@mitre/hdf-converters 2.5.1

package/lib/src/burpsuite-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"burpsuite-mapper.js","sourceRoot":"","sources":["../../src/burpsuite-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,sEAAqC;AACrC,uCAAkC;AAClC,oDAAuB;AACvB,gDAAwB;AACxB,kDAAgE;AAChE,qDAM0B;AAC1B,8DAAyD;AAGzD,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,aAAa,EAAE,GAAG,CAAC;CACrB,CAAC,CAAC;AACH,MAAM,IAAI,GAAG,oBAAoB,CAAC;AAElC,MAAM,qBAAqB,GAAG,cAAI,CAAC,OAAO,CACxC,SAAS,EACT,8BAA8B,CAC/B,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,+BAAc,CAAC,qBAAqB,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAG3C,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE;QACxD,IAAI,CAAC,IAAI,CACP,aAAa,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAC1E,CAAC;KACH;SAAM;QACL,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;KAChC;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;QAC5B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAA,0BAAS,EAAC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;KAC/D;SAAM;QACL,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;KACzB;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAA,0BAAS,EAAC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;KACrE;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,IAAA,0BAAS,EAAC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;KACnE;SAAM;QACL,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;KAC3B;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAChC,CAAC;AACD,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;QACpD,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;KACtB;SAAM;QACL,OAAO,EAAE,CAAC;KACX;AACH,CAAC;AACD,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAA,0BAAS,EAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClD,CAAC;AACD,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,gBAAgB,CAAC,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,OAAO,GAAG;QACd,mBAAmB,EAAE,EAAE;QACvB,YAAY,EAAE,MAAM;QACpB,gBAAgB,EAAE,KAAK;KACxB,CAAC;IACF,OAAO,yBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AACD,MAAa,eAAgB,SAAQ,8BAAa;IA2EhD,YAAY,QAAgB;QAC1B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QA3E5B,aAAQ,GAAqD;YAC3D,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,sBAAoB;gBAC7B,SAAS,EAAE,EAAE;aACd;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE,IAAI;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,IAAI;oBACV,OAAO,EAAE,EAAC,IAAI,EAAE,oBAAoB,EAAC;oBACrC,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,IAAI;oBACrB,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,cAAc;4BACpB,GAAG,EAAE,IAAI;4BACT,EAAE,EAAE,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAC;4BAC3C,KAAK,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BACrB,IAAI,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,0BAAS,EAAC;4BACvD,MAAM,EAAE;gCACN,IAAI,EAAE,UAAU;gCAChB,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;6BAC3C;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE;oCACJ,IAAI,EAAE,8BAA8B;oCACpC,WAAW,EAAE,OAAO;iCACrB;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,8BAA8B;oCACpC,WAAW,EAAE,WAAW;iCACzB;gCACD,UAAU,EAAE,EAAC,IAAI,EAAE,YAAY,EAAC;6BACjC;4BACD,YAAY,EAAE;gCACZ;oCACE,IAAI,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,0BAAS,EAAC;oCACvD,KAAK,EAAE,OAAO;iCACf;gCACD;oCACE,IAAI,EAAE,EAAC,IAAI,EAAE,uBAAuB,EAAE,WAAW,EAAE,0BAAS,EAAC;oCAC7D,KAAK,EAAE,KAAK;iCACb;6BACF;4BACD,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,IAAI,EAAE,EAAE;4BACR,OAAO,EAAE;gCACP;oCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;oCAC3C,SAAS,EAAE,EAAC,WAAW,EAAE,cAAc,EAAC;oCACxC,QAAQ,EAAE,CAAC;oCACX,UAAU,EAAE,EAAC,IAAI,EAAE,qBAAqB,EAAC;iCAC1C;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;SACF,CAAC;IAGF,CAAC;IACD,WAAW,CACT,cAAgE;QAEhE,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AAnFD,0CAmFC"}

package/lib/src/dbprotect-mapper.d.ts

@@ -0,0 +1,7 @@
+import { ExecJSON } from 'inspecjs';
+import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
+export declare class DBProtectMapper extends BaseConverter {
+    mappings: MappedTransform<ExecJSON.Execution, ILookupPath>;
+    constructor(dbProtectXml: string);
+    setMappings(customMappings: MappedTransform<ExecJSON.Execution, ILookupPath>): void;
+}

