mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-16 00:33:46 +01:00
change in namespace as this is now an OWASP project
Former-commit-id: dc00f98a142bef2560d90f3b851844f352fbf262
This commit is contained in:
Jeremy Long
@@ -0,0 +1,72 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck;
|
||||
|
||||
import org.owasp.dependencycheck.Engine;
|
||||
import org.owasp.dependencycheck.reporting.ReportGenerator;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class EngineIntegrationTest {
|
||||
|
||||
public EngineIntegrationTest() throws Exception {
|
||||
org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase.ensureDBExists();
|
||||
org.owasp.dependencycheck.data.cpe.BaseIndexTestCase.ensureIndexExists();
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of scan method, of class Engine.
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testScan() throws Exception {
|
||||
String path = "./src/test/resources/";
|
||||
Engine instance = new Engine();
|
||||
instance.scan(path);
|
||||
assertTrue(instance.getDependencies().size() > 0);
|
||||
instance.analyzeDependencies();
|
||||
ReportGenerator rg = new ReportGenerator("DependencyCheck",
|
||||
instance.getDependencies(), instance.getAnalyzers());
|
||||
rg.generateReports("./target/", "HTML");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.analyzer;
|
||||
|
||||
import org.owasp.dependencycheck.analyzer.AbstractAnalyzer;
|
||||
import java.util.Set;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class AbstractAnalyzerTest {
|
||||
|
||||
public AbstractAnalyzerTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of newHashSet method, of class AbstractAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testNewHashSet() {
|
||||
Set result = AbstractAnalyzer.newHashSet("one","two");
|
||||
assertEquals(2, result.size());
|
||||
assertTrue(result.contains("one"));
|
||||
assertTrue(result.contains("two"));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.analyzer;
|
||||
|
||||
import org.owasp.dependencycheck.analyzer.AnalyzerService;
|
||||
import org.owasp.dependencycheck.analyzer.Analyzer;
|
||||
import java.util.Set;
|
||||
import java.util.Iterator;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class AnalyzerServiceTest {
|
||||
|
||||
public AnalyzerServiceTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getAnalyzers method, of class AnalyzerService.
|
||||
*/
|
||||
@Test
|
||||
public void testGetAnalyzers() {
|
||||
AnalyzerService instance = AnalyzerService.getInstance();
|
||||
Iterator<Analyzer> result = instance.getAnalyzers();
|
||||
|
||||
boolean found = false;
|
||||
while (result.hasNext()) {
|
||||
Analyzer a = result.next();
|
||||
Set<String> e = a.getSupportedExtensions();
|
||||
if (e != null && e.contains("jar")) {
|
||||
found = true;
|
||||
}
|
||||
}
|
||||
assertTrue("JarAnalyzer loaded", found);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,134 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.analyzer;
|
||||
|
||||
import org.owasp.dependencycheck.analyzer.AnalysisPhase;
|
||||
import org.owasp.dependencycheck.analyzer.FileNameAnalyzer;
|
||||
import java.io.File;
|
||||
import java.util.Set;
|
||||
import org.owasp.dependencycheck.dependency.Dependency;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class FileNameAnalyzerTest {
|
||||
|
||||
public FileNameAnalyzerTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getSupportedExtensions method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testGetSupportedExtensions() {
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
Set expResult = null;
|
||||
Set result = instance.getSupportedExtensions();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getName method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testGetName() {
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
String expResult = "File Name Analyzer";
|
||||
String result = instance.getName();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of supportsExtension method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testSupportsExtension() {
|
||||
String extension = "any";
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
boolean expResult = true;
|
||||
boolean result = instance.supportsExtension(extension);
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getAnalysisPhase method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testGetAnalysisPhase() {
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION;
|
||||
AnalysisPhase result = instance.getAnalysisPhase();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of analyze method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testAnalyze() throws Exception {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
|
||||
Dependency result = new Dependency(file);
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
instance.analyze(result, null);
|
||||
assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("struts"));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of initialize method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testInitialize() {
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
instance.initialize();
|
||||
assertTrue(true); //initialize does nothing.
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of close method, of class FileNameAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testClose() {
|
||||
FileNameAnalyzer instance = new FileNameAnalyzer();
|
||||
instance.close();
|
||||
assertTrue(true); //close does nothing.
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,158 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.analyzer;
|
||||
|
||||
import java.util.Properties;
|
||||
import org.owasp.dependencycheck.analyzer.JarAnalyzer;
|
||||
import org.owasp.dependencycheck.dependency.Dependency;
|
||||
import org.owasp.dependencycheck.dependency.Evidence;
|
||||
import java.util.HashSet;
|
||||
import java.io.File;
|
||||
import java.util.Set;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class JarAnalyzerTest {
|
||||
|
||||
public JarAnalyzerTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of inspect method, of class JarAnalyzer.
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testAnalyze() throws Exception {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
|
||||
Dependency result = new Dependency(file);
|
||||
JarAnalyzer instance = new JarAnalyzer();
|
||||
instance.analyze(result, null);
|
||||
assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache"));
|
||||
assertTrue(result.getVendorEvidence().getWeighting().contains("apache"));
|
||||
|
||||
file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath());
|
||||
result = new Dependency(file);
|
||||
instance.analyze(result, null);
|
||||
boolean found = false;
|
||||
for (Evidence e : result.getProductEvidence()) {
|
||||
if (e.getName().equalsIgnoreCase("package-title")
|
||||
&& e.getValue().equalsIgnoreCase("org.mortbay.http")) {
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
assertTrue("package-title of org.mortbay.http not found in org.mortbay.jetty.jar", found);
|
||||
|
||||
found = false;
|
||||
for (Evidence e : result.getVendorEvidence()) {
|
||||
if (e.getName().equalsIgnoreCase("implementation-url")
|
||||
&& e.getValue().equalsIgnoreCase("http://jetty.mortbay.org")) {
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
assertTrue("implementation-url of http://jetty.mortbay.org not found in org.mortbay.jetty.jar", found);
|
||||
|
||||
found = false;
|
||||
for (Evidence e : result.getVersionEvidence()) {
|
||||
if (e.getName().equalsIgnoreCase("Implementation-Version")
|
||||
&& e.getValue().equalsIgnoreCase("4.2.27")) {
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
assertTrue("implementation-version of 4.2.27 not found in org.mortbay.jetty.jar", found);
|
||||
|
||||
file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jmx.jar").getPath());
|
||||
result = new Dependency(file);
|
||||
instance.analyze(result, null);
|
||||
assertEquals("org.mortbar,jmx.jar has version evidence?", result.getVersionEvidence().size(), 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getSupportedExtensions method, of class JarAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testGetSupportedExtensions() {
|
||||
JarAnalyzer instance = new JarAnalyzer();
|
||||
Set expResult = new HashSet();
|
||||
expResult.add("jar");
|
||||
Set result = instance.getSupportedExtensions();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getName method, of class JarAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testGetName() {
|
||||
JarAnalyzer instance = new JarAnalyzer();
|
||||
String expResult = "Jar Analyzer";
|
||||
String result = instance.getName();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of supportsExtension method, of class JarAnalyzer.
