tests: add pdfbox test for level 1 (#80)

chains-project · Sep 11, 2023 · 43c1ad8 · 43c1ad8
1 parent 1563d87
commit 43c1ad8
Show file tree

Hide file tree

Showing 8 changed files with 4,918 additions and 37 deletions.
diff --git a/...in/java/io/github/algomaster99/terminator/commons/fingerprint/classfile/RuntimeClass.java b/...in/java/io/github/algomaster99/terminator/commons/fingerprint/classfile/RuntimeClass.java
@@ -46,7 +46,6 @@ public static boolean isGeneratedClassExtendingMagicAccessor(byte[] classfileByt
      */
     public static boolean isBoundMethodHandle(byte[] classfileBytes) {
         ClassReader reader = new ClassReader(classfileBytes);
-        System.err.println(reader.getSuperName());
         return reader.getSuperName().equals("java/lang/invoke/BoundMethodHandle");
     }
 }
diff --git a/...or-commons/src/main/java/io/github/algomaster99/terminator/commons/jar/JarDownloader.java b/...or-commons/src/main/java/io/github/algomaster99/terminator/commons/jar/JarDownloader.java
@@ -40,6 +40,7 @@ public static String getMavenJarUrl(String groupId, String artifactId, String ve
         if (artifactJarName.isPresent()) {
             return url + artifactJarName.get();
         } else {
+            System.err.println("Could not find jar for " + url);
             LOGGER.warn("Could not find jar for {}:{}:{}", groupId, artifactId, version);
             return null;
         }

diff --git a/watchdog-agent/pom.xml b/watchdog-agent/pom.xml
@@ -73,6 +73,10 @@
               <pattern>com.fasterxml.jackson</pattern>
               <shadedPattern>rtf.com.fasterxml.jackson</shadedPattern>
             </relocation>
+            <relocation>
+              <pattern>org.apache.log4j</pattern>
+              <shadedPattern>rtf.org.apache.log4j</shadedPattern>
+            </relocation>
           </relocations>
         </configuration>
         <executions>

diff --git a/watchdog-agent/src/test/java/AgentTest.java b/watchdog-agent/src/test/java/AgentTest.java
@@ -70,48 +70,100 @@ void shouldDisallowLoadingCustomJDKClass() throws MavenInvocationException, IOEx
     // level 1: fat jar
     @Nested
     class Level1_FatJar {
-        private final Path project = Paths.get("src/test/resources/spoon-10.4.0");
 
-        @Test
-        void spoon_10_4_0_cyclonedx_2_7_4_correctSbom() throws IOException, InterruptedException {
-            // contract: spoon 10.4.0 CLI should be self-contained in a fat jar and its execution should not load any
-            // classes outside SBOM
-            assertThat(runSpoonWithSbom(project.resolve("bom.json"))).isEqualTo(0);
-        }
+        @Nested
+        class PDFBox {
+            private final Path project = Paths.get("src/test/resources/pdfbox-3.0.0");
+
+            @Test
+            void pdfbox_3_0_0_depscan_4_2_2(@TempDir Path tempDir) throws IOException, InterruptedException {
+                // contract: pdfbox 3.0.0 should fail to execute as the SBOM missed dependency. For example,
+                // picocli/CommandLine$ParameterException
+                Path output = tempDir.resolve("output.txt");
+                assertThat(runPDFBoxWithSbom(project.resolve("depscan_pdfbox-app.json"), output))
+                        .isEqualTo(1);
+            }
 
-        @Test
-        void spoon_10_4_0_cyclonedx_2_7_4_wrongSbom() throws IOException, InterruptedException {
-            // contract: spoon should not execute as the incorrect SBOM is passed (spoon-core is changed to 10.3.0)
-            assertThat(runSpoonWithSbom(project.resolve("wrong-bom.json"))).isEqualTo(1);
-        }
+            @Test
+            void pdfbox_3_0_0_buildInfoGo_1_9_9(@TempDir Path tempDir) throws IOException, InterruptedException {
+                // contract: pdfbox 3.0.0 should execute as the SBOM has every dependency
+                Path output = tempDir.resolve("output.txt");
+                assertThat(runPDFBoxWithSbom(project.resolve("build-info-go.json"), output))
+                        .isEqualTo(0);
+            }
 