package/lib/src/dbprotect-mapper.js

@@ -0,0 +1,165 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DBProtectMapper = void 0;
+const fast_xml_parser_1 = __importDefault(require("fast-xml-parser"));
+const inspecjs_1 = require("inspecjs");
+const lodash_1 = __importDefault(require("lodash"));
+const package_json_1 = require("../package.json");
+const base_converter_1 = require("./base-converter");
+const IMPACT_MAPPING = new Map([
+    ['high', 0.7],
+    ['medium', 0.5],
+    ['low', 0.3],
+    ['informational', 0]
+]);
+function parseXml(xml) {
+    const options = {
+        attributeNamePrefix: '',
+        textNodeName: 'text',
+        ignoreAttributes: false
+    };
+    return fast_xml_parser_1.default.parse(xml, options);
+}
+function compileFindings(input) {
+    const keys = lodash_1.default.get(input, 'dataset.metadata.item');
+    const findings = lodash_1.default.get(input, 'dataset.data.row');
+    let output = [];
+    if (Array.isArray(keys) && Array.isArray(findings)) {
+        const keyNames = keys.map((element) => {
+            return lodash_1.default.get(element, 'name');
+        });
+        output = findings.map((element) => {
+            return Object.fromEntries(keyNames.map(function (name, i) {
+                return [name, lodash_1.default.get(element, `value[${i}]`)];
+            }));
+        });
+    }
+    return Object.fromEntries([['data', output]]);
+}
+function formatSummary(entry) {
+    const text = [];
+    text.push(`Organization : ${lodash_1.default.get(entry, 'Organization')}`);
+    text.push(`Asset : ${lodash_1.default.get(entry, 'Check Asset')}`);
+    text.push(`Asset Type : ${lodash_1.default.get(entry, 'Asset Type')}`);
+    text.push(`IP Address, Port, Instance : ${lodash_1.default.get(entry, 'Asset Type')}`);
+    text.push(`IP Address, Port, Instance : ${lodash_1.default.get(entry, 'IP Address, Port, Instance')} `);
+    return text.join('\n');
+}
+function formatDesc(entry) {
+    const text = [];
+    text.push(`Task : ${lodash_1.default.get(entry, 'Task')}`);
+    text.push(`Check Category : ${lodash_1.default.get(entry, 'Check Category')}`);
+    return text.join('; ');
+}
+function getStatus(input) {
+    switch (input) {
+        case 'Fact':
+            return inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
+        case 'Failed':
+            return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
+        case 'Finding':
+            return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
+        case 'Not A Finding':
+            return inspecjs_1.ExecJSON.ControlResultStatus.Passed;
+    }
+    return inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
+}
+function getBacktrace(input) {
+    if (input === 'Failed') {
+        return 'DB Protect Failed Check';
+    }
+    else {
+        return '';
+    }
+}
+function handleBacktrace(input) {
+    if (Array.isArray(input)) {
+        input = input.map((element) => {
+            if (lodash_1.default.get(element, 'backtrace')[0] === '') {
+                return lodash_1.default.omit(element, 'backtrace');
+            }
+            else {
+                return element;
+            }
+        });
+    }
+    return input;
+}
+function idToString(id) {
+    if (typeof id === 'string' || typeof id === 'number') {
+        return id.toString();
+    }
+    else {
+        return '';
+    }
+}
+class DBProtectMapper extends base_converter_1.BaseConverter {
+    constructor(dbProtectXml) {
+        super(compileFindings(parseXml(dbProtectXml)));
+        this.mappings = {
+            platform: {
+                name: 'Heimdall Tools',
+                release: package_json_1.version,
+                target_id: ''
+            },
+            version: package_json_1.version,
+            statistics: {
+                duration: null
+            },
+            profiles: [
+                {
+                    name: { path: 'data.[0].Policy' },
+                    version: '',
+                    title: { path: 'data.[0].Job Name' },
+                    maintainer: null,
+                    summary: { path: 'data.[0]', transformer: formatSummary },
+                    license: null,
+                    copyright: null,
+                    copyright_email: null,
+                    supports: [],
+                    attributes: [],
+                    depends: [],
+                    groups: [],
+                    status: 'loaded',
+                    controls: [
+                        {
+                            path: 'data',
+                            key: 'id',
+                            id: { path: 'Check ID', transformer: idToString },
+                            title: { path: 'Check' },
+                            desc: { transformer: formatDesc },
+                            impact: {
+                                path: 'Risk DV',
+                                transformer: (0, base_converter_1.impactMapping)(IMPACT_MAPPING)
+                            },
+                            tags: {},
+                            descriptions: [],
+                            refs: [],
+                            source_location: {},
+                            code: '',
+                            results: [
+                                {
+                                    arrayTransformer: handleBacktrace,
+                                    status: { path: 'Result Status', transformer: getStatus },
+                                    code_desc: { path: 'Details' },
+                                    run_time: 0,
+                                    start_time: { path: 'Date' },
+                                    backtrace: [{ path: 'Result Status', transformer: getBacktrace }]
+                                }
+                            ]
+                        }
+                    ],
+                    sha256: ''
+                }
+            ]
+        };
+    }
+    setMappings(customMappings) {
+        super.setMappings(customMappings);
+    }
+}
+exports.DBProtectMapper = DBProtectMapper;
+//# sourceMappingURL=dbprotect-mapper.js.map

