@mitre/hdf-converters 2.12.2 → 2.13.0

package/lib/src/dependency-track-mapper.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DependencyTrackMapper = void 0;
 const inspecjs_1 = require("inspecjs");
@@ -63,133 +73,137 @@ function getCweNames(cwes) {
     return cwes.map(({ name }) => name);
 }
 class DependencyTrackMapper extends base_converter_1.BaseConverter {
-    constructor(dtJson, withRaw = false) {
-        super(JSON.parse(dtJson));
-        this.mappings = {
-            platform: {
-                name: { path: 'meta.application' },
-                release: { transformer: getVersion },
-                target_id: { path: 'meta.baseUrl' }
-            },
-            version: package_json_1.version,
-            statistics: {},
-            profiles: [
-                {
-                    name: { path: 'project.uuid' },
-                    version: { path: 'project.version' },
-                    title: { path: 'project.name' },
-                    summary: { path: 'project.description' },
-                    supports: [],
-                    attributes: [],
-                    groups: [],
-                    status: 'loaded',
-                    controls: [
-                        {
-                            path: 'findings',
-                            key: 'id',
-                            tags: {
-                                cweIds: { path: 'vulnerability.cwes', transformer: getCweIds },
-                                cweNames: { path: 'vulnerability.cwes', transformer: getCweNames },
-                                nist: {
-                                    path: 'vulnerability.cwes',
-                                    transformer: (cwes) => nistTags(getCweIds(cwes))
-                                },
-                                cci: {
-                                    path: 'vulnerability.cwes',
-                                    transformer: (cwes) => (0, global_1.getCCIsForNISTTags)(nistTags(getCweIds(cwes)))
-                                },
-                                componentUuid: { path: 'component.uuid' },
-                                componentName: { path: 'component.name' },
-                                componentGroup: { path: 'component.group' },
-                                componentVersion: { path: 'component.version' },
-                                componentLatestVersion: { path: 'component.latestVersion' },
-                                componentPurl: { path: 'component.purl' },
-                                componentCpe: { path: 'component.cpe' },
-                                componentProject: { path: 'component.project' },
-                                vulnerabilityUuid: { path: 'vulnerability.uuid' },
-                                vulnerabilitySource: { path: 'vulnerability.source' },
-                                vulnerabilityVulnId: { path: 'vulnerability.vulnId' },
-                                vulnerabilityTitle: { path: 'vulnerability.title' },
-                                vulnerabilitySubtitle: { path: 'vulnerability.subtitle' },
-                                vulnerabilityAliases: {
-                                    path: 'vulnerability.aliases',
-                                    transformer: (aliases) => JSON.stringify(aliases, null, 2)
-                                },
-                                vulnerabilityCvssV2BaseScore: {
-                                    path: 'vulnerability.cvssV2BaseScore'
-                                },
-                                vulnerabilityCvssV3BaseScore: {
-                                    path: 'vulnerability.cvssV3BaseScore'
-                                },
-                                vulnerabilityOwaspLikelihoodScore: {
-                                    path: 'vulnerability.owaspLikelihoodScore'
-                                },
-                                vulnerabilityOwaspTechnicalImpactScore: {
-                                    path: 'vulnerability.owaspTechnicalImpactScore'
-                                },
-                                vulnerabilityOwaspBusinessImpactScore: {
-                                    path: 'vulnerability.owaspBusinessImpactScore'
-                                },
-                                vulnerabilitySeverityRank: { path: 'vulnerability.severityRank' },
-                                vulnerabilityEpssScore: { path: 'vulnerability.epssScore' },
-                                vulnerabilityEpssPercentile: {
-                                    path: 'vulnerability.epssPercentile'
-                                },
-                                vulnerabilityCweId: { path: 'vulnerability.cweId' },
-                                vulnerabilityCweName: { path: 'vulnerability.cweName' },
-                                attributionAnalyzerIdentity: {
-                                    path: 'attribution.analyzerIdentity'
-                                },
-                                attributionAttributedOn: { path: 'attribution.attributedOn' },
