@mitre/hdf-converters 2.13.0 → 3.0.0

package/lib/src/netsparker-mapper.js

@@ -1,285 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NetsparkerMapper = exports.NetsparkerResults = void 0;
-const inspecjs_1 = require("inspecjs");
-const _ = __importStar(require("lodash"));
-const package_json_1 = require("../package.json");
-const base_converter_1 = require("./base-converter");
-const CweNistMapping_1 = require("./mappings/CweNistMapping");
-const OwaspNistMapping_1 = require("./mappings/OwaspNistMapping");
-const global_1 = require("./utils/global");
-const IMPACT_MAPPING = new Map([
-    ['critical', 1.0],
-    ['high', 0.7],
-    ['medium', 0.5],
-    ['low', 0.3],
-    ['best_practice', 0.0],
-    ['information', 0.0]
-]);
-const CWE_NIST_MAPPING = new CweNistMapping_1.CweNistMapping();
-const OWASP_NIST_MAPPING = new OwaspNistMapping_1.OwaspNistMapping();
-let parseHtml;
-function nistTag(classification) {
-    let cweTag = _.get(classification, 'cwe');
-    if (!Array.isArray(cweTag)) {
-        cweTag = [cweTag];
-    }
-    let owaspTag = _.get(classification, 'owasp');
-    if (!Array.isArray(owaspTag)) {
-        owaspTag = [owaspTag];
-    }
-    const cwe = CWE_NIST_MAPPING.nistFilter(cweTag);
-    const owasp = OWASP_NIST_MAPPING.nistFilterNoDefault(owaspTag);
-    const result = cwe.concat(owasp);
-    if (result.length !== 0) {
-        return result;
-    }
-    else {
-        return global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS;
-    }
-}
-function formatControlDesc(vulnerability) {
-    const text = [];
-    const description = _.get(vulnerability, 'description');
-    if (description) {
-        text.push(description);
-    }
-    const exploitationSkills = _.get(vulnerability, 'exploitation-skills');
-    if (exploitationSkills) {
-        text.push(`Exploitation-skills: ${exploitationSkills}`);
-    }
-    const extraInformation = _.get(vulnerability, 'extra-information');
-    if (extraInformation) {
-        text.push(`Extra-information: ${JSON.stringify(extraInformation).replace(/:/gi, '=>')}`);
-    }
-    const classification = _.get(vulnerability, 'classification');
-    if (classification) {
-        text.push(`Classification: ${JSON.stringify(classification).replace(/:/gi, '=>')}`);
-    }
-    const impact = _.get(vulnerability, 'impact');
-    if (impact) {
-        text.push(`Impact: ${impact}`);
-    }
-    const firstSeenDate = _.get(vulnerability, 'FirstSeenDate');
-    if (firstSeenDate) {
-        text.push(`FirstSeenDate: ${firstSeenDate}`);
-    }
-    const lastSeenDate = _.get(vulnerability, 'LastSeenDate');
-    if (lastSeenDate) {
-        text.push(`LastSeenDate: ${lastSeenDate}`);
-    }
-    const certainty = _.get(vulnerability, 'certainty');
-    if (certainty) {
-        text.push(`Certainty: ${certainty}`);
-    }
-    const type = _.get(vulnerability, 'type');
-    if (type) {
-        text.push(`Type: ${type}`);
-    }
-    const confirmed = _.get(vulnerability, 'confirmed');
-    if (confirmed) {
-        text.push(`Confirmed: ${confirmed}`);
-    }
-    return text.join('<br>');
-}
-function formatCheck(vulnerability) {
-    const text = [];
-    const exploitationSkills = _.get(vulnerability, 'exploitation-skills');
-    if (exploitationSkills) {
-        text.push(`Exploitation-skills: ${exploitationSkills}`);
-    }
-    const proofOfConcept = _.get(vulnerability, 'proof-of-concept');
-    if (proofOfConcept) {
-        text.push(`Proof-of-concept: ${proofOfConcept}`);
-    }
-    return parseHtml(text.join('<br>'));
-}
-function formatFix(vulnerability) {
-    const text = [];
-    const remedialActions = _.get(vulnerability, 'remedial-actions');
-    if (remedialActions) {
-        text.push(`Remedial-actions: ${remedialActions}`);
-    }
-    const remedialProcedure = _.get(vulnerability, 'remedial-procedure');
-    if (remedialProcedure) {
-        text.push(`Remedial-procedure: ${remedialProcedure}`);
-    }
-    const remedyReferences = _.get(vulnerability, 'remedy-references');
-    if (remedyReferences) {
-        text.push(`Remedy-references: ${remedyReferences}`);
-    }
-    return text.join('<br>');
-}
-function formatCodeDesc(request) {
-    const text = [];
-    text.push(`http-request : ${_.get(request, 'content')}`);
-    text.push(`method : ${_.get(request, 'method')}`);
-    return text.join('\n');
-}
-function formatMessage(response) {
-    const text = [];
-    text.push(`http-response : ${_.get(response, 'content')}`);
-    text.push(`duration : ${_.get(response, 'duration')}`);
-    text.push(`status-code  : ${_.get(response, 'status-code')}`);
-    return text.join('\n');
-}
-class NetsparkerResults {
-    netsparkerXml;
-    withRaw;
-    constructor(netsparkerXml, withRaw = false) {
-        this.netsparkerXml = netsparkerXml;
-        this.withRaw = withRaw;
-    }
-    async toHdf() {
-        parseHtml = await (0, base_converter_1.buildParseHtmlFunc)();
-        return (new NetsparkerMapper(this.netsparkerXml, this.withRaw)).toHdf();
-    }
-}
-exports.NetsparkerResults = NetsparkerResults;
-class NetsparkerMapper extends base_converter_1.BaseConverter {
-    withRaw;
-    defineMappings(toolname) {
-        const capitalizedToolname = toolname.replace(/^./, (firstLetter) => firstLetter.toUpperCase());
-        return {
-            platform: {
-                name: 'Heimdall Tools',
-                release: package_json_1.version,
-                target_id: { path: `${toolname}-enterprise.target.url` }
-            },
-            version: package_json_1.version,
-            statistics: {},
-            profiles: [
-                {
-                    name: `${capitalizedToolname} Enterprise Scan`,
-                    title: {
-                        path: `${toolname}-enterprise.target`,
