/*
    * This file is part of dependency-check-core.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   *
   * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
   */
  package org.owasp.dependencycheck.analyzer;
  
  import java.io.BufferedInputStream;
  import java.io.File;
  import java.io.FileFilter;
  import java.io.FileInputStream;
  import java.io.FileNotFoundException;
  import java.io.FileOutputStream;
  import java.io.IOException;
  import java.util.Collections;
  import java.util.Enumeration;
  import java.util.List;
  import java.util.Set;
  
  import org.apache.commons.compress.archivers.ArchiveEntry;
  import org.apache.commons.compress.archivers.ArchiveInputStream;
  import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
  import org.apache.commons.compress.archivers.zip.ZipArchiveEntry;
  import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
  import org.apache.commons.compress.archivers.zip.ZipFile;
  import org.apache.commons.compress.compressors.CompressorInputStream;
  import org.apache.commons.compress.compressors.bzip2.BZip2CompressorInputStream;
  import org.apache.commons.compress.compressors.bzip2.BZip2Utils;
  import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream;
  import org.apache.commons.compress.compressors.gzip.GzipUtils;
  import org.apache.commons.compress.utils.IOUtils;
  
  import org.owasp.dependencycheck.Engine;
  import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
  import org.owasp.dependencycheck.analyzer.exception.ArchiveExtractionException;
  import org.owasp.dependencycheck.dependency.Dependency;
  import org.owasp.dependencycheck.exception.InitializationException;
  import org.owasp.dependencycheck.utils.FileFilterBuilder;
  import org.owasp.dependencycheck.utils.FileUtils;
  import org.owasp.dependencycheck.utils.Settings;
  
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  /**
   * <p>
   * An analyzer that extracts files from archives and ensures any supported files
   * contained within the archive are added to the dependency list.</p>
   *
   * @author Jeremy Long
   */
  public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
  
      /**
       * The logger.
       */
      private static final Logger LOGGER = LoggerFactory.getLogger(ArchiveAnalyzer.class);
      /**
       * The count of directories created during analysis. This is used for
       * creating temporary directories.
       */
      private static int dirCount = 0;
      /**
       * The parent directory for the individual directories per archive.
       */
      private File tempFileLocation = null;
      /**
       * The max scan depth that the analyzer will recursively extract nested
       * archives.
       */
      private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3);
      /**
       * Tracks the current scan/extraction depth for nested archives.
       */
      private int scanDepth = 0;
  
      //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
      /**
       * The name of the analyzer.
       */
      private static final String ANALYZER_NAME = "Archive Analyzer";
      /**
       * The phase that this analyzer is intended to run in.
       */
      private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
      /**
       * The set of things we can handle with Zip methods
      */
     private static final Set<String> ZIPPABLES = newHashSet("zip", "ear", "war", "jar", "sar", "apk", "nupkg");
     /**
      * The set of file extensions supported by this analyzer. Note for
      * developers, any additions to this list will need to be explicitly handled
      * in {@link #extractFiles(File, File, Engine)}.
      */
     private static final Set<String> EXTENSIONS = newHashSet("tar", "gz", "tgz", "bz2", "tbz2");
 
     /**
      * Detects files with extensions to remove from the engine's collection of
      * dependencies.
      */
     private static final FileFilter REMOVE_FROM_ANALYSIS = FileFilterBuilder.newInstance().addExtensions("zip", "tar", "gz", "tgz", "bz2", "tbz2")
             .build();
 
     static {
         final String additionalZipExt = Settings.getString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS);
         if (additionalZipExt != null) {
             final String[] ext = additionalZipExt.split("\\s*,\\s*");
             Collections.addAll(ZIPPABLES, ext);
         }
         EXTENSIONS.addAll(ZIPPABLES);
     }
 
     /**
      * The file filter used to filter supported files.
      */
     private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(EXTENSIONS).build();
 
     @Override
     protected FileFilter getFileFilter() {
         return FILTER;
     }
 
     /**
      * Detects files with .zip extension.
      */
     private static final FileFilter ZIP_FILTER = FileFilterBuilder.newInstance().addExtensions("zip").build();
 
