Skip to content

Commit e9234af

Browse files
darkspirit510darkspirit510
authored
Reader for BlackDuck (#167)
* Reader for BlackDuck * fix testfile
1 parent a9fcd12 commit e9234af

File tree

4 files changed

+208
-0
lines changed

4 files changed

+208
-0
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/BlackDuckReader.java‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5+
* details, please see <a
6+
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
7+
*
8+
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12+
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13+
* PURPOSE. See the GNU General Public License for more details.
14+
*
15+
* @author Sascha Knoop
16+
* @created 2025
17+
*/
18+
package org.owasp.benchmarkutils.score.parsers;
19+
20+
import static java.lang.Integer.parseInt;
21+
22+
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
23+
import com.fasterxml.jackson.annotation.JsonProperty;
24+
import java.util.List;
25+
import java.util.Map;
26+
import java.util.stream.Collectors;
27+
import org.owasp.benchmarkutils.score.BenchmarkScore;
28+
import org.owasp.benchmarkutils.score.ResultFile;
29+
import org.owasp.benchmarkutils.score.TestCaseResult;
30+
import org.owasp.benchmarkutils.score.TestSuiteResults;
31+
32+
public class BlackDuckReader extends Reader {
33+
34+
@Override
35+
public boolean canRead(ResultFile resultFile) {
36+
return resultFile.isJson()
37+
&& resultFile.json().has("driver")
38+
&& resultFile.json().get("driver").equals("polaris_blackduck");
39+
}
40+
41+
@Override
42+
public TestSuiteResults parse(ResultFile resultFile) throws Exception {
43+
TestSuiteResults tr =
44+
new TestSuiteResults("BlackDuck", true, TestSuiteResults.ToolType.SAST);
45+
46+
Report report = jsonMapper.readValue(resultFile.content(), Report.class);
47+
48+
report.items.stream()
49+
.filter(Item::isRelevant)
50+
.forEach(
51+
item -> {
52+
Map<String, String> properties = item.mappedProperties();
53+
54+
String testfile =
55+
extractFilenameWithoutEnding(properties.get("filename"));
56+
57+
TestCaseResult tcr = new TestCaseResult();
58+
59+
tcr.setCWE(parseInt(properties.get("cwe").substring(4)));
60+
tcr.setNumber(testNumber(testfile));
61+
62+
tr.put(tcr);
63+
});
64+
65+
return tr;
66+
}
67+
68+
@JsonIgnoreProperties(ignoreUnknown = true)
69+
private static class Report {
70+
71+
@JsonProperty("_items")
72+
public List<Item> items;
73+
}
74+
75+
@JsonIgnoreProperties(ignoreUnknown = true)
76+
public static class Item {
77+
78+
@JsonProperty("occurrenceProperties")
79+
public List<Property> properties;
80+
81+
public Map<String, String> mappedProperties() {
82+
return properties.stream().collect(Collectors.toMap(Property::key, Property::value));
83+
}
84+
85+
public boolean isRelevant() {
86+
return properties.stream()
87+
.anyMatch(property -> property.value.contains(BenchmarkScore.TESTCASENAME));
88+
}
89+
}
90+
91+
@JsonIgnoreProperties(ignoreUnknown = true)
92+
public static class Property {
93+
public String key;
94+
public String value;
95+
96+
public String key() {
97+
return key;
98+
}
99+
100+
public String value() {
101+
return value;
102+
}
103+
}
104+
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/Reader.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ public static List<Reader> allReaders() {
5656
new AppScanSourceReader(),
5757
new ArachniReader(),
5858
new BearerReader(),
59+
new BlackDuckReader(),
5960
new BurpJsonReader(),
6061
new BurpReader(),
6162
new CASTAIPReader(),

‎plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/BlackDuckReaderTest.java‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5+
* details, please see <a
6+
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
7+
*
8+
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12+
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13+
* PURPOSE. See the GNU General Public License for more details.
14+
*
15+
* @author Sascha Knoop
16+
* @created 2025
17+
*/
18+
package org.owasp.benchmarkutils.score.parsers;
19+
20+
import static org.junit.jupiter.api.Assertions.assertEquals;
21+
import static org.junit.jupiter.api.Assertions.assertTrue;
22+
23+
import org.junit.jupiter.api.BeforeEach;
24+
import org.junit.jupiter.api.Test;
25+
import org.owasp.benchmarkutils.score.BenchmarkScore;
26+
import org.owasp.benchmarkutils.score.CweNumber;
27+
import org.owasp.benchmarkutils.score.ResultFile;
28+
import org.owasp.benchmarkutils.score.TestHelper;
29+
import org.owasp.benchmarkutils.score.TestSuiteResults;
30+
31+
public class BlackDuckReaderTest extends ReaderTestBase {
32+
33+
private ResultFile resultFile;
34+
35+
@BeforeEach
36+
void setUp() {
37+
resultFile = TestHelper.resultFileOf("testfiles/Benchmark-BlackDuck.json");
38+
BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39+
}
40+
41+
@Test
42+
public void onlyBlackDuckReaderReportsCanReadAsTrue() {
43+
assertOnlyMatcherClassIs(this.resultFile, BlackDuckReader.class);
44+
}
45+
46+
@Test
47+
void readerHandlesGivenResultFile() throws Exception {
48+
BlackDuckReader reader = new BlackDuckReader();
49+
TestSuiteResults result = reader.parse(resultFile);
50+
51+
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52+
assertTrue(result.isCommercial());
53+
assertEquals("BlackDuck", result.getToolName());
54+
55+
assertEquals(2, result.getTotalResults());
56+
57+
assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58+
assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
59+
}
60+
}

‎plugin/src/test/resources/testfiles/Benchmark-BlackDuck.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"driver": "polaris_blackduck",
3+
"_items": [
4+
{
5+
"id": "11111111111111111111111111111111",
6+
"weaknessId": "w-1",
7+
"type": {
8+
"id": "11111111-1111-1111-1111-111111111111",
9+
"altName": "sql_injection:nosink|java"
10+
},
11+
"occurrenceProperties": [
12+
{
13+
"key": "filename",
14+
"value": "BenchmarkTest00001.java"
15+
},
16+
{
17+
"key": "cwe",
18+
"value": "CWE-89"
19+
}
20+
],
21+
"_type": "issues"
22+
},
23+
{
24+
"id": "22222222222222222222222222222222",
25+
"weaknessId": "w-2",
26+
"type": {
27+
"id": "22222222-2222-2222-2222-222222222222",
28+
"altName": "xss|java"
29+
},
30+
"occurrenceProperties": [
31+
{
32+
"key": "filename",
33+
"value": "BenchmarkTest00002.java"
34+
},
35+
{
36+
"key": "cwe",
37+
"value": "CWE-79"
38+
}
39+
]
40+
}
41+
],
42+
"totalCount": 2
43+
}

0 commit comments

Comments
 (0)