Skip to content

Commit 1b27b66

Browse files
davewichersdavewichers
authored
Relax the SarifReader tool name matching logic to use startswith instead of equals so versions of the same tool will match. For example, Semgrep OSS and Semgrep PRO use the same file format but their names are slightly different. So now the SemgrepSarifReader class names the tool simply 'Semgrep' and SarifReader uses startswith() so both versions of the same tool match with one reader. And added a test case to test this. (#88)
1 parent db6b322 commit 1b27b66

File tree

5 files changed

+156
-7
lines changed

5 files changed

+156
-7
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/SarifReader.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ public SarifReader(String expectedToolName, boolean isCommercial, CweSourceType
5353
@Override
5454
public boolean canRead(ResultFile resultFile) {
5555
try {
56-
return resultFile.isJson() && sarifToolName(resultFile).equals(expectedToolName);
56+
return resultFile.isJson() && sarifToolName(resultFile).startsWith(expectedToolName);
5757
} catch (Exception e) {
5858
return false;
5959
}

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/SemgrepSarifReader.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,6 @@
2020
public class SemgrepSarifReader extends SarifReader {
2121

2222
public SemgrepSarifReader() {
23-
super("Semgrep OSS", false, CweSourceType.TAG);
23+
super("Semgrep", false, CweSourceType.TAG);
2424
}
2525
}

‎plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/SemgrepSarifReaderTest.java

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,23 +31,25 @@
3131

3232
class SemgrepSarifReaderTest extends ReaderTestBase {
3333

34-
private ResultFile resultFile;
34+
private ResultFile resultFileOSS, resultFilePRO;
3535

3636
@BeforeEach
3737
void setUp() {
38-
resultFile = TestHelper.resultFileOf("testfiles/Benchmark_semgrep-v1.67.0.sarif");
38+
resultFileOSS = TestHelper.resultFileOf("testfiles/Benchmark_semgrep-oss-v1.67.0.sarif");
39+
resultFilePRO = TestHelper.resultFileOf("testfiles/Benchmark_semgrep-pro-v1.68.1.sarif");
3940
BenchmarkScore.TESTCASENAME = "BenchmarkTest";
4041
}
4142

4243
@Test
4344
public void onlySemgrepSarifReaderReportsCanReadAsTrue() {
44-
assertOnlyMatcherClassIs(this.resultFile, SemgrepSarifReader.class);
45+
assertOnlyMatcherClassIs(this.resultFileOSS, SemgrepSarifReader.class);
46+
assertOnlyMatcherClassIs(this.resultFilePRO, SemgrepSarifReader.class);
4547
}
4648

4749
@Test
48-
void readerHandlesGivenResultFile() throws Exception {
50+
void readerHandlesSemgrepOSSResultFile() throws Exception {
4951
SemgrepSarifReader reader = new SemgrepSarifReader();
50-
TestSuiteResults result = reader.parse(resultFile);
52+
TestSuiteResults result = reader.parse(resultFileOSS);
5153

5254
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
5355
assertFalse(result.isCommercial());
@@ -59,4 +61,20 @@ void readerHandlesGivenResultFile() throws Exception {
5961
assertEquals(CweNumber.COOKIE_WITHOUT_HTTPONLY, result.get(1).get(0).getCWE());
6062
assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
6163
}
64+
65+
@Test
66+
void readerHandlesSemgrepPROResultFile() throws Exception {
67+
SemgrepSarifReader reader = new SemgrepSarifReader();
68+
TestSuiteResults result = reader.parse(resultFilePRO);
69+
70+
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
71+
assertFalse(result.isCommercial());
72+
assertEquals("Semgrep PRO", result.getToolName());
73+
assertEquals("1.68.1", result.getToolVersion());
74+
75+
assertEquals(2, result.getTotalResults());
76+
77+
assertEquals(CweNumber.COOKIE_WITHOUT_HTTPONLY, result.get(1).get(0).getCWE());
78+
assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
79+
}
6280
}

‎plugin/src/test/resources/testfiles/Benchmark_semgrep-v1.67.0.sarif renamed to ‎plugin/src/test/resources/testfiles/Benchmark_semgrep-oss-v1.67.0.sarif

File renamed without changes.

