hackerone-client 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ebb425c241793e7a304c86e2432a9cd8c1fbfa4c
-  data.tar.gz: ef459ac5cab769b0ab7ee5ccc012f74c1492a37a
+  metadata.gz: eae8f2a0596bfea4752e9fb67a56da8dea4901a9
+  data.tar.gz: b891bace9cba415e442d4c6cdbfb095e29da0a6b
 SHA512:
-  metadata.gz: 7ae32de2ce5143b8b694a72434057e9d991422f0e374dda94c0f6a26f3b9ef8c8a12b14938bab7e2f5023c890b944dccc55bc6e73ea67bfc26cd01106e1bfe27
-  data.tar.gz: c179d3c6ac1e2ca293126ebcdf9d5a7d731e069f9b209edcc5fc93ac154cdb11763835abca01447de94cf694e8eb4bf741b24997e0772df8e587d367b1e9410c
+  metadata.gz: f667e613c0300b4c883b235b6f419c746f6145a0e95c7cf1c7273d71fced66f8f20f57a4299ff43d9346b0ad88da992b0bbf0c45cf140118a1cdb989126e45a9
+  data.tar.gz: 67528f88aba28f56c2a8d30dae45f6441e1e39309906521fad94809721bab05612db096fa9ca6b2583fd7be1c1dc17dc61dec20cf45e57141896a374e9b67516

data/README.md

@@ -1,9 +1,26 @@
 # Hackerone::Client
 
-A limited client library for interacting with HackerOne. Currently only supports two endpoints:
+A limited client library for interacting with HackerOne. Currently only supports a few operations:
 
-* `/reports` returns all reports in the "new" state for a given program
-* `/report/{id}` returns report data for a given report
+```ruby 
+client = HackerOne::Client::Api.new("github")
+
+# GET`/reports` returns all reports in the "new" state for a given program
+client.reports
+
+# GET `/report/{id}` returns report data for a given report
+client.report(id)
+
+# POST '/report/{id}/state_change change the state of a report
+# `state` can be one of  new, triaged, needs-more-info, resolved, not-applicable, informative, duplicate, spam
+client.state_change(id, state)
+
+# POST '/report/{id}/add_report_reference add a "reference" e.g. internal issue number
+client.add_report_reference(id, reference)
+
+# Triage an issue (add a reference and set state to :triaged)
+client.triage(id, reference)
+```
 
 ## Usage
 

data/fixtures/vcr_cassettes/report.yml

@@ -207,6 +207,18 @@ http_interactions:
                 }
               ]
             },
+            "weakness": {
+              "data": {
+                "id": "1",
+                "type": "weakness",
+                "attributes": {
+                  "name": "Cleartext Storage of Sensitive Information",
+                  "description": "",
+                  "external_id": "CWE-312",
+                  "created_at": "2016-01-28T13:34:08.945Z"
+                }
+              }
+            },
             "activities": {
               "data": [
                 {

data/lib/hackerone/client/report.rb

@@ -1,23 +1,9 @@
+require_relative './weakness'
+
 module HackerOne
   module Client
     class Report
       PAYOUT_ACTIVITY_KEY = "activity-bounty-awarded"
-      CLASSIFICATION_MAPPING = {
-        "None Applicable" => "A0-Other",
-        "Denial of Service" => "A0-Other",
-        "Memory Corruption" => "A0-Other",
-        "Cryptographic Issue" => "A0-Other",
-        "Privilege Escalation" => "A0-Other",
-        "UI Redressing (Clickjacking)" => "A0-Other",
-        "Command Injection" => "A1-Injection",
-        "Remote Code Execution" => "A1-Injection",
-        "SQL Injection" => "A1-Injection",
-        "Authentication" => "A2-AuthSession",
-        "Cross-Site Scripting (XSS)" => "A3-XSS",
-        "Information Disclosure" => "A6-DataExposure",
-        "Cross-Site Request Forgery (CSRF)" => "A8-CSRF",
-        "Unvalidated / Open Redirect" => "A10-Redirects"
-      }
 
       def initialize(report)
         @report = report
@@ -69,15 +55,12 @@ module HackerOne
         attributes[:vulnerability_information]
       end
 
-      # Do our best to map the value that hackerone provides and the reporter sets
-      # to the OWASP Top 10. Take the first match since multiple values can be set.
-      # This is used for the issue label.
-      def classification_label
-        owasp_mapping = vulnerability_types.map do |vuln_type|
-          CLASSIFICATION_MAPPING[vuln_type[:attributes][:name]]
-        end.flatten.first
+      def weakness
+        @weakness ||= Weakness.new relationships[:weakness][:data][:attributes]
+      end
 
-        owasp_mapping || CLASSIFICATION_MAPPING["None Applicable"]
+      def classification_label
+        weakness.to_owasp
       end
 
       # Bounty writeups just use the key, and not the label value.

data/lib/hackerone/client/version.rb

@@ -1,5 +1,5 @@
 module Hackerone
   module Client
-    VERSION = "0.2.0"
+    VERSION = "0.2.1"
   end
 end

data/lib/hackerone/client/weakness.rb

@@ -0,0 +1,43 @@
+module HackerOne
+  module Client
+    class Weakness
+      class << self
+        def extract_cwe_number(cwe)
+          fail StandardError::ArgumentError unless cwe.upcase.start_with?('CWE-')
+
+          cwe.split('CWE-').last.to_i
+        end
+      end
+
+      OWASP_TOP_10_2013_TO_CWE = {
+        'A1-Injection' => [77, 78, 88, 89, 90, 91, 564],
+        'A2-AuthSession' =>
+          [287, 613, 522, 256, 384, 472, 346, 441, 523, 620, 640, 319, 311],
+        'A3-XSS' => [79],
+        'A4-DirectObjRef' => [639, 99, 22],
+        'A5-Misconfig' => [16, 2, 215, 548, 209],
+        'A6-DataExposure' => [312, 319, 310, 326, 320, 311, 325, 328, 327],
+        'A7-MissingACL' => [285, 287],
+        'A8-CSRF' => [352, 642, 613, 346, 441],
+        'A9-KnownVuln' => [],
+        'A10-Redirects' => [601],
+      }.freeze
+
+      OWASP_DEFAULT = 'A0-Other'.freeze
+
+      def initialize(weakness)
+        @attributes = weakness
+      end
+
+      def to_owasp
+        OWASP_TOP_10_2013_TO_CWE.map do |owasp, cwes|
+          owasp if cwes.include?(self.class.extract_cwe_number(to_cwe))
+        end.compact.first || OWASP_DEFAULT
+      end
+
+      def to_cwe
+        @attributes[:external_id]
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hackerone-client
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-03-16 00:00:00.000000000 Z
+date: 2017-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -142,6 +142,7 @@ files:
 - lib/hackerone/client.rb
 - lib/hackerone/client/report.rb
 - lib/hackerone/client/version.rb
+- lib/hackerone/client/weakness.rb
 homepage: https://github.com/oreoshake/hackerone-client
 licenses:
 - MIT