Examples with Rule com.mercedesbenz.sechub.sarif.model.Rule used on opensource projects

Example 1 with Rule

use of com.mercedesbenz.sechub.sarif.model.Rule in project sechub by mercedes-benz.

the class SarifReportSupport method fetchRuleForResult.

public Rule fetchRuleForResult(Result result, Run run) {
    // Each run has ONE tool, multiple results and taxonomies
    Tool tool = run.getTool();
    Driver driver = tool.getDriver();
    List<Rule> rules = driver.getRules();
    String ruleId = result.getRuleId();
    /* @formatter:off */
    Rule ruleFound = rules.stream().filter(rule -> rule.getId().equals(ruleId)).findFirst().orElse(null);
    /* @formatter:on */
    return ruleFound;
}

Example 2 with Rule

use of com.mercedesbenz.sechub.sarif.model.Rule in project sechub by mercedes-benz.

the class SarifReportSupportTest method microsoft_sarif_tutorial_taxonomies_example__result_defaultocnfiguraiton_level.

@Test
void microsoft_sarif_tutorial_taxonomies_example__result_defaultocnfiguraiton_level() throws IOException {
    /* prepare */
    File codeFlowReportFile = new File(sarifTutorialSamplesFolder, "Taxonomies.sarif");
    /* execute */
    Report report = supportToTest.loadReport(codeFlowReportFile);
    /* test */
    List<Run> runs = report.getRuns();
    assertEquals(1, runs.size(), "there must be ONE run!");
    Run run = runs.iterator().next();
    List<Rule> rules = run.getTool().getDriver().getRules();
    Map<String, Rule> sortedMap = new TreeMap<>();
    for (Rule rule : rules) {
        sortedMap.put(rule.getId(), rule);
    }
    Rule rule1 = sortedMap.get("TUT0001");
    assertNotNull(rule1);
    ReportingConfiguration defaultConfig1 = rule1.getDefaultConfiguration();
    assertNotNull(defaultConfig1);
    assertEquals(Level.ERROR, defaultConfig1.getLevel());
    Rule rule2 = sortedMap.get("TUT0002");
    assertNotNull(rule2);
    ReportingConfiguration defaultConfig2 = rule2.getDefaultConfiguration();
    assertNotNull(defaultConfig2);
    assertEquals(Level.WARNING, defaultConfig2.getLevel());
}

Example 3 with Rule

use of com.mercedesbenz.sechub.sarif.model.Rule in project sechub by mercedes-benz.

the class SarifReportSupportTest method brakeman_sarif_example_with_tags__tags_can_be_fetched.

@Test
void brakeman_sarif_example_with_tags__tags_can_be_fetched() throws IOException {
    /* prepare */
    File codeFlowReportFile = new File(sarifBrakemanFolder, "sarif_2_1_0__brakeman_testfile_with_tags.sarif.json");
    /* execute */
    Report report = supportToTest.loadReport(codeFlowReportFile);
    /* test */
    List<Run> runs = report.getRuns();
    assertEquals(1, runs.size(), "there must be ONE run!");
    Run run = runs.iterator().next();
    List<Result> results = run.getResults();
    assertEquals(32, results.size(), "there must be 32 results!");
    Result result = results.iterator().next();
    Rule rule = supportToTest.fetchRuleForResult(result, run);
    Set<String> tags = rule.getProperties().fetchTags();
    assertNotNull(tags);
    Set<String> expected = new LinkedHashSet<>();
    expected.add("ContentTag");
    expected.add("Tag2");
    expected.add("Tag3");
    assertEquals(expected, tags);
}

Example 4 with Rule

use of com.mercedesbenz.sechub.sarif.model.Rule in project sechub by mercedes-benz.

the class SarifV1JSONImporter method createSerecoVulnerability.

private SerecoVulnerability createSerecoVulnerability(Run run, Result result) {
    if (result == null) {
        return null;
    }
    SerecoVulnerability vulnerability = new SerecoVulnerability();
    Rule ruleFound = sarifSupport.fetchRuleForResult(result, run);
    ResultData resultData = resolveData(ruleFound, run, result);
    vulnerability.setType(resultData.identifiedType);
    vulnerability.setDescription(resultData.description);
    vulnerability.setSolution(resultData.solution);
    vulnerability.setSeverity(resolveSeverity(result, run));
    vulnerability.getClassification().setCwe(resultData.cweId);
    detectScanTypeAndInspectOnDemand(result, vulnerability);
    return vulnerability;
}

Example 5 with Rule

use of com.mercedesbenz.sechub.sarif.model.Rule in project sechub by mercedes-benz.

the class SarifReportSupport method resolveLevel.

/**
 * Tries first the result level. If not set, the level will be obtained by
 * default configuration if available. If not found {@link Level#NONE} is
 * returned
 *
 * @param result
 * @param run
 * @return level, never null
 */
public Level resolveLevel(Result result, Run run) {
    Level level = result.getLevel();
    if (level != null) {
        return level;
    }
    Rule rule = fetchRuleForResult(result, run);
    if (rule != null) {
        /* @formatter:off

               first fetch default from rule
               see https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317850

               @formatter:on */
        ReportingConfiguration defaultConfiguration = rule.getDefaultConfiguration();
        if (defaultConfiguration != null) {
            level = defaultConfiguration.getLevel();
        }
    }
    if (level == null) {
        level = Level.NONE;
    }
    return level;
}