Coverage Report - org.owasp.dependencycheck.utils.Settings
 
Classes in this File Line Coverage Branch Coverage Complexity
Settings
51%
57/110
30%
8/26
2.421
Settings$KEYS
N/A
N/A
2.421
 
 1  
 /*
 2  
  * This file is part of dependency-check-core.
 3  
  *
 4  
  * Licensed under the Apache License, Version 2.0 (the "License");
 5  
  * you may not use this file except in compliance with the License.
 6  
  * You may obtain a copy of the License at
 7  
  *
 8  
  *     http://www.apache.org/licenses/LICENSE-2.0
 9  
  *
 10  
  * Unless required by applicable law or agreed to in writing, software
 11  
  * distributed under the License is distributed on an "AS IS" BASIS,
 12  
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 13  
  * See the License for the specific language governing permissions and
 14  
  * limitations under the License.
 15  
  *
 16  
  * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
 17  
  */
 18  
 package org.owasp.dependencycheck.utils;
 19  
 
 20  
 import java.io.File;
 21  
 import java.io.FileInputStream;
 22  
 import java.io.FileNotFoundException;
 23  
 import java.io.IOException;
 24  
 import java.io.InputStream;
 25  
 import java.io.PrintWriter;
 26  
 import java.io.StringWriter;
 27  
 import java.io.UnsupportedEncodingException;
 28  
 import java.net.URLDecoder;
 29  
 import java.util.Enumeration;
 30  
 import java.util.Properties;
 31  
 import java.util.logging.Level;
 32  
 import java.util.logging.Logger;
 33  
 
 34  
 /**
 35  
  * A simple settings container that wraps the dependencycheck.properties file.
 36  
  *
 37  
  * @author Jeremy Long <jeremy.long@owasp.org>
 38  
  */
 39  
 public final class Settings {
 40  
 
 41  
     /**
 42  
      * The logger.
 43  
      */
 44  1
     private static final Logger LOGGER = Logger.getLogger(Settings.class.getName());
 45  
 
 46  
     /**
 47  
      * The collection of keys used within the properties file.
 48  
      */
 49  
     public static final class KEYS {
 50  
 