|
||||
*/
|
||||
@Test
|
||||
public void testSupportsExtension() {
|
||||
String extension = "jar";
|
||||
JarAnalyzer instance = new JarAnalyzer();
|
||||
boolean expResult = true;
|
||||
boolean result = instance.supportsExtension(extension);
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testInterpolateString() {
|
||||
Properties prop = new Properties();
|
||||
prop.setProperty("key", "value");
|
||||
prop.setProperty("nested", "nested ${key}");
|
||||
String text = "This is a test of '${key}' '${nested}'";
|
||||
String expResults = "This is a test of 'value' 'nested value'";
|
||||
JarAnalyzer instance = new JarAnalyzer();
|
||||
String results = instance.interpolateString(text, prop);
|
||||
assertEquals(expResults, results);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,140 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.cpe;
|
||||
|
||||
import org.owasp.dependencycheck.data.cpe.Index;
|
||||
import java.io.BufferedInputStream;
|
||||
import java.io.BufferedOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.FileOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.net.URLDecoder;
|
||||
import java.util.zip.ZipEntry;
|
||||
import java.util.zip.ZipInputStream;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.owasp.dependencycheck.utils.Settings;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public abstract class BaseIndexTestCase {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() throws Exception {
|
||||
ensureIndexExists();
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() throws Exception {
|
||||
}
|
||||
|
||||
protected static File getDataDirectory() throws IOException {
|
||||
String fileName = Settings.getString(Settings.KEYS.CPE_INDEX);
|
||||
String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
|
||||
String decodedPath = URLDecoder.decode(filePath, "UTF-8");
|
||||
File exePath = new File(decodedPath);
|
||||
if (exePath.getName().toLowerCase().endsWith(".jar")) {
|
||||
exePath = exePath.getParentFile();
|
||||
} else {
|
||||
exePath = new File(".");
|
||||
}
|
||||
File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
|
||||
path = new File(path.getCanonicalPath());
|
||||
return path;
|
||||
}
|
||||
|
||||
public static void ensureIndexExists() throws Exception {
|
||||
//String indexPath = Settings.getString(Settings.KEYS.CPE_INDEX);
|
||||
String indexPath = getDataDirectory().getCanonicalPath();
|
||||
java.io.File f = new File(indexPath);
|
||||
if (!f.exists()) {
|
||||
f.mkdirs();
|
||||
FileInputStream fis = null;
|
||||
ZipInputStream zin = null;
|
||||
try {
|
||||
File path = new File(BaseIndexTestCase.class.getClassLoader().getResource("index.cpe.zip").getPath());
|
||||
fis = new FileInputStream(path);
|
||||
zin = new ZipInputStream(new BufferedInputStream(fis));
|
||||
ZipEntry entry;
|
||||
while ((entry = zin.getNextEntry()) != null) {
|
||||
if (entry.isDirectory()) {
|
||||
continue;
|
||||
}
|
||||
int BUFFER = 2048;
|
||||
String outputName = indexPath + File.separatorChar + entry.getName();
|
||||
FileOutputStream fos = null;
|
||||
BufferedOutputStream dest = null;
|
||||
try {
|
||||
File o = new File(outputName);
|
||||
// File oPath = new File(o.getParent());
|
||||
// if (!oPath.exists()) {
|
||||
// oPath.mkdir();
|
||||
// }
|
||||
o.createNewFile();
|
||||
fos = new FileOutputStream(o,false);
|
||||
dest = new BufferedOutputStream(fos, BUFFER);
|
||||
byte data[] = new byte[BUFFER];
|
||||
int count;
|
||||
while ((count = zin.read(data, 0, BUFFER)) != -1) {
|
||||
dest.write(data, 0, count);
|
||||
}
|
||||
} catch (Exception ex) {
|
||||
String ignore = ex.getMessage();
|
||||
} finally {
|
||||
try {
|
||||
dest.flush();
|
||||
dest.close();
|
||||
dest = null;
|
||||
} catch (Throwable ex) { String ignore = ex.getMessage(); }
|
||||
try {
|
||||
fos.close();
|
||||
fos = null;
|
||||
} catch (Throwable ex) { String ignore = ex.getMessage(); }
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
try {
|
||||
if (zin!=null) {
|
||||
zin.close();
|
||||
}
|
||||
zin = null;
|
||||
} catch (Throwable ex) { String ignore = ex.getMessage(); }
|
||||
try {
|
||||
if (fis!=null) {
|
||||
fis.close();
|
||||
}
|
||||
fis = null;
|
||||
} catch (Throwable ex) { String ignore = ex.getMessage(); }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,155 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.cpe;
|
||||
|
||||
import org.owasp.dependencycheck.data.cpe.Entry;
|
||||
import org.owasp.dependencycheck.data.cpe.CPEAnalyzer;
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import org.apache.lucene.index.CorruptIndexException;
|
||||
import org.apache.lucene.queryparser.classic.ParseException;
|
||||
import org.owasp.dependencycheck.dependency.Dependency;
|
||||
import org.owasp.dependencycheck.analyzer.JarAnalyzer;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Test;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class CPEAnalyzerTest extends BaseIndexTestCase {
|
||||
|
||||
/**
|
||||
* Tests of buildSearch of class CPEAnalyzer.
|
||||
* @throws IOException is thrown when an IO Exception occurs.
|
||||
* @throws CorruptIndexException is thrown when the index is corrupt.
|
||||
* @throws ParseException is thrown when a parse exception occurs
|
||||
*/
|
||||
@Test
|
||||
public void testBuildSearch() throws IOException, CorruptIndexException, ParseException {
|
||||
Set<String> productWeightings = new HashSet<String>(1);
|
||||
productWeightings.add("struts2");
|
||||
|
||||
Set<String> vendorWeightings = new HashSet<String>(1);
|
||||
vendorWeightings.add("apache");
|
||||
|
||||
String vendor = "apache software foundation";
|
||||
String product = "struts 2 core";
|
||||
String version = "2.1.2";
|
||||
CPEAnalyzer instance = new CPEAnalyzer();
|
||||
|
||||
String queryText = instance.buildSearch(vendor, product, version, null, null);
|
||||
String expResult = " product:( struts 2 core ) AND vendor:( apache software foundation ) AND version:(2.1.2^0.7 )";
|
||||
Assert.assertTrue(expResult.equals(queryText));
|
||||
|
||||
queryText = instance.buildSearch(vendor, product, version, null, productWeightings);
|
||||
expResult = " product:( struts^5 struts2^5 2 core ) AND vendor:( apache software foundation ) AND version:(2.1.2^0.2 )";
|
||||
Assert.assertTrue(expResult.equals(queryText));
|
||||
|
||||
queryText = instance.buildSearch(vendor, product, version, vendorWeightings, null);
|
||||
expResult = " product:( struts 2 core ) AND vendor:( apache^5 software foundation ) AND version:(2.1.2^0.2 )";
|
||||
Assert.assertTrue(expResult.equals(queryText));
|
||||
|
||||
queryText = instance.buildSearch(vendor, product, version, vendorWeightings, productWeightings);
|
||||
expResult = " product:( struts^5 struts2^5 2 core ) AND vendor:( apache^5 software foundation ) AND version:(2.1.2^0.2 )";
|
||||
Assert.assertTrue(expResult.equals(queryText));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of open method, of class CPEAnalyzer.
|
||||
* @throws Exception is thrown when an exception occurs
|
||||
*/
|
||||
@Test
|
||||
public void testOpen() throws Exception {
|
||||
CPEAnalyzer instance = new CPEAnalyzer();
|
||||
Assert.assertFalse(instance.isOpen());
|
||||
instance.open();
|
||||
Assert.assertTrue(instance.isOpen());
|
||||
instance.close();
|
||||
Assert.assertFalse(instance.isOpen());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of determineCPE method, of class CPEAnalyzer.
