/*
    * This file is part of dependency-check-ant.
    *
    * Dependency-check-ant is free software: you can redistribute it and/or modify it
    * under the terms of the GNU General Public License as published by the Free
    * Software Foundation, either version 3 of the License, or (at your option) any
    * later version.
    *
    * Dependency-check-ant is distributed in the hope that it will be useful, but
   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
   * details.
   *
   * You should have received a copy of the GNU General Public License along with
   * dependency-check-ant. If not, see http://www.gnu.org/licenses/.
   *
   * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
   */
  package org.owasp.dependencycheck.taskdefs;
  
  import java.io.File;
  import java.io.IOException;
  import java.io.InputStream;
  import java.util.List;
  import java.util.logging.Level;
  import java.util.logging.LogManager;
  import java.util.logging.Logger;
  import org.apache.tools.ant.BuildException;
  import org.apache.tools.ant.Task;
  import org.apache.tools.ant.types.EnumeratedAttribute;
  import org.apache.tools.ant.types.Reference;
  import org.apache.tools.ant.types.Resource;
  import org.apache.tools.ant.types.ResourceCollection;
  import org.apache.tools.ant.types.resources.FileProvider;
  import org.apache.tools.ant.types.resources.Resources;
  import org.owasp.dependencycheck.Engine;
  import org.owasp.dependencycheck.dependency.Dependency;
  import org.owasp.dependencycheck.dependency.Vulnerability;
  import org.owasp.dependencycheck.reporting.ReportGenerator;
  import org.owasp.dependencycheck.reporting.ReportGenerator.Format;
  import org.owasp.dependencycheck.utils.Settings;
  
  /**
   * An Ant task definition to execute dependency-check during an Ant build.
   *
   * @author Jeremy Long (jeremy.long@owasp.org)
   */
  public class DependencyCheckTask extends Task {
  
      /**
       * The properties file location.
       */
      private static final String PROPERTIES_FILE = "task.properties";
      /**
       * Name of the logging properties file.
       */
      private static final String LOG_PROPERTIES_FILE = "log.properties";
  
      /**
       * Construct a new DependencyCheckTask.
       */
      public DependencyCheckTask() {
          super();
      }
      //The following code was copied Apache Ant PathConvert
      //BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert
      /**
       * Path to be converted
       */
      private Resources path = null;
      /**
       * Reference to path/fileset to convert
       */
      private Reference refid = null;
  
      /**
       * Add an arbitrary ResourceCollection.
       *
       * @param rc the ResourceCollection to add.
       * @since Ant 1.7
       */
      public void add(ResourceCollection rc) {
          if (isReference()) {
              throw new BuildException("Nested elements are not allowed when using the refid attribute.");
          }
          getPath().add(rc);
      }
  
      /**
       * Returns the path. If the path has not been initialized yet, this class is
       * synchronized, and will instantiate the path object.
       *
       * @return the path
       */
      private synchronized Resources getPath() {
          if (path == null) {
              path = new Resources(getProject());
              path.setCache(true);
          }
         return path;
     }
 
     /**
      * Learn whether the refid attribute of this element been set.
      *
      * @return true if refid is valid.
      */
     public boolean isReference() {
         return refid != null;
     }
 
     /**
      * Add a reference to a Path, FileSet, DirSet, or FileList defined
      * elsewhere.
      *
      * @param r the reference to a path, fileset, dirset or filelist.
      */
     public void setRefid(Reference r) {
         if (path != null) {
             throw new BuildException("Nested elements are not allowed when using the refid attribute.");
         }
         refid = r;
     }
 
     /**
      * If this is a reference, this method will add the referenced resource
      * collection to the collection of paths.
      *
      * @throws BuildException if the reference is not to a resource collection
      */
     private void dealWithReferences() throws BuildException {
         if (isReference()) {
             final Object o = refid.getReferencedObject(getProject());
             if (!(o instanceof ResourceCollection)) {
                 throw new BuildException("refid '" + refid.getRefId()
                         + "' does not refer to a resource collection.");
             }
             getPath().add((ResourceCollection) o);
         }
     }
     // END COPY from org.apache.tools.ant.taskdefs
     /**
      * The application name for the report.
      */
     private String applicationName = "Dependency-Check";
 
     /**
      * Get the value of applicationName.
      *
      * @return the value of applicationName
      */
     public String getApplicationName() {
         return applicationName;
     }
 