-                                attributionAlternateIdentifier: {
-                                    path: 'attribution.alternateIdentifier'
-                                },
-                                attributionReferenceUrl: { path: 'attribution.referenceUrl' },
-                                analysisState: { path: 'analysis.state' },
-                                analysisIsSuppressed: { path: 'analysis.isSuppressed' }
+    withRaw;
+    mappings = {
+        platform: {
+            name: { path: 'meta.application' },
+            release: { transformer: getVersion },
+            target_id: { path: 'meta.baseUrl' }
+        },
+        version: package_json_1.version,
+        statistics: {},
+        profiles: [
+            {
+                name: { path: 'project.uuid' },
+                version: { path: 'project.version' },
+                title: { path: 'project.name' },
+                summary: { path: 'project.description' },
+                supports: [],
+                attributes: [],
+                groups: [],
+                status: 'loaded',
+                controls: [
+                    {
+                        path: 'findings',
+                        key: 'id',
+                        tags: {
+                            // cwes not always present in vulnerability
+                            cweIds: { path: 'vulnerability.cwes', transformer: getCweIds },
+                            cweNames: { path: 'vulnerability.cwes', transformer: getCweNames },
+                            nist: {
+                                path: 'vulnerability.cwes',
+                                transformer: (cwes) => nistTags(getCweIds(cwes))
+                            },
+                            cci: {
+                                path: 'vulnerability.cwes',
+                                transformer: (cwes) => (0, global_1.getCCIsForNISTTags)(nistTags(getCweIds(cwes)))
+                            },
+                            componentUuid: { path: 'component.uuid' },
+                            componentName: { path: 'component.name' },
+                            componentGroup: { path: 'component.group' },
+                            componentVersion: { path: 'component.version' },
+                            componentLatestVersion: { path: 'component.latestVersion' },
+                            componentPurl: { path: 'component.purl' },
+                            componentCpe: { path: 'component.cpe' },
+                            componentProject: { path: 'component.project' },
+                            vulnerabilityUuid: { path: 'vulnerability.uuid' },
+                            vulnerabilitySource: { path: 'vulnerability.source' },
+                            vulnerabilityVulnId: { path: 'vulnerability.vulnId' },
+                            vulnerabilityTitle: { path: 'vulnerability.title' },
+                            vulnerabilitySubtitle: { path: 'vulnerability.subtitle' },
+                            vulnerabilityAliases: {
+                                path: 'vulnerability.aliases',
+                                transformer: (aliases) => JSON.stringify(aliases, null, 2)
+                            },
+                            vulnerabilityCvssV2BaseScore: {
+                                path: 'vulnerability.cvssV2BaseScore'
+                            },
+                            vulnerabilityCvssV3BaseScore: {
+                                path: 'vulnerability.cvssV3BaseScore'
+                            },
+                            vulnerabilityOwaspLikelihoodScore: {
+                                path: 'vulnerability.owaspLikelihoodScore'
                             },
-                            refs: [],
-                            source_location: {},
-                            title: { transformer: getTitle },
-                            id: { path: 'matrix' },
-                            desc: { path: 'vulnerability.description' },
-                            descriptions: [
-                                {
-                                    data: { path: 'vulnerability.description' },
-                                    label: 'check'
-                                },
-                                {
-                                    data: { path: 'vulnerability.recommendation' },
-                                    label: 'fix'
-                                }
-                            ],
-                            impact: {
-                                path: 'vulnerability.severity',
-                                transformer: (0, base_converter_1.impactMapping)(IMPACT_MAPPING)
+                            vulnerabilityOwaspTechnicalImpactScore: {
+                                path: 'vulnerability.owaspTechnicalImpactScore'
                             },
-                            code: {
-                                transformer: (finding) => JSON.stringify(finding, null, 2)
+                            vulnerabilityOwaspBusinessImpactScore: {
+                                path: 'vulnerability.owaspBusinessImpactScore'