|
||||
* @throws Exception is thrown when an exception occurs
|
||||
*/
|
||||
@Test
|
||||
public void testDetermineCPE() throws Exception {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
|
||||
JarAnalyzer jarAnalyzer = new JarAnalyzer();
|
||||
Dependency depends = new Dependency(file);
|
||||
jarAnalyzer.analyze(depends, null);
|
||||
|
||||
File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath());
|
||||
Dependency spring = new Dependency(fileSpring);
|
||||
jarAnalyzer.analyze(spring, null);
|
||||
|
||||
File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath());
|
||||
Dependency spring3 = new Dependency(fileSpring3);
|
||||
jarAnalyzer.analyze(spring3, null);
|
||||
|
||||
CPEAnalyzer instance = new CPEAnalyzer();
|
||||
instance.open();
|
||||
String expResult = "cpe:/a:apache:struts:2.1.2";
|
||||
String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5";
|
||||
String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0";
|
||||
instance.determineCPE(depends);
|
||||
instance.determineCPE(spring);
|
||||
instance.determineCPE(spring3);
|
||||
instance.close();
|
||||
Assert.assertTrue("Incorrect match size - struts", depends.getIdentifiers().size() == 1);
|
||||
Assert.assertTrue("Incorrect match - struts", depends.getIdentifiers().get(0).getValue().equals(expResult));
|
||||
Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1);
|
||||
Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring));
|
||||
Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1);
|
||||
//assertTrue("Incorrect match - spring3", spring3.getIdentifiers().get(0).getValue().equals(expResultSpring3));
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Test of searchCPE method, of class CPEAnalyzer.
|
||||
* @throws Exception is thrown when an exception occurs
|
||||
*/
|
||||
@Test
|
||||
public void testSearchCPE() throws Exception {
|
||||
String vendor = "apache software foundation";
|
||||
String product = "struts 2 core";
|
||||
String version = "2.1.2";
|
||||
String expResult = "cpe:/a:apache:struts:2.1.2";
|
||||
|
||||
CPEAnalyzer instance = new CPEAnalyzer();
|
||||
instance.open();
|
||||
|
||||
//TODO - yeah, not a very good test as the results are the same with or without weighting...
|
||||
Set<String> productWeightings = new HashSet<String>(1);
|
||||
productWeightings.add("struts2");
|
||||
|
||||
Set<String> vendorWeightings = new HashSet<String>(1);
|
||||
vendorWeightings.add("apache");
|
||||
|
||||
List<Entry> result = instance.searchCPE(vendor, product, version, productWeightings, vendorWeightings);
|
||||
Assert.assertEquals(expResult, result.get(0).getName());
|
||||
|
||||
|
||||
instance.close();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.cpe;
|
||||
|
||||
import org.owasp.dependencycheck.data.cpe.Entry;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import org.junit.Assert;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class EntryTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
/**
|
||||
* Test of setName method, of class Entry.
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testSetName() throws Exception {
|
||||
String name = "cpe:/a:apache:struts:1.1:rc2";
|
||||
|
||||
Entry instance = new Entry();
|
||||
instance.parseName(name);
|
||||
|
||||
Assert.assertEquals(name,instance.getName());
|
||||
Assert.assertEquals("apache", instance.getVendor());
|
||||
Assert.assertEquals("struts", instance.getProduct());
|
||||
Assert.assertEquals("1.1", instance.getVersion());
|
||||
Assert.assertEquals("rc2", instance.getRevision());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.cpe;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import org.apache.lucene.store.Directory;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class IndexIntegrationTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of update method, of class Index.
|
||||
*/
|
||||
@Test
|
||||
public void testUpdate() throws Exception {
|
||||
//deprecated
|
||||
//Index instance = new Index();
|
||||
//instance.update();
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of updateNeeded method, of class Index.
|
||||
*/
|
||||
@Test
|
||||
public void testUpdateNeeded() throws Exception {
|
||||
//deprecated
|
||||
//Index instance = new Index();
|
||||
//instance.updateNeeded();
|
||||
//if an exception is thrown this test fails. However, because it depends on the
|
||||
// order of the tests what this will return I am just testing for the exception.
|
||||
//assertTrue(expResult < result);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.cpe;
|
||||
|
||||
import org.owasp.dependencycheck.data.cpe.Index;
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import junit.framework.Assert;
|
||||
import org.apache.lucene.store.Directory;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class IndexTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of open method, of class Index.
|
||||
*/
|
||||
@Test
|
||||
public void testOpen() {
|
||||
Index instance = new Index();
|
||||
try {
|
||||
instance.open();
|
||||
} catch (IOException ex) {
|
||||
Assert.fail(ex.getMessage());
|
||||
}
|
||||
instance.close();
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getDirectory method, of class Index.
|
||||
* @throws Exception
|
||||
*/
|
||||
@Test
|
||||
public void testGetDirectory() throws Exception {
|
||||
Index index = new Index();
|
||||
Directory result = index.getDirectory();
|
||||
|
||||
String exp = File.separatorChar + "target" + File.separatorChar + "data" + File.separatorChar + "cpe";
|
||||
Assert.assertTrue(result.toString().contains(exp));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.cwe;
|
||||
|
||||
import org.owasp.dependencycheck.data.cwe.CweDB;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class CweDBTest {
|
||||
|
||||
public CweDBTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Method to serialize the CWE HashMap. This is not used in
|
||||
* production; this is only used once during dev to create
|
||||
* the serialized hashmap.
|
||||
*/
|
||||
// @Test
|
||||
// public void testUpdate() throws Exception {
|
||||
// SAXParserFactory factory = SAXParserFactory.newInstance();
|
||||
// SAXParser saxParser = factory.newSAXParser();
|
||||
//
|
||||
// CweHandler handler = new CweHandler();
|
||||
// File file = new File(this.getClass().getClassLoader().getResource("cwe.2000.xml").getPath());
|
||||
//
|
||||
// saxParser.parse(file, handler);
|
||||
// System.out.println("Found " + handler.getCwe().size() + " cwe entries.");
|
||||
// Map<String,String> cwe = handler.getCwe();
|
||||
// FileOutputStream fout = new FileOutputStream("src/main/resources/data/cwe.hashmap.serialized");
|
||||
// ObjectOutputStream objOut = new ObjectOutputStream(fout);
|
||||
// objOut.writeObject(cwe);
|
||||
// objOut.close();
|
||||
// }
|
||||
|
||||
/**
|
||||
* Test of getCweName method, of class CweDB.
|
||||
*/
|
||||
@Test
|
||||
public void testGetCweName() {
|
||||
String cweId = "CWE-16";
|
||||
String expResult = "Configuration";
|
||||
String result = CweDB.getCweName(cweId);
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.lucene;
|
||||
|
||||
import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer;
|
||||
import org.owasp.dependencycheck.data.lucene.FieldAnalyzer;
|
||||
import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper;
|
||||
import java.util.HashMap;
|
||||
import org.apache.lucene.queryparser.classic.QueryParser;
|
||||
import org.apache.lucene.analysis.standard.StandardAnalyzer;
|
||||
import org.apache.lucene.analysis.Analyzer;
|
||||
import org.apache.lucene.search.ScoreDoc;
|
||||
import org.apache.lucene.search.TopScoreDocCollector;
|
||||
import org.apache.lucene.search.IndexSearcher;
|
||||
import org.apache.lucene.index.IndexReader;
|
||||
import org.apache.lucene.search.Query;
|
||||
import java.io.IOException;
|
||||
import org.apache.lucene.document.Field;
|
||||
import org.apache.lucene.document.TextField;
|
||||
import org.apache.lucene.document.Document;
|
||||
import org.apache.lucene.index.DirectoryReader;
|
||||
import org.apache.lucene.index.IndexWriter;
|
||||
import org.apache.lucene.index.IndexWriterConfig;
|
||||
import org.apache.lucene.store.RAMDirectory;
|
||||
import org.apache.lucene.store.Directory;
|
||||
import org.apache.lucene.util.Version;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class FieldAnalyzerTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testAnalyzers() throws Exception {
|
||||
|
||||
Analyzer analyzer = new FieldAnalyzer(Version.LUCENE_40);
|
||||
Directory index = new RAMDirectory();
|
||||
|
||||
String field1 = "product";
|
||||
String text1 = "springframework";
|
||||
|
||||
String field2 = "vendor";
|
||||
String text2 = "springsource";
|
||||
|
||||
createIndex(analyzer, index, field1, text1, field2, text2);
|
||||
|
||||
//Analyzer searchingAnalyzer = new SearchFieldAnalyzer(Version.LUCENE_40);
|
||||
String querystr = "product:\"(Spring Framework Core)\" vendor:(SpringSource)";
|
||||
|
||||
SearchFieldAnalyzer searchAnalyzerProduct = new SearchFieldAnalyzer(Version.LUCENE_40);
|
||||
SearchFieldAnalyzer searchAnalyzerVendor = new SearchFieldAnalyzer(Version.LUCENE_40);
|
||||
HashMap<String,Analyzer> map = new HashMap<String,Analyzer>();
|
||||
map.put(field1, searchAnalyzerProduct);
|
||||
map.put(field2, searchAnalyzerVendor);
|
||||
PerFieldAnalyzerWrapper wrapper = new PerFieldAnalyzerWrapper(new StandardAnalyzer(Version.LUCENE_40), map);
|
||||
QueryParser parser = new QueryParser(Version.LUCENE_40, field1, wrapper);
|
||||
|
||||
Query q = parser.parse(querystr);
|
||||
//System.out.println(q.toString());
|
||||
|
||||
int hitsPerPage = 10;
|
||||
|
||||
IndexReader reader = DirectoryReader.open(index);
|
||||
IndexSearcher searcher = new IndexSearcher(reader);
|
||||
TopScoreDocCollector collector = TopScoreDocCollector.create(hitsPerPage, true);
|
||||
searcher.search(q, collector);
|
||||
ScoreDoc[] hits = collector.topDocs().scoreDocs;
|
||||
|
||||
assertEquals("Did not find 1 document?", 1, hits.length);
|
||||
|
||||
searchAnalyzerProduct.clear(); //ensure we don't have anything left over from the previous search.
