mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-03-21 08:39:24 +01:00
Merge branch 'upmaster' into node-js-analyzer
Conflicts: dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java dependency-check-cli/src/site/markdown/arguments.md dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer
This commit is contained in:
Dale Visser
@@ -173,10 +173,10 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
}
|
||||
} else {
|
||||
// copy, alter and set in case some other thread is iterating over
|
||||
final List<Dependency> deps = new ArrayList<Dependency>(
|
||||
final List<Dependency> dependencies = new ArrayList<Dependency>(
|
||||
engine.getDependencies());
|
||||
deps.remove(dependency);
|
||||
engine.setDependencies(deps);
|
||||
dependencies.remove(dependency);
|
||||
engine.setDependencies(dependencies);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -225,7 +225,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
contents = FileUtils.readFileToString(actualFile).trim();
|
||||
} catch (IOException e) {
|
||||
throw new AnalysisException(
|
||||
"Problem occured while reading dependency file.", e);
|
||||
"Problem occurred while reading dependency file.", e);
|
||||
}
|
||||
return contents;
|
||||
}
|
||||
|
||||
@@ -53,7 +53,7 @@ import org.owasp.dependencycheck.utils.UrlStringUtils;
|
||||
public class PythonDistributionAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
|
||||
/**
|
||||
* Name of egg metatdata files to analyze.
|
||||
* Name of egg metadata files to analyze.
|
||||
*/
|
||||
private static final String PKG_INFO = "PKG-INFO";
|
||||
|
||||
@@ -269,10 +269,8 @@ public class PythonDistributionAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
*
|
||||
* @param dependency the dependency being analyzed
|
||||
* @param file a reference to the manifest/properties file
|
||||
* @throws AnalysisException thrown when there is an error
|
||||
*/
|
||||
private static void collectWheelMetadata(Dependency dependency, File file)
|
||||
throws AnalysisException {
|
||||
private static void collectWheelMetadata(Dependency dependency, File file) {
|
||||
final InternetHeaders headers = getManifestProperties(file);
|
||||
addPropertyToEvidence(headers, dependency.getVersionEvidence(),
|
||||
"Version", Confidence.HIGHEST);
|
||||
@@ -352,7 +350,7 @@ public class PythonDistributionAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
}
|
||||
|
||||
/**
|
||||
* Retrieves the next temporary destingation directory for extracting an archive.
|
||||
* Retrieves the next temporary destination directory for extracting an archive.
|
||||
*
|
||||
* @return a directory
|
||||
* @throws AnalysisException thrown if unable to create temporary directory
|
||||
|
||||
@@ -28,13 +28,10 @@ import org.owasp.dependencycheck.dependency.EvidenceCollection;
|
||||
import org.owasp.dependencycheck.utils.FileFilterBuilder;
|
||||
import org.owasp.dependencycheck.utils.Settings;
|
||||
import org.owasp.dependencycheck.utils.UrlStringUtils;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.FileFilter;
|
||||
import java.io.IOException;
|
||||
import java.net.MalformedURLException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.regex.Matcher;
|
||||
@@ -53,12 +50,6 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
private static final int REGEX_OPTIONS = Pattern.DOTALL
|
||||
| Pattern.CASE_INSENSITIVE;
|
||||
|
||||
/**
|
||||
* The logger.
|
||||
*/
|
||||
private static final Logger LOGGER = LoggerFactory
|
||||
.getLogger(PythonPackageAnalyzer.class);
|
||||
|
||||
/**
|
||||
* Filename extensions for files to be analyzed.
|
||||
*/
|
||||
@@ -173,7 +164,7 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
* Analyzes python packages and adds evidence to the dependency.
|
||||
*
|
||||
* @param dependency the dependency being analyzed
|
||||
* @param engine the engine being used to perform the scan
|
||||
* @param engine the engine being used to perform the scan
|
||||
* @throws AnalysisException thrown if there is an unrecoverable error analyzing the dependency
|
||||
*/
|
||||
@Override
|
||||
@@ -184,8 +175,8 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
final String parentName = parent.getName();
|
||||
boolean found = false;
|
||||
if (INIT_PY_FILTER.accept(file)) {
|
||||
for (final File sourcefile : parent.listFiles(PY_FILTER)) {
|
||||
found |= analyzeFileContents(dependency, sourcefile);
|
||||
for (final File sourceFile : parent.listFiles(PY_FILTER)) {
|
||||
found |= analyzeFileContents(dependency, sourceFile);
|
||||
}
|
||||
}
|
||||
if (found) {
|
||||
@@ -194,10 +185,10 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
"PackageName", parentName, Confidence.MEDIUM);
|
||||
} else {
|
||||
// copy, alter and set in case some other thread is iterating over
|
||||
final List<Dependency> deps = new ArrayList<Dependency>(
|
||||
final List<Dependency> dependencies = new ArrayList<Dependency>(
|
||||
engine.getDependencies());
|
||||
deps.remove(dependency);
|
||||
engine.setDependencies(deps);
|
||||
dependencies.remove(dependency);
|
||||
engine.setDependencies(dependencies);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -206,7 +197,7 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
* __summary__, __uri__, __url__, __home*page__, __author__, and their all caps equivalents.
