From ff3be5ccf5cd8f87ef6cccd867211442310059c1 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 29 Sep 2012 04:56:50 -0400 Subject: [PATCH] more minor enhancements Former-commit-id: e5c136aebd3a2112b4d2ea591f2d31619735f8bc --- .../org/codesecure/dependencycheck/App.java | 3 +- .../codesecure/dependencycheck/Engine.java | 3 + .../analyzer/AnalysisException.java | 2 +- .../dependencycheck/analyzer/Analyzer.java | 5 +- .../dependencycheck/analyzer/JarAnalyzer.java | 12 +- .../dependencycheck/data/cpe/CPEAnalyzer.java | 2 +- .../dependency/Dependency.java | 51 +++ .../dependency/Identifier.java | 35 ++ src/main/resources/templates/HtmlReport.vsl | 54 ++- .../resources/templates/HtmlReport.vsl.bak | 327 ------------------ 10 files changed, 153 insertions(+), 341 deletions(-) delete mode 100644 src/main/resources/templates/HtmlReport.vsl.bak diff --git a/src/main/java/org/codesecure/dependencycheck/App.java b/src/main/java/org/codesecure/dependencycheck/App.java index 165be83be..cea9ad9e7 100644 --- a/src/main/java/org/codesecure/dependencycheck/App.java +++ b/src/main/java/org/codesecure/dependencycheck/App.java @@ -23,11 +23,9 @@ import java.io.FileNotFoundException; import java.io.IOException; import java.io.InputStream; import java.util.List; -import java.util.Properties; import java.util.logging.Level; import java.util.logging.LogManager; import java.util.logging.Logger; -import java.util.prefs.Preferences; import javax.xml.parsers.ParserConfigurationException; import org.apache.commons.cli.ParseException; import org.codesecure.dependencycheck.data.cpe.Index; @@ -63,6 +61,7 @@ import org.xml.sax.SAXException; public class App { private static final String LOG_PROPERTIES_FILE = "configuration/log.properties"; + /** * @param args the command line arguments */ diff --git a/src/main/java/org/codesecure/dependencycheck/Engine.java b/src/main/java/org/codesecure/dependencycheck/Engine.java index fb64dfd62..b621cef8d 100644 --- a/src/main/java/org/codesecure/dependencycheck/Engine.java +++ b/src/main/java/org/codesecure/dependencycheck/Engine.java @@ -29,6 +29,7 @@ import java.util.List; import java.util.Set; import java.util.logging.Level; import java.util.logging.Logger; +import org.codesecure.dependencycheck.analyzer.AnalysisException; import org.codesecure.dependencycheck.analyzer.AnalysisPhase; import org.codesecure.dependencycheck.analyzer.Analyzer; import org.codesecure.dependencycheck.analyzer.AnalyzerService; @@ -193,6 +194,8 @@ public class Engine { } else { a.analyze(d); } + } catch (AnalysisException ex) { + d.addAnalysisException(ex); } catch (IOException ex) { String msg = String.format("IOException occured while analyzing the file '%s'.", d.getActualFilePath()); diff --git a/src/main/java/org/codesecure/dependencycheck/analyzer/AnalysisException.java b/src/main/java/org/codesecure/dependencycheck/analyzer/AnalysisException.java index 896ece265..9beda68b3 100644 --- a/src/main/java/org/codesecure/dependencycheck/analyzer/AnalysisException.java +++ b/src/main/java/org/codesecure/dependencycheck/analyzer/AnalysisException.java @@ -23,7 +23,7 @@ package org.codesecure.dependencycheck.analyzer; * * @author Jeremy Long (jeremy.long@gmail.com) */ -public class AnalysisException extends RuntimeException { +public class AnalysisException extends Exception { private static final long serialVersionUID = 1L; diff --git a/src/main/java/org/codesecure/dependencycheck/analyzer/Analyzer.java b/src/main/java/org/codesecure/dependencycheck/analyzer/Analyzer.java index c0c6d2f4f..646c0d496 100644 --- a/src/main/java/org/codesecure/dependencycheck/analyzer/Analyzer.java +++ b/src/main/java/org/codesecure/dependencycheck/analyzer/Analyzer.java @@ -31,7 +31,10 @@ import java.util.Set; public interface Analyzer { /** - * Analyzes the given dependency. + * Analyzes the given dependency. The analysis could be anything from identifying + * an Idenifier for the dependency, to finding vulnerabilities, etc. Additionally, + * if the analyzer collects enough information to add a description for the dependency + * one should be added. * * @param dependency a dependency to analyze. * @throws AnalysisException is thrown if there is an error analyzing the dependency file diff --git a/src/main/java/org/codesecure/dependencycheck/analyzer/JarAnalyzer.java b/src/main/java/org/codesecure/dependencycheck/analyzer/JarAnalyzer.java index b9dc6e6e7..11061f1d9 100644 --- a/src/main/java/org/codesecure/dependencycheck/analyzer/JarAnalyzer.java +++ b/src/main/java/org/codesecure/dependencycheck/analyzer/JarAnalyzer.java @@ -354,6 +354,7 @@ public class JarAnalyzer extends AbstractAnalyzer { vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); } else if (key.equals(BUNDLE_DESCRIPTION)) { productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); + dependency.setDescription(value); } else if (key.equals(BUNDLE_NAME)) { productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); } else if (key.equals(BUNDLE_VENDOR)) { @@ -379,10 +380,13 @@ public class JarAnalyzer extends AbstractAnalyzer { productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); } else { + if (key.contains("description")) { + dependency.setDescription(value); + } productEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW); vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW); if (value.matches(".