This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For 5 | * details, please see https:/owasp.org/www-project-benchmark/. 7 | * 8 | *
The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms 9 | * of the GNU General Public License as published by the Free Software Foundation, version 2. 10 | * 11 | *
The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | /*
21 | * This class contains a single vulnerability category. And is Comparable to other Category instances
22 | * via its 'name' attribute (i.e., the long nname).
23 | */
24 | public class Category implements Comparable This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https:/owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | import javax.xml.bind.annotation.adapters.XmlAdapter;
21 |
22 | public class CategoryAdapter extends XmlAdapter This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https:/owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | import org.eclipse.persistence.oxm.annotations.XmlDiscriminatorValue;
21 |
22 | @XmlDiscriminatorValue("JERSEYWS")
23 | public class JerseyTestCase extends TestCase {
24 | public JerseyTestCase() {}
25 | }
26 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/helpers/ServletTestCase.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https:/owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | import org.eclipse.persistence.oxm.annotations.XmlDiscriminatorValue;
21 |
22 | @XmlDiscriminatorValue("SERVLET")
23 | public class ServletTestCase extends TestCase {
24 | public ServletTestCase() {}
25 | }
26 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/helpers/SpringTestCase.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https:/owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | import org.eclipse.persistence.oxm.annotations.XmlDiscriminatorValue;
21 |
22 | @XmlDiscriminatorValue("SPRINGWS")
23 | public class SpringTestCase extends TestCase {
24 | public SpringTestCase() {}
25 | }
26 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/helpers/TestCaseRequestFileParseException.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https:/owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | public class TestCaseRequestFileParseException extends Exception {
21 |
22 | public TestCaseRequestFileParseException(String message) {
23 | super(message);
24 | }
25 |
26 | public TestCaseRequestFileParseException(String message, Exception e) {
27 | super(message, e);
28 | }
29 | }
30 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/helpers/TestSuite.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https:/owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.helpers;
19 |
20 | import java.util.List;
21 | import javax.xml.bind.annotation.XmlAttribute;
22 | import javax.xml.bind.annotation.XmlElement;
23 | import javax.xml.bind.annotation.XmlRootElement;
24 | import org.owasp.benchmarkutils.tools.AbstractTestCaseRequest;
25 |
26 | @XmlRootElement(name = "benchmarkSuite")
27 | public class TestSuite {
28 | private List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Dave Wichers
16 | * @created 2015
17 | */
18 | package org.owasp.benchmarkutils.score;
19 |
20 | public class CategoryResults {
21 | public final String category;
22 | public final double precision; // TP / TP + FP
23 | public final double truePositiveRate; // AKA Recall
24 | public final double falsePositiveRate;
25 | public final double fscore; // 2 * precision * TPR / ( precision + TPR )
26 | public final int totalTestCases;
27 | public final double score;
28 |
29 | /**
30 | * The overall results for a single vulnerability category for a single tool. F-Score and score
31 | * are automatically calculated for these results when this is created.
32 | *
33 | * @param category - The vulnerability category.
34 | * @param precision - The precision
35 | * @param tpr - The true positive rate
36 | * @param fpr - The false positive rate
37 | * @param totalTestCases - The total number of TP, FP, TN, FN in this category
38 | */
39 | public CategoryResults(
40 | String category, double precision, double tpr, double fpr, int totalTestCases) {
41 | if (Double.isNaN(precision)) {
42 | throw new IllegalArgumentException(
43 | "ERROR: precision for category: " + category + " is NaN");
44 | }
45 | if (Double.isNaN(tpr)) {
46 | throw new IllegalArgumentException(
47 | "ERROR: true positive rate for category: " + category + " is NaN");
48 | }
49 | if (Double.isNaN(fpr)) {
50 | throw new IllegalArgumentException(
51 | "ERROR: false positive rate for category: " + category + " is NaN");
52 | }
53 |
54 | this.category = category;
55 | this.precision = precision;
56 | this.truePositiveRate = tpr;
57 | this.falsePositiveRate = fpr;
58 | double fscore = 2 * precision * tpr / (precision + tpr);
59 | if (Double.isNaN(fscore)) {
60 | this.fscore = 0.0;
61 | } else this.fscore = fscore;
62 | this.totalTestCases = totalTestCases;
63 | this.score = tpr - fpr;
64 | }
65 | }
66 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/TP_FN_TN_FP_Counts.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Dave Wichers
16 | * @created 2015
17 | */
18 | package org.owasp.benchmarkutils.score;
19 |
20 | /**
21 | * This class simply tracks the counts for the true positives, false negatives, true negatives, and
22 | * false positives for a particular tool against the test suite.
23 | */
24 | public class TP_FN_TN_FP_Counts {
25 |
26 | public int tp = 0;
27 | public int fn = 0;
28 | public int tn = 0;
29 | public int fp = 0;
30 |
31 | public TP_FN_TN_FP_Counts() {}
32 |
33 | public TP_FN_TN_FP_Counts(int tp, int fn, int tn, int fp) {
34 | this.tp = tp;
35 | this.fn = fn;
36 | this.tn = tn;
37 | this.fp = fp;
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/domain/TestSuiteName.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.domain;
19 |
20 | public class TestSuiteName {
21 |
22 | private final String name;
23 |
24 | public TestSuiteName(String name) {
25 | this.name = name;
26 | }
27 |
28 | public String simpleName() {
29 | return name;
30 | }
31 |
32 | /**
33 | * If required, provide a more descriptive test suite name than the base, single word test suite
34 | * name.
