Skip to content

Commit 22f45fd

Browse files
author
Dave Wichers
committed
Merge branch 'main' into generalizeScoring
2 parents e38ab13 + 4a10dc2 commit 22f45fd

File tree

64 files changed

+498
-342
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+498
-342
lines changed

‎.mvn/jvm.config‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,8 @@
11
--add-exports jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
22
--add-opens java.base/java.lang=ALL-UNNAMED
3+
4+
--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
5+
--add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED
6+
--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
7+
--add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
8+
--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED

‎plugin/pom.xml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
<dependency>
4848
<groupId>com.google.guava</groupId>
4949
<artifactId>guava</artifactId>
50-
<version>33.3.1-jre</version>
50+
<version>33.4.0-jre</version>
5151
</dependency>
5252

5353
<dependency>
@@ -65,7 +65,7 @@
6565
<dependency>
6666
<groupId>commons-io</groupId>
6767
<artifactId>commons-io</artifactId>
68-
<version>2.17.0</version>
68+
<version>2.18.0</version>
6969
</dependency>
7070

7171
<dependency>
@@ -77,7 +77,7 @@
7777
<dependency>
7878
<groupId>org.apache.commons</groupId>
7979
<artifactId>commons-csv</artifactId>
80-
<version>1.12.0</version>
80+
<version>1.13.0</version>
8181
</dependency>
8282

8383
<dependency>
@@ -95,7 +95,7 @@
9595
<dependency>
9696
<groupId>org.apache.httpcomponents.core5</groupId>
9797
<artifactId>httpcore5</artifactId>
98-
<version>5.3.1</version>
98+
<version>5.3.2</version>
9999
</dependency>
100100

101101
<dependency>
@@ -134,7 +134,7 @@
134134
<dependency>
135135
<groupId>org.json</groupId>
136136
<artifactId>json</artifactId>
137-
<version>20240303</version>
137+
<version>20250107</version>
138138
</dependency>
139139

140140
<dependency>
@@ -192,10 +192,10 @@
192192
</build>
193193

194194
<properties>
195-
<version.fasterxml.jackson>2.18.1</version.fasterxml.jackson>
195+
<version.fasterxml.jackson>2.18.2</version.fasterxml.jackson>
196196
<!-- 3.0.3+ version of eclipse.persistence requires jakarta.xml.bind instead of jaxb -->
197197
<version.eclipse.persistence>2.7.15</version.eclipse.persistence>
198-
<version.junit.jupiter>5.11.3</version.junit.jupiter>
198+
<version.junit.jupiter>5.11.4</version.junit.jupiter>
199199
</properties>
200200

201201
</project>

‎plugin/src/main/java/org/owasp/benchmarkutils/helpers/CWE.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public class CWE {
2121
private final int CWENumber; // e.g., 79
2222
private final String
2323
description; // e.g., Improper Neutralization of Input During Web Page Generation
24+
2425
// ('Cross-site Scripting')
2526

2627
public CWE(int cwe, String description) {

‎plugin/src/main/java/org/owasp/benchmarkutils/score/BenchmarkScore.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -714,6 +714,8 @@ private static ToolMetrics calculateMetrics(
714714
// c.tp & c.fp can both be zero, creating a precision of NaN. So set to 0.0.
715715
if (Double.isNaN(precision)) precision = 0.0;
716716
double tpr = (double) c.tp / (double) (c.tp + c.fn);
717+
// c.tp & c.fn can both be zero, creating an tpr of NaN. So set to 0.0.
718+
if (Double.isNaN(tpr)) tpr = 0.0;
717719
double fpr = (double) c.fp / (double) (c.fp + c.tn);
718720
// c.fp & c.tn can both be zero, creating an fpr of NaN. So set to 0.0.
719721
if (Double.isNaN(fpr)) fpr = 0.0;

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/ZapJsonReader.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -193,14 +193,14 @@ static int mapCwe(String cwe) {
193193
case "91": // XML Injection (aka Blind XPath Injection)
194194
case "120": // Classic Buffer Overflow (Not possible in Java)
195195
case "134": // Use of Externally-Controlled Format String
196-
case "190": // Integer Overflow
196+
case "190": // Integer Overflow or Wraparound
197197
case "200": // Exposure of Sensitive Information to Unauthorized Actor - When 500 errors
198198
// are returned
199199
case "345": // Insufficient Verification of Data Authenticity
200200
case "359": // Exposure of Private Personal Information to an Unauthorized Actor
201201
case "436": // Interpretation Conflict
202202
case "525": // Browser caching sensitive data
203-
case "541": // Inclusion of Sensitive Info in Include File
203+
case "541": // Sensitive Info found in an Include File
204204
case "565": // Reliance on Cookies without Validation and Integrity Checking
205205
case "693": // Protection Mechanism Failure
206206
case "829": // Inclusion of Functionality from Untrusted Control Sphere (e.g., CDN)
@@ -210,7 +210,7 @@ static int mapCwe(String cwe) {
210210
return Integer.parseInt(cwe); // Return the CWE anyway.
211211