 51  
         /**
 52  
          * private constructor because this is a "utility" class containing constants
 53  
          */
 54  
         private KEYS() {
 55  
             //do nothing
 56  
         }
 57  
         /**
 58  
          * The properties key indicating whether or not the cached data sources should be updated.
 59  
          */
 60  
         public static final String AUTO_UPDATE = "autoupdate";
 61  
         /**
 62  
          * The database driver class name. If this is not in the properties file the embedded database is used.
 63  
          */
 64  
         public static final String DB_DRIVER_NAME = "data.driver_name";
 65  
         /**
 66  
          * The database driver class name. If this is not in the properties file the embedded database is used.
 67  
          */
 68  
         public static final String DB_DRIVER_PATH = "data.driver_path";
 69  
         /**
 70  
          * The database connection string. If this is not in the properties file the embedded database is used.
 71  
          */
 72  
         public static final String DB_CONNECTION_STRING = "data.connection_string";
 73  
         /**
 74  
          * The username to use when connecting to the database.
 75  
          */
 76  
         public static final String DB_USER = "data.user";
 77  
         /**
 78  
          * The password to authenticate to the database.
 79  
          */
 80  
         public static final String DB_PASSWORD = "data.password";
 81  
         /**
 82  
          * The base path to use for the data directory (for embedded db).
 83  
          */
 84  
         public static final String DATA_DIRECTORY = "data.directory";
 85  
         /**
 86  
          * The properties key for the URL to retrieve the "meta" data from about the CVE entries.
 87  
          */
 88  
         public static final String CVE_META_URL = "cve.url.meta";
 89  
         /**
 90  
          * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using
 91  
          * the 2.0 schema.
 92  
          */
 93  
         public static final String CVE_MODIFIED_20_URL = "cve.url-2.0.modified";
 94  
         /**
 95  
          * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using
 96  
          * the 1.2 schema.
 97  
          */
 98  
         public static final String CVE_MODIFIED_12_URL = "cve.url-1.2.modified";
 99  
         /**
 100  
          * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days).
 101  
          */
 102  
         public static final String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays";
 103  
         /**
 104  
          * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with
 105  
          * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing.
 106  
          */
 107  
         public static final String CVE_START_YEAR = "cve.startyear";
 108  
         /**
 109  
          * The properties key for the CVE schema version 1.2.
 110  
          */
 111  
         public static final String CVE_SCHEMA_1_2 = "cve.url-1.2.base";
 112  
         /**
 113  
          * The properties key for the CVE schema version 2.0.
 114  
          */
 115  
         public static final String CVE_SCHEMA_2_0 = "cve.url-2.0.base";
 116  
         /**
 117  
          * The properties key for the proxy url.
 118  
          */
 119  
         public static final String PROXY_URL = "proxy.url";
 120  
         /**
 121  
          * The properties key for the proxy port - this must be an integer value.
 122  
          */
 123  
         public static final String PROXY_PORT = "proxy.port";
 124  
         /**
 125  
          * The properties key for the proxy username.
 126  
          */
 127  
         public static final String PROXY_USERNAME = "proxy.username";
 128  
         /**
 129  
          * The properties key for the proxy password.
 130  
          */
 131  
         public static final String PROXY_PASSWORD = "proxy.password";
 132  
         /**
 133  
          * The properties key for the connection timeout.
 134  
          */
 135  
         public static final String CONNECTION_TIMEOUT = "connection.timeout";
 136  
         /**
 137  
          * The location of the temporary directory.
 138  
          */
 139  
         public static final String TEMP_DIRECTORY = "temp.directory";
 140  
         /**
 141  
          * The maximum number of threads to allocate when downloading files.
 142  
          */
 143  
         public static final String MAX_DOWNLOAD_THREAD_POOL_SIZE = "max.download.threads";
 144  
         /**
 145  
          * The key for a list of suppression files.
 146  
          */
 147  
         public static final String SUPPRESSION_FILE = "suppression.file";
 148  
         /**
 149  
          * The properties key for whether the Nexus analyzer is enabled.
 150  
          */
 151  
         public static final String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled";
 152  
         /**
 153  
          * The properties key for the Nexus search URL.
 154  
          */
 155  
         public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url";
 156  
         /**
 157  
          * The properties key for using the proxy to reach Nexus.
 158  
          */
 159  
         public static final String ANALYZER_NEXUS_PROXY = "analyzer.nexus.proxy";
 160  
         /**
 161  
          * The path to mono, if available.
 162  
          */
 163  
         public static final String ANALYZER_ASSEMBLY_MONO_PATH = "analyzer.assembly.mono.path";
 164  
         /**
 165  
          * The additional configured zip file extensions, if available.
 166  
          */
 167  
         public static final String ADDITIONAL_ZIP_EXTENSIONS = "extensions.zip";
 168  
         /**
 169  
          * The properties key for whether Test Scope dependencies should be skipped.
 170  
          */
 171  
         public static final String SKIP_TEST_SCOPE = "skip.test.scope";
 172  
         /**
 173  
          * The properties key for whether Runtime Scope dependencies should be skipped.
 174  
          */
 175  
         public static final String SKIP_RUNTIME_SCOPE = "skip.runtime.scope";
 176  
         /**
 177  
          * The properties key for whether Provided Scope dependencies should be skipped.
 178  
          */
 179  
         public static final String SKIP_PROVIDED_SCOPE = "skip.provided.scope";
 180  
     }
 181  
     /**
 182  
      * The properties file location.
 183  
      */
 184  
     private static final String PROPERTIES_FILE = "dependencycheck.properties";
 185  
     /**
 186  
      * The singleton instance variable.
 187  
      */
 188  1
     private static final Settings INSTANCE = new Settings();
 189  
     /**
 190  
      * The properties.
 191  
      */
 192  1
     private Properties props = null;
 193  
 