package/lib/src/dbprotect-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dbprotect-mapper.js","sourceRoot":"","sources":["../../src/dbprotect-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,sEAAqC;AACrC,uCAAkC;AAClC,oDAAuB;AACvB,kDAAgE;AAChE,qDAK0B;AAE1B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,eAAe,EAAE,CAAC,CAAC;CACrB,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,OAAO,GAAG;QACd,mBAAmB,EAAE,EAAE;QACvB,YAAY,EAAE,MAAM;QACpB,gBAAgB,EAAE,KAAK;KACxB,CAAC;IACF,OAAO,yBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,eAAe,CACtB,KAA8B;IAE9B,MAAM,IAAI,GAAG,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAElD,IAAI,MAAM,GAAc,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAgC,EAAU,EAAE;YACrE,OAAO,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAW,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAgC,EAAE,EAAE;YACzD,OAAO,MAAM,CAAC,WAAW,CACvB,QAAQ,CAAC,GAAG,CAAC,UAAU,IAAY,EAAE,CAAS;gBAC5C,OAAO,CAAC,IAAI,EAAE,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;KACJ;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,kBAAkB,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,gBAAgB,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,gCAAgC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CACP,gCAAgC,gBAAC,CAAC,GAAG,CACnC,KAAK,EACL,4BAA4B,CAC7B,GAAG,CACL,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,UAAU,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,oBAAoB,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,QAAQ,KAAK,EAAE;QACb,KAAK,MAAM;YACT,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAC9C,KAAK,QAAQ;YACX,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7C,KAAK,SAAS;YACZ,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7C,KAAK,eAAe;YAClB,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC;KAC9C;IACD,OAAO,mBAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC;AAC9C,CAAC;AACD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,QAAQ,EAAE;QACtB,OAAO,yBAAyB,CAAC;KAClC;SAAM;QACL,OAAO,EAAE,CAAC;KACX;AACH,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxB,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5B,IAAI,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzC,OAAO,gBAAC,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;aACrC;iBAAM;gBACL,OAAO,OAAO,CAAC;aAChB;QACH,CAAC,CAAC,CAAC;KACJ;IACD,OAAO,KAAiC,CAAC;AAC3C,CAAC;AACD,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE;QACpD,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;KACtB;SAAM;QACL,OAAO,EAAE,CAAC;KACX;AACH,CAAC;AAED,MAAa,eAAgB,SAAQ,8BAAa;IA0DhD,YAAY,YAAoB;QAC9B,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QA1DjD,aAAQ,GAAqD;YAC3D,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,sBAAoB;gBAC7B,SAAS,EAAE,EAAE;aACd;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE,IAAI;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,EAAC,IAAI,EAAE,iBAAiB,EAAC;oBAC/B,OAAO,EAAE,EAAE;oBACX,KAAK,EAAE,EAAC,IAAI,EAAE,mBAAmB,EAAC;oBAClC,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,EAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAC;oBACvD,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,IAAI;oBACrB,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,MAAM;4BACZ,GAAG,EAAE,IAAI;4BACT,EAAE,EAAE,EAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAC;4BAC/C,KAAK,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC;4BACtB,IAAI,EAAE,EAAC,WAAW,EAAE,UAAU,EAAC;4BAC/B,MAAM,EAAE;gCACN,IAAI,EAAE,SAAS;gCACf,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;6BAC3C;4BACD,IAAI,EAAE,EAAE;4BACR,YAAY,EAAE,EAAE;4BAChB,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,IAAI,EAAE,EAAE;4BACR,OAAO,EAAE;gCACP;oCACE,gBAAgB,EAAE,eAAe;oCACjC,MAAM,EAAE,EAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAC;oCACvD,SAAS,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC;oCAC5B,QAAQ,EAAE,CAAC;oCACX,UAAU,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;oCAC1B,SAAS,EAAE,CAAC,EAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAC,CAAC;iCAChE;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;SACF,CAAC;IAGF,CAAC;IACD,WAAW,CACT,cAAgE;QAEhE,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AAlED,0CAkEC"}

package/lib/src/fortify-mapper.d.ts

@@ -0,0 +1,8 @@
+import { ExecJSON } from 'inspecjs';
+import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
+export declare class FortifyMapper extends BaseConverter {
+    startTime: string;
+    mappings: MappedTransform<ExecJSON.Execution, ILookupPath>;
+    constructor(fvdl: string);
+    setMappings(customMappings: MappedTransform<ExecJSON.Execution, ILookupPath>): void;
+}

