diff --git a/.travis/check_code_style.sh b/.travis/check_code_style.sh index 9895fedea..e2e1489b2 100644 --- a/.travis/check_code_style.sh +++ b/.travis/check_code_style.sh @@ -1,10 +1,16 @@ #!/bin/bash # Download Google formatter -executable=google-java-format-1.8-all-deps.jar +executable=google-java-format-1.14.0-all-deps.jar if [[ ! -f $executable ]]; then - curl -L https://github.com/google/google-java-format/releases/download/google-java-format-1.8/google-java-format-1.8-all-deps.jar --output $executable - printf "Downloaded [%s]\n" $executable + curl -L https://github.com/google/google-java-format/releases/download/v1.14.0/$executable --fail --output $executable + res=$? + if [[ ! $res == 0 ]]; then + printf "Could not download [%s], skipping format check...\n" $executable + exit 0 + else + printf "Downloaded [%s]\n" $executable + fi fi # Java files below src/main @@ -21,7 +27,7 @@ printf "Found [%s] Java files in all modules' source directories\n" $count if [[ $1 == "format" ]]; then printf "Formatting... " - java -jar google-java-format-1.8-all-deps.jar -r --skip-sorting-imports --skip-javadoc-formatting --set-exit-if-changed @java-files.txt + java -jar $executable -r --skip-sorting-imports --skip-javadoc-formatting --set-exit-if-changed @java-files.txt status=$? if [[ $status -eq 0 ]]; then @@ -33,7 +39,7 @@ if [[ $1 == "format" ]]; then fi else printf "Checking... " - java -jar google-java-format-1.8-all-deps.jar -n --skip-sorting-imports --skip-javadoc-formatting --set-exit-if-changed @java-files.txt > non-compliant-files.txt + java -jar $executable -n --skip-sorting-imports --skip-javadoc-formatting --set-exit-if-changed @java-files.txt > non-compliant-files.txt status=$? if [[ $status -eq 0 ]]; then diff --git a/docker/readme-pages/Java.md b/docker/readme-pages/Java.md index a9d047416..82d790009 100644 --- a/docker/readme-pages/Java.md +++ b/docker/readme-pages/Java.md @@ -224,9 +224,9 @@ mvn package mvn -Dvulas initialize vulas:instr ``` -**Result:** A new JAR/WAR with suffix "-vulas-instr" will be created in folder "target/vulas/target". +**Result:** A new JAR/WAR with suffix "-steady-instr" will be created in folder "target/vulas/target". -**How does it work:** The bytecode of all the Java classes found in the JAR (WAR) will be modified as to collect information about, for instance, method execution and stack traces. This information will be uploaded to the Steady backend. Note: The modified code in the new JAR with suffix "-vulas-instr" can be inspected with decompilers such as [JD-GUI](http://jd.benow.ca/). +**How does it work:** The bytecode of all the Java classes found in the JAR (WAR) will be modified as to collect information about, for instance, method execution and stack traces. This information will be uploaded to the Steady backend. Note: The modified code in the new JAR with suffix "-steady-instr" can be inspected with decompilers such as [JD-GUI](http://jd.benow.ca/). **Troubleshooting:** diff --git a/docs/public/content/user/manuals/analysis.md b/docs/public/content/user/manuals/analysis.md index 0bd98192f..7f9f23f2c 100644 --- a/docs/public/content/user/manuals/analysis.md +++ b/docs/public/content/user/manuals/analysis.md @@ -425,11 +425,11 @@ An application's JAR or WAR, e.g., as created with `mvn package` in folder `targ #### Result -A new JAR/WAR with suffix `-vulas-instr` will be created in folder `target/vulas/target`. +A new JAR/WAR with suffix `-steady-instr` will be created in folder `target/vulas/target`. #### How does it work -The bytecode of all the Java classes found in the JAR (WAR) will be modified as to collect information about, for instance, method execution and stack traces. This information will be uploaded to the backend if the JAR (WAR) is executed. Note: The modified code in the new JAR with suffix `-vulas-instr` can be inspected with decompilers such as [JD-GUI](http://jd.benow.ca/). +The bytecode of all the Java classes found in the JAR (WAR) will be modified as to collect information about, for instance, method execution and stack traces. This information will be uploaded to the backend if the JAR (WAR) is executed. Note: The modified code in the new JAR with suffix `-steady-instr` can be inspected with decompilers such as [JD-GUI](http://jd.benow.ca/). #### Run as follows diff --git a/lang-java/pom.xml b/lang-java/pom.xml index 18c9b01b7..21aba5a0a 100644 --- a/lang-java/pom.xml +++ b/lang-java/pom.xml @@ -145,8 +145,8 @@ - + self-contained-agent-jar package @@ -157,12 +157,22 @@ jar-with-dependencies true + org.eclipse.steady.java.monitor.DynamicTransformer + + + + + @@ -179,12 +189,40 @@ META-INF/MANIFEST.MF + + - org.apache.http - org.eclipse.steady.repackaged.org.apache.http + org.apache + org.eclipse.steady.repackaged.org.apache + + + org.slf4j + org.eclipse.steady.repackaged.org.slf4j + + + org.antlr + org.eclipse.steady.repackaged.org.antlr + + + org.aopalliance + org.eclipse.steady.repackaged.org.aopalliance + + + com + org.eclipse.steady.repackaged.com + javassist org.eclipse.steady.repackaged.javassist @@ -193,6 +231,13 @@ + + + io.github.edwgiz + log4j-maven-shade-plugin-extensions + 2.17.1 + + - + + diff --git a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/AbstractVulasMojo.java b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/AbstractVulasMojo.java index 2c2eb829d..524019e7f 100644 --- a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/AbstractVulasMojo.java +++ b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/AbstractVulasMojo.java @@ -27,7 +27,6 @@ import javax.validation.constraints.NotNull; -import org.apache.commons.configuration.ConfigurationException; import org.apache.maven.artifact.Artifact; import org.apache.maven.artifact.DependencyResolutionRequiredException; import org.apache.maven.execution.MavenSession; @@ -43,7 +42,6 @@ import org.eclipse.steady.shared.enums.DigestAlgorithm; import org.eclipse.steady.shared.enums.GoalClient; import org.eclipse.steady.shared.enums.Scope; -import org.eclipse.steady.shared.json.model.Application; import org.eclipse.steady.shared.json.model.Dependency; import org.eclipse.steady.shared.json.model.Library; import org.eclipse.steady.shared.json.model.LibraryId; @@ -59,6 +57,10 @@ */ public abstract class AbstractVulasMojo extends AbstractMojo { + private static final String AGENT_ARTIFACT_NAME = "lang-java"; + + private static final String AGENT_ARTIFACT_CLASSIFIER = "jar-with-dependencies"; + private static final String INCLUDES = "vulas.maven.includes"; private static final String EXCLUDES = "vulas.maven.excludes"; @@ -97,71 +99,79 @@ public abstract class AbstractVulasMojo extends AbstractMojo { */ public final void prepareConfiguration() throws Exception { - // Delete any transient settings that remaining from a previous goal execution (if any) + // Delete any transient settings remaining from a previous goal execution (if any) final boolean contained_values = this.vulasConfiguration.clearTransientProperties(); - if (contained_values) getLog().info("Transient configuration settings deleted"); + if (contained_values) { + getLog().info("Transient configuration settings deleted"); + } // Get the configuration layer from the plugin configuration (can be null) this.vulasConfiguration.addLayerAfterSysProps( PLUGIN_CFG_LAYER, this.layeredConfiguration, null, true); + VulasConfiguration.getGlobal() + .addLayerAfterSysProps(PLUGIN_CFG_LAYER, this.layeredConfiguration, null, true); - // Check whether the application context can be established - Application