Skip to content

Commit e52d9cb

Browse files
0xgoto0xgoto
authored
Snyk reader (#40)
* Fix. Veracode reader condition check * Fix. Reduce Veracode test file * Fix. condition to check root node name * Add. Snyk reader to parse snyk code results * Add. Snyk scan testfile * Refactor. Reduce snyk code result testfile * Refactor. Arrage readers in alphabetical order * Refactor. Import headers * Refactor. Snyk code result file check * Fix. Logic to handle invalid rule id
1 parent 88d0dc5 commit e52d9cb

File tree

4 files changed

+649
-0
lines changed

4 files changed

+649
-0
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/Reader.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ public static List<Reader> allReaders() {
8585
new ShiftLeftReader(),
8686
new ShiftLeftScanReader(),
8787
new SnappyTickReader(),
88+
new SnykReader(),
8889
new SonarQubeJsonReader(),
8990
new SonarQubeReader(),
9091
new SourceMeterReader(),

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/SnykReader.java

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
package org.owasp.benchmarkutils.score.parsers;
2+
3+
import java.util.HashMap;
4+
import java.util.Map;
5+
import org.json.JSONArray;
6+
import org.json.JSONException;
7+
import org.json.JSONObject;
8+
import org.owasp.benchmarkutils.score.BenchmarkScore;
9+
import org.owasp.benchmarkutils.score.CweNumber;
10+
import org.owasp.benchmarkutils.score.ResultFile;
11+
import org.owasp.benchmarkutils.score.TestCaseResult;
12+
import org.owasp.benchmarkutils.score.TestSuiteResults;
13+
14+
public class SnykReader extends Reader {
15+
16+
public static final int INVALID_RULE_ID = -1;
17+
private static final Map<String, Integer> snykCweMap =
18+
new HashMap<String, Integer>() {
19+
{
20+
put("Xpath", CweNumber.XPATH_INJECTION);
21+
put("WebCookieWithSecureFalse", CweNumber.INSECURE_COOKIE);
22+
put("Sqli", CweNumber.SQL_INJECTION);
23+
put("PT", CweNumber.PATH_TRAVERSAL);
24+
put("HardcodedPassword", 0);
25+
put("WebCookieMissesCallToSetHttpOnly", CweNumber.INSECURE_COOKIE);
26+
put("ServerInformationExposure", 0);
27+
put("UserControlledFormatString", CweNumber.EXTERNALLY_CONTROLLED_STRING);
28+
put("SpringCSRF", CweNumber.CSRF);
29+
put("TrustBoundaryViolation", CweNumber.TRUST_BOUNDARY_VIOLATION);
30+
put("CommandInjection", CweNumber.COMMAND_INJECTION);
31+
put("DOMXSS", CweNumber.XSS);
32+
put("XSS", CweNumber.XSS);
33+
put("InsecureCipherNoIntegrity", CweNumber.WEAK_CRYPTO_ALGO);
34+
put("InsecureDefaultAesCipher", CweNumber.WEAK_CRYPTO_ALGO);
35+
put("HttpResponseSplitting", CweNumber.HTTP_RESPONSE_SPLITTING);
36+
put("InsecureSecret", CweNumber.WEAK_RANDOM);
37+
put("LdapInjection", CweNumber.LDAP_INJECTION);
38+
put("InsecureCipher", CweNumber.WEAK_CRYPTO_ALGO);
39+
put("InsecureHash", CweNumber.WEAK_HASH_ALGO);
40+
}
41+
};
42+
43+
@Override
44+
public boolean canRead(ResultFile resultFile) {
45+
return resultFile.isJson() && isSnyk(resultFile);
46+
}
47+
48+
@Override
49+
public TestSuiteResults parse(ResultFile resultFile) throws Exception {
50+
TestSuiteResults tr = new TestSuiteResults("Snyk", true, TestSuiteResults.ToolType.SAST);
51+
52+
JSONArray results =
53+
resultFile.json().getJSONArray("runs").getJSONObject(0).getJSONArray("results");
54+
55+
for (int result = 0; result < results.length(); result++) {
56+
TestCaseResult tcr = parseSnykFindings(results.getJSONObject(result));
57+
if (tcr != null) {
58+
tr.put(tcr);
59+
}
60+
}
61+
return tr;
62+
}
63+
64+
private TestCaseResult parseSnykFindings(JSONObject result) {
65+
try {
66+
String className =
67+
result.getJSONArray("locations")
68+
.getJSONObject(0)
69+
.getJSONObject("physicalLocation")
70+
.getJSONObject("artifactLocation")
71+
.getString("uri");
72+
className = (className.substring(className.lastIndexOf('/') + 1)).split("\\.")[0];
73+
if (className.startsWith(BenchmarkScore.TESTCASENAME)) {
74+
75+
TestCaseResult tcr = new TestCaseResult();
76+
77+
String ruleId = result.getString("ruleId");
78+
ruleId = (ruleId.substring(ruleId.lastIndexOf('/') + 1)).split("\\.")[0];
79+
80+
int cwe = snykCweMap.getOrDefault(ruleId, INVALID_RULE_ID);
81+
82+
if (cwe == INVALID_RULE_ID) {
83+
System.out.println("CWE # not parseable from: " + ruleId);
84+
return null;
85+
}
86+
87+
String evidence = result.getJSONObject("message").getString("text");
88+
89+
tcr.setCWE(cwe);
90+
tcr.setCategory(ruleId);
91+
tcr.setEvidence(evidence);
92+
tcr.setConfidence(0);
93+
tcr.setNumber(testNumber(className));
94+
95+
return tcr;
96+
}
97+
} catch (Exception ex) {
98+
ex.printStackTrace();
99+
}
100+
101+
return null;
102+
}
103+
104+
private Boolean isSnyk(ResultFile resultFile) {
105+
106+
try {
107+
return resultFile
108+
.json()
109+
.getJSONArray("runs")
110+
.getJSONObject(0)
111+
.getJSONObject("tool")
112+
.getJSONObject("driver")
113+
.getString("name")
114+
.equalsIgnoreCase("SnykCode");
115+
} catch (JSONException e) {
116+
return false;
117+
}
118+
}
119+
}