package/lib/src/fortify-mapper.js

@@ -0,0 +1,180 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FortifyMapper = void 0;
+const fast_xml_parser_1 = __importDefault(require("fast-xml-parser"));
+const inspecjs_1 = require("inspecjs");
+const lodash_1 = __importDefault(require("lodash"));
+const package_json_1 = require("../package.json");
+const base_converter_1 = require("./base-converter");
+const NIST_REFERENCE_NAME = 'Standards Mapping - NIST Special Publication 800-53 Revision 4';
+const DEFAULT_NIST_TAG = ['unmapped', 'Rev_4'];
+function parseXml(xml) {
+    const options = {
+        attributeNamePrefix: '',
+        textNodeName: 'text',
+        ignoreAttributes: false
+    };
+    return fast_xml_parser_1.default.parse(xml, options);
+}
+function impactMapping(input, id) {
+    if (Array.isArray(input)) {
+        const matches = input.find((element) => {
+            return lodash_1.default.get(element, 'ClassInfo.ClassID') === id;
+        });
+        return parseFloat(lodash_1.default.get(matches, 'ClassInfo.DefaultSeverity')) / 5;
+    }
+    else {
+        return parseFloat(lodash_1.default.get(input, 'ClassInfo.DefaultSeverity')) / 5;
+    }
+}
+function nistTag(rule) {
+    let references = lodash_1.default.get(rule, 'References.Reference');
+    if (!Array.isArray(references)) {
+        references = [references];
+    }
+    if (Array.isArray(references)) {
+        const tag = references.find((element) => {
+            return lodash_1.default.get(element, 'Author') === NIST_REFERENCE_NAME;
+        });
+        if (tag === null || tag === undefined) {
+            return DEFAULT_NIST_TAG;
+        }
+        else {
+            return lodash_1.default.get(tag, 'Title')
+                .match(/[a-zA-Z][a-zA-Z]-\d{1,2}/)
+                .concat(['Rev_4']);
+        }
+    }
+    return [];
+}
+function processEntry(input) {
+    const output = [];
+    output.push(`${lodash_1.default.get(input, 'id')}<=SNIPPET`);
+    output.push(`\nPath: ${lodash_1.default.get(input, 'File')}\n`);
+    output.push(`StartLine: ${lodash_1.default.get(input, 'StartLine')}, `);
+    output.push(`EndLine: ${lodash_1.default.get(input, 'EndLine')}\n`);
+    output.push(`Code:\n${lodash_1.default.get(input, 'Text').trim()}`);
+    return output.join('');
+}
+function makeArray(input) {
+    if (Array.isArray(input)) {
+        return input;
+    }
+    else {
+        return [input];
+    }
+}
+function filterVuln(input, file) {
+    input.forEach((element) => {
+        if (element instanceof Object) {
+            lodash_1.default.set(element, 'results', lodash_1.default.get(element, 'results').filter((result) => {
+                const codedesc = lodash_1.default.get(result, 'code_desc').split('<=SNIPPET');
+                const snippetid = codedesc[0];
+                const classid = lodash_1.default.get(element, 'id');
+                lodash_1.default.set(result, 'code_desc', codedesc[1]);
+                let isMatch = false;
+                const matches = lodash_1.default.get(file, 'FVDL.Vulnerabilities.Vulnerability').filter((subElement) => {
+                    return lodash_1.default.get(subElement, 'ClassInfo.ClassID') === classid;
+                });
+                matches.forEach((match) => {
+                    const traces = makeArray(lodash_1.default.get(match, 'AnalysisInfo.Unified.Trace'));
+                    traces.forEach((trace) => {
+                        const entries = makeArray(lodash_1.default.get(trace, 'Primary.Entry'));
+                        const filteredEntries = entries.filter((entry) => {
+                            return lodash_1.default.has(entry, 'Node.SourceLocation.snippet');
+                        });
+                        filteredEntries.forEach((entry) => {
+                            if (lodash_1.default.get(entry, 'Node.SourceLocation.snippet') === snippetid) {
+                                isMatch = true;
+                            }
+                        });
+                    });
+                });
+                return isMatch;
+            }));
+            lodash_1.default.set(element, 'impact', impactMapping(lodash_1.default.get(element, 'impact'), lodash_1.default.get(element, 'id')));
+        }
+        return element;
+    });
+    return input;
+}
+class FortifyMapper extends base_converter_1.BaseConverter {
+    constructor(fvdl) {
+        super(parseXml(fvdl));
+        this.mappings = {
+            platform: {
+                name: 'Heimdall Tools',
+                release: package_json_1.version,
+                target_id: ''
+            },
+            version: package_json_1.version,
+            statistics: {
+                duration: null
+            },
+            profiles: [
+                {
+                    name: 'Fortify Static Analyzer Scan',
+                    version: { path: 'FVDL.EngineData.EngineVersion' },
+                    title: 'Fortify Static Analyzer Scan',
+                    maintainer: null,
+                    summary: {
+                        path: 'FVDL.UUID',
+                        transformer: (uuid) => {
+                            return `Fortify Static Analyzer Scan of UUID: ${uuid}`;
+                        }
+                    },
+                    license: null,
+                    copyright: null,
+                    copyright_email: null,
+                    supports: [],
+                    attributes: [],
+                    depends: [],
+                    groups: [],
+                    status: 'loaded',
+                    controls: [
+                        {
+                            arrayTransformer: filterVuln,
+                            path: 'FVDL.Description',
+                            key: 'id',
+                            id: { path: 'classID' },
+                            title: { path: 'Abstract', transformer: base_converter_1.parseHtml },
+                            desc: { path: 'Explanation', transformer: base_converter_1.parseHtml },
+                            impact: { path: '$.FVDL.Vulnerabilities.Vulnerability' },
+                            tags: {
+                                nist: { transformer: nistTag }
+                            },
+                            descriptions: [],
+                            refs: [],
+                            source_location: {},
+                            code: '',
+                            results: [
+                                {
+                                    path: '$.FVDL.Snippets.Snippet',
+                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
+                                    code_desc: { transformer: processEntry },
+                                    run_time: 0,
+                                    start_time: {
+                                        path: '$.FVDL.CreatedTS',
+                                        transformer: (input) => {
+                                            return `${lodash_1.default.get(input, 'date')} ${lodash_1.default.get(input, 'time')}`;
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    ],
+                    sha256: ''
+                }
+            ]
+        };
+        this.startTime = `${lodash_1.default.get(this.data, 'FVDL.CreatedTS.date')} ${lodash_1.default.get(this.data, 'FVDL.CreatedTS.time')}`;
+    }
+    setMappings(customMappings) {
+        super.setMappings(customMappings);
+    }
+}
+exports.FortifyMapper = FortifyMapper;
+//# sourceMappingURL=fortify-mapper.js.map