     /**
      * Returns the name of the analyzer.
      *
      * @return the name of the analyzer.
      */
     @Override
     public String getName() {
         return ANALYZER_NAME;
     }
 
     /**
      * Returns the phase that the analyzer is intended to run in.
      *
      * @return the phase that the analyzer is intended to run in.
      */
     @Override
     public AnalysisPhase getAnalysisPhase() {
         return ANALYSIS_PHASE;
     }
     //</editor-fold>
 
     /**
      * Returns the key used in the properties file to reference the analyzer's
      * enabled property.
      *
      * @return the analyzer's enabled property setting key
      */
     @Override
     protected String getAnalyzerEnabledSettingKey() {
         return Settings.KEYS.ANALYZER_ARCHIVE_ENABLED;
     }
 
     /**
      * The initialize method does nothing for this Analyzer.
      *
      * @throws InitializationException is thrown if there is an exception
      * deleting or creating temporary files
      */
     @Override
     public void initializeFileTypeAnalyzer() throws InitializationException {
         try {
             final File baseDir = Settings.getTempDirectory();
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
             if (!tempFileLocation.delete()) {
                 setEnabled(false);
                 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
                 throw new InitializationException(msg);
             }
             if (!tempFileLocation.mkdirs()) {
                 setEnabled(false);
                 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
                 throw new InitializationException(msg);
             }
         } catch (IOException ex) {
             setEnabled(false);
             throw new InitializationException("Unable to create a temporary file", ex);
         }
     }
 
     /**
      * The close method deletes any temporary files and directories created
      * during analysis.
      *
      * @throws Exception thrown if there is an exception deleting temporary
      * files
      */
     @Override
     public void closeAnalyzer() throws Exception {
         if (tempFileLocation != null && tempFileLocation.exists()) {
             LOGGER.debug("Attempting to delete temporary files");
             final boolean success = FileUtils.delete(tempFileLocation);
             if (!success && tempFileLocation.exists()) {
                 final String[] l = tempFileLocation.list();
                 if (l != null && l.length > 0) {
                     LOGGER.warn("Failed to delete some temporary files, see the log for more details");
                 }
             }
         }
     }
 
     /**
      * Does not support parallel processing as it both modifies and iterates
      * over the engine's list of dependencies.
      *
      * @see #analyzeDependency(Dependency, Engine)
      * @see #findMoreDependencies(Engine, File)
      */
     @Override
     public boolean supportsParallelProcessing() {
         return false;
     }
 
     /**
      * Analyzes a given dependency. If the dependency is an archive, such as a
      * WAR or EAR, the contents are extracted, scanned, and added to the list of
      * dependencies within the engine.
      *
      * @param dependency the dependency to analyze
      * @param engine the engine scanning
      * @throws AnalysisException thrown if there is an analysis exception
      */
     @Override
     public void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
         final File f = new File(dependency.getActualFilePath());
         final File tmpDir = getNextTempDirectory();
         extractFiles(f, tmpDir, engine);
 
         //make a copy
         final List<Dependency> dependencySet = findMoreDependencies(engine, tmpDir);
 
         if (dependencySet != null && !dependencySet.isEmpty()) {
             for (Dependency d : dependencySet) {
                 if (d.getFilePath().startsWith(tmpDir.getAbsolutePath())) {
                     //fix the dependency's display name and path
                     final String displayPath = String.format("%s%s",
                             dependency.getFilePath(),
                             d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
                     final String displayName = String.format("%s: %s",
                             dependency.getFileName(),
                             d.getFileName());
                     d.setFilePath(displayPath);
                     d.setFileName(displayName);
                     d.setProjectReferences(dependency.getProjectReferences());
 
