View Javadoc
1   /*
2    * This file is part of dependency-check-core.
3    *
4    * Licensed under the Apache License, Version 2.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    *
8    *     http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   *
16   * Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved.
17   */
18  package org.owasp.dependencycheck.analyzer;
19  
20  import org.junit.After;
21  import org.junit.Before;
22  import org.junit.Test;
23  import org.owasp.dependencycheck.BaseTest;
24  import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
25  import org.owasp.dependencycheck.dependency.Dependency;
26  import org.owasp.dependencycheck.dependency.Evidence;
27  
28  import java.io.File;
29  
30  import static org.junit.Assert.assertEquals;
31  import static org.junit.Assert.assertTrue;
32  
33  /**
34   * Unit tests for PythonDistributionAnalyzer.
35   *
36   * @author Dale Visser
37   */
38  public class PythonDistributionAnalyzerTest extends BaseTest {
39  
40      /**
41       * The analyzer to test.
42       */
43      private PythonDistributionAnalyzer analyzer;
44  
45      /**
46       * Correctly setup the analyzer for testing.
47       *
48       * @throws Exception thrown if there is a problem
49       */
50      @Before
51      public void setUp() throws Exception {
52          analyzer = new PythonDistributionAnalyzer();
53          analyzer.setFilesMatched(true);
54          analyzer.initialize();
55      }
56  
57      /**
58       * Cleanup the analyzer's temp files, etc.
59       *
60       * @throws Exception thrown if there is a problem
61       */
62      @After
63      public void tearDown() throws Exception {
64          analyzer.close();
65          analyzer = null;
66      }
67  
68      /**
69       * Test of getName method, of class PythonDistributionAnalyzer.
70       */
71      @Test
72      public void testGetName() {
73          assertEquals("Analyzer name wrong.", "Python Distribution Analyzer",
74                  analyzer.getName());
75      }
76  
77      /**
78       * Test of supportsExtension method, of class PythonDistributionAnalyzer.
79       */
80      @Test
81      public void testSupportsFiles() {
82          assertTrue("Should support \"whl\" extension.",
83                  analyzer.accept(new File("test.whl")));
84          assertTrue("Should support \"egg\" extension.",
85                  analyzer.accept(new File("test.egg")));
86          assertTrue("Should support \"zip\" extension.",
87                  analyzer.accept(new File("test.zip")));
88          assertTrue("Should support \"METADATA\" extension.",
89                  analyzer.accept(new File("METADATA")));
90          assertTrue("Should support \"PKG-INFO\" extension.",
91                  analyzer.accept(new File("PKG-INFO")));
92      }
93  
94      /**
95       * Test of inspect method, of class PythonDistributionAnalyzer.
96       *
97       * @throws AnalysisException is thrown when an exception occurs.
98       */
99      @Test
100     public void testAnalyzeWheel() throws AnalysisException {
101         djangoAssertions(new Dependency(BaseTest.getResourceAsFile(this,
102                 "python/Django-1.7.2-py2.py3-none-any.whl")));
103     }
104 
105     /**
106      * Test of inspect method, of class PythonDistributionAnalyzer.
107      *
108      * @throws AnalysisException is thrown when an exception occurs.
109      */
110     @Test
111     public void testAnalyzeSitePackage() throws AnalysisException {
112         final Dependency result = new Dependency(BaseTest.getResourceAsFile(
113                 this, "python/site-packages/Django-1.7.2.dist-info/METADATA"));
114         djangoAssertions(result);
115         assertEquals("Django-1.7.2.dist-info/METADATA", result.getDisplayFileName());
116     }
117 
118     private void djangoAssertions(final Dependency result)
119             throws AnalysisException {
120         boolean found = false;
121         analyzer.analyze(result, null);
122         assertTrue("Expected vendor evidence to contain \"djangoproject\".",
123                 result.getVendorEvidence().toString().contains("djangoproject"));
124         for (final Evidence e : result.getVersionEvidence()) {
125             if ("Version".equals(e.getName()) && "1.7.2".equals(e.getValue())) {
126                 found = true;
127                 break;
128             }
129         }
130         assertTrue("Version 1.7.2 not found in Django dependency.", found);
131     }
132 
133     @Test
134     public void testAnalyzeEggInfoFolder() throws AnalysisException {
135         eggtestAssertions(this, "python/site-packages/EggTest.egg-info/PKG-INFO");
136     }
137 
138     @Test
139     public void testAnalyzeEggArchive() throws AnalysisException {
140         eggtestAssertions(this, "python/dist/EggTest-0.0.1-py2.7.egg");
141     }
142 
143     @Test
144     public void testAnalyzeEggArchiveNamedZip() throws AnalysisException {
145         eggtestAssertions(this, "python/dist/EggTest-0.0.1-py2.7.zip");
146     }
147 
148     @Test
149     public void testAnalyzeEggFolder() throws AnalysisException {
150         eggtestAssertions(this, "python/site-packages/EggTest-0.0.1-py2.7.egg/EGG-INFO/PKG-INFO");
151     }
152 
153     public void eggtestAssertions(Object context, final String resource) throws AnalysisException {
154         boolean found = false;
155         final Dependency result = new Dependency(BaseTest.getResourceAsFile(
156                 context, resource));
157         analyzer.analyze(result, null);
158         assertTrue("Expected vendor evidence to contain \"example\".", result
159                 .getVendorEvidence().toString().contains("example"));
160         for (final Evidence e : result.getVersionEvidence()) {
161             if ("0.0.1".equals(e.getValue())) {
162                 found = true;
163                 break;
164             }
165         }
166         assertTrue("Version 0.0.1 not found in EggTest dependency.", found);
167     }
168 }