/*
 * This file is part of dependency-check-core.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
 */
package org.owasp.dependencycheck.analyzer;

import java.io.File;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import org.junit.Test;
import org.owasp.dependencycheck.BaseTest;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.data.cpe.AbstractDatabaseTestCase;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.utils.Settings;

/**
 * Testing the vulnerability suppression analyzer.
 *
 * @author Jeremy Long
 */
public class VulnerabilitySuppressionAnalyzerIntegrationTest extends AbstractDatabaseTestCase {

    /**
     * Test of getName method, of class VulnerabilitySuppressionAnalyzer.
     */
    @Test
    public void testGetName() {
        VulnerabilitySuppressionAnalyzer instance = new VulnerabilitySuppressionAnalyzer();
        String expResult = "Vulnerability Suppression Analyzer";
        String result = instance.getName();
        assertEquals(expResult, result);
    }

    /**
     * Test of getAnalysisPhase method, of class VulnerabilitySuppressionAnalyzer.
     */
    @Test
    public void testGetAnalysisPhase() {
        VulnerabilitySuppressionAnalyzer instance = new VulnerabilitySuppressionAnalyzer();
        AnalysisPhase expResult = AnalysisPhase.POST_FINDING_ANALYSIS;
        AnalysisPhase result = instance.getAnalysisPhase();
        assertEquals(expResult, result);
    }

    /**
     * Test of analyze method, of class VulnerabilitySuppressionAnalyzer.
     */
    @Test
    public void testAnalyze() throws Exception {

        //File file = new File(this.getClass().getClassLoader().getResource("commons-fileupload-1.2.1.jar").getPath());
        File file = BaseTest.getResourceAsFile(this, "commons-fileupload-1.2.1.jar");
        //File suppression = new File(this.getClass().getClassLoader().getResource("commons-fileupload-1.2.1.suppression.xml").getPath());
        File suppression = BaseTest.getResourceAsFile(this, "commons-fileupload-1.2.1.suppression.xml");
        Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
        Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);
        Settings.setBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, false);
        Engine engine = new Engine();
        engine.scan(file);
        engine.analyzeDependencies();
        Dependency dependency = getDependency(engine, file);
        int cveSize = dependency.getVulnerabilities().size();
        int cpeSize = dependency.getIdentifiers().size();
        assertTrue(cveSize > 0);
        assertTrue(cpeSize > 0);
        Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppression.getAbsolutePath());
        VulnerabilitySuppressionAnalyzer instance = new VulnerabilitySuppressionAnalyzer();
        instance.initialize();
        instance.analyze(dependency, engine);
        cveSize = cveSize > 1 ? cveSize - 2 : 0;
        cpeSize = cpeSize > 0 ? cpeSize - 1 : 0;
        assertTrue(dependency.getVulnerabilities().size() == cveSize);
        assertTrue(dependency.getIdentifiers().size() == cpeSize);
        engine.cleanup();
    }

    /**
     * Retrieves a specific dependency from the engine.
     *
     * @param engine the engine
     * @param file the dependency to retrieve
     * @return the dependency
     */
    private Dependency getDependency(Engine engine, File file) {
        for (Dependency d : engine.getDependencies()) {
            if (d.getFileName().equals(file.getName())) {
                return d;
            }
        }
        return null;
    }
}
