@mitre/hdf-converters 2.13.0 → 3.0.0

package/lib/src/nikto-mapper.js

@@ -1,133 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NiktoMapper = void 0;
-const inspecjs_1 = require("inspecjs");
-const _ = __importStar(require("lodash"));
-const package_json_1 = require("../package.json");
-const base_converter_1 = require("./base-converter");
-const NiktoNistMapping_1 = require("./mappings/NiktoNistMapping");
-const global_1 = require("./utils/global");
-const NIKTO_NIST_MAPPING = new NiktoNistMapping_1.NiktoNistMapping();
-function formatTitle(file) {
-    return `Nikto Target: ${projectName(file)}`;
-}
-function projectName(file) {
-    return `Host: ${_.get(file, 'host')} Port: ${_.get(file, 'port')}`;
-}
-function formatCodeDesc(vulnerability) {
-    return `URL : ${_.get(vulnerability, 'url')} Method: ${_.get(vulnerability, 'method')}`;
-}
-function nistTag(id) {
-    return NIKTO_NIST_MAPPING.nistTag(id);
-}
-class NiktoMapper extends base_converter_1.BaseConverter {
-    withRaw;
-    mappings = {
-        platform: {
-            name: 'Heimdall Tools',
-            release: package_json_1.version,
-            target_id: { transformer: projectName }
-        },
-        version: package_json_1.version,
-        statistics: {},
-        profiles: [
-            {
-                name: 'Nikto Website Scanner',
-                title: { transformer: formatTitle },
-                summary: {
-                    path: 'banner',
-                    transformer: (input) => {
-                        return `Banner: ${input}`;
-                    }
-                },
-                supports: [],
-                attributes: [],
-                groups: [],
-                status: 'loaded',
-                controls: [
-                    {
-                        path: 'vulnerabilities',
-                        key: 'id',
-                        tags: {
-                            nist: { path: 'id', transformer: nistTag },
-                            cci: {
-                                path: 'id',
-                                transformer: (id) => (0, global_1.getCCIsForNISTTags)(nistTag(id))
-                            },
-                            ösvdb: { path: 'OSVDB' }
-                        },
-                        refs: [],
-                        source_location: {},
-                        title: { path: 'msg' },
-                        id: { path: 'id' },
-                        desc: { path: 'msg' },
-                        impact: 0.5,
-                        code: {
-                            transformer: (vulnerability) => JSON.stringify(vulnerability, null, 2)
-                        },
-                        results: [
-                            {
-                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                code_desc: { transformer: formatCodeDesc },
-                                start_time: ''
-                            }
-                        ]
-                    }
-                ],
-                sha256: ''
-            }
-        ],
-        passthrough: {
-            transformer: (data) => {
-                return {
-                    auxiliary_data: [
-                        {
-                            name: 'Nikto',
-                            data: _.omit(data, ['banner', 'host', 'port', 'vulnerabilities'])
-                        }
-                    ],
-                    ...(this.withRaw && { raw: data })
-                };
-            }
-        }
-    };
-    constructor(niktoJson, withRaw = false) {
-        super(JSON.parse(niktoJson));
-        this.withRaw = withRaw;
-    }
-}
-exports.NiktoMapper = NiktoMapper;
-//# sourceMappingURL=nikto-mapper.js.map