                     //TODO - can we get more evidence from the parent? EAR contains module name, etc.
                     //analyze the dependency (i.e. extract files) if it is a supported type.
                     if (this.accept(d.getActualFile()) && scanDepth < MAX_SCAN_DEPTH) {
                         scanDepth += 1;
                         analyze(d, engine);
                         scanDepth -= 1;
                     }
                 } else {
                     for (Dependency sub : dependencySet) {
                         if (sub.getFilePath().startsWith(tmpDir.getAbsolutePath())) {
                             final String displayPath = String.format("%s%s",
                                     dependency.getFilePath(),
                                     sub.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
                             final String displayName = String.format("%s: %s",
                                     dependency.getFileName(),
                                     sub.getFileName());
                             sub.setFilePath(displayPath);
                             sub.setFileName(displayName);
                         }
                     }
                 }
             }
         }
         if (REMOVE_FROM_ANALYSIS.accept(dependency.getActualFile())) {
             addDisguisedJarsToDependencies(dependency, engine);
             engine.getDependencies().remove(dependency);
         }
         Collections.sort(engine.getDependencies());
     }
 
     /**
      * If a zip file was identified as a possible JAR, this method will add the
      * zip to the list of dependencies.
      *
      * @param dependency the zip file
      * @param engine the engine
      * @throws AnalysisException thrown if there is an issue
      */
     private void addDisguisedJarsToDependencies(Dependency dependency, Engine engine) throws AnalysisException {
         if (ZIP_FILTER.accept(dependency.getActualFile()) && isZipFileActuallyJarFile(dependency)) {
             final File tdir = getNextTempDirectory();
             final String fileName = dependency.getFileName();
 
             LOGGER.info("The zip file '{}' appears to be a JAR file, making a copy and analyzing it as a JAR.", fileName);
             final File tmpLoc = new File(tdir, fileName.substring(0, fileName.length() - 3) + "jar");
             //store the archives sha1 and change it so that the engine doesn't think the zip and jar file are the same
             // and add it is a related dependency.
             final String archiveSha1 = dependency.getSha1sum();
             try {
                 dependency.setSha1sum("");
                 org.apache.commons.io.FileUtils.copyFile(dependency.getActualFile(), tmpLoc);
                 final List<Dependency> dependencySet = findMoreDependencies(engine, tmpLoc);
                 if (dependencySet != null && !dependencySet.isEmpty()) {
                     for (Dependency d : dependencySet) {
                         //fix the dependency's display name and path
                         if (d.getActualFile().equals(tmpLoc)) {
                             d.setFilePath(dependency.getFilePath());
                             d.setDisplayFileName(dependency.getFileName());
                         } else {
                             for (Dependency sub : d.getRelatedDependencies()) {
                                 if (sub.getActualFile().equals(tmpLoc)) {
                                     sub.setFilePath(dependency.getFilePath());
                                     sub.setDisplayFileName(dependency.getFileName());
                                 }
                             }
                         }
                     }
                 }
             } catch (IOException ex) {
                 LOGGER.debug("Unable to perform deep copy on '{}'", dependency.getActualFile().getPath(), ex);
             } finally {
                 dependency.setSha1sum(archiveSha1);
             }
         }
     }
 
     /**
      * Scan the given file/folder, and return any new dependencies found.
      *
      * @param engine used to scan
      * @param file target of scanning
      * @return any dependencies that weren't known to the engine before
      */
     private static List<Dependency> findMoreDependencies(Engine engine, File file) {
         final List<Dependency> added = engine.scan(file);
         return added;
     }
 
     /**
      * Retrieves the next temporary directory to extract an archive too.
      *
      * @return a directory
      * @throws AnalysisException thrown if unable to create temporary directory
      */
     private File getNextTempDirectory() throws AnalysisException {
         dirCount += 1;
         final File directory = new File(tempFileLocation, String.valueOf(dirCount));
         //getting an exception for some directories not being able to be created; might be because the directory already exists?
         if (directory.exists()) {
             return getNextTempDirectory();
         }
         if (!directory.mkdirs()) {
             final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath());
             throw new AnalysisException(msg);
         }
         return directory;
     }
 
