Skip to content

Commit 1935850

Browse files
darkspirit510darkspirit510
committed
scripts to create several SAST reports
1 parent 4247b45 commit 1935850

9 files changed

Lines changed: 127 additions & 25 deletions

File tree

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@ tools/Contrast/contrast.jar
1010
tools/Contrast/contrast.yaml
1111
tools/Contrast/working/
1212

13+
.idea/
14+
*.iml

‎scripts/getBenchmarkVersion.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/usr/bin/env sh
2+
3+
mvn org.apache.maven.plugins:maven-help-plugin:2.1.1:evaluate -Dexpression=project.version | grep -v '[INFO]'

‎scripts/runHorusec.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/usr/bin/env sh
2+
3+
# Check for install/updates at https://github.com/ZupIT/horusec
4+
5+
benchmark_version=$(scripts/getBenchmarkVersion.sh)
6+
horusec_version=$(horusec version 2>&1 | grep version | awk '{print $NF}')
7+
result_file="results/Benchmark_$benchmark_version-horusec-$horusec_version.json"
8+
9+
horusec start -t 3600 -p="." -o="json" -O="$result_file"

‎scripts/runInsider.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env sh
2+
3+
# Check for install/updates at https://github.com/insidersec/insider
4+
5+
benchmark_version=$(scripts/getBenchmarkVersion.sh)
6+
insider_version=$(insider -version | grep Version | cut -d' ' -f2)
7+
result_file="results/Benchmark_$benchmark_version-insider-v$insider_version.json"
8+
9+
insider -quiet --tech java -no-html -exclude '.idea' -exclude '.mvn' -exclude 'results' -exclude 'scorecard' -exclude 'scripts' -exclude 'tools' -target "."
10+
mv report.json "$result_file"

‎scripts/runSemgrep.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/usr/bin/env sh
2+
3+
# Check for install/updates at https://github.com/returntocorp/semgrep
4+
5+
benchmark_version=$(scripts/getBenchmarkVersion.sh)
6+
semgrep_version=$(semgrep --version)
7+
result_file="results/Benchmark_$benchmark_version-semgrep-v$semgrep_version.json"
8+
9+
semgrep --config p/security-audit -q --json -o "$result_file" . > /dev/null

‎scripts/runShiftLeftScan.sh‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1-
# Generates results files in the folder reports/. The ShiftLeftScanReader processes the file: reports/scan-full-report.json
2-
docker run --rm -e "WORKSPACE=${PWD}" -v ~/.m2:/.m2 -v ${PWD}:/app shiftleft/scan scan --src /app --type java
1+
#!/usr/bin/env sh
32

3+
# Check for install/updates at https://github.com/ShiftLeftSecurity/sast-scan
4+
5+
benchmark_version=$(scripts/getBenchmarkVersion.sh)
6+
shiflteft_version="2.0.3" # it's not (yet) possible to get the release version so we just assume it
7+
result_file="results/Benchmark_$benchmark_version-shiftleftscan-v$shiflteft_version.json"
8+
9+
mkdir -p .shiftlefscan-reports
10+
11+
docker run --rm -e "WORKSPACE=${PWD}" -v ~/.m2:/.m2 -v "$PWD":/app -v "$PWD/.shiftlefscan-reports":/app/reports shiftleft/scan scan --src /app --type java
12+
mv .shiftlefscan-reports/scan-full-report.json "$result_file"
13+
14+
rm -rf .shiftlefscan-reports

‎scripts/runSonarQube.sh‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/usr/bin/env bash
2+
3+
# Check for install/updates at https://github.com/SonarSource/sonarqube
4+
5+
sonar_host="http://localhost:9000"
6+
sonar_project="benchmark"
7+
sonar_token="291e50b66b5f5198e6ac0d49bf1057ac3a3a0fc8"
8+
9+
mvn sonar:sonar \
10+
-Dsonar.projectKey="$sonar_project" \
11+
-Dsonar.host.url="$sonar_host" \
12+
-Dsonar.login="$sonar_token"
13+
14+
sleep 300s # might be replaced with polling of $sonar_host/api/ce/component?component=$sonar_project
15+
16+
benchmark_version=$(scripts/getBenchmarkVersion.sh)
17+
sonarqube_version=$(curl --silent -u "$sonar_token:" "$sonar_host/api/server/version")
18+
result_file="results/Benchmark_$benchmark_version-sonarqube-v$sonarqube_version.json"
19+
20+
# SonarQube does not provide a download option so we've to create the result file manually :(
21+
22+
result='{"issues":[], "hotspots": []}'
23+
rules='[]'
24+
25+
# sonarqube does not allow us to grab more than 10k issues, but most of them are information exposure which is not even
26+
# considered by benchmark so let's just get all relevant rules and receive results for only those rules
27+
28+
rules_count=$(curl --silent -u "$sonar_token:" "$sonar_host/api/rules/search?p=1&ps=1" | jq -r '.total')
29+
page=1
30+
31+
while (((page - 1) * 500 < rules_count)); do
32+
rules=$(echo "$rules" | jq ". += $(curl --silent -u "$sonar_token:" "$sonar_host/api/rules/search?p=$page&ps=500" | jq '.rules | map( .key ) | map( select(. | contains("java:") ) )')")
33+
page=$((page+1))
34+
done
35+
36+
rules=$(echo "$rules" | jq '. | join(",")' | sed 's/java:S1989,//')
37+
38+
issues_count=$(curl --silent -u "$sonar_token:" "$sonar_host/api/issues/search?p=1&ps=1&types=VULNERABILITY&componentKeys=$sonar_project&rules=$rules" | jq -r '.paging.total')
39+
page=1
40+
41+
while (((page - 1) * 500 < issues_count)); do
42+
issues_page=$(curl --silent -u "$sonar_token:" "$sonar_host/api/issues/search?types=VULNERABILITY&p=$page&ps=500&componentKeys=$sonar_project&rules=$rules" | jq '.issues')
43+
44+
result=$(echo "$result" | jq ".issues += $issues_page")
45+
page=$((page+1))
46+
done
47+
48+
hotspot_count=$(curl --silent -u "$sonar_token:" "$sonar_host/api/hotspots/search?projectKey=benchmark&p=1&ps=1" | jq -r '.paging.total')
49+
page=1
50+
51+
while (((page - 1) * 500 < hotspot_count)); do
52+
result=$(echo "$result" | jq ".hotspots += $(curl --silent -u "$sonar_token:" "$sonar_host/api/hotspots/search?projectKey=$sonar_project&p=$page&ps=500" | jq '.hotspots')")
53+
page=$((page+1))
54+
done
55+
56+
echo "$result" > "$result_file"