package/lib/src/nikto-mapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"nikto-mapper.js","sourceRoot":"","sources":["../../src/nikto-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAA6E;AAC7E,kEAA6D;AAC7D,2CAAkD;AAElD,MAAM,kBAAkB,GAAG,IAAI,mCAAgB,EAAE,CAAC;AAElD,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,iBAAiB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9C,CAAC;AACD,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AACrE,CAAC;AACD,SAAS,cAAc,CAAC,aAAsB;IAC5C,OAAO,SAAS,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAC1D,aAAa,EACb,QAAQ,CACT,EAAE,CAAC;AACN,CAAC;AACD,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAa,WAAY,SAAQ,8BAAa;IAC5C,OAAO,CAAU;IAEjB,QAAQ,GAGJ;QACF,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sBAAoB;YAC7B,SAAS,EAAE,EAAC,WAAW,EAAE,WAAW,EAAC;SACtC;QACD,OAAO,EAAE,sBAAoB;QAC7B,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,EAAC,WAAW,EAAE,WAAW,EAAC;gBACjC,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;wBACtC,OAAO,WAAW,KAAK,EAAE,CAAC;oBAC5B,CAAC;iBACF;gBACD,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,iBAAiB;wBACvB,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE;4BACJ,IAAI,EAAE,EAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAC;4BACxC,GAAG,EAAE;gCACH,IAAI,EAAE,IAAI;gCACV,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAA,2BAAkB,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;6BAC7D;4BACD,KAAK,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC;yBACvB;wBACD,IAAI,EAAE,EAAE;wBACR,eAAe,EAAE,EAAE;wBACnB,KAAK,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC;wBACpB,EAAE,EAAE,EAAC,IAAI,EAAE,IAAI,EAAC;wBAChB,IAAI,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC;wBACnB,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,aAAsC,EAAU,EAAE,CAC9D,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;yBACzC;wBACD,OAAO,EAAE;4BACP;gCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;gCAC3C,SAAS,EAAE,EAAC,WAAW,EAAE,cAAc,EAAC;gCACxC,UAAU,EAAE,EAAE;6BACf;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE;aACX;SACF;QACD,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,IAA6B,EAA2B,EAAE;gBACtE,OAAO;oBACL,cAAc,EAAE;wBACd;4BACE,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;yBAClE;qBACF;oBACD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC;iBACjC,CAAC;YACJ,CAAC;SACF;KACF,CAAC;IACF,YAAY,SAAiB,EAAE,OAAO,GAAG,KAAK;QAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAhFD,kCAgFC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport * as _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {BaseConverter, ILookupPath, MappedTransform} from './base-converter';\nimport {NiktoNistMapping} from './mappings/NiktoNistMapping';\nimport {getCCIsForNISTTags} from './utils/global';\n\nconst NIKTO_NIST_MAPPING = new NiktoNistMapping();\n\nfunction formatTitle(file: unknown): string {\n  return `Nikto Target: ${projectName(file)}`;\n}\nfunction projectName(file: unknown): string {\n  return `Host: ${_.get(file, 'host')} Port: ${_.get(file, 'port')}`;\n}\nfunction formatCodeDesc(vulnerability: unknown): string {\n  return `URL : ${_.get(vulnerability, 'url')} Method: ${_.get(\n    vulnerability,\n    'method'\n  )}`;\n}\nfunction nistTag(id: string): string[] {\n  return NIKTO_NIST_MAPPING.nistTag(id);\n}\n\nexport class NiktoMapper extends BaseConverter {\n  withRaw: boolean;\n\n  mappings: MappedTransform<\n    ExecJSON.Execution & {passthrough: unknown},\n    ILookupPath\n  > = {\n    platform: {\n      name: 'Heimdall Tools',\n      release: HeimdallToolsVersion,\n      target_id: {transformer: projectName}\n    },\n    version: HeimdallToolsVersion,\n    statistics: {},\n    profiles: [\n      {\n        name: 'Nikto Website Scanner',\n        title: {transformer: formatTitle},\n        summary: {\n          path: 'banner',\n          transformer: (input: unknown): string => {\n            return `Banner: ${input}`;\n          }\n        },\n        supports: [],\n        attributes: [],\n        groups: [],\n        status: 'loaded',\n        controls: [\n          {\n            path: 'vulnerabilities',\n            key: 'id',\n            tags: {\n              nist: {path: 'id', transformer: nistTag},\n              cci: {\n                path: 'id',\n                transformer: (id: string) => getCCIsForNISTTags(nistTag(id))\n              },\n              ösvdb: {path: 'OSVDB'}\n            },\n            refs: [],\n            source_location: {},\n            title: {path: 'msg'},\n            id: {path: 'id'},\n            desc: {path: 'msg'},\n            impact: 0.5,\n            code: {\n              transformer: (vulnerability: Record<string, unknown>): string =>\n                JSON.stringify(vulnerability, null, 2)\n            },\n            results: [\n              {\n                status: ExecJSON.ControlResultStatus.Failed,\n                code_desc: {transformer: formatCodeDesc},\n                start_time: ''\n              }\n            ]\n          }\n        ],\n        sha256: ''\n      }\n    ],\n    passthrough: {\n      transformer: (data: Record<string, unknown>): Record<string, unknown> => {\n        return {\n          auxiliary_data: [\n            {\n              name: 'Nikto',\n              data: _.omit(data, ['banner', 'host', 'port', 'vulnerabilities'])\n            }\n          ],\n          ...(this.withRaw && {raw: data})\n        };\n      }\n    }\n  };\n  constructor(niktoJson: string, withRaw = false) {\n    super(JSON.parse(niktoJson));\n    this.withRaw = withRaw;\n  }\n}\n"]}

package/lib/src/prisma-mapper.d.ts

@@ -1,25 +0,0 @@
-import { ExecJSON } from 'inspecjs';
-import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
-export type PrismaControl = {
-    Packages: string;
-    Description: string;
-    Distro: string;
-    Type: string;
-    Hostname: string;
-    'Compliance ID': string;
-    'Fix Status'?: string;
-    'CVE ID': string;
-    Severity: string;
-    Cause?: string;
-};
-export declare function nistTag(cveTag: string | undefined): string[];
-export declare class PrismaControlMapper extends BaseConverter {
-    mappings: MappedTransform<ExecJSON.Execution, ILookupPath>;
-    constructor(prismaControls: PrismaControl[]);
-}
-export declare class PrismaMapper {
-    data: PrismaControl[];
-    toHdf(): ExecJSON.Execution[];
-    constructor(prismaCsv: string);
-}
-//# sourceMappingURL=prisma-mapper.d.ts.map

package/lib/src/prisma-mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"prisma-mapper.d.ts","sourceRoot":"","sources":["../../src/prisma-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAUF,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,YAMjD;AAED,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAqHxD;gBAEU,cAAc,EAAE,aAAa,EAAE;CAG5C;AAED,qBAAa,YAAY;IACvB,IAAI,EAAE,aAAa,EAAE,CAAM;IAE3B,KAAK,IAAI,QAAQ,CAAC,SAAS,EAAE;gBAgBjB,SAAS,EAAE,MAAM;CAG9B"}