     /**
      * Extracts the contents of an archive into the specified directory.
      *
      * @param archive an archive file such as a WAR or EAR
      * @param destination a directory to extract the contents to
      * @param engine the scanning engine
      * @throws AnalysisException thrown if the archive is not found
      */
     private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
         if (archive != null && destination != null) {
             String archiveExt = FileUtils.getFileExtension(archive.getName());
             if (archiveExt == null) {
                 return;
             }
             archiveExt = archiveExt.toLowerCase();
 
             final FileInputStream fis;
             try {
                 fis = new FileInputStream(archive);
             } catch (FileNotFoundException ex) {
                 LOGGER.debug("", ex);
                 throw new AnalysisException("Archive file was not found.", ex);
             }
             BufferedInputStream in = null;
             ZipArchiveInputStream zin = null;
             TarArchiveInputStream tin = null;
             GzipCompressorInputStream gin = null;
             BZip2CompressorInputStream bzin = null;
             try {
                 if (ZIPPABLES.contains(archiveExt)) {
                     in = new BufferedInputStream(fis);
                     ensureReadableJar(archiveExt, in);
                     zin = new ZipArchiveInputStream(in);
                     extractArchive(zin, destination, engine);
                 } else if ("tar".equals(archiveExt)) {
                     in = new BufferedInputStream(fis);
                     tin = new TarArchiveInputStream(in);
                     extractArchive(tin, destination, engine);
                 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) {
                     final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
                     final File f = new File(destination, uncompressedName);
                     if (engine.accept(f)) {
                         in = new BufferedInputStream(fis);
                         gin = new GzipCompressorInputStream(in);
                         decompressFile(gin, f);
                     }
                 } else if ("bz2".equals(archiveExt) || "tbz2".equals(archiveExt)) {
                     final String uncompressedName = BZip2Utils.getUncompressedFilename(archive.getName());
                     final File f = new File(destination, uncompressedName);
                     if (engine.accept(f)) {
                         in = new BufferedInputStream(fis);
                         bzin = new BZip2CompressorInputStream(in);
                         decompressFile(bzin, f);
                     }
                 }
             } catch (ArchiveExtractionException ex) {
                 LOGGER.warn("Exception extracting archive '{}'.", archive.getName());
                 LOGGER.debug("", ex);
             } catch (IOException ex) {
                 LOGGER.warn("Exception reading archive '{}'.", archive.getName());
                 LOGGER.debug("", ex);
             } finally {
                 //overly verbose and not needed... but keeping it anyway due to
                 //having issue with file handles being left open
                 FileUtils.close(fis);
                 FileUtils.close(in);
                 FileUtils.close(zin);
                 FileUtils.close(tin);
                 FileUtils.close(gin);
                 FileUtils.close(bzin);
             }
         }
     }
 
     /**
      * Checks if the file being scanned is a JAR that begins with '#!/bin' which
      * indicates it is a fully executable jar. If a fully executable JAR is
      * identified the input stream will be advanced to the start of the actual
      * JAR file ( skipping the script).
      *
      * @see
      * <a href="http://docs.spring.io/spring-boot/docs/1.3.0.BUILD-SNAPSHOT/reference/htmlsingle/#deployment-install">Installing
      * Spring Boot Applications</a>
      * @param archiveExt the file extension
      * @param in the input stream
      * @throws IOException thrown if there is an error reading the stream
      */
     private void ensureReadableJar(final String archiveExt, BufferedInputStream in) throws IOException {
         if ("jar".equals(archiveExt) && in.markSupported()) {
             in.mark(7);
             final byte[] b = new byte[7];
             final int read = in.read(b);
             if (read == 7
                     && b[0] == '#'
                     && b[1] == '!'
                     && b[2] == '/'
                     && b[3] == 'b'
                     && b[4] == 'i'
                     && b[5] == 'n'
                     && b[6] == '/') {
                 boolean stillLooking = true;
                 int chr, nxtChr;
                 while (stillLooking && (chr = in.read()) != -1) {
                     if (chr == '\n' || chr == '\r') {
                         in.mark(4);
                         if ((chr = in.read()) != -1) {
                             if (chr == 'P' && (chr = in.read()) != -1) {
                                 if (chr == 'K' && (chr = in.read()) != -1) {
                                     if ((chr == 3 || chr == 5 || chr == 7) && (nxtChr = in.read()) != -1) {
                                         if (nxtChr == chr + 1) {
                                             stillLooking = false;
                                             in.reset();
                                         }
                                     }
                                 }
                             }
                         }
                     }
                 }
             } else {
                 in.reset();
             }
         }
     }
 
