@mitre/hdf-converters 2.13.0 → 3.0.1

package/dist/converters/fortify-to-hdf/typescript/converter.js

@@ -0,0 +1,211 @@
+import { parseXml } from '@mitre/hdf-utilities';
+import { nistToCci } from '@mitre/hdf-mappings';
+import { inputChecksum, buildNistCciTags, limitArray, stripHTML, ensureArray, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, validateInputSize, } from '../../../shared/typescript/converterutil.js';
+import { ResultStatus, Copyright, createMinimalBaseline, } from '@mitre/hdf-schema';
+// NIST 800-53 reference name used by Fortify in Description.References
+const NIST_REFERENCE_NAME = 'Standards Mapping - NIST Special Publication 800-53 Revision 4';
+// Regex to match NIST control identifiers like SI-10, AC-2
+const NIST_PATTERN = /[a-zA-Z]{2}-\d+/g;
+// --- Helpers ---
+function buildSnippetMap(snippets) {
+    const map = new Map();
+    for (const s of snippets) {
+        if (s.id) {
+            map.set(s.id, s);
+        }
+    }
+    return map;
+}
+function groupVulnsByClassID(vulns) {
+    const groups = new Map();
+    for (const vuln of vulns) {
+        const classID = vuln.ClassInfo?.ClassID ?? 'unknown';
+        const existing = groups.get(classID);
+        if (existing) {
+            existing.push(vuln);
+        }
+        else {
+            groups.set(classID, [vuln]);
+        }
+    }
+    return groups;
+}
+function extractNISTFromReferences(refs) {
+    for (const ref of refs) {
+        if (ref.Author === NIST_REFERENCE_NAME) {
+            const matches = ref.Title?.match(NIST_PATTERN);
+            if (matches && matches.length > 0) {
+                return matches;
+            }
+        }
+    }
+    return [];
+}
+function formatSnippet(snippet) {
+    const text = (snippet.Text ?? '').trim();
+    return `Path: ${snippet.File ?? ''}\nStartLine: ${snippet.StartLine ?? ''}, EndLine: ${snippet.EndLine ?? ''}\nCode:\n${text}`;
+}
+function buildCodeDesc(vuln, snippetMap) {
+    const parts = [];
+    const entries = ensureArray(vuln.AnalysisInfo?.Unified?.Trace?.Primary?.Entry);
+    for (const entry of entries) {
+        if (!entry.Node)
+            continue;
+        const snippetID = entry.Node.SourceLocation?.snippet;
+        if (!snippetID) {
+            const path = entry.Node.SourceLocation?.path;
+            const line = entry.Node.SourceLocation?.line;
+            if (path) {
+                parts.push(`Path: ${path}\nLine: ${line ?? ''}`);
+            }
+            continue;
+        }
+        const snippet = snippetMap.get(snippetID);
+        if (snippet) {
+            parts.push(formatSnippet(snippet));
+        }
+    }
+    if (parts.length === 0) {
+        return `ClassID: ${vuln.ClassInfo?.ClassID ?? ''}, InstanceID: ${vuln.InstanceInfo?.InstanceID ?? ''}`;
+    }
+    return parts.join('\n');
+}
+function buildRequirement(desc, vulns, snippetMap, startTimeStr) {
+    // Extract NIST tags from Description References
+    const refs = ensureArray(desc.References?.Reference);
+    let nistTags = extractNISTFromReferences(refs);
+    if (nistTags.length === 0) {
+        nistTags = [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
+    }
+    const cciTags = nistToCci(nistTags);
+    const tags = buildNistCciTags(nistTags, cciTags);
+    // Title from Abstract (HTML stripped)
+    const title = stripHTML(desc.Abstract ?? '');
+    // Default description from Explanation (HTML stripped)
+    let explanationText = stripHTML(desc.Explanation ?? '');
+    if (!explanationText) {
+        explanationText = title;
+    }
+    const descriptions = [
+        { label: 'default', data: explanationText },
+    ];
+    // Fix description from Recommendations
+    if (desc.Recommendations) {
+        descriptions.push({
+            label: 'fix',
+            data: stripHTML(desc.Recommendations),
+        });
+    }
+    // Impact from the first vulnerability's DefaultSeverity / 5
+    let impact = 0;
+    if (vulns.length > 0) {
+        const severity = parseFloat(vulns[0].ClassInfo?.DefaultSeverity ?? '0');
+        impact = severity / 5.0;
+    }