|
||||
searchAnalyzerVendor.clear();
|
||||
querystr = "product:(Apache Struts) vendor:(Apache)";
|
||||
Query q2 = parser.parse(querystr);
|
||||
//System.out.println(q2.toString());
|
||||
assertFalse("second parsing contains previousWord from the TokenPairConcatenatingFilter", q2.toString().contains("core"));
|
||||
}
|
||||
|
||||
private void createIndex(Analyzer analyzer, Directory index, String field1, String text1, String field2, String text2) throws IOException {
|
||||
IndexWriterConfig config = new IndexWriterConfig(Version.LUCENE_40, analyzer);
|
||||
IndexWriter w = new IndexWriter(index, config);
|
||||
addDoc(w, field1, text1, field2, text2);
|
||||
w.close();
|
||||
}
|
||||
|
||||
private static void addDoc(IndexWriter w, String field1, String text1, String field2, String text2) throws IOException {
|
||||
Document doc = new Document();
|
||||
doc.add(new TextField(field1, text1, Field.Store.YES));
|
||||
doc.add(new TextField(field2, text2, Field.Store.YES));
|
||||
w.addDocument(doc);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,93 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.lucene;
|
||||
|
||||
import org.owasp.dependencycheck.data.lucene.LuceneUtils;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class LuceneUtilsTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of appendEscapedLuceneQuery method, of class LuceneUtils.
|
||||
*/
|
||||
@Test
|
||||
public void testAppendEscapedLuceneQuery() {
|
||||
StringBuilder buf = new StringBuilder();
|
||||
CharSequence text = "test encoding + - & | ! ( ) { } [ ] ^ \" ~ * ? : \\";
|
||||
String expResult = "test encoding \\+ \\- \\& \\| \\! \\( \\) \\{ \\} \\[ \\] \\^ \\\" \\~ \\* \\? \\: \\\\";
|
||||
LuceneUtils.appendEscapedLuceneQuery(buf, text);
|
||||
assertEquals(expResult, buf.toString());
|
||||
}
|
||||
/**
|
||||
* Test of appendEscapedLuceneQuery method, of class LuceneUtils.
|
||||
*/
|
||||
@Test
|
||||
public void testAppendEscapedLuceneQuery_null() {
|
||||
StringBuilder buf = new StringBuilder();
|
||||
CharSequence text = null;
|
||||
LuceneUtils.appendEscapedLuceneQuery(buf, text);
|
||||
assertEquals(0, buf.length());
|
||||
}
|
||||
/**
|
||||
* Test of escapeLuceneQuery method, of class LuceneUtils.
|
||||
*/
|
||||
@Test
|
||||
public void testEscapeLuceneQuery() {
|
||||
CharSequence text = "test encoding + - & | ! ( ) { } [ ] ^ \" ~ * ? : \\";
|
||||
String expResult = "test encoding \\+ \\- \\& \\| \\! \\( \\) \\{ \\} \\[ \\] \\^ \\\" \\~ \\* \\? \\: \\\\";
|
||||
String result = LuceneUtils.escapeLuceneQuery(text);
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of escapeLuceneQuery method, of class LuceneUtils.
|
||||
*/
|
||||
@Test
|
||||
public void testEscapeLuceneQuery_null() {
|
||||
CharSequence text = null;
|
||||
String expResult = null;
|
||||
String result = LuceneUtils.escapeLuceneQuery(text);
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,138 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.nvdcve;
|
||||
|
||||
import org.owasp.dependencycheck.data.cpe.*;
|
||||
import java.io.BufferedInputStream;
|
||||
import java.io.BufferedOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileInputStream;
|
||||
import java.io.FileOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.net.URLDecoder;
|
||||
import java.util.zip.ZipEntry;
|
||||
import java.util.zip.ZipInputStream;
|
||||
import junit.framework.TestCase;
|
||||
import org.owasp.dependencycheck.utils.Settings;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public abstract class BaseDBTestCase extends TestCase {
|
||||
|
||||
public BaseDBTestCase(String testName) {
|
||||
super(testName);
|
||||
}
|
||||
|
||||
@Override
|
||||
protected void setUp() throws Exception {
|
||||
super.setUp();
|
||||
ensureDBExists();
|
||||
}
|
||||
|
||||
protected static File getDataDirectory() throws IOException {
|
||||
String fileName = Settings.getString(Settings.KEYS.CVE_INDEX);
|
||||
String filePath = Index.class.getProtectionDomain().getCodeSource().getLocation().getPath();
|
||||
String decodedPath = URLDecoder.decode(filePath, "UTF-8");
|
||||
File exePath = new File(decodedPath);
|
||||
if (exePath.getName().toLowerCase().endsWith(".jar")) {
|
||||
exePath = exePath.getParentFile();
|
||||
} else {
|
||||
exePath = new File(".");
|
||||
}
|
||||
File path = new File(exePath.getCanonicalFile() + File.separator + fileName);
|
||||
path = new File(path.getCanonicalPath());
|
||||
return path;
|
||||
}
|
||||
|
||||
public static void ensureDBExists() throws Exception {
|
||||
//String indexPath = Settings.getString(Settings.KEYS.CVE_INDEX);
|
||||
String indexPath = getDataDirectory().getCanonicalPath();
|
||||
java.io.File f = new File(indexPath);
|
||||
if (!f.exists()) {
|
||||
f.mkdirs();
|
||||
FileInputStream fis = null;
|
||||
ZipInputStream zin = null;
|
||||
try {
|
||||
File path = new File(BaseDBTestCase.class.getClassLoader().getResource("db.nvdcve.zip").getPath());
|
||||
fis = new FileInputStream(path);
|
||||
zin = new ZipInputStream(new BufferedInputStream(fis));
|
||||
ZipEntry entry;
|
||||
while ((entry = zin.getNextEntry()) != null) {
|
||||
if (entry.isDirectory()) {
|
||||
continue;
|
||||
}
|
||||
int BUFFER = 2048;
|
||||
String outputName = indexPath + File.separatorChar + entry.getName();
|
||||
FileOutputStream fos = null;
|
||||
BufferedOutputStream dest = null;
|
||||
try {
|
||||
File o = new File(outputName);
|
||||
// File oPath = new File(o.getParent());
|
||||
// if (!oPath.exists()) {
|
||||
// oPath.mkdir();
|
||||
// }
|
||||
o.createNewFile();
|
||||
fos = new FileOutputStream(o, false);
|
||||
dest = new BufferedOutputStream(fos, BUFFER);
|
||||
byte data[] = new byte[BUFFER];
|
||||
int count;
|
||||
while ((count = zin.read(data, 0, BUFFER)) != -1) {
|
||||
dest.write(data, 0, count);
|
||||
}
|
||||
} catch (Exception ex) {
|
||||
String ignore = ex.getMessage();
|
||||
} finally {
|
||||
try {
|
||||
dest.flush();
|
||||
dest.close();
|
||||
dest = null;
|
||||
} catch (Throwable ex) {
|
||||
String ignore = ex.getMessage();
|
||||
}
|
||||
try {
|
||||
fos.close();
|
||||
fos = null;
|
||||
} catch (Throwable ex) {
|
||||
String ignore = ex.getMessage();
|
||||
}
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
try {
|
||||
if (zin != null) {
|
||||
zin.close();
|
||||
}
|
||||
zin = null;
|
||||
} catch (Throwable ex) {
|
||||
String ignore = ex.getMessage();
|
||||
}
|
||||
try {
|
||||
if (fis != null) {
|
||||
fis.close();
|
||||
}
|
||||
fis = null;
|
||||
} catch (Throwable ex) {
|
||||
String ignore = ex.getMessage();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.nvdcve.xml;
|
||||
|
||||
import org.owasp.dependencycheck.data.nvdcve.xml.DatabaseUpdater;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class DatabaseUpdaterIntegrationTest {
|
||||
|
||||
public DatabaseUpdaterIntegrationTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of update method, of class DatabaseUpdater.