|
||||
*
|
||||
* @param dependency the dependency being analyzed
|
||||
* @param file the file name to analyze
|
||||
* @param file the file name to analyze
|
||||
* @return whether evidence was found
|
||||
* @throws AnalysisException thrown if there is an unrecoverable error
|
||||
*/
|
||||
@@ -238,14 +229,10 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
.getVendorEvidence();
|
||||
found |= gatherEvidence(AUTHOR_PATTERN, contents, source,
|
||||
vendorEvidence, "SourceAuthor", Confidence.MEDIUM);
|
||||
try {
|
||||
found |= gatherHomePageEvidence(URI_PATTERN, vendorEvidence,
|
||||
source, "URL", contents);
|
||||
found |= gatherHomePageEvidence(HOMEPAGE_PATTERN,
|
||||
vendorEvidence, source, "HomePage", contents);
|
||||
} catch (MalformedURLException e) {
|
||||
LOGGER.warn(e.getMessage());
|
||||
}
|
||||
found |= gatherHomePageEvidence(URI_PATTERN, vendorEvidence,
|
||||
source, "URL", contents);
|
||||
found |= gatherHomePageEvidence(HOMEPAGE_PATTERN,
|
||||
vendorEvidence, source, "HomePage", contents);
|
||||
}
|
||||
return found;
|
||||
}
|
||||
@@ -254,15 +241,15 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
* Adds summary information to the dependency
|
||||
*
|
||||
* @param dependency the dependency being analyzed
|
||||
* @param pattern the pattern used to perform analysis
|
||||
* @param group the group from the pattern that indicates the data to use
|
||||
* @param contents the data being analyzed
|
||||
* @param source the source name to use when recording the evidence
|
||||
* @param key the key name to use when recording the evidence
|
||||
* @param pattern the pattern used to perform analysis
|
||||
* @param group the group from the pattern that indicates the data to use
|
||||
* @param contents the data being analyzed
|
||||
* @param source the source name to use when recording the evidence
|
||||
* @param key the key name to use when recording the evidence
|
||||
* @return true if evidence was collected; otherwise false
|
||||
*/
|
||||
private boolean addSummaryInfo(Dependency dependency, Pattern pattern,
|
||||
int group, String contents, String source, String key) {
|
||||
int group, String contents, String source, String key) {
|
||||
final Matcher matcher = pattern.matcher(contents);
|
||||
final boolean found = matcher.find();
|
||||
if (found) {
|
||||
@@ -275,17 +262,16 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
/**
|
||||
* Collects evidence from the home page URL.
|
||||
*
|
||||
* @param pattern the pattern to match
|
||||
* @param pattern the pattern to match
|
||||
* @param evidence the evidence collection to add the evidence to
|
||||
* @param source the source of the evidence
|
||||
* @param name the name of the evidence
|
||||
* @param source the source of the evidence
|
||||
* @param name the name of the evidence
|
||||
* @param contents the home page URL
|
||||
* @return true if evidence was collected; otherwise false
|
||||
* @throws MalformedURLException thrown if the URL is malformed
|
||||
*/
|
||||
private boolean gatherHomePageEvidence(Pattern pattern,
|
||||
EvidenceCollection evidence, String source, String name,
|
||||
String contents) throws MalformedURLException {
|
||||
EvidenceCollection evidence, String source, String name,
|
||||
String contents) {
|
||||
final Matcher matcher = pattern.matcher(contents);
|
||||
boolean found = false;
|
||||
if (matcher.find()) {
|
||||
@@ -299,19 +285,19 @@ public class PythonPackageAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
}
|
||||
|
||||
/**
|
||||
* Gather evidence from a Python source file usin the given string assignment regex pattern.
|
||||
* Gather evidence from a Python source file using the given string assignment regex pattern.
