Skip to content

Commit edd4bbb

Browse files
davewichersdavewichers
committed
Add Burp and new SonarQube readers. Remove reverse() call from test cases. Delete or move some files out of the root dir. of project.
1 parent fa9df02 commit edd4bbb

File tree

9 files changed

+288
-41
lines changed

9 files changed

+288
-41
lines changed

‎pom.xml

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
<name>OWASP Benchmark Project</name>
99
<url>https://www.owasp.org/index.php/Benchmark</url>
1010
<profiles>
11-
1211
<profile>
1312
<id>benchmarkscore</id>
1413
<build>
@@ -78,24 +77,6 @@
7877
</properties>
7978
<build>
8079
<plugins>
81-
<plugin>
82-
<groupId>org.apache.maven.plugins</groupId>
83-
<artifactId>maven-verifier-plugin</artifactId>
84-
<version>1.1</version>
85-
<configuration>
86-
<verificationFile>verifications.xml</verificationFile>
87-
</configuration>
88-
<executions>
89-
<execution>
90-
<id>main</id>
91-
<phase>validate</phase>
92-
<goals>
93-
<goal>verify</goal>
94-
</goals>
95-
</execution>
96-
</executions>
97-
</plugin>
98-
9980
<plugin>
10081
<artifactId>maven-antrun-plugin</artifactId>
10182
<version>1.7</version>
@@ -108,7 +89,7 @@
10889
</goals>
10990
<configuration>
11091
<target>
111-
<ant target="run" antfile="${basedir}/build.xml">
92+
<ant target="run" antfile="${basedir}/src/config/build.xml">
11293
<!-- This is the important bit -->
11394
<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
11495
</ant>
@@ -568,7 +549,6 @@
568549
</execution>
569550
</executions>
570551
</plugin>
571-
572552
<!-- FindBugs Static Analysis -->
573553
<plugin>
574554
<groupId>org.codehaus.mojo</groupId>

‎build.xml renamed to ‎src/config/build.xml

File renamed without changes.

‎src/main/java/org/owasp/benchmark/helpers/Thing2.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ public class Thing2 implements ThingInterface {
2222

2323
@Override
2424
public String doSomething(String i) {
25-
// reverse input
26-
String r = new StringBuilder(i).reverse().toString();
25+
if (i == null) return "";
26+
String r = new StringBuilder(i).toString();
2727
return r;
2828
}
2929
}

‎src/main/java/org/owasp/benchmark/score/BenchmarkScore.java

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020

2121
import java.io.BufferedReader;
2222
import java.io.File;
23+
import java.io.FileInputStream;
2324
import java.io.FileNotFoundException;
2425
import java.io.FileOutputStream;
2526
import java.io.FileReader;
@@ -40,9 +41,13 @@
4041
import java.util.Set;
4142
import java.util.TreeMap;
4243

44+
import javax.xml.parsers.DocumentBuilder;
45+
import javax.xml.parsers.DocumentBuilderFactory;
46+
4347
import org.apache.commons.io.FileUtils;
4448
import org.owasp.benchmark.score.parsers.AppscanReader;
4549
import org.owasp.benchmark.score.parsers.ArachniReader;
50+
import org.owasp.benchmark.score.parsers.BurpReader;
4651
import org.owasp.benchmark.score.parsers.CheckmarxReader;
4752
import org.owasp.benchmark.score.parsers.Counter;
4853
import org.owasp.benchmark.score.parsers.CoverityReader;
@@ -51,14 +56,19 @@
5156
import org.owasp.benchmark.score.parsers.OverallResults;
5257
import org.owasp.benchmark.score.parsers.PMDReader;
5358
import org.owasp.benchmark.score.parsers.ParasoftReader;
54-
import org.owasp.benchmark.score.parsers.SonarReader;
59+
import org.owasp.benchmark.score.parsers.Reader;
60+
import org.owasp.benchmark.score.parsers.SonarQubeLegacyReader;
61+
import org.owasp.benchmark.score.parsers.SonarQubeReader;
5562
import org.owasp.benchmark.score.parsers.TestCaseResult;
5663
import org.owasp.benchmark.score.parsers.TestResults;
5764
import org.owasp.benchmark.score.parsers.VeracodeReader;
5865
import org.owasp.benchmark.score.parsers.ZapReader;
5966
import org.owasp.benchmark.score.report.Report;
6067
import org.owasp.benchmark.score.report.ScatterScores;
6168
import org.owasp.benchmark.score.report.ScatterVulns;
69+
import org.w3c.dom.Document;
70+
import org.w3c.dom.Node;
71+
import org.xml.sax.InputSource;
6272

