Adding the AssemblyAnalyzer to analyze .NET assemblies

Changed the author on a few files

Added GrokAssembly.exe for grokking assemblies

First revision of the assembly analyzer

Added ability to configure where mono is located


Former-commit-id: a5da71bc9103331d67994bab9e102315f26641e4

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

@@ -0,0 +1,259 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathExpressionException;
+import javax.xml.xpath.XPathFactory;
+
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.dependency.Confidence;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.utils.Settings;
+import org.w3c.dom.Document;
+import org.xml.sax.SAXException;
+
+/**
+ * Analyzer for getting company, product, and version information
+ * from a .NET assembly.
+ *
+ * @author colezlaw
+ *
+ */
+public class AssemblyAnalyzer extends AbstractAnalyzer {
+    /**
+     * The analyzer name
+     */
+    private static final String ANALYZER_NAME = "Assembly Analyzer";
+    /**
+     * The analysis phase
+     */
+    private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
+    /**
+     * The list of supported extensions
+     */
+    private static final Set<String> SUPORTED_EXTENSIONS = newHashSet("dll", "exe");
+    /**
+     * The temp value for GrokAssembly.exe
+     */
+    private File grokAssemblyExe;
+    /**
+     * The DocumentBuilder for parsing the XML
+     */
+    private DocumentBuilder builder;
+    /**
+     * Logger
+     */
+    private static final Logger LOG = Logger.getLogger(AbstractAnalyzer.class.getName());
+
+    /**
+     * Builds the beginnings of a List for ProcessBuilder
+     * @return the list of arguments to begin populating the ProcessBuilder
+     */
+    private List<String> buildArgumentList() {
+        // Use file.separator as a wild guess as to whether this is Windows
+        final List<String> args = new ArrayList<String>();
+        if (!"\\".equals(System.getProperty("file.separator"))) {
+            if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null) {
+                args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
+            } else {
+                args.add("mono");
+            }
+        }
+        args.add(grokAssemblyExe.getPath());
+
+        return args;
+    }
+
+    /**
+     * Performs the analysis on a single Dependency.
+     * @param dependency the dependency to analyze
+     * @param engine the engine to perform the analysis under
+     * @throws AnalysisException if anything goes sideways
+     */
+    @Override
+    public void analyze(Dependency dependency, Engine engine)
+            throws AnalysisException {
+        if (grokAssemblyExe == null) {
+            LOG.warning("GrokAssembly didn't get deployed");
+            return;
+        }
+
+        final List<String> args = buildArgumentList();
+        args.add(dependency.getActualFilePath());
+        final ProcessBuilder pb = new ProcessBuilder(args);
+        try {
+            final Process proc = pb.start();
+            final Document doc = builder.parse(proc.getInputStream());
+            final XPath xpath = XPathFactory.newInstance().newXPath();
+
+            // First, see if there was an error
+            final String error = xpath.evaluate("/assembly/error", doc);
+            if (error != null && !"".equals(error)) {
+                throw new AnalysisException(error);
+            }
+
+            final String version = xpath.evaluate("/assembly/version", doc);
+            if (version != null) {
+                dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly", "version",
+                        version, Confidence.HIGHEST));
+            }
+
+            final String vendor = xpath.evaluate("/assembly/company", doc);
+            if (vendor != null) {
+                dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly", "vendor",
+                        vendor, Confidence.HIGH));
+            }
+
+            final String product = xpath.evaluate("/assembly/product", doc);
+            if (product != null) {
+                dependency.getProductEvidence().addEvidence(new Evidence("grokassembly", "product",
+                        product, Confidence.HIGH));
