View Javadoc

    1   /*
    2    * This file is part of dependency-check-core.
    3    *
    4    * Dependency-check-core is free software: you can redistribute it and/or modify it
    5    * under the terms of the GNU General Public License as published by the Free
    6    * Software Foundation, either version 3 of the License, or (at your option) any
    7    * later version.
    8    *
    9    * Dependency-check-core is distributed in the hope that it will be useful, but
    10   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    11   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    12   * details.
    13   *
    14   * You should have received a copy of the GNU General Public License along with
    15   * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    16   *
    17   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    18   */
    19  package org.owasp.dependencycheck.analyzer;
    20
    21  import java.util.ArrayList;
    22  import java.util.Iterator;
    23  import java.util.Set;
    24  import org.owasp.dependencycheck.Engine;
    25  import org.owasp.dependencycheck.dependency.Dependency;
    26  import org.owasp.dependencycheck.dependency.Evidence;
    27
    28  /**
    29   *
    30   * @author Jeremy Long (jeremy.long@owasp.org)
    31   */
    32  public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
    33
    34      //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    35      /**
    36       * The name of the analyzer.
    37       */
    38      private static final String ANALYZER_NAME = "Hint Analyzer";
    39      /**
    40       * The phase that this analyzer is intended to run in.
    41       */
    42      private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
    43      /**
    44       * The set of file extensions supported by this analyzer.
    45       */
    46      private static final Set<String> EXTENSIONS = null;
    47
    48      /**
    49       * Returns a list of file EXTENSIONS supported by this analyzer.
    50       *
    51       * @return a list of file EXTENSIONS supported by this analyzer.
    52       */
    53      public Set<String> getSupportedExtensions() {
    54          return EXTENSIONS;
    55      }
    56
    57      /**
    58       * Returns the name of the analyzer.
    59       *
    60       * @return the name of the analyzer.
    61       */
    62      public String getName() {
    63          return ANALYZER_NAME;
    64      }
    65
    66      /**
    67       * Returns whether or not this analyzer can process the given extension.
    68       *
    69       * @param extension the file extension to test for support.
    70       * @return whether or not the specified file extension is supported by this
    71       * analyzer.
    72       */
    73      public boolean supportsExtension(String extension) {
    74          return true;
    75      }
    76
    77      /**
    78       * Returns the phase that the analyzer is intended to run in.
    79       *
    80       * @return the phase that the analyzer is intended to run in.
    81       */
    82      public AnalysisPhase getAnalysisPhase() {
    83          return ANALYSIS_PHASE;
    84      }
    85      //</editor-fold>
    86
    87      /**
    88       * The HintAnalyzer uses knowledge about a dependency to add additional
    89       * information to help in identification of identifiers or vulnerabilities.
    90       *
    91       * @param dependency The dependency being analyzed
    92       * @param engine The scanning engine
    93       * @throws AnalysisException is thrown if there is an exception analyzing
    94       * the dependency.
    95       */
    96      @Override
    97      public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    98          final Evidence springTest1 = new Evidence("Manifest",
    99                  "Implementation-Title",
    100                 "Spring Framework",
    101                 Evidence.Confidence.HIGH);
    102
    103         final Evidence springTest2 = new Evidence("Manifest",
    104                 "Implementation-Title",
    105                 "org.springframework.core",
    106                 Evidence.Confidence.HIGH);
    107
    108         final Evidence springTest3 = new Evidence("Manifest",
    109                 "Bundle-Vendor",
    110                 "SpringSource",
    111                 Evidence.Confidence.HIGH);
    112
    113
    114         Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
    115         if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
    116             dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
    117             dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Evidence.Confidence.HIGH);
    118             dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH);
    119         }
    120
    121         evidence = dependency.getVendorEvidence().getEvidence();
    122         if (evidence.contains(springTest3)) {
    123             dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
    124             dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH);
    125         }
    126         final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
    127         final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
    128         while (itr.hasNext()) {
    129             final Evidence e = itr.next();
    130             if ("sun".equalsIgnoreCase(e.getValue(false))) {
    131                 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence());
    132                 newEntries.add(newEvidence);
    133             } else if ("oracle".equalsIgnoreCase(e.getValue(false))) {
    134                 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence());
    135                 newEntries.add(newEvidence);
    136             }
    137         }
    138         for (Evidence e : newEntries) {
    139             dependency.getVendorEvidence().addEvidence(e);
    140         }
    141
    142
    143     }
    144 }