                             },
-                            results: [
-                                {
-                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                    code_desc: { path: 'vulnerability.recommendation' },
-                                    start_time: { path: '$.meta.timestamp' }
-                                }
-                            ]
-                        }
-                    ],
-                    sha256: ''
-                }
-            ],
-            passthrough: {
-                transformer: (data) => {
-                    return {
-                        ...(this.withRaw && { raw: data })
-                    };
-                }
+                            vulnerabilitySeverityRank: { path: 'vulnerability.severityRank' },
+                            vulnerabilityEpssScore: { path: 'vulnerability.epssScore' },
+                            vulnerabilityEpssPercentile: {
+                                path: 'vulnerability.epssPercentile'
+                            },
+                            // Schema is deprecating these attributes: cweId, cweName
+                            vulnerabilityCweId: { path: 'vulnerability.cweId' },
+                            vulnerabilityCweName: { path: 'vulnerability.cweName' },
+                            attributionAnalyzerIdentity: {
+                                path: 'attribution.analyzerIdentity'
+                            },
+                            attributionAttributedOn: { path: 'attribution.attributedOn' },
+                            attributionAlternateIdentifier: {
+                                path: 'attribution.alternateIdentifier'
+                            },
+                            attributionReferenceUrl: { path: 'attribution.referenceUrl' },
+                            analysisState: { path: 'analysis.state' },
+                            analysisIsSuppressed: { path: 'analysis.isSuppressed' }
+                        },
+                        refs: [],
+                        source_location: {},
+                        title: { transformer: getTitle },
+                        id: { path: 'matrix' },
+                        desc: { path: 'vulnerability.description' },
+                        descriptions: [
+                            {
+                                data: { path: 'vulnerability.description' },
+                                label: 'check'
+                            },
+                            {
+                                data: { path: 'vulnerability.recommendation' },
+                                label: 'fix'
+                            }
+                        ],
+                        impact: {
+                            path: 'vulnerability.severity',
+                            transformer: (0, base_converter_1.impactMapping)(IMPACT_MAPPING)
+                        },
+                        code: {
+                            transformer: (finding) => JSON.stringify(finding, null, 2)
+                        },
+                        results: [
+                            {
+                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
+                                // recommendation not always present in vulnerability
+                                code_desc: { path: 'vulnerability.recommendation' },
+                                start_time: { path: '$.meta.timestamp' }
+                            }
+                        ]
+                    }
+                ],
+                sha256: ''
             }
-        };
+        ],
+        passthrough: {
+            transformer: (data) => {
+                return {
+                    ...(this.withRaw && { raw: data })
+                };
+            }
+        }
+    };
+    constructor(dtJson, withRaw = false) {
+        super(JSON.parse(dtJson));
         this.withRaw = withRaw;
     }
 }

package/lib/src/dependency-track-mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-track-mapper.js","sourceRoot":"","sources":["../../src/dependency-track-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAK0B;AAC1B,8DAAyD;AACzD,2CAGwB;AAOxB,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,UAAU,EAAE,GAAG,CAAC;IACjB,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,MAAM,EAAE,CAAC,CAAC;IACX,CAAC,YAAY,EAAE,GAAG,CAAC;CACpB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,+BAAc,EAAE,CAAC;AAE9C,SAAS,QAAQ,CAAC,KAAe;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,OAAO,gBAAgB,CAAC,UAAU,CAChC,IAAI,EACJ,+CAAsC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B;IAC9C,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,EAAE,CAAC;KACX;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,KAAK,EAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B;IAChD,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,EAAE,CAAC;KACX;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,IAAI,EAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,qBAAsB,SAAQ,8BAAa;IAyItD,YAAY,MAAc,EAAE,OAAO,GAAG,KAAK;QACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAvI5B,aAAQ,GAGJ;YACF,QAAQ,EAAE;gBACR,IAAI,EAAE,EAAC,IAAI,EAAE,kBAAkB,EAAC;gBAChC,OAAO,EAAE,EAAC,WAAW,EAAE,UAAU,EAAC;gBAClC,SAAS,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;aAClC;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;oBAC5B,OAAO,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAC;oBAClC,KAAK,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;oBAC7B,OAAO,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;oBACtC,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,UAAU;4BAChB,GAAG,EAAE,IAAI;4BACT,IAAI,EAAE;gCAEJ,MAAM,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,SAAS,EAAC;gCAC5D,QAAQ,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,EAAC;gCAChE,IAAI,EAAE;oCACJ,IAAI,EAAE,oBAAoB;oCAC1B,WAAW,EAAE,CAAC,IAAiB,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;iCAC9D;gCACD,GAAG,EAAE;oCACH,IAAI,EAAE,oBAAoB;oCAC1B,WAAW,EAAE,CAAC,IAAiB,EAAE,EAAE,CACjC,IAAA,2BAAkB,EAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;iCAChD;gCACD,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;gCACvC,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;gCACvC,cAAc,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAC;gCACzC,gBAAgB,EAAE,EAAC,IAAI,EAAE,mBAAmB,EAAC;gCAC7C,sBAAsB,EAAE,EAAC,IAAI,EAAE,yBAAyB,EAAC;gCACzD,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;gCACvC,YAAY,EAAE,EAAC,IAAI,EAAE,eAAe,EAAC;gCACrC,gBAAgB,EAAE,EAAC,IAAI,EAAE,mBAAmB,EAAC;gCAC7C,iBAAiB,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAC;gCAC/C,mBAAmB,EAAE,EAAC,IAAI,EAAE,sBAAsB,EAAC;gCACnD,mBAAmB,EAAE,EAAC,IAAI,EAAE,sBAAsB,EAAC;gCACnD,kBAAkB,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;gCACjD,qBAAqB,EAAE,EAAC,IAAI,EAAE,wBAAwB,EAAC;gCACvD,oBAAoB,EAAE;oCACpB,IAAI,EAAE,uBAAuB;oCAC7B,WAAW,EAAE,CAAC,OAAsC,EAAU,EAAE,CAC9D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;iCACnC;gCACD,4BAA4B,EAAE;oCAC5B,IAAI,EAAE,+BAA+B;iCACtC;gCACD,4BAA4B,EAAE;oCAC5B,IAAI,EAAE,+BAA+B;iCACtC;gCACD,iCAAiC,EAAE;oCACjC,IAAI,EAAE,oCAAoC;iCAC3C;gCACD,sCAAsC,EAAE;oCACtC,IAAI,EAAE,yCAAyC;iCAChD;gCACD,qCAAqC,EAAE;oCACrC,IAAI,EAAE,wCAAwC;iCAC/C;gCACD,yBAAyB,EAAE,EAAC,IAAI,EAAE,4BAA4B,EAAC;gCAC/D,sBAAsB,EAAE,EAAC,IAAI,EAAE,yBAAyB,EAAC;gCACzD,2BAA2B,EAAE;oCAC3B,IAAI,EAAE,8BAA8B;iCACrC;gCAED,kBAAkB,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;gCACjD,oBAAoB,EAAE,EAAC,IAAI,EAAE,uBAAuB,EAAC;gCACrD,2BAA2B,EAAE;oCAC3B,IAAI,EAAE,8BAA8B;iCACrC;gCACD,uBAAuB,EAAE,EAAC,IAAI,EAAE,0BAA0B,EAAC;gCAC3D,8BAA8B,EAAE;oCAC9B,IAAI,EAAE,iCAAiC;iCACxC;gCACD,uBAAuB,EAAE,EAAC,IAAI,EAAE,0BAA0B,EAAC;gCAC3D,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;gCACvC,oBAAoB,EAAE,EAAC,IAAI,EAAE,uBAAuB,EAAC;6BACtD;4BACD,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,KAAK,EAAE,EAAC,WAAW,EAAE,QAAQ,EAAC;4BAC9B,EAAE,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC;4BACpB,IAAI,EAAE,EAAC,IAAI,EAAE,2BAA2B,EAAC;4BACzC,YAAY,EAAE;gCACZ;oCACE,IAAI,EAAE,EAAC,IAAI,EAAE,2BAA2B,EAAC;oCACzC,KAAK,EAAE,OAAO;iCACf;gCACD;oCACE,IAAI,EAAE,EAAC,IAAI,EAAE,8BAA8B,EAAC;oCAC5C,KAAK,EAAE,KAAK;iCACb;6BACF;4BACD,MAAM,EAAE;gCACN,IAAI,EAAE,wBAAwB;gCAC9B,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;6BAC3C;4BACD,IAAI,EAAE;gCACJ,WAAW,EAAE,CAAC,OAAgC,EAAU,EAAE,CACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;6BACnC;4BACD,OAAO,EAAE;gCACP;oCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;oCAE3C,SAAS,EAAE,EAAC,IAAI,EAAE,8BAA8B,EAAC;oCACjD,UAAU,EAAE,EAAC,IAAI,EAAE,kBAAkB,EAAC;iCACvC;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;YACD,WAAW,EAAE;gBACX,WAAW,EAAE,CAAC,IAA6B,EAA2B,EAAE;oBACtE,OAAO;wBACL,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC;qBACjC,CAAC;gBACJ,CAAC;aACF;SACF,CAAC;QAGA,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AA7ID,sDA6IC"}
+{"version":3,"file":"dependency-track-mapper.js","sourceRoot":"","sources":["../../src/dependency-track-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAK0B;AAC1B,8DAAyD;AACzD,2CAGwB;AAOxB,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,UAAU,EAAE,GAAG,CAAC;IACjB,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,MAAM,EAAE,CAAC,CAAC;IACX,CAAC,YAAY,EAAE,GAAG,CAAC;CACpB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,+BAAc,EAAE,CAAC;AAE9C,SAAS,QAAQ,CAAC,KAAe;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,OAAO,gBAAgB,CAAC,UAAU,CAChC,IAAI,EACJ,+CAAsC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,KAAK,EAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,IAAI,EAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,qBAAsB,SAAQ,8BAAa;IACtD,OAAO,CAAU;IAEjB,QAAQ,GAGJ;QACF,QAAQ,EAAE;YACR,IAAI,EAAE,EAAC,IAAI,EAAE,kBAAkB,EAAC;YAChC,OAAO,EAAE,EAAC,WAAW,EAAE,UAAU,EAAC;YAClC,SAAS,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;SAClC;QACD,OAAO,EAAE,sBAAoB;QAC7B,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;gBAC5B,OAAO,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAC;gBAClC,KAAK,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;gBAC7B,OAAO,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;gBACtC,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,UAAU;wBAChB,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE;4BACJ,2CAA2C;4BAC3C,MAAM,