+            }
+        } catch (IOException ioe) {
+            throw new AnalysisException(ioe);
+        } catch (SAXException saxe) {
+            throw new AnalysisException("Couldn't parse GrokAssembly result", saxe);
+        } catch (XPathExpressionException xpe) {
+            // This shouldn't happen
+            throw new AnalysisException(xpe);
+        }
+    }
+
+    /**
+     * Initialize the analyzer. In this case, extract GrokAssembly.exe
+     * to a temporary location.
+     * @throws Exception if anything goes wrong
+     */
+    @Override
+    public void initialize() throws Exception {
+        super.initialize();
+        final File tempFile = File.createTempFile("GKA", ".exe");
+        FileOutputStream fos = null;
+        InputStream is = null;
+        try {
+            fos = new FileOutputStream(tempFile);
+            is = AssemblyAnalyzer.class.getClassLoader().getResourceAsStream("GrokAssembly.exe");
+            final byte[] buff = new byte[4096];
+            int bread = -1;
+            while ((bread = is.read(buff)) >= 0) {
+                fos.write(buff, 0, bread);
+            }
+            grokAssemblyExe = tempFile;
+            // Set the temp file to get deleted when we're done
+            grokAssemblyExe.deleteOnExit();
+            LOG.log(Level.INFO, "Extracted GrokAssembly.exe to {0}", grokAssemblyExe.getPath());
+
+            // Now, need to see if GrokAssembly actually runs from this location.
+            final List<String> args = buildArgumentList();
+            try {
+                final Process p = new ProcessBuilder(args).start();
+                final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(p.getInputStream());
+                final XPath xpath = XPathFactory.newInstance().newXPath();
+                final String error = xpath.evaluate("/assembly/error", doc);
+                if (p.exitValue() != 1 || error == null || "".equals(error)) {
+                    LOG.warning("GrokAssembly.exe is not working properly");
+                    grokAssemblyExe = null;
+                    throw new AnalysisException("Could not execute GrokAssembly");
+                }
+            } catch (Exception e) {
+                LOG.warning("Could not execute GrokAssembly " + e.getMessage());
+                throw new AnalysisException("Could not execute GrokAssembly", e);
+            }
+
+            builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+        } finally {
+            if (fos != null) {
+                try {
+                    fos.close();
+                } catch (Exception e) {
+                    LOG.fine("Error closing output stream");
+                }
+            }
+            if (is != null) {
+                try {
+                    is.close();
+                } catch (Exception e) {
+                    LOG.fine("Error closing input stream");
+                }
+            }
+        }
+    }
+
+    @Override
+    public void close() throws Exception {
+        super.close();
+        try {
+            grokAssemblyExe.delete();
+        } catch (SecurityException se) {
+            LOG.fine("Can't delete temporary GrokAssembly.exe");
+        }
+    }
+
+    /**
+     * Gets the set of extensions supported by this analyzer.
+     * @return the list of supported extensions
+     */
+    @Override
+    public Set<String> getSupportedExtensions() {
+        return SUPORTED_EXTENSIONS;
+    }
+
+    /**
+     * Gets this analyzer's name.
+     *
+     * @return the analyzer name
+     */
+    @Override
+    public String getName() {
+        return ANALYZER_NAME;
+    }
+
+    /**
+     * Gets whether the analyzer supports the provided extension.
+     * @param extension the extension to check
+     * @return whether the analyzer supports the extension
+     */
+    @Override
+    public boolean supportsExtension(String extension) {
+        return SUPORTED_EXTENSIONS.contains(extension);
+    }
+
+    /**
+     * Returns the phase this analyzer runs under.
+     *
+     * @return the phase this runs under
+     */
+    @Override
+    public AnalysisPhase getAnalysisPhase() {
+        return ANALYSIS_PHASE;
+    }
+}