35 | */
36 | public String fullName() {
37 | if ("Benchmark".equals(name)) {
38 | return "OWASP Benchmark";
39 | }
40 |
41 | return simpleName();
42 | }
43 | }
44 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/NoisyCricketReader.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details
14 | *
15 | * @author Dave Wichers
16 | * @created 2015
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import java.util.List;
21 | import org.owasp.benchmarkutils.score.ResultFile;
22 | import org.owasp.benchmarkutils.score.TestCaseResult;
23 | import org.owasp.benchmarkutils.score.TestSuiteResults;
24 | import org.w3c.dom.Node;
25 |
26 | public class NoisyCricketReader extends Reader {
27 |
28 | @Override
29 | public boolean canRead(ResultFile resultFile) {
30 | return resultFile.filename().endsWith(".xml")
31 | && resultFile.xmlRootNodeName().equals("noisycricket");
32 | }
33 |
34 | @Override
35 | public TestSuiteResults parse(ResultFile resultFile) throws Exception {
36 | TestSuiteResults tr =
37 | new TestSuiteResults("NoisyCricket", false, TestSuiteResults.ToolType.SAST);
38 | tr.setTime("1 minute");
39 | Node meta = getNamedChild("meta", resultFile.xmlRootNode());
40 | tr.setToolVersion(getAttributeValue("version", meta));
41 |
42 | Node vulns = getNamedChild("vulnerabilities", resultFile.xmlRootNode());
43 | List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Julien Delange
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import org.owasp.benchmarkutils.score.ResultFile;
21 |
22 | /**
23 | * This reader is made for the datadog-static-analyzer available on
24 | * ....
25 | * It uses the SARIF file produces by the tool.
26 | */
27 | public class DatadogSastReader extends SarifReader {
28 |
29 | public DatadogSastReader() {
30 | super("datadog-static-analyzer", false, CweSourceType.TAG);
31 | }
32 |
33 | @Override
34 | public String toolName(ResultFile resultFile) {
35 | return "DatadogSast";
36 | }
37 | }
38 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/PTAIReader.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Alexey Zhukov
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import org.owasp.benchmarkutils.score.CweNumber;
21 | import org.owasp.benchmarkutils.score.ResultFile;
22 | import org.owasp.benchmarkutils.score.TestSuiteResults;
23 |
24 | public class PTAIReader extends SarifReader {
25 |
26 | static final int PTAI_CWE_EXTERNAL_FILEPATH_CONTROL = 73;
27 | static final int PTAI_CWE_BLIND_XPATH_INJECTION = 91;
28 |
29 | static final String EXPECTED_TOOL_NAME = "Positive Technologies Application Inspector";
30 | static final String SHORTENED_TOOL_NAME = "PT Application Inspector";
31 |
32 | public PTAIReader() {
33 | super(EXPECTED_TOOL_NAME, true, CweSourceType.FIELD);
34 | }
35 |
36 | @Override
37 | public String toolName(ResultFile resultFile) {
38 | return SHORTENED_TOOL_NAME;
39 | }
40 |
41 | /**
42 | * SARIF report tool version field is too long as it contains build number. Shorten it to X.Y.Z
43 | */
44 | @Override
45 | public void setVersion(ResultFile resultFile, TestSuiteResults testSuiteResults) {
46 | super.setVersion(resultFile, testSuiteResults);
47 | String version = testSuiteResults.getToolVersion();
48 | String[] versionItems = version.split("\\.");
49 | if (versionItems.length < 4) return;
50 | testSuiteResults.setToolVersion(
51 | String.format("%s.%s.%s", versionItems[0], versionItems[1], versionItems[2]));
52 | }
53 |
54 | @Override
55 | public int mapCwe(int cwe) {
56 | switch (cwe) {
57 | case PTAI_CWE_EXTERNAL_FILEPATH_CONTROL:
58 | return CweNumber.PATH_TRAVERSAL;
59 | case PTAI_CWE_BLIND_XPATH_INJECTION:
60 | return CweNumber.XPATH_INJECTION;
61 | }
62 | return cwe;
63 | }
64 | }
65 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/PrecautionReader.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Eric Brown
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | public class PrecautionReader extends SarifReader {
21 |
22 | public PrecautionReader() {
23 | super("Precaution", false, CweSourceType.TAG);
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/SemgrepSarifReader.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import org.owasp.benchmarkutils.score.parsers.SemgrepReader;
21 |
22 | public class SemgrepSarifReader extends SarifReader {
23 |
24 | public SemgrepSarifReader() {
25 | super("Semgrep", false, CweSourceType.TAG);
26 | }
27 |
28 | @Override
29 | public int mapCwe(int cwe) {
30 | return SemgrepReader.translate(cwe);
31 | }
32 | }
33 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/sarif/SnykReader.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details
14 | *
15 | * @author Raj Barath
16 | * @created 2023
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import org.owasp.benchmarkutils.score.CweNumber;
21 |
22 | public class SnykReader extends SarifReader {
23 |
24 | public SnykReader() {
25 | super("SnykCode", true, CweSourceType.FIELD);
26 | }
27 |
28 | @Override
29 | public int mapCwe(int cwe) {
30 | if (cwe == CweNumber.PASSWORD_HASH_WITH_INSUFFICIENT_COMPUTATIONAL_EFFORT) {
31 | return CweNumber.WEAK_HASH_ALGO;
32 | }
33 |
34 | if (cwe == CweNumber.RELATIVE_PATH_TRAVERSAL) {
35 | return CweNumber.PATH_TRAVERSAL;
36 | }
37 |
38 | return super.mapCwe(cwe);
39 | }
40 | }
41 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/report/Formats.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.report;
19 |
20 | import java.text.DecimalFormat;
21 |
22 | public class Formats {
23 |
24 | public static final DecimalFormat twoDecimalPlacesPercentage = new DecimalFormat("#0.00%");
25 |
26 | public static final DecimalFormat singleDecimalPlaceNumber = new DecimalFormat("0.0");
27 | public static final DecimalFormat fourDecimalPlacesNumber = new DecimalFormat("#0.0000");
28 | }
29 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/report/html/ToolBarChartProvider.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.report.html;
19 |
20 | import org.owasp.benchmarkutils.score.Tool;
21 |
22 | public interface ToolBarChartProvider {
23 |
24 | void generateComparisonCharts(Tool tool);
25 | }
26 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/score/report/html/ToolReportProvider.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.report.html;
19 |
20 | import java.io.File;
21 | import java.io.IOException;
22 | import org.owasp.benchmarkutils.score.Tool;
23 |
24 | public interface ToolReportProvider {
25 |
26 | String generateHtml(Tool currentTool, String title, File scorecardImageFile) throws IOException;
27 | }
28 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/tools/Logger.java:
--------------------------------------------------------------------------------
1 | package org.owasp.benchmarkutils.tools;
2 |
3 | public interface Logger {
4 |
5 | void print(String message);
6 |
7 | void println(String message);
8 |
9 | void println();
10 |
11 | void printf(String format, Object... args);
12 | }
13 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/tools/LoggerConfigurationException.java:
--------------------------------------------------------------------------------
1 | package org.owasp.benchmarkutils.tools;
2 |
3 | public class LoggerConfigurationException extends Exception {
4 |
5 | public LoggerConfigurationException(String message) {
6 | super(message);
7 | }
8 | }
9 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/tools/ResponseInfo.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Dave Wichers
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.tools;
19 |
20 | import org.apache.hc.client5.http.classic.methods.HttpUriRequest;
21 |
22 | class ResponseInfo {
23 | private String responseString;
24 | private int seconds;
25 | private int statusCode;
26 | private HttpUriRequest requestBase;
27 |
28 | public String getResponseString() {
