Skip to content

Commit 4422831

Browse files
marwin1991marwin1991
authored
fixed problem with id in suppression and added migration info (#52)
* fix old tests * fix problem with skipping suppression when there is suppresion with id * add migration info
1 parent 08b62e0 commit 4422831

File tree

9 files changed

+256
-20
lines changed

9 files changed

+256
-20
lines changed

‎README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,3 +174,29 @@ secret_convert:
174174
reports:
175175
junit: gl-secret-detection-report.xml
176176
```
177+
178+
179+
### Development
180+
181+
Create Python Virtual Environment
182+
```bash
183+
python -m venv ./venv
184+
```
185+
186+
Activate Python Virtual Environment
187+
```bash
188+
source ./venv/bin/activate
189+
```
190+
191+
Install dependencies
192+
```bash
193+
poetry install
194+
```
195+
196+
Run tests
197+
```bash
198+
poetry run pytest
199+
```
200+
201+
202+

‎secscanner2junit/__init__.py‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,13 @@ def parse_arguments(args):
4444

4545

4646
def main(args=None):
47+
48+
print("-------------------------------------------------------------------------------")
49+
print("-------- Hello! Project migrated to organisation https://logchange.dev --------")
50+
print("-------- If you want to get new version change docker image to --------")
51+
print("-------- logchange/secscanner2junit:latest --------")
52+
print("-------------------------------------------------------------------------------")
53+
4754
if args is None:
4855
args = parse_arguments(sys.argv[1:])
4956
if args.config:
@@ -63,6 +70,12 @@ def main(args=None):
6370
testsuite = parser.parse()
6471
save_junit_report(testsuite, args.output_file)
6572

73+
print("-------------------------------------------------------------------------------")
74+
print("-------- Hello! Project migrated to organisation https://logchange.dev --------")
75+
print("-------- If you want to get new version change docker image to --------")
76+
print("-------- logchange/secscanner2junit:latest --------")
77+
print("-------------------------------------------------------------------------------")
78+
6679

6780
if __name__ == '__main__':
6881
main()

‎secscanner2junit/config.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ def __is_vulnerability_suppressed(self, vulnerability):
4848
return False
4949

5050
if suppression.id is not None:
51-
return suppression.id == vulnerability['id']
51+
if suppression.id == vulnerability['id']:
52+
return True
5253

5354
for identifier in vulnerability['identifiers']:
5455
if suppression.type == identifier['type'] and suppression.value == identifier['value']:

‎tests/resources/test_sast/test_sast_suppression_by_id_or_type/gl-sast-report-many-with-same-name.json‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
{
2+
"version": "14.0.4",
3+
"vulnerabilities": [
4+
{
5+
"id": "cccabffcfcf176e47f9138d7fbd763a83b310b071529b687cde3537a935cf251",
6+
"category": "sast",
7+
"name": "Spring CSRF unrestricted RequestMapping",
8+
"message": "Spring CSRF unrestricted RequestMapping",
9+
"description": "Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks",
10+
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
11+
"severity": "Medium",
12+
"confidence": "High",
13+
"scanner": {
14+
"id": "find_sec_bugs",
15+
"name": "Find Security Bugs"
16+
},
17+
"location": {
18+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
19+
"start_line": 23,
20+
"class": "pl.com.abc.example.springbootabcexample.PingController",
21+
"method": "ping"
22+
},
23+
"identifiers": [
24+
{
25+
"type": "find_sec_bugs_type",
26+
"name": "Find Security Bugs-SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING",
27+
"value": "SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING",
28+