|
||||
*
|
||||
* @param pattern to scan contents with
|
||||
* @param contents of Python source file
|
||||
* @param source for storing evidence
|
||||
* @param evidence to store evidence in
|
||||
* @param name of evidence
|
||||
* @param pattern to scan contents with
|
||||
* @param contents of Python source file
|
||||
* @param source for storing evidence
|
||||
* @param evidence to store evidence in
|
||||
* @param name of evidence
|
||||
* @param confidence in evidence
|
||||
* @return whether evidence was found
|
||||
*/
|
||||
private boolean gatherEvidence(Pattern pattern, String contents,
|
||||
String source, EvidenceCollection evidence, String name,
|
||||
Confidence confidence) {
|
||||
String source, EvidenceCollection evidence, String name,
|
||||
Confidence confidence) {
|
||||
final Matcher matcher = pattern.matcher(contents);
|
||||
final boolean found = matcher.find();
|
||||
if (found) {
|
||||
|
||||
@@ -0,0 +1,160 @@
|
||||
/*
|
||||
* This file is part of dependency-check-core.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.analyzer;
|
||||
|
||||
import org.apache.commons.io.FileUtils;
|
||||
import org.owasp.dependencycheck.Engine;
|
||||
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
|
||||
import org.owasp.dependencycheck.dependency.Confidence;
|
||||
import org.owasp.dependencycheck.dependency.Dependency;
|
||||
import org.owasp.dependencycheck.dependency.EvidenceCollection;
|
||||
import org.owasp.dependencycheck.utils.FileFilterBuilder;
|
||||
import org.owasp.dependencycheck.utils.Settings;
|
||||
|
||||
import java.io.FileFilter;
|
||||
import java.io.IOException;
|
||||
import java.util.regex.Matcher;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
/**
|
||||
* Used to analyze Ruby Gem specifications and collect information that can be used to determine the associated CPE.
|
||||
* Regular expressions are used to parse the well-defined Ruby syntax that forms the specification.
|
||||
*
|
||||
* @author Dale Visser <dvisser@ida.org>
|
||||
*/
|
||||
public class RubyGemspecAnalyzer extends AbstractFileTypeAnalyzer {
|
||||
|
||||
/**
|
||||
* The name of the analyzer.
|
||||
*/
|
||||
private static final String ANALYZER_NAME = "Ruby Gemspec Analyzer";
|
||||
|
||||
/**
|
||||
* The phase that this analyzer is intended to run in.
|
||||
*/
|
||||
private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
|
||||
|
||||
private static final FileFilter FILTER =
|
||||
FileFilterBuilder.newInstance().addExtensions("gemspec").addFilenames("Rakefile").build();
|
||||
|
||||
private static final String EMAIL = "email";
|
||||
private static final String GEMSPEC = "gemspec";
|
||||
|
||||
/**
|
||||
* @return a filter that accepts files named Rakefile or matching the glob pattern, *.gemspec
|
||||
*/
|
||||
@Override
|
||||
protected FileFilter getFileFilter() {
|
||||
return FILTER;
|
||||
}
|
||||
|
||||
@Override
|
||||
protected void initializeFileTypeAnalyzer() throws Exception {
|
||||
// NO-OP
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the name of the analyzer.
|
||||
*
|
||||
* @return the name of the analyzer.
|
||||
*/
|
||||
@Override
|
||||
public String getName() {
|
||||
return ANALYZER_NAME;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the phase that the analyzer is intended to run in.
|
||||
*
|
||||
* @return the phase that the analyzer is intended to run in.
|
||||
*/
|
||||
@Override
|
||||
public AnalysisPhase getAnalysisPhase() {
|
||||
return ANALYSIS_PHASE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the key used in the properties file to reference the analyzer's enabled property.
|
||||
*
|
||||
* @return the analyzer's enabled property setting key
|
||||
*/
|
||||
@Override
|
||||
protected String getAnalyzerEnabledSettingKey() {
|
||||
return Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED;
|
||||
}
|
||||
|
||||
/**
|
||||
* The capture group #1 is the block variable.