29 | return responseString;
30 | }
31 |
32 | public void setResponseString(String responseString) {
33 | this.responseString = responseString;
34 | }
35 |
36 | public int getTimeInSeconds() {
37 | return seconds;
38 | }
39 |
40 | public void setTimeInSeconds(int seconds) {
41 | this.seconds = seconds;
42 | }
43 |
44 | public int getStatusCode() {
45 | return statusCode;
46 | }
47 |
48 | public void setStatusCode(int statusCode) {
49 | this.statusCode = statusCode;
50 | }
51 |
52 | public HttpUriRequest getRequestBase() {
53 | return requestBase;
54 | }
55 |
56 | public void setRequestBase(HttpUriRequest request) {
57 | this.requestBase = request;
58 | }
59 | }
60 |
--------------------------------------------------------------------------------
/plugin/src/main/java/org/owasp/benchmarkutils/tools/SimpleFileLogger.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author David Anderson
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.tools;
19 |
20 | import java.io.Closeable;
21 | import java.io.File;
22 | import java.io.FileNotFoundException;
23 | import java.io.FileOutputStream;
24 | import java.io.PrintStream;
25 | import java.util.Properties;
26 | import java.util.concurrent.ConcurrentHashMap;
27 | import java.util.concurrent.ConcurrentMap;
28 |
29 | public class SimpleFileLogger implements Closeable, Logger {
30 | private static final ConcurrentMap This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score;
19 |
20 | import java.io.IOException;
21 | import java.io.InputStream;
22 | import java.nio.charset.Charset;
23 | import java.util.Objects;
24 | import org.apache.commons.io.IOUtils;
25 |
26 | public class TestHelper {
27 |
28 | public static ResultFile resultFileOf(String filename) {
29 | try {
30 | return new ResultFile(filename, contentOf(filename));
31 | } catch (IOException e) {
32 | throw new RuntimeException(e);
33 | }
34 | }
35 |
36 | public static byte[] contentOf(String filename) {
37 | try {
38 | return IOUtils.toByteArray(asStream(filename));
39 | } catch (IOException e) {
40 | throw new RuntimeException(e);
41 | }
42 | }
43 |
44 | public static ResultFile resultFileWithoutLineBreaksOf(String filename) {
45 | try {
46 | return new ResultFile(filename, contentWithoutLineBreaksOf(filename));
47 | } catch (IOException e) {
48 | throw new RuntimeException(e);
49 | }
50 | }
51 |
52 | public static String contentWithoutLineBreaksOf(String filename) {
53 | try {
54 | return IOUtils.toString(asStream(filename), Charset.defaultCharset())
55 | .replace('\n', ' ');
56 | } catch (IOException e) {
57 | throw new RuntimeException(e);
58 | }
59 | }
60 |
61 | private static InputStream asStream(String filename) {
62 | InputStream stream = TestHelper.class.getClassLoader().getResourceAsStream(filename);
63 | if (stream == null) {
64 | System.out.println("TEST ERROR: Test file: " + filename + " does not exist");
65 | }
66 | return Objects.requireNonNull(stream);
67 | }
68 | }
69 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/builder/TestSuiteResultsBuilder.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.builder;
19 |
20 | import org.owasp.benchmarkutils.score.TestSuiteResults;
21 |
22 | public class TestSuiteResultsBuilder {
23 |
24 | private String toolname = "Super Tool";
25 | private boolean isCommercial = false;
26 | private TestSuiteResults.ToolType toolType = TestSuiteResults.ToolType.SAST;
27 | private String version = "47.11";
28 | private String testSuiteVersion = "1.2";
29 |
30 | private TestSuiteResultsBuilder() {}
31 |
32 | public static TestSuiteResultsBuilder builder() {
33 | return new TestSuiteResultsBuilder();
34 | }
35 |
36 | public TestSuiteResultsBuilder setToolname(String toolname) {
37 | this.toolname = toolname;
38 |
39 | return this;
40 | }
41 |
42 | public TestSuiteResultsBuilder setIsCommercial(boolean isCommercial) {
43 | this.isCommercial = isCommercial;
44 |
45 | return this;
46 | }
47 |
48 | public TestSuiteResultsBuilder setToolType(TestSuiteResults.ToolType toolType) {
49 | this.toolType = toolType;
50 |
51 | return this;
52 | }
53 |
54 | public TestSuiteResultsBuilder setToolVersion(String version) {
55 | this.version = version;
56 |
57 | return this;
58 | }
59 |
60 | public TestSuiteResults build() {
61 | TestSuiteResults testSuiteResults = new TestSuiteResults(toolname, isCommercial, toolType);
62 |
63 | testSuiteResults.setToolVersion(version);
64 | testSuiteResults.setTestSuiteVersion(testSuiteVersion);
65 |
66 | return testSuiteResults;
67 | }
68 |
69 | public TestSuiteResultsBuilder setTestSuiteVersion(String testSuiteVersion) {
70 | this.testSuiteVersion = testSuiteVersion;
71 |
72 | return this;
73 | }
74 | }
75 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/builder/ToolBuilder.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.builder;
19 |
20 | import java.util.HashMap;
21 | import java.util.Map;
22 | import org.owasp.benchmarkutils.score.TP_FN_TN_FP_Counts;
23 | import org.owasp.benchmarkutils.score.TestSuiteResults;
24 | import org.owasp.benchmarkutils.score.Tool;
25 | import org.owasp.benchmarkutils.score.ToolResults;
26 |
27 | public class ToolBuilder {
28 |
29 | private TestSuiteResults testSuiteResults = TestSuiteResultsBuilder.builder().build();
30 | private Map This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.domain;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 |
22 | import org.junit.jupiter.api.Test;
23 |
24 | class TestSuiteNameTest {
25 |
26 | @Test
27 | void returnsSimpleName() {
28 | assertEquals("SimpleName", new TestSuiteName("SimpleName").simpleName());
29 | assertEquals("Benchmark", new TestSuiteName("Benchmark").simpleName());
30 | }
31 |
32 | @Test
33 | void returnsFixedFullNameForBenchmark() {
34 | assertEquals("OWASP Benchmark", new TestSuiteName("Benchmark").fullName());
35 | }
36 |
37 | @Test
38 | void returnsSimpleNameForFullNameWhenNotBenchmark() {
39 | assertEquals("SimpleName", new TestSuiteName("SimpleName").fullName());
40 | }
41 | }
42 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/ArachniReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class ArachniReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Arachni-v2.0dev.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyArachniReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, ArachniReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | ArachniReader reader = new ArachniReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("Arachni", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/BearerReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Cédric Fabianski
16 | * @created 2023
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class BearerReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFileV1_30;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFileV1_30 = TestHelper.resultFileOf("testfiles/Benchmark_Bearer-v1.30.0.jsonv2");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyBearerReaderReportsCanReadAsTrueForV1_30() {
43 | assertOnlyMatcherClassIs(this.resultFileV1_30, BearerReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFileInV1_30() throws Exception {
48 | BearerReader reader = new BearerReader();
49 | TestSuiteResults result = reader.parse(resultFileV1_30);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("Bearer", result.getToolName());
54 | assertEquals("v1.30.0", result.getToolVersion());
55 |
56 | assertEquals(3, result.getTotalResults());
57 |
58 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(7).get(0).getCWE());
59 | assertEquals(CweNumber.WEAK_HASH_ALGO, result.get(5).get(0).getCWE());
60 | assertEquals(CweNumber.WEAK_CRYPTO_ALGO, result.get(35).get(0).getCWE());
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/BlackDuckReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2025