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,SAAS,EAAC;4BAC5D,QAAQ,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,EAAC;4BAChE,IAAI,EAAE;gCACJ,IAAI,EAAE,oBAAoB;gCAC1B,WAAW,EAAE,CAAC,IAAiB,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;6BAC9D;4BACD,GAAG,EAAE;gCACH,IAAI,EAAE,oBAAoB;gCAC1B,WAAW,EAAE,CAAC,IAAiB,EAAE,EAAE,CACjC,IAAA,2BAAkB,EAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;6BAChD;4BACD,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;4BACvC,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;4BACvC,cAAc,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAC;4BACzC,gBAAgB,EAAE,EAAC,IAAI,EAAE,mBAAmB,EAAC;4BAC7C,sBAAsB,EAAE,EAAC,IAAI,EAAE,yBAAyB,EAAC;4BACzD,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;4BACvC,YAAY,EAAE,EAAC,IAAI,EAAE,eAAe,EAAC;4BACrC,gBAAgB,EAAE,EAAC,IAAI,EAAE,mBAAmB,EAAC;4BAC7C,iBAAiB,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAC;4BAC/C,mBAAmB,EAAE,EAAC,IAAI,EAAE,sBAAsB,EAAC;4BACnD,mBAAmB,EAAE,EAAC,IAAI,EAAE,sBAAsB,EAAC;4BACnD,kBAAkB,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;4BACjD,qBAAqB,EAAE,EAAC,IAAI,EAAE,wBAAwB,EAAC;4BACvD,oBAAoB,EAAE;gCACpB,IAAI,EAAE,uBAAuB;gCAC7B,WAAW,EAAE,CAAC,OAAsC,EAAU,EAAE,CAC9D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;6BACnC;4BACD,4BAA4B,EAAE;gCAC5B,IAAI,EAAE,+BAA+B;6BACtC;4BACD,4BAA4B,EAAE;gCAC5B,IAAI,EAAE,+BAA+B;6BACtC;4BACD,iCAAiC,EAAE;gCACjC,IAAI,EAAE,oCAAoC;6BAC3C;4BACD,sCAAsC,EAAE;gCACtC,IAAI,EAAE,yCAAyC;6BAChD;4BACD,qCAAqC,EAAE;gCACrC,IAAI,EAAE,wCAAwC;6BAC/C;4BACD,yBAAyB,EAAE,EAAC,IAAI,EAAE,4BAA4B,EAAC;4BAC/D,sBAAsB,EAAE,EAAC,IAAI,EAAE,yBAAyB,EAAC;4BACzD,2BAA2B,EAAE;gCAC3B,IAAI,EAAE,8BAA8B;6BACrC;4BACD,yDAAyD;4BACzD,kBAAkB,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;4BACjD,oBAAoB,EAAE,EAAC,IAAI,EAAE,uBAAuB,EAAC;4BACrD,2BAA2B,EAAE;gCAC3B,IAAI,EAAE,8BAA8B;6BACrC;4BACD,uBAAuB,EAAE,EAAC,IAAI,EAAE,0BAA0B,EAAC;4BAC3D,8BAA8B,EAAE;gCAC9B,IAAI,EAAE,iCAAiC;6BACxC;4BACD,uBAAuB,EAAE,EAAC,IAAI,EAAE,0BAA0B,EAAC;4BAC3D,aAAa,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;4BACvC,oBAAoB,EAAE,EAAC,IAAI,EAAE,uBAAuB,EAAC;yBACtD;wBACD,IAAI,EAAE,EAAE;wBACR,eAAe,EAAE,EAAE;wBACnB,KAAK,EAAE,EAAC,WAAW,EAAE,QAAQ,EAAC;wBAC9B,EAAE,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC;wBACpB,IAAI,EAAE,EAAC,IAAI,EAAE,2BAA2B,EAAC;wBACzC,YAAY,EAAE;4BACZ;gCACE,IAAI,EAAE,EAAC,IAAI,EAAE,2BAA2B,EAAC;gCACzC,KAAK,EAAE,OAAO;6BACf;4BACD;gCACE,IAAI,EAAE,EAAC,IAAI,EAAE,8BAA8B,EAAC;gCAC5C,KAAK,EAAE,KAAK;6BACb;yBACF;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,wBAAwB;4BAC9B,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;yBAC3C;wBACD,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,OAAgC,EAAU,EAAE,CACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;yBACnC;wBACD,OAAO,EAAE;4BACP;gCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;gCAC3C,qDAAqD;gCACrD,SAAS,EAAE,EAAC,IAAI,EAAE,8BAA8B,EAAC;gCACjD,UAAU,EAAE,EAAC,IAAI,EAAE,kBAAkB,EAAC;6BACvC;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE;aACX;SACF;QACD,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,IAA6B,EAA2B,EAAE;gBACtE,OAAO;oBACL,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC;iBACjC,CAAC;YACJ,CAAC;SACF;KACF,CAAC;IACF,YAAY,MAAc,EAAE,OAAO,GAAG,KAAK;QACzC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AA7ID,sDA6IC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport * as _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {\n  BaseConverter,\n  ILookupPath,\n  impactMapping,\n  MappedTransform\n} from './base-converter';\nimport {CweNistMapping} from './mappings/CweNistMapping';\nimport {\n  DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS,\n  getCCIsForNISTTags\n} from './utils/global';\n\ninterface ICweEntry {\n  cweId: number;\n  name: string;\n}\n\nconst IMPACT_MAPPING: Map<string, number> = new Map([\n  ['critical', 0.9],\n  ['high', 0.7],\n  ['medium', 0.5],\n  ['low', 0.3],\n  ['info', 0],\n  ['unassigned', 0.5]\n]);\nconst CWE_NIST_MAPPING = new CweNistMapping();\n\nfunction nistTags(input: number[]): string[] {\n  const cwes = input.map((cweId: number) => cweId.toString());\n  return CWE_NIST_MAPPING.nistFilter(\n    cwes,\n    DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS\n  );\n}\n\nfunction getVersion(file: unknown): string {\n  return `${_.get(file, 'version')} ${_.get(file, 'meta.version')}`;\n}\n\nfunction getTitle(finding: unknown) {\n  const title = _.get(finding, 'vulnerability.title');\n  return `${_.get(finding, 'component.purl')}${title ? ' - ' + title : ''}`;\n}\n\nfunction getCweIds(cwes: ICweEntry[] | undefined) {\n  if (!cwes) {\n    return [];\n  }\n  return cwes.map(({cweId}) => cweId);\n}\n\nfunction getCweNames(cwes: ICweEntry[] | undefined) {\n  if (!cwes) {\n    return [];\n  }\n  return cwes.map(({name}) => name);\n}\n\nexport class DependencyTrackMapper extends BaseConverter {\n  withRaw: boolean;\n\n  mappings: MappedTransform<\n    ExecJSON.Execution & {passthrough: unknown},\n    ILookupPath\n  > = {\n    platform: {\n      name: {path: 'meta.application'},\n      release: {transformer: getVersion},\n      target_id: {path: 'meta.baseUrl'}\n    },\n    version: HeimdallToolsVersion,\n    