     /**
      * Extracts files from an archive.
      *
      * @param input the archive to extract files from
      * @param destination the location to write the files too
      * @param engine the dependency-check engine
      * @throws ArchiveExtractionException thrown if there is an exception
      * extracting files from the archive
      */
     private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
         ArchiveEntry entry;
         try {
             while ((entry = input.getNextEntry()) != null) {
                 final File file = new File(destination, entry.getName());
                 if (entry.isDirectory()) {
                     if (!file.exists() && !file.mkdirs()) {
                         final String msg = String.format("Unable to create directory '%s'.", file.getAbsolutePath());
                         throw new AnalysisException(msg);
                     }
                 } else if (engine.accept(file)) {
                     extractAcceptedFile(input, file);
                 }
             }
         } catch (Throwable ex) {
             throw new ArchiveExtractionException(ex);
         } finally {
             FileUtils.close(input);
         }
     }
 
     /**
      * Extracts a file from an archive.
      *
      * @param input the archives input stream
      * @param file the file to extract
      * @throws AnalysisException thrown if there is an error
      */
     private static void extractAcceptedFile(ArchiveInputStream input, File file) throws AnalysisException {
         LOGGER.debug("Extracting '{}'", file.getPath());
         FileOutputStream fos = null;
         try {
             final File parent = file.getParentFile();
             if (!parent.isDirectory() && !parent.mkdirs()) {
                 final String msg = String.format("Unable to build directory '%s'.", parent.getAbsolutePath());
                 throw new AnalysisException(msg);
             }
             fos = new FileOutputStream(file);
             IOUtils.copy(input, fos);
         } catch (FileNotFoundException ex) {
             LOGGER.debug("", ex);
             final String msg = String.format("Unable to find file '%s'.", file.getName());
             throw new AnalysisException(msg, ex);
         } catch (IOException ex) {
             LOGGER.debug("", ex);
             final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
             throw new AnalysisException(msg, ex);
         } finally {
             FileUtils.close(fos);
         }
     }
 
     /**
      * Decompresses a file.
      *
      * @param inputStream the compressed file
      * @param outputFile the location to write the decompressed file
      * @throws ArchiveExtractionException thrown if there is an exception
      * decompressing the file
      */
     private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
         LOGGER.debug("Decompressing '{}'", outputFile.getPath());
         FileOutputStream out = null;
         try {
             out = new FileOutputStream(outputFile);
             IOUtils.copy(inputStream, out);
         } catch (FileNotFoundException ex) {
             LOGGER.debug("", ex);
             throw new ArchiveExtractionException(ex);
         } catch (IOException ex) {
             LOGGER.debug("", ex);
             throw new ArchiveExtractionException(ex);
         } finally {
             FileUtils.close(out);
         }
     }
 
     /**
      * Attempts to determine if a zip file is actually a JAR file.
      *
      * @param dependency the dependency to check
      * @return true if the dependency appears to be a JAR file; otherwise false
      */
     private boolean isZipFileActuallyJarFile(Dependency dependency) {
         boolean isJar = false;
         ZipFile zip = null;
         try {
             zip = new ZipFile(dependency.getActualFilePath());
             if (zip.getEntry("META-INF/MANIFEST.MF") != null
                     || zip.getEntry("META-INF/maven") != null) {
                 final Enumeration<ZipArchiveEntry> entries = zip.getEntries();
                 while (entries.hasMoreElements()) {
                     final ZipArchiveEntry entry = entries.nextElement();
                     if (!entry.isDirectory()) {
                         final String name = entry.getName().toLowerCase();
                         if (name.endsWith(".class")) {
                             isJar = true;
                             break;
                         }
                     }
                 }
             }
         } catch (IOException ex) {
             LOGGER.debug("Unable to unzip zip file '{}'", dependency.getFilePath(), ex);
         } finally {
             ZipFile.closeQuietly(zip);
         }
 
         return isJar;
     }
 }