View Javadoc
1   /**
2    * Portions of this software was developed by employees of the National Institute
3    * of Standards and Technology (NIST), an agency of the Federal Government and is
4    * being made available as a public service. Pursuant to title 17 United States
5    * Code Section 105, works of NIST employees are not subject to copyright
6    * protection in the United States. This software may be subject to foreign
7    * copyright. Permission in the United States and in foreign countries, to the
8    * extent that NIST may hold copyright, to use, copy, modify, create derivative
9    * works, and distribute this software and its documentation without fee is hereby
10   * granted on a non-exclusive basis, provided that this notice and disclaimer
11   * of warranty appears in all copies.
12   *
13   * THE SOFTWARE IS PROVIDED 'AS IS' WITHOUT ANY WARRANTY OF ANY KIND, EITHER
14   * EXPRESSED, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY
15   * THAT THE SOFTWARE WILL CONFORM TO SPECIFICATIONS, ANY IMPLIED WARRANTIES OF
16   * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND FREEDOM FROM
17   * INFRINGEMENT, AND ANY WARRANTY THAT THE DOCUMENTATION WILL CONFORM TO THE
18   * SOFTWARE, OR ANY WARRANTY THAT THE SOFTWARE WILL BE ERROR FREE.  IN NO EVENT
19   * SHALL NIST BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT,
20   * INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM,
21   * OR IN ANY WAY CONNECTED WITH THIS SOFTWARE, WHETHER OR NOT BASED UPON WARRANTY,
22   * CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR
23   * PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT
24   * OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER.
25   */
26  
27  package gov.nist.secauto.swid.swidval;
28  
29  import gov.nist.secauto.decima.core.assessment.Assessment;
30  import gov.nist.secauto.decima.core.assessment.AssessmentExecutor;
31  import gov.nist.secauto.decima.core.assessment.ConcurrentAssessmentExecutor;
32  import gov.nist.secauto.decima.core.classpath.ClasspathHandler;
33  import gov.nist.secauto.decima.xml.assessment.Factory;
34  import gov.nist.secauto.decima.xml.assessment.schema.SchemaAssessment;
35  import gov.nist.secauto.decima.xml.assessment.schematron.SchematronAssessment;
36  import gov.nist.secauto.decima.xml.document.XMLDocument;
37  import gov.nist.secauto.decima.xml.schematron.DefaultSchematronCompiler;
38  import gov.nist.secauto.decima.xml.schematron.Schematron;
39  import gov.nist.secauto.decima.xml.schematron.SchematronCompilationException;
40  
41  import java.io.File;
42  import java.net.MalformedURLException;
43  import java.net.URL;
44  import java.util.ArrayList;
45  import java.util.Collections;
46  import java.util.List;
47  import java.util.concurrent.ExecutorService;
48  
49  import javax.xml.transform.stream.StreamSource;
50  
51  public class SWIDAssessmentFactory {
52    private static final SWIDAssessmentFactory INSTANCE;
53  
54    public static String toPhase(TagType tagType, boolean authoritative) {
55      return "swid." + tagType.getName() + "." + (authoritative ? "auth" : "non-auth");
56    }
57  
58    public static SWIDAssessmentFactory getInstance() {
59      return INSTANCE;
60    }
61  
62    static {
63      INSTANCE = new SWIDAssessmentFactory();
64    }
65  
66    private final Schematron schematron;
67    private final SchemaAssessment schemaAssessment;
68    private File resultDirectory;
69  
70    private SWIDAssessmentFactory() {
71      ClasspathHandler.initialize();
72      this.schematron = createSchematron();
73      this.schemaAssessment = createSchemaAssessment();
74    }
75  
76    public Schematron getSchematron() {
77      return schematron;
78    }
79  
80    /**
81     * Retrieve the result directory.
82     * 
83     * @return the resultDirectory or <code>null</code> if no directory is set
84     */
85    public File getResultDirectory() {
86      return resultDirectory;
87    }
88  
89    /**
90     * Set the result directory to use.
91     * 
92     * @param resultDirectory
93     *          the resultDirectory to set
94     */
95    public void setResultDirectory(File resultDirectory) {
96      this.resultDirectory = resultDirectory;
97    }
98  
99    /**
100    * Produces a new assessment executor for assessing a SWID tag.
101    * 
102    * @param tagType
103    *          the software type supported by the tag
104    * @param authoritative
105    *          <code>true</code> if the tag was expected to be created by the software provider
106    * @param executorService
107    *          the Java executor to use to run the assessments
108    * @return a new executor
109    */
110   public AssessmentExecutor<XMLDocument> newAssessmentExecutor(TagType tagType, boolean authoritative,
111       ExecutorService executorService) {
112 
113     List<Assessment<XMLDocument>> assessments = new ArrayList<Assessment<XMLDocument>>(2);
114     assessments.add(schemaAssessment);
115 
116     SchematronAssessment assessment = Factory.newSchematronAssessment(schematron, toPhase(tagType, authoritative));
117     assessment.addParameter("authoritative", Boolean.toString(authoritative));
118     assessment.addParameter("type", tagType.getName());
119     assessments.add(assessment);
120     if (resultDirectory != null) {
121       resultDirectory.mkdirs();
122       assessment.setResultDirectory(resultDirectory);
123     }
124 
125     AssessmentExecutor<XMLDocument> executor
126         = new ConcurrentAssessmentExecutor<XMLDocument>(executorService, assessments);
127     return executor;
128   }
129 
130   protected SchemaAssessment createSchemaAssessment() {
131     return Factory.newSchemaAssessment("GEN-1-1",
132         Collections.singletonList(new StreamSource("classpath:swid-schema-fixed-20160908.xsd")));
133   }
134 
135   protected Schematron createSchematron() {
136     URL schematronURL;
137     try {
138       schematronURL = new URL("classpath:schematron/swid-nistir-8060.sch");
139       return new DefaultSchematronCompiler().newSchematron(schematronURL);
140     } catch (MalformedURLException | SchematronCompilationException e) {
141       // this should not happen if the classpath is resolvable and valid
142       throw new RuntimeException(e);
143     }
144   }
145 }