Skip to content

Commit c57c3c2

Browse files
author
anddann
committed
apply google format and extract classpath parsing function into separate method
1 parent b5517d0 commit c57c3c2

File tree

7 files changed

+75
-64
lines changed

7 files changed

+75
-64
lines changed

‎src/main/java/de/codeshield/log4jshell/ClassDetector.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
package de.codeshield.log4jshell;
22

33
import de.codeshield.log4jshell.data.VulnerableClassSHAData;
4+
import org.apache.commons.codec.digest.DigestUtils;
5+
46
import java.io.IOException;
57
import java.io.InputStream;
68
import java.util.Set;
7-
import org.apache.commons.codec.digest.DigestUtils;
89

910
public class ClassDetector {
1011

‎src/main/java/de/codeshield/log4jshell/Log4JDetector.java‎

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
package de.codeshield.log4jshell;
22

3+
import org.apache.commons.io.FileUtils;
4+
import org.apache.commons.io.filefilter.DirectoryFileFilter;
5+
import org.apache.commons.io.filefilter.RegexFileFilter;
6+
37
import java.io.BufferedInputStream;
48
import java.io.BufferedOutputStream;
59
import java.io.File;
@@ -10,9 +14,6 @@
1014
import java.util.Enumeration;
1115
import java.util.jar.JarEntry;
1216
import java.util.jar.JarFile;
13-
import org.apache.commons.io.FileUtils;
14-
import org.apache.commons.io.filefilter.DirectoryFileFilter;
15-
import org.apache.commons.io.filefilter.RegexFileFilter;
1617

1718
/**
1819
* A simple command line tool that scans a jar file for the CVE-2021-44228 vulnerability that
@@ -37,7 +38,8 @@ public static void main(String[] args) throws IOException {
3738
detector.run(args[0]);
3839
}
3940

40-
//Taken from https://stackoverflow.com/questions/981578/how-to-unzip-files-recursively-in-java/7108813#7108813
41+
// Taken from
42+
// https://stackoverflow.com/questions/981578/how-to-unzip-files-recursively-in-java/7108813#7108813
4143
public static String extractFolder(String zipFile) throws IOException {
4244
int buffer = 2048;
4345
File file = new File(zipFile);
@@ -89,30 +91,26 @@ public static String extractFolder(String zipFile) throws IOException {
8991

9092
public boolean run(String pathToJarFile) throws IOException {
9193
String folder = extractFolder(pathToJarFile);
92-
Collection<File> pomFiles = FileUtils.listFiles(
93-
new File(folder),
94-
new RegexFileFilter("^(pom.xml)"),
95-
DirectoryFileFilter.DIRECTORY
96-
);
94+
Collection<File> pomFiles =
95+
FileUtils.listFiles(
96+
new File(folder), new RegexFileFilter("^(pom.xml)"), DirectoryFileFilter.DIRECTORY);
9797
boolean isVulnerable = false;
9898
for (File pomFile : pomFiles) {
9999
try (FileInputStream is = new FileInputStream(pomFile)) {
100-
//Check if a pom file matches one of the pre-computed groupId:artifactId:version
100+
// Check if a pom file matches one of the pre-computed groupId:artifactId:version
101101
if (POMDetector.isVulnerablePOM(is)) {
102102
isVulnerable = true;
103103
System.err.println("CVE-2021-44228 found declared as dependency in " + pomFile);
104104
}
105105
}
106106
}
107-
Collection<File> classFiles = FileUtils.listFiles(
108-
new File(folder),
109-
new RegexFileFilter(".*.class$"),
110-
DirectoryFileFilter.DIRECTORY
111-
);
107+
Collection<File> classFiles =
108+
FileUtils.listFiles(
109+
new File(folder), new RegexFileFilter(".*.class$"), DirectoryFileFilter.DIRECTORY);
112110

113111
for (File classFile : classFiles) {
114112
try (FileInputStream is = new FileInputStream(classFile)) {
115-
//Check if a class file matches one of the pre-computed vulnerable SHAs.
113+
// Check if a class file matches one of the pre-computed vulnerable SHAs.
116114
if (ClassDetector.isVulnerableClass(is)) {
117115
isVulnerable = true;
118116
System.err.println("CVE-2021-44228 found declared as dependency in " + classFile);
@@ -125,5 +123,4 @@ public boolean run(String pathToJarFile) throws IOException {
125123
FileUtils.deleteDirectory(new File(folder));
126124
return isVulnerable;
127125
}
128-
129126
}

‎src/main/java/de/codeshield/log4jshell/Log4JProcessDetector.java‎

Lines changed: 30 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package de.codeshield.log4jshell;
22

3+
import edu.emory.mathcs.backport.java.util.Collections;
34
import org.apache.commons.lang.StringUtils;
45

