newEvidence);
133 | 2 |
                 } else if ("oracle".equalsIgnoreCase(e.getValue(false))) {
134 | 0 |
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence());
135 | 0 |
                     newEntries.add(newEvidence);
136 |  |
                 }
137 | 106 |
             }
138 | 15 |
             for (Evidence e : newEntries) {
139 | 2 |
                 dependency.getVendorEvidence().addEvidence(e);
140 |  |
             }
141 |  |
142 |  |
143 | 15 |
         }
144 |  |
     }