Skip to content

Commit 4b45149

Browse files
ZhukovANZhukovAN
authored
Positive Technologies Application Inspector (PT AI) SARIF report support (#123)
* Positive Technologies Application Inspector SARIF report support added * PT AI tool name and version are shortened
1 parent 38a24e8 commit 4b45149

File tree

4 files changed

+227
-0
lines changed

4 files changed

+227
-0
lines changed

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/Reader.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import org.owasp.benchmarkutils.score.parsers.sarif.CodeQLReader;
3333
import org.owasp.benchmarkutils.score.parsers.sarif.ContrastScanReader;
3434
import org.owasp.benchmarkutils.score.parsers.sarif.DatadogSastReader;
35+
import org.owasp.benchmarkutils.score.parsers.sarif.PTAIReader;
3536
import org.owasp.benchmarkutils.score.parsers.sarif.PrecautionReader;
3637
import org.owasp.benchmarkutils.score.parsers.sarif.SemgrepSarifReader;
3738
import org.owasp.benchmarkutils.score.parsers.sarif.SnykReader;
@@ -89,6 +90,7 @@ public static List<Reader> allReaders() {
8990
new ParasoftReader(),
9091
new PrecautionReader(),
9192
new PMDReader(),
93+
new PTAIReader(),
9294
new QualysWASReader(),
9395
new Rapid7Reader(),
9496
new ReshiftReader(),

‎plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/PTAIReader.java

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5+
* details, please see <a
6+
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
7+
*
8+
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12+
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13+
* PURPOSE. See the GNU General Public License for more details.
14+
*
15+
* @author Alexey Zhukov
16+
* @created 2024
17+
*/
18+
package org.owasp.benchmarkutils.score.parsers.sarif;
19+
20+
import org.owasp.benchmarkutils.score.CweNumber;
21+
import org.owasp.benchmarkutils.score.ResultFile;
22+
import org.owasp.benchmarkutils.score.TestSuiteResults;
23+
24+
public class PTAIReader extends SarifReader {
25+
26+
static final int PTAI_CWE_EXTERNAL_FILEPATH_CONTROL = 73;
27+
static final int PTAI_CWE_BLIND_XPATH_INJECTION = 91;
28+
29+
static final String EXPECTED_TOOL_NAME = "Positive Technologies Application Inspector";
30+
static final String SHORTENED_TOOL_NAME = "PT Application Inspector";
31+
32+
public PTAIReader() {
33+
super(EXPECTED_TOOL_NAME, true, CweSourceType.FIELD);
34+
}
35+
36+
@Override
37+
public String toolName(ResultFile resultFile) {
38+
return SHORTENED_TOOL_NAME;
39+
}
40+
41+
/**
42+
* SARIF report tool version field is too long as it contains build number. Shorten it to X.Y.Z
43+
*/
44+
@Override
45+
public void setVersion(ResultFile resultFile, TestSuiteResults testSuiteResults) {
46+
super.setVersion(resultFile, testSuiteResults);
47+
String version = testSuiteResults.getToolVersion();
48+
String[] versionItems = version.split("\\.");
49+
if (versionItems.length < 4) return;
50+
testSuiteResults.setToolVersion(
51+
String.format("%s.%s.%s", versionItems[0], versionItems[1], versionItems[2]));
52+
}
53+
54+
@Override
55+
public int mapCwe(int cwe) {
56+
switch (cwe) {
57+
case PTAI_CWE_EXTERNAL_FILEPATH_CONTROL:
58+
return CweNumber.PATH_TRAVERSAL;
59+
case PTAI_CWE_BLIND_XPATH_INJECTION:
60+
return CweNumber.XPATH_INJECTION;
61+
}
62+
return cwe;
63+
}
64+
}

