Examples with SerecoCodeCallStackElement com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement used on opensource projects

Example 6 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class CheckmarxV1XMLImporter method addSource.

private void addSource(SerecoCodeCallStackElement info, Element pathNode) {
    if (pathNode == null) {
        return;
    }
    /* add source snippet */
    Element snippet = pathNode.element("Snippet");
    if (snippet == null) {
        return;
    }
    Element snippetLine = snippet.element("Line");
    if (snippetLine == null) {
        return;
    }
    Element snippetCode = snippetLine.element("Code");
    if (snippetCode == null) {
        return;
    }
    info.setSource(snippetCode.getStringValue());
}

Example 7 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class SerecoProductResultTransformerTest method createMetaDataWithOneVulnerabilityAsCodeFound.

private String createMetaDataWithOneVulnerabilityAsCodeFound() {
    SerecoMetaData data = new SerecoMetaData();
    List<SerecoVulnerability> vulnerabilities = data.getVulnerabilities();
    SerecoVulnerability v1 = new SerecoVulnerability();
    v1.setSeverity(SerecoSeverity.MEDIUM);
    v1.setType("type1");
    v1.setScanType(ScanType.CODE_SCAN);
    SerecoCodeCallStackElement serecoCode1 = new SerecoCodeCallStackElement();
    serecoCode1.setLine(1);
    serecoCode1.setColumn(2);
    serecoCode1.setLocation("Location1");
    serecoCode1.setSource("source1");
    serecoCode1.setRelevantPart("relevantPart1");
    v1.setCode(serecoCode1);
    SerecoCodeCallStackElement serecoCode2 = new SerecoCodeCallStackElement();
    serecoCode2.setLine(3);
    serecoCode2.setColumn(4);
    serecoCode2.setLocation("Location2");
    serecoCode2.setSource("source2");
    serecoCode2.setRelevantPart("relevantPart2");
    serecoCode1.setCalls(serecoCode2);
    SerecoClassification cl = v1.getClassification();
    cl.setCapec("capec1");
    vulnerabilities.add(v1);
    String converted = JSONConverter.get().toJSON(data);
    return converted;
}

Example 8 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class SarifV1JSONImporter method resolveCodeInfoFromResult.

private SerecoCodeCallStackElement resolveCodeInfoFromResult(Result result) {
    boolean firstElementfromResultLocation = false;
    SerecoCodeCallStackElement firstElement = resolveCodeInfoFromCodeFlow(result);
    if (firstElement == null) {
        // if no CodeFlow available, try to extract callstack directly from locations
        firstElement = resolveCodeInfoFromLocations(result.getLocations());
        firstElementfromResultLocation = true;
    }
    if (!firstElementfromResultLocation && firstElement != null) {
        /* check source is set at least at first element */
        String source = firstElement.getSource();
        if (source == null || source.trim().isEmpty()) {
            /* not set - last fallback to location */
            SerecoCodeCallStackElement fallbackElement = resolveCodeInfoFromLocations(result.getLocations());
            source = fallbackElement.getSource();
            firstElement.setSource(source);
        }
    }
    return firstElement;
}

Example 9 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class SarifV1JSONImporter method callStackListFromLocations.

private List<SerecoCodeCallStackElement> callStackListFromLocations(List<Location> locations) {
    List<SerecoCodeCallStackElement> callstack = new ArrayList<>();
    if (locations == null) {
        return callstack;
    }
    locations.forEach(location -> {
        PhysicalLocation physicalLocation = location.getPhysicalLocation();
        if (physicalLocation != null) {
            SerecoCodeCallStackElement subCode = new SerecoCodeCallStackElement();
            ArtifactLocation artifactLocation = physicalLocation.getArtifactLocation();
            if (artifactLocation != null) {
                subCode.setLocation(artifactLocation.getUri());
            }
            Region region = physicalLocation.getRegion();
            if (region != null) {
                subCode.setLine(region.getStartLine());
                subCode.setColumn(region.getStartColumn());
                ArtifactContent snippet = region.getSnippet();
                if (snippet != null) {
                    String text = snippet.getText();
                    if (text != null) {
                        text = text.trim();
                    }
                    subCode.setSource(text);
                }
            }
            callstack.add(subCode);
        }
    });
    return callstack;
}

Example 10 with SerecoCodeCallStackElement

use of com.mercedesbenz.sechub.sereco.metadata.SerecoCodeCallStackElement in project sechub by mercedes-benz.

the class SarifV1JSONImporter method resolveCodeInfoFromCodeFlow.

private SerecoCodeCallStackElement resolveCodeInfoFromCodeFlow(Result result) {
    Optional<CodeFlow> codeFlows = result.getCodeFlows().stream().findFirst();
    if (!codeFlows.isPresent()) {
        return null;
    }
    Optional<ThreadFlow> optFlow = codeFlows.get().getThreadFlows().stream().findFirst();
    if (!optFlow.isPresent()) {
        return null;
    }
    ThreadFlow flow = optFlow.get();
    List<Location> locations = flow.getLocations().stream().map(location -> location.getLocation()).collect(Collectors.toList());
    return resolveCodeInfoFromLocations(locations);
}