|
||||
*/
|
||||
private static final Pattern GEMSPEC_BLOCK_INIT =
|
||||
Pattern.compile("Gem::Specification\\.new\\s+?do\\s+?\\|(.+?)\\|");
|
||||
|
||||
@Override
|
||||
protected void analyzeFileType(Dependency dependency, Engine engine)
|
||||
throws AnalysisException {
|
||||
String contents;
|
||||
try {
|
||||
contents = FileUtils.readFileToString(dependency.getActualFile());
|
||||
} catch (IOException e) {
|
||||
throw new AnalysisException(
|
||||
"Problem occurred while reading dependency file.", e);
|
||||
}
|
||||
final Matcher matcher = GEMSPEC_BLOCK_INIT.matcher(contents);
|
||||
if (matcher.find()) {
|
||||
contents = contents.substring(matcher.end());
|
||||
final String blockVariable = matcher.group(1);
|
||||
final EvidenceCollection vendor = dependency.getVendorEvidence();
|
||||
addStringEvidence(vendor, contents, blockVariable, "author", Confidence.HIGHEST);
|
||||
addListEvidence(vendor, contents, blockVariable, "authors", Confidence.HIGHEST);
|
||||
final String email = addStringEvidence(vendor, contents, blockVariable, EMAIL, Confidence.MEDIUM);
|
||||
if (email.isEmpty()) {
|
||||
addListEvidence(vendor, contents, blockVariable, EMAIL, Confidence.MEDIUM);
|
||||
}
|
||||
addStringEvidence(vendor, contents, blockVariable, "homepage", Confidence.MEDIUM);
|
||||
final EvidenceCollection product = dependency.getProductEvidence();
|
||||
final String name = addStringEvidence(product, contents, blockVariable, "name", Confidence.HIGHEST);
|
||||
if (!name.isEmpty()) {
|
||||
vendor.addEvidence(GEMSPEC, "name_project", name + "_project", Confidence.LOW);
|
||||
}
|
||||
addStringEvidence(product, contents, blockVariable, "summary", Confidence.LOW);
|
||||
addStringEvidence(dependency.getVersionEvidence(), contents, blockVariable, "version", Confidence.HIGHEST);
|
||||
}
|
||||
}
|
||||
|
||||
private void addListEvidence(EvidenceCollection evidences, String contents,
|
||||
String blockVariable, String field, Confidence confidence) {
|
||||
final Matcher matcher = Pattern.compile(
|
||||
String.format("\\s+?%s\\.%s\\s*?=\\s*?\\[(.*?)\\]", blockVariable, field)).matcher(contents);
|
||||
if (matcher.find()) {
|
||||
final String value = matcher.group(1).replaceAll("['\"]", " ").trim();
|
||||
evidences.addEvidence(GEMSPEC, field, value, confidence);
|
||||
}
|
||||
}
|
||||
|
||||
private String addStringEvidence(EvidenceCollection evidences, String contents,
|
||||
String blockVariable, String field, Confidence confidence) {
|
||||
final Matcher matcher = Pattern.compile(
|
||||
String.format("\\s+?%s\\.%s\\s*?=\\s*?(['\"])(.*?)\\1", blockVariable, field)).matcher(contents);
|
||||
String value = "";
|
||||
if (matcher.find()) {
|
||||
value = matcher.group(2);
|
||||
evidences.addEvidence(GEMSPEC, field, value, confidence);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
}
|
||||
@@ -720,7 +720,7 @@ public class Dependency implements Serializable, Comparable<Dependency> {
|
||||
&& ObjectUtils.equals(this.description, other.description)
|
||||
&& ObjectUtils.equals(this.license, other.license)
|
||||
&& ObjectUtils.equals(this.vulnerabilities, other.vulnerabilities)
|
||||
&& ObjectUtils.equals(this.relatedDependencies, other.relatedDependencies)
|
||||
//&& ObjectUtils.equals(this.relatedDependencies, other.relatedDependencies)
|
||||
&& ObjectUtils.equals(this.projectReferences, other.projectReferences)
|
||||
&& ObjectUtils.equals(this.availableVersions, other.availableVersions);
|
||||
}
|
||||
@@ -735,8 +735,9 @@ public class Dependency implements Serializable, Comparable<Dependency> {
|
||||
int hash = MAGIC_HASH_INIT_VALUE;
|
||||
for (Object field : new Object[]{this.actualFilePath, this.filePath, this.fileName, this.md5sum,
|
||||
this.sha1sum, this.identifiers, this.vendorEvidence, this.productEvidence, this.versionEvidence,
|
||||
this.description, this.license, this.vulnerabilities, this.relatedDependencies, this.projectReferences,
|
||||
this.availableVersions}) {
|
||||
this.description, this.license, this.vulnerabilities,
|
||||
//this.relatedDependencies,
|
||||
this.projectReferences, this.availableVersions}) {
|
||||
hash = MAGIC_HASH_MULTIPLIER * hash + ObjectUtils.hashCode(field);
|
||||
}
|
||||
return hash;
|
||||
|
||||
@@ -17,4 +17,5 @@ org.owasp.dependencycheck.analyzer.PythonPackageAnalyzer
|
||||
org.owasp.dependencycheck.analyzer.AutoconfAnalyzer
|
||||
org.owasp.dependencycheck.analyzer.OpenSSLAnalyzer
|
||||
org.owasp.dependencycheck.analyzer.CMakeAnalyzer
|
||||
org.owasp.dependencycheck.analyzer.NodePackageAnalyzer
|
||||
org.owasp.dependencycheck.analyzer.NodePackageAnalyzer
|
||||
org.owasp.dependencycheck.analyzer.RubyGemspecAnalyzer
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
<cpe>cpe:/a:mod_security:mod_security</cpe>
|
||||
<cpe>cpe:/a:springsource:spring_framework</cpe>
