From 5a5d699cabb24d9a0ec1f97bbeea88e07217bf08 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 3 Mar 2013 09:47:54 -0500 Subject: [PATCH] bug fixes Former-commit-id: 6411fe67e52a3eef4044b1d640bdfb6864c2dbf3 --- .../analyzer/HintAnalyzer.java | 116 ++++++++++++++++++ .../dependencycheck/analyzer/JarAnalyzer.java | 38 +++--- .../dependencycheck/data/cpe/CPEAnalyzer.java | 5 +- ...rg.owasp.dependencycheck.analyzer.Analyzer | 1 + .../data/cpe/CPEAnalyzerTest.java | 6 +- 5 files changed, 142 insertions(+), 24 deletions(-) create mode 100644 src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java diff --git a/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java b/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java new file mode 100644 index 000000000..f0f11756d --- /dev/null +++ b/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java @@ -0,0 +1,116 @@ +/* + * This file is part of DependencyCheck. + * + * DependencyCheck is free software: you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the Free + * Software Foundation, either version 3 of the License, or (at your option) any + * later version. + * + * DependencyCheck is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * DependencyCheck. If not, see http://www.gnu.org/licenses/. + * + * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + */ +package org.owasp.dependencycheck.analyzer; + +import java.util.Set; +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; + +/** + * + * @author Jeremy Long (jeremy.long@gmail.com) + */ +public class HintAnalyzer implements Analyzer { + + /** + * The name of the analyzer. + */ + private static final String ANALYZER_NAME = "Hint Analyzer"; + /** + * The phase that this analyzer is intended to run in. + */ + private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS; + /** + * The set of file extensions supported by this analyzer. + */ + private static final Set EXTENSIONS = null; + + /** + * Returns a list of file EXTENSIONS supported by this analyzer. + * + * @return a list of file EXTENSIONS supported by this analyzer. + */ + public Set getSupportedExtensions() { + return EXTENSIONS; + } + + /** + * Returns the name of the analyzer. + * + * @return the name of the analyzer. + */ + public String getName() { + return ANALYZER_NAME; + } + + /** + * Returns whether or not this analyzer can process the given extension. + * + * @param extension the file extension to test for support. + * @return whether or not the specified file extension is supported by this + * analyzer. + */ + public boolean supportsExtension(String extension) { + return true; + } + + /** + * Returns the phase that the analyzer is intended to run in. + * + * @return the phase that the analyzer is intended to run in. + */ + public AnalysisPhase getAnalysisPhase() { + return ANALYSIS_PHASE; + } + + public void analyze(Dependency dependency, Engine engine) throws AnalysisException { + Evidence springTest1 = new Evidence("Manifest", + "Implementation-Title", + "Spring Framework", + Evidence.Confidence.HIGH); + + Evidence springTest2 = new Evidence("Manifest", + "Implementation-Title", + "org.springframework.core", + Evidence.Confidence.HIGH); + + Set evidence = dependency.getProductEvidence().getEvidence(); + if (evidence.contains(springTest1) || evidence.contains(springTest2)) { + dependency.getProductEvidence().addEvidence("a priori", "product", "springsource_spring_framework", Evidence.Confidence.HIGH); + dependency.getVendorEvidence().addEvidence("a priori", "vendor", "SpringSource", Evidence.Confidence.HIGH); + dependency.getVendorEvidence().addEvidence("a priori", "vendor", "vmware", Evidence.Confidence.HIGH); + } + + } + + /** + * The initialize method does nothing for this Analyzer + */ + public void initialize() { + //do nothing + } + + /** + * The close method does nothing for this Analyzer + */ + public void close() { + //do nothing + } +} diff --git a/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java index 8d8e06612..d46ae4d66 100644 --- a/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java +++ b/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java @@ -184,7 +184,7 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { parseManifest(dependency); analyzePackageNames(dependency); analyzePOM(dependency); - addPredefinedData(dependency); + //addPredefinedData(dependency); //this has been moved to its own analyzer (HintAnalyzer) } catch (IOException ex) { throw new AnalysisException("Exception occurred reading the JAR file.", ex); } catch (JAXBException ex) { @@ -643,22 +643,22 @@ public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { return interpolateString(sb.toString(), properties); //yes yes, this should be a