-                        transformer: (input) => {
-                            return `${toolname.replace(/^./, (firstLetter) => firstLetter.toUpperCase())} Enterprise Scan ID: ${_.get(input, 'scan-id')} URL: ${_.get(input, 'url')}`;
-                        }
-                    },
-                    summary: `${capitalizedToolname} Enterprise Scan`,
-                    supports: [],
-                    attributes: [],
-                    groups: [],
-                    status: 'loaded',
-                    controls: [
-                        {
-                            path: `${toolname}-enterprise.vulnerabilities.vulnerability`,
-                            key: 'id',
-                            tags: {
-                                cci: {
-                                    path: 'classification',
-                                    transformer: (data) => (0, global_1.getCCIsForNISTTags)(nistTag(data))
-                                },
-                                nist: { path: 'classification', transformer: nistTag }
-                            },
-                            refs: [],
-                            source_location: {},
-                            title: { path: 'name' },
-                            id: { path: 'LookupId' },
-                            desc: { transformer: formatControlDesc },
-                            descriptions: [
-                                {
-                                    data: { transformer: formatCheck },
-                                    label: 'check'
-                                },
-                                {
-                                    data: { transformer: formatFix },
-                                    label: 'fix'
-                                }
-                            ],
-                            impact: {
-                                path: 'severity',
-                                transformer: (0, base_converter_1.impactMapping)(IMPACT_MAPPING)
-                            },
-                            code: {
-                                transformer: (vulnerability) => JSON.stringify(vulnerability, null, 2)
-                            },
-                            results: [
-                                {
-                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                    code_desc: {
-                                        path: 'http-request',
-                                        transformer: formatCodeDesc
-                                    },
-                                    message: { path: 'http-response', transformer: formatMessage },
-                                    start_time: {
-                                        path: `$.${toolname}-enterprise.target.initiated`
-                                    }
-                                }
-                            ]
-                        }
-                    ],
-                    sha256: ''
-                }
-            ],
-            passthrough: {
-                transformer: (data) => {
-                    const auxData = _.get(data, 'netsparker-enterprise');
-                    const genData = _.get(auxData, 'generated');
-                    const targetData = _.omit(_.get(auxData, 'target'), [
-                        'scan-id',
-                        'url',
-                        'initiated'
-                    ]);
-                    return {
-                        auxiliary_data: [
-                            {
-                                name: 'Netsparker',
-                                data: {
-                                    'netsparker-enterprise': {
-                                        generated: genData,
-                                        target: targetData
-                                    }
-                                }
-                            }
-                        ],
-                        ...(this.withRaw && { raw: data })
-                    };
-                }
-            }
-        };
-    }
-    constructor(netsparkerXml, withRaw = false) {
-        super((0, base_converter_1.parseXml)(netsparkerXml));
-        this.withRaw = withRaw;
-        this.setMappings(this.defineMappings(Object.keys(this.data).some((k) => k.includes('netsparker'))
-            ? 'netsparker'
-            : 'invicti'));
-    }
-}
-exports.NetsparkerMapper = NetsparkerMapper;
-//# sourceMappingURL=netsparker-mapper.js.map

package/lib/src/netsparker-mapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"netsparker-mapper.js","sourceRoot":"","sources":["../../src/netsparker-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAO0B;AAC1B,8DAAyD;AACzD,kEAA6D;AAC7D,2CAGwB;AAExB,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,UAAU,EAAE,GAAG,CAAC;IACjB,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,eAAe,EAAE,GAAG,CAAC;IACtB,CAAC,aAAa,EAAE,GAAG,CAAC;CACrB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,+BAAc,EAAE,CAAC;AAC9C,MAAM,kBAAkB,GAAG,IAAI,mCAAgB,EAAE,CAAC;AAElD,IAAI,SAAqC,CAAC;AAE1C,SAAS,OAAO,CAAC,cAAuC;IACtD,IAAI,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,MAAkB,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,QAAoB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,OAAO,+CAAsC,CAAC;IAChD,CAAC;AACH,CAAC;AACD,SAAS,iBAAiB,CAAC,aAAsB;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,kBAAkB,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,wBAAwB,kBAAkB,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACnE,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CACP,sBAAsB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAC5D,KAAK,EACL,IAAI,CACL,EAAE,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC9D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