dradis-veracode 4.14.0 → 4.15.0
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 835a4403ff6c5e49d1ff7b1cff0904f453581577cd529c61d1de670aff178acf
|
|
4
|
+
data.tar.gz: 462d3ddfd62c4ef27d8fae2a2a4d72d7ba3ae261353c372c8c87deae2a2bdbca
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 3a5e0f025803d77e27208c81252490155ff20e2a911a17a14cad65d8ef6192428261c56ceeb2110792e8bf171dfac59bafa5fe218fa48405d02309311521d5ad
|
|
7
|
+
data.tar.gz: e444763d764f6404a9abf5952ba134de7a9e43d7b791e522c272bc8f5e2dbb0150723652cfb541266cdb54dd33971c3975b8d9fb6c02342446706153a1cef24e
|
data/CHANGELOG.md
CHANGED
|
@@ -35,7 +35,7 @@ describe Dradis::Plugins::Veracode::Importer do
|
|
|
35
35
|
end
|
|
36
36
|
|
|
37
37
|
it 'creates nodes, issues, and, evidence' do
|
|
38
|
-
expect(@content_service).to receive(:create_node).with(hash_including label: '
|
|
38
|
+
expect(@content_service).to receive(:create_node).with(hash_including label: 'Example-App').once
|
|
39
39
|
|
|
40
40
|
%w{ 117 382 CVE-2022-41404 CVE-2022-36033 SRCCLR-SID-22742 CVE-2022-42889 }.each do |cweid|
|
|
41
41
|
expect(@content_service).to receive(:create_issue).with(hash_including id: cweid).at_least(:once)
|
|
@@ -44,6 +44,6 @@ describe Dradis::Plugins::Veracode::Importer do
|
|
|
44
44
|
expect(@content_service).to receive(:create_evidence).with(hash_including(content: '')).at_least(7).times
|
|
45
45
|
|
|
46
46
|
# Run the import
|
|
47
|
-
@importer.import(file: 'spec/fixtures/files/veracode.xml')
|
|
47
|
+
@importer.import(file: 'spec/fixtures/files/veracode-scrubbed.xml')
|
|
48
48
|
end
|
|
49
49
|
end
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
2
|
|
|
3
|
-
<detailedreport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://www.veracode.com/schema/reports/export/1.0" xsi:schemaLocation="https://www.veracode.com/schema/reports/export/1.0 https://analysiscenter.veracode.com/resource/detailedreport.xsd" report_format_version="1.5" account_id="10470" app_name="
|
|
3
|
+
<detailedreport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://www.veracode.com/schema/reports/export/1.0" xsi:schemaLocation="https://www.veracode.com/schema/reports/export/1.0 https://analysiscenter.veracode.com/resource/detailedreport.xsd" report_format_version="1.5" account_id="10470" app_name="Example-App" app_id="12345" analysis_id="22666593" static_analysis_unit_id="22682243" sandbox_id="4031820" first_build_submitted_date="2022-12-12 06:18:41 UTC" version="12 Dec 2022 Static Promoted" build_id="22695302" submitter="Submitter" platform="Not Specified" assurance_level="2" business_criticality="2" generation_date="2023-03-07 14:45:59 UTC" veracode_level="VL3 + SCA" total_flaws="3" flaws_not_mitigated="3" teams="SecurityReviewServices" life_cycle_stage="Not Specified" planned_deployment_date="2022-12-12 07:40:09 UTC" last_update_time="2022-12-12 08:20:14 UTC" is_latest_build="true" policy_name="Example Internet App" policy_version="13" policy_compliance_status="Pass" policy_rules_status="Pass" grace_period_expired="false" scan_overdue="false" business_owner="Business Owner" business_unit="Cybersecurity" tags="example@test.com" legacy_scan_engine="false"><static-analysis rating="A" score="99" submitted_date="2022-12-12 08:19:44 UTC" published_date="2022-12-12 08:20:13 UTC" version="12 Dec 2022 Static Promoted" analysis_size_bytes="105400" engine_version="20221110172554">
|
|
4
4
|
<modules>
|
|
5
5
|
<module name="pipeline-scan.jar" compiler="JAVAC_8" os="Java J2SE 8" architecture="JVM" loc="6130" score="99" numflawssev0="0" numflawssev1="0" numflawssev2="1" numflawssev3="2" numflawssev4="0" numflawssev5="0"/>
|
|
6
6
|
</modules>
|
|
@@ -110,9 +110,9 @@
|
|
|
110
110
|
<vulnerabilities>
|
|
111
111
|
<vulnerability cve_id="CVE-2022-41404" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="org.ini4j:ini4j is vulnerable to denial of service (DoS) attacks. The vulnerable `fetch` method in the `BasicProfile.java` allows remote attackers to cause denial of service conditions in the target system." severity_desc="Medium" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2023-01-05 16:15:07 UTC" vulnerability_affects_policy_compliance="false">
|
|
112
112
|
<mitigations>
|
|
113
|
-
<mitigation action="Potential False Positive" description="testing" user="
|
|
114
|
-
<mitigation action="Approve Mitigation" description="asda" user="
|
|
115
|
-
<mitigation action="Mitigate by Design" description="
Technique: M1 : Establish and maintain control over all of your inputs
Specifics: sds
Remaining Risk: sd
Verification: asd" user="
|
|
113
|
+
<mitigation action="Potential False Positive" description="testing" user="example@test.com" date="2023-01-05 16:15:07 UTC"/>
|
|
114
|
+
<mitigation action="Approve Mitigation" description="asda" user="example@test.com" date="2022-12-12 16:00:29 UTC"/>
|
|
115
|
+
<mitigation action="Mitigate by Design" description="
Technique: M1 : Establish and maintain control over all of your inputs
Specifics: sds
Remaining Risk: sd
Verification: asd" user="example@test.com" date="2022-12-12 15:59:53 UTC"/>
|
|