package/lib/src/fortify-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fortify-mapper.js","sourceRoot":"","sources":["../../src/fortify-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,sEAAqC;AACrC,uCAAkC;AAClC,oDAAuB;AACvB,kDAAgE;AAChE,qDAK0B;AAE1B,MAAM,mBAAmB,GACvB,gEAAgE,CAAC;AACnE,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE/C,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,OAAO,GAAG;QACd,mBAAmB,EAAE,EAAE;QACvB,YAAY,EAAE,MAAM;QACpB,gBAAgB,EAAE,KAAK;KACxB,CAAC;IACF,OAAO,yBAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,aAAa,CAAC,KAA8B,EAAE,EAAU;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACrC,OAAO,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC;KACpE;SAAM;QACL,OAAO,UAAU,CAAC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAW,CAAC,GAAG,CAAC,CAAC;KAC5E;AACH,CAAC;AACD,SAAS,OAAO,CAAC,IAA6B;IAC5C,IAAI,UAAU,GAAG,gBAAC,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC9B,UAAU,GAAG,CAAC,UAAU,CAAC,CAAC;KAC3B;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAgC,EAAE,EAAE;YAC/D,OAAO,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,mBAAmB,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE;YACrC,OAAO,gBAAgB,CAAC;SACzB;aAAM;YACL,OAAO,gBAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;iBACvB,KAAK,CAAC,0BAA0B,CAAC;iBACjC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACtB;KACF;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,WAAW,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,cAAc,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,CAAC,YAAY,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,UAAU,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxB,OAAO,KAAkB,CAAC;KAC3B;SAAM;QACL,OAAO,CAAC,KAAK,CAAC,CAAC;KAChB;AACH,CAAC;AACD,SAAS,UAAU,CAAC,KAAgB,EAAE,IAAa;IACjD,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACxB,IAAI,OAAO,YAAY,MAAM,EAAE;YAC7B,gBAAC,CAAC,GAAG,CACH,OAAO,EACP,SAAS,EACT,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,MAA8B,EAAE,EAAE;gBAClE,MAAM,QAAQ,GAAG,gBAAC,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9B,MAAM,OAAO,GAAG,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACrC,gBAAC,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAExC,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,OAAO,GAAG,gBAAC,CAAC,GAAG,CACnB,IAAI,EACJ,oCAAoC,CACrC,CAAC,MAAM,CAAC,CAAC,UAAmC,EAAE,EAAE;oBAC/C,OAAO,gBAAC,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,KAAK,OAAO,CAAC;gBAC5D,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,OAAO,CAAC,CAAC,KAA8B,EAAE,EAAE;oBACjD,MAAM,MAAM,GAAc,SAAS,CACjC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAC3C,CAAC;oBACF,MAAM,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,EAAE;wBAChC,MAAM,OAAO,GAAc,SAAS,CAClC,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAC9B,CAAC;wBACF,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAc,EAAE,EAAE;4BACxD,OAAO,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;wBACrD,CAAC,CAAC,CAAC;wBACH,eAAe,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,EAAE;4BACzC,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,6BAA6B,CAAC,KAAK,SAAS,EAAE;gCAC7D,OAAO,GAAG,IAAI,CAAC;6BAChB;wBACH,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CACH,CAAC;YACF,gBAAC,CAAC,GAAG,CACH,OAAO,EACP,QAAQ,EACR,aAAa,CAAC,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAC9D,CAAC;SACH;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,KAA2B,CAAC;AACrC,CAAC;AAED,MAAa,aAAc,SAAQ,8BAAa;IAoE9C,YAAY,IAAY;QACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAnExB,aAAQ,GAAqD;YAC3D,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,sBAAoB;gBAC7B,SAAS,EAAE,EAAE;aACd;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE,IAAI;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,8BAA8B;oBACpC,OAAO,EAAE,EAAC,IAAI,EAAE,+BAA+B,EAAC;oBAChD,KAAK,EAAE,8BAA8B;oBACrC,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE;wBACP,IAAI,EAAE,WAAW;wBACjB,WAAW,EAAE,CAAC,IAAa,EAAU,EAAE;4BACrC,OAAO,yCAAyC,IAAI,EAAE,CAAC;wBACzD,CAAC;qBACF;oBACD,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,IAAI;oBACrB,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,gBAAgB,EAAE,UAAU;4BAC5B,IAAI,EAAE,kBAAkB;4BACxB,GAAG,EAAE,IAAI;4BACT,EAAE,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC;4BACrB,KAAK,EAAE,EAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,0BAAS,EAAC;4BACjD,IAAI,EAAE,EAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0BAAS,EAAC;4BACnD,MAAM,EAAE,EAAC,IAAI,EAAE,sCAAsC,EAAC;4BACtD,IAAI,EAAE;gCACJ,IAAI,EAAE,EAAC,WAAW,EAAE,OAAO,EAAC;6BAC7B;4BACD,YAAY,EAAE,EAAE;4BAChB,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,IAAI,EAAE,EAAE;4BACR,OAAO,EAAE;gCACP;oCACE,IAAI,EAAE,yBAAyB;oCAC/B,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;oCAC3C,SAAS,EAAE,EAAC,WAAW,EAAE,YAAY,EAAC;oCACtC,QAAQ,EAAE,CAAC;oCACX,UAAU,EAAE;wCACV,IAAI,EAAE,kBAAkB;wCACxB,WAAW,EAAE,CAAC,KAAc,EAAU,EAAE;4CACtC,OAAO,GAAG,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,gBAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;wCAC3D,CAAC;qCACF;iCACF;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;SACF,CAAC;QAGA,IAAI,CAAC,SAAS,GAAG,GAAG,gBAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,gBAAC,CAAC,GAAG,CAClE,IAAI,CAAC,IAAI,EACT,qBAAqB,CACtB,EAAE,CAAC;IACN,CAAC;IACD,WAAW,CACT,cAAgE;QAEhE,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AAhFD,sCAgFC"}

