Skip to content

Commit 08199d0

Browse files
chadlwilsonchadlwilson
committed
test: avoid polluting test classpaths with sample dependencies to be scanned
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
1 parent 7326243 commit 08199d0

17 files changed

+196
-334
lines changed

‎core/pom.xml‎

Lines changed: 141 additions & 224 deletions
Large diffs are not rendered by default.

‎core/src/test/java/org/owasp/dependencycheck/BaseTest.java‎

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
*/
1616
package org.owasp.dependencycheck;
1717

18-
import io.github.jeremylong.jcs3.slf4j.Slf4jAdapter;
1918
import org.junit.jupiter.api.AfterAll;
2019
import org.junit.jupiter.api.AfterEach;
2120
import org.junit.jupiter.api.BeforeEach;
@@ -24,8 +23,7 @@
2423
import java.io.File;
2524
import java.io.InputStream;
2625
import java.net.URISyntaxException;
27-
28-
import static org.junit.jupiter.api.Assumptions.assumeTrue;
26+
import java.util.Objects;
2927

3028
/**
3129
*
@@ -43,8 +41,6 @@ public abstract class BaseTest {
4341
*/
4442
@BeforeEach
4543
public void setUp() throws Exception {
46-
System.setProperty("jcs.logSystem", "slf4j");
47-
Slf4jAdapter.muteLogging(true);
4844
settings = new Settings();
4945
}
5046

@@ -69,42 +65,33 @@ public static void tearDownClass() {
6965
}
7066

7167
/**
72-
* Returns the given resource as an InputStream using the object's class
73-
* loader. The org.junit.Assume API is used so that test cases are skipped
74-
* if the resource is not available.
68+
* Returns the given resource as an InputStream using the object's class loader.
7569
*
7670
* @param o the object used to obtain a reference to the class loader
7771
* @param resource the name of the resource to load
7872
* @return the resource as an InputStream
7973
*/
8074
public static InputStream getResourceAsStream(Object o, String resource) {
81-
getResourceAsFile(o, resource);
82-
return o.getClass().getClassLoader().getResourceAsStream(resource);
75+
return Objects.requireNonNull(o.getClass().getClassLoader().getResourceAsStream(resource), resource + " not found on classpath");
8376
}
8477

8578
/**
86-
* Returns the given resource as a File using the object's class loader. The
87-
* org.junit.Assume API is used so that test cases are skipped if the
88-
* resource is not available.
79+
* Returns the given resource as a File using the object's class loader.
8980
*
9081
* @param o the object used to obtain a reference to the class loader
9182
* @param resource the name of the resource to load
9283
* @return the resource as an File
9384
*/
9485
public static File getResourceAsFile(Object o, String resource) {
9586
try {
96-
File f = new File(o.getClass().getClassLoader().getResource(resource).toURI().getPath());
97-
assumeTrue(f.exists(), String.format("%n%n[SEVERE] Unable to load resource for test case: %s%n%n", resource));
98-
return f;
87+
return new File(Objects.requireNonNull(o.getClass().getClassLoader().getResource(resource), resource + " not found on classpath").toURI().getPath());
9988
} catch (URISyntaxException e) {
10089
throw new UnsupportedOperationException(e);
10190
}
10291
}
10392

10493
/**
105-
* Returns the settings for the test cases.
106-
*
107-
* @return
94+
* @return the settings for the test cases.
10895
*/
10996
protected Settings getSettings() {
11097
return settings;

‎core/src/test/java/org/owasp/dependencycheck/EngineIT.java‎

Lines changed: 21 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
*/
1818
package org.owasp.dependencycheck;
1919

20+
import org.hamcrest.Matchers;
2021
import org.junit.jupiter.api.Test;
2122
import org.junit.jupiter.api.extension.ExtendWith;
2223
import org.mockito.Mock;
@@ -29,12 +30,12 @@
2930