56
import java.io.BufferedReader;
@@ -30,32 +31,16 @@ public static void main(String[] args) throws IOException {
3031
}
3132

3233
// analyze each output
33-
// search for the "-classpath" parameter
3434
for (String outputLine : lines) {
35-
String searchStr = "-classpath";
36-
int i = StringUtils.indexOf(outputLine, searchStr);
37-
if (i == -1) {
38-
// check if someone used -cp
39-
searchStr = "-cp";
40-
i = StringUtils.indexOf(outputLine, searchStr);
41-
}
42-
43-
if (i > 0) {
44-
String cpArgs = outputLine.substring(i + searchStr.length() + 1);
45-
46-
// scan for jar files
47-
String[] cpArgsSplit = cpArgs.split(File.pathSeparator);
48-
final List<String> foundJarsOnCp =
49-
Arrays.stream(cpArgsSplit)
50-
.map(x -> StringUtils.substring(x, 0, StringUtils.indexOf(x, ".jar") + 4))
51-
.collect(Collectors.toList());
5235

36+
final List<String> foundJarsOnCp = parsePSOutPutClassPath(outputLine);
37+
if (!foundJarsOnCp.isEmpty()) {
5338
for (String jarFile : foundJarsOnCp) {
5439
try {
5540
Log4JDetector detector = new Log4JDetector();
5641
System.out.println("Scanning jar file " + jarFile);
57-
// detector.run(jarFile);
58-
} catch (Exception e){
42+
// detector.run(jarFile);
43+
} catch (Exception e) {
5944
System.out.println("Could not scan jar file " + jarFile);
6045
}
6146
}
@@ -66,4 +51,29 @@ public static void main(String[] args) throws IOException {
6651
}
6752
}
6853
}
54+
55+
public static List<String> parsePSOutPutClassPath(String outputLine) {
56+
// search for the "-classpath" parameter
57+
58+
String searchStr = "-classpath";
59+
int i = StringUtils.indexOf(outputLine, searchStr);
60+
if (i == -1) {
61+
// check if someone used -cp
62+
searchStr = "-cp";
63+
i = StringUtils.indexOf(outputLine, searchStr);
64+
}
65+
if (i > 0) {
66+
String cpArgs = outputLine.substring(i + searchStr.length() + 1);
67+
68+
// scan for jar files
69+
String[] cpArgsSplit = cpArgs.split(File.pathSeparator);
70+
final List<String> foundJarsOnCp =
71+
Arrays.stream(cpArgsSplit)
72+
.map(x -> StringUtils.substring(x, 0, StringUtils.indexOf(x, ".jar") + 4))
73+
.collect(Collectors.toList());
74+
return foundJarsOnCp;
75+
}
76+
77+
return Collections.emptyList();
78+
}
6979
}

‎src/main/java/de/codeshield/log4jshell/POMDetector.java‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,21 @@
22

33
import de.codeshield.log4jshell.data.GAVWithClassifier;
44
import de.codeshield.log4jshell.data.VulnerableGavsData;
5-
import java.io.IOException;
6-
import java.io.InputStream;
7-
import java.util.List;
8-
import java.util.Set;
95
import org.apache.maven.model.Dependency;
106
import org.apache.maven.model.Model;
117
import org.apache.maven.model.io.xpp3.MavenXpp3Reader;
128
import org.apache.maven.project.MavenProject;
139
import org.codehaus.plexus.util.xml.pull.XmlPullParserException;
1410

11+
import java.io.IOException;
12+
import java.io.InputStream;
13+
import java.util.List;
14+
import java.util.Set;
15+
1516
public class POMDetector {
1617

17-
private static final Set<GAVWithClassifier> VULNERABLE_GAV_DATA = VulnerableGavsData
18-
.readDataFromCSV();
18+
private static final Set<GAVWithClassifier> VULNERABLE_GAV_DATA =
19+
VulnerableGavsData.readDataFromCSV();
1920

2021
public static boolean isVulnerablePOM(InputStream inputStream) {
2122
final MavenXpp3Reader mavenreader = new MavenXpp3Reader();
@@ -24,21 +25,21 @@ public static boolean isVulnerablePOM(InputStream inputStream) {
2425
model = mavenreader.read(inputStream);
2526
MavenProject mavenProject = new MavenProject(model);
2627

27-
//Check whether the Maven Project or any of its parents is affected.
28+
// Check whether the Maven Project or any of its parents is affected.
2829
if (isVulnerableProject(mavenProject)) {
2930
return true;
3031
}
3132