‎plugin/src/test/resources/testfiles/Benchmark_semgrep-pro-v1.68.1.sarif

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{
2+
"$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json",
3+
"runs": [
4+
{
5+
"results": [
6+
{
7+
"fingerprints": {
8+
"matchBasedId/v1": "1"
9+
},
10+
"locations": [
11+
{
12+
"physicalLocation": {
13+
"artifactLocation": {
14+
"uri": "src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00001.java",
15+
"uriBaseId": "%SRCROOT%"
16+
},
17+
"region": {
18+
"endColumn": 40,
19+
"endLine": 42,
20+
"snippet": {
21+
"text": " response.addCookie(userCookie);"
22+
},
23+
"startColumn": 9,
24+
"startLine": 42
25+
}
26+
}
27+
}
28+
],
29+
"message": {
30+
"text": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"
31+
},
32+
"properties": {},
33+
"ruleId": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"
34+
},
35+
{
36+
"fingerprints": {
37+
"matchBasedId/v1": "1"
38+
},
39+
"locations": [
40+
{
41+
"physicalLocation": {
42+
"artifactLocation": {
43+
"uri": "src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00002.java",
44+
"uriBaseId": "%SRCROOT%"
45+
},
46+
"region": {
47+
"endColumn": 77,
48+
"endLine": 73,
49+
"snippet": {
50+
"text": " response.getWriter()\n .println(\n \"Item: '\"\n + org.owasp.benchmark.helpers.Utils.encodeForHTML(param)\n + \"' with value: '10340' saved in session.\");"
51+
},
52+
"startColumn": 9,
53+
"startLine": 69
54+
}
55+
}
56+
}
57+
],
58+
"message": {
59+
"text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."
60+
},
61+
"properties": {},
62+
"ruleId": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"
63+
}
64+
],
65+
"tool": {
66+
"driver": {
67+
"name": "Semgrep PRO",
68+
"rules": [
69+
{
70+
"defaultConfiguration": {
71+
"level": "warning"
72+
},
73+
"fullDescription": {
74+
"text": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'"
75+
},
76+
"help": {
77+
"markdown": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n",
78+
"text": "A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
79+
},
80+
"helpUri": "https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly",
81+
"id": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly",
82+
"name": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly",
83+
"properties": {
84+
"precision": "very-high",
85+
"tags": [
86+
"CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
87+
"LOW CONFIDENCE",
88+
"OWASP-A05:2021 - Security Misconfiguration",
89+
"security"
90+
]
91+
},
92+
"shortDescription": {
93+
"text": "Semgrep Finding: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly"
94+
}
95+
},
96+
{
97+
"defaultConfiguration": {
98+
"level": "warning"
99+
},
100+
"fullDescription": {
101+
"text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."
102+
},
103+
"help": {
104+
"markdown": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n#### \ud83d\udc8e Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n",
105+
"text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\ud83d\udc8e Enable cross-file analysis and Pro rules for free at sg.run/pro"
106+
},
107+
"helpUri": "https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
108+
"id": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
109+
"name": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
110+
"properties": {
111+
"precision": "very-high",
112+
"tags": [
113+
"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
114+
"MEDIUM CONFIDENCE",
115+
"OWASP-A03:2021 - Injection",
116+
"OWASP-A07:2017 - Cross-Site Scripting (XSS)",
117+
"security"
118+
]
119+
},
120+
"shortDescription": {
121+
"text": "Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"
122+
}
123+
}
124+
],
125+
"semanticVersion": "1.68.1"
126+
}
127+
}
128+
}
129+
],
130+
"version": "2.1.0"
131+
}

0 commit comments

Comments
 (0)