@mitre/hdf-converters 2.13.0 → 3.0.0

package/lib/src/conveyor-mapper.js

@@ -1,255 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConveyorResults = exports.ConveyorMapper = void 0;
-const inspecjs_1 = require("inspecjs");
-const _ = __importStar(require("lodash"));
-const package_json_1 = require("../package.json");
-const base_converter_1 = require("./base-converter");
-const global_1 = require("./utils/global");
-const CONVEYOR_MAX_SCORE = 1000;
-var scannerType;
-(function (scannerType) {
-    scannerType["ClamAV"] = "Clamav";
-    scannerType["CodeQuality"] = "CodeQuality";
-    scannerType["Moldy"] = "Moldy";
-    scannerType["Stigma"] = "Stigma";
-})(scannerType || (scannerType = {}));
-/*
-Uses score to determine pass or fail. Non-zero score is fail
-*/
-function determineStatus(score) {
-    if (score === 0) {
-        return inspecjs_1.ExecJSON.ControlResultStatus.Passed;
-    }
-    return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
-}
-/*
-Groups findings by scanner (service) for final json
-*/
-function groupByScanner(processed) {
-    const groups = _.groupBy(processed, (result) => {
-        return _.get(result, 'response.service_name');
-    });
-    return groups;
-}
-/*
-Goes through api_response.file_tree finding children of each file(sorted by hash), pulling out
-filename sha pairs
-*/
-function collateShaAndFilenames(currLevel) {
-    const shaFilePairs = [];
-    for (const [sha, file] of Object.entries(currLevel)) {
-        if (_.has(file, 'name')) {
-            //name always array of size 1
-            const name = _.get(file, 'name[0]') || '';
-            shaFilePairs.push([sha, name]);
-        }
-        if (_.has(file, 'children')) {
-            const nextLevel = _.get(file, 'children') || {};
-            for (const nextLevelPairs of collateShaAndFilenames(nextLevel)) {
-                shaFilePairs.push(nextLevelPairs);
-            }
-        }
-    }
-    return shaFilePairs;
-}
-/*
-Uses file_tree from json to build map of hash values to filenames
-*/
-function mapSha2Filename(results) {
-    const toplevel = _.get(results, 'api_response.file_tree');
-    const shaMappings = {};
-    const shaFilePairs = collateShaAndFilenames(toplevel);
-    for (const [sha, filename] of shaFilePairs) {
-        _.set(shaMappings, sha || '', filename || '');
-    }
-    return shaMappings;
-}
-/*
-Builds the code_desc field using values from data. Varies based on service
-*/
-function createDescription(data, score, date, scannerName, endTime) {
-    const desc = () => {
-        if (scannerName === scannerType.Moldy ||
-            scannerName === scannerType.Stigma ||
-            scannerName === scannerType.ClamAV) {
-            return `title_text:${_.get(data, 'title_text')}
-      body:${_.get(data, 'body')}
-      body_format:${_.get(data, 'body_format')}
-      classificaton:${_.get(data, 'classification')}
-      depth:${_.get(data, 'depth')}
-      heuristic_heur_id:${_.get(data, 'heuristic.heur_id')}
-      heuristic_score:${_.get(data, 'heuristic.score')}
-      heuristic_name:${_.get(data, 'heuristic.name')}`.replace('\\"', '');
-        }
-        else if (scannerName === scannerType.CodeQuality) {
-            return `body:${_.get(data, 'body')}
-      body_format:${_.get(data, 'body_format')}
-      classificaton:${_.get(data, 'classification')}
-      depth:${_.get(data, 'depth')}
-      title_text:${_.get(data, 'title_text')}`.replace('\\"', '');
-        }
-        else {
-            return JSON.stringify(data).replace('\\"', '');
-        }
-    };
-    return {
-        status: determineStatus(score),
-        code_desc: desc(),
-        start_time: date,
-        run_time: new Date(endTime).valueOf() - new Date(date).valueOf()
-    };
-}
-/*
-parsed - parsed conveyor data
-mappings - sha to file name mappings
-sets new variable in each api_response.result: filename and sets it to the filename
-mapped to its sha value. Then it transforms the result.sections property to
-have properly formatted HDF controls
-*/
-function preprocessObject(parsed, mappings) {
-    const results = _.get(parsed, 'api_response.results');
-    const newSections = [];
-    for (const result of Object.values(results)) {
-        const sha = _.get(result, 'sha256', '');
-        _.set(result, 'filename', _.get(mappings, sha));
-        const descriptions = _.map(_.get(result, 'result.sections'), (section) => createDescription(section, _.get(result, 'result.score'), _.get(result, 'response.milestones.service_started'), _.get(result, 'response.service_name'), _.get(result, 'response.milestones.service_completed')));
-        _.set(result, 'result.sections', descriptions);
-        newSections.push(result);
-    }
-    return newSections;
-}
-/*
-Builds everything under profiles.controls using results.sections data from Conveyor JSON.