+    // Build results — one per vulnerability instance
+    const { items: limitedVulns, truncated } = limitArray(vulns);
+    /* v8 ignore next -- truncation only triggers with >100K items */
+    if (truncated) {
+        // eslint-disable-next-line no-console
+        console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerability items (original: ${vulns.length})`);
+    }
+    const results = limitedVulns.map(vuln => ({
+        status: ResultStatus.Failed,
+        codeDesc: buildCodeDesc(vuln, snippetMap),
+        startTime: new Date(startTimeStr),
+    }));
+    return {
+        id: desc.classID ?? 'unknown',
+        title,
+        impact,
+        tags,
+        descriptions,
+        results,
+    };
+}
+// --- Main converter ---
+/**
+ * Converts Fortify FVDL XML to HDF format.
+ *
+ * Descriptions are used as requirements (one per unique classID).
+ * Vulnerabilities are mapped to results under their corresponding Description.
+ * Snippets provide code context for result code descriptions.
+ *
+ * @param input - Fortify FVDL XML string
+ * @returns HDF JSON string
+ */
+export async function convertFortifyToHdf(input) {
+    if (!input || input.trim().length === 0) {
+        throw new Error('fortify: empty input');
+    }
+    validateInputSize(input, 'fortify');
+    const resultsChecksum = await inputChecksum(input);
+    // Parse FVDL XML — use stopNodes to preserve embedded HTML in Abstract/Explanation
+    const parsed = parseXml(input, {
+        stopNodes: ['FVDL.Description.Abstract', 'FVDL.Description.Explanation'],
+    });
+    if (!parsed.FVDL) {
+        throw new Error('fortify: invalid FVDL — missing <FVDL> root element');
+    }
+    const fvdl = parsed.FVDL;
+    // Build snippet map
+    const snippets = ensureArray(fvdl.Snippets?.Snippet);
+    const snippetMap = buildSnippetMap(snippets);
+    // Get vulnerabilities grouped by ClassID
+    const vulns = ensureArray(fvdl.Vulnerabilities?.Vulnerability);
+    const vulnGroups = groupVulnsByClassID(vulns);
+    // Get descriptions
+    const descriptions = ensureArray(fvdl.Description);
+    const { items: limitedDescs, truncated: truncatedDescs } = limitArray(descriptions);
+    /* v8 ignore next -- truncation only triggers with >100K items */
+    if (truncatedDescs) {
+        // eslint-disable-next-line no-console
+        console.warn(`WARNING: Input truncated at ${limitedDescs.length} Description items (original: ${descriptions.length})`);
+    }
+    // Build timestamp string from CreatedTS
+    const createdDate = fvdl.CreatedTS?.date ?? '';
+    const createdTime = fvdl.CreatedTS?.time ?? '';
+    const startTimeStr = `${createdDate}T${createdTime}`;
+    // Build requirements — one per Description classID
+    const requirements = limitedDescs.map(desc => {
+        const classVulns = vulnGroups.get(desc.classID ?? '') ?? [];
+        return buildRequirement(desc, classVulns, snippetMap, startTimeStr);
+    });
+    // Build baseline
+    const title = 'Fortify Static Analyzer Scan';
+    const summary = `Fortify Static Analyzer Scan of UUID: ${fvdl.UUID ?? ''}`;
+    const version = fvdl.EngineData?.EngineVersion ?? '';
+    const baseline = createMinimalBaseline('Fortify Scan', requirements, {
+        resultsChecksum,
+        title,
+        summary,
+        version,
+        status: 'loaded',
+    });
+    // Component name from SourceBasePath
+    const targetName = fvdl.Build?.SourceBasePath ?? fvdl.Build?.BuildID ?? 'Unknown';
+    const tool = {
+        name: 'Fortify',
+        format: 'FVDL',
+    };
+    const hdfResult = {
+        baselines: [baseline],
+        components: [
+            {
+                name: targetName,
+                type: Copyright.Repository,
+            },
+        ],
+        generator: {
+            name: 'fortify-to-hdf',
+            version: '1.0.0',
+        },
+        tool,
+    };
+    // Set timestamp from CreatedTS
+    if (createdDate) {
+        hdfResult.timestamp = new Date(startTimeStr);
+    }
+    return JSON.stringify(hdfResult, null, 2);
+}
+//# sourceMappingURL=converter.js.map