package/lib/src/prisma-mapper.js

@@ -1,211 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PrismaMapper = exports.PrismaControlMapper = void 0;
-exports.nistTag = nistTag;
-const inspecjs_1 = require("inspecjs");
-const _ = __importStar(require("lodash"));
-const package_json_1 = require("../package.json");
-const base_converter_1 = require("./base-converter");
-const global_1 = require("./utils/global");
-const SEVERITY_LOOKUP = {
-    low: 0.3,
-    moderate: 0.5,
-    high: 0.7,
-    important: 0.9,
-    critical: 1
-};
-function nistTag(cveTag) {
-    if (!cveTag) {
-        return global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS;
-    }
-    else {
-        return global_1.DEFAULT_UPDATE_REMEDIATION_NIST_TAGS;
-    }
-}
-class PrismaControlMapper extends base_converter_1.BaseConverter {
-    mappings = {
-        platform: {
-            name: 'Heimdall Tools',
-            release: package_json_1.version,
-            target_id: 'Prisma Cloud Scan Report'
-        },
-        version: package_json_1.version,
-        statistics: {
-            duration: null
-        },
-        profiles: [
-            {
-                name: 'Palo Alto Prisma Cloud Tool',
-                version: '',
-                title: 'Prisma Cloud Scan Report',
-                maintainer: null,
-                summary: '',
-                license: null,
-                copyright: null,
-                copyright_email: null,
-                supports: [],
-                attributes: [],
-                depends: [],
-                groups: [],
-                status: 'loaded',
-                controls: [
-                    {
-                        path: 'records',
-                        key: 'id',
-                        desc: { path: 'Description' },
-                        tags: {
-                            cci: {
-                                path: 'CVE ID',
-                                transformer: (cve) => (0, global_1.getCCIsForNISTTags)(nistTag(cve))
-                            },
-                            nist: {
-                                path: 'CVE ID',
-                                transformer: nistTag
-                            },
-                            cve: { path: 'CVE ID' },
-                            cvss: { path: 'cssv' }
-                        },
-                        descriptions: [],
-                        refs: [{ url: { path: 'Vulnerability Link' } }],
-                        source_location: { path: 'Hostname' },
-                        id: {
-                            transformer: (item) => {
-                                if (item['CVE ID']) {
-                                    return `${item['Compliance ID']}-${item['CVE ID']}`;
-                                }
-                                else {
-                                    return `${item['Compliance ID']}-${item.Distro}-${item.Severity}`;
-                                }
-                            }
-                        },
-                        title: {
-                            transformer: (item) => `${item.Hostname}-${item.Distro}-${item.Type}`
-                        },
-                        impact: {
-                            path: 'Severity',
-                            transformer: (severity) => {
-                                if (severity) {
-                                    return SEVERITY_LOOKUP[severity];
-                                }
-                                else {
-                                    return 0.5;
-                                }
-                            }
-                        },
-                        code: {
-                            transformer: (obj) => JSON.stringify(obj, null, 2)
-                        },
-                        results: [
-                            {
-                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                code_desc: {
-                                    transformer: (obj) => {
-                                        let result = '';
-                                        if (obj.Type === 'image') {
-                                            if (obj['Packages'] !== '') {
-                                                result += `Version check of package: ${obj['Packages']}`;
-                                            }
-                                        }
-                                        else if (obj.Type === 'linux') {
-                                            if (obj.Distro !== '') {
-                                                result += `Configuration check for ${obj.Distro}`;
-                                            }
-                                            else {
-                                                result += ``;
-                                            }
-                                        }
-                                        else {
-                                            result += `${obj.Type} check for ${obj.Hostname}`;
-                                        }
-                                        result += `\n\n${obj.Description}`;
-                                        return result;
-                                    }
-                                },
-                                message: {
-                                    transformer: (obj) => {
-                                        let result = '';
-                                        if (obj['Fix Status'] !== '' && obj.Cause !== '') {
-                                            result += `Fix Status: ${obj['Fix Status']}\n\n${obj.Cause}`;
-                                        }
-                                        else if (obj['Fix Status'] !== '') {
-                                            result += `Fix Status: ${obj['Fix Status']}`;
-                                        }
-                                        else if (obj.Cause !== '') {
-                                            result += `Cause: ${obj.Cause}`;
-                                        }
-                                        else {
-                                            result += 'Unknown';
-                                        }
-                                        return result;
-                                    }
-                                },
-                                start_time: { path: 'Published' }
-                            }
-                        ]
-                    }
-                ],
-                sha256: ''
-            }
-        ]
-    };
-    constructor(prismaControls) {
-        super({ records: prismaControls });
-    }
-}
-exports.PrismaControlMapper = PrismaControlMapper;
-class PrismaMapper {
-    data = [];
-    toHdf() {
-        const executions = [];
-        const hostnameToControls = {};
-        this.data.forEach((record) => {
-            hostnameToControls[record['Hostname']] =
-                hostnameToControls[record['Hostname']] || [];
-            hostnameToControls[record['Hostname']].push(record);
-        });
-        Object.entries(hostnameToControls).forEach(([hostname, controls]) => {
-            const converted = new PrismaControlMapper(controls).toHdf();
-            _.set(converted, 'platform.target_id', hostname);
-            executions.push(converted);
-        });
-        return executions;
-    }
-    constructor(prismaCsv) {
-        this.data = (0, base_converter_1.parseCsv)(prismaCsv);
-    }
-}
-exports.PrismaMapper = PrismaMapper;
-//# sourceMappingURL=prisma-mapper.js.map