statistics: {},\n    profiles: [\n      {\n        name: {path: 'project.uuid'},\n        version: {path: 'project.version'},\n        title: {path: 'project.name'},\n        summary: {path: 'project.description'},\n        supports: [],\n        attributes: [],\n        groups: [],\n        status: 'loaded',\n        controls: [\n          {\n            path: 'findings',\n            key: 'id',\n            tags: {\n              // cwes not always present in vulnerability\n              cweIds: {path: 'vulnerability.cwes', transformer: getCweIds},\n              cweNames: {path: 'vulnerability.cwes', transformer: getCweNames},\n              nist: {\n                path: 'vulnerability.cwes',\n                transformer: (cwes: ICweEntry[]) => nistTags(getCweIds(cwes))\n              },\n              cci: {\n                path: 'vulnerability.cwes',\n                transformer: (cwes: ICweEntry[]) =>\n                  getCCIsForNISTTags(nistTags(getCweIds(cwes)))\n              },\n              componentUuid: {path: 'component.uuid'},\n              componentName: {path: 'component.name'},\n              componentGroup: {path: 'component.group'},\n              componentVersion: {path: 'component.version'},\n              componentLatestVersion: {path: 'component.latestVersion'},\n              componentPurl: {path: 'component.purl'},\n              componentCpe: {path: 'component.cpe'},\n              componentProject: {path: 'component.project'},\n              vulnerabilityUuid: {path: 'vulnerability.uuid'},\n              vulnerabilitySource: {path: 'vulnerability.source'},\n              vulnerabilityVulnId: {path: 'vulnerability.vulnId'},\n              vulnerabilityTitle: {path: 'vulnerability.title'},\n              vulnerabilitySubtitle: {path: 'vulnerability.subtitle'},\n              vulnerabilityAliases: {\n                path: 'vulnerability.aliases',\n                transformer: (aliases: Array<Record<string, string>>): string =>\n                  JSON.stringify(aliases, null, 2)\n              },\n              vulnerabilityCvssV2BaseScore: {\n                path: 'vulnerability.cvssV2BaseScore'\n              },\n              vulnerabilityCvssV3BaseScore: {\n                path: 'vulnerability.cvssV3BaseScore'\n              },\n              vulnerabilityOwaspLikelihoodScore: {\n                path: 'vulnerability.owaspLikelihoodScore'\n              },\n              vulnerabilityOwaspTechnicalImpactScore: {\n                path: 'vulnerability.owaspTechnicalImpactScore'\n              },\n              vulnerabilityOwaspBusinessImpactScore: {\n                path: 'vulnerability.owaspBusinessImpactScore'\n              },\n              vulnerabilitySeverityRank: {path: 'vulnerability.severityRank'},\n              vulnerabilityEpssScore: {path: 'vulnerability.epssScore'},\n              vulnerabilityEpssPercentile: {\n                path: 'vulnerability.epssPercentile'\n              },\n              // Schema is deprecating these attributes: cweId, cweName\n              vulnerabilityCweId: {path: 'vulnerability.cweId'},\n              vulnerabilityCweName: {path: 'vulnerability.cweName'},\n              attributionAnalyzerIdentity: {\n                path: 'attribution.analyzerIdentity'\n              },\n              attributionAttributedOn: {path: 'attribution.attributedOn'},\n              attributionAlternateIdentifier: {\n                path: 'attribution.alternateIdentifier'\n              },\n              attributionReferenceUrl: {path: 'attribution.referenceUrl'},\n              analysisState: {path: 'analysis.state'},\n              analysisIsSuppressed: {path: 'analysis.isSuppressed'}\n            },\n            refs: [],\n            source_location: {},\n            title: {transformer: getTitle},\n            id: {path: 'matrix'},\n            desc: {path: 'vulnerability.description'},\n            descriptions: [\n              {\n                data: {path: 'vulnerability.description'},\n                label: 'check'\n              },\n              {\n                data: {path: 'vulnerability.recommendation'},\n                label: 'fix'\n              }\n            ],\n            impact: {\n              path: 'vulnerability.severity',\n              transformer: impactMapping(IMPACT_MAPPING)\n            },\n            code: {\n              transformer: (finding: Record<string, unknown>): string =>\n                JSON.stringify(finding, null, 2)\n            },\n            results: [\n              {\n                status: ExecJSON.ControlResultStatus.Failed,\n                // recommendation not always present in vulnerability\n                code_desc: {path: 'vulnerability.recommendation'},\n                start_time: {path: '$.meta.timestamp'}\n              }\n            ]\n          }\n        ],\n        sha256: ''\n      }\n    ],\n    passthrough: {\n      transformer: (data: Record<string, unknown>): Record<string, unknown> => {\n        return {\n          ...(this.withRaw && {raw: data})\n        };\n      }\n    }\n  };\n  constructor(dtJson: string, withRaw = false) {\n    super(JSON.parse(dtJson));\n    this.withRaw = withRaw;\n  }\n}\n"]}