package/lib/src/jfrog-xray-mapper.d.ts

@@ -0,0 +1,7 @@
+import { ExecJSON } from 'inspecjs';
+import { BaseConverter, ILookupPath, MappedTransform } from './base-converter';
+export declare class JfrogXrayMapper extends BaseConverter {
+    mappings: MappedTransform<ExecJSON.Execution, ILookupPath>;
+    constructor(xrayJson: string);
+    setMappings(customMappings: MappedTransform<ExecJSON.Execution, ILookupPath>): void;
+}

package/lib/src/jfrog-xray-mapper.js

@@ -0,0 +1,169 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JfrogXrayMapper = void 0;
+const inspecjs_1 = require("inspecjs");
+const lodash_1 = __importDefault(require("lodash"));
+const path_1 = __importDefault(require("path"));
+const package_json_1 = require("../package.json");
+const base_converter_1 = require("./base-converter");
+const CweNistMapping_1 = require("./mappings/CweNistMapping");
+const IMPACT_MAPPING = new Map([
+    ['high', 0.7],
+    ['medium', 0.5],
+    ['low', 0.3]
+]);
+const CWE_NIST_MAPPING_FILE = path_1.default.resolve(__dirname, '../data/cwe-nist-mapping.csv');
+const CWE_NIST_MAPPING = new CweNistMapping_1.CweNistMapping(CWE_NIST_MAPPING_FILE);
+const DEFAULT_NIST_TAG = ['SA-11', 'RA-5'];
+function hashId(vulnerability) {
+    if (lodash_1.default.get(vulnerability, 'id') === '') {
+        return (0, base_converter_1.generateHash)(lodash_1.default.get(vulnerability, 'summary').toString(), 'md5');
+    }
+    else {
+        return lodash_1.default.get(vulnerability, 'id');
+    }
+}
+function formatDesc(vulnerability) {
+    const text = [];
+    if (lodash_1.default.has(vulnerability, 'description')) {
+        text.push(lodash_1.default.get(vulnerability, 'description').toString());
+    }
+    if (lodash_1.default.has(vulnerability, 'cves')) {
+        const re1 = /":/gi;
+        const re2 = /,/gi;
+        text.push(`cves: ${JSON.stringify(lodash_1.default.get(vulnerability, 'cves'))
+            .replace(re1, '"=>')
+            .replace(re2, ', ')}`);
+    }
+    return text.join('<br>');
+}
+function formatCodeDesc(vulnerability) {
+    const codeDescArray = [];
+    const re = /,/gi;
+    if (lodash_1.default.has(vulnerability, 'source_comp_id')) {
+        codeDescArray.push(`source_comp_id : ${lodash_1.default.get(vulnerability, 'source_comp_id')}`);
+    }
+    else {
+        codeDescArray.push('source_comp_id : ');
+    }
+    if (lodash_1.default.has(vulnerability, 'component_versions.vulnerable_versions')) {
+        codeDescArray.push(`vulnerable_versions : ${JSON.stringify(lodash_1.default.get(vulnerability, 'component_versions.vulnerable_versions'))}`);
+    }
+    else {
+        codeDescArray.push('vulnerable_versions : ');
+    }
+    if (lodash_1.default.has(vulnerability, 'component_versions.fixed_versions')) {
+        codeDescArray.push(`fixed_versions : ${JSON.stringify(lodash_1.default.get(vulnerability, 'component_versions.fixed_versions'))}`);
+    }
+    else {
+        codeDescArray.push('fixed_versions : ');
+    }
+    if (lodash_1.default.has(vulnerability, 'issue_type')) {
+        codeDescArray.push(`issue_type : ${lodash_1.default.get(vulnerability, 'issue_type')}`);
+    }
+    else {
+        codeDescArray.push('issue_type : ');
+    }
+    if (lodash_1.default.has(vulnerability, 'provider')) {
+        codeDescArray.push(`provider : ${lodash_1.default.get(vulnerability, 'provider')}`);
+    }
+    else {
+        codeDescArray.push('provider : ');
+    }
+    return codeDescArray.join('\n').replace(re, ', ');
+}
+function parseIdentifier(identifier) {
+    const output = [];
+    if (Array.isArray(identifier)) {
+        identifier.forEach((element) => {
+            if (element.split('CWE-')[1]) {
+                output.push(element.split('CWE-')[1]);
+            }
+        });
+    }
+    return output;
+}
+function nistTag(identifier) {
+    const identifiers = parseIdentifier(identifier);
+    return CWE_NIST_MAPPING.nistFilter(identifiers, DEFAULT_NIST_TAG);
+}
+class JfrogXrayMapper extends base_converter_1.BaseConverter {
+    constructor(xrayJson) {
+        super(JSON.parse(xrayJson), true);
+        this.mappings = {
+            platform: {
+                name: 'Heimdall Tools',
+                release: package_json_1.version,
+                target_id: ''
+            },
+            version: package_json_1.version,
+            statistics: {
+                duration: null
+            },
+            profiles: [
+                {
+                    name: 'JFrog Xray Scan',
+                    version: '',
+                    title: 'JFrog Xray Scan',
+                    maintainer: null,
+                    summary: 'Continuous Security and Universal Artifact Analysis',
+                    license: null,
+                    copyright: null,
+                    copyright_email: null,
+                    supports: [],
+                    attributes: [],
+                    depends: [],
+                    groups: [],
+                    status: 'loaded',
+                    controls: [
+                        {
+                            path: 'data',
+                            key: 'id',
+                            tags: {
+                                nist: {
+                                    path: 'component_versions.more_details.cves[0].cwe',
+                                    transformer: nistTag
+                                },
+                                cweid: {
+                                    path: 'component_versions.more_details.cves[0].cwe',
+                                    transformer: parseIdentifier
+                                }
+                            },
+                            descriptions: [],
+                            refs: [],
+                            source_location: {},
+                            id: { transformer: hashId },
+                            title: { path: 'summary' },
+                            desc: {
+                                path: 'component_versions.more_details',
+                                transformer: formatDesc
+                            },
+                            impact: {
+                                path: 'severity',
+                                transformer: (0, base_converter_1.impactMapping)(IMPACT_MAPPING)
+                            },
+                            code: '',
+                            results: [
+                                {
+                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
+                                    code_desc: { transformer: formatCodeDesc },
+                                    run_time: 0,
+                                    start_time: ''
+                                }
+                            ]
+                        }
+                    ],
+                    sha256: ''
+                }
+            ]
+        };
+    }
+    setMappings(customMappings) {
+        super.setMappings(customMappings);
+    }
+}
+exports.JfrogXrayMapper = JfrogXrayMapper;
+//# sourceMappingURL=jfrog-xray-mapper.js.map