package/lib/src/prisma-mapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prisma-mapper.js","sourceRoot":"","sources":["../../src/prisma-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,0BAMC;AA1CD,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAK0B;AAC1B,2CAIwB;AAexB,MAAM,eAAe,GAA2B;IAC9C,GAAG,EAAE,GAAG;IACR,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAgB,OAAO,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,+CAAsC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,OAAO,6CAAoC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAa,mBAAoB,SAAQ,8BAAa;IACpD,QAAQ,GAAqD;QAC3D,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sBAAoB;YAC7B,SAAS,EAAE,0BAA0B;SACtC;QACD,OAAO,EAAE,sBAAoB;QAC7B,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI;SACf;QACD,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,0BAA0B;gBACjC,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI;gBACf,eAAe,EAAE,IAAI;gBACrB,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,SAAS;wBACf,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE,EAAC,IAAI,EAAE,aAAa,EAAC;wBAC3B,IAAI,EAAE;4BACJ,GAAG,EAAE;gCACH,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAA,2BAAkB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;6BAC/D;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,OAAO;6BACrB;4BACD,GAAG,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC;4BACrB,IAAI,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;yBACrB;wBACD,YAAY,EAAE,EAAE;wBAChB,IAAI,EAAE,CAAC,EAAC,GAAG,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAC,EAAC,CAAC;wBAC3C,eAAe,EAAE,EAAC,IAAI,EAAE,UAAU,EAAC;wBACnC,EAAE,EAAE;4BACF,WAAW,EAAE,CAAC,IAAmB,EAAE,EAAE;gCACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oCACnB,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gCACtD,CAAC;qCAAM,CAAC;oCACN,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACpE,CAAC;4BACH,CAAC;yBACF;wBACD,KAAK,EAAE;4BACL,WAAW,EAAE,CAAC,IAAmB,EAAE,EAAE,CACnC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE;yBACjD;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,UAAU;4BAChB,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;gCAChC,IAAI,QAAQ,EAAE,CAAC;oCACb,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;gCACnC,CAAC;qCAAM,CAAC;oCACN,OAAO,GAAG,CAAC;gCACb,CAAC;4BACH,CAAC;yBACF;wBACD,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,GAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;yBAClE;wBACD,OAAO,EAAE;4BACP;gCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;gCAC3C,SAAS,EAAE;oCACT,WAAW,EAAE,CAAC,GAAkB,EAAE,EAAE;wCAClC,IAAI,MAAM,GAAG,EAAE,CAAC;wCAChB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4CACzB,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;gDAC3B,MAAM,IAAI,6BAA6B,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;4CAC3D,CAAC;wCACH,CAAC;6CAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4CAChC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gDACtB,MAAM,IAAI,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC;4CACpD,CAAC;iDAAM,CAAC;gDACN,MAAM,IAAI,EAAE,CAAC;4CACf,CAAC;wCACH,CAAC;6CAAM,CAAC;4CACN,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,QAAQ,EAAE,CAAC;wCACpD,CAAC;wCACD,MAAM,IAAI,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;wCACnC,OAAO,MAAM,CAAC;oCAChB,CAAC;iCACF;gCACD,OAAO,EAAE;oCACP,WAAW,EAAE,CAAC,GAAkB,EAAE,EAAE;wCAClC,IAAI,MAAM,GAAG,EAAE,CAAC;wCAChB,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;4CACjD,MAAM,IAAI,eAAe,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;wCAC/D,CAAC;6CAAM,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;4CACpC,MAAM,IAAI,eAAe,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;wCAC/C,CAAC;6CAAM,IAAI,GAAG,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;4CAC5B,MAAM,IAAI,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC;wCAClC,CAAC;6CAAM,CAAC;4CACN,MAAM,IAAI,SAAS,CAAC;wCACtB,CAAC;wCACD,OAAO,MAAM,CAAC;oCAChB,CAAC;iCACF;gCACD,UAAU,EAAE,EAAC,IAAI,EAAE,WAAW,EAAC;6BAChC;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE;aACX;SACF;KACF,CAAC;IAEF,YAAY,cAA+B;QACzC,KAAK,CAAC,EAAC,OAAO,EAAE,cAAc,EAAC,CAAC,CAAC;IACnC,CAAC;CACF;AA3HD,kDA2HC;AAED,MAAa,YAAY;IACvB,IAAI,GAAoB,EAAE,CAAC;IAE3B,KAAK;QACH,MAAM,UAAU,GAAyB,EAAE,CAAC;QAC5C,MAAM,kBAAkB,GAAoC,EAAE,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAqB,EAAE,EAAE;YAC1C,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACpC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE;YAClE,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;YAC5D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,YAAY,SAAiB;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAQ,EAAC,SAAS,CAAoB,CAAC;IACrD,CAAC;CACF;AAtBD,oCAsBC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport * as _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {\n  BaseConverter,\n  ILookupPath,\n  MappedTransform,\n  parseCsv\n} from './base-converter';\nimport {\n  DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS,\n  DEFAULT_UPDATE_REMEDIATION_NIST_TAGS,\n  getCCIsForNISTTags\n} from './utils/global';\n\nexport type PrismaControl = {\n  Packages: string;\n  Description: string;\n  Distro: string;\n  Type: string;\n  Hostname: string;\n  'Compliance ID': string;\n  'Fix Status'?: string;\n  'CVE ID': string;\n  Severity: string;\n  Cause?: string;\n};\n\nconst SEVERITY_LOOKUP: Record<string, number> = {\n  low: 