Skip to content

Commit f6dcf0b

Browse files
author
Dave Wichers
committed
Add support for scoring a Fortify.fpr file converted to SARIF using the
Microsoft SARIF SDK Multitool.
1 parent 4a10dc2 commit f6dcf0b

File tree

5 files changed

+251
-71
lines changed

5 files changed

+251
-71
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/CweNumber.java‎

Lines changed: 53 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -19,168 +19,171 @@
1919

2020
public class CweNumber {
2121

22+
/** Used occasionally to indicate a CWE isn't mapped yet, but might get mapped properly later */
23+
public static final int UNMAPPED = -1;
24+
2225
/** To be used when the CWE reported is one we don't care about in any test suite */
23-
public static int DONTCARE = 0000;
26+
public static final int DONTCARE = 0000;
2427

2528
/** CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') */
26-
public static int PATH_TRAVERSAL = 22;
29+
public static final int PATH_TRAVERSAL = 22;
2730

2831
/** CWE-23: Relative Path Traversal */
29-
public static int RELATIVE_PATH_TRAVERSAL = 23;
32+
public static final int RELATIVE_PATH_TRAVERSAL = 23;
3033

3134
/**
3235
* CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command
3336
* Injection')
3437
*/
35-
public static int COMMAND_INJECTION = 78;
38+
public static final int COMMAND_INJECTION = 78;
3639

3740
/**
3841
* CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
3942
*/
40-
public static int XSS = 79;
43+
public static final int XSS = 79;
4144

4245
/**
4346
* CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
4447
*/
45-
public static int SQL_INJECTION = 89;
48+
public static final int SQL_INJECTION = 89;
4649

4750
/**
4851
* CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
4952
*/
50-
public static int LDAP_INJECTION = 90;
53+
public static final int LDAP_INJECTION = 90;
5154

5255
/** CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') */
53-
public static int CRLF_INJECTION = 93;
56+
public static final int CRLF_INJECTION = 93;
5457

5558
/**
5659
* CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response
5760
* Splitting')
5861
*/
59-
public static int HTTP_RESPONSE_SPLITTING = 113;
62+
public static final int HTTP_RESPONSE_SPLITTING = 113;
6063

6164
/** CWE-134: Use of Externally-Controlled Format String */
62-
public static int EXTERNALLY_CONTROLLED_STRING = 134;
65+
public static final int EXTERNALLY_CONTROLLED_STRING = 134;
6366

6467
/** CWE-284: Improper Access Control */
65-
public static int IMPROPER_ACCESS_CONTROL = 284;
68+
public static final int IMPROPER_ACCESS_CONTROL = 284;
6669

6770
/** CWE-327: Use of a Broken or Risky Cryptographic Algorithm */
68-
public static int WEAK_CRYPTO_ALGO = 327;
71+
public static final int WEAK_CRYPTO_ALGO = 327;
6972

7073
/** CWE-328: Use of Weak Hash */
71-
public static int WEAK_HASH_ALGO = 328;
74+
public static final int WEAK_HASH_ALGO = 328;
7275

7376
/** CWE-329: Generation of Predictable IV with CBC Mode */
74-
public static int STATIC_CRYPTO_INIT = 329;
77+
public static final int STATIC_CRYPTO_INIT = 329;
7578

7679
/** CWE-330: Use of Insufficiently Random Values */
77-
public static int WEAK_RANDOM = 330;
80+
public static final int WEAK_RANDOM = 330;
7881

7982
/** CWE-352: Cross-Site Request Forgery (CSRF) */
80-
public static int CSRF = 352;
83+
public static final int CSRF = 352;
8184

8285
/** CWE-382: J2EE Bad Practices: Use of System.exit() */
83-
public static int SYSTEM_EXIT = 382;
86+
public static final int SYSTEM_EXIT = 382;
8487

8588
/** CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference */
86-
public static int CATCHING_NULL_POINTER_EXCEPTION = 395;
89+
public static final int CATCHING_NULL_POINTER_EXCEPTION = 395;
8790

8891
/** CWE-396: Declaration of Catch for Generic Exception */
89-
public static int CATCH_GENERIC_EXCEPTION = 396;
92+
public static final int CATCH_GENERIC_EXCEPTION = 396;
9093

9194
/** CWE-397: Declaration of Throws for Generic Exception */
92-
public static int THROW_GENERIC_EXCEPTION = 397;
95+
public static final int THROW_GENERIC_EXCEPTION = 397;
9396

