Examples with SerecoCodeCallStackElement com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement used on opensource projects

Example 1 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class CheckmarxV1XMLImporterTest method xmlReportFromCheckmarxVhasNoDescriptionButCodeInfo.

@Test
public void xmlReportFromCheckmarxVhasNoDescriptionButCodeInfo() throws Exception {
    /* prepare */
    String xml = SerecoTestFileSupport.INSTANCE.loadTestFile("checkmarx/sechub-continous-integration-with-false-positive.xml");
    /* execute */
    SerecoMetaData result = importerToTest.importResult(xml);
    /* test */
    List<SerecoVulnerability> vulnerabilities = result.getVulnerabilities();
    SerecoVulnerability v1 = fetchFirstNonFalsePositive(vulnerabilities);
    assertEquals(SerecoSeverity.MEDIUM, v1.getSeverity());
    assertEquals("", v1.getDescription());
    assertEquals(ScanType.CODE_SCAN, v1.getScanType());
    SerecoCodeCallStackElement codeInfo = v1.getCode();
    assertNotNull(codeInfo);
    /*
         * v1 is not first entry, because first entry was a false positive which was
         * already filtered
         */
    assertEquals("com/mercedesbenz/sechub/server/IntegrationTestServerRestController.java", codeInfo.getLocation());
    assertEquals(Integer.valueOf(86), codeInfo.getLine());
    assertEquals(Integer.valueOf(37), codeInfo.getColumn());
    assertEquals("			@PathVariable(\"fileName\") String fileName) throws IOException {", codeInfo.getSource());
    assertEquals("fileName", codeInfo.getRelevantPart());
    SerecoCodeCallStackElement calls1 = codeInfo.getCalls();
    assertNotNull(calls1);
    SerecoCodeCallStackElement calls2 = calls1.getCalls();
    assertNotNull(calls2);
    assertEquals("com/mercedesbenz/sechub/sharedkernel/storage/JobStorage.java", calls2.getLocation());
    assertEquals(Integer.valueOf(139), calls2.getLine());
    assertEquals(Integer.valueOf(39), calls2.getColumn());
    assertEquals("	public String getAbsolutePath(String fileName) {", calls2.getSource());
    assertEquals("fileName", codeInfo.getRelevantPart());
}

Example 2 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class SarifV1JSONImporterTest method sarif_report_threadflow_locations.

@Test
void sarif_report_threadflow_locations() throws Exception {
    /* prepare */
    SerecoMetaData result = importerToTest.importResult(sarif_2_1_0_pythonscanner_thread_flows);
    /* execute */
    List<SerecoVulnerability> vulnerabilities = result.getVulnerabilities();
    SerecoVulnerability vulnerability = fetchFirstNonFalsePositive(vulnerabilities);
    SerecoCodeCallStackElement codeInfo = vulnerability.getCode();
    /* test */
    // was not able to detect from this data
    assertEquals("Undefined", vulnerability.getType());
    assertNotNull(codeInfo);
    assertEquals("3-Beyond-basics/bad-eval-with-code-flow.py", codeInfo.getLocation());
    assertEquals(3, codeInfo.getLine().intValue());
    assertEquals(1, vulnerabilities.size());
    SerecoCodeCallStackElement subCodeInfo = codeInfo.getCalls();
    assertNotNull(subCodeInfo);
    assertEquals("3-Beyond-basics/bad-eval-with-code-flow.py", subCodeInfo.getLocation());
    assertEquals(4, subCodeInfo.getLine().intValue());
}

Example 3 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class SarifV1JSONImporter method resolveCodeInfoFromLocations.

private SerecoCodeCallStackElement resolveCodeInfoFromLocations(List<Location> locations) {
    List<SerecoCodeCallStackElement> callstack = callStackListFromLocations(locations);
    SerecoCodeCallStackElement firstElement = null;
    SerecoCodeCallStackElement prevElement = null;
    for (SerecoCodeCallStackElement code : callstack) {
        if (firstElement == null) {
            firstElement = code;
        } else if (prevElement == null) {
            firstElement.setCalls(code);
            prevElement = code;
        } else {
            prevElement.setCalls(code);
            prevElement = code;
        }
    }
    return firstElement;
}

Example 4 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class IntegrationTestPDSCodeScanImporter method importResult.

@Override
public SerecoMetaData importResult(String simpleText) throws IOException {
    String[] lines = simpleText.split("\n");
    SerecoMetaData metaData = new SerecoMetaData();
    List<SerecoVulnerability> vulnerabilities = metaData.getVulnerabilities();
    int pseudoLineNumber = 0;
    for (String line : lines) {
        // we just reuse result line...
        pseudoLineNumber++;
        if (line.startsWith("#")) {
            continue;
        }
        String[] splitted = line.split(":");
        if (splitted.length < 2) {
            continue;
        }
        int pos = 0;
        String severity = splitted[pos++];
        String message = splitted[pos++];
        SerecoCodeCallStackElement code = new SerecoCodeCallStackElement();
        code.setColumn(123);
        code.setLine(pseudoLineNumber);
        code.setLocation("data.txt");
        code.setRelevantPart("integrationtest");
        code.setSource("integration test code only!");
        SerecoVulnerability vulnerability = new SerecoVulnerability();
        vulnerability.setDescription(message);
        vulnerability.setScanType(ScanType.CODE_SCAN);
        vulnerability.setCode(code);
        vulnerability.setSeverity(SerecoSeverity.fromString(severity));
        vulnerabilities.add(vulnerability);
    }
    return metaData;
}

Example 5 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class CheckmarxV1XMLImporter method fillPathNodeInfo.

private void fillPathNodeInfo(SerecoCodeCallStackElement info, Element pathNode) {
    Element filename = pathNode.element("FileName");
    if (filename != null) {
        info.setLocation(filename.getStringValue());
    }
    Element line = pathNode.element("Line");
    if (line != null) {
        info.setLine(safeGetInteger(line));
    }
    Element column = pathNode.element("Column");
    if (column != null) {
        info.setColumn(safeGetInteger(column));
    }
    Element name = pathNode.element("Name");
    if (name != null) {
        info.setRelevantPart(name.getStringValue());
    }
    addSource(info, pathNode);
}