"url": "https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING"
29+
},
30+
{
31+
"type": "cwe",
32+
"name": "CWE-352",
33+
"value": "352",
34+
"url": "https://cwe.mitre.org/data/definitions/352.html"
35+
}
36+
]
37+
},
38+
{
39+
"id": "db914ce5737b49650ae650fc3b0fe38a531eadd8ea780f48a013419c4adec7f0",
40+
"category": "sast",
41+
"name": "Found Spring endpoint",
42+
"message": "Found Spring endpoint",
43+
"description": "pl.com.abc.example.springbootabcexample.PingController is a Spring endpoint (Controller)",
44+
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
45+
"severity": "Low",
46+
"confidence": "Low",
47+
"scanner": {
48+
"id": "find_sec_bugs",
49+
"name": "Find Security Bugs"
50+
},
51+
"location": {
52+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
53+
"start_line": 23,
54+
"class": "pl.com.abc.example.springbootabcexample.PingController",
55+
"method": "ping"
56+
},
57+
"identifiers": [
58+
{
59+
"type": "find_sec_bugs_type",
60+
"name": "Find Security Bugs-SPRING_ENDPOINT",
61+
"value": "SPRING_ENDPOINT",
62+
"url": "https://find-sec-bugs.github.io/bugs.htm#SPRING_ENDPOINT"
63+
}
64+
]
65+
},
66+
{
67+
"id": "f4e1ee2a65c5d8837cfe6e3b16fc368f23462596f41ca15b182625a259a58baf",
68+
"category": "sast",
69+
"name": "Found Spring endpoint",
70+
"message": "Found Spring endpoint",
71+
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
72+
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:16",
73+
"severity": "Low",
74+
"confidence": "Low",
75+
"scanner": {
76+
"id": "find_sec_bugs",
77+
"name": "Find Security Bugs"
78+
},
79+
"location": {
80+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
81+
"start_line": 16,
82+
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
83+
"method": "getDomainError"
84+
},
85+
"identifiers": [
86+
{
87+
"type": "find_sec_bugs_type",
88+
"name": "Find Security Bugs-SPRING_ENDPOINT",
89+
"value": "SPRING_ENDPOINT",
90+
"url": "https://find-sec-bugs.github.io/bugs.htm#SPRING_ENDPOINT"
91+
}
92+
]
93+
},
94+
{
95+
"id": "e5104af1e9b781ffa19a0f9299e9c44bb62b3dd62c4483e9f2e087dc03e8cd95",
96+
"category": "sast",
97+
"name": "HTTP headers untrusted",
98+
"message": "HTTP headers untrusted",
99+
"description": "Request header can easily be altered by the client",
100+
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:50",
101+
"severity": "Low",
102+
"confidence": "Low",
103+
"scanner": {
104+
"id": "find_sec_bugs",
105+
"name": "Find Security Bugs"
106+
},
107+
"location": {
108+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
109+
"start_line": 50,
110+
"class": "pl.com.abc.example.springbootabcexample.PingController$IpAddressUtils",
111+
"method": "getIpAddressFromRequest"
112+
},
113+
"identifiers": [
114+
{
115+
"type": "find_sec_bugs_type",
116+
"name": "Find Security Bugs-SERVLET_HEADER",
117+
"value": "SERVLET_HEADER",
118+
"url": "https://find-sec-bugs.github.io/bugs.htm#SERVLET_HEADER"
119+
}
120+
]
121+
},
122+
{
123+
"id": "dd623e3dafc27991b80b00c2b38b8ec69ef4b2635a5838622b3efb921e2cbfac",
124+
"category": "sast",
125+
"name": "Found Spring endpoint",
126+
"message": "Found Spring endpoint",
127+
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
128+
"cve": "8e968b3dea7c8b68b43c07ab9b37c120:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:11",
129+
"severity": "Low",
130+
"confidence": "Low",
131+
"scanner": {
132+
"id": "find_sec_bugs",
133+
"name": "Find Security Bugs"
134+
},
135+
"location": {
136+
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
137+
"start_line": 11,
138+
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
139+
"method": "getSomeFakeError"
140+
},
141+
"identifiers": [
142+
{
143+
"type": "find_sec_bugs_type",
144+
"name": "Find Security Bugs-SPRING_ENDPOINT",
145+
"value": "SPRING_ENDPOINT",
146+
