Examples with SQCategory org.sonar.server.security.SecurityStandards.SQCategory used on opensource projects

Example 1 with SQCategory

use of org.sonar.server.security.SecurityStandards.SQCategory in project sonarqube by SonarSource.

the class RuleIndexerTest method twoDifferentCategoriesButOTHERS.

@DataProvider
public static Object[][] twoDifferentCategoriesButOTHERS() {
    EnumSet<SQCategory> sqCategories = EnumSet.allOf(SQCategory.class);
    sqCategories.remove(SQCategory.OTHERS);
    // pick two random categories
    Random random = new Random();
    SQCategory sqCategory1 = sqCategories.toArray(new SQCategory[0])[random.nextInt(sqCategories.size())];
    sqCategories.remove(sqCategory1);
    SQCategory sqCategory2 = sqCategories.toArray(new SQCategory[0])[random.nextInt(sqCategories.size())];
    return new Object[][] { { sqCategory1, sqCategory2 } };
}

Example 2 with SQCategory

use of org.sonar.server.security.SecurityStandards.SQCategory in project sonarqube by SonarSource.

the class RuleIndexerTest method log_debug_if_hotspot_rule_maps_to_multiple_SQCategories.

@Test
@UseDataProvider("twoDifferentCategoriesButOTHERS")
public void log_debug_if_hotspot_rule_maps_to_multiple_SQCategories(SQCategory sqCategory1, SQCategory sqCategory2) {
    Set<String> standards = Stream.of(sqCategory1, sqCategory2).flatMap(t -> CWES_BY_SQ_CATEGORY.get(t).stream().map(e -> "cwe:" + e)).collect(toSet());
    SecurityStandards securityStandards = SecurityStandards.fromSecurityStandards(standards);
    RuleDefinitionDto rule = dbTester.rules().insert(RuleTesting.newRule().setType(RuleType.SECURITY_HOTSPOT).setSecurityStandards(standards).setDescription(VALID_HOTSPOT_RULE_DESCRIPTION));
    underTest.commitAndIndex(dbTester.getSession(), rule.getUuid());
    assertThat(logTester.getLogs()).hasSize(1);
    assertThat(logTester.logs(LoggerLevel.DEBUG).get(0)).isEqualTo(format("Rule %s with CWEs '%s' maps to multiple SQ Security Categories: %s", rule.getKey(), String.join(", ", securityStandards.getCwe()), ImmutableSet.of(sqCategory1, sqCategory2).stream().map(SQCategory::getKey).sorted(SQ_CATEGORY_KEYS_ORDERING).collect(joining(", "))));
}

Example 3 with SQCategory

use of org.sonar.server.security.SecurityStandards.SQCategory in project sonarqube by SonarSource.

the class SearchActionTest method returns_hotspots_ordered_by_vulnerabilityProbability_score_then_rule_uuid.

@Test
public void returns_hotspots_ordered_by_vulnerabilityProbability_score_then_rule_uuid() {
    ComponentDto project = dbTester.components().insertPublicProject();
    userSessionRule.registerComponents(project);
    indexPermissions();
    ComponentDto file = dbTester.components().insertComponent(newFileDto(project));
    List<IssueDto> hotspots = Arrays.stream(SQCategory.values()).sorted(Ordering.from(Comparator.<SQCategory>comparingInt(t1 -> t1.getVulnerability().getScore()).reversed()).thenComparing(SQCategory::getKey)).flatMap(sqCategory -> {
        Set<String> cwes = SecurityStandards.CWES_BY_SQ_CATEGORY.get(sqCategory);
        Set<String> securityStandards = singleton("cwe:" + (cwes == null ? "unknown" : cwes.iterator().next()));
        RuleDefinitionDto rule1 = newRule(SECURITY_HOTSPOT, t -> t.setUuid(sqCategory.name() + "_a").setName("rule_" + sqCategory.name() + "_a").setSecurityStandards(securityStandards));
        RuleDefinitionDto rule2 = newRule(SECURITY_HOTSPOT, t -> t.setUuid(sqCategory.name() + "_b").setName("rule_" + sqCategory.name() + "_b").setSecurityStandards(securityStandards));
        return Stream.of(newHotspot(rule1, project, file).setKee(sqCategory + "_a"), newHotspot(rule2, project, file).setKee(sqCategory + "_b"));
    }).collect(toList());
    String[] expectedHotspotKeys = hotspots.stream().map(IssueDto::getKey).toArray(String[]::new);
    // insert hotspots in random order
    Collections.shuffle(hotspots);
    hotspots.forEach(dbTester.issues()::insertHotspot);
    indexIssues();
    SearchWsResponse response = newRequest(project).executeProtobuf(SearchWsResponse.class);
    assertThat(response.getHotspotsList()).extracting(SearchWsResponse.Hotspot::getKey).containsExactly(expectedHotspotKeys);
}

Example 4 with SQCategory

use of org.sonar.server.security.SecurityStandards.SQCategory in project sonarqube by SonarSource.

the class SecurityStandardsTest method fromSecurityStandards_finds_SQCategory_first_in_order_when_CWEs_map_to_multiple_SQCategories.

@Test
public void fromSecurityStandards_finds_SQCategory_first_in_order_when_CWEs_map_to_multiple_SQCategories() {
    EnumSet<SQCategory> sqCategories = EnumSet.allOf(SQCategory.class);
    sqCategories.remove(SQCategory.OTHERS);
    while (!sqCategories.isEmpty()) {
        SQCategory expected = sqCategories.stream().min(SQ_CATEGORY_KEYS_ORDERING.onResultOf(SQCategory::getKey)).get();
        SQCategory[] expectedIgnored = sqCategories.stream().filter(t -> t != expected).toArray(SQCategory[]::new);
        Set<String> cwes = sqCategories.stream().flatMap(t -> CWES_BY_SQ_CATEGORY.get(t).stream().map(e -> "cwe:" + e)).collect(Collectors.toSet());
        SecurityStandards securityStandards = fromSecurityStandards(cwes);
        assertThat(securityStandards.getSqCategory()).isEqualTo(expected);
        assertThat(securityStandards.getIgnoredSQCategories()).containsOnly(expectedIgnored);
        sqCategories.remove(expected);
    }
}