|
||||
* @throws Exception
|
||||
*/
|
||||
@Test
|
||||
public void testUpdate() throws Exception {
|
||||
DatabaseUpdater instance = new DatabaseUpdater();
|
||||
instance.update();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.nvdcve.xml;
|
||||
|
||||
import org.owasp.dependencycheck.data.nvdcve.xml.NvdCve12Handler;
|
||||
import java.io.File;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import javax.xml.parsers.SAXParser;
|
||||
import javax.xml.parsers.SAXParserFactory;
|
||||
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class NvdCve_1_2_HandlerTest {
|
||||
|
||||
public NvdCve_1_2_HandlerTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testParse() throws Exception {
|
||||
SAXParserFactory factory = SAXParserFactory.newInstance();
|
||||
SAXParser saxParser = factory.newSAXParser();
|
||||
|
||||
File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2012.xml").getPath());
|
||||
|
||||
NvdCve12Handler instance = new NvdCve12Handler();
|
||||
saxParser.parse(file, instance);
|
||||
Map<String, List<VulnerableSoftware>> results = instance.getVulnerabilities();
|
||||
assertTrue("No vulnerable software identified with a previous version in 2012 CVE 1.2?", !results.isEmpty());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.data.nvdcve.xml;
|
||||
|
||||
import org.owasp.dependencycheck.data.nvdcve.xml.NvdCve20Handler;
|
||||
import java.io.File;
|
||||
import javax.xml.parsers.SAXParser;
|
||||
import javax.xml.parsers.SAXParserFactory;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class NvdCve_2_0_HandlerTest {
|
||||
|
||||
public NvdCve_2_0_HandlerTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testParse() {
|
||||
Exception results = null;
|
||||
try {
|
||||
SAXParserFactory factory = SAXParserFactory.newInstance();
|
||||
SAXParser saxParser = factory.newSAXParser();
|
||||
|
||||
File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2.0-2012.xml").getPath());
|
||||
|
||||
NvdCve20Handler instance = new NvdCve20Handler();
|
||||
|
||||
saxParser.parse(file, instance);
|
||||
} catch (Exception ex) {
|
||||
results = ex;
|
||||
}
|
||||
assertTrue("Exception thrown during parse of 2012 CVE version 2.0?", results == null);
|
||||
if (results != null) {
|
||||
System.err.println(results);
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,307 @@
|
||||
package org.owasp.dependencycheck.dependency;
|
||||
|
||||
import org.owasp.dependencycheck.dependency.EvidenceCollection;
|
||||
import org.owasp.dependencycheck.dependency.Identifier;
|
||||
import org.owasp.dependencycheck.dependency.Dependency;
|
||||
import org.owasp.dependencycheck.dependency.Evidence;
|
||||
import java.io.File;
|
||||
import java.util.List;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class DependencyTest {
|
||||
|
||||
public DependencyTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of containsUsedString method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testContainsUsedString() {
|
||||
String str = "apache";
|
||||
String str2 = "owasp";
|
||||
Dependency instance = new Dependency();
|
||||
instance.vendorEvidence.addEvidence("manifest", "something", "apache", Evidence.Confidence.HIGH);
|
||||
instance.vendorEvidence.addEvidence("manifest", "something", "owasp", Evidence.Confidence.MEDIUM);
|
||||
assertFalse(instance.containsUsedString(str));
|
||||
assertFalse(instance.containsUsedString(str2));
|
||||
for (Evidence i : instance.vendorEvidence.iterator(Evidence.Confidence.HIGH)) {
|
||||
String readValue = i.getValue();
|
||||
}
|
||||
assertTrue(instance.containsUsedString(str));
|
||||
assertFalse(instance.containsUsedString(str2));
|
||||
for (Evidence i : instance.vendorEvidence.iterator(Evidence.Confidence.MEDIUM)) {
|
||||
String readValue = i.getValue();
|
||||
}
|
||||
assertTrue(instance.containsUsedString(str));
|
||||
assertTrue(instance.containsUsedString(str2));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getFileName method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetFileName() {
|
||||
Dependency instance = new Dependency();
|
||||
String expResult = "filename";
|
||||
instance.setFileName(expResult);
|
||||
String result = instance.getFileName();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setFileName method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetFileName() {
|
||||
String fileName = "test.file";
|
||||
Dependency instance = new Dependency();
|
||||
instance.setFileName(fileName);
|
||||
assertEquals(fileName,instance.getFileName());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setActualFilePath method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetActualFilePath() {
|
||||
String actualFilePath = "test.file";
|
||||
Dependency instance = new Dependency();
|
||||
instance.setActualFilePath(actualFilePath);
|
||||
assertEquals(actualFilePath,instance.getActualFilePath());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getActualFilePath method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetActualFilePath() {
|
||||
Dependency instance = new Dependency();
|
||||
String expResult = "test.file";
|
||||
instance.setActualFilePath(expResult);
|
||||
String result = instance.getActualFilePath();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setFilePath method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetFilePath() {
|
||||
String filePath = "test.file";
|
||||
Dependency instance = new Dependency();
|
||||
instance.setFilePath(filePath);
|
||||
assertEquals(filePath,instance.getFilePath());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getFilePath method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetFilePath() {
|
||||
Dependency instance = new Dependency();
|
||||
String expResult = "path/test.file";
|
||||
instance.setFilePath(expResult);
|
||||
String result = instance.getFilePath();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setFileExtension method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetFileExtension() {
|
||||
String fileExtension = "jar";
|
||||
Dependency instance = new Dependency();
|
||||
instance.setFileExtension(fileExtension);
|
||||
assertEquals(fileExtension,instance.getFileExtension());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getFileExtension method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetFileExtension() {
|
||||
Dependency instance = new Dependency();
|
||||
String expResult = "jar";
|
||||
instance.setFileExtension(expResult);
|
||||
String result = instance.getFileExtension();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getMd5sum method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetMd5sum() {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
|
||||
Dependency instance = new Dependency(file);
|
||||
// assertEquals("89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B", result.getSha1sum());
|
||||
String expResult = "C30B57142E1CCBC1EFD5CD15F307358F";
|
||||
String result = instance.getMd5sum();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setMd5sum method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetMd5sum() {
|
||||
String md5sum = "test";
|
||||
Dependency instance = new Dependency();
|
||||
instance.setMd5sum(md5sum);
|
||||
assertEquals(md5sum,instance.getMd5sum());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getSha1sum method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetSha1sum() {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
|
||||
Dependency instance = new Dependency(file);
|
||||
String expResult = "89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B";
|
||||
String result = instance.getSha1sum();
|
||||
assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setSha1sum method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetSha1sum() {
|
||||
String sha1sum = "test";
|
||||
Dependency instance = new Dependency();
|
||||
instance.setSha1sum(sha1sum);
|
||||
assertEquals(sha1sum,instance.getSha1sum());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getIdentifiers method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetIdentifiers() {
|
||||
Dependency instance = new Dependency();
|
||||
List expResult = null;
|
||||
List result = instance.getIdentifiers();
|
||||
|
||||
assertTrue(true); //this is just a getter setter pair.