6373
public class BenchmarkScore {
6474

@@ -367,7 +377,15 @@ private static TestResults readActualResults(File actual) throws Exception {
367377
}
368378

369379
else if ( filename.endsWith(".json" ) ) {
370-
tr = new CoverityReader().parse( actual );
380+
String line1 = getLine( actual, 0 );
381+
String line2 = getLine( actual, 1 );
382+
if ( line2.contains("formatVersion")) {
383+
tr = new CoverityReader().parse( actual );
384+
}
385+
386+
else {
387+
tr = new SonarQubeReader().parse( actual );
388+
}
371389
}
372390

373391
else if ( filename.endsWith( ".xml" ) ) {
@@ -395,7 +413,7 @@ else if ( line2.startsWith( "<detailedreport")) {
395413
}
396414

397415
else if ( line1.startsWith( "<total")) {
398-
tr = new SonarReader().parse( actual );
416+
tr = new SonarQubeLegacyReader().parse( actual );
399417
}
400418

401419
else if ( line1.contains( "<OWASPZAPReport") || line2.contains( "<OWASPZAPReport")) {
@@ -409,6 +427,14 @@ else if ( line2.startsWith( "<CxXMLResults")) {
409427
else if ( line2.startsWith( "<report")) {
410428
tr = new ArachniReader().parse( actual );
411429
}
430+
431+
else {
432+
Document doc = getXMLDocument( actual );
433+
Node root = doc.getDocumentElement();
434+
if ( root.getNodeName().equals( "issues" ) ) {
435+
tr = new BurpReader().parse( doc );
436+
}
437+
}
412438
}
413439

414440
else if ( filename.endsWith( ".fpr" ) ) {
@@ -690,7 +716,14 @@ private static void updateMenuTemplates( String toolmenu, String vulnmenu ) {
690716
}
691717
}
692718
}
693-
719+
}
720+
721+
private static Document getXMLDocument( File f ) throws Exception {
722+
DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
723+
DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
724+
InputSource is = new InputSource(new FileInputStream(f));
725+
Document doc = docBuilder.parse(is);
726+
return doc;
694727
}
695728