package/dist/converters/fortify-to-hdf/typescript/converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.js","sourceRoot":"","sources":["../../../../converters/fortify-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,WAAW,EACX,iCAAiC,EACjC,iBAAiB,GAClB,MAAM,6CAA6C,CAAC;AAUrD,OAAO,EACL,YAAY,EACZ,SAAS,EACT,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,uEAAuE;AACvE,MAAM,mBAAmB,GACvB,gEAAgE,CAAC;AAGnE,2DAA2D;AAC3D,MAAM,YAAY,GAAG,kBAAkB,CAAC;AA6FxC,kBAAkB;AAElB,SAAS,eAAe,CAAC,QAAuB;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA0B;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAqB;IACtD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,OAAoB;IACzC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,SAAS,OAAO,CAAC,IAAI,IAAI,EAAE,gBAAgB,OAAO,CAAC,SAAS,IAAI,EAAE,cAAc,OAAO,CAAC,OAAO,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;AACjI,CAAC;AAED,SAAS,aAAa,CACpB,IAAuB,EACvB,UAAoC;IAEpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE/E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,SAAS;QAE1B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,YAAY,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,iBAAiB,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC;IACzG,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAqB,EACrB,KAA0B,EAC1B,UAAoC,EACpC,YAAoB;IAEpB,gDAAgD;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,GAAG,CAAC,GAAG,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEjD,sCAAsC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAE7C,uDAAuD;IACvD,IAAI,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,YAAY,GAAkB;QAClC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE;KAC5C,CAAC;IAEF,uCAAuC;IACvC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,eAAe,IAAI,GAAG,CAAC,CAAC;QACzE,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;IAC1B,CAAC;IAED,iDAAiD;IACjD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7D,iEAAiE;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,MAAM,mCAAmC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,OAAO,GAAwB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;QACzC,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;KAClC,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;QAC7B,KAAK;QACL,MAAM;QACN,IAAI;QACJ,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,yBAAyB;AAEzB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEpC,MAAM,eAAe,GAAa,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7D,mFAAmF;IACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE;QAC7B,SAAS,EAAE,CAAC,2BAA2B,EAAE,8BAA8B,CAAC;KACzE,CAA0B,CAAC;IAE5B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,oBAAoB;IACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE7C,yCAAyC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE9C,mBAAmB;IACnB,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACpF,iEAAiE;IACjE,IAAI,cAAc,EAAE,CAAC;QACnB,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,MAAM,iCAAiC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1H,CAAC;IAED,wCAAwC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;IAErD,mDAAmD;IACnD,MAAM,YAAY,GAA2B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACnE,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5D,OAAO,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,iBAAiB;IACjB,MAAM,KAAK,GAAG,8BAA8B,CAAC;IAC7C,MAAM,OAAO,GAAG,yCAAyC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAsB,qBAAqB,CACvD,cAAc,EACd,YAAY,EACZ;QACE,eAAe;QACf,KAAK;QACL,OAAO;QACP,OAAO;QACP,MAAM,EAAE,QAAQ;KACjB,CACmB,CAAC;IAEvB,qCAAqC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,cAAc,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC;IAElF,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,MAAM,SAAS,GAAe;QAC5B,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,SAAS,CAAC,UAAU;aAC3B;SACF;QACD,SAAS,EAAE;YACT,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,OAAO;SACjB;QACD,IAAI;KACL,CAAC;IAEF,+BAA+B;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/converters/fortify-to-hdf/typescript/fingerprint.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Fortify FVDL format fingerprint.
+ *
+ * Detects Fortify XML files by checking for <FVDL> root element.
+ * Fortify uses the FVDL (Fortify Vulnerability Description Language) format
+ * with xmlns="xmlns.fortify.com/schema/fvdl" namespace.
+ */
+import { type ConverterFingerprint } from '../../../shared/typescript/registry.js';
+export declare const fortifyFingerprint: ConverterFingerprint;
+export declare function register(): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/converters/fortify-to-hdf/typescript/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../../converters/fortify-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAuC,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAGxH,eAAO,MAAM,kBAAkB,EAAE,oBAsBhC,CAAC;AAEF,wBAAgB,QAAQ,IAAI,IAAI,CAG/B"}