"url": "https://find-sec-bugs.github.io/bugs.htm#SPRING_ENDPOINT"
147+
}
148+
]
149+
}
150+
],
151+
"scan": {
152+
"analyzer": {
153+
"id": "spotbugs",
154+
"name": "Spotbugs",
155+
"vendor": {
156+
"name": "GitLab"
157+
},
158+
"version": "3.2.1"
159+
},
160+
"scanner": {
161+
"id": "find_sec_bugs",
162+
"name": "Find Security Bugs",
163+
"url": "https://spotbugs.github.io",
164+
"vendor": {
165+
"name": "GitLab"
166+
},
167+
"version": "4.7.0"
168+
},
169+
"type": "sast",
170+
"start_time": "2022-08-04T05:31:38",
171+
"end_time": "2022-08-04T05:32:16",
172+
"status": "success"
173+
}
174+
}

‎tests/resources/test_sast/test_sast_suppression_by_id_or_type/ss2ju-config.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
sast:
2+
suppressions:
3+
- id: "cccabffcfcf176e47f9138d7fbd763a83b310b071529b687cde3537a935cf251"
4+
- type: "cwe"
5+
value: "2555"
6+
- type: "find_sec_bugs_type"
7+
value: "SPRING_ENDPOINT"

‎tests/test_config.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ class TestConfig(unittest.TestCase):
77

88
def test_get_config_no_file(self):
99
# given:
10-
input_config_path = "resources/test_config/test_get_config_no_file/ss2ju-config.yml"
10+
input_config_path = "tests/resources/test_config/test_get_config_no_file/ss2ju-config.yml"
1111

1212
# when:
1313
config = get_config(input_config_path)
@@ -18,7 +18,7 @@ def test_get_config_no_file(self):
1818

1919
def test_get_config_empty_file(self):
2020
# given:
21-
input_config_path = "resources/test_config/test_get_config_empty_file/ss2ju-config.yml"
21+
input_config_path = "tests/resources/test_config/test_get_config_empty_file/ss2ju-config.yml"
2222

2323
# when:
2424
config = get_config(input_config_path)
@@ -29,7 +29,7 @@ def test_get_config_empty_file(self):
2929

3030
def test_get_config(self):
3131
# given:
32-
input_config_path = "resources/test_config/test_get_config/ss2ju-config.yml"
32+
input_config_path = "tests/resources/test_config/test_get_config/ss2ju-config.yml"
3333

3434
# when:
3535
config = get_config(input_config_path)

‎tests/test_container_scanning.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ class TestContainerScanningParser(unittest.TestCase):
99

1010
def test_basic(self):
1111
# given:
12-
input_report_path = "resources/test_container_scanning/test_basic/gl-container-scanning-report.json"
13-
missing_config_path = "resources/test_container_scanning/test_basic/ss2ju-config.yml"
12+
input_report_path = "tests/resources/test_container_scanning/test_basic/gl-container-scanning-report.json"
13+
missing_config_path = "tests/resources/test_container_scanning/test_basic/ss2ju-config.yml"
1414

1515
report = get_report(input_report_path)
1616
config = get_config(missing_config_path)

‎tests/test_sast.py‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
class TestSast(unittest.TestCase):
99

1010
def test_empty_report(self):
11-
input_report_path = "resources/test_sast/test_empty/gl-sast-report.json"
12-
missing_config_path = "resources/test_sast/test_empty/no-config.yml"
11+
input_report_path = "tests/resources/test_sast/test_empty/gl-sast-report.json"
12+
missing_config_path = "tests/resources/test_sast/test_empty/no-config.yml"
1313

1414
report = get_report(input_report_path)
1515
config = get_config(missing_config_path)
@@ -22,8 +22,8 @@ def test_empty_report(self):
2222
self.assertEqual(len(testsuite.pop().test_cases), 0)
2323

2424
def test_sast_basic(self):
25-
input_report_path = "resources/test_sast/test_basic/gl-sast-report.json"
26-
missing_config_path = "resources/test_sast/test_basic/no-config.yml"
25+
input_report_path = "tests/resources/test_sast/test_basic/gl-sast-report.json"
26+
missing_config_path = "tests/resources/test_sast/test_basic/no-config.yml"
2727

2828
report = get_report(input_report_path)
2929
config = get_config(missing_config_path)