32-
//Check if any of the dependencies is affected.
33+
// Check if any of the dependencies is affected.
3334
List dependencies = mavenProject.getDependencies();
3435
for (Object dependency : dependencies) {
3536
if (!(dependency instanceof Dependency)) {
3637
continue;
3738
}
3839
Dependency dep = (Dependency) dependency;
3940
if (VULNERABLE_GAV_DATA.contains(
40-
new GAVWithClassifier(dep.getGroupId(), dep.getArtifactId(), dep.getVersion(),
41-
dep.getClassifier()))) {
41+
new GAVWithClassifier(
42+
dep.getGroupId(), dep.getArtifactId(), dep.getVersion(), dep.getClassifier()))) {
4243
return true;
4344
}
4445
}
@@ -50,11 +51,13 @@ public static boolean isVulnerablePOM(InputStream inputStream) {
5051
return false;
5152
}
5253

53-
5454
private static boolean isVulnerableProject(MavenProject mavenProject) {
5555
if (VULNERABLE_GAV_DATA.contains(
56-
new GAVWithClassifier(mavenProject.getGroupId(), mavenProject.getArtifactId(),
57-
mavenProject.getVersion(), ""))) {
56+
new GAVWithClassifier(
57+
mavenProject.getGroupId(),
58+
mavenProject.getArtifactId(),
59+
mavenProject.getVersion(),
60+
""))) {
5861
return true;
5962
}
6063
MavenProject parent = mavenProject.getParent();

‎src/main/java/de/codeshield/log4jshell/data/GAVWithClassifier.java‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ public class GAVWithClassifier {
99
private final String version;
1010
private final String classifier;
1111

12-
public GAVWithClassifier(String groupId, String artifactId, String version,
13-
String classifier) {
12+
public GAVWithClassifier(String groupId, String artifactId, String version, String classifier) {
1413
this.groupId = groupId;
1514
this.artifactId = artifactId;
1615
this.version = version;
@@ -26,10 +25,10 @@ public boolean equals(Object o) {
2625
return false;
2726
}
2827
GAVWithClassifier that = (GAVWithClassifier) o;
29-
return Objects.equals(groupId, that.groupId) &&
30-
Objects.equals(artifactId, that.artifactId) &&
31-
Objects.equals(version, that.version) &&
32-
Objects.equals(classifier, that.classifier);
28+
return Objects.equals(groupId, that.groupId)
29+
&& Objects.equals(artifactId, that.artifactId)
30+
&& Objects.equals(version, that.version)
31+
&& Objects.equals(classifier, that.classifier);
3332
}
3433

3534
@Override

‎src/main/java/de/codeshield/log4jshell/data/VulnerableClassSHAData.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import com.opencsv.CSVReader;
44
import com.opencsv.exceptions.CsvException;
5+
56
import java.io.BufferedReader;
67
import java.io.IOException;
78
import java.io.InputStream;
@@ -22,12 +23,11 @@ public static Set<String> readDataFromCSV() {
2223
vulnerableSHAs.add(vulnerableClassSha[1]);
2324
}
2425
csvReader.close();
25-
} catch (IOException e) {
26-
System.err.println("Error reading CSV file ("+CSV_DATA+")");
26+
} catch (IOException e) {
27+
System.err.println("Error reading CSV file (" + CSV_DATA + ")");
2728
} catch (CsvException e) {
28-
System.err.println("Error parsing CSV file ("+CSV_DATA+")");
29+
System.err.println("Error parsing CSV file (" + CSV_DATA + ")");
2930
}
3031
return vulnerableSHAs;
3132
}
32-
3333
}

‎src/main/java/de/codeshield/log4jshell/data/VulnerableGavsData.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import com.opencsv.CSVReader;
44
import com.opencsv.exceptions.CsvException;
5+
56
import java.io.BufferedReader;
67
import java.io.IOException;
78
import java.io.InputStream;
@@ -16,16 +17,16 @@ public class VulnerableGavsData {
1617
public static Set<GAVWithClassifier> readDataFromCSV() {
1718
InputStream resource = VulnerableGavsData.class.getResourceAsStream(CSV_DATA);
1819
Set<GAVWithClassifier> vulnerableGavs = new HashSet<>();
19-
try (BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(resource))) {
20+
try (BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(resource))) {
2021
CSVReader csvReader = new CSVReader(bufferedReader);
2122
for (String[] dep : csvReader.readAll()) {
2223
vulnerableGavs.add(new GAVWithClassifier(dep[0], dep[1], dep[2], dep[3]));
2324
}
2425
csvReader.close();
2526
} catch (IOException e) {
26-
System.err.println("Error reading CSV file ("+CSV_DATA+")");
27+
System.err.println("Error reading CSV file (" + CSV_DATA + ")");
2728
} catch (CsvException e) {
28-
System.err.println("Error parsing CSV file ("+CSV_DATA+")");
29+
System.err.println("Error parsing CSV file (" + CSV_DATA + ")");
2930
}
3031
return vulnerableGavs;
3132
}

0 commit comments

Comments
 (0)