package/dist/converters/fortify-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,42 @@
+/**
+ * Fortify FVDL format fingerprint.
+ *
+ * Detects Fortify XML files by checking for <FVDL> root element.
+ * Fortify uses the FVDL (Fortify Vulnerability Description Language) format
+ * with xmlns="xmlns.fortify.com/schema/fvdl" namespace.
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+import { extractXmlRootElement } from '../../../shared/typescript/xml-utils.js';
+export const fortifyFingerprint = {
+    id: 'fortify-to-hdf',
+    label: 'Fortify',
+    direction: 'ingest',
+    inputFamily: 'xml',
+    outputType: 'results',
+    fingerprint: (input) => {
+        if (typeof input !== 'string')
+            return 0;
+        const root = extractXmlRootElement(input);
+        if (!root)
+            return 0;
+        if (root === 'FVDL') {
+            // Higher confidence with Fortify namespace
+            if (input.includes('xmlns.fortify.com'))
+                return 1.0;
+            return 0.95;
+        }
+        return 0;
+    },
+    detectVersion: (input) => {
+        if (typeof input !== 'string')
+            return '';
+        const m = input.match(/<FVDL\b[^>]*\bversion="([^"]+)"/);
+        return m?.[1] ?? '';
+    },
+};
+export function register() {
+    if (getFingerprint('fortify-to-hdf'))
+        return;
+    registerFingerprint(fortifyFingerprint);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/fortify-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/fortify-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,wCAAwC,CAAC;AACxH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,2CAA2C;YAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,OAAO,GAAG,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,aAAa,EAAE,CAAC,KAAc,EAAU,EAAE;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACzD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ;IACtB,IAAI,cAAc,CAAC,gBAAgB,CAAC;QAAE,OAAO;IAC7C,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;AAC1C,CAAC"}

package/dist/converters/fortify-to-hdf/typescript/index.d.ts

@@ -0,0 +1,2 @@
+export { convertFortifyToHdf } from './converter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/fortify-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/fortify-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/fortify-to-hdf/typescript/index.js

@@ -0,0 +1,2 @@
+export { convertFortifyToHdf } from './converter.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/fortify-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/fortify-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/converters/gitlab-to-hdf/typescript/converter.d.ts

@@ -0,0 +1,2 @@
+export declare function convertGitlabToHdf(input: string): Promise<string>;
+//# sourceMappingURL=converter.d.ts.map

package/dist/converters/gitlab-to-hdf/typescript/converter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../../converters/gitlab-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAuOA,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGvE"}

