Skip to content

Commit 303adab

Browse files
fate93930fate93930
committed
add dependency
1 parent c3ac901 commit 303adab

18 files changed

+300
-17
lines changed

‎JavaProbe/JavaProbe.iml

+4
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@
1111
<orderEntry type="sourceFolder" forTests="false" />
1212
<orderEntry type="library" name="gson-2.7" level="project" />
1313
<orderEntry type="library" name="bcprov-jdk15on-162" level="project" />
14+
<orderEntry type="library" name="spring-boot-loader-2.1.3.RELEASE" level="project" />
15+
<orderEntry type="library" scope="TEST" name="Maven: junit:junit:4.12" level="project" />
16+
<orderEntry type="library" scope="TEST" name="Maven: org.hamcrest:hamcrest-core:1.3" level="project" />
17+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-loader:2.1.3.RELEASE" level="project" />
1418
<orderEntry type="library" name="Maven: commons-io:commons-io:2.6" level="project" />
1519
</component>
1620
</module>

‎JavaProbe/out/artifacts/JavaProbe_jar/JavaProbe.jar

-12 MB
Binary file not shown.

‎JavaProbe/pom.xml

+7-8
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
44
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
55
<modelVersion>4.0.0</modelVersion>
6-
76
<groupId>groupId</groupId>
87
<artifactId>JavaProb</artifactId>
98
<version>1.0-SNAPSHOT</version>
@@ -15,17 +14,17 @@
1514
<version>4.12</version>
1615
<scope>test</scope>
1716
</dependency>
18-
<dependency>
19-
<groupId>commons-io</groupId>
20-
<artifactId>commons-io</artifactId>
21-
<version>2.6</version>
22-
</dependency>
2317
<dependency>
2418
<groupId>org.springframework.boot</groupId>
2519
<artifactId>spring-boot-loader</artifactId>
2620
<version>2.1.3.RELEASE</version>
27-
<scope>provided</scope>
21+
</dependency>
22+
<dependency>
23+
<groupId>commons-io</groupId>
24+
<artifactId>commons-io</artifactId>
25+
<version>2.6</version>
2826
</dependency>
27+
2928
</dependencies>
3029

31-
</project>
30+
</project>

‎JavaProbe/src/entity/DependencyInfo.java

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package entity;
2+
3+
/**
4+
* @author fate
5+
* @date 2019-11-12 下午6:30
6+
* 依赖信息实体
7+
*/
8+
public class DependencyInfo {
9+
10+
private String version;
11+
12+
private String groupId;
13+
14+
private String artifactId;
15+
16+
public String getVersion() {
17+
return version;
18+
}
19+
20+
public void setVersion(String version) {
21+
this.version = version;
22+
}
23+
24+
public String getGroupId() {
25+
return groupId;
26+
}
27+
28+
public void setGroupId(String groupId) {
29+
this.groupId = groupId;
30+
}
31+
32+
public String getArtifactId() {
33+
return artifactId;
34+
}
35+
36+
public void setArtifactId(String artifactId) {
37+
this.artifactId = artifactId;
38+
}
39+
}

‎JavaProbe/src/entity/JvmInfo.java

+11
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package entity;
22

3+
import java.security.PrivateKey;
34
import java.util.ArrayList;
45
import java.util.HashMap;
56
import java.util.List;
@@ -35,6 +36,16 @@ public class JvmInfo {
3536

3637
private Map<String,String> jarPathMap = new HashMap<String, String>(); // 存放可能存在jar的路径呀
3738

39+
private List<DependencyInfo> dependencyInfoList = new ArrayList<DependencyInfo>(); // 存放jar包依赖，用于生成依赖文件，方便对整个应用进行漏洞跟踪
40+
41+
public List<DependencyInfo> getDependencyInfoList() {
42+
return dependencyInfoList;
43+
}
44+
45+
public void setDependencyInfoList(List<DependencyInfo> dependencyInfoList) {
46+
this.dependencyInfoList = dependencyInfoList;
47+
}
48+
3849
public String getExceTime() {
3950
return exceTime;
4051
}