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class BlackDuckReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark-BlackDuck.json");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyBlackDuckReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, BlackDuckReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | BlackDuckReader reader = new BlackDuckReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("BlackDuck", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/BurpReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class BurpReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_BurpPro-v2020.2.1.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyBurpReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, BurpReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | BurpReader reader = new BurpReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Burp Suite Pro", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/CASTAIPReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class CASTAIPReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_CAST_AIP-v8.2.3.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyCASTAIPReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, CASTAIPReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | CASTAIPReader reader = new CASTAIPReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("CAST AIP", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/CheckmarxIASTReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class CheckmarxIASTReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_CxIAST.csv");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyCheckmarxIASTReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, CheckmarxIASTReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | CheckmarxIASTReader reader = new CheckmarxIASTReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.IAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("CxIAST", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/CheckmarxReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class CheckmarxReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Checkmarx-v8.2.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyCheckmarxReaderTestReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, CheckmarxReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | CheckmarxReader reader = new CheckmarxReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Checkmarx CxSAST", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/DatadogReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Ander Ruiz
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class DatadogReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_1.2-Datadog.log");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyDatadogReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, DatadogReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | DatadogReader reader = new DatadogReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.IAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Datadog", result.getToolName());
54 | assertEquals("0.108.0", result.getToolVersion());
55 |
56 | assertEquals(4, result.getTotalResults());
57 |
58 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1609).get(0).getCWE());
59 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(2).get(0).getCWE());
60 | assertEquals(CweNumber.WEAK_HASH_ALGO, result.get(1).get(0).getCWE());
61 | assertEquals(CweNumber.TRUST_BOUNDARY_VIOLATION, result.get(4).get(0).getCWE());
62 | }
63 | }
64 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/FluidAttacksReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2023
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class FluidAttacksReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Fluid-Attacks-v20210416.csv");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyFluidReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, FluidAttacksReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | FluidAttacksReader reader = new FluidAttacksReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Fluid Attacks", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/FortifyReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class FortifyReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Fortify20.20_2020Q1-1234.fpr");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyFortifyReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, FortifyReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | FortifyReader reader = new FortifyReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Fortify", result.getToolName());
54 | assertEquals("0:20:34", result.getTime());
55 |
56 | assertEquals(2, result.getTotalResults());
57 |
58 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
59 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/HCLAppScanIASTReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class HCLAppScanIASTReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_HCL-IAST.hcl");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyHCLReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, HCLAppScanIASTReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | HCLAppScanIASTReader reader = new HCLAppScanIASTReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.IAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("HCL AppScan IAST", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/HCLAppScanSourceReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2023
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class HCLAppScanSourceReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_HCLAppScanSource-2.4.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyHCLAppScanSourceReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, HCLAppScanSourceReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | HCLAppScanSourceReader reader = new HCLAppScanSourceReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("HCL AppScan Cloud", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/HCLAppScanStandardReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class HCLAppScanStandardReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile =
38 | TestHelper.resultFileOf("testfiles/Benchmark_HCLAppScanStandardReader-v10.0.6.xml");
39 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
40 | }
41 |
42 | @Test
43 | public void onlyHCLAppScanStandardReaderReportsCanReadAsTrue() {
44 | assertOnlyMatcherClassIs(this.resultFile, HCLAppScanStandardReader.class);
45 | }
46 |
47 | @Test
48 | void readerHandlesGivenV10ResultFile() throws Exception {
49 | HCLAppScanStandardReader reader = new HCLAppScanStandardReader();
50 | TestSuiteResults result = reader.parse(resultFile);
51 |
52 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
53 | assertTrue(result.isCommercial());
54 | assertEquals("HCL AppScan Standard", result.getToolName());
55 | assertEquals("10.0.6", result.getToolVersion());
56 |
57 | assertEquals(4, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
60 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
61 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(300).get(0).getCWE());
62 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(348).get(0).getCWE());
63 | }
64 | }
65 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/HorusecReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class HorusecReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_horusec-v2.5.0.json");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyHorusecReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, HorusecReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | HorusecReader reader = new HorusecReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("Horusec", result.getToolName());
54 | assertEquals("1:23:45", result.getTime());
