github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-22 09:09:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Autoconf analyzer: added configure.in and unquoted values processing.

Browse Source 
Former-commit-id: 4cedd800c60250f19deaebf8cdff9db4e310e7ab
This commit is contained in:
Dale Visser
2015-05-27 13:35:48 -04:00
parent 154a576388
commit d87fa374ec
2 changed files with 46 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java
View File

@@ -19,6 +19,8 @@ package org.owasp.dependencycheck.analyzer;
import java.io.File; import java.io.File;
import java.io.IOException; import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import java.util.Set; import java.util.Set;
import java.util.regex.Matcher; import java.util.regex.Matcher;
import java.util.regex.Pattern; import java.util.regex.Pattern;
@@ -54,7 +56,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
/** /**
* The set of file extensions supported by this analyzer. * The set of file extensions supported by this analyzer.
*/ */
private static final Set<String> EXTENSIONS = newHashSet("ac"); private static final Set<String> EXTENSIONS = newHashSet("ac", "in");
/** /**
* Matches AC_INIT statement in configure.ac file. * Matches AC_INIT statement in configure.ac file.
@@ -62,7 +64,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
private static final Pattern AC_INIT_PATTERN; private static final Pattern AC_INIT_PATTERN;
static { static {
// each instance of param or sep_param has a capture group // each instance of param or sep_param has a capture group
final String param = "\\[{1,2}(.+?)\\]{1,2}"; final String param = "\\[{0,2}(.+?)\\]{0,2}";
final String sep_param = "\\s*,\\s*" + param; final String sep_param = "\\s*,\\s*" + param;
// Group 1: Package // Group 1: Package
// Group 2: Version // Group 2: Version
@@ -73,7 +75,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
// Group 7: optional // Group 7: optional
// Group 8: URL (if it exists) // Group 8: URL (if it exists)
AC_INIT_PATTERN = Pattern.compile(String.format( AC_INIT_PATTERN = Pattern.compile(String.format(
"AC_INIT\\(%s%s(%s)?(%s)?(%s)?", param, sep_param, sep_param, "AC_INIT\\(%s%s(%s)?(%s)?(%s)?\\s*\\)", param, sep_param, sep_param,
sep_param, sep_param), Pattern.DOTALL sep_param, sep_param), Pattern.DOTALL
| Pattern.CASE_INSENSITIVE); | Pattern.CASE_INSENSITIVE);
} }
@@ -123,7 +125,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
throws AnalysisException { throws AnalysisException {
final File actualFile = dependency.getActualFile(); final File actualFile = dependency.getActualFile();
final String name = actualFile.getName(); final String name = actualFile.getName();
if ("configure.ac".equals(name)) { if ("configure.ac".equals(name) || "configure.in".equals(name)) {
final File parent = actualFile.getParentFile(); final File parent = actualFile.getParentFile();
final String parentName = parent.getName(); final String parentName = parent.getName();
dependency.setDisplayFileName(parentName + "/" + name); dependency.setDisplayFileName(parentName + "/" + name);
@@ -135,32 +137,43 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
"Problem occured while reading dependency file.", e); "Problem occured while reading dependency file.", e);
} }
if (!contents.isEmpty()) { if (!contents.isEmpty()) {
final Matcher matcher = AC_INIT_PATTERN.matcher(contents); gatherEvidence(dependency, name, contents);
if (matcher.find()) { }
final EvidenceCollection productEvidence = dependency } else {
.getProductEvidence(); // copy, alter and set in case some other thread is iterating over
productEvidence.addEvidence(name, "Package", final List<Dependency> deps = new ArrayList<Dependency>(
matcher.group(1), Confidence.HIGHEST); engine.getDependencies());
dependency.getVersionEvidence().addEvidence(name, deps.remove(dependency);
"Package Version", matcher.group(2), engine.setDependencies(deps);
Confidence.HIGHEST); }
final EvidenceCollection vendorEvidence = dependency }
.getVendorEvidence();
if (null != matcher.group(3)) { private void gatherEvidence(Dependency dependency, final String name,
vendorEvidence.addEvidence(name, "Bug report address", String contents) {
matcher.group(4), Confidence.HIGH); final Matcher matcher = AC_INIT_PATTERN.matcher(contents);
} if (matcher.find()) {
if (null != matcher.group(5)) { final EvidenceCollection productEvidence = dependency
productEvidence.addEvidence(name, "Tarname", .getProductEvidence();
matcher.group(6), Confidence.HIGH); productEvidence.addEvidence(name, "Package",
} matcher.group(1), Confidence.HIGHEST);
if (null != matcher.group(7)) { dependency.getVersionEvidence().addEvidence(name,
final String url = matcher.group(8); "Package Version", matcher.group(2),
if (UrlStringUtils.isUrl(url)) { Confidence.HIGHEST);
vendorEvidence.addEvidence(name, "URL", url, final EvidenceCollection vendorEvidence = dependency
Confidence.HIGH); .getVendorEvidence();
} if (null != matcher.group(3)) {
} vendorEvidence.addEvidence(name, "Bug report address",
matcher.group(4), Confidence.HIGH);
}
if (null != matcher.group(5)) {
productEvidence.addEvidence(name, "Tarname",
matcher.group(6), Confidence.HIGH);
}
if (null != matcher.group(7)) {
final String url = matcher.group(8);
if (UrlStringUtils.isUrl(url)) {
vendorEvidence.addEvidence(name, "URL", url,
Confidence.HIGH);
} }
} }
} }

4
dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzerTest.java
View File

@@ -124,7 +124,7 @@ public class AutoconfAnalyzerTest extends BaseTest {
*/ */
@Test @Test
public void testGetSupportedExtensions() { public void testGetSupportedExtensions() {
final String[] expected = { "ac" }; final String[] expected = { "ac", "in" };
assertEquals("Supported extensions should just have the following: " assertEquals("Supported extensions should just have the following: "
+ StringUtils.join(expected, ", "), + StringUtils.join(expected, ", "),
new HashSet<String>(Arrays.asList(expected)), new HashSet<String>(Arrays.asList(expected)),
@@ -138,6 +138,8 @@ public class AutoconfAnalyzerTest extends BaseTest {
public void testSupportsExtension() { public void testSupportsExtension() {
assertTrue("Should support \"ac\" extension.", assertTrue("Should support \"ac\" extension.",
analyzer.supportsExtension("ac")); analyzer.supportsExtension("ac"));
assertTrue("Should support \"in\" extension.",
analyzer.supportsExtension("in"));
} }
} }