CACP,mBAAmB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,kBAAkB,aAAa,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AACD,SAAS,WAAW,CAAC,aAAsB;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,kBAAkB,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,wBAAwB,kBAAkB,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAChE,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,qBAAqB,cAAc,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACtC,CAAC;AACD,SAAS,SAAS,CAAC,aAAsB;IACvC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,qBAAqB,eAAe,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IACrE,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,uBAAuB,iBAAiB,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACnE,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,sBAAsB,gBAAgB,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AACD,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,aAAa,CAAC,QAAiB;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAa,iBAAiB;IACP;IAAgC;IAArD,YAAqB,aAAqB,EAAW,UAAU,KAAK;QAA/C,kBAAa,GAAb,aAAa,CAAQ;QAAW,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAExE,KAAK,CAAC,KAAK;QACT,SAAS,GAAG,MAAM,IAAA,mCAAkB,GAAE,CAAC;QAEvC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1E,CAAC;CACF;AARD,8CAQC;AAED,MAAa,gBAAiB,SAAQ,8BAAa;IACjD,OAAO,CAAU;IAEjB,cAAc,CACZ,QAAgB;QAEhB,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACjE,WAAW,CAAC,WAAW,EAAE,CAC1B,CAAC;QACF,OAAO;YACL,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,sBAAoB;gBAC7B,SAAS,EAAE,EAAC,IAAI,EAAE,GAAG,QAAQ,wBAAwB,EAAC;aACvD;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,GAAG,mBAAmB,kBAAkB;oBAC9C,KAAK,EAAE;wBACL,IAAI,EAAE,GAAG,QAAQ,oBAAoB;wBACrC,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;4BACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAC/C,WAAW,CAAC,WAAW,EAAE,CAC1B,wBAAwB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,GAAG,CAC5D,KAAK,EACL,KAAK,CACN,EAAE,CAAC;wBACN,CAAC;qBACF;oBACD,OAAO,EAAE,GAAG,mBAAmB,kBAAkB;oBACjD,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,GAAG,QAAQ,2CAA2C;4BAC5D,GAAG,EAAE,IAAI;4BACT,IAAI,EAAE;gCACJ,GAAG,EAAE;oCACH,IAAI,EAAE,gBAAgB;oCACtB,WAAW,EAAE,CAAC,IAA6B,EAAE,EAAE,CAC7C,IAAA,2BAAkB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iCACpC;gCACD,IAAI,EAAE,EAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAC;6BACrD;4BACD,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,KAAK,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BACrB,EAAE,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC;4BACtB,IAAI,EAAE,EAAC,WAAW,EAAE,iBAAiB,EAAC;4BACtC,YAAY,EAAE;gCACZ;oCACE,IAAI,EAAE,EAAC,WAAW,EAAE,WAAW,EAAC;oCAChC,KAAK,EAAE,OAAO;iCACf;gCACD;oCACE,IAAI,EAAE,EAAC,WAAW,EAAE,SAAS,EAAC;oCAC9B,KAAK,EAAE,KAAK;iCACb;6BACF;4BACD,MAAM,EAAE;gCACN,IAAI,EAAE,UAAU;gCAChB,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;6BAC3C;4BACD,IAAI,EAAE;gCACJ,WAAW,EAAE,CAAC,aAAsC,EAAU,EAAE,CAC9D,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;6BACzC;4BACD,OAAO,EAAE;gCACP;oCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;oCAC3C,SAAS,EAAE;wCACT,IAAI,EAAE,cAAc;wCACpB,WAAW,EAAE,cAAc;qCAC5B;oCACD,OAAO,EAAE,EAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAC;oCAC5D,UAAU,EAAE;wCACV,IAAI,EAAE,KAAK,QAAQ,8BAA8B;qCAClD;iCACF;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;YACD,WAAW,EAAE;gBACX,WAAW,EAAE,CACX,IAA6B,EACJ,EAAE;oBAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;oBACrD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;oBAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;wBAClD,SAAS;wBACT,KAAK;wBACL,WAAW;qBACZ,CAAC,CAAC;oBACH,OAAO;wBACL,cAAc,EAAE;4BACd;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE;oCACJ,uBAAuB,EAAE;wCACvB,SAAS,EAAE,OAAO;wCAClB,MAAM,EAAE,UAAU;qCACnB;iCACF;6BACF;yBACF;wBACD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC;qBACjC,CAAC;gBACJ,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IACD,YAAY,aAAqB,EAAE,OAAO,GAAG,KAAK;QAChD,KAAK,CAAC,IAAA,yBAAQ,EAAC,aAAa,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,CACd,IAAI,CAAC,cAAc,CACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC1D,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CACd,CACF,CAAC;IACJ,CAAC;CACF;AAjID,4CAiIC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport * as _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {\n  BaseConverter,\n  ILookupPath,\n  impactMapping,\n  MappedTransform,\n  buildParseHtmlFunc,\n  parseXml\n} from './base-converter';\nimport {CweNistMapping} from './mappings/CweNistMapping';\nimport {OwaspNistMapping} from './mappings/OwaspNistMapping';\nimport {\n  DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS,\n  getCCIsForNISTTags\n} from './utils/global';\n\nconst IMPACT_MAPPING: Map<string, number> = new Map([\n  ['critical', 1.0],\n  ['high', 0.7],\n  ['medium', 0.5],\n  ['low', 0.3],\n  ['best_practice', 0.0],\n  ['information', 0.0]\n]);\n\nconst CWE_NIST_MAPPING = new CweNistMapping();\nconst OWASP_NIST_MAPPING = new OwaspNistMapping();\n\nlet parseHtml: (input: unknown) => string;\n\nfunction nistTag(classification: Record<string, unknown>): string[] {\n  let cweTag = _.get(classification, 'cwe');\n  if (!Array.isArray(cweTag)) {\n    cweTag = [cweTag];\n  }\n  let owaspTag = _.get(classification, 'owasp');\n  if (!Array.isArray(owaspTag)) {\n    owaspTag = [owaspTag];\n  }\n  const cwe = CWE_NIST_MAPPING.nistFilter(cweTag as string[]);\n  const owasp = OWASP_NIST_MAPPING.nistFilterNoDefault(owaspTag as string[]);\n  const result = cwe.concat(owasp);\n  if (result.length !