55 | assertEquals("v2.5.0", result.getToolVersion());
56 |
57 | assertEquals(2, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
60 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/InsiderReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class InsiderReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_insider-v3.0.0.json");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyInsiderReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, InsiderReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | InsiderReader reader = new InsiderReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("Insider", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.WEAK_CRYPTO_ALGO, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/JuliaReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class JuliaReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_JuliaSoft-v2.3.2.1.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyJuliaReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, JuliaReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | JuliaReader reader = new JuliaReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Julia", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.WEAK_CRYPTO_ALGO, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/KiuwanReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class KiuwanReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Kiuwan-20191012.threadfix");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyKiuwanReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, KiuwanReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | KiuwanReader reader = new KiuwanReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Kiuwan", result.getToolName());
54 | assertEquals("some.version", result.getToolVersion());
55 | assertEquals("01:23:45", result.getTime());
56 |
57 | assertEquals(2, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
60 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/KlocworkCSVReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Dave Wichers
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class KlocworkCSVReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Klocwork.csv");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyKlocworkCSVReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, KlocworkCSVReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | KlocworkCSVReader reader = new KlocworkCSVReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Klocwork", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/MendReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class MendReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Mend.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyMendReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, MendReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | MendReader reader = new MendReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Mend", result.getToolName());
54 | assertEquals("01:23:45", result.getTime());
55 |
56 | assertEquals(2, result.getTotalResults());
57 |
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
59 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(2).get(0).getCWE());
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/NetsparkerReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class NetsparkerReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Netsparker.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyNetsparkerReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, NetsparkerReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | NetsparkerReader reader = new NetsparkerReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Netsparker", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.COOKIE_WITHOUT_HTTPONLY, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/ParasoftReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class ParasoftReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_ParasoftJTest-v10.2.3.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyParasoftReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, ParasoftReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | ParasoftReader reader = new ParasoftReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Parasoft Jtest", result.getToolName());
54 | assertEquals("0:12:34", result.getTime());
55 |
56 | assertEquals(2, result.getTotalResults());
57 |
58 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
59 | assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/Rapid7ReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class Rapid7ReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_AppSpider-v7.2.119-1234.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyZapReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, Rapid7Reader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | Rapid7Reader reader = new Rapid7Reader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Rapid7 AppSpider", result.getToolName());
54 | assertEquals("7.2.119.1", result.getToolVersion());
55 | assertEquals("0:12:34", result.getTime());
56 |
57 | assertEquals(2, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
60 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(2).get(0).getCWE());
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/ReaderTestBase.java:
--------------------------------------------------------------------------------
1 | package org.owasp.benchmarkutils.score.parsers;
2 |
3 | import static java.util.Collections.singletonList;
4 | import static org.junit.jupiter.api.Assertions.assertEquals;
5 | import static org.junit.jupiter.api.Assertions.assertTrue;
6 |
7 | import java.util.List;
8 | import java.util.stream.Collectors;
9 | import org.junit.jupiter.api.Test;
10 | import org.owasp.benchmarkutils.score.ResultFile;
11 |
12 | public abstract class ReaderTestBase {
13 |
14 | // This list is used in the next test
15 | private static final List This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class SeekerReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Seeker.csv");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlySeekerReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, SeekerReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | SeekerReader reader = new SeekerReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.IAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("Seeker", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.TRUST_BOUNDARY_VIOLATION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/ShiftLeftScanReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class ShiftLeftScanReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_shiftleftscan-v2.0.3.json");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyShiftLeftScanReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, ShiftLeftScanReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | ShiftLeftScanReader reader = new ShiftLeftScanReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("ShiftLeft Scan", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.COOKIE_WITHOUT_HTTPONLY, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/SonarQubeReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class SonarQubeReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile pluginResultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | pluginResultFile =
38 | TestHelper.resultFileOf("testfiles/Benchmark_sonar-Java-Plugin-v3.14-1234.xml");
39 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
40 | }
41 |
42 | @Test
43 | public void onlySonarQubeReaderReportsCanReadAsTrueForPluginResultFile() {
44 | assertOnlyMatcherClassIs(this.pluginResultFile, SonarQubeReader.class);
45 | }
46 |
47 | @Test
48 | void readerHandlesGivenPluginResultFile() throws Exception {