*\\d.*")) { - StringTokenizer tokenizer = new StringTokenizer(value," "); + StringTokenizer tokenizer = new StringTokenizer(value, " "); while (tokenizer.hasMoreElements()) { String s = tokenizer.nextToken(); if (s.matches("^[0-9.]+$")) { @@ -397,6 +401,12 @@ public class JarAnalyzer extends AbstractAnalyzer { } } + private void addDescription(Dependency d, String description) { + if (d.getDescription() == null) { + d.setDescription(description); + } + } + /** * The initialize method does nothing for this Analyzer */ diff --git a/src/main/java/org/codesecure/dependencycheck/data/cpe/CPEAnalyzer.java b/src/main/java/org/codesecure/dependencycheck/data/cpe/CPEAnalyzer.java index 7a9d8af63..888f8ea11 100644 --- a/src/main/java/org/codesecure/dependencycheck/data/cpe/CPEAnalyzer.java +++ b/src/main/java/org/codesecure/dependencycheck/data/cpe/CPEAnalyzer.java @@ -231,7 +231,7 @@ public class CPEAnalyzer implements org.codesecure.dependencycheck.analyzer.Anal sb.append(txt); for (Evidence e : ec.iterator(confidenceFilter)) { String value = e.getValue(); - + //hack to get around the fact that lucene does a realy good job of recognizing domains and not // splitting them. TODO - put together a better lucene analyzer specific to the domain. if (value.startsWith("http://")) { diff --git a/src/main/java/org/codesecure/dependencycheck/dependency/Dependency.java b/src/main/java/org/codesecure/dependencycheck/dependency/Dependency.java index 5f6384be2..82deb26c8 100644 --- a/src/main/java/org/codesecure/dependencycheck/dependency/Dependency.java +++ b/src/main/java/org/codesecure/dependencycheck/dependency/Dependency.java @@ -286,6 +286,57 @@ public class Dependency { public EvidenceCollection getVersionEvidence() { return this.versionEvidence; } + /** + * A list of exceptions that occured during analysis of this dependency. + */ + protected List analysisExceptions = new ArrayList(); + + /** + * Get the value of analysisExceptions + * + * @return the value of analysisExceptions + */ + public List getAnalysisExceptions() { + return analysisExceptions; + } + + /** + * Set the value of analysisExceptions + * + * @param analysisExceptions new value of analysisExceptions + */ + public void setAnalysisExceptions(List analysisExceptions) { + this.analysisExceptions = analysisExceptions; + } + /** + * Adds an exception to the analysis exceptions collection. + * @param ex an exception. + */ + public void addAnalysisException(Exception ex) { + this.analysisExceptions.add(ex); + } + /** + * The description of the JAR file. + */ + protected String description; + + /** + * Get the value of description + * + * @return the value of description + */ + public String getDescription() { + return description; + } + + /** + * Set the value of description + * + * @param description new value of description + */ + public void setDescription(String description) { + this.description = description; + } /** * Determines if the specified string was used when searching. diff --git a/src/main/java/org/codesecure/dependencycheck/dependency/Identifier.java b/src/main/java/org/codesecure/dependencycheck/dependency/Identifier.java index 8d2eb234e..a0550e9e5 100644 --- a/src/main/java/org/codesecure/dependencycheck/dependency/Identifier.java +++ b/src/main/java/org/codesecure/dependencycheck/dependency/Identifier.java @@ -37,6 +37,18 @@ public class Identifier { this.title = title; this.url = url; } + /** + * Constructs a new Identifier with the specified data. + * @param type the identifier type. + * @param value the identifier value. + * @param title the identifier title. + * @param url the identifier url. + * @param description the description of the identifier. + */ + Identifier(String type, String value, String title, String url, String description) { + this(type, value, title, url); + this.description = description; + } /** * The value of the identifeir */ @@ -125,4 +137,27 @@ public class Identifier { public void setType(String type) { this.type = type; } + /** + * A description of the identifier. + */ + protected String description; + + /** + * Get the value of description + * + * @return the value of description + */ + public String getDescription() { + return description; + } + + /** + * Set the value of description + * + * @param description new value of description + */ + public void setDescription(String description) { + this.description = description; + } + } diff --git a/src/main/resources/templates/HtmlReport.vsl b/src/main/resources/templates/HtmlReport.vsl index 2965fe4d6..2f8a63d6b 100644 --- a/src/main/resources/templates/HtmlReport.vsl +++ b/src/main/resources/templates/HtmlReport.vsl @@ -245,6 +245,9 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. .white { background-color: #ffffff; } + .red { + background-color: #DF0101; + } .left { text-align: left; } @@ -252,12 +255,22 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. margin-left:20px; } td, th { - padding:3px; - margin:3px; + padding:6px; + margin:0px; + } + table { + border: 0px; + } + table tr:nth-child(even) { + background-color: #eeeeee; } body { font: 13px "Droid Sans",Arial,"Helvetica Neue","Lucida Grande",sans-serif } + ul { + margin-top:3px; + margin-bottom:3px; + } @@ -276,14 +289,35 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. #set($cnt=0) #foreach($dependency in $dependencies)