116
116
|
</mitigations>
|
|
117
117
|
</vulnerability>
|
|
118
118
|
</vulnerabilities>
|
|
@@ -130,8 +130,8 @@
|
|
|
130
130
|
<vulnerabilities>
|
|
131
131
|
<vulnerability cve_id="CVE-2022-36033" cvss_score="6.4" severity="4" cwe_id="CWE-79" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="jsoup is vulnerable to cross-site scripting. The vulnerability exists in `resolve` function in `StringUtil.java` because the jsoup cleaner is not properly sanitized when SafeList.preserveRelativeLinks is enabled which allows an attacker to inject and execute arbitrary javascript." severity_desc="High" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2022-12-12 08:57:30 UTC" vulnerability_affects_policy_compliance="false">
|
|
132
132
|
<mitigations>
|
|
133
|
-
<mitigation action="Approve Mitigation" description="testg" user="
|
|
134
|
-
<mitigation action="Potential False Positive" description="testr" user="
|
|
133
|
+
<mitigation action="Approve Mitigation" description="testg" user="example@test.com" date="2022-12-12 08:57:30 UTC"/>
|
|
134
|
+
<mitigation action="Potential False Positive" description="testr" user="example@test.com" date="2022-12-12 08:57:21 UTC"/>
|
|
135
135
|
</mitigations>
|
|
136
136
|
</vulnerability>
|
|
137
137
|
</vulnerabilities>
|
|
@@ -173,9 +173,9 @@
|
|
|
173
173
|
<vulnerabilities>
|
|
174
174
|
<vulnerability cve_id="SRCCLR-SID-22742" cvss_score="5.0" severity="3" cwe_id="" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="commons-codec does not properly perform input validation on encoded values. The `decode()` function in the Base32, Base64 and BCodec classes fails to reject malformed Base32 and Base64 encoded strings and decodes into arbitrary values. A remote attacker can leverage this vulnerability to tunnel additional information via Base32 or Base64 encoded strings that appears to be legitimate." severity_desc="Medium" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2023-01-04 17:38:44 UTC" vulnerability_affects_policy_compliance="false">
|
|
175
175
|
<mitigations>
|
|
176
|
-
<mitigation action="Comment" description="testing" user="
|
|
177
|
-
<mitigation action="Approve Mitigation" description="testing" user="
|
|
178
|
-
<mitigation action="Potential False Positive" description="testing" user="
|
|
176
|
+
<mitigation action="Comment" description="testing" user="example@test.com" date="2023-01-04 17:38:44 UTC"/>
|
|
177
|
+
<mitigation action="Approve Mitigation" description="testing" user="example@test.com" date="2022-12-12 08:22:48 UTC"/>
|
|
178
|
+
<mitigation action="Potential False Positive" description="testing" user="example@test.com" date="2022-12-12 08:22:36 UTC"/>
|
|
179
179
|
</mitigations>
|
|
180
180
|
</vulnerability>
|
|
181
181
|
</vulnerabilities>
|
|
@@ -193,8 +193,8 @@
|
|
|
193
193
|
<vulnerabilities>
|
|
194
194
|
<vulnerability cve_id="CVE-2022-42889" cvss_score="7.5" severity="4" cwe_id="CWE-94" first_found_date="2022-12-12 08:19:48 UTC" cve_summary="Apache Commons Text is vulnerable to arbitrary code execution. The vulnerability exists in the `lookup` module due to insecure interpolation defaults when untrusted configuration values are used which allows an attacker to inject arbitrary code into the system." severity_desc="High" mitigation="true" mitigation_type="Potential False Positive" mitigated_date="2022-12-12 15:58:13 UTC" vulnerability_affects_policy_compliance="false">
|
|
195
195
|
<mitigations>
|
|
196
|
-
<mitigation action="Approve Mitigation" description="tets" user="
|
|
197
|
-
<mitigation action="Potential False Positive" description="test" user="
|
|
196
|
+
<mitigation action="Approve Mitigation" description="tets" user="example@test.com" date="2022-12-12 15:58:13 UTC"/>
|
|
197
|
+
<mitigation action="Potential False Positive" description="test" user="example@test.com" date="2022-12-12 15:58:06 UTC"/>
|
|
198
198
|
</mitigations>
|
|
199
199
|
</vulnerability>
|
|
200
200
|
</vulnerabilities>
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: dradis-veracode
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 4.
|
|
4
|
+
version: 4.15.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Dradis Team
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2024-
|
|
11
|
+
date: 2024-12-20 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: dradis-plugins
|
|
@@ -113,7 +113,7 @@ files:
|
|
|
113
113
|
- lib/veracode/flaw.rb
|
|
114
114
|
- lib/veracode/vulnerability.rb
|
|
115
115
|
- spec/dradis/plugins/veracode/importer_spec.rb
|
|
116
|
-
- spec/fixtures/files/veracode.xml
|
|
116
|
+
- spec/fixtures/files/veracode-scrubbed.xml
|
|
117
117
|
- spec/spec_helper.rb
|
|
118
118
|
- templates/evidence.sample
|
|
119
119
|
- templates/issue.sample
|
|
@@ -144,5 +144,5 @@ specification_version: 4
|
|
|
144
144
|
summary: Veracode add-on for the Dradis Framework.
|
|
145
145
|
test_files:
|
|
146
146
|
- spec/dradis/plugins/veracode/importer_spec.rb
|
|
147
|
-
- spec/fixtures/files/veracode.xml
|
|
147
|
+
- spec/fixtures/files/veracode-scrubbed.xml
|
|
148
148
|
- spec/spec_helper.rb
|