/*

  * This file is part of dependency-check-core.

  *

  * Licensed under the Apache License, Version 2.0 (the "License");

  * you may not use this file except in compliance with the License.

  * You may obtain a copy of the License at

  *

  *     http://www.apache.org/licenses/LICENSE-2.0

  *

  * Unless required by applicable law or agreed to in writing, software

  * distributed under the License is distributed on an "AS IS" BASIS,

  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

  * See the License for the specific language governing permissions and

  * limitations under the License.

  *

  * Copyright (c) 2014 Jeremy Long. All Rights Reserved.

  */

 package org.owasp.dependencycheck.analyzer;

 import org.apache.commons.io.FileUtils;

 import org.owasp.dependencycheck.Engine;

 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;

 import org.owasp.dependencycheck.data.nexus.MavenArtifact;

 import org.owasp.dependencycheck.data.nexus.NexusSearch;

 import org.owasp.dependencycheck.dependency.Confidence;

 import org.owasp.dependencycheck.dependency.Dependency;

 import org.owasp.dependencycheck.dependency.Evidence;

 import org.owasp.dependencycheck.xml.pom.PomUtils;

 import org.slf4j.Logger;

 import org.slf4j.LoggerFactory;

 import java.io.File;

 import java.io.FileFilter;

 import java.io.FileNotFoundException;

 import java.io.IOException;

 import java.net.MalformedURLException;

 import java.net.URL;

 import org.owasp.dependencycheck.exception.InitializationException;

 import org.owasp.dependencycheck.utils.DownloadFailedException;

 import org.owasp.dependencycheck.utils.Downloader;

 import org.owasp.dependencycheck.utils.FileFilterBuilder;

 import org.owasp.dependencycheck.utils.InvalidSettingException;

 import org.owasp.dependencycheck.utils.Settings;

 /**

  * Analyzer which will attempt to locate a dependency on a Nexus service by

  * SHA-1 digest of the dependency.

  *

  * There are two settings which govern this behavior:

  *

  * <ul>

  * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED}

  * determines whether this analyzer is even enabled. This can be overridden by

  * setting the system property.</li>

  * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL}

  * the URL to a Nexus service to search by SHA-1. There is an expected

  * <code>%s</code> in this where the SHA-1 will get entered.</li>

  * </ul>

  *

  * @author colezlaw

  */

 public class NexusAnalyzer extends AbstractFileTypeAnalyzer {

     /**

      * The default URL - this will be used by the CentralAnalyzer to determine

      * whether to enable this.

      */

     public static final String DEFAULT_URL = "https://repository.sonatype.org/service/local/";

     /**

      * The logger.

      */

     private static final Logger LOGGER = LoggerFactory.getLogger(NexusAnalyzer.class);

     /**

      * The name of the analyzer.

      */

     private static final String ANALYZER_NAME = "Nexus Analyzer";

     /**

      * The phase in which the analyzer runs.

      */

     private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;

     /**

      * The types of files on which this will work.

      */

     private static final String SUPPORTED_EXTENSIONS = "jar";

     /**

      * Whether or not the Nexus analyzer should use a proxy if configured.

      */

     private boolean useProxy;

     /**

      * The Nexus Search to be set up for this analyzer.

      */

     private NexusSearch searcher;

     /**

      * Field indicating if the analyzer is enabled.

      */

     private final boolean enabled = checkEnabled();

     /**

      * Determines if this analyzer is enabled

      *

      * @return <code>true</code> if the analyzer is enabled; otherwise

      * <code>false</code>

      */

     private boolean checkEnabled() {

         /* Enable this analyzer ONLY if the Nexus URL has been set to something

          other than the default one (if it's the default one, we'll use the

          central one) and it's enabled by the user.

          */

         boolean retval = false;

         try {

             if (!DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL))

                     && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)) {

                 LOGGER.info("Enabling Nexus analyzer");

                 retval = true;

             } else {

                 LOGGER.debug("Nexus analyzer disabled, using Central instead");

             }

         } catch (InvalidSettingException ise) {

             LOGGER.warn("Invalid setting. Disabling Nexus analyzer");

         }

         return retval;

     }

     /**

      * Determine whether to enable this analyzer or not.

      *

      * @return whether the analyzer should be enabled

      */

     @Override

     public boolean isEnabled() {

         return enabled;

     }

     /**

      * Initializes the analyzer once before any analysis is performed.

