Coverage Report

Coverage Report - org.owasp.dependencycheck.App

Classes in this File

Line Coverage

Branch Coverage

Complexity

App

0/137

0/90

12.5

 /*
  * This file is part of dependency-check-cli.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
  */
 package org.owasp.dependencycheck;
 
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import org.apache.commons.cli.ParseException;
 import org.owasp.dependencycheck.cli.CliParser;
 import org.owasp.dependencycheck.data.nvdcve.CveDB;
 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
 import org.owasp.dependencycheck.dependency.Dependency;
 import org.owasp.dependencycheck.reporting.ReportGenerator;
 import org.owasp.dependencycheck.utils.LogUtils;
 import org.owasp.dependencycheck.utils.Settings;
 
 /**
  * The command line interface for the DependencyCheck application.
  *
  * @author Jeremy Long <jeremy.long@owasp.org>
  */
 public class App {
 
     /**
      * The location of the log properties configuration file.
      */
     private static final String LOG_PROPERTIES_FILE = "log.properties";
 
     /**
      * The logger.
      */
     private static final Logger LOGGER = Logger.getLogger(App.class.getName());
 
     /**
      * The main method for the application.
      *
      * @param args the command line arguments
      */
     public static void main(String[] args) {
         final App app = new App();
         app.run(args);
     }
 
     /**
      * Main CLI entry-point into the application.
      *
      * @param args the command line arguments
      */
     public void run(String[] args) {
 
         final CliParser cli = new CliParser();
         try {
             cli.parse(args);
         } catch (FileNotFoundException ex) {
             System.err.println(ex.getMessage());
             cli.printHelp();
             return;
         } catch (ParseException ex) {
             System.err.println(ex.getMessage());
             cli.printHelp();
             return;
         }
 
         final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
         LogUtils.prepareLogger(in, cli.getVerboseLog());
 
         if (cli.isGetVersion()) {
             cli.printVersionInfo();
         } else if (cli.isRunScan()) {
             populateSettings(cli);
             runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles());
         } else {
             cli.printHelp();
         }
     }
 
     /**
      * Scans the specified directories and writes the dependency reports to the reportDirectory.
      *
      * @param reportDirectory the path to the directory where the reports will be written
      * @param outputFormat the output format of the report
      * @param applicationName the application name for the report
      * @param files the files/directories to scan
      */
     private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) {
         Engine scanner = null;
         try {
             scanner = new Engine();
 
             for (String file : files) {
                 scanner.scan(file);
             }
 
             scanner.analyzeDependencies();
             final List<Dependency> dependencies = scanner.getDependencies();
             DatabaseProperties prop = null;
             CveDB cve = null;
             try {
                 cve = new CveDB();
                 cve.open();
                 prop = cve.getDatabaseProperties();
             } catch (DatabaseException ex) {
                 LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
             } finally {
                 if (cve != null) {
                     cve.close();
                 }
             }
             final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop);
             try {
                 report.generateReports(reportDirectory, outputFormat);
             } catch (IOException ex) {
                 LOGGER.log(Level.SEVERE, "There was an IO error while attempting to generate the report.");
                 LOGGER.log(Level.FINE, null, ex);
             } catch (Throwable ex) {
                 LOGGER.log(Level.SEVERE, "There was an error while attempting to generate the report.");
                 LOGGER.log(Level.FINE, null, ex);
             }
         } catch (DatabaseException ex) {
             LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
             LOGGER.log(Level.FINE, "", ex);
         } finally {
             Settings.cleanup();
             if (scanner != null) {
                 scanner.cleanup();
             }
         }
     }
 
     /**
      * Updates the global Settings.
      *
      * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding
      * settings in the core engine.
      */
     private void populateSettings(CliParser cli) {
 