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setIdentifiers method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testSetIdentifiers() {
|
||||
List<Identifier> identifiers = null;
|
||||
Dependency instance = new Dependency();
|
||||
instance.setIdentifiers(identifiers);
|
||||
assertTrue(true); //this is just a getter setter pair.
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of addIdentifier method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testAddIdentifier() {
|
||||
String type = "cpe";
|
||||
String value = "cpe:/a:apache:struts:2.1.2";
|
||||
String url = "http://somewhere";
|
||||
Dependency instance = new Dependency();
|
||||
instance.addIdentifier(type, value, url);
|
||||
assertEquals(1,instance.getIdentifiers().size());
|
||||
Identifier i = instance.getIdentifiers().get(0);
|
||||
assertEquals(type,i.getType());
|
||||
assertEquals(value, i.getValue());
|
||||
assertEquals(url, i.getUrl());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getEvidence method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetEvidence() {
|
||||
Dependency instance = new Dependency();
|
||||
EvidenceCollection expResult = null;
|
||||
EvidenceCollection result = instance.getEvidence();
|
||||
assertTrue(true); //this is just a getter setter pair.
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getEvidenceUsed method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetEvidenceUsed() {
|
||||
Dependency instance = new Dependency();
|
||||
String expResult = "used";
|
||||
|
||||
instance.getProductEvidence().addEvidence("used", "used", "used", Evidence.Confidence.HIGH);
|
||||
instance.getProductEvidence().addEvidence("not", "not", "not", Evidence.Confidence.MEDIUM);
|
||||
for (Evidence e : instance.getProductEvidence().iterator(Evidence.Confidence.HIGH)) {
|
||||
String use = e.getValue();
|
||||
}
|
||||
|
||||
EvidenceCollection result = instance.getEvidenceUsed();
|
||||
|
||||
assertEquals(1, result.size());
|
||||
assertTrue(result.containsUsedString(expResult));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getVendorEvidence method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetVendorEvidence() {
|
||||
Dependency instance = new Dependency();
|
||||
EvidenceCollection expResult = null;
|
||||
EvidenceCollection result = instance.getVendorEvidence();
|
||||
assertTrue(true); //this is just a getter setter pair.
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getProductEvidence method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetProductEvidence() {
|
||||
Dependency instance = new Dependency();
|
||||
EvidenceCollection expResult = null;
|
||||
EvidenceCollection result = instance.getProductEvidence();
|
||||
assertTrue(true); //this is just a getter setter pair.
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getVersionEvidence method, of class Dependency.
|
||||
*/
|
||||
@Test
|
||||
public void testGetVersionEvidence() {
|
||||
Dependency instance = new Dependency();
|
||||
EvidenceCollection expResult = null;
|
||||
EvidenceCollection result = instance.getVersionEvidence();
|
||||
assertTrue(true); //this is just a getter setter pair.
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.reporting;
|
||||
|
||||
import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class ReportGeneratorTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of generateReport method, of class ReportGenerator.
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testGenerateReport() throws Exception {
|
||||
String templateName = "HtmlReport";
|
||||
// File f = new File("target/test-reports");
|
||||
// if (!f.exists()) {
|
||||
// f.mkdir();
|
||||
// }
|
||||
// String writeTo = "target/test-reports/Report.html";
|
||||
// Map<String, Object> properties = new HashMap<String, Object>();
|
||||
// Dependency d = new Dependency();
|
||||
// d.setFileName("FileName.jar");
|
||||
// d.setActualFilePath("lib/FileName.jar");
|
||||
// d.addCPEentry("cpe://a:/some:cpe:1.0");
|
||||
//
|
||||
// List<Dependency> dependencies = new ArrayList<Dependency>();
|
||||
// d.getProductEvidence().addEvidence("jar","filename","<test>test", Confidence.HIGH);
|
||||
// d.getProductEvidence().addEvidence("manifest","vendor","<test>test", Confidence.HIGH);
|
||||
//
|
||||
// for (Evidence e : d.getProductEvidence().iterator(Confidence.HIGH)) {
|
||||
// String t = e.getValue();
|
||||
// }
|
||||
// dependencies.add(d);
|
||||
//
|
||||
// Dependency d2 = new Dependency();
|
||||
// d2.setFileName("Another.jar");
|
||||
// d2.setActualFilePath("lib/Another.jar");
|
||||
// d2.addCPEentry("cpe://a:/another:cpe:1.0");
|
||||
// d2.addCPEentry("cpe://a:/another:cpe:1.1");
|
||||
// d2.addCPEentry("cpe://a:/another:cpe:1.2");
|
||||
// d2.getProductEvidence().addEvidence("jar","filename","another.jar", Confidence.HIGH);
|
||||
// d2.getProductEvidence().addEvidence("manifest","vendor","Company A", Confidence.MEDIUM);
|
||||
//
|
||||
// for (Evidence e : d2.getProductEvidence().iterator(Confidence.HIGH)) {
|
||||
// String t = e.getValue();
|
||||
// }
|
||||
//
|
||||
// dependencies.add(d2);
|
||||
//
|
||||
// Dependency d3 = new Dependency();
|
||||
// d3.setFileName("Third.jar");
|
||||
// d3.setActualFilePath("lib/Third.jar");
|
||||
// d3.getProductEvidence().addEvidence("jar","filename","third.jar", Confidence.HIGH);
|
||||
//
|
||||
// for (Evidence e : d3.getProductEvidence().iterator(Confidence.HIGH)) {
|
||||
// String t = e.getValue();
|
||||
// }
|
||||
//
|
||||
// dependencies.add(d3);
|
||||
//
|
||||
// properties.put("dependencies",dependencies);
|
||||
//
|
||||
// ReportGenerator instance = new ReportGenerator();
|
||||
// instance.generateReport(templateName, writeTo, properties);
|
||||
//TODO add an assertion here...
|
||||
//assertTrue("need to add a real check here", false);
|
||||
}
|
||||
}
|
||||
147
src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java
Normal file
147
src/test/java/org/owasp/dependencycheck/utils/ChecksumTest.java
Normal file
@@ -0,0 +1,147 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.utils;
|
||||
|
||||
import org.owasp.dependencycheck.utils.Checksum;
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class ChecksumTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() throws Exception {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() throws Exception {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getChecksum method, of class Checksum.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testGetChecksum() throws Exception {
|
||||
String algorithm = "MD5";
|
||||
File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath());
|
||||
byte[] expResult = {-16, -111, 92, 95, 70, -72, -49, -94, -125, -27, -83, 103, -96, -101, 55, -109};
|
||||
byte[] result = Checksum.getChecksum(algorithm, file);
|
||||
boolean arraysAreEqual = true;
|
||||
if (expResult.length == result.length) {
|
||||
for (int i = 0; arraysAreEqual && i < result.length; i++) {
|
||||
arraysAreEqual = result[i] == expResult[i];
|
||||
}
|
||||
} else {
|
||||
Assert.fail("Checksum results do not match expected results.");
|
||||
}
|
||||
Assert.assertTrue(arraysAreEqual);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getChecksum method, of class Checksum. This checks that an
|
||||
* exception is thrown when an invalid path is specified.