3031
import java.io.File;
3132
import java.util.ArrayList;
32-
import java.util.HashSet;
3333
import java.util.List;
34-
import java.util.Set;
3534
import java.util.concurrent.ExecutorService;
3635
import java.util.concurrent.Executors;
36+
import java.util.stream.Collectors;
3737

38+
import static org.hamcrest.MatcherAssert.assertThat;
3839
import static org.junit.jupiter.api.Assertions.assertEquals;
3940
import static org.junit.jupiter.api.Assertions.assertThrows;
4041
import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -85,13 +86,9 @@ void exceptionDuringAnalysisTaskExecutionIsFatal() throws DatabaseException {
8586

8687
/**
8788
* Test running the entire engine.
88-
*
89-
* @throws org.owasp.dependencycheck.data.nvdcve.DatabaseException
90-
* @throws org.owasp.dependencycheck.exception.ReportException
91-
* @throws org.owasp.dependencycheck.exception.ExceptionCollection
9289
*/
9390
@Test
94-
void testEngine() throws DatabaseException, ReportException, ExceptionCollection {
91+
void testEngine() throws DatabaseException, ReportException {
9592
String testClasses = "target/test-classes";
9693
getSettings().setBoolean(Settings.KEYS.AUTO_UPDATE, false);
9794
getSettings().setBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, false);
@@ -100,38 +97,29 @@ void testEngine() throws DatabaseException, ReportException, ExceptionCollection
10097
getSettings().setBoolean(Settings.KEYS.ANALYZER_EXPERIMENTAL_ENABLED, true);
10198
getSettings().setBoolean(Settings.KEYS.ANALYZER_BUNDLE_AUDIT_ENABLED, false);
10299
getSettings().setBoolean(Settings.KEYS.ANALYZER_MIX_AUDIT_ENABLED, false);
103-
ExceptionCollection exceptions = null;
104100
try (Engine instance = new Engine(getSettings())) {
105101
instance.scan(testClasses);
106102
assertTrue(instance.getDependencies().length > 0);
103+
104+
ExceptionCollection exceptions = null;
107105
try {
108106
instance.analyzeDependencies();
109107
} catch (ExceptionCollection ex) {
110-
Set<String> allowedMessages = new HashSet<>();
111-
allowedMessages.add("bundle-audit");
112-
allowedMessages.add("mix_audit");
113-
allowedMessages.add("AssemblyAnalyzer");
114-
allowedMessages.add("Failed to request component-reports");
115-
allowedMessages.add("ailed to read results from the NPM Audit API");
116-
allowedMessages.add("../tmp/evil.txt");
117-
allowedMessages.add("malformed input off : 5, length : 1");
118-
allowedMessages.add("Python `pyproject.toml` found and there is not a `poetry.lock` or `requirements.txt`");
119-
allowedMessages.add("file from the NPM Audit API (PnpmAuditAnalyzer)");
120-
for (Throwable t : ex.getExceptions()) {
121-
boolean isOk = false;
122-
if (t.getMessage() != null) {
123-
for (String msg : allowedMessages) {
124-
if (t.getMessage().contains(msg)) {
125-
isOk = true;
126-
break;
127-
}
128-
}
129-
}
130-
if (!isOk) {
131-
throw ex;
132-
}
133-
exceptions = ex;
134-
}
108+
List<String> allowedMessages = List.of(
109+
"../tmp/evil.txt",
110+
"invalid LOC header (bad entry name)",
111+
"malformed input off : 5, length : 1",
112+
"Python `pyproject.toml` found and there is not a `poetry.lock` or `requirements.txt`"
113+
);
114+
115+
List<Throwable> unexpectedErrors = ex.getExceptions()
116+
.stream()
117+
.filter(t -> allowedMessages.stream().noneMatch(msg -> t.toString().contains(msg)))
118+
.collect(Collectors.toList());
119+
120+
assertThat("Analysis threw exceptions that weren't expected", unexpectedErrors, Matchers.empty());
121+
122+
exceptions = ex;
135123
}
136124
instance.writeReports("dependency-check sample", new File("./target/"), "ALL", exceptions);
137125
}

