Skip to content

Commit 66f2d5a

Browse files
author
Dave Wichers
committed
Merge commit 'refs/pull/136/head' of https://github.com/OWASP-Benchmark/BenchmarkUtils into generalizeScoring
2 parents 07eb867 + 4b45149 commit 66f2d5a

File tree

6 files changed

+245
-18
lines changed

6 files changed

+245
-18
lines changed

‎plugin/pom.xml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
<dependency>
4848
<groupId>com.google.guava</groupId>
4949
<artifactId>guava</artifactId>
50-
<version>33.3.0-jre</version>
50+
<version>33.3.1-jre</version>
5151
</dependency>
5252

5353
<dependency>
@@ -65,7 +65,7 @@
6565
<dependency>
6666
<groupId>commons-io</groupId>
6767
<artifactId>commons-io</artifactId>
68-
<version>2.16.1</version>
68+
<version>2.17.0</version>
6969
</dependency>
7070

7171
<dependency>
@@ -77,25 +77,25 @@
7777
<dependency>
7878
<groupId>org.apache.commons</groupId>
7979
<artifactId>commons-csv</artifactId>
80-
<version>1.11.0</version>
80+
<version>1.12.0</version>
8181
</dependency>
8282

8383
<dependency>
8484
<groupId>org.apache.commons</groupId>
8585
<artifactId>commons-lang3</artifactId>
86-
<version>3.16.0</version>
86+
<version>3.17.0</version>
8787
</dependency>
8888

8989
<dependency>
9090
<groupId>org.apache.httpcomponents.client5</groupId>
9191
<artifactId>httpclient5</artifactId>
92-
<version>5.3.1</version>
92+
<version>5.4.1</version>
9393
</dependency>
9494

9595
<dependency>
9696
<groupId>org.apache.httpcomponents.core5</groupId>
9797
<artifactId>httpcore5</artifactId>
98-
<version>5.2.5</version>
98+
<version>5.3.1</version>
9999
</dependency>
100100

101101
<dependency>
@@ -108,7 +108,7 @@
108108
<dependency>
109109
<groupId>org.apache.maven.plugin-tools</groupId>
110110
<artifactId>maven-plugin-annotations</artifactId>
111-
<version>3.15.0</version>
111+
<version>3.15.1</version>
112112
<scope>provided</scope>
113113
</dependency>
114114

@@ -140,7 +140,7 @@
140140
<dependency>
141141
<groupId>org.yaml</groupId>
142142
<artifactId>snakeyaml</artifactId>
143-
<version>2.2</version>
143+
<version>2.3</version>
144144
</dependency>
145145

146146
<!-- The following dependency might be an upgrade/replacement for jaxb.xml.bind.JAXBContext,
@@ -192,10 +192,10 @@
192192
</build>
193193

194194
<properties>
195-
<version.fasterxml.jackson>2.17.2</version.fasterxml.jackson>
195+
<version.fasterxml.jackson>2.18.1</version.fasterxml.jackson>
196196
<!-- 3.0.3+ version of eclipse.persistence requires jakarta.xml.bind instead of jaxb -->
197197
<version.eclipse.persistence>2.7.15</version.eclipse.persistence>
198-
<version.junit.jupiter>5.11.0</version.junit.jupiter>
198+
<version.junit.jupiter>5.11.3</version.junit.jupiter>
199199
</properties>
200200

201201
</project>

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/Reader.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import org.owasp.benchmarkutils.score.parsers.sarif.CodeQLReader;
3333
import org.owasp.benchmarkutils.score.parsers.sarif.ContrastScanReader;
3434
import org.owasp.benchmarkutils.score.parsers.sarif.DatadogSastReader;
35+
import org.owasp.benchmarkutils.score.parsers.sarif.PTAIReader;
3536
import org.owasp.benchmarkutils.score.parsers.sarif.PrecautionReader;
3637
import org.owasp.benchmarkutils.score.parsers.sarif.SemgrepSarifReader;
3738
import org.owasp.benchmarkutils.score.parsers.sarif.SnykReader;
@@ -90,6 +91,7 @@ public static List<Reader> allReaders() {
9091
new ParasoftReader(),
9192
new PrecautionReader(),
9293
new PMDReader(),
94+
new PTAIReader(),
9395
new QualysWASReader(),
9496
new Rapid7Reader(),
9597
new ReshiftReader(),

