/*

  * This file is part of dependency-check-core.

  *

  * Licensed under the Apache License, Version 2.0 (the "License");

  * you may not use this file except in compliance with the License.

  * You may obtain a copy of the License at

  *

  *     http://www.apache.org/licenses/LICENSE-2.0

  *

  * Unless required by applicable law or agreed to in writing, software

  * distributed under the License is distributed on an "AS IS" BASIS,

  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

  * See the License for the specific language governing permissions and

  * limitations under the License.

  *

  * Copyright (c) 2014 Jeremy Long. All Rights Reserved.

  */

 package org.owasp.dependencycheck.data.nexus;

 import java.io.FileNotFoundException;

 import java.io.IOException;

 import java.net.HttpURLConnection;

 import java.net.URL;

 import javax.xml.parsers.DocumentBuilder;

 import javax.xml.parsers.DocumentBuilderFactory;

 import javax.xml.xpath.XPath;

 import javax.xml.xpath.XPathFactory;

 import org.owasp.dependencycheck.utils.InvalidSettingException;

 import org.owasp.dependencycheck.utils.Settings;

 import org.owasp.dependencycheck.utils.URLConnectionFactory;

 import org.slf4j.Logger;

 import org.slf4j.LoggerFactory;

 import org.w3c.dom.Document;

 /**

  * Class of methods to search Nexus repositories.

  *

  * @author colezlaw

  */

 public class NexusSearch {

     /**

      * The root URL for the Nexus repository service.

      */

     private final URL rootURL;

     /**

      * Whether to use the Proxy when making requests.

      */

     private final boolean useProxy;

     /**

      * Used for logging.

      */

     private static final Logger LOGGER = LoggerFactory.getLogger(NexusSearch.class);

     /**

      * Creates a NexusSearch for the given repository URL.

      *

      * @param rootURL the root URL of the repository on which searches should

      * execute. full URL's are calculated relative to this URL, so it should end

      * with a /

      * @param useProxy flag indicating if the proxy settings should be used

      */

     public NexusSearch(URL rootURL, boolean useProxy) {

         this.rootURL = rootURL;

         this.useProxy = useProxy;

         LOGGER.debug("Using proxy: {}", useProxy);

     }

     /**

      * Searches the configured Nexus repository for the given sha1 hash. If the

      * artifact is found, a <code>MavenArtifact</code> is populated with the

      * coordinate information.

      *

      * @param sha1 The SHA-1 hash string for which to search

      * @return the populated Maven coordinates

      * @throws IOException if it's unable to connect to the specified repository

      * or if the specified artifact is not found.

      */

     public MavenArtifact searchSha1(String sha1) throws IOException {

         if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {

             throw new IllegalArgumentException("Invalid SHA1 format");

         }

         final URL url = new URL(rootURL, String.format("identify/sha1/%s",

                 sha1.toLowerCase()));

         LOGGER.debug("Searching Nexus url {}", url);

         // Determine if we need to use a proxy. The rules:

         // 1) If the proxy is set, AND the setting is set to true, use the proxy

         // 2) Otherwise, don't use the proxy (either the proxy isn't configured,

         // or proxy is specifically set to false

         HttpURLConnection conn;

         conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);

         conn.setDoOutput(true);

         // JSON would be more elegant, but there's not currently a dependency

         // on JSON, so don't want to add one just for this

         conn.addRequestProperty("Accept", "application/xml");

         conn.connect();

         switch (conn.getResponseCode()) {

             case 200:

                 try {

                     final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

                     factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

                     final DocumentBuilder builder = factory.newDocumentBuilder();

                     final Document doc = builder.parse(conn.getInputStream());

                     final XPath xpath = XPathFactory.newInstance().newXPath();

                     final String groupId = xpath

                             .evaluate(

                                     "/org.sonatype.nexus.rest.model.NexusArtifact/groupId",

                                     doc);

                     final String artifactId = xpath.evaluate(

                             "/org.sonatype.nexus.rest.model.NexusArtifact/artifactId",

                             doc);

                     final String version = xpath

                             .evaluate(

                                     "/org.sonatype.nexus.rest.model.NexusArtifact/version",

                                     doc);

                     final String link = xpath

                             .evaluate(

                                     "/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink",

                                     doc);

                     final String pomLink = xpath

                             .evaluate(

                                     "/org.sonatype.nexus.rest.model.NexusArtifact/pomLink",

                                     doc);

                     final MavenArtifact ma = new MavenArtifact(groupId, artifactId, version);

                     if (link != null && !link.isEmpty()) {

                         ma.setArtifactUrl(link);

                     }

                     if (pomLink != null && !pomLink.isEmpty()) {

                         ma.setPomUrl(pomLink);

                     }

                     return ma;

                 } catch (Throwable e) {

                     // Anything else is jacked-up XML stuff that we really can't recover

                     // from well

                     throw new IOException(e.getMessage(), e);

                 }

             case 404:

                 throw new FileNotFoundException("Artifact not found in Nexus");

             default:

                 LOGGER.debug("Could not connect to Nexus received response code: {} {}",

                         conn.getResponseCode(), conn.getResponseMessage());

                 throw new IOException("Could not connect to Nexus");

         }

     }

     /**

      * Do a preflight request to see if the repository is actually working.

      *

      * @return whether the repository is listening and returns the /status URL

      * correctly

      */

     public boolean preflightRequest() {

         HttpURLConnection conn;

         try {

             final URL url = new URL(rootURL, "status");

             conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);

             conn.addRequestProperty("Accept", "application/xml");

             conn.connect();

             if (conn.getResponseCode() != 200) {

                 LOGGER.warn("Expected 200 result from Nexus, got {}", conn.getResponseCode());

                 return false;

             }

             final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();

             final Document doc = builder.parse(conn.getInputStream());

             if (!"status".equals(doc.getDocumentElement().getNodeName())) {

                 LOGGER.warn("Expected root node name of status, got {}", doc.getDocumentElement().getNodeName());

                 return false;

             }

         } catch (Throwable e) {

             return false;

         }

         return true;

     }

 }

 // vim: cc=120:sw=4:ts=4:sts=4