49 | SonarQubeReader reader = new SonarQubeReader();
50 | TestSuiteResults result = reader.parse(pluginResultFile);
51 |
52 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
53 | assertFalse(result.isCommercial());
54 | assertEquals("SonarQube Java Plugin", result.getToolName());
55 | assertEquals("0:20:34", result.getTime());
56 |
57 | assertEquals(2, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
60 | assertEquals(CweNumber.WEAK_RANDOM, result.get(2).get(0).getCWE());
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/ThunderScanReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class ThunderScanReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_ThunderScan.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyZapReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, ThunderScanReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | ThunderScanReader reader = new ThunderScanReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertTrue(result.isCommercial());
53 | assertEquals("ThunderScan", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.XPATH_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/VeracodeReaderTest.java:
--------------------------------------------------------------------------------
1 | package org.owasp.benchmarkutils.score.parsers;
2 |
3 | import org.junit.jupiter.api.BeforeEach;
4 | import org.junit.jupiter.api.Test;
5 | import org.owasp.benchmarkutils.score.*;
6 |
7 | import static org.junit.jupiter.api.Assertions.assertEquals;
8 | import static org.junit.jupiter.api.Assertions.assertTrue;
9 |
10 | class VeracodeReaderTest extends ReaderTestBase {
11 |
12 | private ResultFile resultFile;
13 |
14 | @BeforeEach
15 | void setUp() {
16 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Veracode.xml");
17 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
18 | }
19 |
20 | @Test
21 | void onlyVeracodeReportCanReadAsTrue() {
22 | assertOnlyMatcherClassIs(this.resultFile, VeracodeReader.class);
23 | }
24 |
25 | @Test
26 | void readerHandlesGivenResultFile() throws Exception {
27 | VeracodeReader reader = new VeracodeReader();
28 | TestSuiteResults result = reader.parse(resultFile);
29 |
30 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
31 | assertTrue(result.isCommercial());
32 | assertEquals("Veracode SAST", result.getToolName());
33 |
34 | assertEquals(3, result.getTotalResults());
35 |
36 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(7).get(0).getCWE());
37 | assertEquals(CweNumber.SQL_INJECTION, result.get(8).get(0).getCWE());
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/VisualCodeGrepperReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class VisualCodeGrepperReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_visualcodegrepper-v2.2.0.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyFindbugsReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, VisualCodeGrepperReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | VisualCodeGrepperReader reader = new VisualCodeGrepperReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("VisualCodeGrepper", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/W3AFReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class W3AFReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_w3af-v1.7.6.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyW3AFReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, W3AFReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | W3AFReader reader = new W3AFReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("W3AF", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/WapitiJsonReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class WapitiJsonReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Wapiti-v3.0.5.json");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyWapitiJsonReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, WapitiJsonReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | WapitiJsonReader reader = new WapitiJsonReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("Wapiti", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/WapitiReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class WapitiReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Wapiti-v3.0.3.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyWapitiReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, WapitiReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | WapitiReader reader = new WapitiReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("Wapiti", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.SQL_INJECTION, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/ZapReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2021
17 | */
18 | package org.owasp.benchmarkutils.score.parsers;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 |
31 | public class ZapReaderTest extends ReaderTestBase {
32 |
33 | private ResultFile resultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_ZAP_WEEKLY.xml");
38 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
39 | }
40 |
41 | @Test
42 | public void onlyZapReaderReportsCanReadAsTrue() {
43 | assertOnlyMatcherClassIs(this.resultFile, ZapReader.class);
44 | }
45 |
46 | @Test
47 | void readerHandlesGivenResultFile() throws Exception {
48 | ZapReader reader = new ZapReader();
49 | TestSuiteResults result = reader.parse(resultFile);
50 |
51 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
52 | assertFalse(result.isCommercial());
53 | assertEquals("OWASP ZAP", result.getToolName());
54 |
55 | assertEquals(2, result.getTotalResults());
56 |
57 | assertEquals(CweNumber.XSS, result.get(1).get(0).getCWE());
58 | assertEquals(CweNumber.SQL_INJECTION, result.get(2).get(0).getCWE());
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/csv/WhiteHatDynamicReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.csv;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 | import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
31 |
32 | public class WhiteHatDynamicReaderTest extends ReaderTestBase {
33 |
34 | private ResultFile resultFile;
35 |
36 | @BeforeEach
37 | void setUp() {
38 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_WhiteHat.csv");
39 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
40 | }
41 |
42 | @Test
43 | public void onlyWhiteHatDynamicReaderReportsCanReadAsTrue() {
44 | assertOnlyMatcherClassIs(this.resultFile, WhiteHatDynamicReader.class);
45 | }
46 |
47 | @Test
48 | void readerHandlesGivenResultFile() throws Exception {
49 | WhiteHatDynamicReader reader = new WhiteHatDynamicReader();
50 | TestSuiteResults result = reader.parse(resultFile);
51 |
52 | assertEquals(TestSuiteResults.ToolType.DAST, result.getToolType());
53 | assertTrue(result.isCommercial());
54 | assertEquals("WhiteHat Dynamic", result.getToolName());
55 |
56 | assertEquals(2, result.getTotalResults());
57 |
58 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
59 | assertEquals(CweNumber.XSS, result.get(2).get(0).getCWE());
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/ContrastScanReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2022
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertNull;
22 | import static org.junit.jupiter.api.Assertions.assertTrue;
23 |
24 | import org.junit.jupiter.api.BeforeEach;
25 | import org.junit.jupiter.api.Test;
26 | import org.owasp.benchmarkutils.score.BenchmarkScore;
27 | import org.owasp.benchmarkutils.score.CweNumber;
28 | import org.owasp.benchmarkutils.score.ResultFile;
29 | import org.owasp.benchmarkutils.score.TestHelper;
30 | import org.owasp.benchmarkutils.score.TestSuiteResults;
31 | import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
32 |
33 | public class ContrastScanReaderTest extends ReaderTestBase {
34 |
35 | private ResultFile resultFile;
36 |
37 | @BeforeEach