-*/
-function controlMappingConveyor() {
-    return {
-        id: { path: 'sha256' }, // sha256 of file analyzed
-        title: { path: 'filename' }, // Name of file scanned per Conveyor. Will include conveyor-generated files (.clamav, .moldy, etc)
-        desc: '', // Empty placeholder
-        impact: {
-            path: 'result.score', // Score from Conveyor
-            transformer: (value) => {
-                return value / CONVEYOR_MAX_SCORE; // normalize score from Conveyor
-            }
-        },
-        refs: [],
-        tags: {
-            service_context: { path: 'response.service_context' },
-            service_debug_info: { path: 'response.service_debug_info' },
-            service_tool_version: { path: 'response.service_tool_version' },
-            supplementary: { path: 'response.supplementary' },
-            created: { path: 'created' },
-            archive_ts: { path: 'archive_ts' },
-            classification: { path: 'classification' },
-            expiry_ts: { path: 'expiry_ts' },
-            size: { path: 'size' },
-            type: { path: 'type' },
-            nist: global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS,
-            cci: global_1.DEFAULT_STATIC_CODE_ANALYSIS_CCI_TAGS
-        },
-        source_location: {},
-        results: [
-            // Data from heuristics and scan supplemental data
-            {
-                path: 'result.sections',
-                status: { path: 'status' },
-                code_desc: { path: 'code_desc' },
-                start_time: { path: 'start_time' },
-                run_time: { path: 'run_time' }
-            }
-        ]
-    };
-}
-/*
-Builds profile portion of HDF results. Uses date at results level of Conveyor JSON
-*/
-class ConveyorMapper extends base_converter_1.BaseConverter {
-    scannerName;
-    mappings = {
-        passthrough: { path: 'api_response' },
-        platform: {
-            name: 'Heimdall Tools',
-            release: package_json_1.version
-        },
-        version: { path: 'api_server_version' },
-        statistics: {},
-        profiles: [
-            // Each profile is service's results
-            {
-                name: { path: 'api_response.results[0].response.service_name' },
-                sha256: '',
-                version: { path: 'api_response.results[0].response.service_version' },
-                title: { path: 'api_response.params.description' },
-                supports: [],
-                attributes: [],
-                groups: [],
-                status: 'loaded',
-                controls: [
-                    // Each control is a service/file result pair
-                    {
-                        path: 'api_response.results',
-                        ...controlMappingConveyor()
-                    }
-                ]
-            }
-        ]
-    };
-    constructor(remappedConveyorResults, data, scannerName) {
-        _.set(data, 'api_response.results', remappedConveyorResults);
-        super(data);
-        this.scannerName = scannerName;
-    }
-}
-exports.ConveyorMapper = ConveyorMapper;
-class ConveyorResults {
-    data;
-    constructor(conveyorJson) {
-        const parsed = JSON.parse(conveyorJson);
-        const mappings = mapSha2Filename(parsed);
-        const processed = preprocessObject(parsed, mappings);
-        this.data = _.set(parsed, 'api_response.results', groupByScanner(processed));
-    }
-    toHdf() {
-        const scannerRecordInput = Object.entries(_.get(this.data, 'api_response.results')).map(([scannerName, scannerData]) => [
-            scannerName,