696729
}

‎src/main/java/org/owasp/benchmark/score/parsers/BurpReader.java

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Benchmark Project For details, please see
6+
* <a href="https://www.owasp.org/index.php/Benchmark">https://www.owasp.org/index.php/Benchmark</a>.
7+
*
8+
* The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
12+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details
14+
*
15+
* @author Dave Wichers <a href="https://www.aspectsecurity.com">Aspect Security</a>
16+
* @created 2015
17+
*/
18+
19+
package org.owasp.benchmark.score.parsers;
20+
21+
import java.util.List;
22+
23+
import org.w3c.dom.Document;
24+
import org.w3c.dom.Node;
25+
26+
public class BurpReader extends Reader {
27+
28+
public TestResults parse(Document doc) throws Exception {
29+
30+
TestResults tr = new TestResults("Burp Pro", true, TestResults.ToolType.SAST);
31+
32+
// <issues burpVersion="1.6.24"
33+
// exportTime="Wed Aug 19 23:27:54 EDT 2015">
34+
35+
Node root = doc.getDocumentElement();
36+
String version = getAttributeValue("burpVersion", root);
37+
tr.setToolVersion(version);
38+
39+
// String time = getAttributeValue("ScanTime", root);
40+
// tr.setTime( time );
41+
42+
List<Node> issueList = getNamedChildren("issue", root);
43+
44+
for (Node issue : issueList) {
45+
TestCaseResult tcr = parseBurpVulnerability(issue);
46+
if (tcr != null) {
47+
// System.out.println( tcr.getNumber() + "\t" + tcr.getCWE() + "\t" + tcr.getEvidence() );
48+
tr.put(tcr);
49+
}
50+
}
51+
return tr;
52+
}
53+
54+
// <issue>
55+
// <serialNumber>5773821289236842496</serialNumber>
56+
// <type>2097920</type>
57+
// <name>Cross-site scripting (reflected)</name>
58+
// <host ip="127.0.0.1">https://localhost:8443</host>
59+
// <path><![CDATA[/benchmark/BenchmarkTest00023]]></path>
60+
// <location><![CDATA[/benchmark/BenchmarkTest00023 [vector parameter]]]></location>
61+
// <severity>High</severity>
62+
// <confidence>Certain</confidence>
63+
// <issueBackground></remediationBackground>
64+
// <references></references>
65+
// <issueDetail></issueDetail>
66+
// </issue>
67+
68+
private TestCaseResult parseBurpVulnerability(Node issue) {
69+
TestCaseResult tcr = new TestCaseResult();
70+
String cwe = getNamedChild("type", issue).getTextContent();
71+
tcr.setCWE(translate(cwe));
72+
73+
String name = getNamedChild("name", issue).getTextContent();
74+
tcr.setCategory(name);
75+
tcr.setEvidence(name);
76+
77+
String confidence = getNamedChild( "confidence", issue ).getTextContent();
78+
// tcr.setConfidence( makeIntoInt( confidence ) );
79+
80+
String testcase = getNamedChild("path", issue).getTextContent();
81+
testcase = testcase.substring(testcase.lastIndexOf('/') + 1);
82+
testcase = testcase.split("\\.")[0];
83+
if (testcase.startsWith("BenchmarkTest")) {
84+
String testno = testcase.substring("BenchmarkTest".length() );
85+
try {
86+
tcr.setNumber(Integer.parseInt(testno));
87+
} catch (NumberFormatException e) {
88+
e.printStackTrace();
89+
}
90+
return tcr;
91+
}
92+
93+
return null;
94+
}
95+
96+
private int translate(String id) {
97+
switch (id) {
98+
case "2097920": return 79; // XSS
99+
case "5247488": return 9999; // DOM Trust Boundary Violation - Map to nothing right now.
100+
case "1048832": return 78; // Command Injection
101+
case "1051392": return 22; // Path Manipulation
102+
case "5243392": return 614; //SSL cookie without secure flag set
103+
case "5244416": return 9998; //cookie without HttpOnly flag set - There is no CWE defined for this weakness
104+
case "1050112": return 643; //XPATH injection
105+
106+
// //case "Build Misconfiguration" : return 00;
107+
// case "Command Injection" : return 78;
108+
// case "Cookie Security" : return 614;
109+
// case "Cross-Site Scripting" : return 79;
110+
// //case "Dead Code" : return 00;
111+
// //case "Denial of Service" : return 00;
112+
// case "Header Manipulation" : return 113;
113+
// case "Insecure Randomness" : return 330;
114+
// //case "J2EE Bad Practices" : return 00;
115+
// case "LDAP Injection" : return 90;
116+
// //case "Missing Check against Null" : return 00;
117+
// //case "Null Dereference" : return 00;
118+
// case "Password Management" : return 00;
119+
// case "Path Manipulation" : return 22;
120+
// //case "Poor Error Handling" : return 00;
121+
// //case "Poor Logging Practice" : return 00;
122+
// //case "Poor Style" : return 00;
123+
// //case "Resource Injection" : return 00;
124+
// case "SQL Injection" : return 89;
125+
// //case "System Information Leak" : return 00;
126+
// case "Trust Boundary Violation" : return 501;
127+
// //case "Unreleased Resource" : return 00;
128+
// //case "Unsafe Reflection" : return 00;
129+
// case "Weak Cryptographic Hash" : return 328;
130+
// case "Weak Encryption" : return 327;
131+
// case "XPath Injection" : return 643;
132+
}
133+
System.out.println("Unknown id: " + id);
134+
return -1;
135+
}
136+
137+
}