== 0) {\n    return result;\n  } else {\n    return DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS;\n  }\n}\nfunction formatControlDesc(vulnerability: unknown): string {\n  const text: string[] = [];\n  const description = _.get(vulnerability, 'description');\n  if (description) {\n    text.push(description);\n  }\n  const exploitationSkills = _.get(vulnerability, 'exploitation-skills');\n  if (exploitationSkills) {\n    text.push(`Exploitation-skills: ${exploitationSkills}`);\n  }\n  const extraInformation = _.get(vulnerability, 'extra-information');\n  if (extraInformation) {\n    text.push(\n      `Extra-information: ${JSON.stringify(extraInformation).replace(\n        /:/gi,\n        '=>'\n      )}`\n    );\n  }\n  const classification = _.get(vulnerability, 'classification');\n  if (classification) {\n    text.push(\n      `Classification: ${JSON.stringify(classification).replace(/:/gi, '=>')}`\n    );\n  }\n  const impact = _.get(vulnerability, 'impact');\n  if (impact) {\n    text.push(`Impact: ${impact}`);\n  }\n  const firstSeenDate = _.get(vulnerability, 'FirstSeenDate');\n  if (firstSeenDate) {\n    text.push(`FirstSeenDate: ${firstSeenDate}`);\n  }\n  const lastSeenDate = _.get(vulnerability, 'LastSeenDate');\n  if (lastSeenDate) {\n    text.push(`LastSeenDate: ${lastSeenDate}`);\n  }\n  const certainty = _.get(vulnerability, 'certainty');\n  if (certainty) {\n    text.push(`Certainty: ${certainty}`);\n  }\n  const type = _.get(vulnerability, 'type');\n  if (type) {\n    text.push(`Type: ${type}`);\n  }\n  const confirmed = _.get(vulnerability, 'confirmed');\n  if (confirmed) {\n    text.push(`Confirmed: ${confirmed}`);\n  }\n  return text.join('<br>');\n}\nfunction formatCheck(vulnerability: unknown): string {\n  const text: string[] = [];\n  const exploitationSkills = _.get(vulnerability, 'exploitation-skills');\n  if (exploitationSkills) {\n    text.push(`Exploitation-skills: ${exploitationSkills}`);\n  }\n  const proofOfConcept = _.get(vulnerability, 'proof-of-concept');\n  if (proofOfConcept) {\n    text.push(`Proof-of-concept: ${proofOfConcept}`);\n  }\n  return parseHtml(text.join('<br>'));\n}\nfunction formatFix(vulnerability: unknown): string {\n  const text: string[] = [];\n  const remedialActions = _.get(vulnerability, 'remedial-actions');\n  if (remedialActions) {\n    text.push(`Remedial-actions: ${remedialActions}`);\n  }\n  const remedialProcedure = _.get(vulnerability, 'remedial-procedure');\n  if (remedialProcedure) {\n    text.push(`Remedial-procedure: ${remedialProcedure}`);\n  }\n  const remedyReferences = _.get(vulnerability, 'remedy-references');\n  if (remedyReferences) {\n    text.push(`Remedy-references: ${remedyReferences}`);\n  }\n  return text.join('<br>');\n}\nfunction formatCodeDesc(request: unknown): string {\n  const text: string[] = [];\n  text.push(`http-request : ${_.get(request, 'content')}`);\n  text.push(`method : ${_.get(request, 'method')}`);\n  return text.join('\\n');\n}\nfunction formatMessage(response: unknown): string {\n  const text: string[] = [];\n  text.push(`http-response : ${_.get(response, 'content')}`);\n  text.push(`duration : ${_.get(response, 'duration')}`);\n  text.push(`status-code  : ${_.get(response, 'status-code')}`);\n  return text.join('\\n');\n}\n\nexport class NetsparkerResults {\n  constructor(readonly netsparkerXml: string, readonly withRaw = false) {}\n\n  async toHdf(): Promise<ExecJSON.Execution> {\n    parseHtml = await buildParseHtmlFunc();\n\n    return (new NetsparkerMapper(this.netsparkerXml, this.withRaw)).toHdf();\n  }\n}\n\nexport class NetsparkerMapper extends BaseConverter {\n  withRaw: boolean;\n\n  defineMappings(\n    toolname: string\n  ): MappedTransform<ExecJSON.Execution & {passthrough: unknown}, ILookupPath> {\n    const capitalizedToolname = toolname.replace(/^./, (firstLetter) =>\n      firstLetter.toUpperCase()\n    );\n    return {\n      platform: {\n        name: 'Heimdall Tools',\n        release: HeimdallToolsVersion,\n        target_id: {path: `${toolname}-enterprise.target.url`}\n      },\n      version: HeimdallToolsVersion,\n      statistics: {},\n      profiles: [\n        {\n          name: `${capitalizedToolname} Enterprise Scan`,\n          title: {\n            path: `${toolname}-enterprise.target`,\n            transformer: (input: unknown): string => {\n              return `${toolname.replace(/^./, (firstLetter) =>\n                firstLetter.toUpperCase()\n              )} Enterprise Scan ID: ${_.get(input, 'scan-id')} URL: ${_.get(\n                input,\n                'url'\n              )}`;\n            }\n          },\n          summary: `${capitalizedToolname} Enterprise Scan`,\n          supports: [],\n          attributes: [],\n          groups: [],\n          status: 'loaded',\n          controls: [\n            {\n              path: `${toolname}-enterprise.vulnerabilities.vulnerability`,\n              key: 'id',\n              tags: {\n                cci: {\n                  path: 'classification',\n                  transformer: (data: Record<string, unknown>) =>\n                    getCCIsForNISTTags(nistTag(data))\n                },\n                nist: {path: 'classification', transformer: nistTag}\n              },\n              refs: [],\n              source_location: {},\n              title: {path: 'name'},\n              id: {path: 'LookupId'},\n              desc: {transformer: formatControlDesc},\n              descriptions: [\n                {\n                  data: {transformer: formatCheck},\n                  label: 'check'\n                },\n                {\n                  data: {transformer: formatFix},\n                  label: 'fix'\n                }\n              ],\n              impact: {\n                path: 'severity',\n                transformer: impactMapping(IMPACT_MAPPING)\n              },\n              code: {\n                transformer: (vulnerability: Record<string, unknown>): string =>\n                  JSON.stringify(vulnerability, null, 2)\n              },\n              results: [\n                {\n                  status: ExecJSON.ControlResultStatus.Failed,\n                  code_desc: {\n                    path: 'http-request',\n                    transformer: formatCodeDesc\n                  },\n                  message: {path: 'http-response', transformer: formatMessage},\n                  start_time: {\n                    path: `$.