         Settings.initialize();
 
         final boolean autoUpdate = cli.isAutoUpdate();
         final String connectionTimeout = cli.getConnectionTimeout();
         final String proxyUrl = cli.getProxyUrl();
         final String proxyPort = cli.getProxyPort();
         final String proxyUser = cli.getProxyUsername();
         final String proxyPass = cli.getProxyPassword();
         final String dataDirectory = cli.getDataDirectory();
         final File propertiesFile = cli.getPropertiesFile();
         final String suppressionFile = cli.getSuppressionFile();
         final boolean jarDisabled = cli.isJarDisabled();
         final boolean archiveDisabled = cli.isArchiveDisabled();
         final boolean assemblyDisabled = cli.isAssemblyDisabled();
         final boolean nuspecDisabled = cli.isNuspecDisabled();
         final boolean nexusDisabled = cli.isNexusDisabled();
         final String nexusUrl = cli.getNexusUrl();
         final String databaseDriverName = cli.getDatabaseDriverName();
         final String databaseDriverPath = cli.getDatabaseDriverPath();
         final String connectionString = cli.getConnectionString();
         final String databaseUser = cli.getDatabaseUser();
         final String databasePassword = cli.getDatabasePassword();
         final String additionalZipExtensions = cli.getAdditionalZipExtensions();
         final String pathToMono = cli.getPathToMono();
 
         if (propertiesFile != null) {
             try {
                 Settings.mergeProperties(propertiesFile);
             } catch (FileNotFoundException ex) {
                 final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath());
                 LOGGER.log(Level.SEVERE, msg);
                 LOGGER.log(Level.FINE, null, ex);
             } catch (IOException ex) {
                 final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath());
                 LOGGER.log(Level.SEVERE, msg);
                 LOGGER.log(Level.FINE, null, ex);
             }
         }
         // We have to wait until we've merged the properties before attempting to set whether we use
         // the proxy for Nexus since it could be disabled in the properties, but not explicitly stated
         // on the command line
         final boolean nexusUsesProxy = cli.isNexusUsesProxy();
         if (dataDirectory != null) {
             Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
         } else if (System.getProperty("basedir") != null) {
             final File dataDir = new File(System.getProperty("basedir"), "data");
             Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
         } else {
             final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
             final File base = jarPath.getParentFile();
             final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
             final File dataDir = new File(base, sub);
             Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
         }
         Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
         if (proxyUrl != null && !proxyUrl.isEmpty()) {
             Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
         }
         if (proxyPort != null && !proxyPort.isEmpty()) {
             Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
         }
         if (proxyUser != null && !proxyUser.isEmpty()) {
             Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser);
         }
         if (proxyPass != null && !proxyPass.isEmpty()) {
             Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass);
         }
         if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
             Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
         }
         if (suppressionFile != null && !suppressionFile.isEmpty()) {
             Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
         }
 
         //File Type Analyzer Settings
         Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled);
         Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled);
         Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled);
         Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled);
 
         Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled);
         if (nexusUrl != null && !nexusUrl.isEmpty()) {
             Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
         }
         Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
         if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
             Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
         }
         if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
             Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
         }
         if (connectionString != null && !connectionString.isEmpty()) {
             Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
         }
         if (databaseUser != null && !databaseUser.isEmpty()) {
             Settings.setString(Settings.KEYS.DB_USER, databaseUser);
         }
         if (databasePassword != null && !databasePassword.isEmpty()) {
             Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
         }
         if (additionalZipExtensions != null && !additionalZipExtensions.isEmpty()) {
             Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions);
         }
         if (pathToMono != null && !pathToMono.isEmpty()) {
             Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
         }
     }
 }

