/*
    * This file is part of dependency-check-core.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   *
   * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
   */
  package org.owasp.dependencycheck.xml.suppression;
  
  import java.util.ArrayList;
  import java.util.Calendar;
  import java.util.List;
  import javax.annotation.concurrent.NotThreadSafe;
  import org.owasp.dependencycheck.exception.ParseException;
  import org.owasp.dependencycheck.utils.DateUtil;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.xml.sax.Attributes;
  import org.xml.sax.SAXException;
  import org.xml.sax.helpers.DefaultHandler;
  
  /**
   * A handler to load suppression rules.
   *
   * @author Jeremy Long
   */
  @NotThreadSafe
  public class SuppressionHandler extends DefaultHandler {
  
      /**
       * The logger.
       */
      private static final Logger LOGGER = LoggerFactory.getLogger(SuppressionHandler.class);
  
      /**
       * The suppress node, indicates the start of a new rule.
       */
      public static final String SUPPRESS = "suppress";
      /**
       * The file path element name.
       */
      public static final String FILE_PATH = "filePath";
      /**
       * The sha1 hash element name.
       */
      public static final String SHA1 = "sha1";
      /**
       * The CVE element name.
       */
      public static final String CVE = "cve";
      /**
       * The vulnerabilityName element name.
       */
      public static final String VULNERABILITY_NAME = "vulnerabilityName";
  
      /**
       * The CVE element name.
       */
      public static final String NOTES = "notes";
  
      /**
       * The CPE element name.
       */
      public static final String CPE = "cpe";
      /**
       * The CWE element name.
       */
      public static final String CWE = "cwe";
      /**
       * The GAV element name.
       */
      public static final String GAV = "gav";
      /**
       * The Package URL element name.
       */
      public static final String PACKAGE_URL = "packageUrl";
      /**
       * The cvssBelow element name.
       */
      public static final String CVSS_BELOW = "cvssBelow";
      /**
       * A list of suppression rules.
       */
      private final List<SuppressionRule> suppressionRules = new ArrayList<>();
      /**
       * The current rule being read.
       */
      private SuppressionRule rule;
      /**
      * The attributes of the node being read.
      */
     private Attributes currentAttributes;
     /**
      * The current node text being extracted from the element.
      */
     private StringBuilder currentText;
 
     /**
      * Get the value of suppressionRules.
      *
      * @return the value of suppressionRules
      */
     public List<SuppressionRule> getSuppressionRules() {
         return suppressionRules;
     }
 
     /**
      * Handles the start element event.
      *
      * @param uri the URI of the element being processed
      * @param localName the local name of the element being processed
      * @param qName the qName of the element being processed
      * @param attributes the attributes of the element being processed
      * @throws SAXException thrown if there is an exception processing
      */
     @Override
     public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
         currentAttributes = attributes;
         currentText = new StringBuilder();
         if (SUPPRESS.equals(qName)) {
             rule = new SuppressionRule();
             final String base = currentAttributes.getValue("base");
             if (base != null) {
                 rule.setBase(Boolean.parseBoolean(base));
             } else {
                 rule.setBase(false);
             }
             final String until = currentAttributes.getValue("until");
             if (until != null) {
                 try {
                     rule.setUntil(DateUtil.parseXmlDate(until));
                 } catch (ParseException ex) {
                     throw new SAXException("Unable to parse until date in suppression file: " + until, ex);
                 }
             }
         }
     }
 
     /**
      * Handles the end element event.
      *
      * @param uri the URI of the element
      * @param localName the local name of the element
      * @param qName the qName of the element
      * @throws SAXException thrown if there is an exception processing
      */
     @Override
     public void endElement(String uri, String localName, String qName) throws SAXException {
         if (null != qName) {
             switch (qName) {
                 case SUPPRESS:
                     if (rule.getUntil() != null && rule.getUntil().before(Calendar.getInstance())) {
                         LOGGER.info("Suppression is expired for rule: {}", rule);
                     } else {
                         suppressionRules.add(rule);
                     }
                     rule = null;
                     break;
                 case FILE_PATH:
                     rule.setFilePath(processPropertyType());
                     break;
                 case SHA1:
                     rule.setSha1(currentText.toString().trim());
                     break;
                 case GAV:
                     rule.setGav(processPropertyType());
                     break;
                 case PACKAGE_URL:
                     rule.setPackageUrl(processPropertyType());
                     break;
                 case CPE:
                     rule.addCpe(processPropertyType());
                     break;
                 case CWE:
                     rule.addCwe(currentText.toString().trim());
                     break;
                 case CVE:
                     rule.addCve(currentText.toString().trim());
                     break;
                 case VULNERABILITY_NAME:
                     rule.addVulnerabilityName(processPropertyType());
                     break;
                 case NOTES:
                     rule.setNotes(currentText.toString().trim());
                     break;
                 case CVSS_BELOW:
                     final Double cvss = Double.valueOf(currentText.toString().trim());
                     rule.addCvssBelow(cvss);
                     break;
                 default:
                     break;
             }
         }
     }
 
     /**
      * Collects the body text of the node being processed.
      *
      * @param ch the char array of text
      * @param start the start position to copy text from in the char array
      * @param length the number of characters to copy from the char array
      * @throws SAXException thrown if there is a parsing exception
      */
     @Override
     public void characters(char[] ch, int start, int length) throws SAXException {
         currentText.append(ch, start, length);
     }
 
     /**
      * Processes field members that have been collected during the characters
      * and startElement method to construct a PropertyType object.
      *
      * @return a PropertyType object
      */
     private PropertyType processPropertyType() {
         final PropertyType pt = new PropertyType();
         pt.setValue(currentText.toString().trim());
         if (currentAttributes != null && currentAttributes.getLength() > 0) {
             final String regex = currentAttributes.getValue("regex");
             if (regex != null) {
                 pt.setRegex(Boolean.parseBoolean(regex));
             }
             final String caseSensitive = currentAttributes.getValue("caseSensitive");
             if (caseSensitive != null) {
                 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
             }
         }
         return pt;
     }
 }