0.3,\n  moderate: 0.5,\n  high: 0.7,\n  important: 0.9,\n  critical: 1\n};\n\nexport function nistTag(cveTag: string | undefined) {\n  if (!cveTag) {\n    return DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS;\n  } else {\n    return DEFAULT_UPDATE_REMEDIATION_NIST_TAGS;\n  }\n}\n\nexport class PrismaControlMapper extends BaseConverter {\n  mappings: MappedTransform<ExecJSON.Execution, ILookupPath> = {\n    platform: {\n      name: 'Heimdall Tools',\n      release: HeimdallToolsVersion,\n      target_id: 'Prisma Cloud Scan Report'\n    },\n    version: HeimdallToolsVersion,\n    statistics: {\n      duration: null\n    },\n    profiles: [\n      {\n        name: 'Palo Alto Prisma Cloud Tool',\n        version: '',\n        title: 'Prisma Cloud Scan Report',\n        maintainer: null,\n        summary: '',\n        license: null,\n        copyright: null,\n        copyright_email: null,\n        supports: [],\n        attributes: [],\n        depends: [],\n        groups: [],\n        status: 'loaded',\n        controls: [\n          {\n            path: 'records',\n            key: 'id',\n            desc: {path: 'Description'},\n            tags: {\n              cci: {\n                path: 'CVE ID',\n                transformer: (cve: string) => getCCIsForNISTTags(nistTag(cve))\n              },\n              nist: {\n                path: 'CVE ID',\n                transformer: nistTag\n              },\n              cve: {path: 'CVE ID'},\n              cvss: {path: 'cssv'}\n            },\n            descriptions: [],\n            refs: [{url: {path: 'Vulnerability Link'}}],\n            source_location: {path: 'Hostname'},\n            id: {\n              transformer: (item: PrismaControl) => {\n                if (item['CVE ID']) {\n                  return `${item['Compliance ID']}-${item['CVE ID']}`;\n                } else {\n                  return `${item['Compliance ID']}-${item.Distro}-${item.Severity}`;\n                }\n              }\n            },\n            title: {\n              transformer: (item: PrismaControl) =>\n                `${item.Hostname}-${item.Distro}-${item.Type}`\n            },\n            impact: {\n              path: 'Severity',\n              transformer: (severity: string) => {\n                if (severity) {\n                  return SEVERITY_LOOKUP[severity];\n                } else {\n                  return 0.5;\n                }\n              }\n            },\n            code: {\n              transformer: (obj: PrismaControl) => JSON.stringify(obj, null, 2)\n            },\n            results: [\n              {\n                status: ExecJSON.ControlResultStatus.Failed,\n                code_desc: {\n                  transformer: (obj: PrismaControl) => {\n                    let result = '';\n                    if (obj.Type === 'image') {\n                      if (obj['Packages'] !== '') {\n                        result += `Version check of package: ${obj['Packages']}`;\n                      }\n                    } else if (obj.Type === 'linux') {\n                      if (obj.Distro !== '') {\n                        result += `Configuration check for ${obj.Distro}`;\n                      } else {\n                        result += ``;\n                      }\n                    } else {\n                      result += `${obj.Type} check for ${obj.Hostname}`;\n                    }\n                    result += `\\n\\n${obj.Description}`;\n                    return result;\n                  }\n                },\n                message: {\n                  transformer: (obj: PrismaControl) => {\n                    let result = '';\n                    if (obj['Fix Status'] !== '' && obj.Cause !== '') {\n                      result += `Fix Status: ${obj['Fix Status']}\\n\\n${obj.Cause}`;\n                    } else if (obj['Fix Status'] !== '') {\n                      result += `Fix Status: ${obj['Fix Status']}`;\n                    } else if (obj.Cause !== '') {\n                      result += `Cause: ${obj.Cause}`;\n                    } else {\n                      result += 'Unknown';\n                    }\n                    return result;\n                  }\n                },\n                start_time: {path: 'Published'}\n              }\n            ]\n          }\n        ],\n        sha256: ''\n      }\n    ]\n  };\n\n  constructor(prismaControls: PrismaControl[]) {\n    super({records: prismaControls});\n  }\n}\n\nexport class PrismaMapper {\n  data: PrismaControl[] = [];\n\n  toHdf(): ExecJSON.Execution[] {\n    const executions: ExecJSON.Execution[] = [];\n    const hostnameToControls: Record<string, PrismaControl[]> = {};\n    this.data.forEach((record: PrismaControl) => {\n      hostnameToControls[record['Hostname']] =\n        hostnameToControls[record['Hostname']] || [];\n      hostnameToControls[record['Hostname']].push(record);\n    });\n    Object.entries(hostnameToControls).forEach(([hostname, controls]) => {\n      const converted = new PrismaControlMapper(controls).toHdf();\n      _.set(converted, 'platform.target_id', hostname);\n      executions.push(converted);\n    });\n    return executions;\n  }\n\n  constructor(prismaCsv: string) {\n    this.data = parseCsv(prismaCsv) as PrismaControl[];\n  }\n}\n"]}