‎core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerIT.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ void testAnalyze() throws Exception {
137137
try (Engine engine = new Engine(settings)) {
138138

139139
instance.prepare(engine);
140-
File file = BaseTest.getResourceAsFile(this, "daytrader-ear-2.1.7.ear");
140+
File file = BaseTest.getResourceAsFile(this, "maven-lib/daytrader-ear-2.1.7.ear");
141141
Dependency dependency = new Dependency(file);
142142

143143
int initial_size = engine.getDependencies().length;
@@ -230,8 +230,6 @@ void testAnalyzeTar() throws Exception {
230230
try (Engine engine = new Engine(settings)) {
231231
instance.prepare(null);
232232

233-
//File file = new File(this.getClass().getClassLoader().getResource("file.tar").getPath());
234-
//File file = new File(this.getClass().getClassLoader().getResource("stagedhttp-modified.tar").getPath());
235233
File file = BaseTest.getResourceAsFile(this, "stagedhttp-modified.tar");
236234
Dependency dependency = new Dependency(file);
237235

@@ -261,7 +259,6 @@ void testAnalyzeTarGz() throws Exception {
261259
try (Engine engine = new Engine(settings)) {
262260
instance.prepare(null);
263261

264-
//File file = new File(this.getClass().getClassLoader().getResource("file.tar.gz").getPath());
265262
File file = BaseTest.getResourceAsFile(this, "file.tar.gz");
266263
//Dependency dependency = new Dependency(file);
267264

@@ -322,7 +319,6 @@ void testAnalyzeTgz() throws Exception {
322319
try (Engine engine = new Engine(settings)) {
323320
instance.prepare(null);
324321

325-
//File file = new File(this.getClass().getClassLoader().getResource("file.tgz").getPath());
326322
File file = BaseTest.getResourceAsFile(this, "file.tgz");
327323
int initial_size = engine.getDependencies().length;
328324
engine.scan(file);
@@ -408,7 +404,6 @@ void testAnalyze_badZip() throws Exception {
408404
try (Engine engine = new Engine(settings)) {
409405
instance.prepare(null);
410406

411-
//File file = new File(this.getClass().getClassLoader().getResource("test.zip").getPath());
412407
File file = BaseTest.getResourceAsFile(this, "test.zip");
413408
Dependency dependency = new Dependency(file);
414409
int initial_size = engine.getDependencies().length;

‎core/src/test/java/org/owasp/dependencycheck/analyzer/CPEAnalyzerIT.java‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,12 @@ void testDetermineCPE_full() throws Exception {
109109
cpeSuppression.initialize(getSettings());
110110
cpeSuppression.prepare(e);
111111

112-
//callDetermineCPE_full("hazelcast-2.5.jar", "cpe:2.3:a:hazelcast:hazelcast:2.5:*:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
113-
callDetermineCPE_full("spring-context-support-2.5.5.jar", "cpe:2.3:a:springsource:spring_framework:2.5.5:*:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
112+
callDetermineCPE_full("maven-lib/spring-context-support-2.5.5.jar", "cpe:2.3:a:springsource:spring_framework:2.5.5:*:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
114113
callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:2.3:a:pivotal_software:spring_framework:3.0.0:release:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
115114
callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:2.3:a:springsource:spring_framework:3.0.0:release:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
116115
callDetermineCPE_full("jaxb-xercesImpl-1.5.jar", null, cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
117-
callDetermineCPE_full("ehcache-core-2.2.0.jar", null, cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
118-
callDetermineCPE_full("xstream-1.4.8.jar", "cpe:2.3:a:xstream_project:xstream:1.4.8:*:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
116+
callDetermineCPE_full("maven-lib/ehcache-core-2.2.0.jar", null, cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
117+
callDetermineCPE_full("maven-lib/xstream-1.4.8.jar", "cpe:2.3:a:xstream_project:xstream:1.4.8:*:*:*:*:*:*:*", cpeAnalyzer, fnAnalyzer, jarAnalyzer, hAnalyzer, fp, cpeSuppression);
119118
} finally {
120119
cpeAnalyzer.close();
121120
}
@@ -137,7 +136,6 @@ void testDetermineCPE_full() throws Exception {
137136
private void callDetermineCPE_full(String depName, String expResult, CPEAnalyzer cpeAnalyzer, FileNameAnalyzer fnAnalyzer,
138137
JarAnalyzer jarAnalyzer, HintAnalyzer hAnalyzer, FalsePositiveAnalyzer fp, CpeSuppressionAnalyzer cpeSuppression) throws Exception {
139138