‎plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/PTAIReaderTest.java

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* <p>This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5+
* details, please see <a
6+
* href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
7+
*
8+
* <p>The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* <p>The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12+
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13+
* PURPOSE. See the GNU General Public License for more details.
14+
*
15+
* @author Alexey Zhukov
16+
* @created 2024
17+
*/
18+
package org.owasp.benchmarkutils.score.parsers.sarif;
19+
20+
import static org.junit.jupiter.api.Assertions.assertEquals;
21+
22+
import org.junit.jupiter.api.BeforeEach;
23+
import org.junit.jupiter.api.Test;
24+
import org.owasp.benchmarkutils.score.*;
25+
import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
26+
27+
public class PTAIReaderTest extends ReaderTestBase {
28+
29+
private ResultFile resultFile;
30+
31+
@BeforeEach
32+
void setUp() {
33+
resultFile = TestHelper.resultFileOf("testfiles/Benchmark_PTAI-v4.7.2.sarif");
34+
BenchmarkScore.TESTCASENAME = "BenchmarkTest";
35+
}
36+
37+
@Test
38+
public void onlyPTAIReaderTestReportsCanReadAsTrue() {
39+
assertOnlyMatcherClassIs(this.resultFile, PTAIReader.class);
40+
}
41+
42+
@Test
43+
void readerHandlesGivenResultFile() throws Exception {
44+
PTAIReader reader = new PTAIReader();
45+
TestSuiteResults result = reader.parse(resultFile);
46+
47+
assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
48+
49+
assertEquals("PT Application Inspector", result.getToolName());
50+
assertEquals("4.7.2", result.getToolVersion());
51+
52+
assertEquals(2, result.getTotalResults());
53+
54+
assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
55+
assertEquals(CweNumber.SQL_INJECTION, result.get(8).get(0).getCWE());
56+
}
57+
}

‎plugin/src/test/resources/testfiles/Benchmark_PTAI-v4.7.2.sarif

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"version": "2.1.0",
3+
"$schema": "http://json.schemastore.org/sarif-2.1.0.json",
4+
"runs": [
5+
{
6+
"tool": {
7+
"driver": {
8+
"name": "Positive Technologies Application Inspector",
9+
"version": "4.7.2.36549",
10+
"organization": "Positive Technologies",
11+
"informationUri": "https://www.ptsecurity.com/ww-en/products/ai/",
12+
"rules": [
13+
{
14+
"id": "SQL Injection",
15+
"name": "SQL Injection",
16+
"properties": {
17+
"cwe": [
18+
"CWE-89"
19+
]
20+
},
21+
"defaultConfiguration": {
22+
"level": "error",
23+
"enabled": true
24+
},
25+
"messageStrings": {
26+
"default": {
27+
"text": "SQL Injection"
28+
}
29+
}
30+
},
31+
{
32+
"id": "Arbitrary File Reading",
33+
"name": "Arbitrary File Reading",
34+
"properties": {
35+
"cwe": [
36+
"CWE-73"
37+
]
38+
},
39+
"defaultConfiguration": {
40+
"level": "error",
41+
"enabled": true
42+
},
43+
"messageStrings": {
44+
"default": {
45+
"text": "Arbitrary File Reading"
46+
}
47+
}
48+
}
49+
]
50+
}
51+
},
52+
"results": [
53+
{
54+
"ruleId": "Arbitrary File Reading",
55+
"suppressions": [
56+
],
57+
"message": {
58+
"id": "default",
59+
"text": "Arbitrary File Reading"
60+
},
61+
"locations": [
62+
{
63+
"physicalLocation": {
64+
"artifactLocation": {
65+
"uri": "./src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00001.java"
66+
},
67+
"region": {
68+
"startLine": 71,
69+
"snippet": {
70+
"text": "new java.io.FileInputStream(new java.io.File(fileName))"
71+
}
72+
}
73+
}
74+
}
75+
]
76+
},
77+
{
78+
"ruleId": "SQL Injection",
79+
"suppressions": [
80+
],
81+
"message": {
82+
"id": "default",
83+
"text": "SQL Injection"
84+
},
85+
"locations": [
86+
{
87+
"physicalLocation": {
88+
"artifactLocation": {
89+
"uri": "./src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00008.java"
90+
},
91+
"region": {
92+
"startLine": 57,
93+
"snippet": {
94+
"text": "connection.prepareCall(sql)"
95+
}
96+
}
97+
}
98+
}
99+
]
100+
}
101+
]
102+
}
103+
]
104+
}

0 commit comments

Comments
 (0)