use of com.mercedesbenz.sechub.domain.scan.project.FalsePositiveCodePartMetaData in project sechub by mercedes-benz.
the class FalsePositiveRestControllerRestDocTest method user_fetches_false_positive_configuration.
@Test
@UseCaseRestDoc(useCase = UseCaseUserFetchesFalsePositiveConfigurationOfProject.class)
public void user_fetches_false_positive_configuration() throws Exception {
/* prepare */
String apiEndpoint = https(PORT_USED).buildUserFetchesFalsePositiveConfigurationOfProject(PROJECT_ID.pathElement());
Class<? extends Annotation> useCase = UseCaseUserFetchesFalsePositiveConfigurationOfProject.class;
int findingId = 42;
UUID jobUUID = UUID.fromString("f1d02a9d-5e1b-4f52-99e5-401854ccf936");
FalsePositiveProjectConfiguration config = new FalsePositiveProjectConfiguration();
List<FalsePositiveEntry> fpList = config.getFalsePositives();
FalsePositiveEntry entry = new FalsePositiveEntry();
entry.setAuthor("developer1");
entry.setCreated(new Date(1591962795187L));
FalsePositiveJobData jobData1 = new FalsePositiveJobData();
jobData1.setComment("Only used in documentation build not in deployment");
jobData1.setJobUUID(jobUUID);
jobData1.setFindingId(findingId);
entry.setJobData(jobData1);
FalsePositiveMetaData metaData = new FalsePositiveMetaData();
metaData.setCweId(Integer.valueOf(36));
FalsePositiveCodeMetaData code = new FalsePositiveCodeMetaData();
FalsePositiveCodePartMetaData start = new FalsePositiveCodePartMetaData();
start.setLocation("java/com/mercedesbenz/sechub/docgen/AsciidocGenerator.java");
start.setRelevantPart("args");
start.setSourceCode("\tpublic static void main(String[] args) throws Exception {");
code.setStart(start);
FalsePositiveCodePartMetaData end = new FalsePositiveCodePartMetaData();
end.setLocation("java/com/mercedesbenz/sechub/docgen/AsciidocGenerator.java");
end.setRelevantPart("File");
end.setSourceCode("\t\tFile documentsGenFolder = new File(path);");
code.setEnd(end);
metaData.setCode(code);
metaData.setScanType(ScanType.CODE_SCAN);
metaData.setSeverity(Severity.MEDIUM);
metaData.setName("Absolute Path Traversal");
entry.setMetaData(metaData);
fpList.add(entry);
when(falsePositiveJobDataService.fetchFalsePositivesProjectConfiguration(PROJECT1_ID)).thenReturn(config);
/* execute + test @formatter:off */
String metaDataPath = PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_METADATA;
String codeMetaDataPath = metaDataPath + "." + FalsePositiveMetaData.PROPERTY_CODE;
this.mockMvc.perform(get(apiEndpoint, PROJECT1_ID)).andExpect(status().isOk()).andDo(defineRestService().with().useCaseData(useCase).tag(RestDocFactory.extractTag(apiEndpoint)).responseSchema(OpenApiSchema.FALSE_POSITVES.getSchema()).and().document(responseFields(fieldWithPath(PROPERTY_FALSE_POSITIVES).description("Job data list containing false positive setup based on former jobs"), fieldWithPath(PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_AUTHOR).description("User id of author who created false positive"), fieldWithPath(PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_CREATED).description("Creation timestamp"), fieldWithPath(metaDataPath).description("Meta data for this false positive"), fieldWithPath(metaDataPath + "." + FalsePositiveMetaData.PROPERTY_SCANTYPE).description("Scan type - e.g. codeScan"), fieldWithPath(metaDataPath + "." + FalsePositiveMetaData.PROPERTY_NAME).description("Name of origin finding marked as false positive"), fieldWithPath(metaDataPath + "." + FalsePositiveMetaData.PROPERTY_CWE_ID).type(JsonFieldType.NUMBER).optional().description("CWE (common weakness enumeration). For code scans this is always set."), fieldWithPath(metaDataPath + "." + FalsePositiveMetaData.PROPERTY_CVE_ID).type(JsonFieldType.STRING).optional().description("CVE (common vulnerability and exposures). For infra scans this is always set."), fieldWithPath(metaDataPath + "." + FalsePositiveMetaData.PROPERTY_OWASP).type(JsonFieldType.STRING).optional().description("OWASP At least this field must be set for web scans when no cwe identifier is defined."), fieldWithPath(metaDataPath + "." + FalsePositiveMetaData.PROPERTY_SEVERITY).description("Severity of origin report entry marked as false positive"), fieldWithPath(codeMetaDataPath).optional().description("Code part. Only available for scan type 'codeScan'"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_START).description("entry point"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_START + "." + FalsePositiveCodePartMetaData.PROPERTY_LOCATION).description("location of code"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_START + "." + FalsePositiveCodePartMetaData.PROPERTY_RELEVANT_PART).description("relevant part of source vulnerability"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_START + "." + FalsePositiveCodePartMetaData.PROPERTY_SOURCE_CODE).description("source code"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_END).optional().description("end point (sink)"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_END + "." + FalsePositiveCodePartMetaData.PROPERTY_LOCATION).description("location of code"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_END + "." + FalsePositiveCodePartMetaData.PROPERTY_RELEVANT_PART).description("relevant part of source vulnerability"), fieldWithPath(codeMetaDataPath + "." + FalsePositiveCodeMetaData.PROPERTY_END + "." + FalsePositiveCodePartMetaData.PROPERTY_SOURCE_CODE).description("source code"), fieldWithPath(PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_JOBDATA).description("Job data parts, can be used as key to identify false positives"), fieldWithPath(PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_JOBDATA + "." + PROPERTY_JOBUUID).description("SecHub job uuid where finding was"), fieldWithPath(PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_JOBDATA + "." + PROPERTY_FINDINGID).description("SecHub finding identifier - identifies problem inside the job which shall be markeda as a false positive. *ATTENTION*: at the moment only code scan false positive handling is supported. Infra and web scan findings will lead to a non accepted error!"), fieldWithPath(PROPERTY_FALSE_POSITIVES + "[]." + FalsePositiveEntry.PROPERTY_JOBDATA + "." + PROPERTY_COMMENT).optional().description("A comment from author describing why this was marked as a false positive")), pathParameters(parameterWithName(PROJECT_ID.paramName()).description("The project id"))));
/* @formatter:on */
}
use of com.mercedesbenz.sechub.domain.scan.project.FalsePositiveCodePartMetaData in project sechub by mercedes-benz.