212212
default:
213-
System.out.println("WARNING: Unmapped ZAP CWE encountered: " + cwe);
213+
System.out.println("WARNING: No CWE mapping found for CWE: " + cwe);
214214
return Integer.parseInt(cwe);
215215
}
216216
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/CodeQLReader.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,12 @@
1919
*/
2020
package org.owasp.benchmarkutils.score.parsers.sarif;
2121

22+
import org.json.JSONArray;
23+
import org.json.JSONException;
24+
import org.json.JSONObject;
2225
import org.owasp.benchmarkutils.score.CweNumber;
26+
import org.owasp.benchmarkutils.score.ResultFile;
27+
import org.owasp.benchmarkutils.score.TestSuiteResults;
2328

2429
public class CodeQLReader extends SarifReader {
2530

@@ -37,4 +42,43 @@ public int mapCwe(int cwe) {
3742
}
3843
return cwe;
3944
}
45+
46+
/**
47+
* Override setVersion to include the version number of the 'codeql/java-queries' ruleset with
48+
* the version of the tool. Since both the tool version and the ruleset version can seperately
49+
* affect the codeQL score.
50+
*/
51+
@Override
52+
public void setVersion(ResultFile resultFile, TestSuiteResults testSuiteResults) {
53+
JSONObject driver = toolDriver(firstRun(resultFile));
54+
55+
String version = "unknown";
56+
if (driver.has("semanticVersion")) {
57+
version = driver.getString("semanticVersion");
58+
} else if (driver.has("version")) {
59+
version = driver.getString("version");
60+
}
61+
62+
// Search for codeql/java-queries ruleset version and add that to the tool version
63+
try {
64+
JSONArray extensions =
65+
firstRun(resultFile).getJSONObject("tool").getJSONArray("extensions");
66+
67+
for (int i = 0; i < extensions.length(); i++) {
68+
JSONObject extension = extensions.getJSONObject(i);
69+
String name = extension.getString("name");
70+
if ("codeql/java-queries".equals(name)) {
71+
// looking for:
72+
// "semanticVersion": "1.1.9+de325133c7a95d84489acdf5a6ced07886ff5c6d",
73+
String rulesetVersion = extension.getString("semanticVersion");
74+
rulesetVersion = rulesetVersion.substring(0, rulesetVersion.indexOf('+'));
75+
version += "_w" + rulesetVersion + "rules";
76+
}
77+
}
78+
} catch (JSONException e) {
79+
// Do nothing it if can't be found.
80+
}
81+
82+
testSuiteResults.setToolVersion(version);
83+
}
4084
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/ContrastScanReader.java‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ public ContrastScanReader() {
3434
public Map<String, Integer> customRuleCweMappings(JSONObject driver) {
3535
Map<String, Integer> ruleCweMap = new HashMap<>();
3636