140-
//File file = new File(this.getClass().getClassLoader().getResource(depName).getPath());
141139
File file = BaseTest.getResourceAsFile(this, depName);
142140

143141
Dependency dep = new Dependency(file);
@@ -170,9 +168,7 @@ private void callDetermineCPE_full(String depName, String expResult, CPEAnalyzer
170168
*/
171169
@Test
172170
void testDetermineCPE() throws Exception {
173-
//File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
174-
File file = BaseTest.getResourceAsFile(this, "struts2-core-2.1.2.jar");
175-
//File file = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath());
171+
File file = BaseTest.getResourceAsFile(this, "maven-lib/struts2-core-2.1.2.jar");
176172
Dependency struts = new Dependency(file);
177173
try (Engine engine = new Engine(getSettings())) {
178174
CpeSuppressionAnalyzer suppressionAnalyzer = new CpeSuppressionAnalyzer();
@@ -192,19 +188,16 @@ void testDetermineCPE() throws Exception {
192188

193189
jarAnalyzer.analyze(struts, engine);
194190
hintAnalyzer.analyze(struts, engine);
195-
//File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath());
196191
File fileCommonValidator = BaseTest.getResourceAsFile(this, "commons-validator-1.4.0.jar");
197192
Dependency commonValidator = new Dependency(fileCommonValidator);
198193
jarAnalyzer.analyze(commonValidator, engine);
199194
hintAnalyzer.analyze(commonValidator, engine);
200195

201-
//File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath());
202-
File fileSpring = BaseTest.getResourceAsFile(this, "spring-core-2.5.5.jar");
196+
File fileSpring = BaseTest.getResourceAsFile(this, "maven-lib/spring-core-2.5.5.jar");
203197
Dependency spring = new Dependency(fileSpring);
204198
jarAnalyzer.analyze(spring, engine);
205199
hintAnalyzer.analyze(spring, engine);
206200

207-
//File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath());
208201
File fileSpring3 = BaseTest.getResourceAsFile(this, "spring-core-3.0.0.RELEASE.jar");
209202
Dependency spring3 = new Dependency(fileSpring3);
210203
jarAnalyzer.analyze(spring3, engine);

‎core/src/test/java/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzerIT.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ void testGetAnalysisPhase() {
6666
@Test
6767
void testAnalyze() throws Exception {
6868

69-
File file = BaseTest.getResourceAsFile(this, "commons-fileupload-1.2.1.jar");
69+
File file = BaseTest.getResourceAsFile(this, "maven-lib/commons-fileupload-1.2.1.jar");
7070
File suppression = BaseTest.getResourceAsFile(this, "commons-fileupload-1.2.1.suppression.xml");
7171
getSettings().setBoolean(Settings.KEYS.AUTO_UPDATE, false);
7272
getSettings().setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, false);

