View Javadoc
1   /*
2    * This file is part of dependency-check-core.
3    *
4    * Licensed under the Apache License, Version 2.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    *
8    *     http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   *
16   * Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved.
17   */
18  package org.owasp.dependencycheck.analyzer;
19  
20  import org.junit.After;
21  import org.junit.Before;
22  import org.junit.Test;
23  import org.owasp.dependencycheck.BaseTest;
24  import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
25  import org.owasp.dependencycheck.dependency.Dependency;
26  
27  import java.io.File;
28  
29  import static org.hamcrest.CoreMatchers.containsString;
30  import static org.hamcrest.CoreMatchers.is;
31  import static org.junit.Assert.*;
32  
33  /**
34   * Unit tests for {@link RubyGemspecAnalyzer}.
35   *
36   * @author Dale Visser
37   */
38  public class RubyGemspecAnalyzerTest extends BaseTest {
39  
40      /**
41       * The analyzer to test.
42       */
43      RubyGemspecAnalyzer analyzer;
44  
45      /**
46       * Correctly setup the analyzer for testing.
47       *
48       * @throws Exception thrown if there is a problem
49       */
50      @Before
51      public void setUp() throws Exception {
52          analyzer = new RubyGemspecAnalyzer();
53          analyzer.setFilesMatched(true);
54          analyzer.initialize();
55      }
56  
57      /**
58       * Cleanup the analyzer's temp files, etc.
59       *
60       * @throws Exception thrown if there is a problem
61       */
62      @After
63      public void tearDown() throws Exception {
64          analyzer.close();
65          analyzer = null;
66      }
67  
68      /**
69       * Test Ruby Gemspec name.
70       */
71      @Test
72      public void testGetName() {
73          assertThat(analyzer.getName(), is("Ruby Gemspec Analyzer"));
74      }
75  
76      /**
77       * Test Ruby Gemspec file support.
78       */
79      @Test
80      public void testSupportsFiles() {
81          assertThat(analyzer.accept(new File("test.gemspec")), is(true));
82  //        assertThat(analyzer.accept(new File("Rakefile")), is(true));
83      }
84  
85      /**
86       * Test Ruby Gemspec analysis.
87       *
88       * @throws AnalysisException is thrown when an exception occurs.
89       */
90      @Test
91      public void testAnalyzePackageJson() throws AnalysisException {
92          final Dependency result = new Dependency(BaseTest.getResourceAsFile(this,
93                  "ruby/vulnerable/gems/specifications/rest-client-1.7.2.gemspec"));
94          analyzer.analyze(result, null);
95          final String vendorString = result.getVendorEvidence().toString();
96          assertThat(vendorString, containsString("REST Client Team"));
97          assertThat(vendorString, containsString("rest-client_project"));
98          assertThat(vendorString, containsString("rest.client@librelist.com"));
99          assertThat(vendorString, containsString("https://github.com/rest-client/rest-client"));
100         assertThat(result.getProductEvidence().toString(), containsString("rest-client"));
101         assertThat(result.getVersionEvidence().toString(), containsString("1.7.2"));
102     }
103     
104     /**
105      * Test Rakefile analysis.
106      *
107      * @throws AnalysisException is thrown when an exception occurs.
108      */
109     //@Test  TODO: place holder to test Rakefile support
110     public void testAnalyzeRakefile() throws AnalysisException {
111         final Dependency result = new Dependency(BaseTest.getResourceAsFile(this,
112                 "ruby/vulnerable/gems/rails-4.1.15/vendor/bundle/ruby/2.2.0/gems/pg-0.18.4/Rakefile"));
113         analyzer.analyze(result, null);
114         //TODO add verification
115     }
116 }