38 | void setUp() {
39 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Contrast_3.9.0.sarif.json");
40 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
41 | }
42 |
43 | @Test
44 | public void onlyContrastJsonReaderReportsCanReadAsTrue() {
45 | assertOnlyMatcherClassIs(this.resultFile, ContrastScanReader.class);
46 | }
47 |
48 | @Test
49 | void readerHandlesGivenResultFile() throws Exception {
50 | ContrastScanReader reader = new ContrastScanReader();
51 | TestSuiteResults result = reader.parse(resultFile);
52 |
53 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
54 | assertTrue(result.isCommercial());
55 | assertEquals("Contrast Scan", result.getToolName());
56 | assertNull(result.getToolVersion());
57 | assertEquals("22:22:22", result.getTime());
58 |
59 | assertEquals(2, result.getTotalResults());
60 |
61 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(1).get(0).getCWE());
62 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(2).get(0).getCWE());
63 | }
64 | }
65 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/DatadogSastReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Julien Delange
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 | import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
31 |
32 | public class DatadogSastReaderTest extends ReaderTestBase {
33 |
34 | private ResultFile resultFile;
35 |
36 | @BeforeEach
37 | void setUp() {
38 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_DatadogSast.sarif");
39 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
40 | }
41 |
42 | @Test
43 | public void canReadFile() {
44 | assertOnlyMatcherClassIs(this.resultFile, DatadogSastReader.class);
45 | }
46 |
47 | @Test
48 | void readerHandlesGivenResultFile() throws Exception {
49 | DatadogSastReader reader = new DatadogSastReader();
50 | TestSuiteResults result = reader.parse(resultFile);
51 |
52 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
53 | assertEquals("DatadogSast", result.getToolName());
54 | assertEquals("0.2.9", result.getToolVersion());
55 | assertFalse(result.isCommercial());
56 |
57 | assertEquals(1, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(10).get(0).getCWE());
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/PTAIReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Alexey Zhukov
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 |
22 | import org.junit.jupiter.api.BeforeEach;
23 | import org.junit.jupiter.api.Test;
24 | import org.owasp.benchmarkutils.score.*;
25 | import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
26 |
27 | public class PTAIReaderTest extends ReaderTestBase {
28 |
29 | private ResultFile resultFile;
30 |
31 | @BeforeEach
32 | void setUp() {
33 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_PTAI-v4.7.2.sarif");
34 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
35 | }
36 |
37 | @Test
38 | public void onlyPTAIReaderTestReportsCanReadAsTrue() {
39 | assertOnlyMatcherClassIs(this.resultFile, PTAIReader.class);
40 | }
41 |
42 | @Test
43 | void readerHandlesGivenResultFile() throws Exception {
44 | PTAIReader reader = new PTAIReader();
45 | TestSuiteResults result = reader.parse(resultFile);
46 |
47 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
48 |
49 | assertEquals("PT Application Inspector", result.getToolName());
50 | assertEquals("4.7.2", result.getToolVersion());
51 |
52 | assertEquals(2, result.getTotalResults());
53 |
54 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
55 | assertEquals(CweNumber.SQL_INJECTION, result.get(8).get(0).getCWE());
56 | }
57 | }
58 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/PrecautionReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Eric Brown
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertFalse;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 | import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
31 | import org.owasp.benchmarkutils.score.parsers.sarif.PrecautionReader;
32 |
33 | class PrecautionReaderTest extends ReaderTestBase {
34 |
35 | private ResultFile resultFile;
36 |
37 | @BeforeEach
38 | void setUp() {
39 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_Precaution.sarif");
40 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
41 | }
42 |
43 | @Test
44 | public void onlyPrecautionReportsCanReadAsTrue() {
45 | assertOnlyMatcherClassIs(this.resultFile, PrecautionReader.class);
46 | }
47 |
48 | @Test
49 | void readerHandlesGivenResultFile() throws Exception {
50 | PrecautionReader reader = new PrecautionReader();
51 | TestSuiteResults result = reader.parse(resultFile);
52 |
53 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
54 | assertFalse(result.isCommercial());
55 | assertEquals("Precaution", result.getToolName());
56 | assertEquals("0.5.0", result.getToolVersion());
57 |
58 | assertEquals(1, result.getTotalResults());
59 | assertEquals(CweNumber.WEAK_HASH_ALGO, result.get(73).get(0).getCWE());
60 | }
61 | }
62 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/SarifReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 |
22 | import org.junit.jupiter.params.ParameterizedTest;
23 | import org.junit.jupiter.params.provider.ValueSource;
24 | import org.owasp.benchmarkutils.score.parsers.sarif.SarifReader;
25 |
26 | public class SarifReaderTest {
27 |
28 | @ParameterizedTest(name = "{index} - extracts cwe number from input {0}")
29 | @ValueSource(
30 | strings = {
31 | "CWE-326",
32 | "CWE-326: Inadequate Encryption Strength",
33 | "external/cwe/cwe-326",
34 | "CWE:326"
35 | })
36 | void extractsCweNumberFromInput(String input) {
37 | assertEquals(326, SarifReader.extractCwe(input));
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/parsers/sarif/SnykReaderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details
14 | *
15 | * @author Raj Barath
16 | * @created 2023
17 | */
18 | package org.owasp.benchmarkutils.score.parsers.sarif;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertTrue;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.BenchmarkScore;
26 | import org.owasp.benchmarkutils.score.CweNumber;
27 | import org.owasp.benchmarkutils.score.ResultFile;
28 | import org.owasp.benchmarkutils.score.TestHelper;
29 | import org.owasp.benchmarkutils.score.TestSuiteResults;
30 | import org.owasp.benchmarkutils.score.parsers.ReaderTestBase;
31 |
32 | class SnykReaderTest extends ReaderTestBase {
33 |
34 | private ResultFile resultFile;
35 |
36 | @BeforeEach
37 | void setUp() {
38 | resultFile = TestHelper.resultFileOf("testfiles/Benchmark_SnykCodeCli.sarif");
39 | BenchmarkScore.TESTCASENAME = "BenchmarkTest";
40 | }
41 |
42 | @Test
43 | void onlySnykReaderReportsCanReadAsTrue() {
44 | assertOnlyMatcherClassIs(this.resultFile, SnykReader.class);
45 | }
46 |
47 | @Test
48 | void readerHandlesGivenResultFile() throws Exception {
49 | SnykReader reader = new SnykReader();
50 | TestSuiteResults result = reader.parse(resultFile);
51 |
52 | assertEquals(TestSuiteResults.ToolType.SAST, result.getToolType());
53 | assertTrue(result.isCommercial());
54 | assertEquals("SnykCode", result.getToolName());
55 | assertEquals("1.0.0", result.getToolVersion());
56 |
57 | assertEquals(2, result.getTotalResults());
58 |
59 | assertEquals(CweNumber.INSECURE_COOKIE, result.get(1).get(0).getCWE());
60 | assertEquals(CweNumber.XPATH_INJECTION, result.get(2).get(0).getCWE());
61 | }
62 |
63 | @Test
64 | void readerMapsCwes() {
65 | SnykReader reader = new SnykReader();
66 | assertEquals(
67 | CweNumber.WEAK_HASH_ALGO,
68 | reader.mapCwe(CweNumber.PASSWORD_HASH_WITH_INSUFFICIENT_COMPUTATIONAL_EFFORT));
69 | assertEquals(CweNumber.PATH_TRAVERSAL, reader.mapCwe(CweNumber.RELATIVE_PATH_TRAVERSAL));
70 | }
71 | }
72 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/report/FormatsTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details.