$esc.html($dependency.FileName)

-
File Path: $esc.html($dependency.FilePath)
- MD5: $esc.html($dependency.Md5sum)
- SHA1: $esc.html($dependency.Sha1sum) +
+ #if ($dependency.description) +

Description: $esc.html($dependency.description)

+ #end +

File Path: $esc.html($dependency.FilePath)
+ MD5: $esc.html($dependency.Md5sum)
+ SHA1: $esc.html($dependency.Sha1sum)

+ + #if ( $dependency.analysisExceptions.size() != 0 ) + #set($cnt=$cnt+1) +

Analysis Exceptions

+
+
    + #foreach($ex in $dependency.analysisExceptions) +
  • $esc.html($ex.message)

    $esc.html($ex.stackTrace) + #if ( $ex.cause ) +
    Caused by: $esc.html($ex.cause.message) +

    $esc.html($ex.cause.stackTrace) + #end +
    • + #end +
+
+ #end #set($cnt=$cnt+1)

Evidence

- #set($cnt=$cnt+1) - #set($identfiers=$dependency.getIdentifiers()) - #set($cpeCount=0) - #foreach($id in $identifiers) - #if("cpe".equals($id.type) - #set($cpeCount=$cpeCount+1) - #end - #end -

Identifiers

- ##: $esc.html($cpevalue) -
- #if($cpeCount>1) - Several possible CPEs where identified. If one of the following are correct please update the configuration - to set the hash code for this file to the CPE entry below.

- #end - #if($dependency.getCPEs().size()==0) - None - #end - #if($cpeCount>0) -
    - #end - #foreach($id in $identifiers) - ##yes, we are HTML Encoding the href. this is okay. We can't URL encode as we have to trust the analyzer here... -
  • $enc.html($id.title) : $enc.html($id.value) - #if($id.description!=null) -
    $enc.html(id.description) - #end -
    • - #end - #if($cpeCount>0) -
- #end -
- #end -
-
- - -