|
||||
<cpe>cpe:/a:vmware:springsource_spring_framework</cpe>
|
||||
<cpe>cpe:/a:pivotal:spring_framework</cpe>
|
||||
</suppress>
|
||||
<suppress base="true">
|
||||
<notes><![CDATA[
|
||||
|
||||
@@ -504,7 +504,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
<div id="modal-background"></div>
|
||||
<div id="modal-content">
|
||||
<div>Press CTR-C to copy XML <a href="http://jeremylong.github.io/DependencyCheck/suppression.html" class="infolink" target="_blank" title="Help with suppressing false positives">[help]</a></div>
|
||||
<textarea id="modal-text" cols="50" rows="10"></textarea><br/>
|
||||
<textarea id="modal-text" cols="50" rows="10" readonly></textarea><br/>
|
||||
<button id="modal-add-header" title="Add the parent XML nodes to create the complete XML file that can be used to suppress this finding" class="modal-button">Complete XML Doc</button><button id="modal-close" class="modal-button-right">Close</button>
|
||||
</div>
|
||||
<div class="wrapper">
|
||||
@@ -591,6 +591,7 @@ arising out of or in connection with the use of this tool, the analysis performe
|
||||
#else
|
||||
$enc.html($id.value)
|
||||
#end
|
||||
#set($cpeSort=0)
|
||||
#if ($cpeIdConf == "")
|
||||
#set($cpeIdConf=$id.confidence)
|
||||
#set($cpeSort=$id.confidence.ordinal())
|
||||
@@ -602,11 +603,15 @@ arising out of or in connection with the use of this tool, the analysis performe
|
||||
#end
|
||||
#end
|
||||
</td>
|
||||
#if ($mavenlink=="")
|
||||
<td data-sort-value="">
|
||||
#else
|
||||
<td data-sort-value="$enc.html($mavenlink.value)">#if( $mavenlink.url )
|
||||
##yes, we are HTML Encoding the href. this is okay. We can't URL encode as we have to trust the analyzer here...
|
||||
##yes, we are HTML Encoding the href. This is okay. We can't URL encode as we have to trust the analyzer here...
|
||||
<a href="$enc.html($mavenlink.url)" target="_blank">$enc.html($mavenlink.value)</a>
|
||||
#elseif ($mavenlink.value)
|
||||
$enc.html($mavenlink.value)
|
||||
#end
|
||||
#end</td>
|
||||
#set($cveImpact=-1)
|
||||
#foreach($vuln in $dependency.getVulnerabilities())
|
||||
|
||||
@@ -39,10 +39,10 @@ public class OpenSSLAnalyzerTest extends BaseTest {
|
||||
/**
|
||||
* The package analyzer to test.
|
||||
*/
|
||||
OpenSSLAnalyzer analyzer;
|
||||
private OpenSSLAnalyzer analyzer;
|
||||
|
||||
/**
|
||||
* Setup the PtyhonPackageAnalyzer.
|
||||
* Setup the {@link OpenSSLAnalyzer}.
|
||||
*
|
||||
* @throws Exception if there is a problem
|
||||
*/
|
||||
|
||||
@@ -40,7 +40,7 @@ public class PythonDistributionAnalyzerTest extends BaseTest {
|
||||
/**
|
||||
* The analyzer to test.
|
||||
*/
|
||||
PythonDistributionAnalyzer analyzer;
|
||||
private PythonDistributionAnalyzer analyzer;
|
||||
|
||||
/**
|
||||
* Correctly setup the analyzer for testing.
|
||||
|
||||
@@ -40,10 +40,10 @@ public class PythonPackageAnalyzerTest extends BaseTest {
|
||||
/**
|
||||
* The package analyzer to test.
|
||||
*/
|
||||
PythonPackageAnalyzer analyzer;
|
||||
private PythonPackageAnalyzer analyzer;
|
||||
|
||||
/**
|
||||
* Setup the PtyhonPackageAnalyzer.
|
||||
* Setup the {@link PythonPackageAnalyzer}.
|
||||
*
|
||||
* @throws Exception if there is a problem
|
||||
*/
|
||||
@@ -85,14 +85,9 @@ public class PythonPackageAnalyzerTest extends BaseTest {
|
||||
|
||||
@Test
|
||||
public void testAnalyzeSourceMetadata() throws AnalysisException {
|
||||
eggtestAssertions(this,
|
||||
"python/eggtest/__init__.py");
|
||||
}
|
||||
|
||||
public void eggtestAssertions(Object context, final String resource) throws AnalysisException {
|
||||
boolean found = false;
|
||||
final Dependency result = new Dependency(BaseTest.getResourceAsFile(
|
||||
context, resource));
|
||||
this, "python/eggtest/__init__.py"));
|
||||
analyzer.analyze(result, null);
|
||||
assertTrue("Expected vendor evidence to contain \"example\".", result
|
||||
.getVendorEvidence().toString().contains("example"));
|
||||
@@ -104,4 +99,5 @@ public class PythonPackageAnalyzerTest extends BaseTest {
|
||||
}
|
||||
assertTrue("Version 0.0.1 not found in EggTest dependency.", found);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,103 @@
|
||||
/*
|
||||
* This file is part of dependency-check-core.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.analyzer;
|
||||
|
||||
import org.junit.After;
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.owasp.dependencycheck.BaseTest;
|
||||
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
|
||||
import org.owasp.dependencycheck.dependency.Dependency;
|
||||
|
||||
import java.io.File;
|
||||
|
||||
import static org.hamcrest.CoreMatchers.containsString;
|
||||
import static org.hamcrest.CoreMatchers.is;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
* Unit tests for {@link RubyGemspecAnalyzer}.