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.report;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.owasp.benchmarkutils.score.report.Formats.fourDecimalPlacesNumber;
22 | import static org.owasp.benchmarkutils.score.report.Formats.singleDecimalPlaceNumber;
23 | import static org.owasp.benchmarkutils.score.report.Formats.twoDecimalPlacesPercentage;
24 |
25 | import org.junit.jupiter.api.Test;
26 |
27 | class FormatsTest {
28 |
29 | @Test
30 | void hasFormatterForTwoDecimalPlacesPercentage() {
31 | assertEquals("1234.57%", twoDecimalPlacesPercentage.format(12.345678));
32 | }
33 |
34 | @Test
35 | void hasFormatterForFourDecimalPlaces() {
36 | assertEquals("12.3457", fourDecimalPlacesNumber.format(12.345678));
37 | }
38 |
39 | @Test
40 | void hasFormatterForSingleDecimalPlace() {
41 | assertEquals("12.3", singleDecimalPlaceNumber.format(12.345678));
42 | }
43 | }
44 |
--------------------------------------------------------------------------------
/plugin/src/test/java/org/owasp/benchmarkutils/score/service/ExpectedResultsProviderTest.java:
--------------------------------------------------------------------------------
1 | /**
2 | * OWASP Benchmark Project
3 | *
4 | * This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For
5 | * details, please see https://owasp.org/www-project-benchmark/.
7 | *
8 | * The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
9 | * of the GNU General Public License as published by the Free Software Foundation, version 2.
10 | *
11 | * The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY
12 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
13 | * PURPOSE. See the GNU General Public License for more details
14 | *
15 | * @author Sascha Knoop
16 | * @created 2024
17 | */
18 | package org.owasp.benchmarkutils.score.service;
19 |
20 | import static org.junit.jupiter.api.Assertions.assertEquals;
21 | import static org.junit.jupiter.api.Assertions.assertNull;
22 |
23 | import org.junit.jupiter.api.BeforeEach;
24 | import org.junit.jupiter.api.Test;
25 | import org.owasp.benchmarkutils.score.CweNumber;
26 | import org.owasp.benchmarkutils.score.ResultFile;
27 | import org.owasp.benchmarkutils.score.TestHelper;
28 | import org.owasp.benchmarkutils.score.TestSuiteResults;
29 |
30 | class ExpectedResultsProviderTest {
31 |
32 | private ResultFile simpleResultFile;
33 | private ResultFile extendedResultFile;
34 |
35 | @BeforeEach
36 | void setUp() {
37 | simpleResultFile = TestHelper.resultFileOf("expectedresults-1.2-simple.csv");
38 | extendedResultFile = TestHelper.resultFileOf("expectedresults-1.2-extended.csv");
39 | }
40 |
41 | @Test
42 | void providerHandlesGivenSimpleResultFile() throws Exception {
43 | TestSuiteResults result = ExpectedResultsProvider.parse(simpleResultFile);
44 |
45 | assertNull(result.getToolType());
46 | assertEquals("Expected", result.getToolName());
47 |
48 | assertEquals(2, result.getTotalResults());
49 |
50 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
51 | assertNull(result.get(1).get(0).getSource());
52 |
53 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(2).get(0).getCWE());
54 | assertNull(result.get(2).get(0).getSource());
55 | }
56 |
57 | @Test
58 | void providerHandlesGivenExtendedResultFile() throws Exception {
59 | TestSuiteResults result = ExpectedResultsProvider.parse(extendedResultFile);
60 |
61 | assertNull(result.getToolType());
62 | assertEquals("Expected", result.getToolName());
63 |
64 | assertEquals(2, result.getTotalResults());
65 |
66 | assertEquals(CweNumber.PATH_TRAVERSAL, result.get(1).get(0).getCWE());
67 | assertEquals("RequestGetCookies.code", result.get(1).get(0).getSource());
68 |
69 | assertEquals(CweNumber.COMMAND_INJECTION, result.get(2).get(0).getCWE());
70 | assertEquals("RequestGetHeader.code", result.get(2).get(0).getSource());
71 | }
72 | }
73 |
--------------------------------------------------------------------------------
/plugin/src/test/resources/expectedresults-1.2-extended.csv:
--------------------------------------------------------------------------------
1 | # test name, category, real vulnerability, cwe, template, source, vuln src, data flow, vuln df, sink, vuln sink, UI Template, Benchmark version: 1.2, 2024-05-1
2 | BenchmarkTest00001,pathtraver,true,22,"_NoDataflowTemplate.code","RequestGetCookies.code",true,none,true,"FileInputStream-F.code",true,"UI_HTML_post_getCookies.code"
3 | BenchmarkTest00002,cmdi,true,78,"_NoDataflowTemplate.code","RequestGetHeader.code",true,none,true,"ProcessBuilderCommand-L.code",true,"UI_HTML_post_getHeader.code"
4 |
--------------------------------------------------------------------------------
/plugin/src/test/resources/expectedresults-1.2-simple.csv:
--------------------------------------------------------------------------------
1 | # test name, category, real vulnerability, cwe, Benchmark version: 1.2, 2016-06-1
2 | BenchmarkTest00001,pathtraver,true,22
3 | BenchmarkTest00002,cmdi,true,78
4 |
--------------------------------------------------------------------------------
/plugin/src/test/resources/report-html-config.yml:
--------------------------------------------------------------------------------
1 | # config file to test html report related things
2 | includeprojectlink: true
3 | includeprecision: true
4 |
5 | report:
6 | html:
7 | projectLinkEntry: |
8 |
9 | projectLinkEntry
10 |
13 | precisionKeyEntry
14 |
17 | fsCoreEntry
18 |