FvdlStAXParser { Fvdl parse(InputStream inputStream) throws ParserConfigurationException, SAXException, IOException { SMInputFactory inputFactory = FortifyUtils.newStaxParser(); try { SMHierarchicCursor rootC = inputFactory.rootElementCursor(inputStream); rootC.advance(); SMInputCursor childCursor = rootC.childCursor(); Build build = null; Collection<Description> descriptions = new ArrayList<Description>(); Collection<Vulnerability> vulnerabilities = null; while (childCursor.getNext() != null) { String nodeName = childCursor.getLocalName(); if ("Build".equals(nodeName)) { build = processBuild(childCursor); } else if ("Description".equals(nodeName)) { descriptions.add(processDescription(childCursor)); } else if ("Vulnerabilities".equals(nodeName)) { vulnerabilities = processVulnerabilities(childCursor); } } return new Fvdl(build, descriptions, vulnerabilities); } catch (XMLStreamException e) { throw new IllegalStateException("XML is not valid", e); } }    }
@Test public void parse_dummy_report() throws Exception { FvdlStAXParser parser = new FvdlStAXParser(); InputStream inputStream = getClass().getClassLoader().getResourceAsStream("report/dummy-report.xml"); Fvdl fvdl = parser.parse(inputStream); assertThat(fvdl.getBuild().getSourceBasePath()).isEqualTo("/a/dummy/path"); Collection<Vulnerability> vulnerabilities = fvdl.getVulnerabilities(); assertThat(vulnerabilities.size()).isEqualTo(3); for (Vulnerability vulnerability : vulnerabilities) { if ("1".equals(vulnerability.getClassID())) { assertThat(vulnerability.getKingdom()).isEqualTo("Code Quality"); assertThat(vulnerability.getType()).isEqualTo("Unreleased Resource"); assertThat(vulnerability.getSubtype()).isEqualTo("Database"); assertThat(vulnerability.getPath()).isEqualTo("dummy.file"); assertThat(vulnerability.getInstanceID()).isEqualTo("1"); assertThat(vulnerability.getLine()).isEqualTo(1); assertThat(vulnerability.getReplacementDefinitions().size()).isEqualTo(1); } else if ("2".equals(vulnerability.getClassID())) { assertThat(vulnerability.getKingdom()).isEqualTo("Input Validation and Representation"); assertThat(vulnerability.getType()).isEqualTo("Command Injection"); assertThat(vulnerability.getSubtype()).isNull(); assertThat(vulnerability.getPath()).isNull(); assertThat(vulnerability.getInstanceID()).isEqualTo("2"); assertThat(vulnerability.getLine()).isNull(); assertThat(vulnerability.getReplacementDefinitions().size()).isEqualTo(0); } else if ("3".equals(vulnerability.getClassID())) { assertThat(vulnerability.getPath()).isNull(); assertThat(vulnerability.getInstanceID()).isEqualTo("3"); assertThat(vulnerability.getLine()).isNull(); assertThat(vulnerability.getReplacementDefinitions().size()).isEqualTo(0); } else { fail("Vulnerability with classID=" + vulnerability.getClassID() + " is not expected!"); } } }
@Test public void parse_full_report() throws Exception { FvdlStAXParser parser = new FvdlStAXParser(); InputStream inputStream = getClass().getClassLoader().getResourceAsStream("report/audit.fvdl"); Collection<Vulnerability> vulnerabilities = parser.parse(inputStream).getVulnerabilities(); assertThat(vulnerabilities.size()).isEqualTo(1048); for (Vulnerability vulnerability : vulnerabilities) { assertThat(vulnerability.getClassID()).isNotNull(); assertThat(vulnerability.getPath()).isNotNull(); assertThat(vulnerability.getInstanceID()).isNotNull(); assertThat(vulnerability.getLine()).isNotNull(); assertThat(vulnerability.getReplacementDefinitions()).isNotNull(); } }