9497
/** CWE-478: Missing Default Case in Switch Statement */
95-
public static int MISSING_DEFAULT_CASE = 478;
98+
public static final int MISSING_DEFAULT_CASE = 478;
9699

97100
/** CWE-483: Incorrect Block Delimitation */
98-
public static int INCORRECT_BLOCK_DELIMITATION = 483;
101+
public static final int INCORRECT_BLOCK_DELIMITATION = 483;
99102

100103
/** CWE-484: Omitted Break Statement in Switch */
101-
public static int OMITTED_BREAK = 484;
104+
public static final int OMITTED_BREAK = 484;
102105

103106
/** CWE-493: Critical Public Variable Without Final Modifier */
104-
public static int PUBLIC_VAR_WITHOUT_FINAL = 493;
107+
public static final int PUBLIC_VAR_WITHOUT_FINAL = 493;
105108

106109
/** CWE-500: Public Static Field Not Marked Final */
107-
public static int PUBLIC_STATIC_NOT_FINAL = 500;
110+
public static final int PUBLIC_STATIC_NOT_FINAL = 500;
108111

109112
/** CWE-501: Trust Boundary Violation */
110-
public static int TRUST_BOUNDARY_VIOLATION = 501;
113+
public static final int TRUST_BOUNDARY_VIOLATION = 501;
111114

112115
/** CWE-502: Deserialization of Untrusted Data */
113-
public static int INSECURE_DESERIALIZATION = 502;
116+
public static final int INSECURE_DESERIALIZATION = 502;
114117

115118
/** CWE-523: Unprotected Transport of Credentials */
116-
public static int UNPROTECTED_CREDENTIALS_TRANSPORT = 523;
119+
public static final int UNPROTECTED_CREDENTIALS_TRANSPORT = 523;
117120

118121
/** CWE-532: Insertion of Sensitive Information into Log File */
119-
public static int SENSITIVE_LOGFILE = 532;
122+
public static final int SENSITIVE_LOGFILE = 532;
120123

121124
/** CWE-564: SQL Injection: Hibernate */
122-
public static int HIBERNATE_INJECTION = 564;
125+
public static final int HIBERNATE_INJECTION = 564;
123126

124127
/** CWE-572: Call to Thread run() instead of start() */
125-
public static int THREAD_WRONG_CALL = 572;
128+
public static final int THREAD_WRONG_CALL = 572;
126129

127130
/** CWE-580: clone() Method Without super.clone() */
128-
public static int CLONE_WITHOUT_SUPER_CLONE = 580;
131+
public static final int CLONE_WITHOUT_SUPER_CLONE = 580;
129132

130133
/** CWE-563: Assignment to Variable without Use */
131-
public static int UNUSED_VAR_ASSIGNMENT = 563;
134+
public static final int UNUSED_VAR_ASSIGNMENT = 563;
132135

133136
/** CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined */
134-
public static int OBJECT_MODEL_VIOLATION = 581;
137+
public static final int OBJECT_MODEL_VIOLATION = 581;
135138

136139
/** CWE-583: finalize() Method Declared Public */
137-
public static int FINALIZE_DECLARED_PUBLIC = 583;
140+
public static final int FINALIZE_DECLARED_PUBLIC = 583;
138141

139142
/** CWE-584: Return Inside Finally Block */
140-
public static int RETURN_INSIDE_FINALLY = 584;
143+
public static final int RETURN_INSIDE_FINALLY = 584;
141144

142145
/** CWE-595: Comparison of Object References Instead of Object Contents */
143-
public static int OBJECT_REFERENCE_COMPARISON = 595;
146+
public static final int OBJECT_REFERENCE_COMPARISON = 595;
144147

145148
/** CWE-601: URL Redirection to Untrusted Site ('Open Redirect') */
146-
public static int OPEN_REDIRECT = 601;
149+
public static final int OPEN_REDIRECT = 601;
147150

148151
/** CWE-611: Improper Restriction of XML External Entity Reference */
149-
public static int XXE = 611;
152+
public static final int XXE = 611;
150153

151154
/** CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute */
152-
public static int INSECURE_COOKIE = 614;
155+
public static final int INSECURE_COOKIE = 614;
153156

154157
/** CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection') */
155-
public static int XPATH_INJECTION = 643;
158+
public static final int XPATH_INJECTION = 643;
156159