${toolname}-enterprise.target.initiated`\n                  }\n                }\n              ]\n            }\n          ],\n          sha256: ''\n        }\n      ],\n      passthrough: {\n        transformer: (\n          data: Record<string, unknown>\n        ): Record<string, unknown> => {\n          const auxData = _.get(data, 'netsparker-enterprise');\n          const genData = _.get(auxData, 'generated');\n          const targetData = _.omit(_.get(auxData, 'target'), [\n            'scan-id',\n            'url',\n            'initiated'\n          ]);\n          return {\n            auxiliary_data: [\n              {\n                name: 'Netsparker',\n                data: {\n                  'netsparker-enterprise': {\n                    generated: genData,\n                    target: targetData\n                  }\n                }\n              }\n            ],\n            ...(this.withRaw && {raw: data})\n          };\n        }\n      }\n    };\n  }\n  constructor(netsparkerXml: string, withRaw = false) {\n    super(parseXml(netsparkerXml));\n    this.withRaw = withRaw;\n    this.setMappings(\n      this.defineMappings(\n        Object.keys(this.data).some((k) => k.includes('netsparker'))\n          ? 'netsparker'\n          : 'invicti'\n      )\n    );\n  }\n}\n"]}

package/lib/src/neuvector-mapper.d.ts

@@ -1,14 +0,0 @@
-import { ExecJSON } from 'inspecjs';
-import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
-import { NeuVectorScanJson, RESTScanModule } from '../types/neuvector-types';
-export declare class NeuVectorMapper extends BaseConverter {
-    withRaw: boolean;
-    rawData: NeuVectorScanJson;
-    getModules: (moduleName: string) => RESTScanModule['source'] | undefined;
-    memoizedGetModules(): (moduleName: string) => RESTScanModule['source'] | undefined;
-    mappings: MappedTransform<ExecJSON.Execution & {
-        passthrough: unknown;
-    }, ILookupPath>;
-    constructor(exportJson: string, withRaw?: boolean);
-}
-//# sourceMappingURL=neuvector-mapper.d.ts.map

package/lib/src/neuvector-mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"neuvector-mapper.d.ts","sourceRoot":"","sources":["../../src/neuvector-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EAAC,aAAa,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAG7E,OAAO,EACL,iBAAiB,EAEjB,cAAc,EAGf,MAAM,0BAA0B,CAAC;AAqBlC,qBAAa,eAAgB,SAAQ,aAAa;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAEzE,kBAAkB,IAAI,CACpB,UAAU,EAAE,MAAM,KACf,cAAc,CAAC,QAAQ,CAAC,GAAG,SAAS;IAczC,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,SAAS,GAAG;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,EAC3C,WAAW,CACZ,CAmIC;gBACU,UAAU,EAAE,MAAM,EAAE,OAAO,UAAQ;CAOhD"}

package/lib/src/neuvector-mapper.js

@@ -1,170 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NeuVectorMapper = void 0;
-const inspecjs_1 = require("inspecjs");
-const lodash_1 = __importDefault(require("lodash"));
-const package_json_1 = require("../package.json");
-const base_converter_1 = require("./base-converter");
-const CweNistMapping_1 = require("./mappings/CweNistMapping");
-const global_1 = require("./utils/global");
-const CWE_NIST_MAPPING = new CweNistMapping_1.CweNistMapping();
-function cweTags(description) {
-    const regex = /CWE-\d{3}/g;
-    return description.match(regex) ?? undefined;
-}
-function nistTags(cweTags) {
-    const identifiers = cweTags?.map((tag) => tag.slice(-3)) ?? [];
-    return CWE_NIST_MAPPING.nistFilter(identifiers, global_1.DEFAULT_UPDATE_REMEDIATION_NIST_TAGS);
-}
-function cveIdMatches(cveName) {
-    return (cve) => cve.name === cveName;
-}
-class NeuVectorMapper extends base_converter_1.BaseConverter {
-    withRaw;
-    rawData;
-    getModules;
-    memoizedGetModules() {
-        const cache = {};
-        return (moduleName) => {
-            if (Object.prototype.hasOwnProperty.call(cache, moduleName)) {
-                return cache[moduleName];
-            }
-            cache[moduleName] = this.data.report.modules?.find((value) => value.name === moduleName)?.source;
-            return cache[moduleName];
-        };
-    }
-    mappings = {
-        platform: {
-            name: 'Heimdall Tools',
-            release: package_json_1.version
-        },
-        version: package_json_1.version,
-        statistics: {},
-        profiles: [
-            {
-                name: 'NeuVector Scan',
-                title: {
-                    path: 'report',
-                    transformer: (data) => `${data.registry}/${data.repository}:${data.tag} - Digest: ${data.digest} - Image ID: ${data.image_id}`
-                },
-                supports: [],
-                attributes: [],
-                groups: [],
-                status: 'loaded',
-                controls: [
-                    {
-                        path: 'report.vulnerabilities',
-                        key: 'id',
-                        tags: {
-                            cves: { path: 'cves' },
-                            cpes: { path: 'cpes' },
-                            cwe: {
-                                path: 'description',
-                                transformer: cweTags
-                            },
-                            nist: {
-                                path: 'description',
-                                transformer: (description) => nistTags(cweTags(description))