package/lib/src/sarif-mapper.d.ts

@@ -1,10 +0,0 @@
-import { ExecJSON } from 'inspecjs';
-import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
-export declare class SarifMapper extends BaseConverter {
-    withRaw: boolean;
-    mappings: MappedTransform<ExecJSON.Execution & {
-        passthrough: unknown;
-    }, ILookupPath>;
-    constructor(sarifJson: string, withRaw?: boolean);
-}
-//# sourceMappingURL=sarif-mapper.d.ts.map

package/lib/src/sarif-mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sarif-mapper.d.ts","sourceRoot":"","sources":["../../src/sarif-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EAAC,aAAa,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,kBAAkB,CAAC;AA6C7E,qBAAa,WAAY,SAAQ,aAAa;IAC5C,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,SAAS,GAAG;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,EAC3C,WAAW,CACZ,CAmHC;gBACU,SAAS,EAAE,MAAM,EAAE,OAAO,UAAQ;CAI/C"}

package/lib/src/sarif-mapper.js

@@ -1,190 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SarifMapper = void 0;
-const inspecjs_1 = require("inspecjs");
-const _ = __importStar(require("lodash"));
-const package_json_1 = require("../package.json");
-const base_converter_1 = require("./base-converter");
-const CweNistMapping_1 = require("./mappings/CweNistMapping");
-const global_1 = require("./utils/global");
-const IMPACT_MAPPING = new Map([
-    ['error', 0.7],
-    ['warning', 0.5],
-    ['note', 0.3]
-]);
-const MESSAGE_TEXT = 'message.text';
-const CWE_NIST_MAPPING = new CweNistMapping_1.CweNistMapping();
-function extractCwe(text) {
-    let output = text.split('(').slice(-1)[0].slice(0, -2).split(', ');
-    if (output.length === 1) {
-        output = text.split('(').slice(-1)[0].slice(0, -2).split('!/');
-    }
-    return output;
-}
-function impactMapping(severity) {
-    if (typeof severity === 'string' || typeof severity === 'number') {
-        return IMPACT_MAPPING.get(severity.toString().toLowerCase()) || 0.1;
-    }
-    else {
-        return 0.1;
-    }
-}
-function formatCodeDesc(input) {
-    const output = [];
-    output.push(`URL : ${_.get(input, 'artifactLocation.uri')}`);
-    output.push(`LINE : ${_.get(input, 'region.startLine')}`);
-    output.push(`COLUMN : ${_.get(input, 'region.startColumn')}`);
-    return output.join(' ');
-}
-function nistTag(text) {
-    let identifiers = extractCwe(text);
-    identifiers = identifiers.map((element) => element.split('-')[1]);
-    return CWE_NIST_MAPPING.nistFilter(identifiers, global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS);
-}
-class SarifMapper extends base_converter_1.BaseConverter {
-    withRaw;
-    mappings = {
-        platform: {
-            name: 'Heimdall Tools',
-            release: package_json_1.version,
-            target_id: 'Static Analysis Results Interchange Format'
-        },
-        version: package_json_1.version,
-        statistics: {},
-        profiles: [
-            {
-                path: 'runs',
-                name: 'SARIF',
-                version: { path: '$.version' },
-                title: 'Static Analysis Results Interchange Format',
-                supports: [],
-                attributes: [],
-                groups: [],
-                status: 'loaded',
-                controls: [
-                    {
-                        path: 'results',
-                        key: 'id',
-                        tags: {
-                            cci: {
-                                path: 'vulnerabilityClassifications',
-                                transformer: (data) => (0, global_1.getCCIsForNISTTags)(nistTag(data))
-                            },
-                            nist: { path: MESSAGE_TEXT, transformer: nistTag },
-                            cwe: {
-                                path: MESSAGE_TEXT,
-                                transformer: extractCwe
-                            }
-                        },
-                        refs: [],
-                        source_location: {
-                            transformer: (control) => {
-                                return _.omitBy({
-                                    ref: _.get(control, 'locations[0].physicalLocation.artifactLocation.uri'),
-                                    line: _.get(control, 'locations[0].physicalLocation.region.startLine')
-                                }, (value) => value === '');
-                            }
-                        },
-                        title: {
-                            path: MESSAGE_TEXT,
-                            transformer: (text) => {
-                                if (typeof text === 'string') {
-                                    return text.split(': ')[0];
-                                }
-                                else {
-                                    return '';
-                                }
-                            }
-                        },
-                        id: { path: 'ruleId' },
-                        desc: {
-                            path: MESSAGE_TEXT,
-                            transformer: (text) => {
-                                if (typeof text === 'string') {
-                                    return text.split(': ')[1];
-                                }
-                                else {
-                                    return '';
-                                }
-                            }
-                        },
-                        impact: { path: 'level', transformer: impactMapping },
-                        code: {
-                            transformer: (vulnerability) => JSON.stringify(vulnerability, null, 2)
-                        },
-                        results: [
-                            {
-                                status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
-                                code_desc: {
-                                    path: 'locations[0].physicalLocation',
-                                    transformer: formatCodeDesc
-                                },
-                                start_time: ''
-                            }
-                        ]
-                    }
-                ],
-                sha256: ''
-            }
-        ],
-        passthrough: {
-            transformer: (data) => {
-                let runsData = _.get(data, 'runs');
-                if (Array.isArray(runsData)) {
-                    runsData = runsData.map((run) => _.omit(run, ['results']));
-                }
-                return {
-                    auxiliary_data: [
-                        {
-                            name: 'SARIF',
-                            data: {
-                                $schema: _.get(data, '$schema'),
-                                runs: runsData
-                            }
-                        }
-                    ],
-                    ...(this.withRaw && { raw: data })
-                };
-            }
-        }
-    };
-    constructor(sarifJson, withRaw = false) {
-        super(JSON.parse(sarifJson));
-        this.withRaw = withRaw;
-    }
-}
-exports.SarifMapper = SarifMapper;
-//# sourceMappingURL=sarif-mapper.js.map

