rulesetfactory.java

检查Java程序漏洞

        Element ruleElement = (Element) ruleNode;

        String className = ruleElement.getAttribute("class");
        String name = ruleElement.getAttribute("name");
        String message = ruleElement.getAttribute("message");
        Rule rule = (Rule) getClassLoader().loadClass(className).newInstance();
        rule.setName(name);
        rule.setMessage(message);
        
        NodeList nodeList = ruleElement.getChildNodes();
        for (int i = 0; i < nodeList.getLength(); i++) {
            Node node = nodeList.item(i);
            if (node.getNodeType() == Node.ELEMENT_NODE) {
                if (node.getNodeName().equals("description")) {
                    parseDescriptionNode(rule, node);
                } else if (node.getNodeName().equals("example")) {
                    parseExampleNode(rule, node);
                } else if (node.getNodeName().equals("priority")) {
                    parsePriorityNode(rule, node);
                } else if (node.getNodeName().equals("properties")) {
                    parsePropertiesNode(rule, node);
                }
            }
        }
        
        ruleSet.addRule(rule);
    }
    
    /**
     * Process a reference to a rule
     * @param ruleSet the ruleset being constructucted
     * @param ruleNode must be a ruke element node
     */
    private void parseExternallyDefinedRuleNode(RuleSet ruleSet, Node ruleNode) throws RuleSetNotFoundException {
        Element ruleElement = (Element) ruleNode;
        String ref = ruleElement.getAttribute("ref");
        if (ref.endsWith("xml")) {
            parseRuleNodeWithExclude(ruleSet, ruleElement, ref);
        } else {
            parseRuleNodeWithSimpleReference(ruleSet, ref);
        }
    }
    
    /**
     * Parse a rule node with a simple reference
     * @param ruleSet the ruleset being constructed
     * @param ref a reference to a rule
     */
    private void parseRuleNodeWithSimpleReference(RuleSet ruleSet, String ref) throws RuleSetNotFoundException {
        RuleSetFactory rsf = new RuleSetFactory();
        ExternalRuleID externalRuleID = new ExternalRuleID(ref);
        RuleSet externalRuleSet = rsf.createRuleSet(ResourceLoader.loadResourceAsStream(externalRuleID.getFilename()));
        ruleSet.addRule(externalRuleSet.getRuleByName(externalRuleID.getRuleName()));
    }

    /**
     * Parse a reference rule node with excludes
     * @param ruleSet the ruleset being constructed
     * @param ruleElement must be a rule element
     * @param ref the ruleset reference
     */    
    private void parseRuleNodeWithExclude(RuleSet ruleSet, Element ruleElement, String ref) throws RuleSetNotFoundException {
        NodeList excludeNodes = ruleElement.getChildNodes();
        Set excludes = new HashSet();
        for (int i=0; i<excludeNodes.getLength(); i++) {
            Node node = excludeNodes.item(i);
            if ((node.getNodeType() == Node.ELEMENT_NODE) && (node.getNodeName().equals("exclude"))) {
                Element excludeElement = (Element) node;
                excludes.add(excludeElement.getAttribute("name"));
            }
        }
        
        RuleSetFactory rsf = new RuleSetFactory();
        RuleSet externalRuleSet = rsf.createRuleSet(ResourceLoader.loadResourceAsStream(ref));
        for (Iterator i = externalRuleSet.getRules().iterator(); i.hasNext();) {
            Rule rule = (Rule) i.next();
            if (!excludes.contains(rule.getName())) {
                 ruleSet.addRule(rule);
            }
        }
    }

    /**
     * Process a rule descrtiprion node
     * @param rule the rule being constructed
     * @param descriptionNode must be a description element node
     */
    private void parseDescriptionNode(Rule rule, Node descriptionNode) {
        NodeList nodeList = descriptionNode.getChildNodes();
        StringBuffer buffer = new StringBuffer();
        for (int i = 0; i < nodeList.getLength(); i++) {
            Node node = nodeList.item(i);
            if (node.getNodeType() == Node.CDATA_SECTION_NODE) {
                buffer.append(node.getNodeValue());
            } else if (node.getNodeType() == Node.TEXT_NODE) {
                buffer.append(node.getNodeValue());
            }
        }
        rule.setDescription(buffer.toString());
    }

    /**
     * Process a rule example node
     * @param rule the rule being constructed
     * @param exampleNode must be a example element node
     */
    private void parseExampleNode(Rule rule, Node exampleNode) {
        NodeList nodeList = exampleNode.getChildNodes();
        StringBuffer buffer = new StringBuffer();
        for (int i = 0; i < nodeList.getLength(); i++) {
            Node node = nodeList.item(i);
            if (node.getNodeType() == Node.CDATA_SECTION_NODE) {
                buffer.append(node.getNodeValue());
            } else if (node.getNodeType() == Node.TEXT_NODE) {
                buffer.append(node.getNodeValue());
            }
        }
        rule.setExample(buffer.toString());
    }
    
    /**
     * Parse a priority node
     * @param rule the rule being constructed
     * @param priorityNode must be a priority element
     */
    private void parsePriorityNode(Rule rule, Node priorityNode) {
        StringBuffer buffer = new StringBuffer();
        NodeList nodeList = priorityNode.getChildNodes();
        for (int i = 0; i < nodeList.getLength(); i++) {
            Node node = nodeList.item(i);
            if (node.getNodeType() == Node.TEXT_NODE) {
                buffer.append(node.getNodeValue());
            }
        }
        rule.setPriority(new Integer(buffer.toString().trim()).intValue());
    }
    
    /**
     * Parse a properties node
     * @param rule the rule being constructed
     * @param propertiesNode must be a properties element node
     */
    private void parsePropertiesNode(Rule rule, Node propertiesNode) {
        NodeList nodeList = propertiesNode.getChildNodes();
        for (int i = 0; i < nodeList.getLength(); i++) {
            Node node = nodeList.item(i);
            if ((node.getNodeType() == Node.ELEMENT_NODE) && (node.getNodeName().equals("property"))) {
                parsePropertyNode(rule, node);
            }
        }
    }
    
    /**
     * Parse a property node
     * @param rule the rule being constructed
     * @param propertyNode must be a property element node
     */
    private void parsePropertyNode(Rule rule, Node propertyNode) {
        Element propertyElement = (Element) propertyNode;
        String name = propertyElement.getAttribute("name");
        String value = propertyElement.getAttribute("value");
        if (value.trim().length() == 0) {
            NodeList nodeList = propertyNode.getChildNodes();
            for (int i = 0; i < nodeList.getLength(); i++) {
                Node node = nodeList.item(i);
                if ((node.getNodeType() == Node.ELEMENT_NODE) && (node.getNodeName().equals("value"))) {
                    value = parseValueNode(node);
                }
            }
        }
        if (propertyElement.hasAttribute("pluginname")) {
            rule.addProperty("pluginname", propertyElement.getAttributeNode("pluginname").getNodeValue());
        }
        rule.addProperty(name, value);
    }
    
    /**
     * Parse a value node
     * @param valueNode must be a value element node
     * @return the value
     */
    private String parseValueNode(Node valueNode) {
        StringBuffer buffer = new StringBuffer();
        NodeList nodeList = valueNode.getChildNodes();
        for (int i = 0; i < nodeList.getLength(); i++) {
            Node node = nodeList.item(i);
            if (node.getNodeType() == Node.CDATA_SECTION_NODE) {
                buffer.append(node.getNodeValue());
            } else if (node.getNodeType() == Node.TEXT_NODE) {
                buffer.append(node.getNodeValue());
            }
        }
        return buffer.toString();
    }
}