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java

@@ -125,7 +125,11 @@ public class NuspecAnalyzer extends AbstractAnalyzer {
                 np = parser.parse(fis);
             } finally {
                 if (fis != null) {
-                    try { fis.close(); } catch (Exception e) { }
+                    try {
+                        fis.close();
+                    } catch (Exception e) {
+                        LOGGER.fine("Error closing input stream");
+                    }
                 }
             }
 

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nuget/NuspecParser.java

@@ -22,7 +22,7 @@ import java.io.InputStream;
 /**
  * Interface defining methods for parsing a Nuspec file.
  *
- * @author willstranathan
+ * @author colezlaw
  *
  */
 public interface NuspecParser {

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.java

@@ -30,7 +30,7 @@ import org.w3c.dom.Node;
 /**
  * Parse a Nuspec file using XPath.
  *
- * @author willstranathan
+ * @author colezlaw
  */
 public class XPathNuspecParser implements NuspecParser {
     /**

dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Settings.java

@@ -145,6 +145,10 @@ public final class Settings {
          * The properties key for the Nexus search URL.
          */
         public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url";
+        /**
+         * The path to mono, if available.
+         */
+        public static final String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path";
     }
     /**
      * The properties file location.

dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.java

@@ -0,0 +1,118 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.owasp.dependencycheck.dependency.Confidence;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.utils.Settings;
+
+/**
+ * Tests for the AssemblyAnalyzer.
+ * @author colezlaw
+ *
+ */
+public class AssemblyAnalyzerTest {
+    AssemblyAnalyzer analyzer;
+    
+    /**
+     * Sets up the analyzer.
+     * @throws Exception if anything goes sideways
+     */
+    @Before
+    public void setUp() throws Exception {
+        analyzer = new AssemblyAnalyzer();
+        analyzer.initialize();
+    }
+    
+    /**
+     * Tests to make sure the name is correct.
+     */
+    @Test
+    public void testGetName() {
+        assertEquals("Assembly Analyzer", analyzer.getName());
+    }
+    
+    @Test
+    public void testAnalysis() throws Exception {
+        File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("GrokAssembly.exe").getPath());
+        Dependency d = new Dependency(f);
+        analyzer.analyze(d, null);
+        assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly", "version", "1.0.5140.29700", Confidence.HIGHEST)));
+    }
+    
+    @Test
+    public void testLog4Net() throws Exception {
+        File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath());
+        Dependency d = new Dependency(f);
+        analyzer.analyze(d, null);
+        assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly", "version", "1.2.13.0", Confidence.HIGHEST)));
+        assertTrue(d.getVendorEvidence().getEvidence().contains(new Evidence("grokassembly", "vendor", "The Apache Software Foundation", Confidence.HIGH)));
+        assertTrue(d.getProductEvidence().getEvidence().contains(new Evidence("grokassembly", "product", "log4net", Confidence.HIGH)));
+    }
+    
+    @Test(expected=AnalysisException.class)
+    public void testNonexistent() throws Exception {
+        File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath());
+        File test = new File(f.getParent(), "nonexistent.dll");
+        Dependency d = new Dependency(test);
+        analyzer.analyze(d, null);
+    }
+    
+    @Test(expected=AnalysisException.class)
+    public void testWithSettingMono() throws Exception {
+        String oldValue = Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH);
+        // if oldValue is null, that means that neither the system property nor the setting has
+        // been set. If that's the case, then we have to make it such that when we recover,
+        // null still comes back. But you can't put a null value in a HashMap, so we have to set
+        // the system property rather than the setting.
+        if (oldValue == null) {
+            System.setProperty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono");
+        } else {
+            Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, "/yooser/bine/mono");
+        }
+        
+        try {
+            // Have to make a NEW analyzer because during setUp, it would have gotten the correct one
+            AssemblyAnalyzer aanalyzer = new AssemblyAnalyzer();
+            aanalyzer.initialize();
+        } finally {
+            // Now recover the way we came in. If we had to set a System property, delete it. Otherwise,
+            // reset the old value
+            if (oldValue == null) {
+                System.getProperties().remove(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH);
+            } else {
+                Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, oldValue);
+            }
+        }
+    }
+    
+    @After
+    public void tearDown() throws Exception {
+        analyzer.close();
+    }
+}

dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nuget/XPathNuspecParserTest.java

@@ -25,7 +25,7 @@ import static org.junit.Assert.*;
 
 /**
  * 
- * @author willstranathan
+ * @author colezlaw
  *
  */
 public class XPathNuspecParserTest {