package/lib/src/sarif-mapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sarif-mapper.js","sourceRoot":"","sources":["../../src/sarif-mapper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAkC;AAClC,0CAA4B;AAC5B,kDAAgE;AAChE,qDAA6E;AAC7E,8DAAyD;AACzD,2CAGwB;AAExB,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,OAAO,EAAE,GAAG,CAAC;IACd,CAAC,SAAS,EAAE,GAAG,CAAC;IAChB,CAAC,MAAM,EAAE,GAAG,CAAC;CACd,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,gBAAgB,GAAG,IAAI,+BAAc,EAAE,CAAC;AAE9C,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AACD,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AACD,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,gBAAgB,CAAC,UAAU,CAChC,WAAW,EACX,+CAAsC,CACvC,CAAC;AACJ,CAAC;AAED,MAAa,WAAY,SAAQ,8BAAa;IAC5C,OAAO,CAAU;IAEjB,QAAQ,GAGJ;QACF,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sBAAoB;YAC7B,SAAS,EAAE,4CAA4C;SACxD;QACD,OAAO,EAAE,sBAAoB;QAC7B,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,EAAC,IAAI,EAAE,WAAW,EAAC;gBAC5B,KAAK,EAAE,4CAA4C;gBACnD,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,SAAS;wBACf,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE;4BACJ,GAAG,EAAE;gCACH,IAAI,EAAE,8BAA8B;gCACpC,WAAW,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,2BAAkB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;6BACjE;4BACD,IAAI,EAAE,EAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAC;4BAChD,GAAG,EAAE;gCACH,IAAI,EAAE,YAAY;gCAClB,WAAW,EAAE,UAAU;6BACxB;yBACF;wBACD,IAAI,EAAE,EAAE;wBACR,eAAe,EAAE;4BACf,WAAW,EAAE,CAAC,OAAgB,EAAE,EAAE;gCAChC,OAAO,CAAC,CAAC,MAAM,CACb;oCACE,GAAG,EAAE,CAAC,CAAC,GAAG,CACR,OAAO,EACP,oDAAoD,CACrD;oCACD,IAAI,EAAE,CAAC,CAAC,GAAG,CACT,OAAO,EACP,gDAAgD,CACjD;iCACF,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CACxB,CAAC;4BACJ,CAAC;yBACF;wBACD,KAAK,EAAE;4BACL,IAAI,EAAE,YAAY;4BAClB,WAAW,EAAE,CAAC,IAAa,EAAU,EAAE;gCACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oCAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gCAC7B,CAAC;qCAAM,CAAC;oCACN,OAAO,EAAE,CAAC;gCACZ,CAAC;4BACH,CAAC;yBACF;wBACD,EAAE,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC;wBACpB,IAAI,EAAE;4BACJ,IAAI,EAAE,YAAY;4BAClB,WAAW,EAAE,CAAC,IAAa,EAAU,EAAE;gCACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oCAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gCAC7B,CAAC;qCAAM,CAAC;oCACN,OAAO,EAAE,CAAC;gCACZ,CAAC;4BACH,CAAC;yBACF;wBACD,MAAM,EAAE,EAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAC;wBACnD,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,aAAsC,EAAU,EAAE,CAC9D,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;yBACzC;wBACD,OAAO,EAAE;4BACP;gCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;gCAC3C,SAAS,EAAE;oCACT,IAAI,EAAE,+BAA+B;oCACrC,WAAW,EAAE,cAAc;iCAC5B;gCAED,UAAU,EAAE,EAAE;6BACf;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE;aACX;SACF;QACD,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,IAA6B,EAA2B,EAAE;gBACtE,IAAI,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAA4B,EAAE,EAAE,CACvD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CACzB,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE;wBACd;4BACE,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE;gCACJ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;gCAC/B,IAAI,EAAE,QAAQ;6BACf;yBACF;qBACF;oBACD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC;iBACjC,CAAC;YACJ,CAAC;SACF;KACF,CAAC;IACF,YAAY,SAAiB,EAAE,OAAO,GAAG,KAAK;QAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AA9HD,kCA8HC","sourcesContent":["import {ExecJSON} from 'inspecjs';\nimport * as _ from 'lodash';\nimport {version as HeimdallToolsVersion} from '../package.json';\nimport {BaseConverter, ILookupPath, MappedTransform} from './base-converter';\nimport {CweNistMapping} from './mappings/CweNistMapping';\nimport {\n  DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS,\n  getCCIsForNISTTags\n} from './utils/global';\n\nconst IMPACT_MAPPING: Map<string, number> = new Map([\n  ['error', 0.7],\n  ['warning', 0.5],\n  ['note', 0.3]\n]);\nconst MESSAGE_TEXT = 'message.text';\nconst CWE_NIST_MAPPING = new CweNistMapping();\n\nfunction extractCwe(text: string): string[] {\n  let output = text.split('(').slice(-1)[0].slice(0, -2).split(', ');\n  if (output.length === 1) {\n    output = text.split('(').slice(-1)[0].slice(0, -2).split('!