|
||||
*
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testGetChecksum_FileNotFound() throws Exception {
|
||||
String algorithm = "MD5";
|
||||
File file = new File("not a valid file");
|
||||
boolean exceptionThrown = false;
|
||||
try {
|
||||
byte[] result = Checksum.getChecksum(algorithm, file);
|
||||
} catch (IOException ex) {
|
||||
exceptionThrown = true;
|
||||
}
|
||||
Assert.assertTrue(exceptionThrown);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getChecksum method, of class Checksum. This checks that an
|
||||
* exception is thrown when an invalid algorithm is specified.
|
||||
*
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testGetChecksum_NoSuchAlgorithm() throws Exception {
|
||||
String algorithm = "some unknown algorithm";
|
||||
File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath());
|
||||
boolean exceptionThrown = false;
|
||||
try {
|
||||
byte[] result = Checksum.getChecksum(algorithm, file);
|
||||
} catch (NoSuchAlgorithmException ex) {
|
||||
exceptionThrown = true;
|
||||
}
|
||||
Assert.assertTrue(exceptionThrown);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getMD5Checksum method, of class Checksum.
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testGetMD5Checksum() throws Exception {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath());
|
||||
String expResult = "F0915C5F46B8CFA283E5AD67A09B3793";
|
||||
String result = Checksum.getMD5Checksum(file);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getSHA1Checksum method, of class Checksum.
|
||||
* @throws Exception is thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testGetSHA1Checksum() throws Exception {
|
||||
File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath());
|
||||
String expResult = "B8A9FF28B21BCB1D0B50E24A5243D8B51766851A";
|
||||
String result = Checksum.getSHA1Checksum(file);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getHex method, of class Checksum.
|
||||
*/
|
||||
@Test
|
||||
public void testGetHex() {
|
||||
byte[] raw = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
|
||||
String expResult = "000102030405060708090A0B0C0D0E0F10";
|
||||
String result = Checksum.getHex(raw);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
}
|
||||
262
src/test/java/org/owasp/dependencycheck/utils/CliParserTest.java
Normal file
262
src/test/java/org/owasp/dependencycheck/utils/CliParserTest.java
Normal file
@@ -0,0 +1,262 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.utils;
|
||||
|
||||
import org.owasp.dependencycheck.utils.CliParser;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileNotFoundException;
|
||||
import java.io.IOException;
|
||||
import java.io.PrintStream;
|
||||
import org.apache.commons.cli.ParseException;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class CliParserTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() throws Exception {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() throws Exception {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse() throws Exception {
|
||||
|
||||
String[] args = {};
|
||||
PrintStream out = System.out;
|
||||
|
||||
ByteArrayOutputStream baos = new ByteArrayOutputStream();
|
||||
System.setOut(new PrintStream(baos));
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
instance.parse(args);
|
||||
|
||||
Assert.assertFalse(instance.isGetVersion());
|
||||
Assert.assertFalse(instance.isGetHelp());
|
||||
Assert.assertFalse(instance.isRunScan());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method with help arg, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_help() throws Exception {
|
||||
|
||||
String[] args = {"-help"};
|
||||
PrintStream out = System.out;
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
instance.parse(args);
|
||||
|
||||
Assert.assertFalse(instance.isGetVersion());
|
||||
Assert.assertTrue(instance.isGetHelp());
|
||||
Assert.assertFalse(instance.isRunScan());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method with version arg, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_version() throws Exception {
|
||||
|
||||
String[] args = {"-version"};
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
instance.parse(args);
|
||||
Assert.assertTrue(instance.isGetVersion());
|
||||
Assert.assertFalse(instance.isGetHelp());
|
||||
Assert.assertFalse(instance.isRunScan());
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method with jar and cpe args, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_unknown() throws Exception {
|
||||
|
||||
String[] args = {"-unknown"};
|
||||
|
||||
PrintStream out = System.out;
|
||||
PrintStream err = System.err;
|
||||
ByteArrayOutputStream baos_out = new ByteArrayOutputStream();
|
||||
ByteArrayOutputStream baos_err = new ByteArrayOutputStream();
|
||||
System.setOut(new PrintStream(baos_out));
|
||||
System.setErr(new PrintStream(baos_err));
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
|
||||
try {
|
||||
instance.parse(args);
|
||||
} catch (ParseException ex) {
|
||||
Assert.assertTrue(ex.getMessage().contains("Unrecognized option"));
|
||||
}
|
||||
Assert.assertFalse(instance.isGetVersion());
|
||||
Assert.assertFalse(instance.isGetHelp());
|
||||
Assert.assertFalse(instance.isRunScan());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method with scan arg, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_scan() throws Exception {
|
||||
|
||||
String[] args = {"-scan"};
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
|
||||
try {
|
||||
instance.parse(args);
|
||||
} catch (ParseException ex) {
|
||||
Assert.assertTrue(ex.getMessage().contains("Missing argument"));
|
||||
}
|
||||
|
||||
Assert.assertFalse(instance.isGetVersion());
|
||||
Assert.assertFalse(instance.isGetHelp());
|
||||
Assert.assertFalse(instance.isRunScan());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method with jar arg, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_scan_unknownFile() throws Exception {
|
||||
|
||||
String[] args = {"-scan", "jar.that.does.not.exist", "-app", "test"};
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
try {
|
||||
instance.parse(args);
|
||||
} catch (FileNotFoundException ex) {
|
||||
Assert.assertTrue(ex.getMessage().contains("Invalid file argument"));
|
||||
}
|
||||
|
||||
Assert.assertFalse(instance.isGetVersion());
|
||||
Assert.assertFalse(instance.isGetHelp());
|
||||
Assert.assertFalse(instance.isRunScan());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of parse method with jar arg, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_scan_withFileExists() throws Exception {
|
||||
File path = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath());
|
||||
String[] args = {"-scan", path.getCanonicalPath(), "-out", "./", "-app", "test"};
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
instance.parse(args);
|
||||
|
||||
Assert.assertEquals(path.getCanonicalPath(), instance.getScanFiles()[0]);
|
||||
|
||||
Assert.assertFalse(instance.isGetVersion());
|
||||
Assert.assertFalse(instance.isGetHelp());
|
||||
Assert.assertTrue(instance.isRunScan());
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of printVersionInfo, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_printVersionInfo() throws Exception {
|
||||
|
||||
PrintStream out = System.out;
|
||||
ByteArrayOutputStream baos = new ByteArrayOutputStream();
|
||||
System.setOut(new PrintStream(baos));
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
instance.printVersionInfo();
|
||||
try {
|
||||
baos.flush();
|
||||
String text = (new String(baos.toByteArray())).toLowerCase();
|
||||
String[] lines = text.split(System.getProperty("line.separator"));
|
||||
Assert.assertEquals(1, lines.length);
|
||||
Assert.assertTrue(text.contains("version"));
|
||||
Assert.assertTrue(!text.contains("unknown"));
|
||||
} catch (IOException ex) {
|
||||
System.setOut(out);
|
||||
Assert.fail("CliParser.printVersionInfo did not write anything to system.out.");
|
||||
} finally {
|
||||
System.setOut(out);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of printHelp, of class CliParser.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testParse_printHelp() throws Exception {
|
||||
|
||||
PrintStream out = System.out;
|
||||
ByteArrayOutputStream baos = new ByteArrayOutputStream();
|
||||
System.setOut(new PrintStream(baos));
|
||||
|
||||
CliParser instance = new CliParser();
|
||||
String[] args = {"-h"};
|
||||
instance.parse(args);
|
||||
instance.printHelp();
|
||||
args[0] = "-ah";
|
||||
instance.parse(args);
|
||||
instance.printHelp();
|
||||
try {
|
||||
baos.flush();
|
||||
String text = (new String(baos.toByteArray()));
|
||||
String[] lines = text.split(System.getProperty("line.separator"));
|
||||
Assert.assertTrue(lines[0].startsWith("usage: "));
|
||||
Assert.assertTrue((lines.length > 2));
|
||||
} catch (IOException ex) {
|
||||
System.setOut(out);
|
||||
Assert.fail("CliParser.printVersionInfo did not write anything to system.out.");
|
||||
} finally {
|
||||
System.setOut(out);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.utils;
|
||||
|
||||
import org.owasp.dependencycheck.utils.Settings;
|
||||
import org.owasp.dependencycheck.utils.Downloader;
|
||||
import java.net.URL;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class DownloaderIntegrationTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of fetchFile method, of class Downloader.