157160
/**
158161
* CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity
159162
* Checking
160163
*/
161-
public static int OBFUSCATION = 649;
164+
public static final int OBFUSCATION = 649;
162165

163166
/** CWE-754: Improper Check for Unusual or Exceptional Conditions */
164-
public static int IMPROPER_CHECK_FOR_CONDITIONS = 754;
167+
public static final int IMPROPER_CHECK_FOR_CONDITIONS = 754;
165168

166169
/** CWE-783: Operator Precedence Logic Error */
167-
public static int OPERATOR_PRECEDENCE_LOGIC = 783;
170+
public static final int OPERATOR_PRECEDENCE_LOGIC = 783;
168171

169172
/** CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') */
170-
public static int LOOP_WITH_UNREACHABLE_EXIT = 835;
173+
public static final int LOOP_WITH_UNREACHABLE_EXIT = 835;
171174

172175
/** CWE-916: Use of Password Hash With Insufficient Computational Effort */
173-
public static int PASSWORD_HASH_WITH_INSUFFICIENT_COMPUTATIONAL_EFFORT = 916;
176+
public static final int PASSWORD_HASH_WITH_INSUFFICIENT_COMPUTATIONAL_EFFORT = 916;
174177

175178
/** CWE-918: Server-Side Request Forgery (SSRF) */
176-
public static int SSRF = 918;
179+
public static final int SSRF = 918;
177180

178181
/** CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag */
179-
public static int COOKIE_WITHOUT_HTTPONLY = 1004;
182+
public static final int COOKIE_WITHOUT_HTTPONLY = 1004;
180183

181184
/** CWE-1021: Improper Restriction of Rendered UI Layers or Frames */
182-
public static int IMPROPER_UI_LAYER_RESTRICTION = 1021;
185+
public static final int IMPROPER_UI_LAYER_RESTRICTION = 1021;
183186

184187
/** CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine */
185-
public static int SSTI = 1336;
188+
public static final int SSTI = 1336;
186189
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/FortifyReader.java‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public TestSuiteResults parse(ResultFile resultZip) throws Exception {
7979
return tr;
8080
}
8181

82-
private String fetchToolVersison(Node root) {
82+
private static String fetchToolVersison(Node root) {
8383
Node eData = getNamedChild("EngineData", root);
8484
String version = getNamedChild("EngineVersion", eData).getTextContent();
8585
Node rps = getNamedChild("RulePacks", eData);
@@ -96,13 +96,13 @@ private String fetchToolVersison(Node root) {
9696
* @param root
9797
* @return
9898
*/
99-
private boolean isFortifyOnDemand(Node root) {
99+
private static boolean isFortifyOnDemand(Node root) {
100100
return getNamedChild("SourceBasePath", getNamedChild("Build", root))
101101
.getTextContent()
102102
.contains("ronq");
103103
}
104104

105-
public String parseTime(String filename) {
105+
public static String parseTime(String filename) {
106106
try {
107107
// to make the same as normal filenames, strip off the '.fvdl' at the end of the
108108
// filename
@@ -150,7 +150,7 @@ public String parseTime(String filename) {
150150
// outputFile.delete();
151151
// }
152152

153-
private TestCaseResult parseFortifyVulnerability(Node vuln) {
153+
private static TestCaseResult parseFortifyVulnerability(Node vuln) {
154154
TestCaseResult tcr = new TestCaseResult();
155155

156156
Node ci = getNamedNode("ClassInfo", vuln.getChildNodes());
@@ -218,7 +218,7 @@ private TestCaseResult parseFortifyVulnerability(Node vuln) {
218218
return null;
219219
}
220220

221-
private int cweLookup(String vtype, String subtype, Node unifiedNode) {
221+
public static int cweLookup(String vtype, String subtype, Node unifiedNode) {
222222

223223
switch (vtype) {
224224
case "Access Control":
@@ -232,7 +232,7 @@ private int cweLookup(String vtype, String subtype, Node unifiedNode) {
232232
// Verify its the exact type we are looking for (e.g., not HttpOnly finding)
233233
if ("Cookie not Sent Over SSL".equals(subtype))
234234
return CweNumber.INSECURE_COOKIE;
235-
else return 00;
235+
else return CweNumber.DONTCARE;
236236
}
237237