|
||||
*
|
||||
* @author Dale Visser <dvisser@ida.org>
|
||||
*/
|
||||
public class RubyGemspecAnalyzerTest extends BaseTest {
|
||||
|
||||
/**
|
||||
* The analyzer to test.
|
||||
*/
|
||||
RubyGemspecAnalyzer analyzer;
|
||||
|
||||
/**
|
||||
* Correctly setup the analyzer for testing.
|
||||
*
|
||||
* @throws Exception thrown if there is a problem
|
||||
*/
|
||||
@Before
|
||||
public void setUp() throws Exception {
|
||||
analyzer = new RubyGemspecAnalyzer();
|
||||
analyzer.setFilesMatched(true);
|
||||
analyzer.initialize();
|
||||
}
|
||||
|
||||
/**
|
||||
* Cleanup the analyzer's temp files, etc.
|
||||
*
|
||||
* @throws Exception thrown if there is a problem
|
||||
*/
|
||||
@After
|
||||
public void tearDown() throws Exception {
|
||||
analyzer.close();
|
||||
analyzer = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getName method, of class PythonDistributionAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testGetName() {
|
||||
assertThat(analyzer.getName(), is("Ruby Gemspec Analyzer"));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of supportsExtension method, of class PythonDistributionAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testSupportsFiles() {
|
||||
assertThat(analyzer.accept(new File("test.gemspec")), is(true));
|
||||
assertThat(analyzer.accept(new File("Rakefile")), is(true));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of inspect method, of class PythonDistributionAnalyzer.
|
||||
*
|
||||
* @throws AnalysisException is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testAnalyzePackageJson() throws AnalysisException {
|
||||
final Dependency result = new Dependency(BaseTest.getResourceAsFile(this,
|
||||
"ruby/gems/specifications/rest-client-1.7.2.gemspec"));
|
||||
analyzer.analyze(result, null);
|
||||
final String vendorString = result.getVendorEvidence().toString();
|
||||
assertThat(vendorString, containsString("REST Client Team"));
|
||||
assertThat(vendorString, containsString("rest-client_project"));
|
||||
assertThat(vendorString, containsString("rest.client@librelist.com"));
|
||||
assertThat(vendorString, containsString("https://github.com/rest-client/rest-client"));
|
||||
assertThat(result.getProductEvidence().toString(), containsString("rest-client"));
|
||||
assertThat(result.getVersionEvidence().toString(), containsString("1.7.2"));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
# -*- encoding: utf-8 -*-
|
||||
# stub: mime-types 2.6.1 ruby lib
|
||||
|
||||
Gem::Specification.new do |s|
|
||||
s.name = "mime-types"
|
||||
s.version = "2.6.1"
|
||||
|
||||
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
||||
s.require_paths = ["lib"]
|
||||
s.authors = ["Austin Ziegler"]
|
||||
s.date = "2015-05-25"
|
||||
s.description = "The mime-types library provides a library and registry for information about\nMIME content type definitions. It can be used to determine defined filename\nextensions for MIME types, or to use filename extensions to look up the likely\nMIME type definitions.\n\nMIME content types are used in MIME-compliant communications, as in e-mail or\nHTTP traffic, to indicate the type of content which is transmitted. The\nmime-types library provides the ability for detailed information about MIME\nentities (provided as an enumerable collection of MIME::Type objects) to be\ndetermined and used. There are many types defined by RFCs and vendors, so the\nlist is long but by definition incomplete; don't hesitate to add additional\ntype definitions. MIME type definitions found in mime-types are from RFCs, W3C\nrecommendations, the {IANA Media Types\nregistry}[https://www.iana.org/assignments/media-types/media-types.xhtml], and\nuser contributions. It conforms to RFCs 2045 and 2231.\n\nThis is release 2.6 with two new experimental features. The first new feature\nis a new default registry storage format that greatly reduces the initial\nmemory use of the mime-types library. This feature is enabled by requiring\n+mime/types/columnar+ instead of +mime/types+ with a small performance cost and\nno change in *total* memory use if certain methods are called (see {Columnar\nStore}[#columnar-store] for more details). The second new feature is a logger\ninterface that conforms to the expectations of an ActiveSupport::Logger so that\nwarnings can be written to an application's log rather than the default\nlocation for +warn+. This interface may be used for other logging purposes in\nthe future.\n\nmime-types 2.6 is the last planned version of mime-types 2.x, so deprecation\nwarnings are no longer cached but provided every time the method is called.\nmime-types 2.6 supports Ruby 1.9.2 or later."