the class SerecoFalsePositiveCodeScanStrategy method isFalsePositive.
/**
* Checks if given vulnerability is identified as false positive by given meta
* data
*
* @param vulnerability
* @param metaData
* @return <code>true</code> when identified as false positive
*/
public boolean isFalsePositive(SerecoVulnerability vulnerability, FalsePositiveMetaData metaData) {
notNull(vulnerability, " vulnerability may not be null");
notNull(metaData, " metaData may not be null");
/* check supported scan type */
if (metaData.getScanType() != ScanType.CODE_SCAN) {
return false;
}
if (vulnerability.getScanType() != ScanType.CODE_SCAN) {
return false;
}
FalsePositiveCodeMetaData metaDataCode = metaData.getCode();
if (metaDataCode == null) {
LOG.error("Cannot check code vulnerability for false positives when meta data has no code parts!");
return false;
}
/* ---------------------------------------------------- */
/* -------------------CWE ID--------------------------- */
/* ---------------------------------------------------- */
/* for code scans we only use CWE as wellknown common identifier */
Integer cweId = metaData.getCweId();
if (cweId == null) {
LOG.error("Cannot check code vulnerability for false positives when code meta data has no CWE id set!");
return false;
}
SerecoClassification serecoClassification = vulnerability.getClassification();
String serecoCWE = serecoClassification.getCwe();
if (serecoCWE == null || serecoCWE.isEmpty()) {
LOG.error("Code scan sereco vulnerability type:{} found without CWE! Cannot determin false positive! Classification was:{}", vulnerability.getType(), serecoClassification);
return false;
}
try {
int serecoCWEint = Integer.parseInt(serecoCWE);
if (cweId.intValue() != serecoCWEint) {
/* not same type of common vulnerability enumeration - so skip */
return false;
}
} catch (NumberFormatException e) {
LOG.error("Code scan sereco vulnerability type:{} found CWE:{} but not expected integer format!", vulnerability.getType(), serecoCWE);
return false;
}
/* ------------------------------------------------------- */
/* -------------------Location---------------------------- */
/* ------------------------------------------------------- */
SerecoCodeCallStackElement serecoFirstElement = vulnerability.getCode();
if (serecoFirstElement == null) {
/* strange - canot be investigated */
LOG.warn("Cannot check code vulnerability for false positives when no first code element is found!");
return false;
}
FalsePositiveCodePartMetaData start = metaDataCode.getStart();
if (start == null) {
LOG.warn("Cannot check code vulnerability for false positives when no start code meta data is found!");
return false;
}
if (isLocationDifferent(start, serecoFirstElement)) {
return false;
}
FalsePositiveCodePartMetaData end = metaDataCode.getEnd();
SerecoCodeCallStackElement serecoLastElement = findLastElement(serecoFirstElement);
if (isLocationDifferent(end, serecoLastElement)) {
return false;
}
/* ------------------------------------------------------- */
/* -------------------Relevant parts---------------------- */
/* ------------------------------------------------------- */
String relevant1 = start.getRelevantPart();
String relevant2 = serecoFirstElement.getRelevantPart();
if (relevant1 == null || relevant1.isEmpty()) {
relevant1 = createRelevantReplacment(start);
}
if (relevant2 == null || relevant2.isEmpty()) {
relevant2 = createRelevantReplacment(serecoFirstElement);
}
if (!relevant1.equals(relevant2)) {
return false;
}
String relevant3 = "";
String relevant4 = "";
if (end != null) {
relevant3 = end.getRelevantPart();
if (relevant3 == null || relevant3.isEmpty()) {
relevant3 = createRelevantReplacment(end);
}
}
if (serecoLastElement != null) {
relevant4 = serecoLastElement.getRelevantPart();
if (relevant4 == null || relevant4.isEmpty()) {
relevant4 = createRelevantReplacment(serecoLastElement);
}
}
if (!relevant3.equals(relevant4)) {
return false;
}
return true;
}
Aggregations