Coverage Report

Coverage Report - org.owasp.dependencycheck.analyzer.AutoconfAnalyzer

Classes in this File

Line Coverage

Branch Coverage

Complexity

AutoconfAnalyzer

90%

64/71

76%

26/34

3.222

 /*
  * This file is part of dependency-check-core.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  * Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved.
  */
 package org.owasp.dependencycheck.analyzer;
 
 import org.apache.commons.io.FileUtils;
 import org.owasp.dependencycheck.Engine;
 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
 import org.owasp.dependencycheck.dependency.Confidence;
 import org.owasp.dependencycheck.dependency.Dependency;
 import org.owasp.dependencycheck.dependency.EvidenceCollection;
 import org.owasp.dependencycheck.utils.FileFilterBuilder;
 import org.owasp.dependencycheck.utils.Settings;
 import org.owasp.dependencycheck.utils.UrlStringUtils;
 
 import java.io.File;
 import java.io.FileFilter;
 import java.io.IOException;
 import java.nio.charset.Charset;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 /**
  * Used to analyze Autoconf input files named configure.ac or configure.in. Files simply named "configure" are also analyzed,
  * assuming they are generated by Autoconf, and contain certain special package descriptor variables.
  *
  * @author Dale Visser
  * @see <a href="https://www.gnu.org/software/autoconf/">Autoconf - GNU Project - Free Software Foundation (FSF)</a>
  */
 @Experimental
 public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
 
     /**
      * Autoconf output filename.
      */
     private static final String CONFIGURE = "configure";
 
     /**
      * Autoconf input filename.
      */
     private static final String CONFIGURE_IN = "configure.in";
 
     /**
      * Autoconf input filename.
      */
     private static final String CONFIGURE_AC = "configure.ac";
 
     /**
      * The name of the analyzer.
      */
     private static final String ANALYZER_NAME = "Autoconf Analyzer";
 
     /**
      * The phase that this analyzer is intended to run in.
      */
     private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
 
     /**
      * The set of file extensions supported by this analyzer.
      */
     private static final String[] EXTENSIONS = {"ac", "in"};
 
     /**
      * Matches AC_INIT variables in the output configure script.
      */
     private static final Pattern PACKAGE_VAR = Pattern.compile(
             "PACKAGE_(.+?)='(.*?)'", Pattern.DOTALL | Pattern.CASE_INSENSITIVE);
 
     /**
      * Matches AC_INIT statement in configure.ac file.
      */
     private static final Pattern AC_INIT_PATTERN;
 
     static {
         // each instance of param or sep_param has a capture group
         final String param = "\\[{0,2}(.+?)\\]{0,2}";
         final String sepParam = "\\s*,\\s*" + param;
         // Group 1: Package
         // Group 2: Version
         // Group 3: optional
         // Group 4: Bug report address (if it exists)
         // Group 5: optional
         // Group 6: Tarname (if it exists)
         // Group 7: optional
         // Group 8: URL (if it exists)
         AC_INIT_PATTERN = Pattern.compile(String.format(
                 "AC_INIT\\(%s%s(%s)?(%s)?(%s)?\\s*\\)", param, sepParam,
                 sepParam, sepParam, sepParam), Pattern.DOTALL
                 | Pattern.CASE_INSENSITIVE);
     }
 
     /**
      * The file filter used to determine which files this analyzer supports.
      */
     private static final FileFilter FILTER = FileFilterBuilder.newInstance().addFilenames(CONFIGURE).addExtensions(
             EXTENSIONS).build();
 
     /**
      * Returns the FileFilter
      *
      * @return the FileFilter
      */
     @Override
     protected FileFilter getFileFilter() {
         return FILTER;
     }
 
     /**
      * Returns the name of the analyzer.
      *
      * @return the name of the analyzer.
      */
     @Override
     public String getName() {
         return ANALYZER_NAME;
     }
 
     /**
      * Returns the phase that the analyzer is intended to run in.
      *
      * @return the phase that the analyzer is intended to run in.
      */
     @Override
     public AnalysisPhase getAnalysisPhase() {
         return ANALYSIS_PHASE;
     }
 
     /**
      * Returns the key used in the properties file to reference the analyzer's enabled property.
      *
      * @return the analyzer's enabled property setting key
      */
     @Override
     protected String getAnalyzerEnabledSettingKey() {
         return Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED;
     }
 
