@Test public void xmlReportFromCheckmarxVhasNoDescriptionButCodeInfo() throws Exception { String xml = SerecoTestFileSupport.INSTANCE.loadTestFile("checkmarx/sechub-continous-integration-with-false-positive.xml"); SerecoMetaData result = importerToTest.importResult(xml); List<SerecoVulnerability> vulnerabilities = result.getVulnerabilities(); SerecoVulnerability v1 = fetchFirstNonFalsePositive(vulnerabilities); assertEquals(SerecoSeverity.MEDIUM, v1.getSeverity()); assertEquals("", v1.getDescription()); assertEquals(ScanType.CODE_SCAN,v1.getScanType()); SerecoCodeCallStackElement codeInfo = v1.getCode(); assertNotNull(codeInfo); assertEquals("com/daimler/sechub/server/IntegrationTestServerRestController.java", codeInfo.getLocation()); assertEquals(Integer.valueOf(86), codeInfo.getLine()); assertEquals(Integer.valueOf(37), codeInfo.getColumn()); assertEquals(" @PathVariable(\"fileName\") String fileName) throws IOException {",codeInfo.getSource()); assertEquals("fileName",codeInfo.getRelevantPart()); SerecoCodeCallStackElement calls1 = codeInfo.getCalls(); assertNotNull(calls1); SerecoCodeCallStackElement calls2 = calls1.getCalls(); assertNotNull(calls2); assertEquals("com/daimler/sechub/sharedkernel/storage/JobStorage.java", calls2.getLocation()); assertEquals(Integer.valueOf(139), calls2.getLine()); assertEquals(Integer.valueOf(39), calls2.getColumn()); assertEquals(" public String getAbsolutePath(String fileName) {",calls2.getSource()); assertEquals("fileName",codeInfo.getRelevantPart()); }
public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; } }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }  }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }  SerecoMetaData importResult(String xml); }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }  SerecoMetaData importResult(String xml);  }