package/dist/converters/gitlab-to-hdf/typescript/converter.js

@@ -0,0 +1,222 @@
+import { createMinimalBaseline, Copyright, ResultStatus, severityToImpact, } from '@mitre/hdf-schema';
+import { getCweNistControl, nistToCci, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, } from '@mitre/hdf-mappings';
+import { parseJSON } from '@mitre/hdf-utilities';
+import { inputChecksum, buildNistCciTags, limitArray, validateInputSize } from '../../../shared/typescript/converterutil.js';
+// --- Severity to impact ---
+function gitlabSeverityToImpact(severity) {
+    return severityToImpact(severity.toLowerCase());
+}
+// --- Scan type to target type ---
+function scanTypeToTargetType(scanType) {
+    switch (scanType) {
+        case 'dast':
+            return Copyright.Application;
+        case 'container_scanning':
+            return Copyright.ContainerImage;
+        default:
+            return Copyright.Repository;
+    }
+}
+// --- Scan type label ---
+function scanTypeLabel(scanType) {
+    const labels = {
+        sast: 'SAST',
+        dast: 'DAST',
+        dependency_scanning: 'Dependency Scanning',
+        container_scanning: 'Container Scanning',
+        secret_detection: 'Secret Detection',
+        api_fuzzing: 'API Fuzzing',
+    };
+    return labels[scanType] ?? scanType.toUpperCase();
+}
+// --- NIST tag building ---
+function buildNistTags(identifiers) {
+    const seen = new Set();
+    const controls = [];
+    for (const id of identifiers) {
+        if (id.type === 'cwe' && id.value) {
+            const cweNum = parseInt(id.value, 10);
+            if (!isNaN(cweNum)) {
+                const control = getCweNistControl(cweNum);
+                if (control && !seen.has(control)) {
+                    seen.add(control);
+                    controls.push(control);
+                }
+            }
+        }
+    }
+    if (controls.length > 0) {
+        return controls;
+    }
+    return [...DEFAULT_STATIC_ANALYSIS_NIST_TAGS];
+}
+// --- Collect identifier tags ---
+function collectIdentifierTags(identifiers) {
+    const result = {};
+    for (const id of identifiers) {
+        if (id.type && id.value) {
+            const key = id.type.toLowerCase();
+            if (!result[key]) {
+                result[key] = [];
+            }
+            result[key].push(id.value);
+        }
+    }
+    return result;
+}
+// --- Build code description by scan type ---
+function buildCodeDesc(scanType, location) {
+    if (!location)
+        return '';
+    switch (scanType) {
+        case 'sast':
+        case 'secret_detection': {
+            const parts = [];
+            if (location.file) {
+                parts.push(`File: ${location.file}`);
+            }
+            if (location.start_line != null) {
+                const line = location.end_line != null && location.end_line !== location.start_line
+                    ? `${location.start_line}-${location.end_line}`
+                    : `${location.start_line}`;
+                parts.push(`Line: ${line}`);
+            }
+            if (location.class) {
+                parts.push(`Class: ${location.class}`);
+            }
+            if (location.method) {
+                parts.push(`Method: ${location.method}`);
+            }
+            return parts.join(' | ');
+        }
+        case 'dast': {
+            const parts = [];
+            if (location.hostname) {
+                const url = location.path ? `${location.hostname}${location.path}` : location.hostname;
+                parts.push(`URL: ${url}`);
+            }
+            if (location.method) {
+                parts.push(`Method: ${location.method}`);
+            }
+            if (location.param) {
+                parts.push(`Param: ${location.param}`);
+            }
+            return parts.join(' | ');
+        }
+        case 'dependency_scanning': {
+            const parts = [];
+            if (location.file) {
+                parts.push(`File: ${location.file}`);
+            }
+            if (location.dependency?.package?.name) {
+                const pkg = location.dependency.version
+                    ? `${location.dependency.package.name}@${location.dependency.version}`
+                    : location.dependency.package.name;
+                parts.push(`Package: ${pkg}`);
+            }
+            return parts.join(' | ');
+        }
+        case 'container_scanning': {
+            const parts = [];
+            if (location.image) {
+                parts.push(`Image: ${location.image}`);
+            }
+            if (location.dependency?.package?.name) {
+                const pkg = location.dependency.version
+                    ? `${location.dependency.package.name}@${location.dependency.version}`
+                    : location.dependency.package.name;
+                parts.push(`Package: ${pkg}`);
+            }
+            return parts.join(' | ');
+        }
+        default:
+            return `Location: ${JSON.stringify(location)}`;
+    }
+}
+// --- Main converter ---
+export async function convertGitlabToHdf(input) {
+    validateInputSize(input, 'gitlab');
+    const resultsChecksum = await inputChecksum(input);
+    const report = parseJSON(input);
+    const scanType = report.scan?.type ?? 'sast';
+    const scannerName = report.scan?.scanner?.name ?? 'GitLab Security Scanner';
+    const scannerVersion = report.scan?.scanner?.version;
+    const startTime = report.scan?.start_time;
+    const vulns = report.vulnerabilities ?? [];
+    const { items: limitedVulns, truncated } = limitArray(vulns);
+    /* v8 ignore next -- truncation only triggers with >100K items */
+    if (truncated) {
+        // eslint-disable-next-line no-console
+        console.warn(`WARNING: Input truncated at ${limitedVulns.length} vulnerabilities (original: ${vulns.length})`);
+    }
+    const requirements = [];
+    for (const vuln of limitedVulns) {
+        const identifiers = vuln.identifiers ?? [];
+        // Build NIST tags
+        const nistTags = buildNistTags(identifiers);
+        const cciTags = nistToCci(nistTags);
+        // Build extra tags from identifiers
+        const idTags = collectIdentifierTags(identifiers);
+        const extras = {};
+        for (const [key, values] of Object.entries(idTags)) {
+            extras[key] = values;
+        }
+        const tags = buildNistCciTags(nistTags, cciTags, Object.keys(extras).length > 0 ? extras : undefined);
+        // Build descriptions
+        const descriptions = [];
+        if (vuln.description) {
+            descriptions.push({ label: 'default', data: vuln.description });
+        }
+        if (vuln.solution) {
+            descriptions.push({ label: 'check', data: vuln.solution });
+        }
+        // Build result
+        const result = {
+            status: ResultStatus.Failed,
+            codeDesc: buildCodeDesc(scanType, vuln.location),
+            startTime: startTime ? new Date(startTime) : new Date('0001-01-01T00:00:00Z'),
+        };
+        const impact = gitlabSeverityToImpact(vuln.severity ?? 'Unknown');
+        const req = {
+            id: vuln.id,
+            title: vuln.name ?? vuln.id,
+            impact,
+            results: [result],
+            tags,
+            descriptions,
+        };
+        requirements.push(req);
+    }
+    const label = scanTypeLabel(scanType);
+    const baselineTitle = `GitLab ${label} Security Scan`;
+    const baseline = createMinimalBaseline('GitLab Security Scan', requirements, {
+        resultsChecksum,
+        title: baselineTitle,
+        summary: `Scanner: ${scannerName}${scannerVersion ? ` v${scannerVersion}` : ''}`,
+    });
+    const tool = {
+        name: scannerName,
+        format: 'JSON',
+    };
+    if (scannerVersion) {
+        tool.version = scannerVersion;
+    }
+    // Build components based on scan type
+    const components = [];
+    const targetType = scanTypeToTargetType(scanType);
+    components.push({ name: scannerName, type: targetType });
+    const hdf = {
+        baselines: [baseline],
+        components,
+        generator: {
+            name: 'gitlab-to-hdf',
+            version: 'unknown',
+        },
+        tool,
+    };
+    if (report.scan?.end_time) {
+        hdf.timestamp = new Date(report.scan.end_time);
+    }
+    return JSON.stringify(hdf, null, 2);
+}
+//# sourceMappingURL=converter.js.map