@@ -37,8 +37,8 @@ def test_sast_basic(self):
3737

3838
def test_sast_suppression(self):
3939
# given:
40-
input_report_path = "resources/test_sast/test_sast_suppression/gl-sast-report-many-with-same-name.json"
41-
input_config_path = "resources/test_sast/test_sast_suppression/ss2ju-config.yml"
40+
input_report_path = "tests/resources/test_sast/test_sast_suppression/gl-sast-report-many-with-same-name.json"
41+
input_config_path = "tests/resources/test_sast/test_sast_suppression/ss2ju-config.yml"
4242

4343
report = get_report(input_report_path)
4444
config = get_config(input_config_path)
@@ -52,8 +52,8 @@ def test_sast_suppression(self):
5252

5353
def test_sast_suppression_by_id(self):
5454
# given:
55-
input_report_path = "resources/test_sast/test_sast_suppression_by_id/gl-sast-report-many-with-same-name.json"
56-
input_config_path = "resources/test_sast/test_sast_suppression_by_id/ss2ju-config.yml"
55+
input_report_path = "tests/resources/test_sast/test_sast_suppression_by_id/gl-sast-report-many-with-same-name.json"
56+
input_config_path = "tests/resources/test_sast/test_sast_suppression_by_id/ss2ju-config.yml"
5757

5858
report = get_report(input_report_path)
5959
config = get_config(input_config_path)
@@ -65,6 +65,21 @@ def test_sast_suppression_by_id(self):
6565
# then:
6666
self.assertEqual(len(testsuite.pop().test_cases), 4)
6767

68+
def test_sast_suppression_by_id_or_type(self):
69+
# given:
70+
input_report_path = "tests/resources/test_sast/test_sast_suppression_by_id_or_type/gl-sast-report-many-with-same-name.json"
71+
input_config_path = "tests/resources/test_sast/test_sast_suppression_by_id_or_type/ss2ju-config.yml"
72+
73+
report = get_report(input_report_path)
74+
config = get_config(input_config_path)
75+
parser = SastParser(report, input_report_path, config)
76+
77+
# when:
78+
testsuite = parser.parse()
79+
80+
# then:
81+
self.assertEqual(len(testsuite.pop().test_cases), 1)
82+
6883

6984
def get_report(path):
7085
with open(path) as input_file:

‎tests/test_secrets.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ class TestSecretsParser(unittest.TestCase):
99

1010
def test_empty_report(self):
1111
# given:
12-
input_report_path = "resources/test_secrets/test_empty/gl-secret-detection-report.json"
13-
missing_config_path = "resources/test_secrets/test_basic/ss2ju-config.yml"
12+
input_report_path = "tests/resources/test_secrets/test_empty/gl-secret-detection-report.json"
13+
missing_config_path = "tests/resources/test_secrets/test_basic/ss2ju-config.yml"
1414

1515
report = get_report(input_report_path)
1616
config = get_config(missing_config_path)
@@ -24,8 +24,8 @@ def test_empty_report(self):
2424

2525
def test_basic(self):
2626
# given:
27-
input_report_path = "resources/test_secrets/test_basic/gl-secret-detection-report.json"
28-
missing_config_path = "resources/test_secrets/test_basic/ss2ju-config.yml"
27+
input_report_path = "tests/resources/test_secrets/test_basic/gl-secret-detection-report.json"
28+
missing_config_path = "tests/resources/test_secrets/test_basic/ss2ju-config.yml"
2929

3030
report = get_report(input_report_path)
3131
config = get_config(missing_config_path)
@@ -48,8 +48,8 @@ def test_basic(self):
4848

4949
def test_secret_suppression(self):
5050
# given:
51-
input_report_path = "resources/test_secrets/test_secrets_suppression/gl-secret-detection-report.json"
52-
input_config_path = "resources/test_secrets/test_secrets_suppression/ss2ju-config.yml"
51+
input_report_path = "tests/resources/test_secrets/test_secrets_suppression/gl-secret-detection-report.json"
52+
input_config_path = "tests/resources/test_secrets/test_secrets_suppression/ss2ju-config.yml"
5353

5454
report = get_report(input_report_path)
5555
config = get_config(input_config_path)

0 commit comments

Comments
 (0)