package/lib/src/fortify-mapper.d.ts

@@ -1,5 +1,11 @@
 import { ExecJSON } from 'inspecjs';
 import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
+export declare class FortifyResults {
+    readonly fvdl: string;
+    readonly withRaw: boolean;
+    constructor(fvdl: string, withRaw?: boolean);
+    toHdf(): Promise<ExecJSON.Execution>;
+}
 export declare class FortifyMapper extends BaseConverter {
     startTime: string;
     withRaw: boolean;
@@ -8,3 +14,4 @@ export declare class FortifyMapper extends BaseConverter {
     }, ILookupPath>;
     constructor(fvdl: string, withRaw?: boolean);
 }
+//# sourceMappingURL=fortify-mapper.d.ts.map

package/lib/src/fortify-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fortify-mapper.d.ts","sourceRoot":"","sources":["../../src/fortify-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EAGhB,MAAM,kBAAkB,CAAC;AAgH1B,qBAAa,cAAc;IACb,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,OAAO;gBAA9B,IAAI,EAAE,MAAM,EAAW,OAAO,UAAQ;IAErD,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;CAK3C;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,SAAS,GAAG;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,EAC3C,WAAW,CACZ,CAqFC;gBACU,IAAI,EAAE,MAAM,EAAE,OAAO,UAAQ;CAY1C"}

package/lib/src/fortify-mapper.js

@@ -15,15 +15,25 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FortifyMapper = void 0;
+exports.FortifyMapper = exports.FortifyResults = void 0;
 const inspecjs_1 = require("inspecjs");
 const _ = __importStar(require("lodash"));
 const package_json_1 = require("../package.json");
@@ -31,6 +41,7 @@ const base_converter_1 = require("./base-converter");
 const global_1 = require("./utils/global");
 const NIST_REFERENCE_NAME = 'Standards Mapping - NIST Special Publication 800-53 Revision 4';
 const DEFAULT_NIST_TAG = [];
+let parseHtml;
 function impactMapping(input, id) {
     if (Array.isArray(input)) {
         const matches = input.find((element) => {
@@ -111,96 +122,111 @@ function filterVuln(input, file) {
     });
     return input;
 }
-class FortifyMapper extends base_converter_1.BaseConverter {
+class FortifyResults {
+    fvdl;
+    withRaw;
     constructor(fvdl, withRaw = false) {
-        super((0, base_converter_1.parseXml)(fvdl, {
-            stopNodes: ['FVDL.Description.Abstract', 'FVDL.Description.Explanation']
-        }));
-        this.mappings = {
-            platform: {
-                name: 'Heimdall Tools',
-                release: package_json_1.version
-            },
-            version: package_json_1.version,
-            statistics: {},
-            profiles: [
-                {
-                    name: 'Fortify Static Analyzer Scan',
-                    version: { path: 'FVDL.EngineData.EngineVersion' },
-                    title: 'Fortify Static Analyzer Scan',
-                    summary: {
-                        path: 'FVDL.UUID',
-                        transformer: (uuid) => {
-                            return `Fortify Static Analyzer Scan of UUID: ${uuid}`;
-                        }
-                    },
-                    supports: [],
-                    attributes: [],
-                    groups: [],
-                    status: 'loaded',
-                    controls: [
-                        {
-                            arrayTransformer: filterVuln,
-                            path: 'FVDL.Description',
-                            key: 'id',
-                            tags: {
-                                nist: { transformer: nistTag },
-                                cci: {
-                                    transformer: (data) => (0, global_1.getCCIsForNISTTags)(nistTag(data))
-                                }
-                            },
-                            refs: [],
-                            source_location: {},
-                            title: { path: 'Abstract', transformer: base_converter_1.parseHtml },
-                            id: { path: 'classID' },
-                            desc: { path: 'Explanation', transformer: base_converter_1.parseHtml },
-                            impact: { path: '$.FVDL.Vulnerabilities.Vulnerability' },
-                            code: {
-                                transformer: (vulnerability) => {
-                                    return JSON.stringify(vulnerability, null, 2);
-                                }
-                            },
-                            results: [
-                                {
-                                    path: '$.FVDL.Snippets.Snippet',
-                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                    code_desc: { transformer: processEntry },
-                                    start_time: {
-                                        path: '$.FVDL.CreatedTS',
-                                        transformer: (input) => {
-                                            return `${_.get(input, 'date')} ${_.get(input, 'time')}`;
-                                        }
