View Javadoc

    1   /*
    2    * This file is part of dependency-check-core.
    3    *
    4    * Dependency-check-core is free software: you can redistribute it and/or modify it
    5    * under the terms of the GNU General Public License as published by the Free
    6    * Software Foundation, either version 3 of the License, or (at your option) any
    7    * later version.
    8    *
    9    * Dependency-check-core is distributed in the hope that it will be useful, but
    10   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    11   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    12   * details.
    13   *
    14   * You should have received a copy of the GNU General Public License along with
    15   * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    16   *
    17   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    18   */
    19  package org.owasp.dependencycheck.analyzer;
    20
    21  import org.owasp.dependencycheck.data.cpe.IndexEntry;
    22  import org.owasp.dependencycheck.analyzer.CPEAnalyzer;
    23  import java.io.File;
    24  import java.io.IOException;
    25  import java.util.HashSet;
    26  import java.util.List;
    27  import java.util.Set;
    28  import org.apache.lucene.index.CorruptIndexException;
    29  import org.apache.lucene.queryparser.classic.ParseException;
    30  import org.junit.After;
    31  import org.junit.AfterClass;
    32  import org.owasp.dependencycheck.dependency.Dependency;
    33  import org.junit.Assert;
    34  import org.junit.Before;
    35  import org.junit.BeforeClass;
    36  import org.junit.Test;
    37  import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase;
    38  import org.owasp.dependencycheck.data.cpe.IndexEntry;
    39  import org.owasp.dependencycheck.dependency.Identifier;
    40
    41  /**
    42   *
    43   * @author Jeremy Long (jeremy.long@owasp.org)
    44   */
    45  public class CPEAnalyzerTest extends BaseIndexTestCase {
    46
    47      @BeforeClass
    48      public static void setUpClass() throws Exception {
    49      }
    50
    51      @AfterClass
    52      public static void tearDownClass() throws Exception {
    53      }
    54
    55      @Before
    56      @Override
    57      public void setUp() throws Exception {
    58          super.setUp();
    59      }
    60
    61      @After
    62      @Override
    63      public void tearDown() throws Exception {
    64          super.tearDown();
    65      }
    66
    67      /**
    68       * Tests of buildSearch of class CPEAnalyzer.
    69       *
    70       * @throws IOException is thrown when an IO Exception occurs.
    71       * @throws CorruptIndexException is thrown when the index is corrupt.
    72       * @throws ParseException is thrown when a parse exception occurs
    73       */
    74      @Test
    75      public void testBuildSearch() throws IOException, CorruptIndexException, ParseException {
    76          Set<String> productWeightings = new HashSet<String>(1);
    77          productWeightings.add("struts2");
    78
    79          Set<String> vendorWeightings = new HashSet<String>(1);
    80          vendorWeightings.add("apache");
    81
    82          String vendor = "apache software foundation";
    83          String product = "struts 2 core";
    84          String version = "2.1.2";
    85          CPEAnalyzer instance = new CPEAnalyzer();
    86
    87          String queryText = instance.buildSearch(vendor, product, null, null);
    88          String expResult = " product:( struts 2 core )  AND  vendor:( apache software foundation ) ";
    89          Assert.assertTrue(expResult.equals(queryText));
    90
    91          queryText = instance.buildSearch(vendor, product, null, productWeightings);
    92          expResult = " product:(  struts^5 struts2^5 2 core )  AND  vendor:( apache software foundation ) ";
    93          Assert.assertTrue(expResult.equals(queryText));
    94
    95          queryText = instance.buildSearch(vendor, product, vendorWeightings, null);
    96          expResult = " product:( struts 2 core )  AND  vendor:(  apache^5 software foundation ) ";
    97          Assert.assertTrue(expResult.equals(queryText));
    98
    99          queryText = instance.buildSearch(vendor, product, vendorWeightings, productWeightings);
    100         expResult = " product:(  struts^5 struts2^5 2 core )  AND  vendor:(  apache^5 software foundation ) ";
    101         Assert.assertTrue(expResult.equals(queryText));
    102     }
    103
    104     /**
    105      * Test of open method, of class CPEAnalyzer.
    106      *
    107      * @throws Exception is thrown when an exception occurs
    108      */
    109     @Test
    110     public void testOpen() throws Exception {
    111         CPEAnalyzer instance = new CPEAnalyzer();
    112         Assert.assertFalse(instance.isOpen());
    113         instance.open();
    114         Assert.assertTrue(instance.isOpen());
    115         instance.close();
    116         Assert.assertFalse(instance.isOpen());
    117     }
    118
    119     /**
    120      * Test of determineCPE method, of class CPEAnalyzer.
    121      *
    122      * @throws Exception is thrown when an exception occurs
    123      */
    124     @Test
    125     public void testDetermineCPE_full() throws Exception {
    126         callDetermineCPE_full("hazelcast-2.5.jar", null);
    127         callDetermineCPE_full("spring-context-support-2.5.5.jar", "cpe:/a:vmware:springsource_spring_framework:2.5.5");
    128         callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:/a:vmware:springsource_spring_framework:3.0.0");
    129         callDetermineCPE_full("org.mortbay.jetty.jar", "cpe:/a:mortbay_jetty:jetty:4.2");
    130         callDetermineCPE_full("jaxb-xercesImpl-1.5.jar", null);
    131         callDetermineCPE_full("ehcache-core-2.2.0.jar", null);
    132     }
    133
    134     /**
    135      * Test of determineCPE method, of class CPEAnalyzer.