-                            },
-                            score: { path: 'score' },
-                            vectors: { path: 'vectors' },
-                            vectors_v3: { path: 'vectors_v3' },
-                            score_v3: { path: 'score_v3' },
-                            severity: { path: 'severity' },
-                            source: {
-                                path: 'package_name',
-                                transformer: (packageName) => this.getModules(packageName)
-                            },
-                            status: {
-                                path: 'name',
-                                transformer: (name) => this.rawData.report.modules
-                                    ?.find((module) => module.cves?.find(cveIdMatches(name)))
-                                    ?.cves?.find(cveIdMatches(name))?.status
-                            },
-                            feed_rating: { path: 'feed_rating' },
-                            link: { path: 'link' },
-                            published_timestamp: { path: 'published_timestamp' },
-                            last_modified_timestamp: { path: 'last_modified_timestamp' },
-                            in_base_image: { path: 'in_base_image' },
-                            tags: {
-                                path: 'tags',
-                                transformer: (tags) => JSON.stringify(tags, null, 2)
-                            },
-                            envs: {
-                                path: '$.report.envs',
-                                transformer: (envs) => envs ? envs.join('\n') : undefined
-                            },
-                            cmds: {
-                                path: '$.report.cmds',
-                                transformer: (cmds) => cmds ? cmds.join('\n') : undefined
-                            }
-                        },
-                        refs: [],
-                        source_location: { ref: { path: 'file_name' } },
-                        title: {
-                            transformer: (data) => `NeuVector found a vulnerability to ${data.name} in ${data.package_name}/${data.package_version}.`
-                        },
-                        id: {
-                            transformer: (data) => `${data.name}/${data.package_name}/${data.package_version}`
-                        },
-                        desc: { path: 'description' },
-                        impact: {
-                            transformer: (data) => data.score_v3 / 10
-                        },
-                        results: [
-                            {
-                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                code_desc: '',
-                                message: {
-                                    transformer: (data) => {
-                                        const { package_name, package_version, fixed_version } = data;
-                                        if (!fixed_version) {
-                                            return `Vulnerable package ${package_name} is at version ${package_version}. No fixed version available.`;
-                                        }
-                                        return `Vulnerable package ${package_name} is at version ${package_version}. Update to fixed version ${fixed_version}.`;
-                                    }
-                                },
-                                start_time: ''
-                            }
-                        ]
-                    }
-                ],
-                sha256: ''
-            }
-        ],
-        passthrough: {
-            transformer: (data) => {
-                return {
-                    auxiliary_data: [
-                        {
-                            name: 'NeuVector',
-                            data: lodash_1.default.omit([
-                                'reports.vulnerabilities',
-                                'reports.cmds',
-                                'reports.envs',
-                                'reports.registry',
-                                'reports.repository',
-                                'reports.tag',
-                                'reports.digest',
-                                'reports.image_id'
-                            ])
-                        }
-                    ],
-                    ...(this.withRaw && { raw: data })
-                };
-            }
-        }
-    };
-    constructor(exportJson, withRaw = false) {
-        const rawParams = JSON.parse(exportJson);
-        super(rawParams);
-        this.withRaw = withRaw;
-        this.rawData = rawParams;
-        this.getModules = this.memoizedGetModules();
-    }
-}
-exports.NeuVectorMapper = NeuVectorMapper;
-//# sourceMappingURL=neuvector-mapper.js.map

