/*
    * This file is part of dependency-check-core.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   *
   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
   */
  package org.owasp.dependencycheck.analyzer;
  
  import java.io.File;
  import java.io.FileFilter;
  import java.io.FileOutputStream;
  import java.io.IOException;
  import java.io.InputStream;
  import org.apache.commons.io.IOUtils;
  import org.apache.commons.io.output.NullOutputStream;
  import org.owasp.dependencycheck.Engine;
  import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
  import org.owasp.dependencycheck.dependency.Confidence;
  import org.owasp.dependencycheck.dependency.Dependency;
  import org.owasp.dependencycheck.dependency.Evidence;
  import org.owasp.dependencycheck.utils.FileFilterBuilder;
  import org.owasp.dependencycheck.utils.Settings;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.w3c.dom.Document;
  import org.xml.sax.SAXException;
  
  import javax.xml.parsers.DocumentBuilder;
  import javax.xml.xpath.XPath;
  import javax.xml.xpath.XPathExpressionException;
  import javax.xml.xpath.XPathFactory;
  import java.util.ArrayList;
  import java.util.List;
  import javax.xml.parsers.ParserConfigurationException;
  import org.owasp.dependencycheck.exception.InitializationException;
  import org.apache.commons.lang3.SystemUtils;
  import org.owasp.dependencycheck.utils.XmlUtils;
  
  /**
   * Analyzer for getting company, product, and version information from a .NET
   * assembly.
   *
   * @author colezlaw
   *
   */
  public class AssemblyAnalyzer extends AbstractFileTypeAnalyzer {
  
      /**
       * The analyzer name
       */
      private static final String ANALYZER_NAME = "Assembly Analyzer";
      /**
       * The analysis phase
       */
      private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
      /**
       * The list of supported extensions
       */
      private static final String[] SUPPORTED_EXTENSIONS = {"dll", "exe"};
      /**
       * The temp value for GrokAssembly.exe
       */
      private File grokAssemblyExe = null;
      /**
       * Logger
       */
      private static final Logger LOGGER = LoggerFactory.getLogger(AssemblyAnalyzer.class);
  
      /**
       * Builds the beginnings of a List for ProcessBuilder
       *
       * @return the list of arguments to begin populating the ProcessBuilder
       */
      protected List<String> buildArgumentList() {
          // Use file.separator as a wild guess as to whether this is Windows
          final List<String> args = new ArrayList<String>();
          if (!SystemUtils.IS_OS_WINDOWS) {
              if (Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH) != null) {
                  args.add(Settings.getString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH));
              } else if (isInPath("mono")) {
                  args.add("mono");
              } else {
                  return null;
              }
          }
          args.add(grokAssemblyExe.getPath());
          return args;
      }
 
     /**
      * Performs the analysis on a single Dependency.
      *
      * @param dependency the dependency to analyze
      * @param engine the engine to perform the analysis under
      * @throws AnalysisException if anything goes sideways
      */
     @Override
     public void analyzeDependency(Dependency dependency, Engine engine)
             throws AnalysisException {
         if (grokAssemblyExe == null) {
             LOGGER.warn("GrokAssembly didn't get deployed");
             return;
         }
 
         final List<String> args = buildArgumentList();
         if (args == null) {
             LOGGER.warn("Assembly Analyzer was unable to execute");
             return;
         }
         args.add(dependency.getActualFilePath());
         final ProcessBuilder pb = new ProcessBuilder(args);
         Document doc = null;
         try {
             final Process proc = pb.start();
             final DocumentBuilder builder = XmlUtils.buildSecureDocumentBuilder();
 
             doc = builder.parse(proc.getInputStream());
 