/');\n  }\n  return output;\n}\nfunction impactMapping(severity: unknown): number {\n  if (typeof severity === 'string' || typeof severity === 'number') {\n    return IMPACT_MAPPING.get(severity.toString().toLowerCase()) || 0.1;\n  } else {\n    return 0.1;\n  }\n}\nfunction formatCodeDesc(input: unknown): string {\n  const output = [];\n  output.push(`URL : ${_.get(input, 'artifactLocation.uri')}`);\n  output.push(`LINE : ${_.get(input, 'region.startLine')}`);\n  output.push(`COLUMN : ${_.get(input, 'region.startColumn')}`);\n  return output.join(' ');\n}\nfunction nistTag(text: string): string[] {\n  let identifiers = extractCwe(text);\n  identifiers = identifiers.map((element) => element.split('-')[1]);\n  return CWE_NIST_MAPPING.nistFilter(\n    identifiers,\n    DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS\n  );\n}\n\nexport class SarifMapper extends BaseConverter {\n  withRaw: boolean;\n\n  mappings: MappedTransform<\n    ExecJSON.Execution & {passthrough: unknown},\n    ILookupPath\n  > = {\n    platform: {\n      name: 'Heimdall Tools',\n      release: HeimdallToolsVersion,\n      target_id: 'Static Analysis Results Interchange Format'\n    },\n    version: HeimdallToolsVersion,\n    statistics: {},\n    profiles: [\n      {\n        path: 'runs',\n        name: 'SARIF',\n        version: {path: '$.version'},\n        title: 'Static Analysis Results Interchange Format',\n        supports: [],\n        attributes: [],\n        groups: [],\n        status: 'loaded',\n        controls: [\n          {\n            path: 'results',\n            key: 'id',\n            tags: {\n              cci: {\n                path: 'vulnerabilityClassifications',\n                transformer: (data: string) => getCCIsForNISTTags(nistTag(data))\n              },\n              nist: {path: MESSAGE_TEXT, transformer: nistTag},\n              cwe: {\n                path: MESSAGE_TEXT,\n                transformer: extractCwe\n              }\n            },\n            refs: [],\n            source_location: {\n              transformer: (control: unknown) => {\n                return _.omitBy(\n                  {\n                    ref: _.get(\n                      control,\n                      'locations[0].physicalLocation.artifactLocation.uri'\n                    ),\n                    line: _.get(\n                      control,\n                      'locations[0].physicalLocation.region.startLine'\n                    )\n                  },\n                  (value) => value === ''\n                );\n              }\n            },\n            title: {\n              path: MESSAGE_TEXT,\n              transformer: (text: unknown): string => {\n                if (typeof text === 'string') {\n                  return text.split(': ')[0];\n                } else {\n                  return '';\n                }\n              }\n            },\n            id: {path: 'ruleId'},\n            desc: {\n              path: MESSAGE_TEXT,\n              transformer: (text: unknown): string => {\n                if (typeof text === 'string') {\n                  return text.split(': ')[1];\n                } else {\n                  return '';\n                }\n              }\n            },\n            impact: {path: 'level', transformer: impactMapping},\n            code: {\n              transformer: (vulnerability: Record<string, unknown>): string =>\n                JSON.stringify(vulnerability, null, 2)\n            },\n            results: [\n              {\n                status: ExecJSON.ControlResultStatus.Failed,\n                code_desc: {\n                  path: 'locations[0].physicalLocation',\n                  transformer: formatCodeDesc\n                },\n\n                start_time: ''\n              }\n            ]\n          }\n        ],\n        sha256: ''\n      }\n    ],\n    passthrough: {\n      transformer: (data: Record<string, unknown>): Record<string, unknown> => {\n        let runsData = _.get(data, 'runs');\n        if (Array.isArray(runsData)) {\n          runsData = runsData.map((run: Record<string, unknown>) =>\n            _.omit(run, ['results'])\n          );\n        }\n        return {\n          auxiliary_data: [\n            {\n              name: 'SARIF',\n              data: {\n                $schema: _.get(data, '$schema'),\n                runs: runsData\n              }\n            }\n          ],\n          ...(this.withRaw && {raw: data})\n        };\n      }\n    }\n  };\n  constructor(sarifJson: string, withRaw = false) {\n    super(JSON.parse(sarifJson));\n    this.withRaw = withRaw;\n  }\n}\n"]}

package/lib/src/scoutsuite-mapper.d.ts

@@ -1,10 +0,0 @@
-import { ExecJSON } from 'inspecjs';
-import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
-export declare class ScoutsuiteMapper extends BaseConverter {
-    withRaw: boolean;
-    mappings: MappedTransform<ExecJSON.Execution & {
-        passthrough: unknown;
-    }, ILookupPath>;
-    constructor(scoutsuiteJson: string, withRaw?: boolean);
-}
-//# sourceMappingURL=scoutsuite-mapper.d.ts.map

package/lib/src/scoutsuite-mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scoutsuite-mapper.d.ts","sourceRoot":"","sources":["../../src/scoutsuite-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,UAAU,CAAC;AAGlC,OAAO,EACL,aAAa,EACb,WAAW,EAEX,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAkH1B,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,SAAS,GAAG;QAAC,WAAW,EAAE,OAAO,CAAA;KAAC,EAC3C,WAAW,CACZ,CAoKC;gBACU,cAAc,EAAE,MAAM,EAAE,OAAO,UAAQ;CAIpD"}