‎src/main/java/org/owasp/benchmark/score/parsers/Reader.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ public List<Node> getNamedNodes(String name, NodeList list) {
7474
return results;
7575
}
7676

77-
public String getAttributeValue(String name, Node node) {
77+
public static String getAttributeValue(String name, Node node) {
7878
if (node == null)
7979
return null;
8080
NamedNodeMap nnm = node.getAttributes();

‎src/main/java/org/owasp/benchmark/score/parsers/SonarReader.java renamed to ‎src/main/java/org/owasp/benchmark/score/parsers/SonarQubeLegacyReader.java

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
import org.w3c.dom.NodeList;
3232
import org.xml.sax.InputSource;
3333

34-
public class SonarReader extends Reader {
34+
public class SonarQubeLegacyReader extends Reader {
3535

3636
public TestResults parse(File f) throws Exception {
3737
DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
@@ -78,8 +78,37 @@ private TestCaseResult parseSonarIssue(Node flaw) {
7878
return null;
7979
}
8080

81+
// //case "Build Misconfiguration" : return 00;
82+
// case "Command Injection" : return 78;
83+
// case "Cookie Security" : return 614;
84+
// case "Cross-Site Scripting" : return 79;
85+
// //case "Dead Code" : return 00;
86+
// //case "Denial of Service" : return 00;
87+
// case "Header Manipulation" : return 113;
88+
// case "Insecure Randomness" : return 330;
89+
// //case "J2EE Bad Practices" : return 00;
90+
// case "LDAP Injection" : return 90;
91+
// //case "Missing Check against Null" : return 00;
92+
// //case "Null Dereference" : return 00;
93+
// case "Password Management" : return 00;
94+
// case "Path Manipulation" : return 22;
95+
// //case "Poor Error Handling" : return 00;
96+
// //case "Poor Logging Practice" : return 00;
97+
// //case "Poor Style" : return 00;
98+
// //case "Resource Injection" : return 00;
99+
// case "SQL Injection" : return 89;
100+
// //case "System Information Leak" : return 00;
101+
// case "Trust Boundary Violation" : return 501;
102+
// //case "Unreleased Resource" : return 00;
103+
// //case "Unsafe Reflection" : return 00;
104+
// case "Weak Cryptographic Hash" : return 328;
105+
// case "Weak Encryption" : return 327;
106+
// case "XPath Injection" : return 643;
107+
81108

82-
private int cweLookup(String squidNumber) {
109+
110+
111+
public static int cweLookup(String squidNumber) {
83112
switch( squidNumber ) {
84113
case "S00105" : return 0000; //S00105-Replace all tab characters in this file by sequences of white-spaces.
85114
case "S106" : return 0000; //S00106-Replace this usage of System.out or System.err by a logger.
@@ -106,7 +135,7 @@ private int cweLookup(String squidNumber) {
106135
case "S1948" : return 594; //S1948-Fields in a"Serializable" class should either be transient or serializable
107136
case "S2068" : return 259; //S2068-Credentials should not be hard-coded
108137
case "S2070" : return 328; //S2070-SHA-1 and Message-Digest hash algorithms should not be used
109-
case "S2076" : return 88; //S2076-Values passed to OS commands should be sanitized
138+
case "S2076" : return 78; //S2076-Values passed to OS commands should be sanitized
110139
case "S2077" : return 89; //S2077-Values passed to SQL commands should be sanitized
111140
case "S2078" : return 90; //S2078-Values passed to LDAP queries should be sanitized
112141
case "S2089" : return 293; //S2089-HTTP referers should not be relied on

0 commit comments

Comments
 (0)