     /**
      * Set the value of applicationName.
      *
      * @param applicationName new value of applicationName
      */
     public void setApplicationName(String applicationName) {
         this.applicationName = applicationName;
     }
     /**
      * The location of the data directory that contains
      */
     private String dataDirectory = null;
 
     /**
      * Get the value of dataDirectory.
      *
      * @return the value of dataDirectory
      */
     public String getDataDirectory() {
         return dataDirectory;
     }
 
     /**
      * Set the value of dataDirectory.
      *
      * @param dataDirectory new value of dataDirectory
      */
     public void setDataDirectory(String dataDirectory) {
         this.dataDirectory = dataDirectory;
     }
     /**
      * Specifies the destination directory for the generated Dependency-Check
      * report.
      */
     private String reportOutputDirectory = ".";
 
     /**
      * Get the value of reportOutputDirectory.
      *
      * @return the value of reportOutputDirectory
      */
     public String getReportOutputDirectory() {
         return reportOutputDirectory;
     }
 
     /**
      * Set the value of reportOutputDirectory.
      *
      * @param reportOutputDirectory new value of reportOutputDirectory
      */
     public void setReportOutputDirectory(String reportOutputDirectory) {
         this.reportOutputDirectory = reportOutputDirectory;
     }
     /**
      * Specifies if the build should be failed if a CVSS score above a specified
      * level is identified. The default is 11 which means since the CVSS scores
      * are 0-10, by default the build will never fail and the CVSS score is set
      * to 11. The valid range for the fail build on CVSS is 0 to 11, where
      * anything above 10 will not cause the build to fail.
      */
     private float failBuildOnCVSS = 11;
 
     /**
      * Get the value of failBuildOnCVSS.
      *
      * @return the value of failBuildOnCVSS
      */
     public float getFailBuildOnCVSS() {
         return failBuildOnCVSS;
     }
 
     /**
      * Set the value of failBuildOnCVSS.
      *
      * @param failBuildOnCVSS new value of failBuildOnCVSS
      */
     public void setFailBuildOnCVSS(float failBuildOnCVSS) {
         this.failBuildOnCVSS = failBuildOnCVSS;
     }
     /**
      * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not
      * recommended that this be turned to false. Default is true.
      */
     private boolean autoUpdate = true;
 
     /**
      * Get the value of autoUpdate.
      *
      * @return the value of autoUpdate
      */
     public boolean isAutoUpdate() {
         return autoUpdate;
     }
 
     /**
      * Set the value of autoUpdate.
      *
      * @param autoUpdate new value of autoUpdate
      */
     public void setAutoUpdate(boolean autoUpdate) {
         this.autoUpdate = autoUpdate;
     }
     /**
      * The report format to be generated (HTML, XML, VULN, ALL). This
      * configuration option has no affect if using this within the Site plugin
      * unless the externalReport is set to true. Default is HTML.
      */
     private String reportFormat = "HTML";
 
     /**
      * Get the value of reportFormat.
      *
      * @return the value of reportFormat
      */
     public String getReportFormat() {
         return reportFormat;
     }
 
     /**
      * Set the value of reportFormat.
      *
      * @param reportFormat new value of reportFormat
      */
     public void setReportFormat(ReportFormats reportFormat) {
         this.reportFormat = reportFormat.getValue();
     }
     /**
      * The Proxy URL.
      */
     private String proxyUrl;
 
     /**
      * Get the value of proxyUrl.
      *
      * @return the value of proxyUrl
      */
     public String getProxyUrl() {
         return proxyUrl;
     }
 
     /**
      * Set the value of proxyUrl.
      *
      * @param proxyUrl new value of proxyUrl
      */
     public void setProxyUrl(String proxyUrl) {
         this.proxyUrl = proxyUrl;
     }
     /**
      * The Proxy Port.
      */
     private String proxyPort;
 
     /**
      * Get the value of proxyPort.
      *
      * @return the value of proxyPort
      */
     public String getProxyPort() {
         return proxyPort;
     }
 
     /**
      * Set the value of proxyPort.
      *
      * @param proxyPort new value of proxyPort
      */
     public void setProxyPort(String proxyPort) {
         this.proxyPort = proxyPort;
     }
     /**
      * The Connection Timeout.
      */
     private String connectionTimeout;
 
     /**
      * Get the value of connectionTimeout.
      *
      * @return the value of connectionTimeout
      */
     public String getConnectionTimeout() {
         return connectionTimeout;
     }
 
     /**
      * Set the value of connectionTimeout.
      *
      * @param connectionTimeout new value of connectionTimeout
      */
     public void setConnectionTimeout(String connectionTimeout) {
         this.connectionTimeout = connectionTimeout;
     }
 