     @Override
     protected void analyzeFileType(Dependency dependency, Engine engine)
             throws AnalysisException {
         final File actualFile = dependency.getActualFile();
         final String name = actualFile.getName();
         if (name.startsWith(CONFIGURE)) {
             final File parent = actualFile.getParentFile();
             final String parentName = parent.getName();
             dependency.setDisplayFileName(parentName + "/" + name);
             final boolean isOutputScript = CONFIGURE.equals(name);
             if (isOutputScript || CONFIGURE_AC.equals(name)
                     || CONFIGURE_IN.equals(name)) {
                 final String contents = getFileContents(actualFile);
                 if (!contents.isEmpty()) {
                     if (isOutputScript) {
                         extractConfigureScriptEvidence(dependency, name,
                                 contents);
                     } else {
                         gatherEvidence(dependency, name, contents);
                     }
                 }
             }
         } else {
             // copy, alter and set in case some other thread is iterating over
             final List<Dependency> dependencies = new ArrayList<Dependency>(
                     engine.getDependencies());
             dependencies.remove(dependency);
             engine.setDependencies(dependencies);
         }
     }
 
     /**
      * Extracts evidence from the configuration.
      *
      * @param dependency the dependency being analyzed
      * @param name the name of the source of evidence
      * @param contents the contents to analyze for evidence
      */
     private void extractConfigureScriptEvidence(Dependency dependency,
             final String name, final String contents) {
         final Matcher matcher = PACKAGE_VAR.matcher(contents);
         while (matcher.find()) {
             final String variable = matcher.group(1);
             final String value = matcher.group(2);
             if (!value.isEmpty()) {
                 if (variable.endsWith("NAME")) {
                     dependency.getProductEvidence().addEvidence(name, variable,
                             value, Confidence.HIGHEST);
                 } else if ("VERSION".equals(variable)) {
                     dependency.getVersionEvidence().addEvidence(name, variable,
                             value, Confidence.HIGHEST);
                 } else if ("BUGREPORT".equals(variable)) {
                     dependency.getVendorEvidence().addEvidence(name, variable,
                             value, Confidence.HIGH);
                 } else if ("URL".equals(variable)) {
                     dependency.getVendorEvidence().addEvidence(name, variable,
                             value, Confidence.HIGH);
                 }
             }
         }
     }
 
     /**
      * Retrieves the contents of a given file.
      *
      * @param actualFile the file to read
      * @return the contents of the file
      * @throws AnalysisException thrown if there is an IO Exception
      */
     private String getFileContents(final File actualFile)
             throws AnalysisException {
         try {
             return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
         } catch (IOException e) {
             throw new AnalysisException(
                     "Problem occurred while reading dependency file.", e);
         }
     }
 
     /**
      * Gathers evidence from a given file
      *
      * @param dependency the dependency to add evidence to
      * @param name the source of the evidence
      * @param contents the evidence to analyze
      */
     private void gatherEvidence(Dependency dependency, final String name,
             String contents) {
         final Matcher matcher = AC_INIT_PATTERN.matcher(contents);
         if (matcher.find()) {
             final EvidenceCollection productEvidence = dependency
                     .getProductEvidence();
             productEvidence.addEvidence(name, "Package", matcher.group(1),
                     Confidence.HIGHEST);
             dependency.getVersionEvidence().addEvidence(name,
                     "Package Version", matcher.group(2), Confidence.HIGHEST);
             final EvidenceCollection vendorEvidence = dependency
                     .getVendorEvidence();
             if (null != matcher.group(3)) {
                 vendorEvidence.addEvidence(name, "Bug report address",
                         matcher.group(4), Confidence.HIGH);
             }
             if (null != matcher.group(5)) {
                 productEvidence.addEvidence(name, "Tarname", matcher.group(6),
                         Confidence.HIGH);
             }
             if (null != matcher.group(7)) {
                 final String url = matcher.group(8);
                 if (UrlStringUtils.isUrl(url)) {
                     vendorEvidence.addEvidence(name, "URL", url,
                             Confidence.HIGH);
                 }
             }
         }
     }
 
     /**
      * Initializes the file type analyzer.
      *
      * @throws Exception thrown if there is an exception during initialization
      */
     @Override
     protected void initializeFileTypeAnalyzer() throws Exception {
         // No initialization needed.
     }
 }

