Examples with SerecoWeb com.mercedesbenz.sechub.sereco.metadata.SerecoWeb used on opensource projects

Example 6 with SerecoWeb

use of com.mercedesbenz.sechub.sereco.metadata.SerecoWeb in project sechub by mercedes-benz.

the class AssertVulnerabilities method assertWebResponse.

public static void assertWebResponse(SerecoVulnerability toInspect, SerecoWebResponse expectedResponse) {
    SerecoWeb vulnerabilityWeb = toInspect.getWeb();
    if (vulnerabilityWeb == null) {
        fail("vulnerability web is null!");
    }
    SerecoWebResponse foundResponse = vulnerabilityWeb.getResponse();
    if (!expectedResponse.equals(foundResponse)) {
        SerecoWebBody body1 = expectedResponse.getBody();
        SerecoWebBody body2 = foundResponse.getBody();
        internalAssertEquals(expectedResponse.getHeaders(), foundResponse.getHeaders(), "headers not as expected");
        internalAssertEquals(body1, body2, "body not as expected");
        assertEquals("protocol", expectedResponse.getProtocol(), foundResponse.getProtocol());
        assertEquals("version", expectedResponse.getVersion(), foundResponse.getVersion());
        assertEquals("reasonPhrase", expectedResponse.getReasonPhrase(), foundResponse.getReasonPhrase());
        assertEquals("statusCode", expectedResponse.getStatusCode(), foundResponse.getStatusCode());
        fail("not equal but not detectable");
    }
}

Example 7 with SerecoWeb

use of com.mercedesbenz.sechub.sereco.metadata.SerecoWeb in project sechub by mercedes-benz.

the class AssertVulnerabilitiesParamTest method createVulnerabilityWithCurrentTestData.

private SerecoVulnerability createVulnerabilityWithCurrentTestData() {
    SerecoVulnerability testVulnerability = new SerecoVulnerability();
    testVulnerability.setDescription(currentTestData.get(DESCRIPTION));
    testVulnerability.setSeverity(currentTestData.getSeverity());
    testVulnerability.setType(currentTestData.get(TYPE));
    SerecoWeb web = new SerecoWeb();
    web.getRequest().setTarget(currentTestData.get(URL));
    testVulnerability.setWeb(web);
    SerecoClassification classification = testVulnerability.getClassification();
    classification.setOwasp(currentTestData.get(OWASP));
    classification.setCapec(currentTestData.get(CAPEC));
    classification.setCwe("" + currentTestData.getInt(CWE));
    classification.setOwaspProactiveControls(currentTestData.get(OWASPPROACTIVE));
    classification.setHipaa(currentTestData.get(HIPAA));
    classification.setPci31(currentTestData.get(PCI31));
    classification.setPci32(currentTestData.get(PCI32));
    return testVulnerability;
}

Example 8 with SerecoWeb

use of com.mercedesbenz.sechub.sereco.metadata.SerecoWeb in project sechub by mercedes-benz.

the class VulnerabilityTestDescriptionBuilder method describe.

public String describe(SerecoVulnerability vulnerability) {
    if (vulnerability == null) {
        return "null";
    }
    StringBuilder sb = new StringBuilder();
    /* first row */
    if (vulnerability.getSeverity() != null) {
        sb.append("severity=");
        sb.append(vulnerability.getSeverity());
    }
    if (vulnerability.getClassification() != null) {
        sb.append(",cwe=");
        sb.append(vulnerability.getClassification().getCwe());
    }
    if (vulnerability.getType() != null) {
        sb.append(",type=");
        sb.append(vulnerability.getType());
    }
    sb.append("\n");
    /* additional rows */
    if (vulnerability.getScanType() != null) {
        sb.append("- scanType:");
        sb.append(vulnerability.getScanType());
        sb.append("\n");
    }
    if (vulnerability.getCode() != null) {
        sb.append("- code:");
        sb.append("\n");
        SerecoCodeCallStackElement callstackElement = vulnerability.getCode();
        String indention = INDENTION;
        while (callstackElement != null) {
            sb.append(indention);
            sb.append("- location:");
            sb.append(callstackElement.getLocation());
            sb.append(", line:");
            sb.append(callstackElement.getLine());
            sb.append(", column:");
            sb.append(callstackElement.getColumn());
            sb.append("\n");
            sb.append(indention);
            sb.append("- relevant:");
            if (callstackElement.getRelevantPart() != null) {
                sb.append(callstackElement.getRelevantPart());
            }
            sb.append("\n");
            sb.append(indention);
            sb.append("- source:");
            if (callstackElement.getSource() != null) {
                sb.append(callstackElement.getSource());
            }
            sb.append("\n");
            indention = indention + INDENTION;
            callstackElement = callstackElement.getCalls();
        }
        sb.append("\n");
    }
    SerecoWeb web = vulnerability.getWeb();
    if (web != null) {
        SerecoWebAttack attack = web.getAttack();
        if (attack != null) {
            sb.append(INDENTION);
            sb.append("- attack:");
            sb.append(attack);
            sb.append("\n");
        }
        SerecoWebRequest request = web.getRequest();
        if (request != null) {
            sb.append(INDENTION);
            sb.append("- request:");
            sb.append(request);
            sb.append("\n");
        }
        SerecoWebResponse response = web.getResponse();
        if (response != null) {
            sb.append(INDENTION);
            sb.append("- response:");
            sb.append(response);
            sb.append("\n");
        }
    }
    if (vulnerability.getDescription() != null) {
        sb.append("- description:");
        sb.append(vulnerability.getDescription());
        sb.append("\n");
    }
    if (vulnerability.getClassification() != null) {
        sb.append("- classification:");
        sb.append(vulnerability.getClassification());
        sb.append("\n");
    }
    /* code parts not inside toString */
    return sb.toString();
}

Example 9 with SerecoWeb

use of com.mercedesbenz.sechub.sereco.metadata.SerecoWeb in project sechub by mercedes-benz.

the class SerecoFalsePositiveWebScanStrategyTest method createValidTestVulnerability.

private SerecoVulnerability createValidTestVulnerability() {
    SerecoVulnerability vulnerability = new SerecoVulnerability();
    SerecoWeb web = new SerecoWeb();
    vulnerability.getClassification().setCwe("" + CWE_ID_4711);
    vulnerability.setWeb(web);
    vulnerability.setScanType(ScanType.WEB_SCAN);
    SerecoWebRequest request = web.getRequest();
    request.setMethod(METHOD1);
    request.setTarget(TARGET1);
    request.setProtocol("protocol1");
    request.setVersion("version1");
    web.getResponse().setStatusCode(3333);
    web.getAttack().setVector(ATTACK_VECTOR1);
    SerecoWebEvidence evidence = new SerecoWebEvidence();
    web.getAttack().setEvidence(evidence);
    evidence.setSnippet(EVIDENCE1);
    return vulnerability;
}