@Test public void load_example1_contains_expected_data() throws IOException { String xml = SerecoTestFileSupport.INSTANCE.loadTestFileFromRoot("sechub-other/testoutput/checkmarx-example1.xml"); SerecoMetaData data = importerToTest.importResult(xml); List<SerecoVulnerability> vulnerabilities = data.getVulnerabilities(); assertEquals(109, vulnerabilities.size()); SerecoVulnerability v1 = vulnerabilities.get(0); assertEquals(SerecoSeverity.MEDIUM, v1.getSeverity()); SerecoClassification classification = v1.getClassification(); assertEquals("A5", classification.getOwasp()); assertEquals("6.5.8", classification.getPci32()); assertEquals(null, classification.getPci31()); SerecoVulnerability v100 = vulnerabilities.get(99); assertEquals(SerecoSeverity.LOW, v100.getSeverity()); classification = v100.getClassification(); assertEquals(null, classification.getPci32()); assertEquals(null, classification.getOwasp()); assertEquals("AC-3", classification.getNist()); assertEquals("Identification And Authentication", classification.getFisma()); SerecoVulnerability v109 = vulnerabilities.get(108); assertEquals(SerecoSeverity.INFO, v109.getSeverity()); classification = v109.getClassification(); assertEquals(null, classification.getOwasp()); assertEquals(null, classification.getPci32()); assertEquals(null, classification.getNist()); assertEquals(null, classification.getFisma()); assertEquals("778", classification.getCwe()); assertEquals("Insufficient Logging of Exceptions", v109.getType()); }
public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; } }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }  }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }  SerecoMetaData importResult(String xml); }
CheckmarxV1XMLImporter extends AbstractProductResultImporter { public SerecoMetaData importResult(String xml) throws IOException { if (xml == null) { xml = ""; } Document document; try { document = DocumentHelper.parseText(xml); } catch (DocumentException e) { throw new IOException("Import cannot parse xml", e); } CheckmarxCategoriesToClassificationConverter categoryConverter = new CheckmarxCategoriesToClassificationConverter(); SerecoMetaData metaData = new SerecoMetaData(); Element checkmarxCxXMLResults = document.getRootElement(); List<Element> queryElements = checkmarxCxXMLResults.elements("Query"); for (Element queryElement : queryElements) { String name = queryElement.attributeValue("name"); String type = NAME_PATTERN.matcher(name).replaceAll(" "); String categories = queryElement.attributeValue("categories"); String cweId = queryElement.attributeValue("cweId"); List<Element> resultElements = queryElement.elements("Result"); for (Element resultElement : resultElements) { String falsePositive = resultElement.attributeValue("FalsePositive"); String deeplink = resultElement.attributeValue("DeepLink"); String severity = resultElement.attributeValue("Severity"); SerecoVulnerability vulnerability = new SerecoVulnerability(); vulnerability.setFalsePositive(Boolean.parseBoolean(falsePositive)); if (vulnerability.isFalsePositive()) { vulnerability.setFalsePositiveReason("marked directly in security product"); } vulnerability.setType(type); if ("Information".equalsIgnoreCase(severity)) { severity = "info"; } vulnerability.setSeverity(SerecoSeverity.fromString(severity)); SerecoCodeCallStackElement codeInfo = resolveCodeInfoFromElement(resultElement); vulnerability.setCode(codeInfo); vulnerability.setProductResultLink(deeplink); vulnerability.setDescription(""); vulnerability.getClassification().setCwe(cweId); vulnerability.setScanType(ScanType.CODE_SCAN); categoryConverter.convert(categories, vulnerability.getClassification()); metaData.getVulnerabilities().add(vulnerability); } } return metaData; }  SerecoMetaData importResult(String xml);  }