package/lib/src/jfrog-xray-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jfrog-xray-mapper.js","sourceRoot":"","sources":["../../src/jfrog-xray-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,uCAAkC;AAClC,oDAAuB;AACvB,gDAAwB;AACxB,kDAAgE;AAChE,qDAM0B;AAC1B,8DAAyD;AAGzD,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,QAAQ,EAAE,GAAG,CAAC;IACf,CAAC,KAAK,EAAE,GAAG,CAAC;CACb,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,cAAI,CAAC,OAAO,CACxC,SAAS,EACT,8BAA8B,CAC/B,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,+BAAc,CAAC,qBAAqB,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAG3C,SAAS,MAAM,CAAC,aAAsB;IACpC,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE;QACrC,OAAO,IAAA,6BAAY,EAAC,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;KACxE;SAAM;QACL,OAAO,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAW,CAAC;KAC7C;AACH,CAAC;AACD,SAAS,UAAU,CAAC,aAAsB;IACxC,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC3D;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,IAAI,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;aAClD,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;aACnB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CACxB,CAAC;KACH;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AACD,SAAS,cAAc,CAAC,aAAsB;IAC5C,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC;IACjB,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;QAC1C,aAAa,CAAC,IAAI,CAChB,oBAAoB,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAC7D,CAAC;KACH;SAAM;QACL,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;KACzC;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,wCAAwC,CAAC,EAAE;QAClE,aAAa,CAAC,IAAI,CAChB,yBAAyB,IAAI,CAAC,SAAS,CACrC,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAC/D,EAAE,CACJ,CAAC;KACH;SAAM;QACL,aAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;KAC9C;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,mCAAmC,CAAC,EAAE;QAC7D,aAAa,CAAC,IAAI,CAChB,oBAAoB,IAAI,CAAC,SAAS,CAChC,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,mCAAmC,CAAC,CAC1D,EAAE,CACJ,CAAC;KACH;SAAM;QACL,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;KACzC;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE;QACtC,aAAa,CAAC,IAAI,CAAC,gBAAgB,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;KAC1E;SAAM;QACL,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;KACrC;IACD,IAAI,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE;QACpC,aAAa,CAAC,IAAI,CAAC,cAAc,gBAAC,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;KACtE;SAAM;QACL,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;KACnC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AACD,SAAS,eAAe,CAAC,UAAmC;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC7B,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACvC;QACH,CAAC,CAAC,CAAC;KACJ;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,OAAO,CAAC,UAAmC;IAClD,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,gBAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAID,MAAa,eAAgB,SAAQ,8BAAa;IAoEhD,YAAY,QAAgB;QAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QApEpC,aAAQ,GAAqD;YAC3D,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,sBAAoB;gBAC7B,SAAS,EAAE,EAAE;aACd;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE,IAAI;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,EAAE;oBACX,KAAK,EAAE,iBAAiB;oBACxB,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,qDAAqD;oBAC9D,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,IAAI;oBACrB,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,MAAM;4BACZ,GAAG,EAAE,IAAI;4BACT,IAAI,EAAE;gCACJ,IAAI,EAAE;oCACJ,IAAI,EAAE,6CAA6C;oCACnD,WAAW,EAAE,OAAO;iCACrB;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,6CAA6C;oCACnD,WAAW,EAAE,eAAe;iCAC7B;6BACF;4BACD,YAAY,EAAE,EAAE;4BAChB,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,EAAE,EAAE,EAAC,WAAW,EAAE,MAAM,EAAC;4BACzB,KAAK,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC;4BACxB,IAAI,EAAE;gCACJ,IAAI,EAAE,iCAAiC;gCACvC,WAAW,EAAE,UAAU;6BACxB;4BACD,MAAM,EAAE;gCACN,IAAI,EAAE,UAAU;gCAChB,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;6BAC3C;4BACD,IAAI,EAAE,EAAE;4BACR,OAAO,EAAE;gCACP;oCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;oCAC3C,SAAS,EAAE,EAAC,WAAW,EAAE,cAAc,EAAC;oCACxC,QAAQ,EAAE,CAAC;oCACX,UAAU,EAAE,EAAE;iCACf;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;SACF,CAAC;IAGF,CAAC;IACD,WAAW,CACT,cAAgE;QAEhE,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AA5ED,0CA4EC"}