‎JavaProbe/src/maven/EasyJarHandle.java

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
package maven;
2+
3+
import common.CommonUtil;
4+
import entity.DependencyInfo;
5+
6+
import java.io.File;
7+
import java.util.Enumeration;
8+
import java.util.List;
9+
import java.util.Properties;
10+
import java.util.jar.JarEntry;
11+
import java.util.jar.JarFile;
12+
13+
/**
14+
* @author fate
15+
* @date 2019-11-22 下午12:05
16+
*/
17+
public class EasyJarHandle {
18+
19+
/**
20+
* 获取依赖信息
21+
* @param jarpath jar文件路径
22+
* @param dependencyInfoList 存放依赖包数据的list
23+
* @return
24+
*/
25+
public static List<DependencyInfo> getDependencyInfo(String jarpath, List<DependencyInfo> dependencyInfoList) {
26+
27+
try {
28+
29+
File jarDict = new File(jarpath.replace("file:","").replace("WEB-INF/classes/", "WEB-INF/lib/"));
30+
31+
for (File file : jarDict.listFiles()) {
32+
33+
if (file.isFile() && file.getName().endsWith(".jar")) {
34+
35+
JarFile jarFile = new JarFile(file);
36+
37+
Enumeration<JarEntry> jarEntryEnumeration = jarFile.entries();
38+
39+
while (jarEntryEnumeration.hasMoreElements()) {
40+
41+
JarEntry jarEntry= jarEntryEnumeration.nextElement();
42+
43+
if (jarEntry.getName().endsWith("/pom.properties")) {
44+
45+
Properties prop = new Properties();
46+
prop.load(jarFile.getInputStream(jarEntry));
47+
48+
DependencyInfo dependencyInfo = new DependencyInfo(); // 存放依赖信息
49+
dependencyInfo.setArtifactId(prop.getProperty("artifactId"));
50+
dependencyInfo.setGroupId(prop.getProperty("groupId"));
51+
dependencyInfo.setVersion(prop.getProperty("version"));
52+
53+
dependencyInfoList.add(dependencyInfo);
54+
}
55+
}
56+
}
57+
}
58+
}
59+
catch (Exception e) {
60+
61+
CommonUtil.writeStr("/tmp/jvm_error.txt","getDependencyInfo_byeasy:\t" + e.getMessage());
62+
}
63+
64+
return dependencyInfoList;
65+
}
66+
67+
}

