/*
    * This file is part of dependency-check-core.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   *
   * Copyright (c) 2015 Jeremy Long. All Rights Reserved.
   */
  package org.owasp.dependencycheck.data.update;
  
  import java.io.File;
  import java.io.IOException;
  import java.net.MalformedURLException;
  import java.net.URL;
  import java.util.List;
  import javax.xml.parsers.ParserConfigurationException;
  import javax.xml.parsers.SAXParser;
  import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.LAST_CPE_UPDATE;
  import org.owasp.dependencycheck.data.update.cpe.CPEHandler;
  import org.owasp.dependencycheck.data.update.cpe.Cpe;
  import org.owasp.dependencycheck.data.update.exception.UpdateException;
  import org.owasp.dependencycheck.utils.DateUtil;
  import org.owasp.dependencycheck.utils.DownloadFailedException;
  import org.owasp.dependencycheck.utils.Downloader;
  import org.owasp.dependencycheck.utils.ExtractionUtil;
  import org.owasp.dependencycheck.utils.Settings;
  import org.owasp.dependencycheck.utils.XmlUtils;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.xml.sax.SAXException;
  
  /**
   *
   * This class is currently unused and if enabled will likely not work on MySQL
   * as the MERGE statement is used.
   *
   * The CpeUpdater is designed to download the CPE data file from NIST and import
   * the data into the database. However, as this currently adds no beneficial
   * data, compared to what is in the CPE data contained in the CVE data files,
   * this class is not currently used. The code is being kept as a future update
   * may utilize more data from the CPE XML files.
   *
   * @deprecated the CPE updater is not currently used.
   * @author Jeremy Long
   */
  @Deprecated
  public class CpeUpdater extends BaseUpdater implements CachedWebDataSource {
  
      /**
       * Static logger.
       */
      private static final Logger LOGGER = LoggerFactory.getLogger(CpeUpdater.class);
  
      @Override
      public void update() throws UpdateException {
          /*
          //the following could be used if this were ever used.
          try {
              if (!Settings.getBoolean(Settings.KEYS.UPDATE_NVDCVE_ENABLED, true)) {
                  return;
              }
          } catch (InvalidSettingException ex) {
              LOGGER.trace("inavlid setting UPDATE_NVDCVE_ENABLED", ex);
          }
           */
  
          try {
              openDataStores();
              if (updateNeeded()) {
                  LOGGER.info("Updating the Common Platform Enumeration (CPE)");
                  final File xml = downloadCpe();
                  final List<Cpe> cpes = processXML(xml);
                  getCveDB().deleteUnusedCpe();
                  for (Cpe cpe : cpes) {
                      getCveDB().addCpe(cpe.getValue(), cpe.getVendor(), cpe.getProduct());
                  }
                  final long now = System.currentTimeMillis();
                  getProperties().save(LAST_CPE_UPDATE, Long.toString(now));
                  LOGGER.info("CPE update complete");
              }
          } finally {
              closeDataStores();
          }
      }
  
      /**
       * Downloads the CPE XML file.
       *
       * @return the file reference to the CPE.xml file
       * @throws UpdateException thrown if there is an issue downloading the XML
      * file
      */
     private File downloadCpe() throws UpdateException {
         File xml;
         final URL url;
         try {
             url = new URL(Settings.getString(Settings.KEYS.CPE_URL));
             xml = File.createTempFile("cpe", ".xml", Settings.getTempDirectory());
             Downloader.fetchFile(url, xml);
             if (url.toExternalForm().endsWith(".xml.gz")) {
                 ExtractionUtil.extractGzip(xml);
             }
 
         } catch (MalformedURLException ex) {
             throw new UpdateException("Invalid CPE URL", ex);
         } catch (DownloadFailedException ex) {
             throw new UpdateException("Unable to download CPE XML file", ex);
         } catch (IOException ex) {
             throw new UpdateException("Unable to create temporary file to download CPE", ex);
         }
         return xml;
     }
 
     /**
      * Parses the CPE XML file to return a list of CPE entries.
      *
      * @param xml the CPE data file
      * @return the list of CPE entries
      * @throws UpdateException thrown if there is an issue with parsing the XML
      * file
      */
     private List<Cpe> processXML(final File xml) throws UpdateException {
         try {
             final SAXParser saxParser = XmlUtils.buildSecureSaxParser();
             final CPEHandler handler = new CPEHandler();
             saxParser.parse(xml, handler);
             return handler.getData();
         } catch (ParserConfigurationException ex) {
             throw new UpdateException("Unable to parse CPE XML file due to SAX Parser Issue", ex);
         } catch (SAXException ex) {
             throw new UpdateException("Unable to parse CPE XML file due to SAX Parser Exception", ex);
         } catch (IOException ex) {
             throw new UpdateException("Unable to parse CPE XML file due to IO Failure", ex);
         }
     }
 
     /**
      * Checks to find the last time the CPE data was refreshed and if it needs
      * to be updated.
      *
      * @return true if the CPE data should be refreshed
      */
     private boolean updateNeeded() {
         final long now = System.currentTimeMillis();
         final int days = Settings.getInt(Settings.KEYS.CPE_MODIFIED_VALID_FOR_DAYS, 30);
         long timestamp = 0;
         final String ts = getProperties().getProperty(LAST_CPE_UPDATE);
         if (ts != null && ts.matches("^[0-9]+$")) {
             timestamp = Long.parseLong(ts);
         }
         return !DateUtil.withinDateRange(timestamp, now, days);
     }
 }