238238
case "Cross-Site Request Forgery":
@@ -250,7 +250,7 @@ private int cweLookup(String vtype, String subtype, Node unifiedNode) {
250250
}
251251

252252
case "Dead Code":
253-
return 00;
253+
return CweNumber.DONTCARE;
254254
case "Denial of Service":
255255
return 400;
256256
case "Dynamic Code Evaluation":
@@ -306,11 +306,11 @@ private int cweLookup(String vtype, String subtype, Node unifiedNode) {
306306
return 330;
307307
}
308308
}
309-
return 00; // If neither of these, then don't care
309+
return CweNumber.DONTCARE; // If neither of these, don't care
310310
}
311311

312312
case "Password Management":
313-
return 00;
313+
return CweNumber.DONTCARE;
314314
case "Path Manipulation":
315315
return 22;
316316

@@ -351,7 +351,8 @@ private int cweLookup(String vtype, String subtype, Node unifiedNode) {
351351
// TODO: Assuming this Fortify rule is valid, we might need to fix
352352
// Benchmark itself to eliminate unintended vulns.
353353
case "Insecure Mode of Operation":
354-
return 0; // Disable so it doesn't count against Fortify.
354+
return CweNumber
355+
.DONTCARE; // Disable so it doesn't count against Fortify.
355356
}
356357
return 327;
357358
}
@@ -379,13 +380,13 @@ private int cweLookup(String vtype, String subtype, Node unifiedNode) {
379380
case "Portability Flaw":
380381
case "Race Condition":
381382
case "Redundant Null Check":
382-
return 00;
383+
return CweNumber.DONTCARE;
383384

384385
default:
385386
System.out.println(
386387
"Fortify parser encountered unknown vulnerability type: " + vtype);
387388
} // end switch
388389

389-
return 0;
390+
return CweNumber.UNMAPPED;
390391
}
391392
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/Reader.java‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import org.owasp.benchmarkutils.score.parsers.sarif.CodeQLReader;
3333
import org.owasp.benchmarkutils.score.parsers.sarif.ContrastScanReader;
3434
import org.owasp.benchmarkutils.score.parsers.sarif.DatadogSastReader;
35+
import org.owasp.benchmarkutils.score.parsers.sarif.FortifySarifReader;
3536
import org.owasp.benchmarkutils.score.parsers.sarif.PTAIReader;
3637
import org.owasp.benchmarkutils.score.parsers.sarif.PrecautionReader;
3738
import org.owasp.benchmarkutils.score.parsers.sarif.SemgrepSarifReader;
@@ -45,10 +46,8 @@ public abstract class Reader {
4546
protected final ObjectMapper jsonMapper = new ObjectMapper();
4647
protected final XmlMapper xmlMapper = new XmlMapper();
4748

48-
// TODO: Figure out how to dynamically add all readers here without listing them
49-
// out manually
50-
// NOTE: There is a unit test that at least automatically verifies that any
51-
// reader with a unit
49+
// TODO: Figure out how to dynamically add all readers without listing them manually
50+
// NOTE: There is a unit test that at least automatically verifies that any reader with a unit
5251
// test is in this list
5352
public static List<Reader> allReaders() {
5453
return Arrays.asList(
@@ -74,6 +73,7 @@ public static List<Reader> allReaders() {
7473
new FindbugsReader(),
7574
new FluidAttacksReader(),
7675
new FortifyReader(),
76+
new FortifySarifReader(),
7777
new FusionLiteInsightReader(),
7878
new HCLAppScanIASTReader(),
7979
new HCLAppScanSourceReader(),
@@ -132,9 +132,9 @@ public static Node getNamedNode(String name, NodeList list) {
132132

133133
return null;
134134
}
135+
135136
// Returns the node inside this nodelist whose name matches 'name', that also
136-
// has an attribute
137-
// called 'key' whose value matches 'keyvalue'
137+
// has an attribute called 'key' whose value matches 'keyvalue'
138138

139139
public static Node getNamedNode(String name, String keyValue, NodeList list) {
140140
if ((name == null) || (keyValue == null) || (list == null)) return null;
@@ -265,6 +265,7 @@ public static int testNumber(String path, String testCaseName) {
265265
// Remove remaining dots
266266
path = path.replace(".", "");
267267
// System.out.println("Final: " + path);
268+
268269
// In the case of $innerclass
269270
int dollar = path.indexOf("$");
270271
if (dollar != -1) {

0 commit comments

Comments
 (0)