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/PTAIReader.java‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5+
* details, please see <a
6+
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
7+
*
8+
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12+
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13+
* PURPOSE. See the GNU General Public License for more details.
14+
*
15+
* @author Alexey Zhukov
16+
* @created 2024
17+
*/
18+
package org.owasp.benchmarkutils.score.parsers.sarif;
19+
20+
import org.owasp.benchmarkutils.score.CweNumber;
21+
import org.owasp.benchmarkutils.score.ResultFile;
22+
import org.owasp.benchmarkutils.score.TestSuiteResults;
23+
24+
public class PTAIReader extends SarifReader {
25+
26+
static final int PTAI_CWE_EXTERNAL_FILEPATH_CONTROL = 73;
27+
static final int PTAI_CWE_BLIND_XPATH_INJECTION = 91;
28+
29+
static final String EXPECTED_TOOL_NAME = "Positive Technologies Application Inspector";
30+
static final String SHORTENED_TOOL_NAME = "PT Application Inspector";
31+
32+
public PTAIReader() {
33+
super(EXPECTED_TOOL_NAME, true, CweSourceType.FIELD);
34+
}
35+
36+
@Override
37+
public String toolName(ResultFile resultFile) {
38+
return SHORTENED_TOOL_NAME;
39+
}
40+
41+
/**
42+
* SARIF report tool version field is too long as it contains build number. Shorten it to X.Y.Z
43+
*/
44+
@Override
45+
public void setVersion(ResultFile resultFile, TestSuiteResults testSuiteResults) {
46+
super.setVersion(resultFile, testSuiteResults);
47+
String version = testSuiteResults.getToolVersion();
48+
String[] versionItems = version.split("\\.");
49+
if (versionItems.length < 4) return;
50+
testSuiteResults.setToolVersion(
51+
String.format("%s.%s.%s", versionItems[0], versionItems[1], versionItems[2]));
52+
}
53+
54+
@Override
55+
public int mapCwe(int cwe) {
56+
switch (cwe) {
57+
case PTAI_CWE_EXTERNAL_FILEPATH_CONTROL:
58+
return CweNumber.PATH_TRAVERSAL;
59+
case PTAI_CWE_BLIND_XPATH_INJECTION:
60+
return CweNumber.XPATH_INJECTION;
61+
}
62+
return cwe;
63+
}
64+
}

‎plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/PTAIReaderTest.java‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5+
* details, please see <a
6+
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
7+
*
8+
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12+
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13+
* PURPOSE. See the GNU General Public License for more details.
14+
*
15+
* @author Alexey Zhukov
16+
* @created 2024
17+
*/
18+
package org.owasp.benchmarkutils.score.parsers.sarif;
19+
20+
import static org.junit.jupiter.api.Assertions.assertEquals;
21+
22+
import org.junit.jupiter.api.BeforeEach;
23+
import org.junit.jupiter.api.Test;
24+
import org.owasp.benchmarkutils.score.*;
25+
import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
26+
27+
public class PTAIReaderTest extends ReaderTestBase {
28+
29+
private ResultFile resultFile;
30+
31+
@BeforeEach
32+
void setUp() {
33+
resultFile = TestHelper.resultFileOf("testfiles/Benchmark_PTAI-v4.7.2.sarif");
34+
BenchmarkScore.TESTCASENAME = "BenchmarkTest";
35+
}
36+
37+
@Test
38+
public void onlyPTAIReaderTestReportsCanReadAsTrue() {
39+
assertOnlyMatcherClassIs(this.resultFile, PTAIReader.class);
40+
}
41+
42+
@Test
43+
void readerHandlesGivenResultFile() throws Exception {
44+
PTAIReader reader = new PTAIReader();
45+
TestSuiteResults result = reader.parse(resultFile);
46+
47+
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
48+
49+
assertEquals("PT Application Inspector", result.getToolName());
50+
assertEquals("4.7.2", result.getToolVersion());
51+
52+
assertEquals(2, result.getTotalResults());
53+
54+
assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
55+
assertEquals(CweNumber.SQL_INJECTION, result.get(8).get(0).getCWE());
56+
}
57+
}

