org.owasp.dependencycheck.utils.PyPACoreMetadataParser Maven / Gradle / Ivy
/*
* This file is part of dependency-check-core.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* Copyright (c) 2013 Jeremy Long. All Rights Reserved.
*/
package org.owasp.dependencycheck.utils;
import org.apache.commons.lang3.StringUtils;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.BufferedReader;
import java.io.File;
import java.io.IOException;
import java.math.BigDecimal;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.util.Properties;
/**
* A utility class to handle Python Packaging Authority (PyPA) core metadata files. It was created based on the
* specification by PyPA for
* version 2.2
*
* @author Hans Aikema
*/
public final class PyPACoreMetadataParser {
/**
* The logger.
*/
private static final Logger LOGGER = LoggerFactory.getLogger(PyPACoreMetadataParser.class);
/**
* The largest major version considered by this parser
*/
private static final int SUPPORTED_MAJOR_UPPERBOUND = 2;
/**
* The largest version of the specification considered during coding of this parser
*/
private static final BigDecimal MAX_SUPPORTED_VERSION = BigDecimal.valueOf(22, 1);
private PyPACoreMetadataParser() {
// hide constructor for utility class
}
/**
* Loads all key/value pairs from PyPA metadata specifications¶.
*
* @param file
* The Wheel metadata of a Python package as a File
*
* @return The metadata properties read from the file
*/
public static Properties getProperties(File file) throws AnalysisException {
try (BufferedReader utf8Reader = Files.newBufferedReader(file.toPath(), StandardCharsets.UTF_8)) {
return getProperties(utf8Reader);
} catch (IOException | IllegalArgumentException e) {
throw new AnalysisException("Error parsing PyPA core-metadata file", e);
}
}
/**
* Loads all key/value pairs from PyPA metadata specifications¶.
*
* @param utf8Reader
* The Wheel metadata of a Python package as a BufferedReader
*
* @return The metadata properties read from the utf8Reader
* @throws java.io.IOException thrown if there is error reading the properties
*/
public static Properties getProperties(final BufferedReader utf8Reader) throws IOException {
final Properties result = new Properties();
String line = utf8Reader.readLine();
StringBuilder singleHeader = null;
boolean inDescription = false;
while (line != null && !line.isEmpty()) {
if (inDescription && line.startsWith(" |")) {
singleHeader.append('\n').append(line.substring(8));
} else if (singleHeader != null && line.startsWith(" ")) {
singleHeader.append(line.substring(1));
} else {
if (singleHeader != null) {
parseAndAddHeader(result, singleHeader);
}
singleHeader = new StringBuilder(line);
inDescription = line.startsWith("Description:");
}
line = utf8Reader.readLine();
}
if (singleHeader != null) {
parseAndAddHeader(result, singleHeader);
}
// ignore a body if any (description is allowed to be the message body)
return result;
}
/**
* Add a single metadata keyvalue pair to the metadata. When the given metadataHeader cannot be parsed as a '{@code key: value}'
* line a warning is emitted and the line is ignored.
*
* @param metadata
* The collected metadata to which the new metadataHeader must be added
* @param metadataHeader
* A single uncollapsed header line of the metadata
*
* @throws IllegalArgumentException
* When the given metadataHeader has a key {@code Metadata-Version} and the value holds a major version that is larger
* than the highest supported metadata version. As defined by the specification: Automated tools consuming
* metadata SHOULD warn if metadata_version is greater than the highest version they support, and MUST fail if
* metadata_version has a greater major version than the highest version they support (as described in PEP 440, the
* major version is the value before the first dot).
*/
private static void parseAndAddHeader(final Properties metadata, final StringBuilder metadataHeader) {
final String[] keyValue = StringUtils.split(metadataHeader.toString(), ":", 2);
if (keyValue.length != 2) {
LOGGER.warn("Invalid mailheader format encountered in Wheel Metadata, not a \"key: value\" string");
return;
}
final String key = keyValue[0];
final String value = keyValue[1].trim();
if ("Metadata-Version".equals(key)) {
final int majorVersion = Integer.parseInt(value.substring(0, value.indexOf('.')), 10);
final BigDecimal version = new BigDecimal(value);
if (majorVersion > SUPPORTED_MAJOR_UPPERBOUND) {
throw new IllegalArgumentException(String.format(
"Unsupported PyPA Wheel metadata. Metadata-Version " + "is '%s', largest supported major is %d", value,
SUPPORTED_MAJOR_UPPERBOUND));
} else if (version.compareTo(MAX_SUPPORTED_VERSION) > 0 && LOGGER.isWarnEnabled()) {
LOGGER.warn(String.format("Wheel metadata Metadata-Version (%s) has a larger minor version than the highest known "
+ "supported Metadata specification (%s) continuing with best effort", value,
MAX_SUPPORTED_VERSION));
}
}
metadata.setProperty(key, value);
}
}