-            new ConveyorMapper(scannerData, this.data, scannerName).toHdf()
-        ]);
-        return Object.fromEntries(scannerRecordInput);
-    }
-}
-exports.ConveyorResults = ConveyorResults;
-//# sourceMappingURL=conveyor-mapper.js.map

package/lib/src/conveyor-mapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"conveyor-mapper.js","sourceRoot":"","sources":["../../src/conveyor-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAA6E;AAC7E,2CAGwB;AACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,IAAK,WAKJ;AALD,WAAK,WAAW;IACd,gCAAiB,CAAA;IACjB,0CAA2B,CAAA;IAC3B,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EALI,WAAW,KAAX,WAAW,QAKf;AAED;;EAEE;AACF,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC;IAC7C,CAAC;IACD,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC;AAC7C,CAAC;AAED;;EAEE;AACF,SAAS,cAAc,CACrB,SAAoC;IAEpC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7C,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;EAGE;AACF,SAAS,sBAAsB,CAC7B,SAAkC;IAElC,MAAM,YAAY,GAAe,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YACxB,6BAA6B;YAC7B,MAAM,IAAI,GAAW,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,SAAS,GAA4B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;YACzE,KAAK,MAAM,cAAc,IAAI,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;EAEE;AACF,SAAS,eAAe,CACtB,OAAgC;IAEhC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAGvD,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AACD;;EAEE;AACF,SAAS,iBAAiB,CACxB,IAA6B,EAC7B,KAAa,EACb,IAAY,EACZ,WAAmB,EACnB,OAAe;IAEf,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IACE,WAAW,KAAK,WAAW,CAAC,KAAK;YACjC,WAAW,KAAK,WAAW,CAAC,MAAM;YAClC,WAAW,KAAK,WAAW,CAAC,MAAM,EAClC,CAAC;YACD,OAAO,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAW;aACjD,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;oBACZ,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAW;sBAClC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAW;cAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAW;0BAClB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAW;wBAC5C,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAW;uBACzC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAW,EAAE,CAAC,OAAO,CAChE,KAAK,EACL,EAAE,CACH,CAAC;QACJ,CAAC;aAAM,IAAI,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;YACnD,OAAO,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;oBACpB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAW;sBAClC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAW;cAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAW;mBACzB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAC9B,SAAS,EAAE,IAAI,EAAE;QACjB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;EAME;AACF,SAAS,gBAAgB,CACvB,MAA+B,EAC/B,QAAiC;IAEjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAGnD,CAAC;IACF,MAAM,WAAW,GAA8B,EAAE,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAW,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAW,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CACxB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAA8B,EAC7D,CAAC,OAAO,EAAE,EAAE,CACV,iBAAiB,CACf,OAAkC,EAClC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAW,EACvC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,qCAAqC,CAAW,EAC9D,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAW,EAChD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,uCAAuC,CAAW,CACjE,CACJ,CAAC;QACF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC/C,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;EAEE;AACF,SAAS,sBAAsB;IAI7B,OAAO;QACL,EAAE,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC,EAAE,0BAA0B;QAChD,KAAK,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC,EAAE,kGAAkG;QAC7H,IAAI,EAAE,EAAE,EAAE,oBAAoB;QAC9B,MAAM,EAAE;YACN,IAAI,EAAE,cAAc,EAAE,sBAAsB;YAC5C,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,OAAO,KAAK,GAAG,kBAAkB,CAAC,CAAC,gCAAgC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,EAAE;QACR,IAAI,EAAE;YACJ,eAAe,EAAE,EAAC,IAAI,EAAE,0BAA0B,EAAC;YACnD,kBAAkB,EAAE,EAAC,IAAI,EAAE,6BAA6B,EAAC;YACzD,oBAAoB,EAAE,EAAC,IAAI,EAAE,+BAA+B,EAAC;YAC7D,aAAa,EAAE,EAAC,IAAI,EAAE,wBAAwB,EAAC;YAC/C,OAAO,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC;YAC1B,UAAU,EAAE,EAAC,IAAI,EAAE,YAAY,EAAC;YAChC,cAAc,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAC;YACxC,SAAS,EAAE,EAAC,IAAI,EAAE,WAAW,EAAC;YAC9B,IAAI,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;YACpB,IAAI,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;YACpB,IAAI,EAAE,+CAAsC;YAC5C,GAAG,EAAE,8CAAqC;SAC3C;QACD,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE;YACP,kDAAkD;YAClD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC;gBACxB,SAAS,EAAE,EAAC,IAAI,EAAE,WAAW,EAAC;gBAC9B,UAAU,EAAE,EAAC,IAAI,EAAE,YAAY,EAAC;gBAChC,QAAQ,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC;aAC7B;SACF;KACF,CAAC;AACJ,CAAC;AAED;;EAEE;AACF,MAAa,cAAe,SAAQ,8BAAa;IAC/C,WAAW,CAAS;IACpB,QAAQ,GAGJ;QACF,WAAW,EAAE,EAAC,IAAI,EAAE,cAAc,EAAC;QACnC,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sBAAoB;SAC9B;QACD,OAAO,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAC;QACrC,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE;YACR,oCAAoC;YACpC;gBACE,IAAI,EAAE,EAAC,IAAI,EAAE,+CAA+C,EAAC;gBAC7D,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,EAAC,IAAI,EAAE,kDAAkD,EAAC;gBACnE,KAAK,EAAE,EAAC,IAAI,EAAE,iCAAiC,EAAC;gBAChD,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR,6CAA6C;oBAC7C;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,GAAG,sBAAsB,EAAE;qBAC5B;iBACF;aACF;SACF;KACF,CAAC;IACF,YACE,uBAAgD,EAChD,IAA6B,EAC7B,WAAmB;QAEnB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA3CD,wCA2CC;AAED,MAAa,eAAe;IAC1B,IAAI,CAA0B;IAC9B,YAAY,YAAoB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CACf,MAAM,EACN,sBAAsB,EACtB,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED,KAAK;QACH,MAAM,kBAAkB,GACtB,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAA4B,CAEtE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;YACpC,WAAW;YACX,IAAI,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,KAAK,EAAE;SAChE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;CACF;AAxBD,0CAwBC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport * as _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {BaseConverter, ILookupPath, MappedTransform} from './base-converter';\nimport {\n  DEFAULT_STATIC_CODE_ANALYSIS_CCI_TAGS,\n  DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS\n} from './utils/global';\nconst CONVEYOR_MAX_SCORE = 1000;\nenum scannerType {\n  ClamAV = 'Clamav',\n  CodeQuality = 'CodeQuality',\n  Moldy = 'Moldy',\n  Stigma = 'Stigma'\n}\n\n/*\nUses score to determine pass or fail. Non-zero score is fail\n*/\nfunction determineStatus(score: number): ExecJSON.ControlResultStatus {\n  if (score === 0) {\n    return ExecJSON.ControlResultStatus.Passed;\n  }\n  return ExecJSON.ControlResultStatus.Failed;\n}\n\n/*\nGroups findings by scanner (service) for final json\n*/\nfunction groupByScanner(\n  processed: Record<string, unknown>[]\n): Record<string, unknown> {\n  const groups = _.groupBy(processed, (result) => {\n    return _.get(result, 'response.service_name');\n  });\n  return groups;\n}\n\n/*\nGoes through api_response.file_tree finding children of each file(sorted by hash), pulling out \nfilename sha pairs\n*/\nfunction collateShaAndFilenames(\n  currLevel: Record<string, unknown>\n): string[][] {\n  const shaFilePairs: string[][] = [];\n  for (const [sha, file] of Object.entries(currLevel)) {\n    if (_.has(file, 'name')) {\n      //name always array of size 1\n      const name: string = _.get(file, 'name[0]') || '';\n      shaFilePairs.push([sha, name]);\n    }\n    if (_.has(file, 'children')) {\n      const nextLevel: Record<string, unknown> = _.get(file, 'children') || {};\n      for (const nextLevelPairs of collateShaAndFilenames(nextLevel)) {\n        shaFilePairs.push(nextLevelPairs);\n      }\n    }\n  }\n  return shaFilePairs;\n}\n\n/*\nUses file_tree from json to build map of hash values to filenames\n*/\nfunction mapSha2Filename(\n  results: Record<string, unknown>\n): Record<string, unknown> {\n  const toplevel = _.get(results, 'api_response.file_tree') as Record<\n    string,\n    unknown\n  >;\n  const shaMappings = {};\n  const shaFilePairs = collateShaAndFilenames(toplevel);\n  for (const [sha, filename] of shaFilePairs) {\n    _.set(shaMappings, sha || '', filename || '');\n  }\n  return shaMappings;\n}\n/*\nBuilds the code_desc field using values from data. Varies based on service\n*/\nfunction createDescription(\n  data: Record<string, unknown>,\n  score: number,\n  date: string,\n  scannerName: string,\n  endTime: string\n): Record<string, unknown> {\n  const desc = () => {\n    if (\n      scannerName === scannerType.Moldy ||\n      scannerName === scannerType.Stigma ||\n      scannerName === scannerType.ClamAV\n    ) {\n      return `title_text:${_.get(data, 'title_text') as string}\n      body:${_.get(data, 'body')}\n      body_format:${_.get(data, 'body_format') as string}\n      classificaton:${_.get(data, 'classification') as string}\n      depth:${_.get(data, 'depth') as string}\n      heuristic_heur_id:${_.get(data, 'heuristic.heur_id') as string}\n      heuristic_score:${_.get(data, 'heuristic.score') as string}\n      heuristic_name:${_.get(data, 'heuristic.name') as string}`.replace(\n        '\\\\\"',\n        ''\n      );\n    } else if (scannerName === scannerType.CodeQuality) {\n      return `body:${_.get(data, 'body')}\n      body_format:${_.get(data, 'body_format') as string}\n      classificaton:${_.get(data, 'classification') as string}\n      depth:${_.get(data, 'depth') as string}\n      title_text:${_.get(data, 'title_text') as string}`.replace('\\\\\"', '');\n    } else {\n      return JSON.stringify(data).replace('\\\\\"', '');\n    }\n  };\n  return {\n    status: determineStatus(score),\n    code_desc: desc(),\n    start_time: date,\n    run_time: new Date(endTime).valueOf() - new Date(date).valueOf()\n  };\n}\n\n/*\nparsed - parsed conveyor data\nmappings - sha to file name mappings \nsets new variable in each api_response.result: filename and sets it to the filename \nmapped to its sha value. Then it transforms the result.sections property to \nhave properly formatted HDF controls \n*/\nfunction preprocessObject(\n  parsed: Record<string, unknown>,\n  mappings: Record<string, unknown>\n): Record<string, unknown>[] {\n  const results = _.get(parsed, 'api_response.results') as Record<\n    string,\n    Record<string, unknown>\n  >;\n  const newSections: Record<string, unknown>[] = [];\n  for (const result of Object.values(results)) {\n    const sha: string = _.get(result, 'sha256', '') as string;\n    _.set(result, 'filename', _.get(mappings, sha));\n    const descriptions = _.map(\n      _.get(result, 'result.sections') as Record<string, unknown>[],\n      (section) =>\n        createDescription(\n          section as Record<string, unknown>,\n          _.get(result, 'result.score') as number,\n          _.get(result, 'response.milestones.service_started') as string,\n          _.get(result, 'response.service_name') as string,\n          _.get(result, 'response.milestones.service_completed') as string\n        )\n    );\n    _.set(result, 'result.sections', descriptions);\n    newSections.push(result);\n  }\n  return newSections;\n}\n\n/*\nBuilds everything under profiles.controls using results.sections data from Conveyor JSON.