|
||||
s.email = ["halostatue@gmail.com"]
|
||||
s.extra_rdoc_files = ["Contributing.rdoc", "History-Types.rdoc", "History.rdoc", "Licence.rdoc", "Manifest.txt", "README.rdoc", "docs/COPYING.txt", "docs/artistic.txt"]
|
||||
s.files = ["Contributing.rdoc", "History-Types.rdoc", "History.rdoc", "Licence.rdoc", "Manifest.txt", "README.rdoc", "docs/COPYING.txt", "docs/artistic.txt"]
|
||||
s.homepage = "https://github.com/mime-types/ruby-mime-types/"
|
||||
s.licenses = ["MIT", "Artistic 2.0", "GPL-2"]
|
||||
s.rdoc_options = ["--main", "README.rdoc"]
|
||||
s.required_ruby_version = Gem::Requirement.new(">= 1.9.2")
|
||||
s.rubygems_version = "2.2.2"
|
||||
s.summary = "The mime-types library provides a library and registry for information about MIME content type definitions"
|
||||
|
||||
s.installed_by_version = "2.2.2" if s.respond_to? :installed_by_version
|
||||
|
||||
if s.respond_to? :specification_version then
|
||||
s.specification_version = 4
|
||||
|
||||
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
|
||||
s.add_development_dependency(%q<minitest>, ["~> 5.6"])
|
||||
s.add_development_dependency(%q<rdoc>, ["~> 4.0"])
|
||||
s.add_development_dependency(%q<hoe-doofus>, ["~> 1.0"])
|
||||
s.add_development_dependency(%q<hoe-gemspec2>, ["~> 1.1"])
|
||||
s.add_development_dependency(%q<hoe-git>, ["~> 1.6"])
|
||||
s.add_development_dependency(%q<hoe-rubygems>, ["~> 1.0"])
|
||||
s.add_development_dependency(%q<hoe-travis>, ["~> 1.2"])
|
||||
s.add_development_dependency(%q<minitest-autotest>, ["~> 1.0"])
|
||||
s.add_development_dependency(%q<minitest-focus>, ["~> 1.0"])
|
||||
s.add_development_dependency(%q<rake>, ["~> 10.0"])
|
||||
s.add_development_dependency(%q<simplecov>, ["~> 0.7"])
|
||||
s.add_development_dependency(%q<coveralls>, ["~> 0.8"])
|
||||
s.add_development_dependency(%q<hoe>, ["~> 3.13"])
|
||||
else
|
||||
s.add_dependency(%q<minitest>, ["~> 5.6"])
|
||||
s.add_dependency(%q<rdoc>, ["~> 4.0"])
|
||||
s.add_dependency(%q<hoe-doofus>, ["~> 1.0"])
|
||||
s.add_dependency(%q<hoe-gemspec2>, ["~> 1.1"])
|
||||
s.add_dependency(%q<hoe-git>, ["~> 1.6"])
|
||||
s.add_dependency(%q<hoe-rubygems>, ["~> 1.0"])
|
||||
s.add_dependency(%q<hoe-travis>, ["~> 1.2"])
|
||||
s.add_dependency(%q<minitest-autotest>, ["~> 1.0"])
|
||||
s.add_dependency(%q<minitest-focus>, ["~> 1.0"])
|
||||
s.add_dependency(%q<rake>, ["~> 10.0"])
|
||||
s.add_dependency(%q<simplecov>, ["~> 0.7"])
|
||||
s.add_dependency(%q<coveralls>, ["~> 0.8"])
|
||||
s.add_dependency(%q<hoe>, ["~> 3.13"])
|
||||
end
|
||||
else
|
||||
s.add_dependency(%q<minitest>, ["~> 5.6"])
|
||||
s.add_dependency(%q<rdoc>, ["~> 4.0"])
|
||||
s.add_dependency(%q<hoe-doofus>, ["~> 1.0"])
|
||||
s.add_dependency(%q<hoe-gemspec2>, ["~> 1.1"])
|
||||
s.add_dependency(%q<hoe-git>, ["~> 1.6"])
|
||||
s.add_dependency(%q<hoe-rubygems>, ["~> 1.0"])
|
||||
s.add_dependency(%q<hoe-travis>, ["~> 1.2"])
|
||||
s.add_dependency(%q<minitest-autotest>, ["~> 1.0"])
|
||||
s.add_dependency(%q<minitest-focus>, ["~> 1.0"])
|
||||
s.add_dependency(%q<rake>, ["~> 10.0"])
|
||||
s.add_dependency(%q<simplecov>, ["~> 0.7"])
|
||||
s.add_dependency(%q<coveralls>, ["~> 0.8"])
|
||||
s.add_dependency(%q<hoe>, ["~> 3.13"])
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,32 @@
|
||||
# -*- encoding: utf-8 -*-
|
||||
# stub: netrc 0.10.3 ruby lib
|
||||
|
||||
Gem::Specification.new do |s|
|
||||
s.name = "netrc"
|
||||
s.version = "0.10.3"
|
||||
|
||||
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
||||
s.require_paths = ["lib"]
|
||||
s.authors = ["Keith Rarick", "geemus (Wesley Beary)"]
|
||||
s.date = "2015-02-24"
|
||||
s.description = "This library can read and update netrc files, preserving formatting including comments and whitespace."
