Coverage Report - org.owasp.dependencycheck.analyzer.HintAnalyzer
 
Classes in this File Line Coverage Branch Coverage Complexity
HintAnalyzer
76%
23/30
71%
10/14
3.333
 
 1   
 /*
 2   
  * This file is part of dependency-check-core.
 3   
  *
 4   
  * Licensed under the Apache License, Version 2.0 (the "License");
 5   
  * you may not use this file except in compliance with the License.
 6   
  * You may obtain a copy of the License at
 7   
  *
 8   
  *     http://www.apache.org/licenses/LICENSE-2.0
 9   
  *
 10   
  * Unless required by applicable law or agreed to in writing, software
 11   
  * distributed under the License is distributed on an "AS IS" BASIS,
 12   
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 13   
  * See the License for the specific language governing permissions and
 14   
  * limitations under the License.
 15   
  *
 16   
  * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
 17   
  */
 18   
 package org.owasp.dependencycheck.analyzer;
 19   
 
 20   
 import java.util.ArrayList;
 21   
 import java.util.Iterator;
 22   
 import java.util.Set;
 23   
 import org.owasp.dependencycheck.Engine;
 24   
 import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
 25   
 import org.owasp.dependencycheck.dependency.Confidence;
 26   
 import org.owasp.dependencycheck.dependency.Dependency;
 27   
 import org.owasp.dependencycheck.dependency.Evidence;
 28   
 
 29   
 /**
 30   
  *
 31   
  * @author Jeremy Long <jeremy.long@owasp.org>
 32   
  */
 33   
 public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
 34   
 
 35   
     //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
 36   
     /**
 37   
      * The name of the analyzer.
 38   
      */
 39   
     private static final String ANALYZER_NAME = "Hint Analyzer";
 40   
     /**
 41   
      * The phase that this analyzer is intended to run in.
 42   
      */
 43  1 
     private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
 44   
 
 45   
     /**
 46   
      * Returns the name of the analyzer.
 47   
      *
 48   
      * @return the name of the analyzer.
 49   
      */
 50   
     @Override
 51   
     public String getName() {
 52  5 
         return ANALYZER_NAME;
 53   
     }
 54   
 
 55   
     /**
 56   
      * Returns the phase that the analyzer is intended to run in.
 57   
      *
 58   
      * @return the phase that the analyzer is intended to run in.
 59   
      */
 60   
     @Override
 61   
     public AnalysisPhase getAnalysisPhase() {
 62  2 
         return ANALYSIS_PHASE;
 63   
     }
 64   
     //</editor-fold>
 65   
 
 66   
     /**
 67   
      * The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of
 68   
      * identifiers or vulnerabilities.
 69   
      *
 70   
      * @param dependency The dependency being analyzed
 71   
      * @param engine The scanning engine
 72   
      * @throws AnalysisException is thrown if there is an exception analyzing the dependency.
 73   
      */
 74   
     @Override
 75   
     public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
 76  2 
         final Evidence springTest1 = new Evidence("Manifest",
 77   
                 "Implementation-Title",
 78   
                 "Spring Framework",
 79   
                 Confidence.HIGH);
 80   
 
 81  2 
         final Evidence springTest2 = new Evidence("Manifest",
 82   
                 "Implementation-Title",
 83   
                 "org.springframework.core",
 84   
                 Confidence.HIGH);
 85   
 
 86  2 
         final Evidence springTest3 = new Evidence("Manifest",
 87   
                 "Bundle-Vendor",
 88   
                 "SpringSource",
 89   
                 Confidence.HIGH);
 90   
 
 91  2 
         Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
 92  2 
         if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
 93  1 
             dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
 94  1 
             dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGH);
 95  1 
             dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
 96   
         }
 97   
 
 98  2 
         evidence = dependency.getVendorEvidence().getEvidence();
 99  2 
         if (evidence.contains(springTest3)) {
 100  1 
             dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
 101  1 
             dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
 102   
         }
 103  2 
         final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
 104  2 
         final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
 105  29 
         while (itr.hasNext()) {
 106  27 
             final Evidence e = itr.next();
 107  27 
             if ("sun".equalsIgnoreCase(e.getValue(false))) {
 108  0 
                 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence());
 109  0 
                 newEntries.add(newEvidence);
 110  0 
             } else if ("oracle".equalsIgnoreCase(e.getValue(false))) {
 111  0 
                 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence());
 112  0 
                 newEntries.add(newEvidence);
 113   
             }
 114  27 
         }
 115  2 
         for (Evidence e : newEntries) {
 116  0 
             dependency.getVendorEvidence().addEvidence(e);
 117  0 
         }
 118   
 
 119  2 
     }
 120   
 }
Report generated by Cobertura 2.0.3 on 11/16/14 9:17 AM.