1		/*
2		* This file is part of dependency-check-core.
3		*
4		* Licensed under the Apache License, Version 2.0 (the "License");
5		* you may not use this file except in compliance with the License.
6		* You may obtain a copy of the License at
7		*
8		* http://www.apache.org/licenses/LICENSE-2.0
9		*
10		* Unless required by applicable law or agreed to in writing, software
11		* distributed under the License is distributed on an "AS IS" BASIS,
12		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13		* See the License for the specific language governing permissions and
14		* limitations under the License.
15		*
16		* Copyright (c) 2015 Institute for Defense Analyses. All Rights Reserved.
17		*/
18		package org.owasp.dependencycheck.analyzer;
19
20		import org.apache.commons.io.FileUtils;
21		import org.owasp.dependencycheck.Engine;
22		import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
23		import org.owasp.dependencycheck.dependency.Confidence;
24		import org.owasp.dependencycheck.dependency.Dependency;
25		import org.owasp.dependencycheck.dependency.EvidenceCollection;
26		import org.owasp.dependencycheck.utils.FileFilterBuilder;
27		import org.owasp.dependencycheck.utils.Settings;
28		import org.owasp.dependencycheck.utils.UrlStringUtils;
29
30		import java.io.File;
31		import java.io.FileFilter;
32		import java.io.IOException;
33		import java.nio.charset.Charset;
34		import java.util.ArrayList;
35		import java.util.List;
36		import java.util.regex.Matcher;
37		import java.util.regex.Pattern;
38
39		/**
40		* Used to analyze Autoconf input files named configure.ac or configure.in. Files simply named "configure" are also analyzed,
41		* assuming they are generated by Autoconf, and contain certain special package descriptor variables.
42		*
43		* @author Dale Visser
44		* @see <a href="https://www.gnu.org/software/autoconf/">Autoconf - GNU Project - Free Software Foundation (FSF)</a>
45		*/
46		@Experimental
47	24	public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
48
49		/**
50		* Autoconf output filename.
51		*/
52		private static final String CONFIGURE = "configure";
53
54		/**
55		* Autoconf input filename.
56		*/
57		private static final String CONFIGURE_IN = "configure.in";
58
59		/**
60		* Autoconf input filename.
61		*/
62		private static final String CONFIGURE_AC = "configure.ac";
63
64		/**
65		* The name of the analyzer.
66		*/
67		private static final String ANALYZER_NAME = "Autoconf Analyzer";
68
69		/**
70		* The phase that this analyzer is intended to run in.
71		*/
72	2	private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
73
74		/**
75		* The set of file extensions supported by this analyzer.
76		*/
77	2	private static final String[] EXTENSIONS = {"ac", "in"};
78
79		/**
80		* Matches AC_INIT variables in the output configure script.
81		*/
82	2	private static final Pattern PACKAGE_VAR = Pattern.compile(
83		"PACKAGE_(.+?)='(.*?)'", Pattern.DOTALL \| Pattern.CASE_INSENSITIVE);
84
85		/**
86		* Matches AC_INIT statement in configure.ac file.
87		*/
88		private static final Pattern AC_INIT_PATTERN;
89
90		static {
91		// each instance of param or sep_param has a capture group
92	2	final String param = "\\[{0,2}(.+?)\\]{0,2}";
93	2	final String sepParam = "\\s,\\s" + param;
94		// Group 1: Package
95		// Group 2: Version
96		// Group 3: optional
97		// Group 4: Bug report address (if it exists)
98		// Group 5: optional
99		// Group 6: Tarname (if it exists)
100		// Group 7: optional
101		// Group 8: URL (if it exists)
102	2	AC_INIT_PATTERN = Pattern.compile(String.format(
103		"AC_INIT\\(%s%s(%s)?(%s)?(%s)?\\s*\\)", param, sepParam,
104		sepParam, sepParam, sepParam), Pattern.DOTALL
105		\| Pattern.CASE_INSENSITIVE);
106		}
107
108		/**
109		* The file filter used to determine which files this analyzer supports.
110		*/
111	4	private static final FileFilter FILTER = FileFilterBuilder.newInstance().addFilenames(CONFIGURE).addExtensions(
112	2	EXTENSIONS).build();
113
114		/**
115		* Returns the FileFilter
116		*
117		* @return the FileFilter
118		*/
119		@Override
120		protected FileFilter getFileFilter() {
121	1724	return FILTER;
122		}
123
124		/**
125		* Returns the name of the analyzer.
126		*
127		* @return the name of the analyzer.
128		*/
129		@Override
130		public String getName() {
131	30	return ANALYZER_NAME;
132		}
133
134		/**
135		* Returns the phase that the analyzer is intended to run in.
136		*
137		* @return the phase that the analyzer is intended to run in.
138		*/
139		@Override
140		public AnalysisPhase getAnalysisPhase() {
141	8	return ANALYSIS_PHASE;
142		}
143
144		/**
145		* Returns the key used in the properties file to reference the analyzer's enabled property.