app = null; - try { - app = CoreConfiguration.getAppContext(this.vulasConfiguration); - } - // In case the plugin is called w/o using the Vulas profile, project-specific settings are not - // set - // Set them using the project member - catch (ConfigurationException e) { - this.vulasConfiguration.setPropertyIfEmpty( - CoreConfiguration.APP_CTX_GROUP, this.project.getGroupId()); - this.vulasConfiguration.setPropertyIfEmpty( - CoreConfiguration.APP_CTX_ARTIF, this.project.getArtifactId()); - this.vulasConfiguration.setPropertyIfEmpty( - CoreConfiguration.APP_CTX_VERSI, this.project.getVersion()); - app = CoreConfiguration.getAppContext(this.vulasConfiguration); - } + // Set defaults + this.setDefaults(this.vulasConfiguration, this.project); + this.setDefaults(VulasConfiguration.getGlobal(), this.project); + + // Establish application context (exception thrown if not possible) + CoreConfiguration.getAppContext(this.vulasConfiguration); + + // Test how-to get the reactor POM in a reliable manner + // The following method call fails if Maven is called with option -pl + getLog().info("Top level project: " + this.session.getTopLevelProject()); + getLog().info("Execution root dir: " + this.session.getExecutionRootDirectory()); + + // Includes, excludes and ignorePoms + this.includeArtifacts = new StringList(this.vulasConfiguration.getStringArray(INCLUDES, null)); + this.excludeArtifacts = new StringList(this.vulasConfiguration.getStringArray(EXCLUDES, null)); + this.ignorePoms = this.vulasConfiguration.getConfiguration().getBoolean(IGNORE_POMS, false); + } + + /** + * Completes several {@link VulasConfiguration} settings with defaults taken + * from the given {@link MavenProject}. This is useful, for instance, if the + * Maven plugin is called using the fully-qualified plugin identifier (rather + * than including and configuring the plugin in the POM). + * @param _cfg the configuration to update with defaults + * @param _prj the Maven project from which defaults are taken + */ + private final void setDefaults(VulasConfiguration _cfg, MavenProject _prj) { + // In case the plugin is called w/o using the Maven profile, + // take project-specific settings to establish/complete the app context + _cfg.setPropertyIfEmpty(CoreConfiguration.APP_CTX_GROUP, _prj.getGroupId()); + _cfg.setPropertyIfEmpty(CoreConfiguration.APP_CTX_ARTIF, _prj.getArtifactId()); + _cfg.setPropertyIfEmpty(CoreConfiguration.APP_CTX_VERSI, _prj.getVersion()); // Set defaults for all the paths - this.vulasConfiguration.setPropertyIfEmpty( + _cfg.setPropertyIfEmpty( VulasConfiguration.TMP_DIR, - Paths.get(this.project.getBuild().getDirectory(), "vulas", "tmp").toString()); - this.vulasConfiguration.setPropertyIfEmpty( + Paths.get(_prj.getBuild().getDirectory(), "vulas", "tmp").toString()); + _cfg.setPropertyIfEmpty( CoreConfiguration.UPLOAD_DIR, - Paths.get(this.project.getBuild().getDirectory(), "vulas", "upload").toString()); - this.vulasConfiguration.setPropertyIfEmpty( - CoreConfiguration.INSTR_SRC_DIR, - Paths.get(this.project.getBuild().getDirectory()).toString()); - this.vulasConfiguration.setPropertyIfEmpty( + Paths.get(_prj.getBuild().getDirectory(), "vulas", "upload").toString()); + _cfg.setPropertyIfEmpty( + CoreConfiguration.INSTR_SRC_DIR, Paths.get(_prj.getBuild().getDirectory()).toString()); + _cfg.setPropertyIfEmpty( CoreConfiguration.INSTR_TARGET_DIR, - Paths.get(this.project.getBuild().getDirectory(), "vulas", "target").toString()); - this.vulasConfiguration.setPropertyIfEmpty( + Paths.get(_prj.getBuild().getDirectory(), "vulas", "target").toString()); + _cfg.setPropertyIfEmpty( CoreConfiguration.INSTR_INCLUDE_DIR, - Paths.get(this.project.getBuild().getDirectory(), "vulas", "include").toString()); - this.vulasConfiguration.setPropertyIfEmpty( + Paths.get(_prj.getBuild().getDirectory(), "vulas", "include").toString()); + _cfg.setPropertyIfEmpty( CoreConfiguration.INSTR_LIB_DIR, - Paths.get(this.project.getBuild().getDirectory(), "vulas", "lib").toString()); - this.vulasConfiguration.setPropertyIfEmpty( + Paths.get(_prj.getBuild().getDirectory(), "vulas", "lib").toString()); + _cfg.setPropertyIfEmpty( CoreConfiguration.REP_DIR, - Paths.get(this.project.getBuild().getDirectory(), "vulas", "report").toString()); + Paths.get(_prj.getBuild().getDirectory(), "vulas", "report").toString()); // Read app constructs from src/main/java and target/classes final String p = - Paths.get(this.project.getBuild().getOutputDirectory()).toString() + Paths.get(_prj.getBuild().getOutputDirectory()).toString() + "," - + Paths.get(this.project.getBuild().getSourceDirectory()).toString(); - this.vulasConfiguration.setPropertyIfEmpty(CoreConfiguration.APP_DIRS, p); - - // Test how-to get the reactor POM in a reliable manner - // The following method call fails if Maven is called with option -pl - getLog().info("Top level project: " + this.session.getTopLevelProject()); - getLog().info("Execution root dir: " + this.session.getExecutionRootDirectory()); - - // Includes, excludes and ignorePoms - this.includeArtifacts = new StringList(this.vulasConfiguration.getStringArray(INCLUDES, null)); - this.excludeArtifacts = new StringList(this.vulasConfiguration.getStringArray(EXCLUDES, null)); - this.ignorePoms = this.vulasConfiguration.getConfiguration().getBoolean(IGNORE_POMS, false); + + Paths.get(_prj.getBuild().getSourceDirectory()).toString(); + _cfg.setPropertyIfEmpty(CoreConfiguration.APP_DIRS, p); } /** @@ -413,4 +423,44 @@ protected final LibraryId parseGAPV(@NotNull String _string) { return new LibraryId(gapv[0], gapv[1], gapv[3]); } } + + /** + * Returns the archive used as agent (in case of dynamic instrumentation) or + * to be included in instrumented (re-written) archives (static + * instrumentation). The file has to be created with "mvn + * org.apache.maven.plugins:maven-dependency-plugin:3.2.0:copy + * -Dartifact=org.eclipse.steady:lang-java:3.2.3-SNAPSHOT:jar:jar-with-dependencies" + * before running the instr and prepare-agent goals. + * + * @return the Steady agent file + * @throws MojoExecutionException + */ + protected File getAgentJarFile() throws MojoExecutionException { + // mvn org.apache.maven.plugins:maven-dependency-plugin:3.2.0:copy + // -Dartifact=org.eclipse.steady:lang-java:3.2.3-SNAPSHOT:jar:jar-with-dependencies + /*final Artifact vulasAgentArtifact = pluginArtifactMap.get(AGENT_ARTIFACT_NAME); + if (vulasAgentArtifact == null + || !vulasAgentArtifact.hasClassifier() + || !vulasAgentArtifact.getClassifier().equals(AGENT_ARTIFACT_CLASSIFIER)) { + throw new MojoExecutionException( + "Could not found " + AGENT_ARTIFACT_NAME + ":" + AGENT_ARTIFACT_CLASSIFIER); + } + return vulasAgentArtifact.getFile();*/ + final String version = + this.vulasConfiguration.getConfiguration().getString(VulasConfiguration.VERSION); + final String agent_filename = + AGENT_ARTIFACT_NAME + "-" + version + "-" + AGENT_ARTIFACT_CLASSIFIER + ".jar"; + final Path agent = + Paths.get(this.project.getBuild().getDirectory(), "dependency", agent_filename); + if (agent == null || !agent.toFile().exists()) { + throw new MojoExecutionException( + "Could not find agent JAR [" + + agent + + "], create with [mvn org.apache.maven.plugins:maven-dependency-plugin:3.2.0:copy" + + " -Dartifact=org.eclipse.steady:lang-java:" + + version + + ":jar:jar-with-dependencies]"); + } + return agent.toFile(); + } } diff --git a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java index c4b31d910..31453541d 100644 --- a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java +++ b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java @@ -18,12 +18,10 @@ */ package org.eclipse.steady.java.mvn; -import java.io.File; import java.nio.file.Path; import java.util.Map; import org.apache.maven.artifact.Artifact; -import org.apache.maven.plugin.MojoExecutionException; import org.apache.maven.plugins.annotations.LifecyclePhase; import org.apache.maven.plugins.annotations.Mojo; import org.apache.maven.plugins.annotations.Parameter; @@ -33,11 +31,13 @@ import org.eclipse.steady.shared.util.FileUtil; /** - * This plugin analyzes all Java archives in a given Maven project in order to identify all their Java constructs. - * Those are then uploaded to a remote service for further analysis (test coverage, vulnerability assessments, archive integrity). - * The plugin can be executed for Eclipse projects through 'Run As' > 'Maven build...' > Goal 'vulas:instr'. + * This plugin analyzes all Java archives in a given Maven project in order to + * identify all their Java constructs. Those are then uploaded to a remote + * service for further analysis (test coverage, vulnerability assessments, + * archive integrity). The plugin can be executed for Eclipse projects through + * 'Run As' > 'Maven build...' > Goal 'vulas:instr'. * - * help:describe -Dplugin=org.eclipse.steady:vulas-maven-plugin + * help:describe -Dplugin=org.eclipse.steady:plugin-maven */ @Mojo( name = "instr", @@ -49,9 +49,6 @@ public class MvnPluginInstr extends AbstractVulasMojo { @Parameter(property = "plugin.artifactMap", required = true, readonly = true) private Map pluginArtifactMap; - private static final String VULAS_AGENT_ARTIFACT_NAME = "org.eclipse.steady:lang-java"; - private static final String VULAS_AGENT_ARTIFACT_CLASSIFIER = "jar-with-dependencies"; - /** {@inheritDoc} */ @Override protected void createGoal() { @@ -79,15 +76,4 @@ protected void executeGoal() throws Exception { + "]"); super.executeGoal(); } - - private File getAgentJarFile() throws MojoExecutionException { - final Artifact vulasAgentArtifact = pluginArtifactMap.get(VULAS_AGENT_ARTIFACT_NAME); - if (vulasAgentArtifact == null - || !vulasAgentArtifact.hasClassifier() - || !vulasAgentArtifact.getClassifier().equals(VULAS_AGENT_ARTIFACT_CLASSIFIER)) { - throw new MojoExecutionException( - "Could not found " + VULAS_AGENT_ARTIFACT_NAME + ":" + VULAS_AGENT_ARTIFACT_CLASSIFIER); - } - return vulasAgentArtifact.getFile(); - } } diff --git a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/VulasAgentMojo.java b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/VulasAgentMojo.java index 525cee36d..9265d746f 100644 --- a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/VulasAgentMojo.java +++ b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/VulasAgentMojo.java @@ -63,9 +63,6 @@ public class VulasAgentMojo extends AbstractVulasMojo { private static final String ECLIPSE_TEST_PLUGIN = "eclipse-test-plugin"; - private static final String VULAS_AGENT_ARTIFACT_NAME = "org.eclipse.steady:lang-java"; - private static final String VULAS_AGENT_ARTIFACT_CLASSIFIER = "jar-with-dependencies"; - /** * Name of the property used in maven-osgi-test-plugin. */ @@ -81,30 +78,22 @@ protected final class VulasAgentOptions { private final HashMap agentOptions = new HashMap<>(); /** - * Creates the options for Vulas' Java Agent and initializes them with reasonable defaults. + * Creates the options for Steady's Java agent and populates them using + * some settings from {@link VulasConfiguration}, which is created in + * {@link AbstractVulasMojo#prepareConfiguration}. */ public VulasAgentOptions() { - // prepare vulas configuration - /*try { - VulasAgentMojo.this.prepareConfiguration(); - VulasConfiguration.getGlobal().setPropertyIfEmpty(CoreConfiguration.MONI_PERIODIC_UPL_ENABLED, false); - VulasConfiguration.getGlobal().setPropertyIfEmpty(CoreConfiguration.INSTR_WRITE_CODE, false); - VulasConfiguration.getGlobal().setPropertyIfEmpty(CoreConfiguration.INSTR_MAX_STACKTRACES, 10); - VulasConfiguration.getGlobal().setPropertyIfEmpty(CoreConfiguration.INSTR_CHOOSEN_INSTR, "org.eclipse.steady.java.monitor.trace.SingleStackTraceInstrumentor"); - - } catch (Exception e) { - e.printStackTrace(); - }*/ - - // Add settings from plugin configuration - Configuration configuration = vulasConfiguration.getConfigurationLayer(PLUGIN_CFG_LAYER); - if (configuration != null) { - getLog().info("The following settings are taken from layer [" + PLUGIN_CFG_LAYER + "]:"); - final Iterator iter = configuration.getKeys(); - while (iter.hasNext()) { - final String key = iter.next(); - final Object val = configuration.getProperty(key); - String val_str = null; + final Configuration configuration = vulasConfiguration.getConfiguration(); + getLog() + .info( + "The configuration settings starting with \"vulas.core.*\" or \"vulas.shared.*\" are" + + " taken from the composite configuration:"); + final Iterator iter = configuration.getKeys(); + while (iter.hasNext()) { + final String key = iter.next(); + final Object val = configuration.getProperty(key); + String val_str = null; + if (key.startsWith("vulas.core.") || key.startsWith("vulas.shared.")) { if (val instanceof String[]) { val_str = StringUtil.join((String[]) val, ","); } else if (val instanceof ArrayList) { @@ -113,8 +102,8 @@ public VulasAgentOptions() { val_str = val.toString(); } - // Do not include exemptions, as too many would result in error "The command line is too - // long." + // Do not include exemptions, as too many would result in error "The + // command line is too long." if (key.startsWith(ExemptionBug.CFG_PREFIX) || key.startsWith(ExemptionBug.DEPRECATED_CFG_PREFIX)) { getLog().warn(" Ignoring [" + key + "=...]"); @@ -125,65 +114,6 @@ public VulasAgentOptions() { } } - // Add settings from sys properties - configuration = - vulasConfiguration.getConfigurationLayer(VulasConfiguration.SYS_PROP_CFG_LAYER); - if (configuration != null) { - getLog() - .info( - "The following settings are taken from layer [" - + VulasConfiguration.SYS_PROP_CFG_LAYER - + "]:"); - final Iterator iter = configuration.getKeys(); - while (iter.hasNext()) { - final String key = iter.next(); - final Object val = configuration.getProperty(key); - String val_str = null; - if (key.startsWith("vulas.")) { - if (val instanceof String[]) { - val_str = StringUtil.join((String[]) val, ","); - } else if (val instanceof ArrayList) { - val_str = StringUtil.join((ArrayList) val, ","); - } else { - val_str = val.toString(); - } - - // Do not include exemptions, as too many would result in error "The command line is too - // long." - if (key.startsWith(ExemptionBug.CFG_PREFIX) - || key.startsWith(ExemptionBug.DEPRECATED_CFG_PREFIX)) { - getLog().warn(" Ignoring [" + key + "=...]"); - } else { - this.agentOptions.put(key, val_str); - getLog().info(" [" + key + "=" + val + "]"); - } - } - } - } - - // If not yet present, e.g., because no plugin configuration is present, add GAV from pom.xml - if (this.agentOptions.get(CoreConfiguration.APP_CTX_GROUP) == null - || this.agentOptions.get(CoreConfiguration.APP_CTX_ARTIF) == null - || this.agentOptions.get(CoreConfiguration.APP_CTX_VERSI) == null) { - getLog().info("The following settings are taken from the project's [pom.xml]:"); - if (this.agentOptions.get(CoreConfiguration.APP_CTX_GROUP) == null) { - this.agentOptions.put(CoreConfiguration.APP_CTX_GROUP, project.getGroupId()); - getLog() - .info(" [" + CoreConfiguration.APP_CTX_GROUP + "=" + project.getGroupId() + "]"); - } - if (this.agentOptions.get(CoreConfiguration.APP_CTX_ARTIF) == null) { - this.agentOptions.put(CoreConfiguration.APP_CTX_ARTIF, project.getArtifactId()); - getLog() - .info( - " [" + CoreConfiguration.APP_CTX_ARTIF + "=" + project.getArtifactId() + "]"); - } - if (this.agentOptions.get(CoreConfiguration.APP_CTX_VERSI) == null) { - this.agentOptions.put(CoreConfiguration.APP_CTX_VERSI, project.getVersion()); - getLog() - .info(" [" + CoreConfiguration.APP_CTX_VERSI + "=" + project.getVersion() + "]"); - } - } - // Always READ_ONLY so that traces, paths, etc. will be written to disk this.agentOptions.put( CoreConfiguration.BACKEND_CONNECT, CoreConfiguration.ConnectType.READ_ONLY.toString()); @@ -197,7 +127,6 @@ public VulasAgentOptions() { } public String prependVMArguments(final String arguments, final File agentJarFile) { - CommandlineJava commandlineJava = new CommandlineJava() { @Override @@ -291,19 +220,8 @@ public void execute() throws MojoExecutionException, MojoFailureException { } // Every other exception results in a MojoExecutionException (= unexpected) catch (Exception e) { - throw new MojoExecutionException("Error during Vulas agent preparation: ", e); - } - } - - File getAgentJarFile() throws MojoExecutionException { - final Artifact vulasAgentArtifact = pluginArtifactMap.get(VULAS_AGENT_ARTIFACT_NAME); - if (vulasAgentArtifact == null - || !vulasAgentArtifact.hasClassifier() - || !vulasAgentArtifact.getClassifier().equals(VULAS_AGENT_ARTIFACT_CLASSIFIER)) { - throw new MojoExecutionException( - "Could not found " + VULAS_AGENT_ARTIFACT_NAME + ":" + VULAS_AGENT_ARTIFACT_CLASSIFIER); + throw new MojoExecutionException("Error during agent preparation: ", e); } - return vulasAgentArtifact.getFile(); } /** {@inheritDoc} */ diff --git a/rest-backend/src/main/java/org/eclipse/steady/backend/repo/DependencyRepository.java b/rest-backend/src/main/java/org/eclipse/steady/backend/repo/DependencyRepository.java index 9b5fde4d1..a693163e6 100644 --- a/rest-backend/src/main/java/org/eclipse/steady/backend/repo/DependencyRepository.java +++ b/rest-backend/src/main/java/org/eclipse/steady/backend/repo/DependencyRepository.java @@ -123,10 +123,10 @@ List findByGAV( */ @Query( "SELECT new org.eclipse.steady.backend.model.DependencyIntersection(d1, d2, COUNT(lc1))" - + " FROM Dependency d1 JOIN d1.app a1 JOIN d1.lib l1 JOIN " - + " l1.constructs lc1, Dependency d2 JOIN d2.app a2 JOIN " - + " d2.lib l2 JOIN l2.constructs lc2 WHERE a1.mvnGroup" - + " = :mvnGroup " // Given application + + " FROM Dependency d1 JOIN d1.app a1 JOIN d1.lib l1 JOIN " + + " l1.constructs lc1, Dependency d2 JOIN d2.app a2 JOIN " + + " d2.lib l2 JOIN l2.constructs lc2 WHERE a1.mvnGroup =" + + " :mvnGroup " // Given application + " AND a1.artifact = :artifact " + " AND a1.version = :version " + " AND a1.space = :space " diff --git a/rest-backend/src/main/java/org/eclipse/steady/backend/repo/LibraryRepository.java b/rest-backend/src/main/java/org/eclipse/steady/backend/repo/LibraryRepository.java index 463cd801d..cc56a0d71 100644 --- a/rest-backend/src/main/java/org/eclipse/steady/backend/repo/LibraryRepository.java +++ b/rest-backend/src/main/java/org/eclipse/steady/backend/repo/LibraryRepository.java @@ -283,15 +283,15 @@ List findAffCCs( + " candidate.mvn_group,candidate.artifact,candidate.version,count(*) as" + " candidate_pack_count from (select distinct" + " a.digest,a.id,a.mvn_group,a.artifact,a.version from (select distinct" - + " l1.digest,l1.id,lid1.mvn_group,lid1.artifact,lid1.version,c1.id as cid from" - + " lib as l1 join library_id lid1 on l1.library_id_id=lid1.id join" - + " lib_constructs as lc1 on l1.id=lc1.library_id join construct_id as c1 on" - + " lc1.constructs_id=c1.id where c1.type='PACK' ) as a join (select c.id from" - + " lib as l join lib_constructs as lc on l.id=lc.library_id join construct_id as" - + " c on lc.constructs_id=c.id where l.digest=:digest and c.type='PACK') as" - + " unknown on a.cid=unknown.id) as candidate join lib_constructs as lc3 on" - + " candidate.id=lc3.library_id join construct_id as c3 on lc3.constructs_id=c3.id " - + " where c3.type='PACK' group by" + + " l1.digest,l1.id,lid1.mvn_group,lid1.artifact,lid1.version,c1.id as cid from lib" + + " as l1 join library_id lid1 on l1.library_id_id=lid1.id join lib_constructs as" + + " lc1 on l1.id=lc1.library_id join construct_id as c1 on lc1.constructs_id=c1.id" + + " where c1.type='PACK' ) as a join (select c.id from lib as l join" + + " lib_constructs as lc on l.id=lc.library_id join construct_id as c on" + + " lc.constructs_id=c.id where l.digest=:digest and c.type='PACK') as unknown on" + + " a.cid=unknown.id) as candidate join lib_constructs as lc3 on" + + " candidate.id=lc3.library_id join construct_id as c3 on lc3.constructs_id=c3.id " + + " where c3.type='PACK' group by" + " candidate.digest,candidate.id,candidate.mvn_group,candidate.artifact,candidate.version)" + " as s, (select count(*) as unknown_pack_count from lib as l2 join" + " lib_constructs as lc2 on l2.id=lc2.library_id join construct_id as c2 on" diff --git a/rest-backend/src/main/java/org/eclipse/steady/backend/repo/V_AppVulndepRepository.java b/rest-backend/src/main/java/org/eclipse/steady/backend/repo/V_AppVulndepRepository.java index ccd745690..26d63ace5 100644 --- a/rest-backend/src/main/java/org/eclipse/steady/backend/repo/V_AppVulndepRepository.java +++ b/rest-backend/src/main/java/org/eclipse/steady/backend/repo/V_AppVulndepRepository.java @@ -139,10 +139,10 @@ public interface V_AppVulndepRepository value = " select count(*) from ( select distinct" + " latest.mvn_group,a1.artifact,latest.latest_version from ( select" - + " aa.mvn_group,aa.version as latest_version from app aa join (select app from ( " - + " select distinct b.mvn_group,max(created_at) as max from (select distinct" - + " g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app a on g.app=a.id" - + " ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " aa.mvn_group,aa.version as latest_version from app aa join (select app from ( " + + " select distinct b.mvn_group,max(created_at) as max from (select distinct" + + " g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app a on g.app=a.id )" + + " as b group by b.mvn_group ) as c join app_goal_exe as l on" + " c.max=l.created_at) as d on d.app=aa.id) as latest join app a1 on" + " latest.mvn_group=a1.mvn_group and latest.latest_version=a1.version) as f ", nativeQuery = true) @@ -167,12 +167,12 @@ public interface V_AppVulndepRepository */ @Query( value = - " select count(*) from (select distinct vd.app_group,vd.app_artifact,vd.app_version" - + " from v_app_vulndep as vd join ( select aa.mvn_group,aa.version as" - + " latest_version from app aa join (select app from ( select distinct" + " select count(*) from (select distinct vd.app_group,vd.app_artifact,vd.app_version from" + + " v_app_vulndep as vd join ( select aa.mvn_group,aa.version as latest_version" + + " from app aa join (select app from ( select distinct" + " b.mvn_group,max(created_at) as max from (select distinct" - + " g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app a on g.app=a.id" - + " ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app a on g.app=a.id )" + + " as b group by b.mvn_group ) as c join app_goal_exe as l on" + " c.max=l.created_at) as d on d.app=aa.id) as latest on" + " latest.mvn_group=vd.app_group and latest.latest_version=vd.app_version where" + " affected=true) as latest_vd ", @@ -196,11 +196,11 @@ public interface V_AppVulndepRepository value = " select