1		/*
2		* This file is part of dependency-check-cli.
3		*
4		* Licensed under the Apache License, Version 2.0 (the "License");
5		* you may not use this file except in compliance with the License.
6		* You may obtain a copy of the License at
7		*
8		* http://www.apache.org/licenses/LICENSE-2.0
9		*
10		* Unless required by applicable law or agreed to in writing, software
11		* distributed under the License is distributed on an "AS IS" BASIS,
12		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13		* See the License for the specific language governing permissions and
14		* limitations under the License.
15		*
16		* Copyright (c) 2012 Jeremy Long. All Rights Reserved.
17		*/
18		package org.owasp.dependencycheck;
19
20		import java.io.File;
21		import java.io.FileNotFoundException;
22		import java.io.IOException;
23		import java.io.InputStream;
24		import java.util.List;
25		import java.util.logging.Level;
26		import java.util.logging.Logger;
27		import org.apache.commons.cli.ParseException;
28		import org.owasp.dependencycheck.cli.CliParser;
29		import org.owasp.dependencycheck.data.nvdcve.CveDB;
30		import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
31		import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
32		import org.owasp.dependencycheck.dependency.Dependency;
33		import org.owasp.dependencycheck.reporting.ReportGenerator;
34		import org.owasp.dependencycheck.utils.LogUtils;
35		import org.owasp.dependencycheck.utils.Settings;
36
37		/**
38		* The command line interface for the DependencyCheck application.
39		*
40		* @author Jeremy Long <jeremy.long@owasp.org>
41		*/
42		public class App {
43
44		/**
45		* The location of the log properties configuration file.
46		*/
47		private static final String LOG_PROPERTIES_FILE = "log.properties";
48
49		/**
50		* The logger.
51		*/
52	0	private static final Logger LOGGER = Logger.getLogger(App.class.getName());
53
54		/**
55		* The main method for the application.
56		*
57		* @param args the command line arguments
58		*/
59		public static void main(String[] args) {
60	0	final App app = new App();
61	0	app.run(args);
62	0	}
63
64		/**
65		* Main CLI entry-point into the application.
66		*
67		* @param args the command line arguments
68		*/
69		public void run(String[] args) {
70
71	0	final CliParser cli = new CliParser();
72		try {
73	0	cli.parse(args);
74	0	} catch (FileNotFoundException ex) {
75	0	System.err.println(ex.getMessage());
76	0	cli.printHelp();
77	0	return;
78	0	} catch (ParseException ex) {
79	0	System.err.println(ex.getMessage());
80	0	cli.printHelp();
81	0	return;
82	0	}
83
84	0	final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
85	0	LogUtils.prepareLogger(in, cli.getVerboseLog());
86
87	0	if (cli.isGetVersion()) {
88	0	cli.printVersionInfo();
89	0	} else if (cli.isRunScan()) {
90	0	populateSettings(cli);
91	0	runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles());
92		} else {
93	0	cli.printHelp();
94		}
95	0	}
96
97		/**
98		* Scans the specified directories and writes the dependency reports to the reportDirectory.
99		*
100		* @param reportDirectory the path to the directory where the reports will be written
101		* @param outputFormat the output format of the report
102		* @param applicationName the application name for the report
103		* @param files the files/directories to scan
104		*/
105		private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) {
106	0	Engine scanner = null;
107		try {
108	0	scanner = new Engine();
109
110	0	for (String file : files) {
111	0	scanner.scan(file);
112		}
113
114	0	scanner.analyzeDependencies();
115	0	final List<Dependency> dependencies = scanner.getDependencies();
116	0	DatabaseProperties prop = null;
117	0	CveDB cve = null;
118		try {
119	0	cve = new CveDB();
120	0	cve.open();
121	0	prop = cve.getDatabaseProperties();
122	0	} catch (DatabaseException ex) {
123	0	LOGGER.log(Level.FINE, "Unable to retrieve DB Properties", ex);
124		} finally {
125	0	if (cve != null) {
126	0	cve.close();
127		}
128		}
129	0	final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop);
130		try {
131	0	report.generateReports(reportDirectory, outputFormat);
132	0	} catch (IOException ex) {
133	0	LOGGER.log(Level.SEVERE, "There was an IO error while attempting to generate the report.");
134	0	LOGGER.log(Level.FINE, null, ex);
135	0	} catch (Throwable ex) {
136	0	LOGGER.log(Level.SEVERE, "There was an error while attempting to generate the report.");
137	0	LOGGER.log(Level.FINE, null, ex);
138	0	}
139	0	} catch (DatabaseException ex) {
140	0	LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
141	0	LOGGER.log(Level.FINE, "", ex);
142		} finally {
143	0	Settings.cleanup();
144	0	if (scanner != null) {
145	0	scanner.cleanup();
146		}
147		}
148	0	}
149
150		/**
151		* Updates the global Settings.
152		*
153		* @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding
154		* settings in the core engine.
155		*/
156		private void populateSettings(CliParser cli) {
157
158	0	Settings.initialize();
159
160	0	final boolean autoUpdate = cli.isAutoUpdate();
161	0	final String connectionTimeout = cli.getConnectionTimeout();
