@Test public void vulnerability_is_NOT_found_when_locations_and_relevant_parts_are_same_but_cwe_differs() { SerecoVulnerability vulnerability = TestSerecoVulnerabilityBuilder.builder(). name("name1"). cwe(4711). codeScan(). location("location1"). source("source1"). relevantPart("relevant1"). callsCode(). callsCode(). callsCode(). location("location2"). source("source2"). relevantPart("relevant2"). end().build(); FalsePositiveMetaData metaData = fetchFirstEntryMetaDataOfExample3(); when(relevantPartResolver.toRelevantPart(any())).thenReturn(""); assertFalse(strategyToTest.isFalsePositive(vulnerability, metaData)); }
public boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData) { notNull(vulnerability, " vulnerability may not be null"); notNull(metaData, " metaData may not be null"); if (metaData.getScanType() != ScanType.CODE_SCAN) { return false; } FalsePositiveCodeMetaData metaDataCode = metaData.getCode(); if (metaDataCode == null) { LOG.error("Cannot check code vulnerability for false positives when meta data has no code parts!"); return false; } Integer cweId = metaData.getCweId(); if (cweId == null) { LOG.error("Cannot check code vulnerability for false positives when code meta data has no CWE id set!"); return false; } SerecoClassification serecoClassification = vulnerability.getClassification(); String serecoCWE = serecoClassification.getCwe(); if (serecoCWE == null || serecoCWE.isEmpty()) { LOG.error("Code scan sereco vulnerability type:{} found without CWE! Cannot determin false positive! Classification was:{}", vulnerability.getType(), serecoClassification); return false; } try { int serecoCWEint = Integer.parseInt(serecoCWE); if (cweId.intValue()!=serecoCWEint) { return false; } } catch (NumberFormatException e) { LOG.error("Code scan sereco vulnerability type:{} found CWE:{} but not expected integer format!", vulnerability.getType(), serecoCWE); return false; } SerecoCodeCallStackElement serecoFirstElement = vulnerability.getCode(); if (serecoFirstElement == null) { LOG.warn("Cannot check code vulnerability for false positives when no first code element is found!"); return false; } FalsePositiveCodePartMetaData start = metaDataCode.getStart(); if (start == null) { LOG.warn("Cannot check code vulnerability for false positives when no start code meta data is found!"); return false; } if (isLocationDifferent(start, serecoFirstElement)) { return false; } FalsePositiveCodePartMetaData end = metaDataCode.getEnd(); SerecoCodeCallStackElement serecoLastElement = findLastElement(serecoFirstElement); if (isLocationDifferent(end, serecoLastElement)) { return false; } String relevant1 = start.getRelevantPart(); String relevant2 = serecoFirstElement.getRelevantPart(); if (relevant1 == null || relevant1.isEmpty()) { relevant1 = createRelevantReplacment(start); } if (relevant2 == null || relevant2.isEmpty()) { relevant2 = createRelevantReplacment(serecoFirstElement); } if (!relevant1.equals(relevant2)) { return false; } String relevant3 = ""; String relevant4 = ""; if (end != null) { relevant3 = end.getRelevantPart(); if (relevant3 == null || relevant3.isEmpty()) { relevant3 = createRelevantReplacment(end); } } if (serecoLastElement != null) { relevant4 = serecoLastElement.getRelevantPart(); if (relevant4 == null || relevant4.isEmpty()) { relevant4 = createRelevantReplacment(serecoLastElement); } } if (!relevant3.equals(relevant4)) { return false; } return true; }
SerecoFalsePositiveCodeScanStrategy { public boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData) { notNull(vulnerability, " vulnerability may not be null"); notNull(metaData, " metaData may not be null"); if (metaData.getScanType() != ScanType.CODE_SCAN) { return false; } FalsePositiveCodeMetaData metaDataCode = metaData.getCode(); if (metaDataCode == null) { LOG.error("Cannot check code vulnerability for false positives when meta data has no code parts!"); return false; } Integer cweId = metaData.getCweId(); if (cweId == null) { LOG.error("Cannot check code vulnerability for false positives when code meta data has no CWE id set!"); return false; } SerecoClassification serecoClassification = vulnerability.getClassification(); String serecoCWE = serecoClassification.getCwe(); if (serecoCWE == null || serecoCWE.isEmpty()) { LOG.error("Code scan sereco vulnerability type:{} found without CWE! Cannot determin false positive! Classification was:{}", vulnerability.getType(), serecoClassification); return false; } try { int serecoCWEint = Integer.parseInt(serecoCWE); if (cweId.intValue()!