     /**
      * Configures the logger for use by the application.
      */
     private static void prepareLogger() {
         InputStream in = null;
         try {
             in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
             LogManager.getLogManager().reset();
             LogManager.getLogManager().readConfiguration(in);
             //TODO add code to disable fine grained log file.
 //            Logger logger = LogManager.getLogManager().getLogger("");
 //            for (Handler h : logger.getHandlers()) {
 //                if (h.getFormatter(). h.toString());
 //            }
         } catch (IOException ex) {
             System.err.println(ex.toString());
             Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.SEVERE, null, ex);
         } catch (SecurityException ex) {
             Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.SEVERE, null, ex);
         } finally {
             if (in != null) {
                 try {
                     in.close();
                 } catch (Exception ex) {
                     //noinspection UnusedAssignment
                     in = null;
                 }
             }
         }
     }
 
     @Override
     public void execute() throws BuildException {
         prepareLogger();
 
         dealWithReferences();
         validateConfiguration();
         populateSettings();
 
         final Engine engine = new Engine();
         for (Resource resource : path) {
             final FileProvider provider = resource.as(FileProvider.class);
             if (provider != null) {
                 final File file = provider.getFile();
                 if (file != null && file.exists()) {
                     engine.scan(file);
                 }
             }
         }
         try {
             engine.analyzeDependencies();
             final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers());
             reporter.generateReports(reportOutputDirectory, reportFormat);
 
             if (this.failBuildOnCVSS <= 10) {
                 checkForFailure(engine.getDependencies());
             }
         } catch (IOException ex) {
             Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex);
             throw new BuildException("Unable to generate dependency-check report", ex);
         } catch (Exception ex) {
             Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.SEVERE, null, ex);
             throw new BuildException("An exception occured; unable to continue task", ex);
         }
     }
 
     /**
      * Validate the configuration to ensure the parameters have been properly
      * configured/initialized.
      *
      * @throws BuildException if the task was not configured correctly.
      */
     private void validateConfiguration() throws BuildException {
         if (path == null) {
             throw new BuildException("No project dependencies have been defined to analyze.");
         }
         if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
             throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");
         }
     }
 
     /**
      * Takes the properties supplied and updates the dependency-check settings.
      * Additionally, this sets the system properties required to change the
      * proxy url, port, and connection timeout.
      */
     private void populateSettings() {
         InputStream taskProperties = null;
         try {
             taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
             Settings.mergeProperties(taskProperties);
         } catch (IOException ex) {
             Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
             Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex);
         } finally {
             if (taskProperties != null) {
                 try {
                     taskProperties.close();
                 } catch (IOException ex) {
                     Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex);
                 }
             }
         }
         if (dataDirectory != null) {
             Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
         } else {
             final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
             final File base = jarPath.getParentFile();
             final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
             final File dataDir = new File(base, sub);
             Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
         }
 
         Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
 
         if (proxyUrl != null && !proxyUrl.isEmpty()) {
             Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
         }
         if (proxyPort != null && !proxyPort.isEmpty()) {
             Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
         }
         if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
             Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
         }
     }
 
     /**
      * Checks to see if a vulnerability has been identified with a CVSS score
      * that is above the threshold set in the configuration.
      *
      * @param dependencies the list of dependency objects
      * @throws BuildException thrown if a CVSS score is found that is higher
      * then the threshold set
      */
     private void checkForFailure(List<Dependency> dependencies) throws BuildException {
         final StringBuilder ids = new StringBuilder();
         for (Dependency d : dependencies) {
             for (Vulnerability v : d.getVulnerabilities()) {
                 if (v.getCvssScore() >= failBuildOnCVSS) {
                     if (ids.length() == 0) {
                         ids.append(v.getName());
                     } else {
                         ids.append(", ").append(v.getName());
                     }
                 }
             }
         }
         if (ids.length() > 0) {
             final String msg = String.format("%n%nDependency-Check Failure:%n"
                     + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
                     + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
             throw new BuildException(msg);
         }
     }
 
     /**
      * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN",
      * etc..
      */
     public static class ReportFormats extends EnumeratedAttribute {
 
         /**
          * Returns the list of values for the report format.
          *
          * @return the list of values for the report format
          */
         public String[] getValues() {
             int i = 0;
             final Format[] formats = Format.values();
             final String[] values = new String[formats.length];
             for (Format format : formats) {
                 values[i++] = format.name();
             }
             return values;
         }
     }
 }