146		*
147		* @return the analyzer's enabled property setting key
148		*/
149		@Override
150		protected String getAnalyzerEnabledSettingKey() {
151	24	return Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED;
152		}
153
154		@Override
155		protected void analyzeFileType(Dependency dependency, Engine engine)
156		throws AnalysisException {
157	8	final File actualFile = dependency.getActualFile();
158	8	final String name = actualFile.getName();
159	8	if (name.startsWith(CONFIGURE)) {
160	8	final File parent = actualFile.getParentFile();
161	8	final String parentName = parent.getName();
162	8	dependency.setDisplayFileName(parentName + "/" + name);
163	8	final boolean isOutputScript = CONFIGURE.equals(name);
164	8	if (isOutputScript \|\| CONFIGURE_AC.equals(name)
165	0	\|\| CONFIGURE_IN.equals(name)) {
166	8	final String contents = getFileContents(actualFile);
167	8	if (!contents.isEmpty()) {
168	8	if (isOutputScript) {
169	4	extractConfigureScriptEvidence(dependency, name,
170		contents);
171		} else {
172	4	gatherEvidence(dependency, name, contents);
173		}
174		}
175		}
176	8	} else {
177		// copy, alter and set in case some other thread is iterating over
178	0	final List<Dependency> dependencies = new ArrayList<Dependency>(
179	0	engine.getDependencies());
180	0	dependencies.remove(dependency);
181	0	engine.setDependencies(dependencies);
182		}
183	8	}
184
185		/**
186		* Extracts evidence from the configuration.
187		*
188		* @param dependency the dependency being analyzed
189		* @param name the name of the source of evidence
190		* @param contents the contents to analyze for evidence
191		*/
192		private void extractConfigureScriptEvidence(Dependency dependency,
193		final String name, final String contents) {
194	4	final Matcher matcher = PACKAGE_VAR.matcher(contents);
195	40	while (matcher.find()) {
196	36	final String variable = matcher.group(1);
197	36	final String value = matcher.group(2);
198	36	if (!value.isEmpty()) {
199	28	if (variable.endsWith("NAME")) {
200	8	dependency.getProductEvidence().addEvidence(name, variable,
201		value, Confidence.HIGHEST);
202	20	} else if ("VERSION".equals(variable)) {
203	4	dependency.getVersionEvidence().addEvidence(name, variable,
204		value, Confidence.HIGHEST);
205	16	} else if ("BUGREPORT".equals(variable)) {
206	2	dependency.getVendorEvidence().addEvidence(name, variable,
207		value, Confidence.HIGH);
208	14	} else if ("URL".equals(variable)) {
209	2	dependency.getVendorEvidence().addEvidence(name, variable,
210		value, Confidence.HIGH);
211		}
212		}
213	36	}
214	4	}
215
216		/**
217		* Retrieves the contents of a given file.
218		*
219		* @param actualFile the file to read
220		* @return the contents of the file
221		* @throws AnalysisException thrown if there is an IO Exception
222		*/
223		private String getFileContents(final File actualFile)
224		throws AnalysisException {
225		try {
226	8	return FileUtils.readFileToString(actualFile, Charset.defaultCharset()).trim();
227	0	} catch (IOException e) {
228	0	throw new AnalysisException(
229		"Problem occurred while reading dependency file.", e);
230		}
231		}
232
233		/**
234		* Gathers evidence from a given file
235		*
236		* @param dependency the dependency to add evidence to
237		* @param name the source of the evidence
238		* @param contents the evidence to analyze
239		*/
240		private void gatherEvidence(Dependency dependency, final String name,
241		String contents) {
242	4	final Matcher matcher = AC_INIT_PATTERN.matcher(contents);
243	4	if (matcher.find()) {
244	4	final EvidenceCollection productEvidence = dependency
245	4	.getProductEvidence();
246	4	productEvidence.addEvidence(name, "Package", matcher.group(1),
247		Confidence.HIGHEST);
248	8	dependency.getVersionEvidence().addEvidence(name,
249	4	"Package Version", matcher.group(2), Confidence.HIGHEST);
250	4	final EvidenceCollection vendorEvidence = dependency
251	4	.getVendorEvidence();
252	4	if (null != matcher.group(3)) {
253	8	vendorEvidence.addEvidence(name, "Bug report address",
254	4	matcher.group(4), Confidence.HIGH);
255		}
256	4	if (null != matcher.group(5)) {
257	2	productEvidence.addEvidence(name, "Tarname", matcher.group(6),
258		Confidence.HIGH);
259		}
260	4	if (null != matcher.group(7)) {
261	2	final String url = matcher.group(8);
262	2	if (UrlStringUtils.isUrl(url)) {
263	2	vendorEvidence.addEvidence(name, "URL", url,
264		Confidence.HIGH);
265		}
266		}
267		}
268	4	}
269
270		/**
271		* Initializes the file type analyzer.
272		*
273		* @throws Exception thrown if there is an exception during initialization
274		*/
275		@Override
276		protected void initializeFileTypeAnalyzer() throws Exception {
277		// No initialization needed.
278	12	}
279		}