|
||||
* @throws Exception thrown when an exception occurs.
|
||||
*/
|
||||
@Test
|
||||
public void testFetchFile() throws Exception {
|
||||
|
||||
// Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, "1000");
|
||||
|
||||
// Settings.setString(Settings.KEYS.PROXY_PORT, "8080");
|
||||
// Settings.setString(Settings.KEYS.PROXY_URL, "127.0.0.1");
|
||||
|
||||
URL url = new URL(Settings.getString(Settings.KEYS.CPE_URL));
|
||||
String outputPath = "target\\downloaded_cpe.xml";
|
||||
Downloader.fetchFile(url, outputPath, true);
|
||||
|
||||
url = new URL("http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2010.xml");
|
||||
outputPath = "target\\downloaded_cve.xml";
|
||||
Downloader.fetchFile(url, outputPath, false);
|
||||
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGetLastModified() throws Exception {
|
||||
URL url = new URL("http://nvd.nist.gov/download/nvdcve-2012.xml");
|
||||
long timestamp = Downloader.getLastModified(url);
|
||||
assertTrue("timestamp equal to zero?", timestamp>0);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.utils;
|
||||
|
||||
import org.owasp.dependencycheck.utils.Filter;
|
||||
import java.util.List;
|
||||
import java.util.ArrayList;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class FilterTest {
|
||||
|
||||
public FilterTest() {
|
||||
}
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of passes method, of class Filter.
|
||||
*/
|
||||
@Test
|
||||
public void testPasses() {
|
||||
String keep = "keep";
|
||||
String fail = "fail";
|
||||
|
||||
assertTrue("String contained keep - but passes returned false.", TEST_FILTER.passes(keep));
|
||||
assertFalse("String contained fail - but passes returned true.", TEST_FILTER.passes(fail));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of filter method, of class Filter.
|
||||
*/
|
||||
@Test
|
||||
public void testFilter_Iterable() {
|
||||
List<String> testData = new ArrayList<String>();
|
||||
testData.add("keep");
|
||||
testData.add("remove");
|
||||
testData.add("keep");
|
||||
|
||||
List<String> expResults = new ArrayList<String>();
|
||||
expResults.add("keep");
|
||||
expResults.add("keep");
|
||||
|
||||
List<String> actResults = new ArrayList<String>();
|
||||
for (String s : TEST_FILTER.filter(testData)) {
|
||||
actResults.add(s);
|
||||
}
|
||||
assertArrayEquals(expResults.toArray(), actResults.toArray());
|
||||
}
|
||||
private static final Filter<String> TEST_FILTER =
|
||||
new Filter<String>() {
|
||||
|
||||
public boolean passes(String str) {
|
||||
return str.contains("keep");
|
||||
}
|
||||
};
|
||||
}
|
||||
151
src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java
Normal file
151
src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java
Normal file
@@ -0,0 +1,151 @@
|
||||
/*
|
||||
* This file is part of DependencyCheck.
|
||||
*
|
||||
* DependencyCheck is free software: you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the Free
|
||||
* Software Foundation, either version 3 of the License, or (at your option) any
|
||||
* later version.
|
||||
*
|
||||
* DependencyCheck is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
* details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License along with
|
||||
* DependencyCheck. If not, see http://www.gnu.org/licenses/.
|
||||
*
|
||||
* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
package org.owasp.dependencycheck.utils;
|
||||
|
||||
import org.owasp.dependencycheck.utils.InvalidSettingException;
|
||||
import org.owasp.dependencycheck.utils.Settings;
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.net.URISyntaxException;
|
||||
import org.junit.After;
|
||||
import org.junit.AfterClass;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Before;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Jeremy Long (jeremy.long@gmail.com)
|
||||
*/
|
||||
public class SettingsTest {
|
||||
|
||||
@BeforeClass
|
||||
public static void setUpClass() throws Exception {
|
||||
}
|
||||
|
||||
@AfterClass
|
||||
public static void tearDownClass() throws Exception {
|
||||
}
|
||||
|
||||
@Before
|
||||
public void setUp() throws Exception {
|
||||
}
|
||||
|
||||
@After
|
||||
public void tearDown() throws Exception {
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getString method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testGetString() {
|
||||
String key = Settings.KEYS.CPE_INDEX;
|
||||
String expResult = "target/data/cpe";
|
||||
String result = Settings.getString(key);
|
||||
Assert.assertTrue(result.endsWith(expResult));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of mergeProperties method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testMergeProperties_String() throws IOException, URISyntaxException {
|
||||
String key = Settings.KEYS.PROXY_PORT;
|
||||
String expResult = Settings.getString(key);
|
||||
File f = new File(this.getClass().getClassLoader().getResource("test.properties").toURI());
|
||||
//InputStream in = this.getClass().getClassLoader().getResourceAsStream("test.properties");
|
||||
Settings.mergeProperties(f.getAbsolutePath());
|
||||
String result = Settings.getString(key);
|
||||
Assert.assertTrue("setting didn't change?", (expResult == null && result != null) || !expResult.equals(result));
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of setString method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testSetString() {
|
||||
String key = "newProperty";
|
||||
String value = "someValue";
|
||||
Settings.setString(key, value);
|
||||
String expResults = Settings.getString(key);
|
||||
Assert.assertEquals(expResults, value);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getString method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testGetString_String_String() {
|
||||
String key = "key That Doesn't Exist";
|
||||
String defaultValue = "blue bunny";
|
||||
String expResult = "blue bunny";
|
||||
String result = Settings.getString(key);
|
||||
Assert.assertTrue(result == null);
|
||||
result = Settings.getString(key, defaultValue);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getString method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testGetString_String() {
|
||||
String key = Settings.KEYS.CONNECTION_TIMEOUT;
|
||||
String result = Settings.getString(key);
|
||||
Assert.assertTrue(result == null);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getInt method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testGetInt() throws InvalidSettingException {
|
||||
String key = "SomeNumber";
|
||||
int expResult = 85;
|
||||
Settings.setString(key, "85");
|
||||
int result = Settings.getInt(key);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getLong method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testGetLong() throws InvalidSettingException {
|
||||
String key = "SomeNumber";
|
||||
long expResult = 300L;
|
||||
Settings.setString(key, "300");
|
||||
long result = Settings.getLong(key);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test of getBoolean method, of class Settings.
|
||||
*/
|
||||
@Test
|
||||
public void testGetBoolean() throws InvalidSettingException {
|
||||
String key = "SomeBoolean";
|
||||
Settings.setString(key, "false");
|
||||
boolean expResult = false;
|
||||
boolean result = Settings.getBoolean(key);
|
||||
Assert.assertEquals(expResult, result);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user