diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java new file mode 100644 index 000000000..4861b7bf4 --- /dev/null +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java @@ -0,0 +1,220 @@ +/* + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + */ +package org.owasp.dependencycheck.analyzer; + +import java.io.File; +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.List; +import java.util.Set; +import java.util.logging.Level; +import java.util.logging.Logger; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.xpath.XPath; +import javax.xml.xpath.XPathConstants; +import javax.xml.xpath.XPathExpressionException; +import javax.xml.xpath.XPathFactory; + +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.dependency.Confidence; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; +import org.w3c.dom.Document; +import org.w3c.dom.Node; +import org.w3c.dom.NodeList; +import org.xml.sax.SAXException; + +/** + * Analyzer for getting company, product, and version information + * from a .NET assembly. + * + * @author colezlaw + * + */ +public class AssemblyAnalyzer extends AbstractAnalyzer { + /** + * The analyzer name + */ + private static final String ANALYZER_NAME = "Assembly Analyzer"; + /** + * The analysis phase + */ + private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; + /** + * The list of supported extensions + */ + private static final Set SUPORTED_EXTENSIONS = newHashSet("dll", "exe"); + /** + * The temp value for GrokAssembly.exe + */ + private File grokAssemblyExe; + /** + * The DocumentBuilder for parsing the XML + */ + private DocumentBuilder builder; + /** + * Logger + */ + private static final Logger LOG = Logger.getLogger(AbstractAnalyzer.class.getName()); + + /** + * Performs the analysis on a single Dependency. + * @param dependency the dependency to analyze + * @param engine the engine to perform the analysis under + * @throws AnalysisException if anything goes sideways + */ + @Override + public void analyze(Dependency dependency, Engine engine) + throws AnalysisException { + if (grokAssemblyExe == null) { + LOG.warning("GrokAssembly didn't get deployed"); + return; + } + + // Use file.separator as a wild guess as to whether this is Windows + List args = new ArrayList(); + if (! "\\".equals(System.getProperty("file.separator"))) { + args.add("mono"); + } + args.add(grokAssemblyExe.getPath()); + args.add(dependency.getActualFilePath()); + ProcessBuilder pb = new ProcessBuilder(args); + try { + Process proc = pb.start(); + Document doc = builder.parse(proc.getInputStream()); + XPath xpath = XPathFactory.newInstance().newXPath(); + String version = xpath.evaluate("/assembly/version", doc); + if (version != null) { + dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly", "version", + version, Confidence.HIGHEST)); + } + + String vendor = xpath.evaluate("/assembly/company", doc); + if (vendor != null) { + dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly", "vendor", + vendor, Confidence.HIGH)); + } + + String product = xpath.evaluate("/assembly/product", doc); + if (product != null) { + dependency.getProductEvidence().addEvidence(new Evidence("grokassembly", "product", + product, Confidence.HIGH)); + } + + NodeList types = (NodeList)xpath.evaluate("/assembly/types/type/text()", doc, XPathConstants.NODESET); + for (int i = 0; i < types.getLength(); i++) { + Node type = types.item(i); + // System.out.println(type.getTextContent()); + } + } catch (IOException ioe) { + throw new AnalysisException(ioe); + } catch (SAXException saxe) { + throw new AnalysisException("Couldn't parse GrokAssembly result", saxe); + } catch (XPathExpressionException xpe) { + // This shouldn't happen + throw new AnalysisException(xpe); + } + + } + + /** + * Initialize the analyzer. In this case, extract GrokAssembly.exe + * to a temporary location. + */ + @Override + public void initialize() throws Exception { + super.initialize(); + File tempFile = File.createTempFile("GKA", ".exe"); + FileOutputStream fos = null; + InputStream is = null; + try { + fos = new FileOutputStream(tempFile); + is = AssemblyAnalyzer.class.getClassLoader().getResourceAsStream("GrokAssembly.exe"); + byte[] buff = new byte[4096]; + int bread = -1; + while((bread = is.read(buff)) >= 0) { + fos.write(buff, 0, bread); + } + grokAssemblyExe = tempFile; + // Set the temp file to get deleted when we're done + grokAssemblyExe.deleteOnExit(); + LOG.log(Level.INFO, "Extracted GrokAssembly.exe to {0}", grokAssemblyExe.getPath()); + builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); + } finally { + if (fos != null) { + try { fos.close(); } catch (Exception e) {} + } + if (is != null) { + try { is.close(); } catch (Exception e) {} + } + } + } + + @Override + public void close() throws Exception { + super.close(); + try { + grokAssemblyExe.delete(); + } catch (SecurityException se) { + + } + } + + /** + * Gets the set of extensions supported by this analyzer. + * @return the list of supported extensions + */ + @Override + public Set getSupportedExtensions() { + return SUPORTED_EXTENSIONS; + } + + /** + * Gets this analyzer's name. + * + * @return the analyzer name + */ + @Override + public String getName() { + return ANALYZER_NAME; + } + + /** + * Gets whether the analyzer supports the provided extension. + * @param extension the extension to check + * @return whether the analyzer supports the extension + */ + @Override + public boolean supportsExtension(String extension) { + return SUPORTED_EXTENSIONS.contains(extension); + } + + /** + * Returns the phase this analyzer runs under. + * + * @return the phase this runs under + */ + @Override + public AnalysisPhase getAnalysisPhase() { + return ANALYSIS_PHASE; + } +} diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.java new file mode 100644 index 000000000..c36e6bea1 --- /dev/null +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.java @@ -0,0 +1,80 @@ +/* + * This file is part of dependency-check-core. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2012 Jeremy Long. All Rights Reserved. + */ +package org.owasp.dependencycheck.analyzer; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import java.io.File; + +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.owasp.dependencycheck.dependency.Confidence; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.dependency.Evidence; + +/** + * Tests for the AssemblyAnalyzer. + * @author colezlaw + * + */ +public class AssemblyAnalyzerTest { + AssemblyAnalyzer analyzer; + + /** + * Sets up the analyzer. + * @throws Exception if anything goes sideways + */ + @Before + public void setUp() throws Exception { + analyzer = new AssemblyAnalyzer(); + analyzer.initialize(); + } + + /** + * Tests to make sure the name is correct. + */ + @Test + public void testGetName() { + assertEquals("Assembly Analyzer", analyzer.getName()); + } + + @Test + public void testAnalysis() throws Exception { + File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("GrokAssembly.exe").getPath()); + Dependency d = new Dependency(f); + analyzer.analyze(d, null); + assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly", "version", "1.0.5140.29700", Confidence.HIGHEST))); + } + + @Test + public void testLog4Net() throws Exception { + File f = new File(AssemblyAnalyzerTest.class.getClassLoader().getResource("log4net.dll").getPath()); + Dependency d = new Dependency(f); + analyzer.analyze(d, null); + assertTrue(d.getVersionEvidence().getEvidence().contains(new Evidence("grokassembly", "version", "1.2.13.0", Confidence.HIGHEST))); + assertTrue(d.getVendorEvidence().getEvidence().contains(new Evidence("grokassembly", "vendor", "The Apache Software Foundation", Confidence.HIGH))); + assertTrue(d.getProductEvidence().getEvidence().contains(new Evidence("grokassembly", "product", "log4net", Confidence.HIGH))); + } + + @After + public void tearDown() throws Exception { + analyzer.close(); + } +} diff --git a/dependency-check-core/src/test/resources/log4net.dll b/dependency-check-core/src/test/resources/log4net.dll new file mode 100644 index 000000000..2d9437854 Binary files /dev/null and b/dependency-check-core/src/test/resources/log4net.dll differ