Skip to content

Commit b3ae170

Browse files
tiagobcxtiagobcx
authored
adding codebashing link support (#88)
1 parent bb8e5ba commit b3ae170

File tree

6 files changed

+113
-5
lines changed

6 files changed

+113
-5
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ jobs:
3030
CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
3131
CX_TENANT: ${{ secrets.CX_TENANT }}
3232
CX_SCAN_ID: ${{ secrets.CX_SCAN_ID }}
33+
CX_APIKEY: ${{ secrets.CX_APIKEY }}
3334
run: mvn -B test --file pom.xml
3435
cx-scan:
3536
runs-on: ubuntu-latest

‎src/main/java/com/checkmarx/ast/codebashing/CodeBashing.java‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
package com.checkmarx.ast.codebashing;
2+
3+
import com.checkmarx.ast.predicate.Predicate;
4+
import com.checkmarx.ast.wrapper.CxBaseObject;
5+
import com.fasterxml.jackson.annotation.JsonCreator;
6+
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
7+
import com.fasterxml.jackson.annotation.JsonInclude;
8+
import com.fasterxml.jackson.annotation.JsonProperty;
9+
import com.fasterxml.jackson.databind.JavaType;
10+
import com.fasterxml.jackson.databind.ObjectMapper;
11+
import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
12+
import com.fasterxml.jackson.databind.type.TypeFactory;
13+
import lombok.EqualsAndHashCode;
14+
import lombok.Value;
15+
import org.apache.commons.lang3.StringUtils;
16+
17+
import java.io.IOException;
18+
import java.util.List;
19+
import java.util.Map;
20+
21+
@Value
22+
@JsonDeserialize()
23+
@JsonInclude(JsonInclude.Include.NON_NULL)
24+
@JsonIgnoreProperties(ignoreUnknown = true)
25+
public class CodeBashing {
26+
String path;
27+
String cweId;
28+
String language;
29+
String queryName;
30+
31+
@JsonCreator
32+
public CodeBashing(@JsonProperty("path") String path,
33+
@JsonProperty("cwe_id") String cweId,
34+
@JsonProperty("lang") String language,
35+
@JsonProperty("cxQueryName") String queryName) {
36+
this.path=path;
37+
this.cweId=cweId;
38+
this.language=language;
39+
this.queryName=queryName;
40+
}
41+
42+
public static <T> T fromLine(String line) {
43+
return parse(line, TypeFactory.defaultInstance().constructType(Predicate.class));
44+
}
45+
46+
public static <T> List<T> listFromLine(String line) {
47+
return parse(line, TypeFactory.defaultInstance().constructCollectionType(List.class, CodeBashing.class));
48+
}
49+
50+
protected static <T> T parse(String line, JavaType type) {
51+
T result = null;
52+
try {
53+
if (!StringUtils.isBlank(line) && isValidJSON(line)) {
54+
result = new ObjectMapper().readValue(line, type);
55+
56+
}
57+
} catch (IOException e) {
58+
e.printStackTrace();
59+
}
60+
return result;
61+
}
62+
63+
private static boolean isValidJSON(final String json) {
64+
try {
65+
final ObjectMapper mapper = new ObjectMapper();
66+
mapper.readTree(json);
67+
return true;
68+
} catch (IOException e) {
69+
return false;
70+
}
71+
}
72+
73+
}
74+

‎src/main/java/com/checkmarx/ast/wrapper/CxConfig.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,14 +45,14 @@ void validate() throws InvalidCLIConfigException {
4545
List<String> toArguments() {
4646
List<String> commands = new ArrayList<>();
4747

48-
if (StringUtils.isNotBlank(getClientId()) && StringUtils.isNotBlank(getClientSecret())) {
48+
if (StringUtils.isNotBlank(getApiKey())) {
49+
commands.add(CxConstants.API_KEY);
50+
commands.add(getApiKey());
51+
} else if (StringUtils.isNotBlank(getClientId()) && StringUtils.isNotBlank(getClientSecret())) {
4952
commands.add(CxConstants.CLIENT_ID);
5053
commands.add(getClientId());
5154
commands.add(CxConstants.CLIENT_SECRET);
5255
commands.add(getClientSecret());
53-
} else if (StringUtils.isNotBlank(getApiKey())) {
54-
commands.add(CxConstants.API_KEY);
55-
commands.add(getApiKey());
5656
}
5757

