Skip to content

Commit 48f593b

Browse files
davewichersdavewichers
committed
Add new Xanitizer scorecard generator class.
1 parent 31a1b77 commit 48f593b

File tree

1 file changed

+191
-0
lines changed

1 file changed

+191
-0
lines changed

‎src/main/java/org/owasp/benchmark/score/parsers/XanitizerReader.java

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
/**
2+
* OWASP Benchmark Project
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Benchmark Project For details, please see
6+
* <a href="https://www.owasp.org/index.php/Benchmark">https://www.owasp.org/index.php/Benchmark</a>.
7+
*
8+
* The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9+
* of the GNU General Public License as published by the Free Software Foundation, version 2.
10+
*
11+
* The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
12+
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details
14+
*
15+
* @author Heinrich Rust
16+
* @created 2016-02-16
17+
*/
18+
19+
package org.owasp.benchmark.score.parsers;
20+
21+
import java.io.File;
22+
23+
import javax.xml.XMLConstants;
24+
import javax.xml.parsers.SAXParser;
25+
import javax.xml.parsers.SAXParserFactory;
26+
27+
import org.xml.sax.Attributes;
28+
import org.xml.sax.SAXException;
29+
import org.xml.sax.helpers.DefaultHandler;
30+
31+
public class XanitizerReader extends Reader {
32+
33+
public XanitizerReader() {
34+
}
35+
36+
public TestResults parse(final File f) throws Exception {
37+
final TestResults tr = new TestResults("Xanitizer", false, TestResults.ToolType.SAST);
38+
tr.setTime(f);
39+
40+
/*
41+
* Create a SAX handler that collects and registers the needed data from
42+
* the findings file.
43+
*/
44+
final DefaultHandler handler = new DefaultHandler() {
45+
46+
private final StringBuilder m_CollectedCharacters = new StringBuilder();
47+
48+
private String m_ProblemTypeId;
49+
private String m_Class;
50+
private String m_Classification;
51+
52+
@Override
53+
public void startElement(final String uri, final String localName, final String qName,
54+
final Attributes attributes) throws SAXException {
55+
56+
m_CollectedCharacters.setLength(0);
57+
58+
switch (qName) {
59+
case "XanitizerFindingsList":
60+
61+
String version = attributes.getValue("xanitizerVersion");
62+
version = version.replace('/', '-');
63+
tr.setToolVersion(version);
64+
65+
break;
66+
67+
}
68+
}
69+
70+
@Override
71+
public void endElement(final String uri, final String localName, final String qName)
72+
throws SAXException {
73+
switch (qName) {
74+
75+
case "problemTypeId":
76+
m_ProblemTypeId = m_CollectedCharacters.toString();
77+
break;
78+
79+
case "class":
80+
m_Class = m_CollectedCharacters.toString();
81+
break;
82+
83+
case "classification":
84+
m_Classification = m_CollectedCharacters.toString();
85+
break;
86+
87+
case "finding":
88+
// Finishing a finding.
89+
90+
// Defensiveness: This condition should always be true.
91+
if (m_ProblemTypeId != null && m_Class != null && m_Classification != null) {
92+
93+
// Skip informational findings.
94+
if (!m_Classification.equals("Information")) {
95+
96+
// Skip findings for non-BenchmarkTest classes.
97+
if (m_Class.startsWith("BenchmarkTest")) {
98+
99+
final String testNumberAsString = m_Class
100+
.substring("BenchmarkTest".length());
101+
102+
int testCaseNumber;
103+
try {
104+
testCaseNumber = Integer.parseInt(testNumberAsString);
105+
} catch (final NumberFormatException ex) {
106+
// Inner classes can lead to this.
107+
testCaseNumber = -1;
108+
}
109+
110+
if (testCaseNumber >= 0) {
111+
final TestCaseResult tcr = new TestCaseResult();
112+
113+
tcr.setNumber(testCaseNumber);
114+
tcr.setCategory(m_ProblemTypeId);
115+
tcr.setCWE(figureCWE(m_ProblemTypeId));
116+
117+
tr.put(tcr);
118+
}
119+
}
120+
}
121+
}
122+
123+
m_ProblemTypeId = null;
124+
m_Class = null;
125+
m_Classification = null;
126+
break;
127+
}
128+
129+
m_CollectedCharacters.setLength(0);
130+
}
131+
132+
@Override
133+
public void characters(final char ch[], final int start, final int length)
134+
throws SAXException {
135+
m_CollectedCharacters.append(ch, start, length);
136+
}
137+
};
138+
139+
final SAXParserFactory factory = SAXParserFactory.newInstance();
140+
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);
141+
final SAXParser saxParser = factory.newSAXParser();
142+
143+
saxParser.parse(f, handler);
144+
145+
return tr;
146+
}
147+
148+
private static int figureCWE(final String problemTypeId) {
149+
switch (problemTypeId) {
150+
case "ci:CommandInjection":
151+
return 78;
152+
153+
case "SpecialMethodCall:WeakEncryption":
154+
return 327;
155+
156+
case "SpecialMethodCall:WeakHash":
157+
return 328;
158+
159+
case "ci:LDAPInjection":
160+
return 90;
161+
162+
case "pt:PathTraversal":
163+
return 22;
164+
165+
case "cook:UnsecuredCookie":
166+
return 614;
167+
168+
case "ci:SQLInjection":
169+
return 89;
170+
171+
case "tbv:TrustBoundaryViolationSession":
172+
return 501;
173+
174+
case "SpecialMethodCall:java.util.Random":
175+
return 330;
176+
177+
case "ci:XPathInjection":
178+
return 643;
179+
180+
case "xss:XSSFromRequest":
181+
case "xss:XSSFromDb":
182+
return 79;
183+
184+
default:
185+
// Dummy.
186+
return 0;
187+
}
188+
}
189+
190+
}
191+

0 commit comments

Comments
 (0)