package/dist/converters/gitlab-to-hdf/typescript/converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.js","sourceRoot":"","sources":["../../../../converters/gitlab-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,EACrB,SAAS,EAOT,YAAY,EACZ,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAC,MAAM,6CAA6C,CAAC;AAmE3H,6BAA6B;AAE7B,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,mCAAmC;AAEnC,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,KAAK,oBAAoB;YACvB,OAAO,SAAS,CAAC,cAAc,CAAC;QAClC;YACE,OAAO,SAAS,CAAC,UAAU,CAAC;IAChC,CAAC;AACH,CAAC;AAED,0BAA0B;AAE1B,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,MAAM,GAA2B;QACrC,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,mBAAmB,EAAE,qBAAqB;QAC1C,kBAAkB,EAAE,oBAAoB;QACxC,gBAAgB,EAAE,kBAAkB;QACpC,WAAW,EAAE,aAAa;KAC3B,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC;AAED,4BAA4B;AAE5B,SAAS,aAAa,CAAC,WAA+B;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAClB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,iCAAiC,CAAC,CAAC;AAChD,CAAC;AAED,kCAAkC;AAElC,SAAS,qBAAqB,CAAC,WAA+B;IAC5D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8CAA8C;AAE9C,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAyB;IAChE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU;oBACjF,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE;oBAC/C,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACvF,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO;oBACrC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE;oBACtE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO;oBACrC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE;oBACtE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD;YACE,OAAO,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,yBAAyB;AAEzB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnC,MAAM,eAAe,GAAa,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,SAAS,CAAe,KAAK,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,yBAAyB,CAAC;IAC5E,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1C,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3C,MAAM,EAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3D,iEAAiE;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,MAAM,+BAA+B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAE3C,kBAAkB;QAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEpC,oCAAoC;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAEtG,qBAAqB;QACrB,MAAM,YAAY,GAAyC,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,YAAY,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAC,CAAC,CAAC;QAC3D,CAAC;QAED,eAAe;QACf,MAAM,MAAM,GAAsB;YAChC,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;YAChD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC;SAC9E,CAAC;QAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;QAElE,MAAM,GAAG,GAAyB;YAChC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;YAC3B,MAAM;YACN,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,IAAI;YACJ,YAAY;SACb,CAAC;QAEF,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,UAAU,KAAK,gBAAgB,CAAC;IAEtD,MAAM,QAAQ,GAAsB,qBAAqB,CAAC,sBAAsB,EAAE,YAAY,EAAE;QAC9F,eAAe;QACf,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,YAAY,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;KACjF,CAAsB,CAAC;IAExB,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,MAAM;KACf,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;IAChC,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,UAAU,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAC,CAAC,CAAC;IAEvD,MAAM,GAAG,GAAe;QACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,UAAU;QACV,SAAS,EAAE;YACT,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,SAAS;SACnB;QACD,IAAI;KACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/converters/gitlab-to-hdf/typescript/fingerprint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GitLab Security Report format fingerprint.
+ *
+ * Exports a ConverterFingerprint object (data only, no converter import).
+ * Detects JSON with vulnerabilities[] + scan.type (v0.9) or just vulnerabilities[] (v0.5).
+ */
+import { type ConverterFingerprint } from '../../../shared/typescript/registry.js';
+export declare const gitlabFingerprint: ConverterFingerprint;
+export declare function register(): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/converters/gitlab-to-hdf/typescript/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../../converters/gitlab-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAuC,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAExH,eAAO,MAAM,iBAAiB,EAAE,oBAoB/B,CAAC;AAEF,wBAAgB,QAAQ,IAAI,IAAI,CAG/B"}