package/lib/src/neuvector-mapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"neuvector-mapper.js","sourceRoot":"","sources":["../../src/neuvector-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,uCAAkC;AAClC,oDAAuB;AACvB,kDAAgE;AAChE,qDAA6E;AAC7E,8DAAyD;AACzD,2CAAoE;AASpE,MAAM,gBAAgB,GAAG,IAAI,+BAAc,EAAE,CAAC;AAE9C,SAAS,OAAO,CAAC,WAAmB;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC;IAC3B,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B;IAC7C,MAAM,WAAW,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,OAAO,gBAAgB,CAAC,UAAU,CAChC,WAAW,EACX,6CAAoC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CAAC,GAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC;AACtD,CAAC;AAED,MAAa,eAAgB,SAAQ,8BAAa;IAChD,OAAO,CAAU;IACjB,OAAO,CAAoB;IAC3B,UAAU,CAA+D;IAEzE,kBAAkB;QAGhB,MAAM,KAAK,GAAyD,EAAE,CAAC;QAEvE,OAAO,CAAC,UAAkB,EAAE,EAAE;YAC5B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,GAAI,IAAI,CAAC,IAA0B,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CACvE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CACrC,EAAE,MAAM,CAAC;YACV,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,GAGJ;QACF,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sBAAoB;SAC9B;QACD,OAAO,EAAE,sBAAoB;QAC7B,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,CAAC,IAAwB,EAAE,EAAE,CACxC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,cAAc,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,QAAQ,EAAE;iBAC1G;gBACD,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,wBAAwB;wBAC9B,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE;4BACJ,IAAI,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BACpB,IAAI,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BACpB,GAAG,EAAE;gCACH,IAAI,EAAE,aAAa;gCACnB,WAAW,EAAE,OAAO;6BACrB;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE,aAAa;gCACnB,WAAW,EAAE,CAAC,WAAmB,EAAE,EAAE,CACnC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;6BACjC;4BACD,KAAK,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC;4BACtB,OAAO,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC;4BAC1B,UAAU,EAAE,EAAC,IAAI,EAAE,YAAY,EAAC;4BAChC,QAAQ,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC;4BAC5B,QAAQ,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC;4BAC5B,MAAM,EAAE;gCACN,IAAI,EAAE,cAAc;gCACpB,WAAW,EAAE,CAAC,WAAmB,EAAE,EAAE,CACnC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;6BAC/B;4BACD,MAAM,EAAE;gCACN,IAAI,EAAE,MAAM;gCACZ,WAAW,EAAE,CAAC,IAAY,EAAE,EAAE,CAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;oCACzB,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;oCACzD,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM;6BAC7C;4BACD,WAAW,EAAE,EAAC,IAAI,EAAE,aAAa,EAAC;4BAClC,IAAI,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BACpB,mBAAmB,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;4BAClD,uBAAuB,EAAE,EAAC,IAAI,EAAE,yBAAyB,EAAC;4BAC1D,aAAa,EAAE,EAAC,IAAI,EAAE,eAAe,EAAC;4BACtC,IAAI,EAAE;gCACJ,IAAI,EAAE,MAAM;gCACZ,WAAW,EAAE,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;6BAC/D;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE,eAAe;gCACrB,WAAW,EAAE,CAAC,IAAe,EAAE,EAAE,CAC/B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;6BACrC;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE,eAAe;gCACrB,WAAW,EAAE,CAAC,IAAe,EAAE,EAAE,CAC/B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;6BACrC;yBACF;wBACD,IAAI,EAAE,EAAE;wBACR,eAAe,EAAE,EAAC,GAAG,EAAE,EAAC,IAAI,EAAE,WAAW,EAAC,EAAC;wBAC3C,KAAK,EAAE;4BACL,WAAW,EAAE,CAAC,IAAuB,EAAE,EAAE,CACvC,sCAAsC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,GAAG;yBACrG;wBACD,EAAE,EAAE;4BACF,WAAW,EAAE,CAAC,IAAuB,EAAE,EAAE,CACvC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,EAAE;yBAC9D;wBACD,IAAI,EAAE,EAAC,IAAI,EAAE,aAAa,EAAC;wBAC3B,MAAM,EAAE;4BACN,WAAW,EAAE,CAAC,IAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE;yBAC7D;wBACD,OAAO,EAAE;4BACP;gCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;gCAC3C,SAAS,EAAE,EAAE;gCACb,OAAO,EAAE;oCACP,WAAW,EAAE,CAAC,IAAuB,EAAE,EAAE;wCACvC,MAAM,EAAC,YAAY,EAAE,eAAe,EAAE,aAAa,EAAC,GAAG,IAAI,CAAC;wCAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;4CACnB,OAAO,sBAAsB,YAAY,kBAAkB,eAAe,+BAA+B,CAAC;wCAC5G,CAAC;wCACD,OAAO,sBAAsB,YAAY,kBAAkB,eAAe,6BAA6B,aAAa,GAAG,CAAC;oCAC1H,CAAC;iCACF;gCACD,UAAU,EAAE,EAAE;6BACf;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE;aACX;SACF;QACD,WAAW,EAAE;YACX,WAAW,EAAE,CACX,IAAuB,EAC8B,EAAE;gBACvD,OAAO;oBACL,cAAc,EAAE;wBACd;4BACE,IAAI,EAAE,WAAW;4BACjB,IAAI,EAAE,gBAAC,CAAC,IAAI,CAAC;gCACX,yBAAyB;gCACzB,cAAc;gCACd,cAAc;gCACd,kBAAkB;gCAClB,oBAAoB;gCACpB,aAAa;gCACb,gBAAgB;gCAChB,kBAAkB;6BACnB,CAAC;yBACH;qBACF;oBACD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC;iBACjC,CAAC;YACJ,CAAC;SACF;KACF,CAAC;IACF,YAAY,UAAkB,EAAE,OAAO,GAAG,KAAK;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC9C,CAAC;CACF;AAnKD,0CAmKC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {BaseConverter, ILookupPath, MappedTransform} from './base-converter';\nimport {CweNistMapping} from './mappings/CweNistMapping';\nimport {DEFAULT_UPDATE_REMEDIATION_NIST_TAGS} from './utils/global';\nimport {\n  NeuVectorScanJson,\n  RESTModuleCve,\n  RESTScanModule,\n  RESTScanRepoReport,\n  RESTVulnerability\n} from '../types/neuvector-types';\n\nconst CWE_NIST_MAPPING = new CweNistMapping();\n\nfunction cweTags(description: string): string[] | undefined {\n  const regex = /CWE-\\d{3}/g;\n  return description.match(regex) ?? undefined;\n}\n\nfunction nistTags(cweTags: string[] | undefined): string[] {\n  const identifiers = cweTags?.map((tag: string) => tag.slice(-3)) ?? [];\n  return CWE_NIST_MAPPING.nistFilter(\n    identifiers,\n    DEFAULT_UPDATE_REMEDIATION_NIST_TAGS\n  );\n}\n\nfunction cveIdMatches(cveName: string): (value: RESTModuleCve) => boolean {\n  return (cve: RESTModuleCve) => cve.name === cveName;\n}\n\nexport class NeuVectorMapper extends BaseConverter {\n  withRaw: boolean;\n  rawData: NeuVectorScanJson;\n  getModules: (moduleName: string) => RESTScanModule['source'] | undefined;\n\n  memoizedGetModules(): (\n    moduleName: string\n  ) => RESTScanModule['source'] | undefined {\n    const cache: Record<string, RESTScanModule['source'] | undefined> = {};\n\n    return (moduleName: string) => {\n      if (Object.prototype.hasOwnProperty.call(cache, moduleName)) {\n        return cache[moduleName];\n      }\n      cache[moduleName] = (this.data as NeuVectorScanJson).report.modules?.find(\n        (value) => value.name === moduleName\n      )?.source;\n      return cache[moduleName];\n    };\n  }\n\n  mappings: MappedTransform<\n    ExecJSON.Execution & {passthrough: unknown},\n    ILookupPath\n  > = {\n    platform: {\n      name: 'Heimdall