|
| 1 | +#!/usr/bin/env python |
| 2 | +# -*- coding: utf-8 -*- |
| 3 | +# Copyright (c) 2022 LG Electronics Inc. |
| 4 | +# SPDX-License-Identifier: Apache-2.0 |
| 5 | + |
| 6 | +import logging |
| 7 | +import json |
| 8 | +import os |
| 9 | +import subprocess |
| 10 | +import fosslight_util.constant as constant |
| 11 | +from ._binary import BinaryItem, OssItem |
| 12 | + |
| 13 | + |
| 14 | +logger = logging.getLogger(constant.LOGGER_NAME) |
| 15 | + |
| 16 | + |
| 17 | +def get_oss_ver(version): |
| 18 | + oss_version = "" |
| 19 | + |
| 20 | + if version['source'] == 'pom': |
| 21 | + if version['name'] == 'version': |
| 22 | + oss_version = version['value'] |
| 23 | + |
| 24 | + return oss_version |
| 25 | + |
| 26 | + |
| 27 | +def get_oss_lic_in_jar(data): |
| 28 | + license = "" |
| 29 | + license_raw = str(data.get("license")) |
| 30 | + split_lic = license_raw.split(':')[0] |
| 31 | + |
| 32 | + # Not NoneType but string 'None' |
| 33 | + if license_raw == "None": |
| 34 | + license = "" |
| 35 | + else: |
| 36 | + if not split_lic.startswith('http'): |
| 37 | + license = split_lic.replace(',', '') |
| 38 | + else: |
| 39 | + license = license_raw |
| 40 | + |
| 41 | + return license |
| 42 | + |
| 43 | + |
| 44 | +def merge_binary_list(owasp_items, bin_list): |
| 45 | + not_found_bin = [] |
| 46 | + |
| 47 | + # key : file_path / value : oss_list for one binary |
| 48 | + for key, value in owasp_items.items(): |
| 49 | + found = False |
| 50 | + for bin in bin_list: |
| 51 | + if bin.binary_strip_root == key: |
| 52 | + bin.set_oss_items(value, False) |
| 53 | + found = True |
| 54 | + break |
| 55 | + |
| 56 | + if not found: |
| 57 | + bin_item = BinaryItem(os.path.abspath(key)) |
| 58 | + bin_item.binary_name_without_path = os.path.basename(key) |
| 59 | + bin_item.binary_strip_root = key |
| 60 | + bin_item.set_oss_items(value) |
| 61 | + not_found_bin.append(bin_item) |
| 62 | + |
| 63 | + bin_list += not_found_bin |
| 64 | + return bin_list |
| 65 | + |
| 66 | + |
| 67 | +def ananlyze_jar_file(path_to_find_bin): |
| 68 | + remove_owasp_item = [] |
| 69 | + owasp_items = {} |
| 70 | + |
| 71 | + try: |
| 72 | + command = f"dependency-check --scan {path_to_find_bin} --out {path_to_find_bin} --disableArchive --disableAssembly --disableRetireJS --disableNodeJS \ |
| 73 | + --disableNodeAudit --disableNugetconf --disableNuspec --disableOpenSSL --disableOssIndex --disableBundleAudit -f ALL" |
| 74 | + subprocess.run(command, shell=True) |
| 75 | + |
| 76 | + json_file = os.path.join(path_to_find_bin, 'dependency-check-report.json') |
| 77 | + |
| 78 | + try: |
| 79 | + with open(json_file, 'r') as f: |
| 80 | + jar_contents = json.load(f) |
| 81 | + |
| 82 | + dependencies = jar_contents.get("dependencies") |
| 83 | + for val in dependencies: |
| 84 | + bin_with_path = "" |
| 85 | + oss_name = "" |
| 86 | + oss_ver = "" |
| 87 | + oss_artifactid = "" |
| 88 | + oss_groupid = "" |
| 89 | + oss_dl_url = "" |
| 90 | + oss_license = get_oss_lic_in_jar(val) |
| 91 | + get_oss_info = False |
| 92 | + |
| 93 | + all_evidence = val.get("evidenceCollected") |
| 94 | + vendor_evidences = all_evidence.get('vendorEvidence') |
| 95 | + product_evidences = all_evidence.get('productEvidence') |
| 96 | + version_evidences = all_evidence.get('versionEvidence') |
| 97 | + |
| 98 | + # Check if the file is .jar file |
| 99 | + # Even if the oss info is from pom.xml in jar file, the file name will be .jar file. |
| 100 | + # But the oss info from pom.xml could be different from .jar file. |
| 101 | + bin_with_path = val.get("filePath") |
| 102 | + if not bin_with_path.endswith('.jar'): |
| 103 | + bin_with_path = bin_with_path.split('.jar')[0] + '.jar' |
| 104 | + |
| 105 | + file_with_path = os.path.relpath(bin_with_path, path_to_find_bin) |
| 106 | + # Get Version info from versionEvidence |
| 107 | + for version_info in version_evidences: |
| 108 | + oss_ver = get_oss_ver(version_info) |
| 109 | + |
| 110 | + # Get Artifact ID, Group ID, OSS Name from vendorEvidence |
| 111 | + for vendor_info in vendor_evidences: |
| 112 | + # Get OSS Info from POM |
| 113 | + if vendor_info['source'] == 'pom': |
| 114 | + if vendor_info['name'] == 'artifactid': |
| 115 | + oss_artifactid = vendor_info['value'] |
| 116 | + if vendor_info['name'] == 'groupid': |
| 117 | + oss_groupid = vendor_info['value'] |
| 118 | + if vendor_info['name'] == 'url': |
| 119 | + oss_dl_url = vendor_info['value'] |
| 120 | + if oss_artifactid != "" and oss_groupid != "": |
| 121 | + oss_name = f"{oss_groupid}:{oss_artifactid}" |
| 122 | + |
| 123 | + # Check if get oss_name and version from pom |
| 124 | + if oss_name != "" and oss_ver != "": |
| 125 | + get_oss_info = True |
| 126 | + |
| 127 | + # If there is no pom.mxl in .jar file, get oss info from MANIFEST.MF file |
| 128 | + if get_oss_info is False: |
| 129 | + for product_info in product_evidences: |
| 130 | + if product_info['source'] == 'Manifest': |
| 131 | + if oss_name == "" and (product_info['name'] == 'Implementation-Title' or product_info['name'] == 'specification-title'): |
| 132 | + oss_name = product_info['value'] |
| 133 | + if oss_ver == "" and (product_info['name'] == 'Implementation-Version' or product_info['name'] == 'Bundle-Version'): |
| 134 | + oss_ver = product_info['value'] |
| 135 | + |
| 136 | + oss = OssItem(oss_name, oss_ver, oss_license, oss_dl_url) |
| 137 | + oss.set_comment("OWASP Result. ") |
| 138 | + |
| 139 | + remove_owasp_item = owasp_items.get(file_with_path) |
| 140 | + if remove_owasp_item: |
| 141 | + remove_owasp_item.append(oss) |
| 142 | + else: |
| 143 | + owasp_items[file_with_path] = [oss] |
| 144 | + |
| 145 | + except Exception as ex: |
| 146 | + logger.warning(f"Error to read json file : {ex}") |
| 147 | + except Exception as ex: |
| 148 | + logger.warning(f"Error to use dependency-check : {ex}") |
| 149 | + |
| 150 | + return owasp_items |
0 commit comments