loop... } - private void addPredefinedData(Dependency dependency) { - Evidence springTest1 = new Evidence("Manifest", - "Implementation-Title", - "Spring Framework", - Evidence.Confidence.HIGH); - - Evidence springTest2 = new Evidence("Manifest", - "Implementation-Title", - "org.springframework.core", - Evidence.Confidence.HIGH); - - Set evidence = dependency.getProductEvidence().getEvidence(); - if (evidence.contains(springTest1) || evidence.contains(springTest2)) { - dependency.getProductEvidence().addEvidence("a priori", "product", "springsource_spring_framework", Evidence.Confidence.HIGH); - dependency.getVendorEvidence().addEvidence("a priori", "vendor", "SpringSource", Evidence.Confidence.HIGH); - dependency.getVendorEvidence().addEvidence("a priori", "vendor", "vmware", Evidence.Confidence.HIGH); - } - } +// private void addPredefinedData(Dependency dependency) { +// Evidence springTest1 = new Evidence("Manifest", +// "Implementation-Title", +// "Spring Framework", +// Evidence.Confidence.HIGH); +// +// Evidence springTest2 = new Evidence("Manifest", +// "Implementation-Title", +// "org.springframework.core", +// Evidence.Confidence.HIGH); +// +// Set evidence = dependency.getProductEvidence().getEvidence(); +// if (evidence.contains(springTest1) || evidence.contains(springTest2)) { +// dependency.getProductEvidence().addEvidence("a priori", "product", "springsource_spring_framework", Evidence.Confidence.HIGH); +// dependency.getVendorEvidence().addEvidence("a priori", "vendor", "SpringSource", Evidence.Confidence.HIGH); +// dependency.getVendorEvidence().addEvidence("a priori", "vendor", "vmware", Evidence.Confidence.HIGH); +// } +// } } diff --git a/src/main/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzer.java b/src/main/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzer.java index 9145b7331..428da4488 100644 --- a/src/main/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzer.java +++ b/src/main/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzer.java @@ -50,7 +50,7 @@ public class CPEAnalyzer implements org.owasp.dependencycheck.analyzer.Analyzer /** * The maximum number of query results to return. */ - static final int MAX_QUERY_RESULTS = 10; + static final int MAX_QUERY_RESULTS = 25; /** * The weighting boost to give terms when constructing the Lucene query. */ @@ -211,7 +211,7 @@ public class CPEAnalyzer implements org.owasp.dependencycheck.analyzer.Analyzer if (value.startsWith("https://")) { value = value.substring(8).replaceAll("\\.", " "); } - if (sb.indexOf(value) < 0) { + if (sb.indexOf(" " + value + " ") < 0) { sb.append(value).append(' '); } } @@ -261,6 +261,7 @@ public class CPEAnalyzer implements org.owasp.dependencycheck.analyzer.Analyzer if (searchString == null) { return ret; } + TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); for (ScoreDoc d : docs.scoreDocs) { Document doc = cpe.getDocument(d.doc); diff --git a/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer b/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer index 825d63667..a2e3e122f 100644 --- a/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer +++ b/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer @@ -1,5 +1,6 @@ org.owasp.dependencycheck.analyzer.JarAnalyzer org.owasp.dependencycheck.analyzer.FileNameAnalyzer +org.owasp.dependencycheck.analyzer.HintAnalyzer org.owasp.dependencycheck.analyzer.SpringCleaningAnalyzer org.owasp.dependencycheck.data.cpe.CPEAnalyzer org.owasp.dependencycheck.data.nvdcve.NvdCveAnalyzer \ No newline at end of file diff --git a/src/test/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzerTest.java b/src/test/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzerTest.java index dba74e8bd..bbbc3c80b 100644 --- a/src/test/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzerTest.java +++ b/src/test/java/org/owasp/dependencycheck/data/cpe/CPEAnalyzerTest.java @@ -118,13 +118,13 @@ public class CPEAnalyzerTest extends BaseIndexTestCase { instance.close(); Assert.assertTrue("Incorrect match size - struts", depends.getIdentifiers().size() == 1); Assert.assertTrue("Incorrect match - struts", depends.getIdentifiers().get(0).getValue().equals(expResult)); - Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); - Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); + //the following two only work if the HintAnalyzer is used. + //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); + //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1); //assertTrue("Incorrect match - spring3", spring3.getIdentifiers().get(0).getValue().equals(expResultSpring3)); } - /** * Test of searchCPE method, of class CPEAnalyzer. * @throws Exception is thrown when an exception occurs