count(*) from (select distinct" + " vd.app_group,vd.app_artifact,vd.app_version,vd.digest,vd.bug from v_app_vulndep" - + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join" - + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " - + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join" - + " app a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as" - + " l on c.max=l.created_at) as d on d.app=aa.id) as latest on" + + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join " + + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " + + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app" + + " a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " c.max=l.created_at) as d on d.app=aa.id) as latest on" + " latest.mvn_group=vd.app_group and latest.latest_version=vd.app_version where" + " affected=true or affected is NULL) as latest_vd ", nativeQuery = true) @@ -215,11 +215,11 @@ public interface V_AppVulndepRepository value = " select count(*) from (select distinct" + " vd.app_group,vd.app_artifact,vd.app_version,vd.digest,vd.bug from v_app_vulndep" - + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join" - + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " - + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join" - + " app a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as" - + " l on c.max=l.created_at) as d on d.app=aa.id) as latest on" + + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join " + + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " + + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app" + + " a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " c.max=l.created_at) as d on d.app=aa.id) as latest on" + " latest.mvn_group=vd.app_group and latest.latest_version=vd.app_version where" + " affected=true and NOT (scope='TEST' or scope='PROVIDED')) as latest_vd ", nativeQuery = true) @@ -233,11 +233,11 @@ public interface V_AppVulndepRepository @Query( value = " select count(*) from (select distinct vd.app_group,vd.app_artifact from v_app_vulndep" - + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join" - + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " - + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join" - + " app a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as" - + " l on c.max=l.created_at) as d on d.app=aa.id) as latest on" + + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join " + + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " + + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app" + + " a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " c.max=l.created_at) as d on d.app=aa.id) as latest on" + " latest.mvn_group=vd.app_group and latest.latest_version=vd.app_version where" + " affected=true or affected is NULL) as latest_vd ", nativeQuery = true) @@ -251,10 +251,10 @@ public interface V_AppVulndepRepository @Query( value = " select count(*) from ( select distinct latest.mvn_group,a1.artifact from ( select" - + " aa.mvn_group,aa.version as latest_version from app aa join (select app from ( " - + " select distinct b.mvn_group,max(created_at) as max from (select distinct" - + " g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app a on g.app=a.id" - + " ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " aa.mvn_group,aa.version as latest_version from app aa join (select app from ( " + + " select distinct b.mvn_group,max(created_at) as max from (select distinct" + + " g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app a on g.app=a.id )" + + " as b group by b.mvn_group ) as c join app_goal_exe as l on" + " c.max=l.created_at) as d on d.app=aa.id) as latest join app a1 on" + " latest.mvn_group=a1.mvn_group and latest.latest_version=a1.version) as f ", nativeQuery = true) @@ -268,11 +268,11 @@ public interface V_AppVulndepRepository @Query( value = " select count(*) from (select distinct vd.app_group,vd.app_artifact from v_app_vulndep" - + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join" - + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " - + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join" - + " app a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as" - + " l on c.max=l.created_at) as d on d.app=aa.id) as latest on" + + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join " + + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " + + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app" + + " a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " c.max=l.created_at) as d on d.app=aa.id) as latest on" + " latest.mvn_group=vd.app_group and latest.latest_version=vd.app_version where" + " affected=true and NOT (scope='TEST' or scope='PROVIDED')) as latest_vd ", nativeQuery = true) @@ -325,11 +325,11 @@ public interface V_AppVulndepRepository value = " select latest_vd.app_group,latest_vd.app_artifact,count(*) from (select distinct" + " vd.app_group,vd.app_artifact,vd.app_version,vd.digest,vd.bug from v_app_vulndep" - + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join" - + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " - + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join" - + " app a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as" - + " l on c.max=l.created_at) as d on d.app=aa.id) as latest on" + + " as vd join ( select aa.mvn_group,aa.version as latest_version from app aa join " + + " (select app from ( select distinct b.mvn_group,max(created_at) as max from " + + " (select distinct g.id,g.created_at,a.id,a.mvn_group from app_goal_exe g join app" + + " a on g.app=a.id ) as b group by b.mvn_group ) as c join app_goal_exe as l on" + + " c.max=l.created_at) as d on d.app=aa.id) as latest on" + " latest.mvn_group=vd.app_group and latest.latest_version=vd.app_version where" + " affected=true or affected is NULL) as latest_vd group by" + " latest_vd.app_group,latest_vd.app_artifact", diff --git a/shared/src/main/java/org/eclipse/steady/shared/cache/Cache.java b/shared/src/main/java/org/eclipse/steady/shared/cache/Cache.java index f3de02150..7dfede1e6 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/cache/Cache.java +++ b/shared/src/main/java/org/eclipse/steady/shared/cache/Cache.java @@ -33,7 +33,7 @@ */ public class Cache { - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(Cache.class); private long refreshMilli = -1; private int maxSize = -1; diff --git a/shared/src/main/java/org/eclipse/steady/shared/enums/ExportFormat.java b/shared/src/main/java/org/eclipse/steady/shared/enums/ExportFormat.java index a46052c06..d80057582 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/enums/ExportFormat.java +++ b/shared/src/main/java/org/eclipse/steady/shared/enums/ExportFormat.java @@ -31,7 +31,7 @@ public enum ExportFormat { JSON; /** Constant log */ - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(ExportFormat.class); /** Constant TXT_CSV="text/csv;charset=UTF-8" */ public static final String TXT_CSV = "text/csv;charset=UTF-8"; diff --git a/shared/src/main/java/org/eclipse/steady/shared/enums/Scope.java b/shared/src/main/java/org/eclipse/steady/shared/enums/Scope.java index ca07e5a92..32fe2d5a9 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/enums/Scope.java +++ b/shared/src/main/java/org/eclipse/steady/shared/enums/Scope.java @@ -35,7 +35,7 @@ public enum Scope { IMPORT; /** Constant log */ - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(Scope.class); /** *

fromStringArray.