‎core/src/test/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzerTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ void testGetMainSwiftDependency() {
233233
void testGetMainAndroidDependency() throws Exception {
234234
ArchiveAnalyzer aa = null;
235235
try (Engine engine = new Engine(Engine.Mode.EVIDENCE_COLLECTION, getSettings())) {
236-
Dependency dependency1 = new Dependency(BaseTest.getResourceAsFile(this, "aar-1.0.0.aar"));
236+
Dependency dependency1 = new Dependency(BaseTest.getResourceAsFile(this, "maven-lib/aar-1.0.0.aar"));
237237
dependency1.setEcosystem(Ecosystem.JAVA);
238238
aa = new ArchiveAnalyzer();
239239

‎core/src/test/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.java‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,11 +61,9 @@ void testGetAnalysisPhase() {
6161
*/
6262
@Test
6363
void testAnalyze() throws Exception {
64-
//File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
65-
File struts = BaseTest.getResourceAsFile(this, "struts2-core-2.1.2.jar");
64+
File struts = BaseTest.getResourceAsFile(this, "maven-lib/struts2-core-2.1.2.jar");
6665
Dependency resultStruts = new Dependency(struts);
67-
//File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath());
68-
File axis = BaseTest.getResourceAsFile(this, "axis2-adb-1.4.1.jar");
66+
File axis = BaseTest.getResourceAsFile(this, "maven-lib/axis2-adb-1.4.1.jar");
6967
Dependency resultAxis = new Dependency(axis);
7068
FileNameAnalyzer instance = new FileNameAnalyzer();
7169
instance.analyze(resultStruts, null);

‎core/src/test/java/org/owasp/dependencycheck/analyzer/HintAnalyzerTest.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,8 @@ void testGetAnalysisPhase() {
6464
*/
6565
@Test
6666
void testAnalyze() throws Exception {
67-
//File guice = new File(this.getClass().getClassLoader().getResource("guice-3.0.jar").getPath());
68-
File guice = BaseTest.getResourceAsFile(this, "guice-3.0.jar");
67+
File guice = BaseTest.getResourceAsFile(this, "maven-lib/guice-3.0.jar");
6968
//Dependency guice = new EngineDependency(fileg);
70-
//File spring = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath());
7169
File spring = BaseTest.getResourceAsFile(this, "spring-core-3.0.0.RELEASE.jar");
7270
//Dependency spring = new Dependency(files);
7371
getSettings().setBoolean(Settings.KEYS.AUTO_UPDATE, false);

‎core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,7 @@ class JarAnalyzerTest extends BaseTest {
4848
*/
4949
@Test
5050
void testAnalyze() throws Exception {
51-
//File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath());
52-
File file = BaseTest.getResourceAsFile(this, "struts2-core-2.1.2.jar");
51+
File file = BaseTest.getResourceAsFile(this, "maven-lib/struts2-core-2.1.2.jar");
5352
Dependency result = new Dependency(file);
5453
JarAnalyzer instance = new JarAnalyzer();
5554
instance.initialize(getSettings());
@@ -115,7 +114,7 @@ void testAnalyze() throws Exception {
115114

116115
@Test
117116
void testAddMatchingValues() throws Exception {
118-
File file = BaseTest.getResourceAsFile(this, "struts2-core-2.1.2.jar");
117+
File file = BaseTest.getResourceAsFile(this, "maven-lib/struts2-core-2.1.2.jar");
119118
Dependency dependency = new Dependency(file);
120119
JarAnalyzer instance = new JarAnalyzer();
121120
instance.initialize(getSettings());
@@ -172,7 +171,7 @@ void testGetName() {
172171

173172
@Test
174173
void testParseManifest() throws Exception {
175-
File file = BaseTest.getResourceAsFile(this, "xalan-2.7.0.jar");
174+
File file = BaseTest.getResourceAsFile(this, "maven-lib/xalan-2.7.0.jar");
176175
Dependency result = new Dependency(file);
177176
JarAnalyzer instance = new JarAnalyzer();
178177
List<JarAnalyzer.ClassNameInformation> cni = new ArrayList<>();

0 commit comments

Comments
 (0)