             // Try evacuating the error stream
             final String errorStream = IOUtils.toString(proc.getErrorStream(), "UTF-8");
             if (null != errorStream && !errorStream.isEmpty()) {
                 LOGGER.warn("Error from GrokAssembly: {}", errorStream);
             }
 
             int rc = 0;
             try {
                 rc = proc.waitFor();
             } catch (InterruptedException ie) {
                 return;
             }
             if (rc == 3) {
                 LOGGER.debug("{} is not a .NET assembly or executable and as such cannot be analyzed by dependency-check",
                         dependency.getActualFilePath());
                 return;
             } else if (rc != 0) {
                 LOGGER.warn("Return code {} from GrokAssembly", rc);
             }
 
             final XPath xpath = XPathFactory.newInstance().newXPath();
 
             // First, see if there was an error
             final String error = xpath.evaluate("/assembly/error", doc);
             if (error != null && !error.isEmpty()) {
                 throw new AnalysisException(error);
             }
 
             final String version = xpath.evaluate("/assembly/version", doc);
             if (version != null) {
                 dependency.getVersionEvidence().addEvidence(new Evidence("grokassembly", "version",
                         version, Confidence.HIGHEST));
             }
 
             final String vendor = xpath.evaluate("/assembly/company", doc);
             if (vendor != null) {
                 dependency.getVendorEvidence().addEvidence(new Evidence("grokassembly", "vendor",
                         vendor, Confidence.HIGH));
             }
 
             final String product = xpath.evaluate("/assembly/product", doc);
             if (product != null) {
                 dependency.getProductEvidence().addEvidence(new Evidence("grokassembly", "product",
                         product, Confidence.HIGH));
             }
 
         } catch (ParserConfigurationException pce) {
             throw new AnalysisException("Error initializing the assembly analyzer", pce);
         } catch (IOException ioe) {
             throw new AnalysisException(ioe);
         } catch (SAXException saxe) {
             LOGGER.error("----------------------------------------------------");
             LOGGER.error("Failed to read the Assembly Analyzer results. "
                     + "On some systems mono-runtime and mono-devel need to be installed.");
             LOGGER.error("----------------------------------------------------");
             throw new AnalysisException("Couldn't parse Assembly Analzyzer results (GrokAssembly)", saxe);
         } catch (XPathExpressionException xpe) {
             // This shouldn't happen
             throw new AnalysisException(xpe);
         }
     }
 
     /**
      * Initialize the analyzer. In this case, extract GrokAssembly.exe to a
      * temporary location.
      *
      * @throws InitializationException thrown if anything goes wrong
      */
     @Override
     public void initializeFileTypeAnalyzer() throws InitializationException {
         final File tempFile;
         try {
             tempFile = File.createTempFile("GKA", ".exe", Settings.getTempDirectory());
         } catch (IOException ex) {
             setEnabled(false);
             throw new InitializationException("Unable to create temporary file for the assembly analyzerr", ex);
         }
         FileOutputStream fos = null;
         InputStream is = null;
         try {
             fos = new FileOutputStream(tempFile);
             is = AssemblyAnalyzer.class.getClassLoader().getResourceAsStream("GrokAssembly.exe");
             IOUtils.copy(is, fos);
 
             grokAssemblyExe = tempFile;
             LOGGER.debug("Extracted GrokAssembly.exe to {}", grokAssemblyExe.getPath());
         } catch (IOException ioe) {
             this.setEnabled(false);
             LOGGER.warn("Could not extract GrokAssembly.exe: {}", ioe.getMessage());
             throw new InitializationException("Could not extract GrokAssembly.exe", ioe);
         } finally {
             if (fos != null) {
                 try {
                     fos.close();
                 } catch (Throwable e) {
                     LOGGER.debug("Error closing output stream");
                 }
             }
             if (is != null) {
                 try {
                     is.close();
                 } catch (Throwable e) {
                     LOGGER.debug("Error closing input stream");
                 }
             }
         }
 