‎plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/SnykReaderTest.java

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
package org.owasp.benchmarkutils.score.parsers;
2+
3+
import static org.junit.jupiter.api.Assertions.assertEquals;
4+
import static org.junit.jupiter.api.Assertions.assertTrue;
5+
6+
import org.junit.jupiter.api.BeforeEach;
7+
import org.junit.jupiter.api.Test;
8+
import org.owasp.benchmarkutils.score.BenchmarkScore;
9+
import org.owasp.benchmarkutils.score.CweNumber;
10+
import org.owasp.benchmarkutils.score.ResultFile;
11+
import org.owasp.benchmarkutils.score.TestHelper;
12+
import org.owasp.benchmarkutils.score.TestSuiteResults;
13+
14+
public class SnykReaderTest extends ReaderTestBase {
15+
16+
private ResultFile resultFile;
17+
18+
@BeforeEach
19+
void setUp() {
20+
resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Snyk-v1.json");
21+
BenchmarkScore.TESTCASENAME = "BenchmarkTest";
22+
}
23+
24+
@Test
25+
void onlySnykReaderReportsCanReadAsTrue() {
26+
assertOnlyMatcherClassIs(this.resultFile, SnykReader.class);
27+
}
28+
29+
@Test
30+
void readerHandlesGivenResultFile() throws Exception {
31+
SnykReader reader = new SnykReader();
32+
TestSuiteResults result = reader.parse(resultFile);
33+
34+
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
35+
assertTrue(result.isCommercial());
36+
assertEquals("Snyk", result.getToolName());
37+
38+
assertEquals(2, result.getTotalResults());
39+
assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
40+
assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
41+
}
42+
}

0 commit comments

Comments
 (0)