-        @Test
-        void spoon_10_4_0_depscan_4_2_2() throws IOException, InterruptedException {
-            // contract: spoon should execute as the root component is within component list
-            assertThat(runSpoonWithSbom(project.resolve("sbom-universal.json"))).isEqualTo(0);
+            private int runPDFBoxWithSbom(Path sbom, Path output) throws IOException, InterruptedException {
+                Path pdfboxExecutable = project.resolve("pdfbox-app-3.0.0.jar");
+                Path workload = project.resolve("2303.11102.pdf").toAbsolutePath();
+                String agentArgs = "sbom=" + sbom;
+                String[] cmd = {
+                    "java",
+                    "-javaagent:" + getAgentPath(agentArgs),
+                    "-jar",
+                    pdfboxExecutable.toString(),
+                    "export:text",
+                    "--input",
+                    workload.toString(),
+                    "--output",
+                    output.toString()
+                };
+                ProcessBuilder pb = new ProcessBuilder(cmd);
+                pb.redirectInput(ProcessBuilder.Redirect.INHERIT);
+                pb.redirectOutput(ProcessBuilder.Redirect.INHERIT);
+                pb.redirectError(ProcessBuilder.Redirect.INHERIT);
+
+                Process p = pb.start();
+                return p.waitFor();
+            }
         }
 
-        private int runSpoonWithSbom(Path sbom) throws IOException, InterruptedException {
-            Path spoonExecutable = project.resolve("spoon-core-10.4.0-jar-with-dependencies.jar");
-            Path workload = project.resolve("Main.java").toAbsolutePath();
-            String agentArgs = "sbom=" + sbom;
-            String[] cmd = {
-                "java",
-                "-javaagent:" + getAgentPath(agentArgs),
-                "-jar",
-                spoonExecutable.toString(),
-                "--input",
-                workload.toString(),
-                "--disable-comments", // remove comments and prints in spooned/Main.java
-                "--compile" // prints bytecode in spooned-classes
-            };
-            ProcessBuilder pb = new ProcessBuilder(cmd);
-            pb.redirectInput(ProcessBuilder.Redirect.INHERIT);
-            pb.redirectOutput(ProcessBuilder.Redirect.INHERIT);
-            pb.redirectError(ProcessBuilder.Redirect.INHERIT);
+        @Nested
+        class Spoon {
+            private final Path project = Paths.get("src/test/resources/spoon-10.4.0");
 
-            Process p = pb.start();
-            return p.waitFor();
+            @Test
+            void spoon_10_4_0_cyclonedx_2_7_4_correctSbom() throws IOException, InterruptedException {
+                // contract: spoon 10.4.0 CLI should be self-contained in a fat jar and its execution should not load
+                // any
+                // classes outside SBOM
+                assertThat(runSpoonWithSbom(project.resolve("bom.json"))).isEqualTo(0);
+            }
+
+            @Test
+            void spoon_10_4_0_cyclonedx_2_7_4_wrongSbom() throws IOException, InterruptedException {
+                // contract: spoon should not execute as the incorrect SBOM is passed (spoon-core is changed to 10.3.0)
+                assertThat(runSpoonWithSbom(project.resolve("wrong-bom.json"))).isEqualTo(1);
+            }
+
+            @Test
+            void spoon_10_4_0_depscan_4_2_2() throws IOException, InterruptedException {
+                // contract: spoon should execute as the root component is within component list
+                assertThat(runSpoonWithSbom(project.resolve("sbom-universal.json")))
+                        .isEqualTo(0);
+            }
+
+            private int runSpoonWithSbom(Path sbom) throws IOException, InterruptedException {
+                Path spoonExecutable = project.resolve("spoon-core-10.4.0-jar-with-dependencies.jar");
+                Path workload = project.resolve("Main.java").toAbsolutePath();
+                String agentArgs = "sbom=" + sbom;
+                String[] cmd = {
+                    "java",
+                    "-javaagent:" + getAgentPath(agentArgs),
+                    "-jar",
+                    spoonExecutable.toString(),
+                    "--input",
+                    workload.toString(),
+                    "--disable-comments", // remove comments and prints in spooned/Main.java
+                    "--compile" // prints bytecode in spooned-classes
+                };
+                ProcessBuilder pb = new ProcessBuilder(cmd);
+                pb.redirectInput(ProcessBuilder.Redirect.INHERIT);
+                pb.redirectOutput(ProcessBuilder.Redirect.INHERIT);
+                pb.redirectError(ProcessBuilder.Redirect.INHERIT);
+
+                Process p = pb.start();
+                return p.waitFor();
+            }
         }
     }