    136      *
    137      * @throws Exception is thrown when an exception occurs
    138      */
    139     public void callDetermineCPE_full(String depName, String expResult) throws Exception {
    140
    141         File file = new File(this.getClass().getClassLoader().getResource(depName).getPath());
    142
    143         Dependency dep = new Dependency(file);
    144
    145         FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer();
    146         fnAnalyzer.analyze(dep, null);
    147
    148         JarAnalyzer jarAnalyzer = new JarAnalyzer();
    149         jarAnalyzer.analyze(dep, null);
    150         HintAnalyzer hAnalyzer = new HintAnalyzer();
    151         hAnalyzer.analyze(dep, null);
    152
    153
    154         CPEAnalyzer instance = new CPEAnalyzer();
    155         instance.open();
    156         instance.analyze(dep, null);
    157         instance.close();
    158         FalsePositiveAnalyzer fp = new FalsePositiveAnalyzer();
    159         fp.analyze(dep, null);
    160
    161 //        for (Identifier i : dep.getIdentifiers()) {
    162 //            System.out.println(i.getValue());
    163 //        }
    164         if (expResult != null) {
    165             Identifier expIdentifier = new Identifier("cpe", expResult, expResult);
    166             Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().contains(expIdentifier));
    167         } else if (dep.getIdentifiers().isEmpty()) {
    168             Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().isEmpty());
    169         } else {
    170             Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "', identifier:'" + dep.getIdentifiers().iterator().next().getValue() + "' }", dep.getIdentifiers().isEmpty());
    171         }
    172     }
    173
    174     /**
    175      * Test of determineCPE method, of class CPEAnalyzer.
    176      *
    177      * @throws Exception is thrown when an exception occurs
    178      */
    179     @Test
    180     public void testDetermineCPE() throws Exception {
    181         File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
    182         //File file = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath());
    183         Dependency struts = new Dependency(file);
    184
    185         FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer();
    186         fnAnalyzer.analyze(struts, null);
    187
    188         JarAnalyzer jarAnalyzer = new JarAnalyzer();
    189         jarAnalyzer.analyze(struts, null);
    190
    191
    192         File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath());
    193         Dependency commonValidator = new Dependency(fileCommonValidator);
    194         jarAnalyzer.analyze(commonValidator, null);
    195
    196         File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath());
    197         Dependency spring = new Dependency(fileSpring);
    198         jarAnalyzer.analyze(spring, null);
    199
    200         File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath());
    201         Dependency spring3 = new Dependency(fileSpring3);
    202         jarAnalyzer.analyze(spring3, null);
    203
    204         CPEAnalyzer instance = new CPEAnalyzer();
    205         instance.open();
    206         instance.determineCPE(commonValidator);
    207         instance.determineCPE(struts);
    208         instance.determineCPE(spring);
    209         instance.determineCPE(spring3);
    210         instance.close();
    211
    212         String expResult = "cpe:/a:apache:struts:2.1.2";
    213         Identifier expIdentifier = new Identifier("cpe", expResult, expResult);
    214         String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5";
    215         String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0";
    216
    217         Assert.assertTrue("Apache Common Validator - found an identifier?", commonValidator.getIdentifiers().isEmpty());
    218         Assert.assertTrue("Incorrect match size - struts", struts.getIdentifiers().size() >= 1);
    219         Assert.assertTrue("Incorrect match - struts", struts.getIdentifiers().contains(expIdentifier));
    220         Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1);
    221
    222         //the following two only work if the HintAnalyzer is used.
    223         //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1);
    224         //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring));
    225
    226     }
    227
    228     /**
    229      * Test of searchCPE method, of class CPEAnalyzer.
    230      *
    231      * @throws Exception is thrown when an exception occurs
    232      */
    233     @Test
    234     public void testSearchCPE() throws Exception {
    235         String vendor = "apache software foundation";
    236         String product = "struts 2 core";
    237         String version = "2.1.2";
    238         String expResult = "cpe:/a:apache:struts:2.1.2";
    239
    240         CPEAnalyzer instance = new CPEAnalyzer();
    241         instance.open();
    242
    243         //TODO - yeah, not a very good test as the results are the same with or without weighting...
    244         Set<String> productWeightings = new HashSet<String>(1);
    245         productWeightings.add("struts2");
    246
    247         Set<String> vendorWeightings = new HashSet<String>(1);
    248         vendorWeightings.add("apache");
    249
    250         List<IndexEntry> result = instance.searchCPE(vendor, product, productWeightings, vendorWeightings);
    251         //TODO fix this assert
    252         //Assert.assertEquals(expResult, result.get(0).getName());
    253
    254
    255         instance.close();
    256     }
    257 }