37+
// The following are the ruleIds for Contrast scan for Java war/jar files
3738
ruleCweMap.put("unsafe-code-execution", CweNumber.COMMAND_INJECTION);
3839
ruleCweMap.put("cmd-injection", CweNumber.COMMAND_INJECTION);
3940
ruleCweMap.put("cookie-flags-missing", CweNumber.INSECURE_COOKIE);
@@ -43,19 +44,122 @@ public Map<String, Integer> customRuleCweMappings(JSONObject driver) {
4344
ruleCweMap.put("header-injection", CweNumber.HTTP_RESPONSE_SPLITTING);
4445
ruleCweMap.put("hql-injection", CweNumber.HIBERNATE_INJECTION);
4546
ruleCweMap.put("ldap-injection", CweNumber.LDAP_INJECTION);
47+
ruleCweMap.put("log-injection", 117);
4648
ruleCweMap.put("nosql-injection", CweNumber.SQL_INJECTION);
4749
ruleCweMap.put("path-traversal", CweNumber.PATH_TRAVERSAL);
4850
ruleCweMap.put("reflected-xss", CweNumber.XSS);
51+
ruleCweMap.put("reflection-injection", 470); // CWE-470 Unsafe Reflection
4952
ruleCweMap.put("sql-injection", CweNumber.SQL_INJECTION);
5053
ruleCweMap.put("trust-boundary-violation", CweNumber.TRUST_BOUNDARY_VIOLATION);
54+
// CWE-111 Direct Use of Unsafe JNI
55+
ruleCweMap.put("unmanaged-code-invocation", 111);
56+
// CWE-770 Allocation of Resources Without Limits or Throttling
57+
ruleCweMap.put("unsafe-readline", 770);
58+
// CWE-601 URL Redirection to Untrusted Site (Open Redirect)
59+
ruleCweMap.put("unvalidated-redirect", 601);
5160
ruleCweMap.put("xpath-injection", CweNumber.XPATH_INJECTION);
5261
ruleCweMap.put("xxe", CweNumber.XXE);
62+
ruleCweMap.put("autocomplete-missing", 522); // CWE-522 Insufficiently Protected Creds
63+
64+
// The following are the ruleIds for Contrast scan for HTML source code files
65+
// See HTML rules: https://docs.contrastsecurity.com/en/html-scan-rules.html
66+
ruleCweMap.put(
67+
"OPT.HTML.MissingPasswordFieldMasking",
68+
549); // CWE-549 Missing Password Field Masking
69+
70+
// The following are the ruleIds for Contrast scan for Java source code files
71+
// See Java rules: https://docs.contrastsecurity.com/en/java-scan-rules.html
72+
73+
// Don't access/modify java.security config objects (Policy, Security, Provider, Principal,
74+
// KeyStore)
75+
ruleCweMap.put("OPT.JAVA.EJB.DontModifyAccessSecurity", CweNumber.DONTCARE);
76+
ruleCweMap.put("OPT.JAVA.RGS.CMP", 486); // Comparison of Classes by Name
77+
// Java access restriction subverted by using reflection. (e.g., protected/private methods).
78+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AccessibilitySubversionRule", 506); // Malicious Code
79+
// CWE-111 Direct Use of Unsafe JNI
80+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidNativeCallsRule", 111);
81+
// CWE-245: Direct Mgt of Connection
82+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EEDirectDatabaseConnection", 245);
83+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EEExplicitSocket", 246); // Direct Use of Sockets
84+
ruleCweMap.put(
85+
"OPT.JAVA.SEC_JAVA.AvoidJ2EEExplicitThreadManagement",
86+
383); // Direct Use of Threads
87+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EEJvmExit", 382); // Use of System.exit()
88+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.AvoidJ2EELeftoverDebugCode", 489); // Active Debug Code
89+
// CWE-502: Deserialization of Untrusted Data
90+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CodeInjectionWithDeserializationRule", 502);
91+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CodeInjectionRule", 94); // Code Injection
92+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CommandInjectionRule", CweNumber.COMMAND_INJECTION);
93+
// XHSM. No CWE
94+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CrossSiteRequestForgeryRule", CweNumber.CSRF);
95+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CrossSiteHistoryManipulation", CweNumber.DONTCARE);
96+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.CrossSiteScriptingRule", CweNumber.XSS);
97+
// CWE-676: Use of Potentially Dangerous Function
98+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ESAPIBannedRule", 676);
99+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ExecutionAfterRedirect", 698); // Execution after Redirect
100+
// CWE-134: Use of Externally-Controlled Format String
101+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ExternalControlOfConfigurationSetting", 134);
102+
// CWE-15: External Control of System or Configuration Setting
103+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.FormatStringInjectionRule", 15);
104+
// CWE-321: Hard-coded Crypto Key
105+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HardcodedCryptoKey", 321);
106+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HardcodedUsernamePassword", 798); // Hardcoded Creds
107+
// CWE-235: Improper Handling Extra Params
108+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HttpParameterPollutionRule", 235);
109+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.HttpSplittingRule", 113); // HTTP Req/Resp Splitting
110+
// Mapping InadequatePaddingRule to CWE-327 Weak Crypto, causes LOTS of False Positives
111+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InadequatePaddingRule", CweNumber.DONTCARE);
112+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InformationExposureThroughErrorMessage", 209);
113+
// CWE-20: Improper Input Validation
114+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InputPathNotCanonicalizedRule", 20);
115+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InsecureRandomnessRule", CweNumber.WEAK_RANDOM);
116+
// CWE-319: Cleartext transmission of sensitive data
117+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.InsecureTransport", 319);
118+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.LdapInjectionRule", CweNumber.LDAP_INJECTION);
119+
// CWE-329: Generation of Predictable IV with CBC Mode
120+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.NonRandomIVWithCBCMode", 329);
121+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.OpenRedirectRule", 601); // CWE-601 Open Redirect
122+
ruleCweMap.put(
123+
"OPT.JAVA.SEC_JAVA.PasswordInCommentRule", 615); // Sensitive Info in Comments
124+
ruleCweMap.put(
125+
"OPT.JAVA.SEC_JAVA.PasswordInConfigurationFile", 256); // Plaintext Password Storage
126+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.PathTraversalRule", CweNumber.PATH_TRAVERSAL);
127+
// CWE-315: Cleartext Storage of Sensitive Info in Cookie
128+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.PlaintextStorageInACookieRule", 315);
129+
ruleCweMap.put(
130+
"OPT.JAVA.SEC_JAVA.PlaintextStorageOfPassword", 256); // Plaintext Password Storage
131+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.PotentialInfiniteLoop", 835); // Infinite Loop
132+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ProcessControlRule", 114); // Process Control
133+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.ServerSideRequestForgeryRule", 918); // SSRF
134+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.SqlInjectionRule", CweNumber.SQL_INJECTION);
135+
ruleCweMap.put(
136+
"OPT.JAVA.SEC_JAVA.TrustBoundaryViolationRule", CweNumber.TRUST_BOUNDARY_VIOLATION);
137+
ruleCweMap.put(
138+
"OPT.JAVA.SEC_JAVA.UnnormalizedInputString", 20); // Improper Input Validation
139+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.UnsafeCookieRule", 614); // No secure attribute
140+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.UnsafeReflection", 470); // Unsafe Reflection
141+
// CWE-566: Authorization Bypass Thru User-Controlled SQL Primary Key
142+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.UserControlledSQLPrimaryKey", 566);
143+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.WeakCryptographicHashRule", CweNumber.WEAK_HASH_ALGO);
144+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.WeakEncryptionRule", CweNumber.WEAK_CRYPTO_ALGO);
145+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.WebXmlSecurityMisconfigurationsRule", CweNumber.DONTCARE);
146+
ruleCweMap.put("OPT.JAVA.SEC_JAVA.XPathInjectionRule", CweNumber.XPATH_INJECTION);
53147