=serecoCWEint) { return false; } } catch (NumberFormatException e) { LOG.error("Code scan sereco vulnerability type:{} found CWE:{} but not expected integer format!", vulnerability.getType(), serecoCWE); return false; } SerecoCodeCallStackElement serecoFirstElement = vulnerability.getCode(); if (serecoFirstElement == null) { LOG.warn("Cannot check code vulnerability for false positives when no first code element is found!"); return false; } FalsePositiveCodePartMetaData start = metaDataCode.getStart(); if (start == null) { LOG.warn("Cannot check code vulnerability for false positives when no start code meta data is found!"); return false; } if (isLocationDifferent(start, serecoFirstElement)) { return false; } FalsePositiveCodePartMetaData end = metaDataCode.getEnd(); SerecoCodeCallStackElement serecoLastElement = findLastElement(serecoFirstElement); if (isLocationDifferent(end, serecoLastElement)) { return false; } String relevant1 = start.getRelevantPart(); String relevant2 = serecoFirstElement.getRelevantPart(); if (relevant1 == null || relevant1.isEmpty()) { relevant1 = createRelevantReplacment(start); } if (relevant2 == null || relevant2.isEmpty()) { relevant2 = createRelevantReplacment(serecoFirstElement); } if (!relevant1.equals(relevant2)) { return false; } String relevant3 = ""; String relevant4 = ""; if (end != null) { relevant3 = end.getRelevantPart(); if (relevant3 == null || relevant3.isEmpty()) { relevant3 = createRelevantReplacment(end); } } if (serecoLastElement != null) { relevant4 = serecoLastElement.getRelevantPart(); if (relevant4 == null || relevant4.isEmpty()) { relevant4 = createRelevantReplacment(serecoLastElement); } } if (!relevant3.equals(relevant4)) { return false; } return true; } }
SerecoFalsePositiveCodeScanStrategy { public boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData) { notNull(vulnerability, " vulnerability may not be null"); notNull(metaData, " metaData may not be null"); if (metaData.getScanType() != ScanType.CODE_SCAN) { return false; } FalsePositiveCodeMetaData metaDataCode = metaData.getCode(); if (metaDataCode == null) { LOG.error("Cannot check code vulnerability for false positives when meta data has no code parts!"); return false; } Integer cweId = metaData.getCweId(); if (cweId == null) { LOG.error("Cannot check code vulnerability for false positives when code meta data has no CWE id set!"); return false; } SerecoClassification serecoClassification = vulnerability.getClassification(); String serecoCWE = serecoClassification.getCwe(); if (serecoCWE == null || serecoCWE.isEmpty()) { LOG.error("Code scan sereco vulnerability type:{} found without CWE! Cannot determin false positive! Classification was:{}", vulnerability.getType(), serecoClassification); return false; } try { int serecoCWEint = Integer.parseInt(serecoCWE); if (cweId.intValue()!=serecoCWEint) { return false; } } catch (NumberFormatException e) { LOG.error("Code scan sereco vulnerability type:{} found CWE:{} but not expected integer format!", vulnerability.getType(), serecoCWE); return false; } SerecoCodeCallStackElement serecoFirstElement = vulnerability.getCode(); if (serecoFirstElement == null) { LOG.warn("Cannot check code vulnerability for false positives when no first code element is found!"); return false; } FalsePositiveCodePartMetaData start = metaDataCode.getStart(); if (start == null) { LOG.warn("Cannot check code vulnerability for false positives when no start code meta data is found!"); return false; } if (isLocationDifferent(start, serecoFirstElement)) { return false; } FalsePositiveCodePartMetaData end = metaDataCode.getEnd(); SerecoCodeCallStackElement serecoLastElement = findLastElement(serecoFirstElement); if (isLocationDifferent(end, serecoLastElement)) { return false; } String relevant1 = start.getRelevantPart(); String relevant2 = serecoFirstElement.getRelevantPart(); if (relevant1 == null || relevant1.isEmpty()) { relevant1 = createRelevantReplacment(start); } if (relevant2 == null || relevant2.isEmpty()) { relevant2 = createRelevantReplacment(serecoFirstElement); } if (!relevant1.equals(relevant2)) { return false; } String relevant3 = ""; String relevant4 = ""; if (end != null) { relevant3 = end.getRelevantPart(); if (relevant3 == null || relevant3.isEmpty()) { relevant3 = createRelevantReplacment(end); } } if (serecoLastElement != null) { relevant4 = serecoLastElement.getRelevantPart(); if (relevant4 == null || relevant4.isEmpty()) { relevant4 = createRelevantReplacment(serecoLastElement); } } if (!relevant3.equals(relevant4)) { return false; } return true; }  }
SerecoFalsePositiveCodeScanStrategy { public boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData) { notNull(vulnerability, " vulnerability may not be null"); notNull(metaData, " metaData may not be null"); if (metaData.getScanType() != ScanType.CODE_SCAN) { return false; } FalsePositiveCodeMetaData metaDataCode = metaData.getCode(); if (metaDataCode == null) { LOG.error("Cannot check code vulnerability for false positives when meta data has no code parts!"); return false; } Integer cweId = metaData.getCweId(); if (cweId == null) { LOG.error("Cannot check code vulnerability for false positives when code meta data has no CWE id set!"); return false; } SerecoClassification serecoClassification = vulnerability.getClassification(); String serecoCWE = serecoClassification.getCwe(); if (serecoCWE == null || serecoCWE.isEmpty()) { LOG.error("Code scan sereco vulnerability type:{} found without CWE! Cannot determin false positive! Classification was:{}", vulnerability.getType(), serecoClassification); return false; } try { int serecoCWEint = Integer.parseInt(serecoCWE); if (cweId.intValue()!