5858
if (StringUtils.isNotBlank(getTenant())) {

‎src/main/java/com/checkmarx/ast/wrapper/CxConstants.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,8 @@ public final class CxConstants {
4242
static final String REPORT_FORMAT = "--report-format";
4343
static final String OUTPUT_NAME = "--output-name";
4444
static final String OUTPUT_PATH = "--output-path";
45+
static final String SUB_CMD_CODE_BASHING = "codebashing";
46+
static final String CWE_ID = "--cwe-id";
47+
static final String LANGUAGE = "--language";
48+
static final String VULNERABILITY_TYPE = "--vulnerabity-type";
4549
}

‎src/main/java/com/checkmarx/ast/wrapper/CxWrapper.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast.wrapper;
22

3+
import com.checkmarx.ast.codebashing.CodeBashing;
34
import com.checkmarx.ast.predicate.Predicate;
45
import com.checkmarx.ast.project.Project;
56
import com.checkmarx.ast.results.ReportFormat;
@@ -201,6 +202,23 @@ public List<String> projectBranches(@NonNull UUID projectId, String filter)
201202
line -> CxBaseObject.parse(line, BRANCHES_TYPE));
202203
}
203204

205+
public List<CodeBashing> codeBashingList(@NonNull String cweId,@NonNull String language,@NonNull String queryName) throws IOException, InterruptedException, CxException {
206+
this.logger.info("Fetching the codebashing link");
207+
208+
List<String> arguments = new ArrayList<>();
209+
arguments.add(CxConstants.CMD_RESULT);
210+
arguments.add(CxConstants.SUB_CMD_CODE_BASHING);
211+
arguments.add(CxConstants.LANGUAGE);
212+
arguments.add(language);
213+
arguments.add(CxConstants.VULNERABILITY_TYPE);
214+
arguments.add(queryName);
215+
arguments.add(CxConstants.CWE_ID);
216+
arguments.add(cweId);
217+
arguments.addAll(jsonArguments());
218+
219+
return Execution.executeCommand(withConfigArguments(arguments), logger, CodeBashing::listFromLine);
220+
}
221+
204222
public ResultsSummary resultsSummary(@NonNull UUID scanId) throws IOException, InterruptedException, CxException {
205223
return new ObjectMapper()
206224
.readerFor(ResultsSummary.class)

‎src/test/java/com/checkmarx/ast/ResultTest.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.checkmarx.ast;
22

3+
import com.checkmarx.ast.codebashing.CodeBashing;
34
import com.checkmarx.ast.results.ReportFormat;
45
import com.checkmarx.ast.results.Results;
56
import com.checkmarx.ast.results.ResultsSummary;
@@ -11,7 +12,9 @@
1112
import java.util.UUID;
1213

1314
class ResultTest extends BaseTest {
14-
15+
private static String CWE_ID = "79";
16+
private static String LANGUAGE = "PHP";
17+
private static String QUERY_NAME = "Reflected XSS All Clients";
1518
@Test
1619
void testResultsHTML() throws Exception {
1720
List<Scan> scanList = wrapper.scanList();
@@ -48,4 +51,12 @@ void testResultsStructure() throws Exception {
4851
results.getResults().stream().filter(result -> "sast".equalsIgnoreCase(result.getType())).findFirst();
4952
Assertions.assertEquals(results.getTotalCount(), results.getResults().size());
5053
}
54+
55+
@Test()
56+
void testResultsCodeBashing() throws Exception {
57+
List<CodeBashing> codeBashingList = wrapper.codeBashingList(CWE_ID,LANGUAGE,QUERY_NAME);
58+
Assertions.assertTrue(codeBashingList.size() > 0);
59+
String path = codeBashingList.get(0).getPath();
60+
Assertions.assertTrue(path.length() > 0);
61+
}
5162
}

0 commit comments

Comments
 (0)