diff --git a/shared/src/main/java/org/eclipse/steady/shared/enums/VulnDepOrigin.java b/shared/src/main/java/org/eclipse/steady/shared/enums/VulnDepOrigin.java index cc1184d07..72575b931 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/enums/VulnDepOrigin.java +++ b/shared/src/main/java/org/eclipse/steady/shared/enums/VulnDepOrigin.java @@ -33,7 +33,8 @@ public enum VulnDepOrigin { BUNDLEDAFFLIBID; /** Constant log */ - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(VulnDepOrigin.class); /** *

fromStringArray.

diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/JsonReader.java b/shared/src/main/java/org/eclipse/steady/shared/json/JsonReader.java index 20c29a4e4..934f6f66e 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/JsonReader.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/JsonReader.java @@ -31,7 +31,7 @@ */ public class JsonReader { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(JsonReader.class); private Class clazz; diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/JsonWriter.java b/shared/src/main/java/org/eclipse/steady/shared/json/JsonWriter.java index 388d05a80..4cb8bb0b1 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/JsonWriter.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/JsonWriter.java @@ -31,7 +31,7 @@ */ public class JsonWriter { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(JsonWriter.class); /** *

write.

diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/model/Artifact.java b/shared/src/main/java/org/eclipse/steady/shared/json/model/Artifact.java index 59331e985..63b2fcc9d 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/model/Artifact.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/model/Artifact.java @@ -23,20 +23,20 @@ import java.nio.file.Paths; import java.util.regex.Pattern; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonIgnoreProperties; + import org.apache.logging.log4j.Logger; import org.eclipse.steady.shared.enums.ProgrammingLanguage; import org.eclipse.steady.shared.util.VulasConfiguration; -import com.fasterxml.jackson.annotation.JsonIgnore; -import com.fasterxml.jackson.annotation.JsonIgnoreProperties; - /** *

Artifact class.

*/ @JsonIgnoreProperties(ignoreUnknown = true) public class Artifact implements Serializable, Comparable { - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(Artifact.class); static final Pattern VERSION_PATTERN = Pattern.compile("([\\d\\.]*)(.*)", Pattern.DOTALL); diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionBug.java b/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionBug.java index 1cff41d57..849da54d1 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionBug.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionBug.java @@ -40,7 +40,8 @@ */ public class ExemptionBug implements IExemption { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(ExemptionBug.class); private static final String ALL = "*"; diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionUnassessed.java b/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionUnassessed.java index 9cab0ddfe..bbd50e15d 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionUnassessed.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/model/ExemptionUnassessed.java @@ -28,7 +28,8 @@ */ public class ExemptionUnassessed implements IExemption { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(ExemptionUnassessed.class); /** * Configuration setting REP_EXCL_UNASS="vulas.report.exceptionExcludeUnassessed". diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/model/LibraryId.java b/shared/src/main/java/org/eclipse/steady/shared/json/model/LibraryId.java index 40c6fb8fc..6a09b3351 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/model/LibraryId.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/model/LibraryId.java @@ -20,13 +20,13 @@ import java.io.Serializable; -import org.apache.logging.log4j.Logger; - import com.fasterxml.jackson.annotation.JsonIgnore; import com.fasterxml.jackson.annotation.JsonIgnoreProperties; import com.fasterxml.jackson.annotation.JsonInclude; import com.fasterxml.jackson.annotation.JsonProperty; +import org.apache.logging.log4j.Logger; + /** * Human-readable library ID, for instance, a Maven artifact identifier. * Can be sorted using group, artifact, timestamp and version (if timestamp is null). @@ -37,7 +37,7 @@ public class LibraryId implements Serializable, Comparable { private static final long serialVersionUID = 1L; - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(LibraryId.class); @JsonIgnore private Long id; diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/model/Version.java b/shared/src/main/java/org/eclipse/steady/shared/json/model/Version.java index 8ef4f3e18..f83da9768 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/json/model/Version.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/model/Version.java @@ -29,7 +29,7 @@ */ public class Version implements Comparable { - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(Version.class); static final Pattern VERSION_PATTERN = Pattern.compile("([\\d\\.]*)(.*)", Pattern.DOTALL); diff --git a/shared/src/main/java/org/eclipse/steady/shared/json/model/mavenCentral/ResponseDoc.java b/shared/src/main/java/org/eclipse/steady/shared/json/model/mavenCentral/ResponseDoc.java index 96ca436c2..9d7487c0f 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/json/model/mavenCentral/ResponseDoc.java +++ b/shared/src/main/java/org/eclipse/steady/shared/json/model/mavenCentral/ResponseDoc.java @@ -22,14 +22,14 @@ import java.util.regex.Matcher; import java.util.regex.Pattern; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonIgnoreProperties; + import org.apache.logging.log4j.Logger; import org.eclipse.steady.shared.enums.ProgrammingLanguage; import org.eclipse.steady.shared.json.model.Artifact; import org.eclipse.steady.shared.json.model.LibraryId; -import com.fasterxml.jackson.annotation.JsonIgnore; -import com.fasterxml.jackson.annotation.JsonIgnoreProperties; - /** * Corresponds to the JSON object structure returned by the RESTful search of the Maven Central. * This class is used to de-serialize requests from Maven central and to represent artifacts to be @@ -42,7 +42,7 @@ public class ResponseDoc implements Comparable { static final Pattern VERSION_PATTERN = Pattern.compile("([\\d\\.]*)(.*)", Pattern.DOTALL); - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(ResponseDoc.class); private String id; diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/AbstractFileSearch.java b/shared/src/main/java/org/eclipse/steady/shared/util/AbstractFileSearch.java index 336ac904a..f33eedb89 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/util/AbstractFileSearch.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/AbstractFileSearch.java @@ -40,7 +40,8 @@ public class AbstractFileSearch extends SimpleFileVisitor { private static final Logger getLog() { if (AbstractFileSearch.log == null) - AbstractFileSearch.log = org.apache.logging.log4j.LogManager.getLogger(); + AbstractFileSearch.log = + org.apache.logging.log4j.LogManager.getLogger(AbstractFileSearch.class); return AbstractFileSearch.log; } diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/ConstructIdUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/ConstructIdUtil.java index 467739766..40cb23007 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/ConstructIdUtil.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/ConstructIdUtil.java @@ -31,7 +31,8 @@ */ public class ConstructIdUtil { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(ConstructIdUtil.class); /** *

filterWithRegex.

diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/DependencyUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/DependencyUtil.java index 8c8be9df6..aaca009f9 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/DependencyUtil.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/DependencyUtil.java @@ -34,7 +34,8 @@ */ public class DependencyUtil { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(DependencyUtil.class); /** * Returns a set of dependencies such that every {@link Dependency} points to a different {@link Library}. diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/DigestUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/DigestUtil.java index 2e37b5da8..5154b4aa8 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/DigestUtil.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/DigestUtil.java @@ -31,7 +31,7 @@ */ public class DigestUtil { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(DigestUtil.class); private static final char[] HEX_ARRAY = "0123456789ABCDEF".toCharArray(); diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/DirUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/DirUtil.java index 63038daa8..faedaf59a 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/DirUtil.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/DirUtil.java @@ -43,7 +43,7 @@ */ public class DirUtil { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(DirUtil.class); /** * Returns true if the given directory contains a file with the given name, false otherwise. diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/DirWithFileSearch.java b/shared/src/main/java/org/eclipse/steady/shared/util/DirWithFileSearch.java index 8b1ff6f66..76e05a93a 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/DirWithFileSearch.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/DirWithFileSearch.java @@ -31,7 +31,8 @@ */ public class DirWithFileSearch extends AbstractFileSearch { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(DirWithFileSearch.class); private String filename = null; diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/FileSearch.java b/shared/src/main/java/org/eclipse/steady/shared/util/FileSearch.java index 49d899cc2..68a9bbf2c 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/FileSearch.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/FileSearch.java @@ -29,7 +29,7 @@ */ public class FileSearch extends AbstractFileSearch { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(FileSearch.class); private String[] suffixes = null; diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java index 0d86ff2ce..283f75ab4 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java @@ -41,6 +41,8 @@ import java.security.NoSuchAlgorithmException; import java.util.HashSet; import java.util.Set; +import java.util.zip.CRC32; +import java.util.zip.Checksum; import java.util.zip.ZipInputStream; import org.apache.logging.log4j.Logger; @@ -52,7 +54,7 @@ */ public class FileUtil { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(FileUtil.class); /** * Returns the file extension of the given {@link File} or null if the file does not have an extension. @@ -443,6 +445,43 @@ public static Path getPath(String _path) { return FileUtil.getPath(_path, false); } + /** + * Returns the CRC-32 checksum for the given byte array. + * @param _bytes a byte array + * @return the CRC-32 checksum of the array + */ + public static long getCRC32(byte[] _bytes) { + Checksum checksum = new CRC32(); + checksum.update(_bytes, 0, _bytes.length); + return checksum.getValue(); + } + + /** + * Returns the CRC-32 checksum for the given {@link File}. + * Returns -1 if the checksum cannot be computed. + * @param _file a file + * @return the CRC-32 checksum of the file + */ + public static long getCRC32(File _file) { + try { + if (!_file.canRead()) throw new IOException("Cannot read file"); + + Checksum checksum = new CRC32(); + + try (final InputStream is = new FileInputStream(_file); ) { + byte[] bytes = new byte[1024]; + int bytes_read = -1; + while ((bytes_read = is.read(bytes)) != -1) { + checksum.update(bytes, 0, bytes_read); + } + return checksum.getValue(); + } + } catch (IOException e) { + FileUtil.log.error("IO Error while computing CRC-32: " + e.getMessage()); + } + return -1; + } + /** * Returns the SHA1 digest for the given file. * diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/FilenamePatternSearch.java b/shared/src/main/java/org/eclipse/steady/shared/util/FilenamePatternSearch.java index 6faa543a7..698c9fc40 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/util/FilenamePatternSearch.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/FilenamePatternSearch.java @@ -27,7 +27,7 @@ import javax.validation.constraints.NotNull; /** - * Searches for all files whose name follows a given pattern. + * Searches for all files whose name matches a given pattern. */ public class FilenamePatternSearch extends AbstractFileSearch { diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/MemoryMonitor.java b/shared/src/main/java/org/eclipse/steady/shared/util/MemoryMonitor.java index b976b34cd..da8a3617a 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/util/MemoryMonitor.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/MemoryMonitor.java @@ -25,7 +25,8 @@ */ public class MemoryMonitor implements Runnable { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = + org.apache.logging.log4j.LogManager.getLogger(MemoryMonitor.class); private long memoSleepTimeMs = 2000; // Every 2 seconds private long memoPrintTimeMs = 60000; // Every 60 seconds diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/StopWatch.java b/shared/src/main/java/org/eclipse/steady/shared/util/StopWatch.java index 52dd43dce..1cbe50511 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/StopWatch.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/StopWatch.java @@ -31,7 +31,7 @@ */ public class StopWatch { - private static Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static Logger log = org.apache.logging.log4j.LogManager.getLogger(StopWatch.class); private String id; diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/ThreadUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/ThreadUtil.java index eb7b9caee..dd4ddab0a 100755 --- a/shared/src/main/java/org/eclipse/steady/shared/util/ThreadUtil.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/ThreadUtil.java @@ -25,7 +25,7 @@ */ public class ThreadUtil { - private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + private static final Logger log = org.apache.logging.log4j.LogManager.getLogger(ThreadUtil.class); /** Constant NO_OF_THREADS="vulas.core.noThreads" */ public static final String NO_OF_THREADS = "vulas.core.noThreads"; diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/VulasConfiguration.java b/shared/src/main/java/org/eclipse/steady/shared/util/VulasConfiguration.java index 41371a65b..89e1ab249 100644 --- a/shared/src/main/java/org/eclipse/steady/shared/util/VulasConfiguration.java +++ b/shared/src/main/java/org/eclipse/steady/shared/util/VulasConfiguration.java @@ -19,13 +19,16 @@ package org.eclipse.steady.shared.util; import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; import java.io.File; import java.io.IOException; +import java.io.InputStreamReader; import java.io.UnsupportedEncodingException; import java.net.URI; import java.net.URISyntaxException; import java.net.URLClassLoader; import java.net.URLDecoder; +import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Path; import java.nio.file.Paths; @@ -89,13 +92,17 @@ public class VulasConfiguration { private static final synchronized Logger getLog() { if (VulasConfiguration.log == null) - VulasConfiguration.log = org.apache.logging.log4j.LogManager.getLogger(); + VulasConfiguration.log = + org.apache.logging.log4j.LogManager.getLogger(VulasConfiguration.class); return VulasConfiguration.log; } private static final String[] LOG_PREFIXES = new String[] {"http", "https", "vulas"}; private static VulasConfiguration global = null; + + private static final Pattern KEY_PATTERN = Pattern.compile("[a-zA-Z0-9\\._\\-]+"); + /** *

Getter for the field global.