-                                    }
-                                }
-                            ]
-                        }
-                    ],
-                    sha256: ''
-                }
-            ],
-            passthrough: {
-                transformer: (data) => {
-                    let auxData = _.get(data, 'FVDL');
-                    if (_.isObject(auxData)) {
-                        auxData = _.omit(auxData, [
-                            'CreatedTS',
-                            'UUID',
-                            'Description',
-                            'Snippets'
-                        ]);
+        this.fvdl = fvdl;
+        this.withRaw = withRaw;
+    }
+    async toHdf() {
+        parseHtml = await (0, base_converter_1.buildParseHtmlFunc)();
+        return (new FortifyMapper(this.fvdl, this.withRaw)).toHdf();
+    }
+}
+exports.FortifyResults = FortifyResults;
+class FortifyMapper extends base_converter_1.BaseConverter {
+    startTime;
+    withRaw;
+    mappings = {
+        platform: {
+            name: 'Heimdall Tools',
+            release: package_json_1.version
+        },
+        version: package_json_1.version,
+        statistics: {},
+        profiles: [
+            {
+                name: 'Fortify Static Analyzer Scan',
+                version: { path: 'FVDL.EngineData.EngineVersion' },
+                title: 'Fortify Static Analyzer Scan',
+                summary: {
+                    path: 'FVDL.UUID',
+                    transformer: (uuid) => {
+                        return `Fortify Static Analyzer Scan of UUID: ${uuid}`;
                     }
-                    return {
-                        auxiliary_data: [
+                },
+                supports: [],
+                attributes: [],
+                groups: [],
+                status: 'loaded',
+                controls: [
+                    {
+                        arrayTransformer: filterVuln,
+                        path: 'FVDL.Description',
+                        key: 'id',
+                        tags: {
+                            nist: { transformer: nistTag },
+                            cci: {
+                                transformer: (data) => (0, global_1.getCCIsForNISTTags)(nistTag(data))
+                            }
+                        },
+                        refs: [],
+                        source_location: {},
+                        title: { path: 'Abstract', transformer: parseHtml }, // there are embedded nodes that do not show up properly
+                        id: { path: 'classID' },
+                        desc: { path: 'Explanation', transformer: parseHtml },
+                        impact: { path: '$.FVDL.Vulnerabilities.Vulnerability' },
+                        code: {
+                            transformer: (vulnerability) => {
+                                return JSON.stringify(vulnerability, null, 2);
+                            }
+                        },
+                        results: [
                             {
-                                name: 'Fortify',
-                                data: { FVDL: auxData }
+                                path: '$.FVDL.Snippets.Snippet',
+                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
+                                code_desc: { transformer: processEntry },
+                                start_time: {
+                                    path: '$.FVDL.CreatedTS',
+                                    transformer: (input) => {
+                                        return `${_.get(input, 'date')} ${_.get(input, 'time')}`;
+                                    }
+                                }
                             }
-                        ],
-                        ...(this.withRaw && { raw: data })
-                    };
+                        ]
+                    }
+                ],
+                sha256: ''
+            }
+        ],
+        passthrough: {
+            transformer: (data) => {
+                let auxData = _.get(data, 'FVDL');
+                if (_.isObject(auxData)) {
+                    auxData = _.omit(auxData, [
+                        'CreatedTS',
+                        'UUID',
+                        'Description',
+                        'Snippets'
+                    ]);
                 }
+                return {
+                    auxiliary_data: [
+                        {
+                            name: 'Fortify',
+                            data: { FVDL: auxData }
+                        }
+                    ],
+                    ...(this.withRaw && { raw: data })
+                };
             }
-        };
+        }
+    };
+    constructor(fvdl, withRaw = false) {
+        super((0, base_converter_1.parseXml)(fvdl, {
+            stopNodes: ['FVDL.Description.Abstract', 'FVDL.Description.Explanation']
+        }));
         this.startTime = `${_.get(this.data, 'FVDL.CreatedTS.date')} ${_.get(this.data, 'FVDL.CreatedTS.time')}`;
         this.withRaw = withRaw;
     }