|
||||
s.email = "geemus@gmail.com"
|
||||
s.homepage = "https://github.com/geemus/netrc"
|
||||
s.licenses = ["MIT"]
|
||||
s.rubygems_version = "2.2.2"
|
||||
s.summary = "Library to read and write netrc files."
|
||||
|
||||
s.installed_by_version = "2.2.2" if s.respond_to? :installed_by_version
|
||||
|
||||
if s.respond_to? :specification_version then
|
||||
s.specification_version = 4
|
||||
|
||||
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
|
||||
s.add_development_dependency(%q<turn>, [">= 0"])
|
||||
else
|
||||
s.add_dependency(%q<turn>, [">= 0"])
|
||||
end
|
||||
else
|
||||
s.add_dependency(%q<turn>, [">= 0"])
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,54 @@
|
||||
# -*- encoding: utf-8 -*-
|
||||
# stub: rest-client 1.7.2 ruby lib
|
||||
|
||||
Gem::Specification.new do |s|
|
||||
s.name = "rest-client"
|
||||
s.version = "1.7.2"
|
||||
|
||||
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
||||
s.require_paths = ["lib"]
|
||||
s.authors = ["REST Client Team"]
|
||||
s.date = "2014-07-14"
|
||||
s.description = "A simple HTTP and REST client for Ruby, inspired by the Sinatra microframework style of specifying actions: get, put, post, delete."
|
||||
s.email = "rest.client@librelist.com"
|
||||
s.executables = ["restclient"]
|
||||
s.extra_rdoc_files = ["README.rdoc", "history.md"]
|
||||
s.files = ["README.rdoc", "bin/restclient", "history.md"]
|
||||
s.homepage = "https://github.com/rest-client/rest-client"
|
||||
s.licenses = ["MIT"]
|
||||
s.required_ruby_version = Gem::Requirement.new(">= 1.9.2")
|
||||
s.rubygems_version = "2.2.2"
|
||||
s.summary = "Simple HTTP and REST client for Ruby, inspired by microframework syntax for specifying actions."
|
||||
|
||||
s.installed_by_version = "2.2.2" if s.respond_to? :installed_by_version
|
||||
|
||||
if s.respond_to? :specification_version then
|
||||
s.specification_version = 3
|
||||
|
||||
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
|
||||
s.add_development_dependency(%q<webmock>, ["~> 1.4"])
|
||||
s.add_development_dependency(%q<rspec>, ["~> 2.4"])
|
||||
s.add_development_dependency(%q<pry>, [">= 0"])
|
||||
s.add_development_dependency(%q<pry-doc>, [">= 0"])
|
||||
s.add_development_dependency(%q<rdoc>, ["< 5.0", ">= 2.4.2"])
|
||||
s.add_runtime_dependency(%q<mime-types>, ["< 3.0", ">= 1.16"])
|
||||
s.add_runtime_dependency(%q<netrc>, ["~> 0.7"])
|
||||
else
|
||||
s.add_dependency(%q<webmock>, ["~> 1.4"])
|
||||
s.add_dependency(%q<rspec>, ["~> 2.4"])
|
||||
s.add_dependency(%q<pry>, [">= 0"])
|
||||
s.add_dependency(%q<pry-doc>, [">= 0"])
|
||||
s.add_dependency(%q<rdoc>, ["< 5.0", ">= 2.4.2"])
|
||||
s.add_dependency(%q<mime-types>, ["< 3.0", ">= 1.16"])
|
||||
s.add_dependency(%q<netrc>, ["~> 0.7"])
|
||||
end
|
||||
else
|
||||
s.add_dependency(%q<webmock>, ["~> 1.4"])
|
||||
s.add_dependency(%q<rspec>, ["~> 2.4"])
|
||||
s.add_dependency(%q<pry>, [">= 0"])
|
||||
s.add_dependency(%q<pry-doc>, [">= 0"])
|
||||
s.add_dependency(%q<rdoc>, ["< 5.0", ">= 2.4.2"])
|
||||
s.add_dependency(%q<mime-types>, ["< 3.0", ">= 1.16"])
|
||||
s.add_dependency(%q<netrc>, ["~> 0.7"])
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user