Skip to content

Commit 2c3ee58

Browse files
Alaeddin03Alaeddin03
authored
Added support for Black Duck Coverity (formerly Synopsys) for newer versions (#189)
* Update CoverityReader.java Newer versions greater than 3 are getting handled in the "else" block even though they can be safely parsed by the same configuration for version 3 (as of version 10 currently) * added coverity v10 test file * added tests for coverity v10 * split tests for coverity versions
1 parent db7f69a commit 2c3ee58

File tree

3 files changed

+134
-7
lines changed

3 files changed

+134
-7
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/CoverityReader.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ private TestCaseResult parseCoverityFinding(JSONObject finding, int version) {
6767
TestCaseResult tcr = new TestCaseResult();
6868
String filename = null;
6969

70-
if (version == 3) {
70+
if (version >= 3) {
7171
filename = finding.getString("mainEventFilePathname");
7272
filename = filename.replaceAll("\\\\", "/");
7373
filename = filename.substring(filename.lastIndexOf('/') + 1);

‎plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/CoverityReaderTest.java‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,23 +30,43 @@
3030

3131
public class CoverityReaderTest extends ReaderTestBase {
3232

33-
private ResultFile resultFile;
33+
private ResultFile resultFile_v3, resultFile_v10;
3434

3535
@BeforeEach
3636
void setUp() {
37-
resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Coverity-v3.0.json");
37+
resultFile_v3 = TestHelper.resultFileOf("testfiles/Benchmark_Coverity-v3.0.json");
38+
resultFile_v10 = TestHelper.resultFileOf("testfiles/Benchmark_Coverity-v10.0.json");
3839
BenchmarkScore.TESTCASENAME = "BenchmarkTest";
3940
}
4041

4142
@Test
42-
public void onlyCoverityReaderReportsCanReadAsTrue() {
43-
assertOnlyMatcherClassIs(this.resultFile, CoverityReader.class);
43+
public void onlyCoverityReaderReportsCanReadAsTrueForV3() {
44+
assertOnlyMatcherClassIs(this.resultFile_v3, CoverityReader.class);
45+
}
46+
47+
public void onlyCoverityReaderReportsCanReadAsTrueForV10() {
48+
assertOnlyMatcherClassIs(this.resultFile_v10, CoverityReader.class);
49+
}
50+
51+
@Test
52+
void readerHandlesGivenResultFileInV3() throws Exception {
53+
CoverityReader reader = new CoverityReader();
54+
TestSuiteResults result = reader.parse(resultFile_v3);
55+
56+
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
57+
assertTrue(result.isCommercial());
58+
assertEquals("Coverity Code Advisor", result.getToolName());
59+
60+
assertEquals(2, result.getTotalResults());
61+
62+
assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
63+
assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
4464
}
4565

4666
@Test
47-
void readerHandlesGivenResultFile() throws Exception {
67+
void readerHandlesGivenResultFileInV10() throws Exception {
4868
CoverityReader reader = new CoverityReader();
49-
TestSuiteResults result = reader.parse(resultFile);
69+
TestSuiteResults result = reader.parse(resultFile_v10);
5070

5171
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
5272
assertTrue(result.isCommercial());

‎plugin/src/test/resources/testfiles/Benchmark_Coverity-v10.0.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"type" : "Coverity issues",
3+
"formatVersion" : 10,
4+
"suppressedIssueCount" : 0,
5+
"issues" : [
6+
{
7+
"mergeKey" : "00000000000000000000000000000000",
8+
"occurrenceCountForMK" : 1,
9+
"occurrenceNumberInMK" : 1,
10+
"checkerName" : "PATH_MANIPULATION",
11+
"subcategory" : "none",
12+
"extra" : "fileName",
13+
"domain" : "STATIC_JAVA",
14+
"mainEventFilePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00001.java",
15+
"strippedMainEventFilePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00001.java",
16+
"mainEventLineNumber" : 0,
17+
"properties" : {},
18+
"functionDisplayName" : "org.owasp.benchmark.testcode.BenchmarkTest00001.doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)",
19+
"functionMangledName" : "org.owasp.benchmark.testcode.BenchmarkTest00001.doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)",
20+
"ordered" : true,
21+
"events" : [
22+
{
23+
"covLStrEventDescription" : "Lorem Ipsum",
24+
"eventDescription" : "Lorem Ipsum",
25+
"eventNumber" : 0,
26+
"eventTreePosition" : "0",
27+
"eventSet" : 0,
28+
"eventTag" : "tainted_source",
29+
"filePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00001.java",
30+
"strippedFilePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00001.java",
31+
"lineNumber" : 0,
32+
"main" : false,
33+
"moreInformationId" : null,
34+
"remediation" : false,
35+
"events" : null
36+
}
37+
],
38+
"stateOnServer" : null,
39+
"checkerProperties" : {
40+
"category" : "High impact security",
41+
"categoryDescription" : "High impact security",
42+
"cweCategory" : "22",
43+
"issueKinds" : [
44+
"SECURITY"
45+
],
46+
"eventSetCaptions" : [],
47+
"impact" : "High",
48+
"impactDescription" : "High",
49+
"subcategoryLocalEffect" : "Lorem Ipsum",
50+
"subcategoryShortDescription" : "Lorem Ipsum",
51+
"subcategoryLongDescription" : "Lorem Ipsum"
52+
}
53+
},
54+
{
55+
"mergeKey" : "00000000000000000000000000000000",
56+
"occurrenceCountForMK" : 1,
57+
"occurrenceNumberInMK" : 1,
58+
"checkerName" : "SQLI",
59+
"subcategory" : "sink",
60+
"extra" : "sql",
61+
"domain" : "STATIC_JAVA",
62+
"mainEventFilePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00002.java",
63+
"strippedMainEventFilePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00002.java",
64+
"mainEventLineNumber" : 0,
65+
"properties" : {},
66+
"functionDisplayName" : "org.owasp.benchmark.testcode.BenchmarkTest00002.doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)",
67+
"functionMangledName" : "org.owasp.benchmark.testcode.BenchmarkTest00002.doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)",
68+
"ordered" : true,
69+
"events" : [
70+
{
71+
"covLStrEventDescription" : "Lorem Ipsum",
72+
"eventDescription" : "Lorem Ipsum",
73+
"eventNumber" : 1,
74+
"eventTreePosition" : "0",
75+
"eventSet" : 0,
76+
"eventTag" : "tainted_source",
77+
"filePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00002.java",
78+
"strippedFilePathname" : "somepath\\src\\main\\java\\org\\owasp\\benchmark\\testcode\\BenchmarkTest00002.java",
79+
"lineNumber" : 0,
80+
"main" : false,
81+
"moreInformationId" : null,
82+
"remediation" : false,
83+
"events" : null
84+
}
85+
],
86+
"stateOnServer" : null,
87+
"checkerProperties" : {
88+
"category" : "High impact security",
89+
"categoryDescription" : "High impact security",
90+
"cweCategory" : "89",
91+
"issueKinds" : [
92+
"SECURITY"
93+
],
94+
"eventSetCaptions" : [
95+
"Lorem Ipsum"
96+
],
97+
"impact" : "High",
98+
"impactDescription" : "High",
99+
"subcategoryLocalEffect" : "Lorem Ipsum",
100+
"subcategoryShortDescription" : "Lorem Ipsum",
101+
"subcategoryLongDescription" : "Lorem Ipsum"
102+
}
103+
}
104+
],
105+
"desktopAnalysisSettings" : null,
106+
"error" : null
107+
}

0 commit comments

Comments
 (0)