162	0	final String proxyUrl = cli.getProxyUrl();
163	0	final String proxyPort = cli.getProxyPort();
164	0	final String proxyUser = cli.getProxyUsername();
165	0	final String proxyPass = cli.getProxyPassword();
166	0	final String dataDirectory = cli.getDataDirectory();
167	0	final File propertiesFile = cli.getPropertiesFile();
168	0	final String suppressionFile = cli.getSuppressionFile();
169	0	final boolean jarDisabled = cli.isJarDisabled();
170	0	final boolean archiveDisabled = cli.isArchiveDisabled();
171	0	final boolean assemblyDisabled = cli.isAssemblyDisabled();
172	0	final boolean nuspecDisabled = cli.isNuspecDisabled();
173	0	final boolean nexusDisabled = cli.isNexusDisabled();
174	0	final String nexusUrl = cli.getNexusUrl();
175	0	final String databaseDriverName = cli.getDatabaseDriverName();
176	0	final String databaseDriverPath = cli.getDatabaseDriverPath();
177	0	final String connectionString = cli.getConnectionString();
178	0	final String databaseUser = cli.getDatabaseUser();
179	0	final String databasePassword = cli.getDatabasePassword();
180	0	final String additionalZipExtensions = cli.getAdditionalZipExtensions();
181	0	final String pathToMono = cli.getPathToMono();
182
183	0	if (propertiesFile != null) {
184		try {
185	0	Settings.mergeProperties(propertiesFile);
186	0	} catch (FileNotFoundException ex) {
187	0	final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath());
188	0	LOGGER.log(Level.SEVERE, msg);
189	0	LOGGER.log(Level.FINE, null, ex);
190	0	} catch (IOException ex) {
191	0	final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath());
192	0	LOGGER.log(Level.SEVERE, msg);
193	0	LOGGER.log(Level.FINE, null, ex);
194	0	}
195		}
196		// We have to wait until we've merged the properties before attempting to set whether we use
197		// the proxy for Nexus since it could be disabled in the properties, but not explicitly stated
198		// on the command line
199	0	final boolean nexusUsesProxy = cli.isNexusUsesProxy();
200	0	if (dataDirectory != null) {
201	0	Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
202	0	} else if (System.getProperty("basedir") != null) {
203	0	final File dataDir = new File(System.getProperty("basedir"), "data");
204	0	Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
205	0	} else {
206	0	final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
207	0	final File base = jarPath.getParentFile();
208	0	final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
209	0	final File dataDir = new File(base, sub);
210	0	Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
211		}
212	0	Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
213	0	if (proxyUrl != null && !proxyUrl.isEmpty()) {
214	0	Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
215		}
216	0	if (proxyPort != null && !proxyPort.isEmpty()) {
217	0	Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
218		}
219	0	if (proxyUser != null && !proxyUser.isEmpty()) {
220	0	Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser);
221		}
222	0	if (proxyPass != null && !proxyPass.isEmpty()) {
223	0	Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass);
224		}
225	0	if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
226	0	Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
227		}
228	0	if (suppressionFile != null && !suppressionFile.isEmpty()) {
229	0	Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
230		}
231
232		//File Type Analyzer Settings
233	0	Settings.setBoolean(Settings.KEYS.ANALYZER_JAR_ENABLED, !jarDisabled);
234	0	Settings.setBoolean(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, !archiveDisabled);
235	0	Settings.setBoolean(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, !nuspecDisabled);
236	0	Settings.setBoolean(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, !assemblyDisabled);
237
238	0	Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled);
239	0	if (nexusUrl != null && !nexusUrl.isEmpty()) {
240	0	Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
241		}
242	0	Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_PROXY, nexusUsesProxy);
243	0	if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
244	0	Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
245		}
246	0	if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
247	0	Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
248		}
249	0	if (connectionString != null && !connectionString.isEmpty()) {
250	0	Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
251		}
252	0	if (databaseUser != null && !databaseUser.isEmpty()) {
253	0	Settings.setString(Settings.KEYS.DB_USER, databaseUser);
254		}
255	0	if (databasePassword != null && !databasePassword.isEmpty()) {
256	0	Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
257		}
258	0	if (additionalZipExtensions != null && !additionalZipExtensions.isEmpty()) {
259	0	Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, additionalZipExtensions);
260		}
261	0	if (pathToMono != null && !pathToMono.isEmpty()) {
262	0	Settings.setString(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
263		}
264	0	}
265		}