Skip to content

feat: Add Java binary catalogers #1392

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kzantow merged 1 commit into from
Dec 8, 2022
Merged

feat: Add Java binary catalogers #1392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions syft/pkg/cataloger/binary/cataloger_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,62 @@ func TestClassifierCataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
},
},
},
{
name: "positive-java-openjdk",
fixtureDir: "test-fixtures/classifiers/positive/openjdk",
expected: pkg.Package{
Name: "java",
Version: "1.8.0_352-b08",
Type: "binary",
Locations: singleLocation("java"),
Metadata: pkg.BinaryMetadata{
Classifier: "java-binary-openjdk",
VirtualPath: "java",
},
},
},
{
name: "positive-java-oracle",
fixtureDir: "test-fixtures/classifiers/positive/oracle",
expected: pkg.Package{
Name: "java",
Version: "19.0.1+10-21",
Type: "binary",
Locations: singleLocation("java"),
Metadata: pkg.BinaryMetadata{
Classifier: "java-binary-oracle",
VirtualPath: "java",
},
},
},
{
name: "positive-java-oracle-macos",
fixtureDir: "test-fixtures/classifiers/positive/oracle-macos",
expected: pkg.Package{
Name: "java",
Version: "19.0.1+10-21",
Type: "binary",
Locations: singleLocation("java"),
Metadata: pkg.BinaryMetadata{
Classifier: "java-binary-oracle",
VirtualPath: "java",
},
},
},
{
name: "positive-java-ibm",
fixtureDir: "test-fixtures/classifiers/positive/ibm",
expected: pkg.Package{
Name: "java",
Version: "1.8.0-foreman_2022_09_22_15_30-b00",
Type: "binary",
Locations: singleLocation("java"),
Metadata: pkg.BinaryMetadata{
Classifier: "java-binary-ibm",
VirtualPath: "java",
},
},
},
}

for _, test := range tests {
Expand Down
30 changes: 11 additions & 19 deletions syft/pkg/cataloger/binary/classifier.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,22 +81,10 @@ func fileNameTemplateVersionMatcher(fileNamePattern string, contentTemplate stri
}

matchMetadata := internal.MatchNamedCaptureGroups(tmplPattern, string(contents))

version, ok := matchMetadata["version"]
if ok {
return singlePackage(classifier, reader, version), nil
}

return nil, nil
return singlePackage(classifier, reader, matchMetadata), nil
}
}

func patternEndingWithNull(pattern string) string {
bytes := []byte(pattern)
bytes = append(bytes, 0)
return string(bytes)
}

func fileContentsVersionMatcher(pattern string) evidenceMatcher {
pat := regexp.MustCompile(pattern)
return func(classifier classifier, reader source.LocationReadCloser) ([]pkg.Package, error) {
Expand All @@ -106,11 +94,7 @@ func fileContentsVersionMatcher(pattern string) evidenceMatcher {
}

matchMetadata := internal.MatchNamedCaptureGroups(pat, string(contents))
version, ok := matchMetadata["version"]
if ok {
return singlePackage(classifier, reader, version), nil
}
return nil, nil
return singlePackage(classifier, reader, matchMetadata), nil
}
}

Expand All @@ -122,10 +106,18 @@ func mustPURL(purl string) packageurl.PackageURL {
return p
}

func singlePackage(classifier classifier, reader source.LocationReadCloser, version string) []pkg.Package {
func singlePackage(classifier classifier, reader source.LocationReadCloser, matchMetadata map[string]string) []pkg.Package {
version, ok := matchMetadata["version"]
if !ok {
return nil
}

update := matchMetadata["update"]

var cpes []pkg.CPE
for _, cpe := range classifier.CPEs {
cpe.Version = version
cpe.Update = update
cpes = append(cpes, cpe)
}

Expand Down
32 changes: 30 additions & 2 deletions syft/pkg/cataloger/binary/default_classifiers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,39 @@ var defaultClassifiers = []classifier{
{
Class: "go-binary",
FileGlob: "**/go",
EvidenceMatcher: fileContentsVersionMatcher(patternEndingWithNull(
`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)`)),
EvidenceMatcher: fileContentsVersionMatcher(
`(?m)go(?P<version>[0-9]+\.[0-9]+(\.[0-9]+|beta[0-9]+|alpha[0-9]+|rc[0-9]+)?)\x00`),
Package: "go",
CPEs: singleCPE("cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"),
},
{
Class: "java-binary-openjdk",
FileGlob: "**/java",
EvidenceMatcher: fileContentsVersionMatcher(
// [NUL]openjdk[NUL]java[NUL]1.8[NUL]1.8.0_352-b08[NUL]
`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]+)\x00(?P<version>[0-9]+[-._a-zA-Z0-9]+)\x00`),
Package: "java",
// TODO the updates might need to be part of the CPE, like: 1.8.0:update152
Copy link
Copy Markdown
Contributor

@spiffcs spiffcs Dec 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this TODO still apply? Are there any changes we have to make in the CPE generation logic?

Copy link
Copy Markdown
Contributor Author

@kzantow kzantow Dec 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Spiffs yes I think the TODO is still possibly applicable, but for now I think it's okay to just surface the entire version string because that's what the package managers are doing. I think they will all have the same potential problem matching against the CPEs and I'd rather find a solution for all java packages instead of just these classifiers. It needs more investigation

CPEs: singleCPE("cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*"),
},
{
Class: "java-binary-ibm",
FileGlob: "**/java",
EvidenceMatcher: fileContentsVersionMatcher(
// [NUL]java[NUL]1.8[NUL][NUL][NUL][NUL]1.8.0-foreman_2022_09_22_15_30-b00[NUL]
Comment thread
kzantow marked this conversation as resolved.
`(?m)\x00java\x00(?P<release>[0-9]+[.0-9]+)\x00{4}(?P<version>[0-9]+[-._a-zA-Z0-9]+)\x00`),
Package: "java",
CPEs: singleCPE("cpe:2.3:a:ibm:java:*:*:*:*:*:*:*:*"),
},
{
Class: "java-binary-oracle",
FileGlob: "**/java",
EvidenceMatcher: fileContentsVersionMatcher(
// [NUL]19.0.1+10-21[NUL]
`(?m)\x00(?P<version>[0-9]+[.0-9]+[+][-0-9]+)\x00`),
Package: "java",
CPEs: singleCPE("cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"),
},
{
Class: "nodejs-binary",
FileGlob: "**/node",
Expand Down
Binary file added syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/ibm/java
View file
Open in desktop
Binary file not shown.
Binary file added syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/openjdk/java
View file
Open in desktop
Binary file not shown.
Binary file added syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/oracle-macos/java
View file
Open in desktop
Binary file not shown.
Binary file added syft/pkg/cataloger/binary/test-fixtures/classifiers/positive/oracle/java
View file
Open in desktop
Binary file not shown.