‎JavaProbe/src/maven/FatJarHandle.java

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
package maven;
2+
import common.CommonUtil;
3+
import entity.DependencyInfo;
4+
import org.springframework.boot.loader.jar.JarFile; // 偷懒 直接使用springboot的
5+
import java.io.File;
6+
import java.util.Enumeration;
7+
import java.util.List;
8+
import java.util.Properties;
9+
import java.util.jar.JarEntry;
10+
11+
/**
12+
* @author fate
13+
* @date 2019-11-22 上午11:38
14+
* 用于处理fat jar资源的获取
15+
*/
16+
public class FatJarHandle {
17+
18+
/**
19+
* fat jar 依赖文件的获取，多用于处理springboot打包的jar 传入的path是这样的 jar:file:/home/q/system/java/live/build/libs/live-33541.a12ed7cc.jar!/BOOT-INF/classes!/
20+
* @param jarpath
21+
* @param dependencyInfoList
22+
* @return
23+
*/
24+
public static List<DependencyInfo> getDependencyInfo(String jarpath, List<DependencyInfo> dependencyInfoList) {
25+
26+
try {
27+
28+
JarFile jarFile = new JarFile(new File(getROOTJar(jarpath)));
29+
30+
Enumeration<JarEntry> jarEntryEnumeration = jarFile.entries();
31+
32+
while (jarEntryEnumeration.hasMoreElements()) {
33+
34+
JarEntry jarEntry = jarEntryEnumeration.nextElement();
35+
36+
if (jarEntry.getName().endsWith(".jar")) { // 这里就暂时不匹配BOOT-INF/lib，考虑通用性
37+
38+
JarFile inJarFile = jarFile.getNestedJarFile(jarEntry);
39+
DependencyInfo dependencyInfo = getJarInJardependcyInfo(inJarFile); // 获取资源
40+
41+
if (dependencyInfo != null) dependencyInfoList.add(dependencyInfo);
42+
43+
}
44+
}
45+
46+
}
47+
catch (Exception e) {
48+
49+
CommonUtil.writeStr("/tmp/jvm_error.txt","getDependencyInfo:\t" + e.getMessage());
50+
}
51+
52+
return dependencyInfoList;
53+
}
54+
55+
/**
56+
* 获取Jarinjar中的资源
57+
* @param jarFile
58+
* @return
59+
*/
60+
public static DependencyInfo getJarInJardependcyInfo(JarFile jarFile) {
61+
62+
try {
63+
64+
Enumeration<JarEntry> jarEntryEnumeration = jarFile.entries();
65+
66+
while (jarEntryEnumeration.hasMoreElements()) {
67+
68+
JarEntry jarEntry= jarEntryEnumeration.nextElement();
69+
70+
if (jarEntry.getName().endsWith("/pom.properties")) {
71+
72+
Properties prop = new Properties();
73+
prop.load(jarFile.getInputStream(jarEntry));
74+
75+
DependencyInfo dependencyInfo = new DependencyInfo(); // 存放依赖信息
76+
dependencyInfo.setArtifactId(prop.getProperty("artifactId"));
77+
dependencyInfo.setGroupId(prop.getProperty("groupId"));
78+
dependencyInfo.setVersion(prop.getProperty("version"));
79+
80+
return dependencyInfo;
81+
}
82+
}
83+
84+
}
85+
catch (Exception e) {
86+
87+
CommonUtil.writeStr("/tmp/jvm_error.txt","getJarInJardependcyInfo:\t" + e.getMessage());
88+
}
89+
90+
return null;
91+
92+
}
93+
94+
/**
95+
* 获取rootjar资源路径
96+
* @param jarPath
97+
* @return
98+
*/
99+
public static String getROOTJar(String jarPath) {
100+
101+
jarPath = jarPath.split(".jar!/")[0].replace("jar:file:","");
102+
103+
return jarPath + ".jar";
104+
}
105+
106+
}

‎JavaProbe/src/maven/MavenHandle.java

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package maven;
2+
3+
import common.CommonUtil;
4+
import entity.DependencyInfo;
5+
import entity.JvmInfo;
6+
import org.springframework.boot.loader.jar.Handler;
7+
8+
import java.util.*;
9+
10+
/**
11+
* @author fate
12+
* @date 2019-11-08 上午12:31
13+
* 从jvm实例中构建pom.xml
14+
*/
15+
public class MavenHandle extends Handler {
16+
17+
/**
18+
* 获取jar读取到的依赖 用于针对于应用的漏洞(风险)管理
19+
* @param jvmInfo
20+
* @return
21+
*/
22+
public JvmInfo getMavenResult(JvmInfo jvmInfo) {
23+
24+
try {
25+
26+
List<DependencyInfo> dependencyInfos = new ArrayList<DependencyInfo>();
27+
28+
for(Map.Entry<String, String> entry : jvmInfo.getJarPathMap().entrySet()){
29+
30+
String targetJar = entry.getKey().trim();
31+
32+
if (targetJar.endsWith("!/")) {
33+
34+
FatJarHandle.getDependencyInfo(targetJar,dependencyInfos);
35+
//System.out.println("胖头鱼走起");
36+
}
37+
else {
38+
39+
EasyJarHandle.getDependencyInfo(targetJar,dependencyInfos);
40+
//System.out.println("easyjar 走起");
41+
}
42+
}
43+
44+
jvmInfo.setDependencyInfoList(dependencyInfos);
45+
}
46+
catch (Exception e) {
47+
48+
CommonUtil.writeStr("/tmp/jvm_error.txt","getMavenResult:\t" + e.getMessage());
49+
}
50+
51+
return jvmInfo;
52+
}
53+
}
54+

0 commit comments

Comments
 (0)