‎plugin/src/test/resources/testfiles/Benchmark_PTAI-v4.7.2.sarif‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"version": "2.1.0",
3+
"$schema": "http://json.schemastore.org/sarif-2.1.0.json",
4+
"runs": [
5+
{
6+
"tool": {
7+
"driver": {
8+
"name": "Positive Technologies Application Inspector",
9+
"version": "4.7.2.36549",
10+
"organization": "Positive Technologies",
11+
"informationUri": "https://www.ptsecurity.com/ww-en/products/ai/",
12+
"rules": [
13+
{
14+
"id": "SQL Injection",
15+
"name": "SQL Injection",
16+
"properties": {
17+
"cwe": [
18+
"CWE-89"
19+
]
20+
},
21+
"defaultConfiguration": {
22+
"level": "error",
23+
"enabled": true
24+
},
25+
"messageStrings": {
26+
"default": {
27+
"text": "SQL Injection"
28+
}
29+
}
30+
},
31+
{
32+
"id": "Arbitrary File Reading",
33+
"name": "Arbitrary File Reading",
34+
"properties": {
35+
"cwe": [
36+
"CWE-73"
37+
]
38+
},
39+
"defaultConfiguration": {
40+
"level": "error",
41+
"enabled": true
42+
},
43+
"messageStrings": {
44+
"default": {
45+
"text": "Arbitrary File Reading"
46+
}
47+
}
48+
}
49+
]
50+
}
51+
},
52+
"results": [
53+
{
54+
"ruleId": "Arbitrary File Reading",
55+
"suppressions": [
56+
],
57+
"message": {
58+
"id": "default",
59+
"text": "Arbitrary File Reading"
60+
},
61+
"locations": [
62+
{
63+
"physicalLocation": {
64+
"artifactLocation": {
65+
"uri": "./src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00001.java"
66+
},
67+
"region": {
68+
"startLine": 71,
69+
"snippet": {
70+
"text": "new java.io.FileInputStream(new java.io.File(fileName))"
71+
}
72+
}
73+
}
74+
}
75+
]
76+
},
77+
{
78+
"ruleId": "SQL Injection",
79+
"suppressions": [
80+
],
81+
"message": {
82+
"id": "default",
83+
"text": "SQL Injection"
84+
},
85+
"locations": [
86+
{
87+
"physicalLocation": {
88+
"artifactLocation": {
89+
"uri": "./src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00008.java"
90+
},
91+
"region": {
92+
"startLine": 57,
93+
"snippet": {
94+
"text": "connection.prepareCall(sql)"
95+
}
96+
}
97+
}
98+
}
99+
]
100+
}
101+
]
102+
}
103+
]
104+
}

‎pom.xml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,12 @@
4848
<plugin>
4949
<groupId>org.apache.maven.plugins</groupId>
5050
<artifactId>maven-dependency-plugin</artifactId>
51-
<version>3.8.0</version>
51+
<version>3.8.1</version>
5252
</plugin>
5353
<plugin>
5454
<groupId>org.apache.maven.plugins</groupId>
5555
<artifactId>maven-plugin-plugin</artifactId>
56-
<version>3.15.0</version>
56+
<version>3.15.1</version>
5757
</plugin>
5858
<plugin>
5959
<groupId>org.apache.maven.plugins</groupId>
@@ -122,7 +122,7 @@
122122
<dependency>
123123
<groupId>org.codehaus.mojo</groupId>
124124
<artifactId>extra-enforcer-rules</artifactId>
125-
<version>1.8.0</version>
125+
<version>1.9.0</version>
126126
</dependency>
127127
</dependencies>
128128
<executions>
@@ -173,13 +173,13 @@
173173
<plugin>
174174
<groupId>org.apache.maven.plugins</groupId>
175175
<artifactId>maven-jxr-plugin</artifactId>
176-
<version>3.5.0</version>
176+
<version>3.6.0</version>
177177
</plugin>
178178

179179
<plugin>
180180
<groupId>org.apache.maven.plugins</groupId>
181181
<artifactId>maven-project-info-reports-plugin</artifactId>
182-
<version>3.7.0</version>
182+
<version>3.8.0</version>
183183
</plugin>
184184

185185
<plugin>
@@ -206,13 +206,13 @@
206206
<plugin>
207207
<groupId>org.apache.maven.plugins</groupId>
208208
<artifactId>maven-surefire-plugin</artifactId>
209-
<version>3.5.0</version>
209+
<version>3.5.2</version>
210210
</plugin>
211211

212212
<plugin>
213213
<groupId>org.codehaus.mojo</groupId>
214214
<artifactId>versions-maven-plugin</artifactId>
215-
<version>2.17.1</version>
215+
<version>2.18.0</version>
216216
</plugin>
217217

218218
<plugin>
@@ -358,7 +358,7 @@
358358
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
359359
<java.target>11</java.target>
360360
<log.directory>${project.build.directory}/log</log.directory>
361-
<version.fluido>2.0.0-M10</version.fluido>
361+
<version.fluido>2.0.0</version.fluido>
362362
</properties>
363363

364364
</project>

0 commit comments

Comments
 (0)