\n*/\nfunction controlMappingConveyor(): MappedTransform<\n  ExecJSON.Control & ILookupPath,\n  ILookupPath\n> {\n  return {\n    id: {path: 'sha256'}, // sha256 of file analyzed\n    title: {path: 'filename'}, // Name of file scanned per Conveyor. Will include conveyor-generated files (.clamav, .moldy, etc)\n    desc: '', // Empty placeholder\n    impact: {\n      path: 'result.score', // Score from Conveyor\n      transformer: (value) => {\n        return value / CONVEYOR_MAX_SCORE; // normalize score from Conveyor\n      }\n    },\n    refs: [],\n    tags: {\n      service_context: {path: 'response.service_context'},\n      service_debug_info: {path: 'response.service_debug_info'},\n      service_tool_version: {path: 'response.service_tool_version'},\n      supplementary: {path: 'response.supplementary'},\n      created: {path: 'created'},\n      archive_ts: {path: 'archive_ts'},\n      classification: {path: 'classification'},\n      expiry_ts: {path: 'expiry_ts'},\n      size: {path: 'size'},\n      type: {path: 'type'},\n      nist: DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS,\n      cci: DEFAULT_STATIC_CODE_ANALYSIS_CCI_TAGS\n    },\n    source_location: {},\n    results: [\n      // Data from heuristics and scan supplemental data\n      {\n        path: 'result.sections',\n        status: {path: 'status'},\n        code_desc: {path: 'code_desc'},\n        start_time: {path: 'start_time'},\n        run_time: {path: 'run_time'}\n      }\n    ]\n  };\n}\n\n/*\nBuilds profile portion of HDF results. Uses date at results level of Conveyor JSON\n*/\nexport class ConveyorMapper extends BaseConverter {\n  scannerName: string;\n  mappings: MappedTransform<\n    ExecJSON.Execution & {passthrough: unknown},\n    ILookupPath\n  > = {\n    passthrough: {path: 'api_response'},\n    platform: {\n      name: 'Heimdall Tools',\n      release: HeimdallToolsVersion\n    },\n    version: {path: 'api_server_version'},\n    statistics: {},\n    profiles: [\n      // Each profile is service's results\n      {\n        name: {path: 'api_response.results[0].response.service_name'},\n        sha256: '',\n        version: {path: 'api_response.results[0].response.service_version'},\n        title: {path: 'api_response.params.description'},\n        supports: [],\n        attributes: [],\n        groups: [],\n        status: 'loaded',\n        controls: [\n          // Each control is a service/file result pair\n          {\n            path: 'api_response.results',\n            ...controlMappingConveyor()\n          }\n        ]\n      }\n    ]\n  };\n  constructor(\n    remappedConveyorResults: Record<string, unknown>,\n    data: Record<string, unknown>,\n    scannerName: string\n  ) {\n    _.set(data, 'api_response.results', remappedConveyorResults);\n    super(data);\n    this.scannerName = scannerName;\n  }\n}\n\nexport class ConveyorResults {\n  data: Record<string, unknown>;\n  constructor(conveyorJson: string) {\n    const parsed = JSON.parse(conveyorJson);\n    const mappings = mapSha2Filename(parsed);\n    const processed = preprocessObject(parsed, mappings);\n    this.data = _.set(\n      parsed,\n      'api_response.results',\n      groupByScanner(processed)\n    );\n  }\n\n  toHdf(): Record<string, ExecJSON.Execution> {\n    const scannerRecordInput = (\n      Object.entries(\n        _.get(this.data, 'api_response.results') as Record<string, unknown>\n      ) as [string, Record<string, unknown>][]\n    ).map(([scannerName, scannerData]) => [\n      scannerName,\n      new ConveyorMapper(scannerData, this.data, scannerName).toHdf()\n    ]);\n    return Object.fromEntries(scannerRecordInput);\n  }\n}\n"]}