* @@ -261,6 +268,8 @@ private void appendInitialConfigurations() { private void addConfiguration(Configuration _cfg, String _source) { if (!individualConfigurations.containsValue(_source)) { + // Remove malformed keys + this.sanitize(_cfg); individualConfigurations.put(_cfg, _source); cfg.addConfiguration(_cfg); VulasConfiguration.getLog() @@ -281,6 +290,23 @@ private void addConfiguration(Configuration _cfg, String _source) { } } + /** + * Removes keys not matching the regular expression {@link KEY_PATTERN} from + * the configuration. + * @param _cfg the configuration whose keys are checked + */ + public void sanitize(Configuration _cfg) { + final Iterator i = _cfg.getKeys(); + while (i.hasNext()) { + final String k = i.next(); + final Matcher m = KEY_PATTERN.matcher(k); + if (!m.matches()) { + getLog().warn("Configuration key [" + k + "] removed due to illegal characters"); + _cfg.clearProperty(k); + } + } + } + /** * Puts the given Configuration as a new layer at the given position and with the given name. If a layer with the same name * already exists at the given position, it will be either deleted or shifted by one position according to the boolean argument. @@ -479,7 +505,8 @@ private Map discoverConfigurationsInJarUri(String _jar_pa if (m.matches() || m_spring.matches()) { try { final Properties prop = new Properties(); - prop.load(jf.getInputStream(entry)); + // prop.load(jf.getInputStream(entry)); + prop.load(new InputStreamReader(jf.getInputStream(entry), StandardCharsets.UTF_8)); jar_configs.put(full_name, ConfigurationConverter.getConfiguration(prop)); } catch (Exception e) { getLog() @@ -532,7 +559,10 @@ private Map discoverConfigurationsInNestedJar( if (m.matches() || m_spring.matches()) { try { final Properties prop = new Properties(); - prop.load(new ByteArrayInputStream(this.readContent(_jis))); + // prop.load(new ByteArrayInputStream(this.readContent(_jis))); + prop.load( + new InputStreamReader( + new ByteArrayInputStream(this.readContent(_jis)), StandardCharsets.UTF_8)); jar_configs.put(full_name, ConfigurationConverter.getConfiguration(prop)); } catch (Exception e) { getLog() @@ -576,11 +606,13 @@ else if (entry.getName().endsWith(".jar") || entry.getName().endsWith(".war")) { * @throws IOException */ private byte[] readContent(JarInputStream _jis) throws IOException { - byte[] bytes = new byte[1024]; - while (_jis.read(bytes, 0, 1024) != -1) { - ; - } // read() - return bytes; + final ByteArrayOutputStream bos = new ByteArrayOutputStream(); + final byte[] byte_buffer = new byte[1024]; + int len = 0; + while ((len = _jis.read(byte_buffer)) != -1) { + bos.write(byte_buffer, 0, len); + } + return bos.toByteArray(); } // =============== Stuff for accessing single shared configuration settings diff --git a/shared/src/test/java/org/eclipse/steady/shared/json/VulnerableDependencyJsonTest.java b/shared/src/test/java/org/eclipse/steady/shared/json/VulnerableDependencyJsonTest.java index 783a3032a..8ac7f9f76 100644 --- a/shared/src/test/java/org/eclipse/steady/shared/json/VulnerableDependencyJsonTest.java +++ b/shared/src/test/java/org/eclipse/steady/shared/json/VulnerableDependencyJsonTest.java @@ -45,7 +45,8 @@ public class VulnerableDependencyJsonTest { @Test public void testVulnerableDependecyDeserialization() { - final Logger log = org.apache.logging.log4j.LogManager.getLogger(); + final Logger log = + org.apache.logging.log4j.LogManager.getLogger(VulnerableDependencyJsonTest.class); String vulndepstring = this.getFile("vulndepJsonExpected.json"); inputNew = (VulnerableDependency) JacksonUtil.asObject(vulndepstring, VulnerableDependency.class); diff --git a/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java b/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java index bb5b50173..5c1de0b31 100755 --- a/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java +++ b/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java @@ -55,6 +55,17 @@ public void testGetCharset() { assertEquals("UTF-8", cs.name()); } + @Test + public void testGetCRC32File() { + assertEquals( + 2321822010l, FileUtil.getCRC32(new File("./src/test/resources/steady-test.properties"))); + } + + @Test + public void testGetCRC32Bytes() { + assertEquals(4157704578l, FileUtil.getCRC32("Hello".getBytes())); + } + @Test public void testCopyFile() { try { diff --git a/shared/src/test/java/org/eclipse/steady/shared/util/VulasConfigurationTest.java b/shared/src/test/java/org/eclipse/steady/shared/util/VulasConfigurationTest.java index 180482f16..e4b7df41b 100644 --- a/shared/src/test/java/org/eclipse/steady/shared/util/VulasConfigurationTest.java +++ b/shared/src/test/java/org/eclipse/steady/shared/util/VulasConfigurationTest.java @@ -33,6 +33,7 @@ import org.apache.commons.configuration.Configuration; import org.apache.commons.configuration.ConfigurationException; +import org.apache.commons.configuration.PropertiesConfiguration; import org.eclipse.steady.shared.connectivity.Service; import org.eclipse.steady.shared.json.model.KeyValue; import org.junit.Test; @@ -238,4 +239,14 @@ public void testGetServiceHeaders() { assertEquals("AJDEY@HEX@EWX@XEH@I*QA", headers.get("X-Vulas-Client-Token")); // assertEquals("123, 456", headers.get("test")); } + + @Test + public void testSanitize() { + VulasConfiguration c1 = new VulasConfiguration(); + Configuration pc = new PropertiesConfiguration(); + pc.setProperty("abc.123", "foo"); + pc.setProperty("!@&^!@", "bar"); + c1.sanitize(pc); + assertTrue(!pc.containsKey("!@&^!@")); + } }