=serecoCWEint) { return false; } } catch (NumberFormatException e) { LOG.error("Code scan sereco vulnerability type:{} found CWE:{} but not expected integer format!", vulnerability.getType(), serecoCWE); return false; } SerecoCodeCallStackElement serecoFirstElement = vulnerability.getCode(); if (serecoFirstElement == null) { LOG.warn("Cannot check code vulnerability for false positives when no first code element is found!"); return false; } FalsePositiveCodePartMetaData start = metaDataCode.getStart(); if (start == null) { LOG.warn("Cannot check code vulnerability for false positives when no start code meta data is found!"); return false; } if (isLocationDifferent(start, serecoFirstElement)) { return false; } FalsePositiveCodePartMetaData end = metaDataCode.getEnd(); SerecoCodeCallStackElement serecoLastElement = findLastElement(serecoFirstElement); if (isLocationDifferent(end, serecoLastElement)) { return false; } String relevant1 = start.getRelevantPart(); String relevant2 = serecoFirstElement.getRelevantPart(); if (relevant1 == null || relevant1.isEmpty()) { relevant1 = createRelevantReplacment(start); } if (relevant2 == null || relevant2.isEmpty()) { relevant2 = createRelevantReplacment(serecoFirstElement); } if (!relevant1.equals(relevant2)) { return false; } String relevant3 = ""; String relevant4 = ""; if (end != null) { relevant3 = end.getRelevantPart(); if (relevant3 == null || relevant3.isEmpty()) { relevant3 = createRelevantReplacment(end); } } if (serecoLastElement != null) { relevant4 = serecoLastElement.getRelevantPart(); if (relevant4 == null || relevant4.isEmpty()) { relevant4 = createRelevantReplacment(serecoLastElement); } } if (!relevant3.equals(relevant4)) { return false; } return true; }  boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData); }
SerecoFalsePositiveCodeScanStrategy { public boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData) { notNull(vulnerability, " vulnerability may not be null"); notNull(metaData, " metaData may not be null"); if (metaData.getScanType() != ScanType.CODE_SCAN) { return false; } FalsePositiveCodeMetaData metaDataCode = metaData.getCode(); if (metaDataCode == null) { LOG.error("Cannot check code vulnerability for false positives when meta data has no code parts!"); return false; } Integer cweId = metaData.getCweId(); if (cweId == null) { LOG.error("Cannot check code vulnerability for false positives when code meta data has no CWE id set!"); return false; } SerecoClassification serecoClassification = vulnerability.getClassification(); String serecoCWE = serecoClassification.getCwe(); if (serecoCWE == null || serecoCWE.isEmpty()) { LOG.error("Code scan sereco vulnerability type:{} found without CWE! Cannot determin false positive! Classification was:{}", vulnerability.getType(), serecoClassification); return false; } try { int serecoCWEint = Integer.parseInt(serecoCWE); if (cweId.intValue()!=serecoCWEint) { return false; } } catch (NumberFormatException e) { LOG.error("Code scan sereco vulnerability type:{} found CWE:{} but not expected integer format!", vulnerability.getType(), serecoCWE); return false; } SerecoCodeCallStackElement serecoFirstElement = vulnerability.getCode(); if (serecoFirstElement == null) { LOG.warn("Cannot check code vulnerability for false positives when no first code element is found!"); return false; } FalsePositiveCodePartMetaData start = metaDataCode.getStart(); if (start == null) { LOG.warn("Cannot check code vulnerability for false positives when no start code meta data is found!"); return false; } if (isLocationDifferent(start, serecoFirstElement)) { return false; } FalsePositiveCodePartMetaData end = metaDataCode.getEnd(); SerecoCodeCallStackElement serecoLastElement = findLastElement(serecoFirstElement); if (isLocationDifferent(end, serecoLastElement)) { return false; } String relevant1 = start.getRelevantPart(); String relevant2 = serecoFirstElement.getRelevantPart(); if (relevant1 == null || relevant1.isEmpty()) { relevant1 = createRelevantReplacment(start); } if (relevant2 == null || relevant2.isEmpty()) { relevant2 = createRelevantReplacment(serecoFirstElement); } if (!relevant1.equals(relevant2)) { return false; } String relevant3 = ""; String relevant4 = ""; if (end != null) { relevant3 = end.getRelevantPart(); if (relevant3 == null || relevant3.isEmpty()) { relevant3 = createRelevantReplacment(end); } } if (serecoLastElement != null) { relevant4 = serecoLastElement.getRelevantPart(); if (relevant4 == null || relevant4.isEmpty()) { relevant4 = createRelevantReplacment(serecoLastElement); } } if (!relevant3.equals(relevant4)) { return false; } return true; }  boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData);  }