dradis-veracode 4.14.0 → 4.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 6f041e0a2687a67c6bf0dbbd427a1e4b9c8ab8997f0630ee36c9d388f081b772
|
|
4
|
+
data.tar.gz: c7f4f7096c0d207be9a73a600dd0e7323661cd27bfe6f7d50cfe2ce207128539
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: d5a4e6b6d59f4c13d253e6a3445ece2aab1eccda0251b761a2fd848f1ba033b7c242e07c03267d317e70093050649a0e4a64016bb77101e4e99d4ebf26dd9a76
|
|
7
|
+
data.tar.gz: 4605c3881c89a79ec5364f3532b016d30cba27ca6546d84a4cfa33d37bb553335d84c79982cfccc87c631f0e71e2a1e4722f302cd5b73d30c346f6885289d344
|
data/CHANGELOG.md
CHANGED
|
@@ -35,7 +35,7 @@ describe Dradis::Plugins::Veracode::Importer do
|
|
|
35
35
|
end
|
|
36
36
|
|
|
37
37
|
it 'creates nodes, issues, and, evidence' do
|
|
38
|
-
expect(@content_service).to receive(:create_node).with(hash_including label: '
|
|
38
|
+
expect(@content_service).to receive(:create_node).with(hash_including label: 'Example-App').once
|
|
39
39
|
|
|
40
40
|
%w{ 117 382 CVE-2022-41404 CVE-2022-36033 SRCCLR-SID-22742 CVE-2022-42889 }.each do |cweid|
|
|
41
41
|
expect(@content_service).to receive(:create_issue).with(hash_including id: cweid).at_least(:once)
|
|
@@ -44,6 +44,6 @@ describe Dradis::Plugins::Veracode::Importer do
|
|
|
44
44
|
expect(@content_service).to receive(:create_evidence).with(hash_including(content: '')).at_least(7).times
|
|
45
45
|
|
|
46
46
|
# Run the import
|
|
47
|
-
@importer.import(file: 'spec/fixtures/files/veracode.xml')
|
|
47
|
+
@importer.import(file: 'spec/fixtures/files/veracode-scrubbed.xml')
|
|
48
48
|
end
|
|
49
49
|
end
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
|
|
3
|
-
<detailedreport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://www.veracode.com/schema/reports/export/1.0" xsi:schemaLocation="https://www.veracode.com/schema/reports/export/1.0 https://analysiscenter.veracode.com/resource/detailedreport.xsd" report_format_version="1.5" account_id="10470" app_name="
|
|
3
|
+
<detailedreport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://www.veracode.com/schema/reports/export/1.0" xsi:schemaLocation="https://www.veracode.com/schema/reports/export/1.0 https://analysiscenter.veracode.com/resource/detailedreport.xsd" report_format_version="1.5" account_id="10470" app_name="Example-App" app_id="12345" analysis_id="22666593" static_analysis_unit_id="22682243" sandbox_id="4031820" first_build_submitted_date="2022-12-12 06:18:41 UTC" version="12 Dec 2022 Static Promoted" build_id="22695302" submitter="Submitter" platform="Not Specified" assurance_level="2" business_criticality="2" generation_date="2023-03-07 14:45:59 UTC" veracode_level="VL3 + SCA" total_flaws="3" flaws_not_mitigated="3" teams="SecurityReviewServices" life_cycle_stage="Not Specified" planned_deployment_date="2022-12-12 07:40:09 UTC" last_update_time="2022-12-12 08:20:14 UTC" is_latest_build="true" policy_name="Example Internet App" policy_version="13" policy_compliance_status="Pass" policy_rules_status="Pass" grace_period_expired="false" scan_overdue="false" business_owner="Business Owner" business_unit="Cybersecurity" tags="example@test.com" legacy_scan_engine="false"><static-analysis rating="A" score="99" submitted_date="2022-12-12 08:19:44 UTC" published_date="2022-12-12 08:20:13 UTC" version="12 Dec 2022 Static Promoted" analysis_size_bytes="105400" engine_version="20221110172554">
|
|
4
4
|
<modules>
|
|
5
5
|
<module name="pipeline-scan.jar" compiler="JAVAC_8" os="Java J2SE 8" architecture="JVM" loc="6130" score="99" numflawssev0="0" numflawssev1="0" numflawssev2="1" numflawssev3="2" numflawssev4="0" numflawssev5="0"/>
|
|
6
6
|
</modules>
|
|
@@ -110,9 +110,9 @@
|
|
|
110
110
|
<vulnerabilities>
|
|
111
111
|
<vulnerability cve_id="CVE-2022-41404" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="org.ini4j:ini4j is vulnerable to denial of service (DoS) attacks. The vulnerable `fetch` method in the `BasicProfile.java` allows remote attackers to cause denial of service conditions in the target system." severity_desc="Medium" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2023-01-05 16:15:07 UTC" vulnerability_affects_policy_compliance="false">
|
|
112
112
|
<mitigations>
|
|
113
|
-
<mitigation action="Potential False Positive" description="testing" user="
|
|
114
|
-
<mitigation action="Approve Mitigation" description="asda" user="
|
|
115
|
-
<mitigation action="Mitigate by Design" description="
Technique: M1 : Establish and maintain control over all of your inputs
Specifics: sds
Remaining Risk: sd
Verification: asd" user="
|
|
113
|
+
<mitigation action="Potential False Positive" description="testing" user="example@test.com" date="2023-01-05 16:15:07 UTC"/>
|
|
114
|
+
<mitigation action="Approve Mitigation" description="asda" user="example@test.com" date="2022-12-12 16:00:29 UTC"/>
|
|
115
|
+
<mitigation action="Mitigate by Design" description="
Technique: M1 : Establish and maintain control over all of your inputs
Specifics: sds
Remaining Risk: sd
Verification: asd" user="example@test.com" date="2022-12-12 15:59:53 UTC"/>