      *

      * @throws InitializationException if there's an error during initialization

      */

     @Override

     public void initializeFileTypeAnalyzer() throws InitializationException {

         LOGGER.debug("Initializing Nexus Analyzer");

         LOGGER.debug("Nexus Analyzer enabled: {}", isEnabled());

         if (isEnabled()) {

             useProxy = useProxy();

             final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);

             LOGGER.debug("Nexus Analyzer URL: {}", searchUrl);

             try {

                 searcher = new NexusSearch(new URL(searchUrl), useProxy);

                 if (!searcher.preflightRequest()) {

                     setEnabled(false);

                     throw new InitializationException("There was an issue getting Nexus status. Disabling analyzer.");

                 }

             } catch (MalformedURLException mue) {

                 setEnabled(false);

                 throw new InitializationException("Malformed URL to Nexus: " + searchUrl, mue);

             }

         }

     }

     /**

      * Returns the analyzer's name.

      *

      * @return the name of the analyzer

      */

     @Override

     public String getName() {

         return ANALYZER_NAME;

     }

     /**

      * Returns the key used in the properties file to reference the analyzer's

      * enabled property.

      *

      * @return the analyzer's enabled property setting key

      */

     @Override

     protected String getAnalyzerEnabledSettingKey() {

         return Settings.KEYS.ANALYZER_NEXUS_ENABLED;

     }

     /**

      * Returns the analysis phase under which the analyzer runs.

      *

      * @return the phase under which this analyzer runs

      */

     @Override

     public AnalysisPhase getAnalysisPhase() {

         return ANALYSIS_PHASE;

     }

     /**

      * The file filter used to determine which files this analyzer supports.

      */

     private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(SUPPORTED_EXTENSIONS).build();

     /**

      * Returns the FileFilter

      *

      * @return the FileFilter

      */

     @Override

     protected FileFilter getFileFilter() {

         return FILTER;

     }

     /**

      * Performs the analysis.

      *

      * @param dependency the dependency to analyze

      * @param engine the engine

      * @throws AnalysisException when there's an exception during analysis

      */

     @Override

     public void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {

         if (!isEnabled()) {

             return;

         }

         try {

             final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());

             dependency.addAsEvidence("nexus", ma, Confidence.HIGH);

             boolean pomAnalyzed = false;

             LOGGER.debug("POM URL {}", ma.getPomUrl());

             for (Evidence e : dependency.getVendorEvidence()) {

                 if ("pom".equals(e.getSource())) {

                     pomAnalyzed = true;

                     break;

                 }

             }

             if (!pomAnalyzed && ma.getPomUrl() != null) {

                 File pomFile = null;

                 try {

                     final File baseDir = Settings.getTempDirectory();

                     pomFile = File.createTempFile("pom", ".xml", baseDir);

                     if (!pomFile.delete()) {

                         LOGGER.warn("Unable to fetch pom.xml for {} from Nexus repository; "

                                 + "this could result in undetected CPE/CVEs.", dependency.getFileName());

                         LOGGER.debug("Unable to delete temp file");

                     }

                     LOGGER.debug("Downloading {}", ma.getPomUrl());

                     Downloader.fetchFile(new URL(ma.getPomUrl()), pomFile);

                     PomUtils.analyzePOM(dependency, pomFile);

                 } catch (DownloadFailedException ex) {

                     LOGGER.warn("Unable to download pom.xml for {} from Nexus repository; "

                             + "this could result in undetected CPE/CVEs.", dependency.getFileName());

                 } finally {

                     if (pomFile != null && pomFile.exists() && !FileUtils.deleteQuietly(pomFile)) {

                         LOGGER.debug("Failed to delete temporary pom file {}", pomFile.toString());

                         pomFile.deleteOnExit();

                     }

                 }

             }

         } catch (IllegalArgumentException iae) {

             //dependency.addAnalysisException(new AnalysisException("Invalid SHA-1"));

             LOGGER.info("invalid sha-1 hash on {}", dependency.getFileName());

         } catch (FileNotFoundException fnfe) {

             //dependency.addAnalysisException(new AnalysisException("Artifact not found on repository"));

             LOGGER.debug("Artifact not found in repository '{}'", dependency.getFileName());

             LOGGER.debug(fnfe.getMessage(), fnfe);

         } catch (IOException ioe) {

             //dependency.addAnalysisException(new AnalysisException("Could not connect to repository", ioe));

             LOGGER.debug("Could not connect to nexus repository", ioe);

         }

     }

     /**

      * Determine if a proxy should be used.

      *

      * @return {@code true} if a proxy should be used

      */

     public static boolean useProxy() {

         try {

             return Settings.getString(Settings.KEYS.PROXY_SERVER) != null

                     && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY);

         } catch (InvalidSettingException ise) {

             LOGGER.warn("Failed to parse proxy settings.", ise);

             return false;

         }

     }

 }