‎src/main/java/org/owasp/benchmark/score/parsers/HorusecReader.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ private String guessCwe(String details) {
142142
switch (category(details)) {
143143
case "Java Crypto import":
144144
case "DES is considered deprecated. AES is the recommended cipher.":
145+
case "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.":
145146
return "327";
146147
case "Weak block mode for Cryptographic Hash Function":
147148
case "Message Digest":

‎src/main/java/org/owasp/benchmark/score/parsers/SonarQubeJsonReader.java‎

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
import java.nio.file.Files;
2222
import java.nio.file.Paths;
2323
import org.json.JSONArray;
24-
import org.json.JSONException;
2524
import org.json.JSONObject;
2625
import org.owasp.benchmark.score.BenchmarkScore;
2726
import org.owasp.benchmark.score.TestCaseResult;
@@ -39,42 +38,41 @@ public TestSuiteResults parse(File f) throws Exception {
3938
tr.setTime(f);
4039

4140
String content = new String(Files.readAllBytes(Paths.get(f.getPath())));
42-
4341
JSONObject obj = new JSONObject(content);
44-
// int version = obj.getInt( "formatVersion" );
45-
JSONArray arr;
4642

47-
boolean hotSpotIssue = true;
43+
parseIssues(tr, obj);
44+
parseHotspots(tr, obj);
4845

49-
// Figure out if there are quality issues or security hotspots in the JSON file
50-
// Each has a different JSON format.
51-
try {
52-
arr = obj.getJSONArray("issues");
53-
hotSpotIssue = false;
54-
} catch (JSONException e) {
55-
try {
56-
arr = obj.getJSONArray("hotspots");
57-
} catch (JSONException e2) {
58-
System.out.println(
59-
"ERROR: Couldn't find 'issues' or 'hotspots' element in SonarQube JSON results."
60-
+ " Maybe not SonarQube results file?");
61-
return null;
62-
}
46+
return tr;
47+
}
48+
49+
private void parseHotspots(TestSuiteResults tr, JSONObject obj) {
50+
parseResults(tr, obj, true);
51+
}
52+
53+
private void parseIssues(TestSuiteResults tr, JSONObject obj) {
54+
parseResults(tr, obj, false);
55+
}
56+
57+
private void parseResults(TestSuiteResults tr, JSONObject obj, boolean isHotspots) {
58+
String key = isHotspots ? "hotspots" : "issues";
59+
60+
if (!obj.has(key)) {
61+
return;
6362
}
6463

64+
JSONArray arr = obj.getJSONArray(key);
6565
int numIssues = arr.length();
66-
for (int i = 0; i < numIssues; i++) {
6766

67+
for (int i = 0; i < numIssues; i++) {
6868
TestCaseResult tcr =
69-
(hotSpotIssue
69+
(isHotspots
7070
? parseSonarQubeHotSpotIssue(arr.getJSONObject(i))
7171
: parseSonarQubeQualityIssue(arr.getJSONObject(i)));
7272
if (tcr != null) {
7373
tr.put(tcr);
7474
}
7575
}
76-
77-
return tr;
7876
}
7977

8078
/**
@@ -197,9 +195,12 @@ public static int securityCategoryCWELookup(String secCat, String message) {
197195
.equals(message)
198196
|| "Ensure that string concatenation is required and safe for this SQL query."
199197
.equals(message)
198+
|| "Make sure using a dynamically formatted SQL query is safe here.".equals(message)
200199
|| "Make sure creating this cookie without the \"secure\" flag is safe here."
201200
.equals(message)
202201
|| "Make sure that hashing data is safe here.".equals(message)
202+
|| "Make sure this weak hash algorithm is not used in a sensitive context here."
203+
.equals(message)
203204
|| "Make sure creating this cookie without the \"HttpOnly\" flag is safe."
204205
.equals(message))) {
205206
System.out.println(

0 commit comments

Comments
 (0)