 194  
     /**
 195  
      * Private constructor for the Settings class. This class loads the properties files.
 196  
      */
 197  1
     private Settings() {
 198  1
         InputStream in = null;
 199  1
         props = new Properties();
 200  
         try {
 201  1
             in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
 202  1
             props.load(in);
 203  0
         } catch (IOException ex) {
 204  0
             Logger.getLogger(Settings.class.getName()).log(Level.SEVERE, "Unable to load default settings.");
 205  0
             Logger.getLogger(Settings.class.getName()).log(Level.FINE, null, ex);
 206  
         } finally {
 207  1
             if (in != null) {
 208  
                 try {
 209  1
                     in.close();
 210  0
                 } catch (IOException ex) {
 211  0
                     Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex);
 212  1
                 }
 213  
             }
 214  
         }
 215  1
         logProperties("Properties loaded", props);
 216  1
     }
 217  
 
 218  
     /**
 219  
      * Logs the properties. This will not log any properties that contain 'password' in the key.
 220  
      *
 221  
      * @param header the header to print with the log message
 222  
      * @param properties the properties to log
 223  
      */
 224  
     private static void logProperties(String header, Properties properties) {
 225  2
         if (LOGGER.isLoggable(Level.FINE)) {
 226  0
             final StringWriter sw = new StringWriter();
 227  0
             PrintWriter pw = null;
 228  
             try {
 229  0
                 pw = new PrintWriter(sw);
 230  0
                 pw.format("%s:%n%n", header);
 231  0
                 final Enumeration e = properties.propertyNames();
 232  0
                 while (e.hasMoreElements()) {
 233  0
                     final String key = (String) e.nextElement();
 234  0
                     if (key.contains("password")) {
 235  0
                         pw.format("%s='*****'%n", key);
 236  
                     } else {
 237  0
                         final String value = properties.getProperty(key);
 238  0
                         if (value != null) {
 239  0
                             pw.format("%s='%s'%n", key, value);
 240  
                         }
 241  
                     }
 242  0
                 }
 243  0
                 pw.flush();
 244  0
                 LOGGER.fine(sw.toString());
 245  
             } finally {
 246  0
                 if (pw != null) {
 247  0
                     pw.close();
 248  
                 }
 249  
             }
 250  
 
 251  
         }
 252  2
     }
 253  
 
 254  
     /**
 255  
      * Sets a property value.
 256  
      *
 257  
      * @param key the key for the property
 258  
      * @param value the value for the property
 259  
      */
 260  
     public static void setString(String key, String value) {
 261  5
         INSTANCE.props.setProperty(key, value);
 262  5
         if (LOGGER.isLoggable(Level.FINE)) {
 263  0
             LOGGER.fine(String.format("Setting: %s='%s'", key, value));
 264  
         }
 265  5
     }
 266  
 
 267  
     /**
 268  
      * Sets a property value.
 269  
      *
 270  
      * @param key the key for the property
 271  
      * @param value the value for the property
 272  
      */
 273  
     public static void setBoolean(String key, boolean value) {
 274  10
         if (value) {
 275  0
             INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
 276  
         } else {
 277  10
             INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
 278  
         }
 279  10
         if (LOGGER.isLoggable(Level.FINE)) {
 280  0
             LOGGER.fine(String.format("Setting: %s='%b'", key, value));
 281  
         }
 282  10
     }
 283  
 
 284  
     /**
 285  
      * Merges a new properties file into the current properties. This method allows for the loading of a user provided
 286  
      * properties file.<br/><br/>
 287  
      * Note: even if using this method - system properties will be loaded before properties loaded from files.
 288  
      *
 289  
      * @param filePath the path to the properties file to merge.
 290  
      * @throws FileNotFoundException is thrown when the filePath points to a non-existent file
 291  
      * @throws IOException is thrown when there is an exception loading/merging the properties
 292  
      */
 293  
     public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
 294  0
         final FileInputStream fis = new FileInputStream(filePath);
 295  0
         mergeProperties(fis);
 296  0
     }
 297  
 
 298  
     /**
 299  
      * Merges a new properties file into the current properties. This method allows for the loading of a user provided
 300  
      * properties file.<br/><br/>
 301  
      * Note: even if using this method - system properties will be loaded before properties loaded from files.
 302  
      *
 303  
      * @param filePath the path to the properties file to merge.
 304  
      * @throws FileNotFoundException is thrown when the filePath points to a non-existent file
 305  
      * @throws IOException is thrown when there is an exception loading/merging the properties
 306  
      */
 307  
     public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
 308  1
         final FileInputStream fis = new FileInputStream(filePath);
 309  1
         mergeProperties(fis);
 310  1
     }
 311  
 