54148
return ruleCweMap;
55149
}
56150

57151
@Override
58152
public void setVersion(ResultFile resultFile, TestSuiteResults testSuiteResults) {
59153
// SARIF file contains several nulls as version, just ignoring it
154+
// Instead, we use the 'version' to set the type of CodeSec scan. WAR, JAR, SAST, etc.
155+
JSONObject firstrun = resultFile.json().getJSONArray("runs").getJSONObject(0);
156+
String commandLine =
157+
firstrun.getJSONArray("invocations").getJSONObject(0).getString("commandLine");
158+
159+
if (commandLine.contains("contrast-scan-java-cli")) {
160+
if (commandLine.endsWith("jar")) testSuiteResults.setToolVersion("OfJAR");
161+
else if (commandLine.endsWith("war")) testSuiteResults.setToolVersion("OfWAR");
162+
} else if (commandLine.contains("sast-engine"))
163+
testSuiteResults.setToolVersion("OfSourceCode");
60164
}
61165
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/SarifReader.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,11 +63,11 @@ private String sarifToolName(ResultFile resultFile) {
6363
return toolDriver(firstRun(resultFile)).getString("name");
6464
}
6565

66-
private static JSONObject firstRun(ResultFile resultFile) {
66+
static JSONObject firstRun(ResultFile resultFile) {
6767
return resultFile.json().getJSONArray("runs").getJSONObject(0);
6868
}
6969

70-
private static JSONObject toolDriver(JSONObject run) {
70+
static JSONObject toolDriver(JSONObject run) {
7171
return run.getJSONObject("tool").getJSONObject("driver");
7272
}
7373

@@ -255,6 +255,7 @@ private TestCaseResult testCaseResultFor(JSONObject result, Map<String, Integer>
255255
int cwe = mappings.getOrDefault(ruleId, -1);
256256

257257
if (cwe == -1) {
258+
System.out.println("WARNING: No CWE mapping found for ruleID: " + ruleId);
258259
return null;
259260
}
260261

‎plugin/src/main/java/org/owasp/benchmarkutils/score/report/ScatterHome.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ private void makeDataLabels(Set<Tool> tools, XYPlot xyplot) {
170170
}
171171

172172
private static SecureRandom sr = new SecureRandom();
173+
173174
// This method generates all the points put on the home page chart. One per tool.
174175
private HashMap<Point2D, String> makePointList(Set<Tool> tools) {
175176
HashMap<Point2D, String> map = new HashMap<Point2D, String>();

‎plugin/src/main/java/org/owasp/benchmarkutils/score/service/ExpectedResultsProvider.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ public class ExpectedResultsProvider {
4242
private static final String CWE = " cwe";
4343

4444
private static final String SOURCE = " source";
45-
private static final String DATA_FLOW = " vuln src";
46-
private static final String SINK = " vuln df";
45+
private static final String DATA_FLOW = " data flow";
46+
private static final String SINK = " sink";
4747

4848
private static boolean standardBenchmarkStyleScoring;
4949
private static TestSuiteResults expectedResults;

0 commit comments

Comments
 (0)