package/lib/src/mappings/CciNistMapping.d.ts

@@ -0,0 +1,6 @@
+import { CciNistMappingItem } from './CciNistMappingItem';
+export declare class CciNistMapping {
+    data: CciNistMappingItem[];
+    constructor(xmlDataPath: string);
+    nistFilter(identifiers: string[], defaultNist: string[], collapse?: boolean): string[];
+}

package/lib/src/mappings/CciNistMapping.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CciNistMapping = void 0;
+const fast_xml_parser_1 = __importDefault(require("fast-xml-parser"));
+const fs_1 = __importDefault(require("fs"));
+const lodash_1 = __importDefault(require("lodash"));
+const CciNistMappingItem_1 = require("./CciNistMappingItem");
+const options = {
+    attributeNamePrefix: '',
+    textNodeName: 'text',
+    ignoreAttributes: false
+};
+class CciNistMapping {
+    constructor(xmlDataPath) {
+        this.data = [];
+        const tags = lodash_1.default.get(fast_xml_parser_1.default.parse(fs_1.default.readFileSync(xmlDataPath, { encoding: 'utf-8' }), options), 'cci_list.cci_items.cci_item');
+        if (Array.isArray(tags)) {
+            tags.forEach((element) => {
+                let path = '';
+                if (Array.isArray(lodash_1.default.get(element, 'references.reference'))) {
+                    path = 'references.reference[2].index';
+                    if (lodash_1.default.get(element, path) === null ||
+                        lodash_1.default.get(element, path) === undefined) {
+                        path = 'references.reference[0].index';
+                    }
+                }
+                else {
+                    path = 'references.reference.index';
+                }
+                this.data.push(new CciNistMappingItem_1.CciNistMappingItem(lodash_1.default.get(element, 'id'), lodash_1.default.get(element, path)));
+            });
+        }
+    }
+    nistFilter(identifiers, defaultNist, collapse = true) {
+        const DEFAULT_NIST_TAG = defaultNist;
+        const matches = [];
+        identifiers.forEach((id) => {
+            const item = this.data.find((element) => element.cci === id);
+            if (item && item.nistId) {
+                if (collapse) {
+                    if (matches.indexOf(item.nistId) === -1) {
+                        matches.push(item.nistId);
+                    }
+                }
+                else {
+                    matches.push(item.nistId);
+                }
+            }
+        });
+        if (matches.length === 0) {
+            return DEFAULT_NIST_TAG;
+        }
+        return matches;
+    }
+}
+exports.CciNistMapping = CciNistMapping;
+//# sourceMappingURL=CciNistMapping.js.map

package/lib/src/mappings/CciNistMapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CciNistMapping.js","sourceRoot":"","sources":["../../../src/mappings/CciNistMapping.ts"],"names":[],"mappings":";;;;;;AAAA,sEAAqC;AACrC,4CAAoB;AACpB,oDAAuB;AACvB,6DAAwD;AAExD,MAAM,OAAO,GAAG;IACd,mBAAmB,EAAE,EAAE;IACvB,YAAY,EAAE,MAAM;IACpB,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF,MAAa,cAAc;IAGzB,YAAY,WAAmB;QAC7B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,gBAAC,CAAC,GAAG,CAChB,yBAAM,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EAAC,QAAQ,EAAE,OAAO,EAAC,CAAC,EAAE,OAAO,CAAC,EACxE,6BAA6B,CAC9B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBACvB,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE;oBACzD,IAAI,GAAG,+BAA+B,CAAC;oBACvC,IACE,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI;wBAC7B,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,SAAS,EAClC;wBACA,IAAI,GAAG,+BAA+B,CAAC;qBACxC;iBACF;qBAAM;oBACL,IAAI,GAAG,4BAA4B,CAAC;iBACrC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CACZ,IAAI,uCAAkB,CAAC,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,gBAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CACnE,CAAC;YACJ,CAAC,CAAC,CAAC;SACJ;IACH,CAAC;IAED,UAAU,CACR,WAAqB,EACrB,WAAqB,EACrB,QAAQ,GAAG,IAAI;QAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC;QACrC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7D,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE;gBACvB,IAAI,QAAQ,EAAE;oBACZ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;wBACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;qBAC3B;iBACF;qBAAM;oBACL,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;iBAC3B;aACF;QACH,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,OAAO,gBAAgB,CAAC;SACzB;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAtDD,wCAsDC"}