         // Now, need to see if GrokAssembly actually runs from this location.
         final List<String> args = buildArgumentList();
         //TODO this creates an "unreported" error - if someone doesn't look
         // at the command output this could easily be missed (especially in an
         // Ant or Maven build.
         //
         // We need to create a non-fatal warning error type that will
         // get added to the report.
         //TOOD this idea needs to get replicated to the bundle audit analyzer.
         if (args == null) {
             setEnabled(false);
             LOGGER.error("----------------------------------------------------");
             LOGGER.error(".NET Assembly Analyzer could not be initialized and at least one "
                     + "'exe' or 'dll' was scanned. The 'mono' executable could not be found on "
                     + "the path; either disable the Assembly Analyzer or configure the path mono. "
                     + "On some systems mono-runtime and mono-devel need to be installed.");
             LOGGER.error("----------------------------------------------------");
             return;
         }
         try {
             final ProcessBuilder pb = new ProcessBuilder(args);
             final Process p = pb.start();
             // Try evacuating the error stream
             IOUtils.copy(p.getErrorStream(), NullOutputStream.NULL_OUTPUT_STREAM);
 
             final DocumentBuilder builder = XmlUtils.buildSecureDocumentBuilder();
             final Document doc = builder.parse(p.getInputStream());
             final XPath xpath = XPathFactory.newInstance().newXPath();
             final String error = xpath.evaluate("/assembly/error", doc);
             if (p.waitFor() != 1 || error == null || error.isEmpty()) {
                 LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details.");
                 LOGGER.debug("GrokAssembly.exe is not working properly");
                 grokAssemblyExe = null;
                 setEnabled(false);
                 throw new InitializationException("Could not execute .NET AssemblyAnalyzer");
             }
         } catch (InitializationException e) {
             setEnabled(false);
             throw e;
         } catch (Throwable e) {
             LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
                     + "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details.");
             LOGGER.debug("Could not execute GrokAssembly {}", e.getMessage());
             setEnabled(false);
             throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer", e);
         }
     }
 
     /**
      * Removes resources used from the local file system.
      *
      * @throws Exception thrown if there is a problem closing the analyzer
      */
     @Override
     public void closeAnalyzer() throws Exception {
         try {
             if (grokAssemblyExe != null && !grokAssemblyExe.delete()) {
                 LOGGER.debug("Unable to delete temporary GrokAssembly.exe; attempting delete on exit");
                 grokAssemblyExe.deleteOnExit();
             }
         } catch (SecurityException se) {
             LOGGER.debug("Can't delete temporary GrokAssembly.exe");
             grokAssemblyExe.deleteOnExit();
         }
     }
 
     /**
      * The File Filter used to filter supported extensions.
      */
     private static final FileFilter FILTER = FileFilterBuilder.newInstance().addExtensions(
             SUPPORTED_EXTENSIONS).build();
 
     @Override
     protected FileFilter getFileFilter() {
         return FILTER;
     }
 
     /**
      * Gets this analyzer's name.
      *
      * @return the analyzer name
      */
     @Override
     public String getName() {
         return ANALYZER_NAME;
     }
 
     /**
      * Returns the phase this analyzer runs under.
      *
      * @return the phase this runs under
      */
     @Override
     public AnalysisPhase getAnalysisPhase() {
         return ANALYSIS_PHASE;
     }
 
     /**
      * Returns the key used in the properties file to reference the analyzer's
      * enabled property.
      *
      * @return the analyzer's enabled property setting key
      */
     @Override
     protected String getAnalyzerEnabledSettingKey() {
         return Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED;
     }
 
     /**
      * Tests to see if a file is in the system path. <b>Note</b> - the current
      * implementation only works on non-windows platforms. For purposes of the
      * AssemblyAnalyzer this is okay as this is only needed on Mac/*nix.
      *
      * @param file the executable to look for
      * @return <code>true</code> if the file exists; otherwise
      * <code>false</code>
      */
     private boolean isInPath(String file) {
         final ProcessBuilder pb = new ProcessBuilder("which", file);
         try {
             final Process proc = pb.start();
             final int retCode = proc.waitFor();
             if (retCode == 0) {
                 return true;
             }
         } catch (IOException ex) {
             LOGGER.debug("Path seach failed for " + file);
         } catch (InterruptedException ex) {
             LOGGER.debug("Path seach failed for " + file);
         }
         return false;
     }
 }