package/dist/converters/gitlab-to-hdf/typescript/fingerprint.js

@@ -0,0 +1,37 @@
+/**
+ * GitLab Security Report format fingerprint.
+ *
+ * Exports a ConverterFingerprint object (data only, no converter import).
+ * Detects JSON with vulnerabilities[] + scan.type (v0.9) or just vulnerabilities[] (v0.5).
+ */
+import { registerFingerprint, getFingerprint } from '../../../shared/typescript/registry.js';
+export const gitlabFingerprint = {
+    id: 'gitlab-to-hdf',
+    label: 'GitLab',
+    direction: 'ingest',
+    inputFamily: 'json',
+    outputType: 'results',
+    fingerprint: (input) => {
+        if (typeof input !== 'object' || input === null)
+            return 0;
+        const obj = input;
+        if (!Array.isArray(obj.vulnerabilities))
+            return 0;
+        // Strong signal: scan object with type field (GitLab Security Report schema)
+        if (typeof obj.scan === 'object' && obj.scan !== null) {
+            const scan = obj.scan;
+            if (typeof scan.type === 'string')
+                return 0.9;
+            // Has scan but no type — still likely GitLab
+            return 0.7;
+        }
+        // Weak signal: just vulnerabilities[] (could be GitLab or other tools)
+        return 0.5;
+    },
+};
+export function register() {
+    if (getFingerprint('gitlab-to-hdf'))
+        return;
+    registerFingerprint(gitlabFingerprint);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/converters/gitlab-to-hdf/typescript/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../../converters/gitlab-to-hdf/typescript/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,wCAAwC,CAAC;AAExH,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,SAAS;IACrB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,OAAO,CAAC,CAAC;QAClD,6EAA6E;QAC7E,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;YACjD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAC9C,6CAA6C;YAC7C,OAAO,GAAG,CAAC;QACb,CAAC;QACD,uEAAuE;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,QAAQ;IACtB,IAAI,cAAc,CAAC,eAAe,CAAC;QAAE,OAAO;IAC5C,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AACzC,CAAC"}

package/dist/converters/gitlab-to-hdf/typescript/index.d.ts

@@ -0,0 +1,2 @@
+export { convertGitlabToHdf } from './converter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/converters/gitlab-to-hdf/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../converters/gitlab-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,kBAAkB,EAAC,MAAM,gBAAgB,CAAC"}

package/dist/converters/gitlab-to-hdf/typescript/index.js

@@ -0,0 +1,2 @@
+export { convertGitlabToHdf } from './converter.js';
+//# sourceMappingURL=index.js.map

package/dist/converters/gitlab-to-hdf/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../converters/gitlab-to-hdf/typescript/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,kBAAkB,EAAC,MAAM,gBAAgB,CAAC"}

package/dist/converters/gosec-to-hdf/typescript/converter.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Converts gosec output to HDF format.
+ * Accepts both native gosec JSON and SARIF format — SARIF input is detected
+ * automatically and delegated to the shared SARIF converter.
+ *
+ * @param input - gosec JSON or SARIF string
+ * @returns HDF JSON string
+ */
+export declare function convertGosecToHdf(input: string): Promise<string>;
+//# sourceMappingURL=converter.d.ts.map

package/dist/converters/gosec-to-hdf/typescript/converter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../../converters/gosec-to-hdf/typescript/converter.ts"],"names":[],"mappings":"AAyIA;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDtE"}