Tools',\n      release: HeimdallToolsVersion\n    },\n    version: HeimdallToolsVersion,\n    statistics: {},\n    profiles: [\n      {\n        name: 'NeuVector Scan',\n        title: {\n          path: 'report',\n          transformer: (data: RESTScanRepoReport) =>\n            `${data.registry}/${data.repository}:${data.tag} - Digest: ${data.digest} - Image ID: ${data.image_id}`\n        },\n        supports: [],\n        attributes: [],\n        groups: [],\n        status: 'loaded',\n        controls: [\n          {\n            path: 'report.vulnerabilities',\n            key: 'id',\n            tags: {\n              cves: {path: 'cves'},\n              cpes: {path: 'cpes'},\n              cwe: {\n                path: 'description',\n                transformer: cweTags\n              },\n              nist: {\n                path: 'description',\n                transformer: (description: string) =>\n                  nistTags(cweTags(description))\n              },\n              score: {path: 'score'},\n              vectors: {path: 'vectors'},\n              vectors_v3: {path: 'vectors_v3'},\n              score_v3: {path: 'score_v3'},\n              severity: {path: 'severity'},\n              source: {\n                path: 'package_name',\n                transformer: (packageName: string) =>\n                  this.getModules(packageName)\n              },\n              status: {\n                path: 'name',\n                transformer: (name: string) =>\n                  this.rawData.report.modules\n                    ?.find((module) => module.cves?.find(cveIdMatches(name)))\n                    ?.cves?.find(cveIdMatches(name))?.status\n              },\n              feed_rating: {path: 'feed_rating'},\n              link: {path: 'link'},\n              published_timestamp: {path: 'published_timestamp'},\n              last_modified_timestamp: {path: 'last_modified_timestamp'},\n              in_base_image: {path: 'in_base_image'},\n              tags: {\n                path: 'tags',\n                transformer: (tags: string[]) => JSON.stringify(tags, null, 2)\n              },\n              envs: {\n                path: '$.report.envs',\n                transformer: (envs?: string[]) =>\n                  envs ? envs.join('\\n') : undefined\n              },\n              cmds: {\n                path: '$.report.cmds',\n                transformer: (cmds?: string[]) =>\n                  cmds ? cmds.join('\\n') : undefined\n              }\n            },\n            refs: [],\n            source_location: {ref: {path: 'file_name'}},\n            title: {\n              transformer: (data: RESTVulnerability) =>\n                `NeuVector found a vulnerability to ${data.name} in ${data.package_name}/${data.package_version}.`\n            },\n            id: {\n              transformer: (data: RESTVulnerability) =>\n                `${data.name}/${data.package_name}/${data.package_version}`\n            },\n            desc: {path: 'description'},\n            impact: {\n              transformer: (data: RESTVulnerability) => data.score_v3 / 10\n            },\n            results: [\n              {\n                status: ExecJSON.ControlResultStatus.Failed,\n                code_desc: '',\n                message: {\n                  transformer: (data: RESTVulnerability) => {\n                    const {package_name, package_version, fixed_version} = data;\n                    if (!fixed_version) {\n                      return `Vulnerable package ${package_name} is at version ${package_version}. No fixed version available.`;\n                    }\n                    return `Vulnerable package ${package_name} is at version ${package_version}. Update to fixed version ${fixed_version}.`;\n                  }\n                },\n                start_time: ''\n              }\n            ]\n          }\n        ],\n        sha256: ''\n      }\n    ],\n    passthrough: {\n      transformer: (\n        data: NeuVectorScanJson\n      ): Record<string, unknown> & {raw?: NeuVectorScanJson} => {\n        return {\n          auxiliary_data: [\n            {\n              name: 'NeuVector',\n              data: _.omit([\n                'reports.vulnerabilities',\n                'reports.cmds',\n                'reports.envs',\n                'reports.registry',\n                'reports.repository',\n                'reports.tag',\n                'reports.digest',\n                'reports.image_id'\n              ])\n            }\n          ],\n          ...(this.withRaw && {raw: data})\n        };\n      }\n    }\n  };\n  constructor(exportJson: string, withRaw = false) {\n    const rawParams = JSON.parse(exportJson);\n    super(rawParams);\n    this.withRaw = withRaw;\n    this.rawData = rawParams;\n    this.getModules = this.memoizedGetModules();\n  }\n}\n"]}

package/lib/src/nikto-mapper.d.ts

@@ -1,10 +0,0 @@
-import { ExecJSON } from 'inspecjs';
-import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
-export declare class NiktoMapper extends BaseConverter {
-    withRaw: boolean;
-    mappings: MappedTransform<ExecJSON.Execution & {
-        passthrough: unknown;
-    }, ILookupPath>;
-    constructor(niktoJson: string, withRaw?: boolean);
-}
-//# sourceMappingURL=nikto-mapper.d.ts.map

package/lib/src/nikto-mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nikto-mapper.d.ts","sourceRoot":"","sources":["../../src/nikto-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EAAC,aAAa,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAsB7E,qBAAa,WAAY,SAAQ,aAAa;IAC5C,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,SAAS,GAAG;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,EAC3C,WAAW,CACZ,CAqEC;gBACU,SAAS,EAAE,MAAM,EAAE,OAAO,UAAQ;CAI/C"}