 312  
     /**
 313  
      * Merges a new properties file into the current properties. This method allows for the loading of a user provided
 314  
      * properties file.<br/><br/>
 315  
      * Note: even if using this method - system properties will be loaded before properties loaded from files.
 316  
      *
 317  
      * @param stream an Input Stream pointing at a properties file to merge
 318  
      * @throws IOException is thrown when there is an exception loading/merging the properties
 319  
      */
 320  
     public static void mergeProperties(InputStream stream) throws IOException {
 321  1
         INSTANCE.props.load(stream);
 322  1
         logProperties("Properties updated via merge", INSTANCE.props);
 323  1
     }
 324  
 
 325  
     /**
 326  
      * Returns a value from the properties file as a File object. If the value was specified as a system property or
 327  
      * passed in via the -Dprop=value argument - this method will return the value from the system properties before the
 328  
      * values in the contained configuration file.
 329  
      *
 330  
      * @param key the key to lookup within the properties file
 331  
      * @return the property from the properties file converted to a File object
 332  
      */
 333  
     public static File getFile(String key) {
 334  6
         final String file = getString(key);
 335  6
         if (file == null) {
 336  6
             return null;
 337  
         }
 338  0
         return new File(file);
 339  
     }
 340  
 
 341  
     /**
 342  
      * Returns a value from the properties file as a File object. If the value was specified as a system property or
 343  
      * passed in via the -Dprop=value argument - this method will return the value from the system properties before the
 344  
      * values in the contained configuration file.
 345  
      *
 346  
      * This method will check the configured base directory and will use this as the base of the file path.
 347  
      * Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder
 348  
      * containing the JAR file containing this class.
 349  
      *
 350  
      * @param key the key to lookup within the properties file
 351  
      * @return the property from the properties file converted to a File object
 352  
      */
 353  
     public static File getDataFile(String key) {
 354  35
         final String file = getString(key);
 355  35
         Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file));
 356  35
         if (file == null) {
 357  0
             return null;
 358  
         }
 359  35
         if (file.startsWith("[JAR]")) {
 360  0
             Logger.getLogger(Settings.class.getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename");
 361  0
             final File jarPath = getJarPath();
 362  0
             Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString()));
 363  0
             final File retVal = new File(jarPath, file.substring(6));
 364  0
             Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString()));
 365  0
             return retVal;
 366  
         }
 367  35
         return new File(file);
 368  
     }
 369  
 
 370  
     /**
 371  
      * Attempts to retrieve the folder containing the Jar file containing the Settings class.
 372  
      *
 373  
      * @return a File object
 374  
      */
 375  
     private static File getJarPath() {
 376  0
         final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
 377  0
         String decodedPath = ".";
 378  
         try {
 379  0
             decodedPath = URLDecoder.decode(jarPath, "UTF-8");
 380  0
         } catch (UnsupportedEncodingException ex) {
 381  0
             Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex);
 382  0
         }
 383  
 
 384  0
         final File path = new File(decodedPath);
 385  0
         if (path.getName().toLowerCase().endsWith(".jar")) {
 386  0
             return path.getParentFile();
 387  
         } else {
 388  0
             return new File(".");
 389  
         }
 390  
     }
 391  
 
 392  
     /**
 393  
      * Returns a value from the properties file. If the value was specified as a system property or passed in via the
 394  
      * -Dprop=value argument - this method will return the value from the system properties before the values in the
 395  
      * contained configuration file.
 396  
      *
 397  
      * @param key the key to lookup within the properties file
 398  
      * @param defaultValue the default value for the requested property
 399  
      * @return the property from the properties file
 400  
      */
 401  
     public static String getString(String key, String defaultValue) {
 402  45
         final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
 403  45
         return str;
 404  
     }
 405  
 
 406  
     /**
 407  
      * Returns the temporary directory.
 408  
      *
 409  
      * @return the temporary directory
 410  
      */
 411  
     public static File getTempDirectory() {
 412  12
         return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir")));
 413  
     }
 414  
 