|
|
116
116
|
</mitigations>
|
|
117
117
|
</vulnerability>
|
|
118
118
|
</vulnerabilities>
|
|
@@ -130,8 +130,8 @@
|
|
|
130
130
|
<vulnerabilities>
|
|
131
131
|
<vulnerability cve_id="CVE-2022-36033" cvss_score="6.4" severity="4" cwe_id="CWE-79" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="jsoup is vulnerable to cross-site scripting. The vulnerability exists in `resolve` function in `StringUtil.java` because the jsoup cleaner is not properly sanitized when SafeList.preserveRelativeLinks is enabled which allows an attacker to inject and execute arbitrary javascript." severity_desc="High" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2022-12-12 08:57:30 UTC" vulnerability_affects_policy_compliance="false">
|
|
132
132
|
<mitigations>
|
|
133
|
-
<mitigation action="Approve Mitigation" description="testg" user="
|
|
134
|
-
<mitigation action="Potential False Positive" description="testr" user="
|
|
133
|
+
<mitigation action="Approve Mitigation" description="testg" user="example@test.com" date="2022-12-12 08:57:30 UTC"/>
|
|
134
|
+
<mitigation action="Potential False Positive" description="testr" user="example@test.com" date="2022-12-12 08:57:21 UTC"/>
|
|
135
135
|
</mitigations>
|
|
136
136
|
</vulnerability>
|
|
137
137
|
</vulnerabilities>
|
|
@@ -173,9 +173,9 @@
|
|
|
173
173
|
<vulnerabilities>
|
|
174
174
|
<vulnerability cve_id="SRCCLR-SID-22742" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="commons-codec does not properly perform input validation on encoded values. The `decode()` function in the Base32, Base64 and BCodec classes fails to reject malformed Base32 and Base64 encoded strings and decodes into arbitrary values. A remote attacker can leverage this vulnerability to tunnel additional information via Base32 or Base64 encoded strings that appears to be legitimate." severity_desc="Medium" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2023-01-04 17:38:44 UTC" vulnerability_affects_policy_compliance="false">
|
|
175
175
|
<mitigations>
|
|
176
|
-
<mitigation action="Comment" description="testing" user="
|
|
177
|
-
<mitigation action="Approve Mitigation" description="testing" user="
|
|
178
|
-
<mitigation action="Potential False Positive" description="testing" user="
|
|
176
|
+
<mitigation action="Comment" description="testing" user="example@test.com" date="2023-01-04 17:38:44 UTC"/>
|
|
177
|
+
<mitigation action="Approve Mitigation" description="testing" user="example@test.com" date="2022-12-12 08:22:48 UTC"/>
|
|
178
|
+
<mitigation action="Potential False Positive" description="testing" user="example@test.com" date="2022-12-12 08:22:36 UTC"/>
|
|
179
179
|
</mitigations>
|
|
180
180
|
</vulnerability>
|
|
181
181
|
</vulnerabilities>
|
|
@@ -193,8 +193,8 @@
|
|
|
193
193
|
<vulnerabilities>
|
|
194
194
|
<vulnerability cve_id="CVE-2022-42889" cvss_score="7.5" severity="4" cwe_id="CWE-94" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="Apache Commons Text is vulnerable to arbitrary code execution. The vulnerability exists in the `lookup` module due to insecure interpolation defaults when untrusted configuration values are used which allows an attacker to inject arbitrary code into the system." severity_desc="High" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2022-12-12 15:58:13 UTC" vulnerability_affects_policy_compliance="false">
|
|
195
195
|
<mitigations>
|
|
196
|
-
<mitigation action="Approve Mitigation" description="tets" user="
|
|
197
|
-
<mitigation action="Potential False Positive" description="test" user="
|
|
196
|
+
<mitigation action="Approve Mitigation" description="tets" user="example@test.com" date="2022-12-12 15:58:13 UTC"/>
|
|
197
|
+
<mitigation action="Potential False Positive" description="test" user="example@test.com" date="2022-12-12 15:58:06 UTC"/>
|
|
198
198
|
</mitigations>
|
|
199
199
|
</vulnerability>
|
|
200
200
|
</vulnerabilities>
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: dradis-veracode
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 4.
|
|
4
|
+
version: 4.16.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Dradis Team
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2025-05-16 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: dradis-plugins
|
|
@@ -113,7 +113,7 @@ files:
|
|
|
113
113
|
- lib/veracode/flaw.rb
|
|
114
114
|
- lib/veracode/vulnerability.rb
|
|
115
115
|
- spec/dradis/plugins/veracode/importer_spec.rb
|
|
116
|
-
- spec/fixtures/files/veracode.xml
|
|
116
|
+
- spec/fixtures/files/veracode-scrubbed.xml
|
|
117
117
|
- spec/spec_helper.rb
|
|
118
118
|
- templates/evidence.sample
|
|
119
119
|
- templates/issue.sample
|
|
@@ -144,5 +144,5 @@ specification_version: 4
|
|
|
144
144
|
summary: Veracode add-on for the Dradis Framework.
|
|
145
145
|
test_files:
|
|
146
146
|
- spec/dradis/plugins/veracode/importer_spec.rb
|
|
147
|
-
- spec/fixtures/files/veracode.xml
|
|
147
|
+
- spec/fixtures/files/veracode-scrubbed.xml
|
|
148
148
|
- spec/spec_helper.rb
|