package/lib/src/cyclonedx-sbom-mapper.d.ts

@@ -1,35 +0,0 @@
-import { ExecJSON } from 'inspecjs';
-import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
-import { CycloneDXSoftwareBillOfMaterialSpecification, CycloneDXSoftwareBillOfMaterialsStandard, CycloneDXBillOfMaterialsStandardVulnerability, CycloneDXSoftwareBillOfMaterialsStandardVulnerability, ComponentClass, ComponentObject } from '../types/cyclonedx';
-type IntermediaryComponent = Omit<ComponentClass | ComponentObject, 'components'> & {
-    components?: IntermediaryComponent[];
-    affectingVulnerabilities?: string[];
-    isDummy?: boolean;
-};
-type IntermediaryVulnerability = (CycloneDXBillOfMaterialsStandardVulnerability | CycloneDXSoftwareBillOfMaterialsStandardVulnerability) & {
-    affectedComponents?: number[];
-};
-type DataStorage = {
-    components: IntermediaryComponent[];
-    vulnerabilities: IntermediaryVulnerability[];
-    raw: CycloneDXSoftwareBillOfMaterialSpecification | CycloneDXSoftwareBillOfMaterialsStandard;
-};
-export declare class CycloneDXSBOMResults {
-    data: DataStorage;
-    withRaw: boolean;
-    constructor(sbomJson: string, withRaw?: boolean);
-    flattenComponents(data: DataStorage): void;
-    generateIntermediary(data: DataStorage): void;
-    formatVEX(data: DataStorage): void;
-    toHdf(): ExecJSON.Execution;
-}
-export declare class CycloneDXSBOMMapper extends BaseConverter<DataStorage> {
-    withRaw: boolean;
-    getComponentValueAtIndex(index: number, keys: string[]): Record<string, unknown>;
-    mappings: MappedTransform<ExecJSON.Execution & {
-        passthrough: unknown;
-    }, ILookupPath>;
-    constructor(exportJson: DataStorage, withRaw?: boolean);
-}
-export {};
-//# sourceMappingURL=cyclonedx-sbom-mapper.d.ts.map

package/lib/src/cyclonedx-sbom-mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cyclonedx-sbom-mapper.d.ts","sourceRoot":"","sources":["../../src/cyclonedx-sbom-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EAAC,aAAa,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAG7E,OAAO,EACL,4CAA4C,EAC5C,wCAAwC,EACxC,6CAA6C,EAC7C,qDAAqD,EAWrD,cAAc,EACd,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAK5B,KAAK,qBAAqB,GAAG,IAAI,CAC/B,cAAc,GAAG,eAAe,EAChC,YAAY,CACb,GAAG;IACF,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACrC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,KAAK,yBAAyB,GAAG,CAC7B,6CAA6C,GAC7C,qDAAqD,CACxD,GAAG;IACF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,eAAe,EAAE,yBAAyB,EAAE,CAAC;IAC7C,GAAG,EACC,4CAA4C,GAC5C,wCAAwC,CAAC;CAC9C,CAAC;AA2FF,qBAAa,oBAAoB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;gBACL,QAAQ,EAAE,MAAM,EAAE,OAAO,UAAQ;IA0B7C,iBAAiB,CAAC,IAAI,EAAE,WAAW;IA+CnC,oBAAoB,CAAC,IAAI,EAAE,WAAW;IAmCtC,SAAS,CAAC,IAAI,EAAE,WAAW;IAyB3B,KAAK,IAAI,QAAQ,CAAC,SAAS;CAG5B;AAED,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,WAAW,CAAC;IACjE,OAAO,EAAE,OAAO,CAAC;IAGjB,wBAAwB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EAAE,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI1B,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,SAAS,GAAG;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,EAC3C,WAAW,CACZ,CAuXC;gBACU,UAAU,EAAE,WAAW,EAAE,OAAO,UAAQ;CAIrD"}