 415  
     /**
 416  
      * Returns a value from the properties file. If the value was specified as a system property or passed in via the
 417  
      * -Dprop=value argument - this method will return the value from the system properties before the values in the
 418  
      * contained configuration file.
 419  
      *
 420  
      * @param key the key to lookup within the properties file
 421  
      * @return the property from the properties file
 422  
      */
 423  
     public static String getString(String key) {
 424  76
         return System.getProperty(key, INSTANCE.props.getProperty(key));
 425  
     }
 426  
 
 427  
     /**
 428  
      * Removes a property from the local properties collection. This is mainly used in test cases.
 429  
      *
 430  
      * @param key the property key to remove
 431  
      */
 432  
     public static void removeProperty(String key) {
 433  1
         INSTANCE.props.remove(key);
 434  1
     }
 435  
 
 436  
     /**
 437  
      * Returns an int value from the properties file. If the value was specified as a system property or passed in via
 438  
      * the -Dprop=value argument - this method will return the value from the system properties before the values in the
 439  
      * contained configuration file.
 440  
      *
 441  
      * @param key the key to lookup within the properties file
 442  
      * @return the property from the properties file
 443  
      * @throws InvalidSettingException is thrown if there is an error retrieving the setting
 444  
      */
 445  
     public static int getInt(String key) throws InvalidSettingException {
 446  
         int value;
 447  
         try {
 448  1
             value = Integer.parseInt(Settings.getString(key));
 449  0
         } catch (NumberFormatException ex) {
 450  0
             throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
 451  1
         }
 452  1
         return value;
 453  
     }
 454  
 
 455  
     /**
 456  
      * Returns an int value from the properties file. If the value was specified as a system property or passed in via
 457  
      * the -Dprop=value argument - this method will return the value from the system properties before the values in the
 458  
      * contained configuration file.
 459  
      *
 460  
      * @param key the key to lookup within the properties file
 461  
      * @param defaultValue the default value to return
 462  
      * @return the property from the properties file or the defaultValue if the property does not exist or cannot be
 463  
      * converted to an integer
 464  
      */
 465  
     public static int getInt(String key, int defaultValue) {
 466  
         int value;
 467  
         try {
 468  7
             value = Integer.parseInt(Settings.getString(key));
 469  7
         } catch (NumberFormatException ex) {
 470  7
             final String msg = String.format("Could not convert property '%s' to an int.", key);
 471  7
             Logger.getLogger(Settings.class.getName()).log(Level.FINEST, msg, ex);
 472  7
             value = defaultValue;
 473  0
         }
 474  7
         return value;
 475  
     }
 476  
 
 477  
     /**
 478  
      * Returns a long value from the properties file. If the value was specified as a system property or passed in via
 479  
      * the -Dprop=value argument - this method will return the value from the system properties before the values in the
 480  
      * contained configuration file.
 481  
      *
 482  
      * @param key the key to lookup within the properties file
 483  
      * @return the property from the properties file
 484  
      * @throws InvalidSettingException is thrown if there is an error retrieving the setting
 485  
      */
 486  
     public static long getLong(String key) throws InvalidSettingException {
 487  
         long value;
 488  
         try {
 489  1
             value = Long.parseLong(Settings.getString(key));
 490  0
         } catch (NumberFormatException ex) {
 491  0
             throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
 492  1
         }
 493  1
         return value;
 494  
     }
 495  
 
 496  
     /**
 497  
      * Returns a boolean value from the properties file. If the value was specified as a system property or passed in
 498  
      * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before
 499  
      * the values in the contained configuration file.
 500  
      *
 501  
      * @param key the key to lookup within the properties file
 502  
      * @return the property from the properties file
 503  
      * @throws InvalidSettingException is thrown if there is an error retrieving the setting
 504  
      */
 505  
     public static boolean getBoolean(String key) throws InvalidSettingException {
 506  
         boolean value;
 507  
         try {
 508  10
             value = Boolean.parseBoolean(Settings.getString(key));
 509  0
         } catch (NumberFormatException ex) {
 510  0
             throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
 511  10
         }
 512  10
         return value;
 513  
     }
 514  
 }